diff --git a/server/src/__tests__/issue-scheduled-retry-routes.test.ts b/server/src/__tests__/issue-scheduled-retry-routes.test.ts
index 2f196d89289..ddc62e1ec8d 100644
--- a/server/src/__tests__/issue-scheduled-retry-routes.test.ts
+++ b/server/src/__tests__/issue-scheduled-retry-routes.test.ts
@@ -579,7 +579,10 @@ describeEmbeddedPostgres("issue scheduled retry routes", () => {
       const states = () => db.select({ companyId: heartbeatRuns.companyId, status: heartbeatRuns.status }).from(heartbeatRuns)
         .where(inArray(heartbeatRuns.id, work.map(row => row.id)));
       clock();
-      const coordinator = createDeliveryWorkCoordinator({ owner: db, canRun: () => true, onError: error => { throw error; } });
+      let completeFirstPass!: (result: { error: unknown } | undefined) => void;
+      const firstPassCompleted = new Promise<{ error: unknown } | undefined>(resolve => { completeFirstPass = resolve; });
+      const coordinator = createDeliveryWorkCoordinator({ owner: db, canRun: () => true,
+        onError: error => { completeFirstPass({ error }); throw error; } });
       const register = coordinator.register.bind(coordinator);
       let initial: Awaited<ReturnType<typeof states>> | undefined;
       let releaseFirstPass!: () => void;
@@ -592,6 +595,7 @@ describeEmbeddedPostgres("issue scheduled retry routes", () => {
           const cancelled = (await states()).filter(row => row.status === "cancelled");
           if (cancelled.length === 0) return result;
           initial = cancelled;
+          completeFirstPass(undefined);
           await firstPassHeld;
           return result;
         },
@@ -603,7 +607,8 @@ describeEmbeddedPostgres("issue scheduled retry routes", () => {
         work.push({ id: earlierId });
         await writeIntent({ companyId: a.companyId, retryRunId: earlierId });
         await vi.advanceTimersByTimeAsync(1000);
-        await expect.poll(() => initial).toBeDefined();
+        const firstPass = await firstPassCompleted;
+        if (firstPass) throw firstPass.error;
         expect(initial).toHaveLength(20);
         expect(new Set(initial!.map(row => row.companyId)).size).toBe(2);
         releaseFirstPass();
diff --git a/tests/runner-e2e/chat-full-catalog-testops-manifest.json b/tests/runner-e2e/chat-full-catalog-testops-manifest.json
index 9a96c67fd40..547674dfb96 100644
--- a/tests/runner-e2e/chat-full-catalog-testops-manifest.json
+++ b/tests/runner-e2e/chat-full-catalog-testops-manifest.json
@@ -1,6 +1,6 @@
 {
   "schema": "paperclip.chat-full-catalog-testops-manifest/v1",
-  "targetSha": "249b487a2d2451763913038cc009f7090580d1f1",
+  "targetSha": "c6cc59282a45ed3c79880a220f7f60aa3ac1d6a4",
   "metadataSourceSha": "de0941835cc8f0d01c982574ee258e110babdbeb",
   "profile": "runner-opencode",
   "model": "openrouter/deepseek/deepseek-v4.1-flash-1017",
@@ -172,7 +172,7 @@
       "baseTargetSha": "3b66c3c144360ddf32714a0742fd774b8ceafb16",
       "previousTargetSha": "ab2019e976076ec0eb60b026844f3d9211cb0208",
       "definitionSourceSha": "de0941835cc8f0d01c982574ee258e110babdbeb",
-      "candidateDescriptorSha256": "e9c59dade7aeffd5b23c05b66bf52ed11988a897d8a160e75d0435052733abf6",
+      "candidateDescriptorSha256": "f83a36c8aff7c933dd6b2d9f9613c1c5778e9bf742a1098c1e1abe5d9a3349b4",
       "changedDefinitionFiles": [
         {
           "path": "tests/runner-e2e/chat-scenarios/companies.yaml",
@@ -232,7 +232,7 @@
           "key": "activity.work-timeline",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.internal.v1",
-          "current": "paperclip.chat-catalog.work-timeline.v5"
+          "current": "paperclip.chat-catalog.work-timeline.v6"
         },
         {
           "key": "activity.work-timeline",
@@ -635,7 +635,7 @@
           "key": "secrets.configure-company-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.company-secret-controller-baseline.v4"
+          "current": "paperclip.chat-catalog.company-secret-controller-baseline.v5"
         },
         {
           "key": "secrets.personal-secret",
@@ -694,7 +694,7 @@
           "key": "secrets.personal-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.personal-secret.v5"
+          "current": "paperclip.chat-catalog.personal-secret.v6"
         },
         {
           "key": "skills.author-skill",
@@ -899,6 +899,30 @@
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
           "current": "paperclip.chat-catalog.team-configure.v2"
+        },
+        {
+          "key": "connection-setup.secure-api-key",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.least-scope-delivery",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.secret-proposal",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.vault-reference",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
         }
       ],
       "candidateDescriptorSnapshot": "fixtures/chat-repair-candidate-descriptors.json",
@@ -938,7 +962,7 @@
           "key": "activity.work-timeline",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.internal.v1",
-          "current": "paperclip.chat-catalog.work-timeline.v5"
+          "current": "paperclip.chat-catalog.work-timeline.v6"
         },
         {
           "key": "agents.choose-primary",
@@ -1311,7 +1335,7 @@
           "key": "secrets.configure-company-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.company-secret-controller-baseline.v4"
+          "current": "paperclip.chat-catalog.company-secret-controller-baseline.v5"
         },
         {
           "key": "secrets.personal-secret",
@@ -1381,7 +1405,7 @@
           "key": "secrets.personal-secret",
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
-          "current": "paperclip.chat-catalog.personal-secret.v5"
+          "current": "paperclip.chat-catalog.personal-secret.v6"
         },
         {
           "key": "skills.author-skill",
@@ -1630,6 +1654,30 @@
           "field": "oracleVersion",
           "previous": "paperclip.chat-catalog.external.v1",
           "current": "paperclip.chat-catalog.team-configure.v2"
+        },
+        {
+          "key": "connection-setup.secure-api-key",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.least-scope-delivery",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.secret-proposal",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
+        },
+        {
+          "key": "secrets.vault-reference",
+          "field": "oracleVersion",
+          "previous": "paperclip.chat-catalog.external.v1",
+          "current": "paperclip.chat-catalog.external.v2"
         }
       ],
       "runtimeConditions": {
@@ -1745,7 +1793,7 @@
       },
       "candidateLauncherSnapshot": {
         "path": "fixtures/chat-repair-candidate-launcher.txt",
-        "targetSha": "249b487a2d2451763913038cc009f7090580d1f1",
+        "targetSha": "c6cc59282a45ed3c79880a220f7f60aa3ac1d6a4",
         "sourcePath": "tests/runner-e2e/launch.ts",
         "gitBlobOid": "dba1467e211611f37937e9e1fc4c0c5be4329cbc"
       }
@@ -2288,7 +2336,7 @@
         "activity/timeline"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.work-timeline.v5",
+      "oracleVersion": "paperclip.chat-catalog.work-timeline.v6",
       "sourceFiles": [
         "chat-catalog-domains/internal-definition.ts",
         "chat-catalog-domains/internal-support.ts",
@@ -6510,7 +6558,7 @@
         "connection-setup/credentials"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.external.v1",
+      "oracleVersion": "paperclip.chat-catalog.external.v2",
       "sourceFiles": [
         "chat-catalog-domains/external-secure-key.ts",
         "chat-query-attachments.ts",
@@ -11080,7 +11128,7 @@
         "connection-setup/credentials"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.company-secret-controller-baseline.v4",
+      "oracleVersion": "paperclip.chat-catalog.company-secret-controller-baseline.v5",
       "sourceFiles": [
         "chat-catalog-domains/external-company-secret.ts",
         "chat-catalog-domains/external-secret-question.ts",
@@ -11132,7 +11180,7 @@
         "secrets/runtime-delivery"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.external.v1",
+      "oracleVersion": "paperclip.chat-catalog.external.v2",
       "sourceFiles": [
         "chat-catalog-domains/external-secret-delivery.ts",
         "chat-catalog-domains/external-secret-endpoint.ts",
@@ -11196,7 +11244,7 @@
         "secrets/user-secrets"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.personal-secret.v5",
+      "oracleVersion": "paperclip.chat-catalog.personal-secret.v6",
       "sourceFiles": [
         "chat-catalog-domains/external-personal-secret.ts",
         "chat-catalog-domains/external-secret-question.ts",
@@ -11257,7 +11305,7 @@
         "secrets/proposals"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.external.v1",
+      "oracleVersion": "paperclip.chat-catalog.external.v2",
       "sourceFiles": [
         "chat-catalog-domains/external-secret-proposal.ts",
         "chat-catalog-domains/external-secret-scan.ts",
@@ -11320,7 +11368,7 @@
         "secrets/vault-import"
       ],
       "checks": null,
-      "oracleVersion": "paperclip.chat-catalog.external.v1",
+      "oracleVersion": "paperclip.chat-catalog.external.v2",
       "sourceFiles": [
         "chat-catalog-domains/external-vault-reference.ts",
         "chat-catalog-domains/external-fixtures.ts",
diff --git a/tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs b/tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs
index bc9d6342819..a7853cc9aa8 100644
--- a/tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs
+++ b/tests/runner-e2e/chat-full-catalog-testops-manifest.test.mjs
@@ -103,7 +103,7 @@ test('repair source metadata binds the corrected candidate and explicit changed
   const repair = manifest.source.repairMetadata;
   assert.equal(repair.baseTargetSha, '3b66c3c144360ddf32714a0742fd774b8ceafb16');
   assert.equal(repair.previousTargetSha, 'ab2019e976076ec0eb60b026844f3d9211cb0208');
-  assert.equal(manifest.targetSha, '249b487a2d2451763913038cc009f7090580d1f1');
+  assert.equal(manifest.targetSha, 'c6cc59282a45ed3c79880a220f7f60aa3ac1d6a4');
   assert.equal(repair.definitionSourceSha, manifest.metadataSourceSha);
   assert.equal(repair.candidateDescriptorSnapshot, 'fixtures/chat-repair-candidate-descriptors.json');
   const descriptorBytes = readFileSync(new URL(repair.candidateDescriptorSnapshot, import.meta.url));
@@ -295,14 +295,30 @@ test('repair source metadata binds the corrected candidate and explicit changed
   [
     "teams.configure-team",
     "oracleVersion"
+  ],
+  [
+    "connection-setup.secure-api-key",
+    "oracleVersion"
+  ],
+  [
+    "secrets.least-scope-delivery",
+    "oracleVersion"
+  ],
+  [
+    "secrets.secret-proposal",
+    "oracleVersion"
+  ],
+  [
+    "secrets.vault-reference",
+    "oracleVersion"
   ]
 ]);
   for (const change of repair.changedFields) {
     assert.deepEqual(row(change.key)[change.field], change.current);
     assert.notDeepEqual(change.current, change.previous);
   }
-  assert.equal(repair.descriptorChanges.length, 44);
-  assert.equal(new Set(repair.descriptorChanges.map(change => change.key)).size, 28);
+  assert.equal(repair.descriptorChanges.length, 48);
+  assert.equal(new Set(repair.descriptorChanges.map(change => change.key)).size, 32);
   assert.deepEqual([...new Set(repair.descriptorChanges.map(change => change.field))].sort(), ['expectedRunCount', 'minimumRunCount', 'oracleVersion', 'setupPolicy', 'sourceFiles']);
   for (const change of repair.descriptorChanges) {
     assert.notDeepEqual(change.current, change.previous);
diff --git a/tests/runner-e2e/fixtures/chat-repair-candidate-descriptors.json b/tests/runner-e2e/fixtures/chat-repair-candidate-descriptors.json
index ec69e699e25..d14ae9b3a2f 100644
--- a/tests/runner-e2e/fixtures/chat-repair-candidate-descriptors.json
+++ b/tests/runner-e2e/fixtures/chat-repair-candidate-descriptors.json
@@ -258,7 +258,7 @@
       "../../server/src/services/native-runtime/status-decision-committer.ts",
       "../../server/src/services/work-timeline.ts"
     ],
-    "oracleVersion": "paperclip.chat-catalog.work-timeline.v5",
+    "oracleVersion": "paperclip.chat-catalog.work-timeline.v6",
     "coverageGaps": [],
     "expectedRunCount": 3,
     "minimumRunCount": 3,
@@ -2599,7 +2599,7 @@
       "chat-catalog-domains/identity-support.ts",
       "chat-scenarios/connection-setup.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.external.v1",
+    "oracleVersion": "paperclip.chat-catalog.external.v2",
     "expectedRunCount": 1,
     "turnTimeoutMs": 120000,
     "attemptTimeoutMs": 420000,
@@ -4905,7 +4905,7 @@
       "chat-flow.ts",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.company-secret-controller-baseline.v4",
+    "oracleVersion": "paperclip.chat-catalog.company-secret-controller-baseline.v5",
     "expectedRunCount": 2,
     "expectedHumanMessageCount": 2,
     "turnTimeoutMs": 120000,
@@ -4944,7 +4944,7 @@
       "../../packages/plugins/sdk/dist/index.js",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.external.v1",
+    "oracleVersion": "paperclip.chat-catalog.external.v2",
     "expectedRunCount": 3,
     "expectedHumanMessageCount": 1,
     "minimumRunCount": 3,
@@ -4981,7 +4981,7 @@
       "../../ui/src/pages/secrets/SetMyUserSecretDialog.tsx",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.personal-secret.v5",
+    "oracleVersion": "paperclip.chat-catalog.personal-secret.v6",
     "expectedRunCount": 3,
     "expectedHumanMessageCount": 2,
     "minimumRunCount": 3,
@@ -5013,7 +5013,7 @@
       "../../server/src/services/secret-proposal-notifications.ts",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.external.v1",
+    "oracleVersion": "paperclip.chat-catalog.external.v2",
     "expectedRunCount": 4,
     "expectedHumanMessageCount": 4,
     "minimumRunCount": 4,
@@ -5061,7 +5061,7 @@
       "../../ui/src/pages/secrets/ImportFromVaultDialog.tsx",
       "chat-scenarios/secrets.yaml"
     ],
-    "oracleVersion": "paperclip.chat-catalog.external.v1",
+    "oracleVersion": "paperclip.chat-catalog.external.v2",
     "expectedRunCount": 3,
     "expectedHumanMessageCount": 2,
     "minimumRunCount": 2,