Batch 3: terminal JWT revocation, release reconciliation, CLI fail-closed + routine dependency bumps (#1838 #1837 #1738 + 8 deps)

.claude/skills/env-reference/SKILL.md

@@ -112,6 +112,10 @@ See `apps/api/.env.example` for the full list. Key variables:
 - `DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE` — Maximum terminal release rows deleted per run (default: `250`)
 - `DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS` — Minimum interval between release retention runs (default: `24`)
 - `DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY` — KV interval marker (default: `cleanup:deployment-releases:last-run`)
+- `DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED` — Kill switch for stale nonterminal compose release reconciliation (default: enabled)
+- `DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE` — Maximum stale nonterminal releases terminalized before retention pruning in one run (default: `50`)
+- `DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS` — Minimum release status age before reconciliation can mark a nonterminal release failed (default: `168`)
+- `DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS` — Recent release-event protection window for active fetch/apply work (default: `6`)
 - `COMPOSE_IMAGE_ARTIFACT_CLEANUP_BATCH_SIZE` — Maximum abandoned compose archives deleted per daily run (default: `250`)
 
 ### Guided Agent Credential Setup

.codex/config.toml

@@ -14,7 +14,7 @@ project_doc_fallback_filenames = ["CLAUDE.md"]
 # Added by SAM vm-agent for Codex ACP sessions.
 sandbox_mode = "danger-full-access"
 approval_policy = "never"
-model_reasoning_effort = "high"
+model_reasoning_effort = "xhigh"
 [mcp_servers.sam-mcp]
 url = "https://api.simple-agent-manager.org/mcp"
 bearer_token_env_var = "SAM_MCP_TOKEN"

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       go-modules: ${{ steps.filter.outputs.go-modules }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
@@ -85,7 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -95,7 +95,20 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Preflight evidence documents an agent's pre-implementation research. Dependabot
+      # opens PRs from a fixed template and cannot produce that evidence, so the check
+      # is unsatisfiable for it and leaves the whole dependency lane permanently red.
+      # The stale-binary guard below still runs for every author.
+      #
+      # Both identities are required. `user.login` is frozen when the PR is opened, and
+      # dependabot branches live in this repo rather than a fork, so anyone with push
+      # access can add a commit to an open dependabot/** branch without changing it.
+      # `github.actor` is the actor of THIS event, so a human push flips it back and the
+      # evidence check runs again. Skip only when both say dependabot.
       - name: Validate agent preflight evidence
+        if: >-
+          github.actor != 'dependabot[bot]' ||
+          github.event.pull_request.user.login != 'dependabot[bot]'
         run: pnpm quality:preflight
 
       - name: Validate no stale binary artifacts are tracked
@@ -109,7 +122,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -130,7 +143,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -153,7 +166,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -192,7 +205,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -234,7 +247,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -258,7 +271,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -282,7 +295,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -303,7 +316,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -355,7 +368,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -413,7 +426,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -454,7 +467,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -522,7 +535,7 @@ jobs:
       - name: Assert Go version
         run: go version | grep -E '^go version go1\.26\.6 '
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -551,7 +564,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -578,7 +591,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/claude.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@6b082c41935b4c8a3b8b0ef85ba4ba4d9eeb8975 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           allowed_bots: 'simple-agent-manager'

.github/workflows/codspeed.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -34,7 +34,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@0ca9cbbf4623b599a6c3ed4fc8a922942705d9f1 # v5.0.2
+        uses: CodSpeedHQ/action@4296e51e7041e24dadb86d1d6e8b9320d223dbe8 # v5.0.3
         with:
           mode: simulation
           run: pnpm --filter @simple-agent-manager/shared exec vitest bench --run

.github/workflows/d1-restore.yml

@@ -66,7 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/deploy-reusable.yml

@@ -148,7 +148,7 @@ jobs:
           fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -407,6 +407,10 @@ jobs:
           DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE }}
           DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS }}
           DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS }}
           SESSION_SNAPSHOT_PURGE_ENABLED: ${{ vars.SESSION_SNAPSHOT_PURGE_ENABLED }}
           SESSION_SNAPSHOT_PURGE_BATCH_SIZE: ${{ vars.SESSION_SNAPSHOT_PURGE_BATCH_SIZE }}
           SESSION_SNAPSHOT_RECOVERY_MAX_ATTEMPTS: ${{ vars.SESSION_SNAPSHOT_RECOVERY_MAX_ATTEMPTS }}
@@ -764,6 +768,10 @@ jobs:
           DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE }}
           DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS }}
           DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY: ${{ vars.DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS }}
+          DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS: ${{ vars.DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS }}
           SESSION_SNAPSHOT_PURGE_ENABLED: ${{ vars.SESSION_SNAPSHOT_PURGE_ENABLED }}
           SESSION_SNAPSHOT_PURGE_BATCH_SIZE: ${{ vars.SESSION_SNAPSHOT_PURGE_BATCH_SIZE }}
           SESSION_SNAPSHOT_RECOVERY_MAX_ATTEMPTS: ${{ vars.SESSION_SNAPSHOT_RECOVERY_MAX_ATTEMPTS }}

.github/workflows/deploy-www.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/deploy.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -96,7 +96,7 @@ jobs:
         with:
           ref: refs/heads/main
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/devcontainer-cache-experiments.yml

@@ -47,7 +47,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
         with:
           version: 9.15.9
 
@@ -114,7 +114,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
         with:
           version: 9.15.9
 
@@ -209,7 +209,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86
         with:
           version: 9.15.9
 

.github/workflows/do-wall-time.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/e2e-smoke.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/provision-www.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/pulumi-state-repair.yml

@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/scheduler-lifecycle.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/teardown.yml

@@ -102,7 +102,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

apps/api/.env.example

@@ -789,6 +789,10 @@ INFOMANIAK_IP_POLL_INTERVAL_MS=3000
 # DEPLOYMENT_RELEASE_RETENTION_BATCH_SIZE=250           # Max terminal release rows deleted per run
 # DEPLOYMENT_RELEASE_RETENTION_INTERVAL_HOURS=24        # Minimum hours between release retention runs
 # DEPLOYMENT_RELEASE_RETENTION_LAST_RUN_KV_KEY=cleanup:deployment-releases:last-run
+# DEPLOYMENT_RELEASE_RECONCILIATION_ENABLED=true        # Set to false to disable stale nonterminal release reconciliation
+# DEPLOYMENT_RELEASE_RECONCILIATION_BATCH_SIZE=50       # Max stale nonterminal releases terminalized per retention run
+# DEPLOYMENT_RELEASE_RECONCILIATION_STALE_HOURS=168     # Minimum status age before reconciliation (7 days)
+# DEPLOYMENT_RELEASE_RECONCILIATION_ACTIVITY_GRACE_HOURS=6 # Protect releases with recent fetch/apply events
 
 # Account Map visualization
 # ACCOUNT_MAP_MAX_ENTITIES=200                        # Max entities per type from D1 (default: 200)

apps/api/src/db/migrations/0112_deployment_release_status_updated_at.sql

@@ -0,0 +1,6 @@
+-- Track deployment release status activity so scheduled reconciliation can
+-- distinguish stale nonterminal releases from active apply/fetch work.
+ALTER TABLE deployment_releases ADD COLUMN status_updated_at TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_deployment_releases_status_updated_at
+  ON deployment_releases(status, status_updated_at);

apps/api/src/db/schema.ts

@@ -2773,6 +2773,8 @@ export const deploymentReleases = sqliteTable(
     manifest: text('manifest').notNull(),
     version: integer('version').notNull(),
     status: text('status').notNull().default('created'),
+    /** Updated whenever the control plane changes release.status. Added in migration 0112. */
+    statusUpdatedAt: text('status_updated_at'),
     // Discriminator for how the release was produced (migration 0073).
     // NULL / 'build-on-node' = manifest is a DeploymentManifest.
     // 'compose-publish' = manifest is a captured `docker compose publish`
@@ -2792,6 +2794,10 @@ export const deploymentReleases = sqliteTable(
       table.version
     ),
     sourceIdx: index('idx_deployment_releases_source').on(table.source),
+    statusUpdatedAtIdx: index('idx_deployment_releases_status_updated_at').on(
+      table.status,
+      table.statusUpdatedAt
+    ),
   })
 );