feat: harden deployment and worker operations

backend/src/databaseMigrations/0008WorkerControl.ts

@@ -0,0 +1,16 @@
+import type { DatabaseMigration } from "./types.ts";
+
+export const workerControlMigration: DatabaseMigration = {
+    version: 8,
+    name: "worker-control",
+    sql: `
+CREATE TABLE job_worker_control (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    claims_paused INTEGER NOT NULL DEFAULT 0 CHECK (claims_paused IN (0, 1)),
+    updated_at TEXT NOT NULL
+);
+
+INSERT INTO job_worker_control (id, claims_paused, updated_at)
+VALUES (1, 0, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'));
+`,
+};

backend/src/databaseMigrations/index.ts

@@ -5,6 +5,7 @@ import { maintenanceCoverageMigration } from "./0004MaintenanceCoverage.ts";
 import { auditEventsMigration } from "./0005AuditEvents.ts";
 import { multiFactorAuthenticationMigration } from "./0006MultiFactorAuthentication.ts";
 import { deploymentRetentionIndexMigration } from "./0007DeploymentRetentionIndex.ts";
+import { workerControlMigration } from "./0008WorkerControl.ts";
 import type { DatabaseMigration } from "./types.ts";
 
 export const databaseMigrations: readonly DatabaseMigration[] = [
@@ -15,6 +16,7 @@ export const databaseMigrations: readonly DatabaseMigration[] = [
     auditEventsMigration,
     multiFactorAuthenticationMigration,
     deploymentRetentionIndexMigration,
+    workerControlMigration,
 ];
 
 export interface DatabaseMigrationIdentity {

backend/src/databaseSchemaCompatibility.ts

@@ -9,7 +9,7 @@ const CURRENT_DATABASE_SCHEMA_VERSION = databaseMigrations.at(-1)?.version ?? 0;
  * remain bounded by the live schema.
  */
 export const DASHBOARD_DATABASE_SCHEMA_COMPATIBILITY = Object.freeze({
-    maximum: 7,
+    maximum: 8,
     minimum: 6,
     target: CURRENT_DATABASE_SCHEMA_VERSION,
 });

backend/src/managedBunRuntime.ts

@@ -14,7 +14,6 @@ const RETIRED_RUNTIME_DIRECTORY_PATTERN =
     /^\.retired-[\da-f]{8}-[\da-f]{4}-7[\da-f]{3}-[89ab][\da-f]{3}-[\da-f]{12}$/u;
 const RUNTIME_CHECK_TIMEOUT_MS = 5000;
 let currentRuntimeIdentity: string | undefined;
-let currentRuntimeVersion: string | undefined;
 
 export interface ManagedBunRuntimeInstallOptions {
     runtimeRoot?: string;
@@ -116,20 +115,11 @@ function isSingleLinkRegularExecutable(filePath: string): boolean {
     }
 }
 
-/**
- * Reads a Bun executable's strict version without inheriting application secrets.
- * @param executablePath Absolute executable path.
- * @param argument Bun identity flag.
- * @returns Reported Bun version, or undefined when verification fails.
- */
-function bunExecutableReportedIdentity(
-    executablePath: string,
-    argument: "--revision" | "--version"
-): string | undefined {
+function readBunRevisionIdentity(executablePath: string): string | undefined {
     if (!isCanonicalRegularExecutable(executablePath)) {
         return undefined;
     }
-    const result = spawnSync(executablePath, [argument], {
+    const result = spawnSync(executablePath, ["--revision"], {
         encoding: "utf8",
         env: {
             LANG: "C",
@@ -151,7 +141,7 @@ function bunExecutableReportedIdentity(
  * @returns Revision-qualified Bun identity, or undefined when verification fails.
  */
 export function bunExecutableRuntimeIdentity(executablePath: string): string | undefined {
-    return bunExecutableReportedIdentity(executablePath, "--revision");
+    return readBunRevisionIdentity(executablePath);
 }
 
 /**
@@ -169,7 +159,7 @@ export function currentBunRuntimeIdentity(): string {
 }
 
 /**
- * Checks an executable against either a revision-qualified or legacy version identity.
+ * Checks an executable against its revision-qualified release identity.
  * @param executablePath Absolute executable path.
  * @param identity Release-manifest Bun identity.
  * @returns Whether the executable exactly satisfies the release identity.
@@ -181,27 +171,19 @@ export function bunExecutableMatchesRuntime(
     if (!isBunRuntimeVersion(identity)) {
         return false;
     }
-    return (
-        bunExecutableRuntimeIdentity(executablePath) === identity ||
-        bunExecutableReportedIdentity(executablePath, "--version") === identity
-    );
+    return bunExecutableRuntimeIdentity(executablePath) === identity;
 }
 
 /**
  * Checks whether an identity matches the Bun process running Dashboard.
  * @param identity Release-manifest Bun identity.
- * @returns Whether the current process satisfies the exact or legacy identity.
+ * @returns Whether the current process satisfies the exact identity.
  */
 export function isCurrentBunRuntime(identity: string): boolean {
     if (!isBunRuntimeVersion(identity)) {
         return false;
     }
-    const revision = currentBunRuntimeIdentity();
-    currentRuntimeVersion ??= bunExecutableReportedIdentity(
-        process.execPath,
-        "--version"
-    );
-    return identity === revision || identity === currentRuntimeVersion;
+    return identity === currentBunRuntimeIdentity();
 }
 
 /**