diff --git a/.github-gen/velnor-workflow.toml b/.github-gen/velnor-workflow.toml
index 2be57d0..b703345 100644
--- a/.github-gen/velnor-workflow.toml
+++ b/.github-gen/velnor-workflow.toml
@@ -1,7 +1,7 @@
 schema = 2
 [generator]
 repository = "jackin-project/jackin-dev"
-revision = "be61acbbbfb71db6b51337e547e39de049d4fc15"
+revision = "eed474c4a1d9b071fd1b5de00c769c8997398e5a"
 [policy]
 ruleset_required_status_checks = ["ci-required", "Policy"]
 ruleset_external_status_checks = ["DCO"]
diff --git a/.github/ci/.github-actions-generator-state b/.github/ci/.github-actions-generator-state
index b502622..f32846e 100644
--- a/.github/ci/.github-actions-generator-state
+++ b/.github/ci/.github-actions-generator-state
@@ -1,18 +1,18 @@
 # Generated ownership state; do not edit.
 schema = 2
 [inputs]
-config	e0b05e7602fb7a1c
+config	cb1a5640b0e573e2
 scan	86b0642f49c862b8
-generator	69
+generator	70
 [outputs]
 .github/AGENTS.md	02ebb7198c435e9b
 .github/actionlint.yaml	c642e98fce5b1906
 .github/ci/project.toml	f2239a3864054197
-.github/workflows/ci-main.yml	8b2cf2bc453561af
-.github/workflows/ci-policy.yml	f58d3e5e1827497e
-.github/workflows/ci-pr.yml	f8403d227851a4f2
-.github/workflows/ci-unit-docs.yml	69090c4b67ece6b5
-.github/workflows/maintenance.yml	ff88945f34f71efd
+.github/workflows/ci-main.yml	6dcc358cfd9bb003
+.github/workflows/ci-policy.yml	095de42e1abaf54e
+.github/workflows/ci-pr.yml	8937ce761bc0c0da
+.github/workflows/ci-unit-docs.yml	7023615966e1d195
+.github/workflows/maintenance.yml	55b33da735dcb7b7
 .github/workflows/nightly.yml	0659fbb3d6af2359
 config/fleet/velnor-host.env	d14b419216449423
 .github/CLAUDE.md	78a740c6ccf6937a
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index facea06..f25d655 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -58,11 +58,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         id: runtime
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
-          rev: be61acbbbfb71db6b51337e547e39de049d4fc15
+          rev: eed474c4a1d9b071fd1b5de00c769c8997398e5a
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=be61acbbbfb71db6b51337e547e39de049d4fc15" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=eed474c4a1d9b071fd1b5de00c769c8997398e5a" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -89,7 +89,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -108,7 +108,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-be61acbbbfb71db6b51337e547e39de049d4fc15-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-eed474c4a1d9b071fd1b5de00c769c8997398e5a-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
@@ -147,9 +147,9 @@ jobs:
           fi
           git checkout --quiet --detach "$HEAD_SHA"
       - name: Set up Velnor workflow runtime
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
-          rev: be61acbbbfb71db6b51337e547e39de049d4fc15
+          rev: eed474c4a1d9b071fd1b5de00c769c8997398e5a
           checkout-path: ${{ github.workspace }}/policy-checkout
       - name: Read declared generator pin
         id: pin
@@ -162,13 +162,13 @@ jobs:
           echo "value=$pin" >> "$GITHUB_OUTPUT"
       - name: Set up declared generator product
         id: renderer
-        if: steps.pin.outputs.value != 'be61acbbbfb71db6b51337e547e39de049d4fc15'
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        if: steps.pin.outputs.value != 'eed474c4a1d9b071fd1b5de00c769c8997398e5a'
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
           rev: ${{ steps.pin.outputs.value }}
           checkout-path: ${{ github.workspace }}/policy-checkout
       - name: Resolve declared generator product
-        if: steps.pin.outputs.value != 'be61acbbbfb71db6b51337e547e39de049d4fc15'
+        if: steps.pin.outputs.value != 'eed474c4a1d9b071fd1b5de00c769c8997398e5a'
         run: |
           set -euo pipefail
           binary="$HOME/.cache/velnor/workflow-runtime/${{ steps.renderer.outputs.closure }}/bin/velnor-workflow"
@@ -202,7 +202,7 @@ jobs:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          VELNOR_WORKFLOW_POLICY_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           velnor-workflow policy \
@@ -251,12 +251,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-be61acbbbfb71db6b51337e547e39de049d4fc15-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-eed474c4a1d9b071fd1b5de00c769c8997398e5a-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -270,7 +270,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
diff --git a/.github/workflows/ci-policy.yml b/.github/workflows/ci-policy.yml
index 684823f..a5852cf 100644
--- a/.github/workflows/ci-policy.yml
+++ b/.github/workflows/ci-policy.yml
@@ -49,9 +49,9 @@ jobs:
           fi
           git checkout --quiet --detach "$HEAD_SHA"
       - name: Set up Velnor workflow runtime
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
-          rev: be61acbbbfb71db6b51337e547e39de049d4fc15
+          rev: eed474c4a1d9b071fd1b5de00c769c8997398e5a
           checkout-path: ${{ github.workspace }}/policy-checkout
       - name: Read declared generator pin
         id: pin
@@ -64,13 +64,13 @@ jobs:
           echo "value=$pin" >> "$GITHUB_OUTPUT"
       - name: Set up declared generator product
         id: renderer
-        if: steps.pin.outputs.value != 'be61acbbbfb71db6b51337e547e39de049d4fc15'
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        if: steps.pin.outputs.value != 'eed474c4a1d9b071fd1b5de00c769c8997398e5a'
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
           rev: ${{ steps.pin.outputs.value }}
           checkout-path: ${{ github.workspace }}/policy-checkout
       - name: Resolve declared generator product
-        if: steps.pin.outputs.value != 'be61acbbbfb71db6b51337e547e39de049d4fc15'
+        if: steps.pin.outputs.value != 'eed474c4a1d9b071fd1b5de00c769c8997398e5a'
         run: |
           set -euo pipefail
           binary="$HOME/.cache/velnor/workflow-runtime/${{ steps.renderer.outputs.closure }}/bin/velnor-workflow"
@@ -104,7 +104,7 @@ jobs:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          VELNOR_WORKFLOW_POLICY_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           velnor-workflow policy \
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 1008fc3..1bbce3c 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -57,11 +57,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         id: runtime
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
-          rev: be61acbbbfb71db6b51337e547e39de049d4fc15
+          rev: eed474c4a1d9b071fd1b5de00c769c8997398e5a
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=be61acbbbfb71db6b51337e547e39de049d4fc15" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=eed474c4a1d9b071fd1b5de00c769c8997398e5a" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -88,7 +88,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -107,7 +107,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-be61acbbbfb71db6b51337e547e39de049d4fc15-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-eed474c4a1d9b071fd1b5de00c769c8997398e5a-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
@@ -140,12 +140,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-be61acbbbfb71db6b51337e547e39de049d4fc15-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-eed474c4a1d9b071fd1b5de00c769c8997398e5a-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -159,7 +159,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
diff --git a/.github/workflows/ci-unit-docs.yml b/.github/workflows/ci-unit-docs.yml
index 683f977..adfe037 100644
--- a/.github/workflows/ci-unit-docs.yml
+++ b/.github/workflows/ci-unit-docs.yml
@@ -177,12 +177,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-be61acbbbfb71db6b51337e547e39de049d4fc15-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-eed474c4a1d9b071fd1b5de00c769c8997398e5a-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -196,7 +196,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: be61acbbbfb71db6b51337e547e39de049d4fc15
+          EXPECTED_REVISION: eed474c4a1d9b071fd1b5de00c769c8997398e5a
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
@@ -342,7 +342,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: github
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index daefa02..21fb39b 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -112,12 +112,12 @@ jobs:
           echo "skip=false" >> "$GITHUB_OUTPUT"
       - name: Set up Velnor workflow runtime
         id: runtime
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@be61acbbbfb71db6b51337e547e39de049d4fc15
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@eed474c4a1d9b071fd1b5de00c769c8997398e5a
         with:
-          rev: be61acbbbfb71db6b51337e547e39de049d4fc15
+          rev: eed474c4a1d9b071fd1b5de00c769c8997398e5a
       - name: Set trusted workflow policy revision
         if: steps.retention-gate.outputs.skip != 'true'
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=be61acbbbfb71db6b51337e547e39de049d4fc15" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=eed474c4a1d9b071fd1b5de00c769c8997398e5a" >> "$GITHUB_ENV"
       - name: Sweep closed-PR merge-ref caches
         if: steps.retention-gate.outputs.skip != 'true'
         env: