From 57c4c76f99f3329754037a9207a9ce61bb63d39f Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 10:09:44 +0000
Subject: [PATCH 1/3] docs(webhooks): document signing secret rotation grace
 period

---
 docs/v3-openapi.yaml      | 43 ++++++++++++++++++++++++++++++++++++---
 docs/webhooks/connect.mdx |  6 +++++-
 docs/webhooks/sources.mdx |  2 ++
 3 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/docs/v3-openapi.yaml b/docs/v3-openapi.yaml
index 1a9cfa5c31e..e09cc060120 100644
--- a/docs/v3-openapi.yaml
+++ b/docs/v3-openapi.yaml
@@ -4933,8 +4933,24 @@ paths:
 
         Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers
         where you choose the secret, such as GitHub. It replaces any existing secret, so deliveries fail
-        verification until the provider uses the new one. Endpoints whose source verifies with a public key
-        refuse this; set the provider's key with the set secret endpoint instead.
+        verification until the provider uses the new one, unless you pass `previousSecretTtlSeconds` to keep
+        the old secret valid for a while. Endpoints whose source verifies with a public key refuse this; set the
+        provider's key with the set secret endpoint instead.
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                previousSecretTtlSeconds:
+                  type: integer
+                  minimum: 0
+                  maximum: 604800
+                  description: >-
+                    How many seconds the replaced secret keeps verifying deliveries, up to 7 days. Omit or pass
+                    `0` to stop accepting the old secret immediately.
+                  example: 86400
       responses:
         "200":
           description: Successful request
@@ -4972,7 +4988,8 @@ paths:
         **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
 
         Store the signing secret or public key the provider issued for this endpoint, such as the `whsec_`
-        secret Stripe returns when you create a webhook endpoint. It replaces any existing secret.
+        secret Stripe returns when you create a webhook endpoint. It replaces any existing secret. Pass
+        `previousSecretTtlSeconds` to keep the old one valid for a while.
       requestBody:
         required: true
         content:
@@ -4988,6 +5005,14 @@ paths:
                   maxLength: 4096
                   description: The signing secret or public key. Leading and trailing whitespace is trimmed.
                   example: whsec_5f2b...
+                previousSecretTtlSeconds:
+                  type: integer
+                  minimum: 0
+                  maximum: 604800
+                  description: >-
+                    How many seconds the replaced secret keeps verifying deliveries, up to 7 days. Omit or pass
+                    `0` to stop accepting the old secret immediately.
+                  example: 86400
       responses:
         "200":
           description: Successful request
@@ -5884,6 +5909,12 @@ components:
           type: string
           description: The new signing secret. It is returned only in this response and can't be read again.
           example: whsec_5f2b...
+        previousSecretExpiresAt:
+          type: string
+          format: date-time
+          description: >-
+            When the replaced secret stops verifying deliveries. Present only when `previousSecretTtlSeconds`
+            kept the old secret valid.
     SetWebhookEndpointSecretResponse:
       type: object
       required: [id, secretSet]
@@ -5895,6 +5926,12 @@ components:
         secretSet:
           type: boolean
           const: true
+        previousSecretExpiresAt:
+          type: string
+          format: date-time
+          description: >-
+            When the replaced secret stops verifying deliveries. Present only when `previousSecretTtlSeconds`
+            kept the old secret valid.
     WebhookDeliveryStatus:
       type: string
       enum: [pending, processing, succeeded, failed, filtered, unmatched]
diff --git a/docs/webhooks/connect.mdx b/docs/webhooks/connect.mdx
index 0f429810193..0c09270e907 100644
--- a/docs/webhooks/connect.mdx
+++ b/docs/webhooks/connect.mdx
@@ -78,7 +78,11 @@ The verify token answers the URL check. The signing secret verifies event delive
 
 Choose **Rotate signing secret** to replace a provider-supplied secret. For a secret you generate, choose **Regenerate secret**, copy the new value, and update the provider's configuration. Use **Rotate public key** when replacing an asymmetric provider's key.
 
+The rotate and regenerate dialogs include **Keep accepting the old signing secret for** (or the old public key). Trigger.dev keeps verifying deliveries signed with the old credential until that time passes, so you can update the provider without failing deliveries. Choose **1 hour**, **24 hours** (the default) or **7 days**. Choose **Stop immediately** if the old credential leaked.
+
+Over the API, pass `previousSecretTtlSeconds` (up to `604800`, 7 days) to [generate a secret](/management/webhooks/generate-secret) or [set a secret](/management/webhooks/set-secret). The response includes `previousSecretExpiresAt`. Without `previousSecretTtlSeconds`, the old secret stops verifying immediately.
+
 <Warning>
   Trigger.dev stores credentials encrypted and doesn't display saved values. Copy a generated secret
-  before closing the dialog. Deliveries signed with the old secret fail verification after rotation.
+  before closing the dialog.
 </Warning>
diff --git a/docs/webhooks/sources.mdx b/docs/webhooks/sources.mdx
index 574a812fb88..989343a9a35 100644
--- a/docs/webhooks/sources.mdx
+++ b/docs/webhooks/sources.mdx
@@ -150,6 +150,8 @@ export const internalEvents = webhook({
 });
 ```
 
+To accept a signature from more than one header, list the extra headers in `additionalSignatureHeaders` (up to 4). Trigger.dev parses them like `signatureHeader` and accepts a match in any of them. This keeps deliveries verifying when a provider sends a second signature during a secret rotation, such as Hookdeck's `x-hookdeck-signature-2`. `signatureHeader` is still required.
+
 The optional `setupPrompt` is the provider-specific part of the endpoint's [setup prompt](/webhooks/connect#set-it-up-with-an-ai-agent): where the provider's webhook settings are and how to register a URL there. Trigger.dev adds the URL, the subscribers' filters and the signing secret steps around it.
 
 ### Form-encoded bodies

From dbc030cd8f7931661a6238942767d72ff412a089 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 09:12:44 +0000
Subject: [PATCH 2/3] docs(webhooks): trim to additionalSignatureHeaders,
 rotation docs landed on main

---
 .changeset/chat-agent-telemetry-default.md    |   5 +
 .changeset/webhook-secret-grace-option.md     |   6 +
 .changeset/webhooks-hookdeck-source.md        |   6 +
 .github/workflows/changesets-pr.yml           |   2 +-
 .github/workflows/claude.yml                  |   2 +-
 .github/workflows/code-quality.yml            |   2 +-
 .github/workflows/e2e-webapp-auth-full.yml    |   2 +-
 .github/workflows/e2e-webapp.yml              |   2 +-
 .github/workflows/e2e.yml                     |   2 +-
 .github/workflows/fk-cascade-guard.yml        |   2 +-
 .github/workflows/migration-guard.yml         |   2 +-
 .github/workflows/observability-map.yml       |   4 +-
 .github/workflows/preview-packages.yml        |   2 +-
 .github/workflows/release.yml                 |   4 +-
 .github/workflows/runops-guard.yml            |   2 +-
 .github/workflows/sdk-compat.yml              |   8 +-
 .github/workflows/typecheck.yml               |   2 +-
 .github/workflows/unit-tests-internal.yml     |   4 +-
 .../unit-tests-observability-map.yml          |   2 +-
 .github/workflows/unit-tests-packages.yml     |   4 +-
 .github/workflows/unit-tests-webapp.yml       |   4 +-
 .nvmrc                                        |   2 +-
 .../alerts-create-without-agent.md            |   6 +
 .../legacy-slack-deleted-integration.md       |   6 +
 ...evoke-previous-root-api-key-immediately.md |   6 +
 .server-changes/trigger-dashboard-url.md      |   6 +
 CONTRIBUTING.md                               |   4 +-
 apps/supervisor/.nvmrc                        |   2 +-
 apps/supervisor/Containerfile                 |   2 +-
 .../components/alerts/LegacyAlertsSection.tsx |   8 +-
 .../alerts/ManualAlertCreation.dom.test.ts    | 256 +++++++++++++++++
 .../components/alerts/ManualAlertCreation.tsx | 272 ++++++++++++++++++
 .../ManualAlertCreationDock.dom.test.ts       | 159 ++++++++++
 .../components/alerts/createAlertRequest.ts   |  68 +++++
 .../dashboard-agent/DashboardAgentHeader.tsx  | 134 ++++-----
 .../dashboard-agent/DashboardPanelChrome.tsx  |  39 +++
 .../environments/RegenerateApiKeyModal.tsx    |  23 +-
 .../app/components/navigation/SideMenu.tsx    |   3 +-
 .../navigation/sideMenuSections.tsx           |   5 +-
 apps/webapp/app/features.server.ts            |   3 +
 apps/webapp/app/hooks/useFeatures.ts          |   1 +
 apps/webapp/app/models/api-key.server.ts      |  22 +-
 .../route.createPrefill.render.test.tsx       | 114 +++++++-
 .../route.tsx                                 | 119 +++++---
 .../route.replace.render.test.tsx             | 140 +++++++++
 .../route.tsx                                 |  86 ++++--
 .../route.tsx                                 |   9 +-
 .../app/routes/account._index/route.tsx       |  24 +-
 ...cts.$projectRef.$env.regenerate-api-key.ts |  23 ++
 ...oks.endpoints.$endpointId.rotate-secret.ts |  11 +-
 ...1.webhooks.endpoints.$endpointId.secret.ts |   7 +-
 ...ents.$environmentId.regenerate-api-key.tsx |   7 +-
 apps/webapp/app/v3/canUseAlertsList.server.ts |   7 +-
 apps/webapp/app/v3/canUseAlertsList.test.ts   |  12 +-
 apps/webapp/app/v3/canUseAlertsList.ts        |  12 +-
 .../environmentVariablesRepository.server.ts  |   4 +
 apps/webapp/app/v3/featureFlags.ts            |   2 +
 apps/webapp/app/v3/invocationUsage.server.ts  |   3 +
 apps/webapp/app/v3/runEngine.server.ts        |   6 +
 .../webapp/app/v3/runEngineHandlers.server.ts |   3 +-
 .../services/alerts/alertTransport.server.ts  |  19 +-
 .../v3/services/alerts/deliverAlert.server.ts |  12 +-
 .../deliverDashboardAgentWatchAlert.server.ts |  12 +-
 .../alerts/deliverErrorGroupAlert.server.ts   |  27 +-
 .../findSlackIntegration.server.test.ts       |  57 ++++
 .../v3/utils/waitpointStoreEnabled.server.ts  |  26 ++
 apps/webapp/app/v3/webhookSetupPrompt.ts      |   2 +-
 apps/webapp/app/v3/webhookSigningSecret.ts    |   9 -
 apps/webapp/test/alertsGateRoutes.test.ts     |  22 +-
 .../webapp/test/alertsListRouteLegacy.test.ts |   3 +
 apps/webapp/test/alertsRequireEnabled.test.ts |  19 +-
 apps/webapp/test/api-auth.e2e.test.ts         |  34 +++
 .../test/canUseMonitoringAlerts.test.ts       |   9 +-
 .../test/dashboardAgentAlertsGate.test.ts     |  19 +-
 .../dashboardAgentMonitoringAlerts.test.ts    |   1 +
 .../test/helpers/seedTestUserProject.ts       |   3 +
 apps/webapp/test/invocationUsage.test.ts      |  18 ++
 apps/webapp/test/monitoringAlertsApi.test.ts  |   4 +
 apps/webapp/test/regenerateApiKey.test.ts     |  70 +++++
 .../regenerateApiKeyBranch.e2e.full.test.ts   |  63 +++-
 apps/webapp/test/sideMenuSections.test.ts     |   3 +
 apps/webapp/test/waitpointRollout.test.ts     |  35 +++
 apps/webapp/test/webhookSetupPrompt.test.ts   |   3 +-
 apps/webapp/test/webhookSigningSecret.test.ts |   9 +-
 base-images/images.json                       |   6 +-
 docker/Dockerfile                             |   2 +-
 docs/ai-chat/backend.mdx                      |   6 +-
 docs/ai-chat/patterns/redacting-telemetry.mdx |  10 +-
 docs/ai-chat/pending-messages.mdx             |   2 +-
 docs/ai-chat/reference.mdx                    |   8 +-
 docs/apikeys.mdx                              |   2 +-
 docs/guides/examples/hookdeck-webhook.mdx     | 105 ++++---
 docs/mcp-tools.mdx                            |   4 -
 docs/snippets/webhooks-beta-banner.mdx        |   7 -
 docs/snippets/webhooks-beta-note.mdx          |   4 -
 docs/v3-openapi.yaml                          |  75 ++---
 docs/webhooks/channels.mdx                    |   4 -
 docs/webhooks/connect.mdx                     |  19 +-
 docs/webhooks/deliveries.mdx                  |   6 +-
 docs/webhooks/filters.mdx                     |   4 -
 docs/webhooks/human-in-the-loop.mdx           |   4 -
 docs/webhooks/linear.mdx                      |   4 -
 docs/webhooks/overview.mdx                    |   4 -
 docs/webhooks/session-routing.mdx             |   4 -
 docs/webhooks/slack.mdx                       |   4 -
 docs/webhooks/sources.mdx                     |  36 ++-
 docs/webhooks/waiters.mdx                     |   4 -
 .../run-engine/src/engine/index.ts            |   1 +
 .../completedWaitpointRecordAdapter.test.ts   | 209 ++++++++++++++
 .../completedWaitpointRecordAdapter.ts        | 251 ++++++++++++++++
 .../completedWaitpointResolver.test.ts        | 118 +++++++-
 .../systems/completedWaitpointResolver.ts     |  53 +++-
 .../redisPrimaryCompletionAssociation.test.ts | 174 ++++++++++-
 .../engine/systems/waitpointResultRunStore.ts |  52 ++++
 .../engine/systems/waitpointSystem.test.ts    |  73 ++++-
 .../src/engine/systems/waitpointSystem.ts     |  81 +++++-
 .../run-engine/src/engine/types.ts            |   5 +
 ...reCoordinator.readCompletedRecords.test.ts | 136 +++++++++
 .../waitpointCoordinator/storeCoordinator.ts  |  56 ++++
 internal-packages/run-engine/src/index.ts     |   7 +-
 .../completedWaitpointHydratingRunStore.ts    |  97 +++++++
 internal-packages/run-store/src/index.ts      |   1 +
 .../redisSnapshotStore.recoveryLease.test.ts  |   9 +-
 ...tionSnapshotStore.resolverLaziness.test.ts | 123 ++++++++
 .../src/taskRunExecutionSnapshotStore.ts      |  18 +-
 .../webhook-sources/catalog/providers.json    |  21 ++
 .../src/handAuthored/hookdeck.ts              |  67 +++++
 .../webhook-sources/src/handAuthored/index.ts |   2 +
 .../src/providerSignatures.test.ts            |  58 ++++
 .../webhook-sources/src/registry/hookdeck.ts  |  19 ++
 .../webhook-sources/src/registry/index.ts     |   2 +
 packages/cli-v3/src/mcp/config.ts             |   4 +-
 packages/cli-v3/src/mcp/tools/webhooks.ts     |  40 ++-
 packages/core/src/v3/apiClient/index.ts       |   9 +-
 packages/core/src/v3/schemas/webhookApi.ts    |  25 ++
 packages/core/src/v3/webhooks/index.ts        |  34 +++
 packages/core/test/runStream.test.ts          |  24 +-
 packages/trigger-sdk/src/v3/ai.ts             |  22 +-
 packages/trigger-sdk/src/v3/webhooks.ts       |  25 +-
 .../trigger-sdk/test/bound-streamtext.test.ts |  86 ++++++
 140 files changed, 3878 insertions(+), 512 deletions(-)
 create mode 100644 .changeset/chat-agent-telemetry-default.md
 create mode 100644 .changeset/webhook-secret-grace-option.md
 create mode 100644 .changeset/webhooks-hookdeck-source.md
 create mode 100644 .server-changes/alerts-create-without-agent.md
 create mode 100644 .server-changes/legacy-slack-deleted-integration.md
 create mode 100644 .server-changes/revoke-previous-root-api-key-immediately.md
 create mode 100644 .server-changes/trigger-dashboard-url.md
 create mode 100644 apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
 create mode 100644 apps/webapp/app/components/alerts/ManualAlertCreation.tsx
 create mode 100644 apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
 create mode 100644 apps/webapp/app/components/alerts/createAlertRequest.ts
 create mode 100644 apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
 create mode 100644 apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
 create mode 100644 apps/webapp/app/v3/invocationUsage.server.ts
 create mode 100644 apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
 create mode 100644 apps/webapp/test/invocationUsage.test.ts
 create mode 100644 apps/webapp/test/regenerateApiKey.test.ts
 create mode 100644 apps/webapp/test/waitpointRollout.test.ts
 delete mode 100644 docs/snippets/webhooks-beta-banner.mdx
 delete mode 100644 docs/snippets/webhooks-beta-note.mdx
 create mode 100644 internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
 create mode 100644 internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
 create mode 100644 internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
 create mode 100644 internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
 create mode 100644 internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
 create mode 100644 internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
 create mode 100644 internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
 create mode 100644 internal-packages/webhook-sources/src/registry/hookdeck.ts

diff --git a/.changeset/chat-agent-telemetry-default.md b/.changeset/chat-agent-telemetry-default.md
new file mode 100644
index 00000000000..853de1a1b30
--- /dev/null
+++ b/.changeset/chat-agent-telemetry-default.md
@@ -0,0 +1,5 @@
+---
+"@trigger.dev/sdk": patch
+---
+
+The `streamText` passed to a `chat.agent`'s `run()` now turns AI SDK telemetry on by default, so each model step and tool call shows up as a span in the run trace even when the agent doesn't store a prompt with `chat.prompt.set()`. An agent with `telemetry: { recordUserMessage: false }` gets these spans without prompt and response content, including when it stores a prompt (whose variables are left out of the span metadata). Pass `experimental_telemetry: { isEnabled: false }` at the call site to turn them off, or `recordInputs: false` / `recordOutputs: false` to keep them without content.
diff --git a/.changeset/webhook-secret-grace-option.md b/.changeset/webhook-secret-grace-option.md
new file mode 100644
index 00000000000..7ee2f97de42
--- /dev/null
+++ b/.changeset/webhook-secret-grace-option.md
@@ -0,0 +1,6 @@
+---
+"@trigger.dev/core": patch
+"trigger.dev": patch
+---
+
+The `generate_webhook_secret` and `set_webhook_secret` MCP tools take an optional `previousSecretTtlSeconds` to keep accepting a webhook endpoint's old signing secret while the provider switches to the new one (up to 7 days), and report when the old secret stops working.
diff --git a/.changeset/webhooks-hookdeck-source.md b/.changeset/webhooks-hookdeck-source.md
new file mode 100644
index 00000000000..52590506d58
--- /dev/null
+++ b/.changeset/webhooks-hookdeck-source.md
@@ -0,0 +1,6 @@
+---
+"@trigger.dev/core": patch
+"@trigger.dev/sdk": patch
+---
+
+Add `webhooks.hookdeck()`, a source for deliveries relayed through a Hookdeck connection. It verifies the `x-hookdeck-signature` header with the project's signing secret, keeps verifying while the secret is being rolled (Hookdeck sends the previous secret's signature in `x-hookdeck-signature-2`), and deduplicates retries on `x-hookdeck-eventid`. The event is the original provider's payload, so pass its type: `webhooks.hookdeck<Stripe.Event>()`. If the Hookdeck project's header prefix was changed, pass it as `webhooks.hookdeck({ headerPrefix })` so retries keep deduplicating.
diff --git a/.github/workflows/changesets-pr.yml b/.github/workflows/changesets-pr.yml
index 8e166211fa1..1f9210192cb 100644
--- a/.github/workflows/changesets-pr.yml
+++ b/.github/workflows/changesets-pr.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 6372bb2628b..486692691f4 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -44,7 +44,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 705233e839e..637c3c990ab 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/e2e-webapp-auth-full.yml b/.github/workflows/e2e-webapp-auth-full.yml
index 8721c4bc201..989c33fd1a2 100644
--- a/.github/workflows/e2e-webapp-auth-full.yml
+++ b/.github/workflows/e2e-webapp-auth-full.yml
@@ -85,7 +85,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 🐳 Login to DockerHub
diff --git a/.github/workflows/e2e-webapp.yml b/.github/workflows/e2e-webapp.yml
index 7ef6a9b0722..e4a95335f9e 100644
--- a/.github/workflows/e2e-webapp.yml
+++ b/.github/workflows/e2e-webapp.yml
@@ -66,7 +66,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c024696e251..be6d8e81ddc 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -37,7 +37,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
 
       - name: 📥 Download deps
         run: pnpm install --frozen-lockfile --filter trigger.dev...
diff --git a/.github/workflows/fk-cascade-guard.yml b/.github/workflows/fk-cascade-guard.yml
index 1c942a3ac39..48a5a4c3674 100644
--- a/.github/workflows/fk-cascade-guard.yml
+++ b/.github/workflows/fk-cascade-guard.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/migration-guard.yml b/.github/workflows/migration-guard.yml
index 72672c9d927..6a16b5404cc 100644
--- a/.github/workflows/migration-guard.yml
+++ b/.github/workflows/migration-guard.yml
@@ -24,7 +24,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/observability-map.yml b/.github/workflows/observability-map.yml
index ba283c6f603..1f590713571 100644
--- a/.github/workflows/observability-map.yml
+++ b/.github/workflows/observability-map.yml
@@ -184,7 +184,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
@@ -244,7 +244,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/preview-packages.yml b/.github/workflows/preview-packages.yml
index ed0717c3bdd..b822c72f847 100644
--- a/.github/workflows/preview-packages.yml
+++ b/.github/workflows/preview-packages.yml
@@ -59,7 +59,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04333584916..bf48afb0ccd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -90,7 +90,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support
@@ -303,7 +303,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support
diff --git a/.github/workflows/runops-guard.yml b/.github/workflows/runops-guard.yml
index c974aa1590f..080a21e701a 100644
--- a/.github/workflows/runops-guard.yml
+++ b/.github/workflows/runops-guard.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/sdk-compat.yml b/.github/workflows/sdk-compat.yml
index 26baca286bf..2c5a65a5281 100644
--- a/.github/workflows/sdk-compat.yml
+++ b/.github/workflows/sdk-compat.yml
@@ -14,7 +14,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [warp-ubuntu-latest-x64-4x]
-        node: ["20.20", "22.23", "24.18", "26.4"]
+        node: ["20.20", "22.23.4", "24.22.1", "26.12.1"]
 
     steps:
       - name: ⬇️ Checkout repo
@@ -70,7 +70,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 🥟 Setup Bun
@@ -112,7 +112,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 🦕 Setup Deno
@@ -158,7 +158,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index e9329191d05..420ffceba3d 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: Restore Turbo cache
diff --git a/.github/workflows/unit-tests-internal.yml b/.github/workflows/unit-tests-internal.yml
index b836907e2c1..908f90d3455 100644
--- a/.github/workflows/unit-tests-internal.yml
+++ b/.github/workflows/unit-tests-internal.yml
@@ -67,7 +67,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -174,7 +174,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
 
       - name: Download blob reports
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/unit-tests-observability-map.yml b/.github/workflows/unit-tests-observability-map.yml
index 2338bb6c51a..72b971f973d 100644
--- a/.github/workflows/unit-tests-observability-map.yml
+++ b/.github/workflows/unit-tests-observability-map.yml
@@ -30,7 +30,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/unit-tests-packages.yml b/.github/workflows/unit-tests-packages.yml
index b7b8d7d01b6..2a293fb4e9e 100644
--- a/.github/workflows/unit-tests-packages.yml
+++ b/.github/workflows/unit-tests-packages.yml
@@ -66,7 +66,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -145,7 +145,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
diff --git a/.github/workflows/unit-tests-webapp.yml b/.github/workflows/unit-tests-webapp.yml
index c2c3ca54f84..22a2fd48d1c 100644
--- a/.github/workflows/unit-tests-webapp.yml
+++ b/.github/workflows/unit-tests-webapp.yml
@@ -68,7 +68,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -180,7 +180,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 24.22.1
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
diff --git a/.nvmrc b/.nvmrc
index 5bcf9c6e6ac..474d750b504 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v24.18.0
+v24.22.1
diff --git a/.server-changes/alerts-create-without-agent.md b/.server-changes/alerts-create-without-agent.md
new file mode 100644
index 00000000000..258a93ebefd
--- /dev/null
+++ b/.server-changes/alerts-create-without-agent.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Creating an alert works without the dashboard agent.
diff --git a/.server-changes/legacy-slack-deleted-integration.md b/.server-changes/legacy-slack-deleted-integration.md
new file mode 100644
index 00000000000..9dc10131151
--- /dev/null
+++ b/.server-changes/legacy-slack-deleted-integration.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Alerts sent to Slack channels connected through a removed Slack installation deliver again.
diff --git a/.server-changes/revoke-previous-root-api-key-immediately.md b/.server-changes/revoke-previous-root-api-key-immediately.md
new file mode 100644
index 00000000000..d88254905ca
--- /dev/null
+++ b/.server-changes/revoke-previous-root-api-key-immediately.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
diff --git a/.server-changes/trigger-dashboard-url.md b/.server-changes/trigger-dashboard-url.md
new file mode 100644
index 00000000000..e36e0cbdd22
--- /dev/null
+++ b/.server-changes/trigger-dashboard-url.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Runs now get a `TRIGGER_DASHBOARD_URL` environment variable with the dashboard's address, so a task can link to its run (`${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}`) on any Trigger.dev instance. A `TRIGGER_DASHBOARD_URL` you set on the project still wins.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 804c9cc5df1..88288a4b417 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -33,7 +33,7 @@ branch are tagged into a release periodically.
 
 ### Prerequisites
 
-- [Node.js](https://nodejs.org/en) version 24.18.0
+- [Node.js](https://nodejs.org/en) version 24.22.1
 - [pnpm package manager](https://pnpm.io/installation) version 10.33.2
 - [Docker](https://www.docker.com/get-started/) (Compose 2.24.4 or newer for `dev:docker`)
 - [protobuf](https://github.com/protocolbuffers/protobuf)
@@ -53,7 +53,7 @@ branch are tagged into a release periodically.
    ```
    cd trigger.dev
    ```
-3. Ensure you are on the correct version of Node.js (24.18.0). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
+3. Ensure you are on the correct version of Node.js (24.22.1). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
 
 4. Run `corepack enable` to use the correct version of pnpm (`10.33.2`) as specified in the root `package.json` file.
 
diff --git a/apps/supervisor/.nvmrc b/apps/supervisor/.nvmrc
index 5bcf9c6e6ac..474d750b504 100644
--- a/apps/supervisor/.nvmrc
+++ b/apps/supervisor/.nvmrc
@@ -1 +1 @@
-v24.18.0
+v24.22.1
diff --git a/apps/supervisor/Containerfile b/apps/supervisor/Containerfile
index 727ae6db442..a759e8f6f9d 100644
--- a/apps/supervisor/Containerfile
+++ b/apps/supervisor/Containerfile
@@ -1,4 +1,4 @@
-FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS node-24-alpine
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS node-24-alpine
 
 WORKDIR /app
 
diff --git a/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx b/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
index d70e6039f29..b5be2f10f89 100644
--- a/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
+++ b/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
@@ -1,3 +1,4 @@
+import { BellAlertIcon } from "@heroicons/react/20/solid";
 import { TrashIcon } from "~/assets/icons/TrashIcon";
 import { useState } from "react";
 import { AgentIcon } from "~/components/dashboard-agent/agent-identity";
@@ -48,6 +49,7 @@ export function LegacyAlertsSection({
   canWrite = true,
   canDelete = true,
   replacing = false,
+  manualReplace = false,
 }: {
   channels: LegacyAlertChannelRow[];
   onReplace: (row: LegacySubscriptionRow) => void;
@@ -55,6 +57,7 @@ export function LegacyAlertsSection({
   canWrite?: boolean;
   canDelete?: boolean;
   replacing?: boolean;
+  manualReplace?: boolean;
 }) {
   const [deleting, setDeleting] = useState<LegacySubscriptionRow | undefined>();
   const rows = legacySubscriptions(channels);
@@ -87,8 +90,9 @@ export function LegacyAlertsSection({
               <TableCell actionClassName="py-1.5">
                 {row.migration.kind === "replace" ? (
                   <Button
-                    variant="ask-trigger/small"
-                    LeadingIcon={AgentIcon}
+                    variant={manualReplace ? "secondary/small" : "ask-trigger/small"}
+                    LeadingIcon={manualReplace ? BellAlertIcon : AgentIcon}
+                    leadingIconClassName={manualReplace ? "text-alerts" : undefined}
                     className="whitespace-nowrap"
                     disabled={replacing || !(canWrite && (row.canWrite ?? true))}
                     onClick={() => onReplace(row)}
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts b/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
new file mode 100644
index 00000000000..e404edc6bd9
--- /dev/null
+++ b/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
@@ -0,0 +1,256 @@
+// @vitest-environment jsdom
+import type * as RemixReactModule from "@remix-run/react";
+import { createElement, useState, type ComponentProps, type ReactNode } from "react";
+import { act } from "react-dom/test-utils";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
+import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
+import type { DraftPrefillParams } from "~/components/dashboard-agent/alert-creation/flow-state";
+import { ManualAlertCreationDock } from "./ManualAlertCreation";
+
+const CURRENT_ENV_CHANNELS = [{ id: "ch1", name: "Ops webhook", type: "WEBHOOK" }];
+const PROJECT_CHANNELS = [
+  ...CURRENT_ENV_CHANNELS,
+  { id: "ch_prod", name: "Prod pager", type: "WEBHOOK" },
+];
+
+vi.mock("@remix-run/react", async (importOriginal) => ({
+  ...(await importOriginal<typeof RemixReactModule>()),
+  useInRouterContext: () => false,
+  Link: ({ to, children }: { to: string; children: ReactNode }) =>
+    createElement("a", { href: to }, children),
+  useNavigate: () => vi.fn(),
+  useLocation: () => ({ pathname: "/", search: "" }),
+  useFetcher: () => {
+    const [url, setUrl] = useState<string>();
+    return {
+      data: url?.startsWith("/resources/alerts/channels")
+        ? {
+            channels: url.includes("environmentId=") ? CURRENT_ENV_CHANNELS : PROJECT_CHANNELS,
+            canWrite: true,
+          }
+        : undefined,
+      load: setUrl,
+    };
+  },
+}));
+vi.mock("~/hooks/useOrganizations", () => ({
+  useOptionalOrganization: () => ({ slug: "org", id: "org1" }),
+  useOrganization: () => ({ slug: "org", id: "org1" }),
+}));
+vi.mock("~/hooks/useProject", () => ({
+  useOptionalProject: () => ({ slug: "proj", id: "proj1" }),
+  useProject: () => ({ slug: "proj", id: "proj1" }),
+}));
+vi.mock("~/hooks/useEnvironment", () => ({
+  useOptionalEnvironment: () => ({ slug: "prod", id: "env1", type: "PRODUCTION" }),
+  useEnvironment: () => ({ slug: "prod", id: "env1", type: "PRODUCTION" }),
+}));
+vi.mock("~/hooks/useTypedMatchData", () => ({ useTypedMatchesData: () => undefined }));
+vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
+
+const fetchMock = vi.fn(async (url: string | URL | Request) => {
+  if (String(url) === "/resources/alerts/create") {
+    return new Response(JSON.stringify({ ok: true, alertId: "a1" }));
+  }
+  if (String(url).includes("/alerts/legacy?_data=")) {
+    return new Response(
+      JSON.stringify({ count: 1, message: "Created 1 alert", legacyRemaining: false })
+    );
+  }
+  return new Response("{}");
+});
+
+Element.prototype.scrollIntoView ??= () => {};
+globalThis.ResizeObserver ??= class {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+} as unknown as typeof ResizeObserver;
+
+const fieldset = (step: string) =>
+  document.querySelector<HTMLFieldSetElement>(`fieldset[data-step="${step}"]`);
+const combobox = (step: string) =>
+  fieldset(step)?.querySelector<HTMLButtonElement>("button[role=combobox]") ?? null;
+const popover = (select: HTMLElement) =>
+  document.getElementById(select.getAttribute("aria-controls") ?? "");
+const options = (select: HTMLElement) =>
+  Array.from(popover(select)?.querySelectorAll<HTMLElement>("[role=option]") ?? []);
+const click = (el: HTMLElement) => act(() => el.click());
+const open = (select: HTMLElement) => {
+  act(() => select.focus());
+  act(() => select.click());
+};
+function pick(step: string, label: string) {
+  const select = combobox(step)!;
+  open(select);
+  const found = options(select).find((o) => o.textContent === label);
+  if (!found) throw new Error(`no ${label}: ${options(select).map((o) => o.textContent)}`);
+  click(found);
+}
+const checkbox = (step: string, label: string) =>
+  Array.from(fieldset(step)!.querySelectorAll<HTMLLabelElement>("[data-checkbox-list] label"))
+    .find((l) => l.textContent === label)!
+    .querySelector<HTMLInputElement>("input")!;
+const button = (label: string) =>
+  Array.from(document.querySelectorAll<HTMLButtonElement>("button")).find(
+    (b) => b.textContent === label
+  );
+
+let container: HTMLElement;
+let root: Root;
+const onCreated = vi.fn();
+const onClose = vi.fn();
+const onReplaced = vi.fn();
+
+function render(prefill: DraftPrefillParams) {
+  act(() =>
+    root.render(
+      createElement(
+        OperatingSystemContextProvider,
+        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
+        createElement(
+          ShortcutsProvider,
+          null,
+          createElement(
+            ManualAlertCreationDock,
+            {
+              open: true,
+              prefill,
+              alertDetailPath: (id: string) => `/alerts/${id}`,
+              onCreated,
+              onReplaced,
+              onClose,
+            },
+            createElement("div", { "data-testid": "page" }, "page")
+          )
+        )
+      )
+    )
+  );
+}
+
+describe("ManualAlertCreation", () => {
+  beforeEach(() => {
+    fetchMock.mockClear();
+    vi.stubGlobal("fetch", fetchMock);
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+  afterEach(() => {
+    act(() => root.unmount());
+    container.remove();
+    vi.unstubAllGlobals();
+  });
+
+  it("walks the real form, posts the alert and reports the created id", async () => {
+    vi.useFakeTimers({ toFake: ["Date"], now: new Date("2026-01-01T00:00:00.000Z") });
+    try {
+      render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
+      pick("condition", "50");
+      pick("expiry", "For 24 hours");
+      click(checkbox("notifiers", "Ops webhook"));
+      click(button("Done")!);
+      await act(async () => button("Create alert")!.click());
+      const calls = fetchMock.mock.calls.filter(([url]) => url === "/resources/alerts/create");
+      expect(calls).toHaveLength(1);
+      const init = (calls[0] as unknown as [string, RequestInit])[1];
+      expect(init.method).toBe("POST");
+      expect(JSON.parse(init.body as string)).toEqual({
+        organizationId: "org1",
+        projectId: "proj1",
+        environmentId: "env1",
+        name: "Failed runs above 50 on x",
+        expiry: "24h",
+        form: {
+          capabilityKey: "runs.failed",
+          scopeType: "task",
+          scopeValue: "x",
+          conditionKind: "threshold",
+          operator: ">",
+          value: 50,
+          windowMinutes: 10,
+          expiresAt: "2026-01-02T00:00:00.000Z",
+          notifierChannelIds: ["ch1"],
+        },
+      });
+      expect(onCreated).toHaveBeenCalledWith("a1");
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("starts a fresh draft when the prefill changes", () => {
+    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
+    pick("condition", "50");
+    expect(combobox("condition")!.textContent).toBe("50");
+    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "y" });
+    expect(combobox("condition")!.textContent).toBe("Select…");
+    pick("condition", "50");
+    expect(fieldset("scope")!.textContent).toContain("y");
+    expect(fieldset("scope")!.textContent).not.toContain("x");
+  });
+
+  it("docks beside the page with the panel header and no chat controls", () => {
+    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
+    expect(document.querySelector("[data-testid=page]")).not.toBeNull();
+    const panel = document.querySelector("[data-testid=manual-alert-panel]")!;
+    const title = Array.from(panel.querySelectorAll("span")).find(
+      (span) => span.textContent === "New alert"
+    )!;
+    expect(title.className).toContain("truncate text-sm font-medium text-text-bright");
+    expect(panel.querySelector("[aria-label^='Change layout']")).toBeNull();
+    expect(panel.querySelector("[aria-haspopup]:not([role=combobox])")).toBeNull();
+    expect(panel.querySelector("[data-testid=manual-mode-toggle]")).toBeNull();
+    expect(panel.querySelector("textarea")).toBeNull();
+    click(panel.querySelector<HTMLButtonElement>("[aria-label='Close (Esc)']")!);
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+
+  it("replaces a legacy subscription through the legacy route", async () => {
+    render({
+      capability: "runs.failed",
+      scope: "all",
+      replace: {
+        channelId: "ch_prod",
+        channelName: "Prod pager",
+        alertType: "TASK_RUN",
+        environments: [
+          { id: "env1", type: "PRODUCTION", slug: "prod", branchName: null },
+          { id: "env2", type: "DEVELOPMENT", slug: "dev", branchName: null },
+        ],
+      },
+    });
+    pick("expiry", "No expiry");
+    expect(checkbox("notifiers", "Prod pager").checked).toBe(true);
+    click(button("Done")!);
+    await act(async () => button("Create alert")!.click());
+    const calls = fetchMock.mock.calls.filter(([url]) => String(url).includes("/alerts/legacy"));
+    expect(calls).toHaveLength(1);
+    const [url, init] = calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe(
+      `/orgs/org/projects/proj/env/prod/alerts/legacy?_data=${encodeURIComponent(
+        "routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy"
+      )}`
+    );
+    expect(init.method).toBe("POST");
+    expect(Object.fromEntries(init.body as FormData)).toEqual({
+      intent: "replace",
+      channelId: "ch_prod",
+      alertType: "TASK_RUN",
+      environmentIds: "env1,env2",
+      value: "0",
+      windowMinutes: "10",
+      scopeType: "all",
+      notifierChannelIds: "ch_prod",
+    });
+    expect(fetchMock.mock.calls.some(([u]) => u === "/resources/alerts/create")).toBe(false);
+    expect(onReplaced).toHaveBeenCalledWith({
+      count: 1,
+      message: "Created 1 alert",
+      legacyRemaining: false,
+    });
+  });
+});
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreation.tsx b/apps/webapp/app/components/alerts/ManualAlertCreation.tsx
new file mode 100644
index 00000000000..6e71fcde56b
--- /dev/null
+++ b/apps/webapp/app/components/alerts/ManualAlertCreation.tsx
@@ -0,0 +1,272 @@
+import { useFetcher } from "@remix-run/react";
+import { type ReactNode, useCallback, useEffect, useRef, useState } from "react";
+import type { PanelHandle } from "@window-splitter/react";
+import { alertChannelsResourcePath } from "~/components/alerts/alertChannelsResourcePath";
+import { CreationChatShell } from "~/components/alerts/CreationChatShell";
+import {
+  CREATE_ALERT_PATH,
+  createAlertRequestBody,
+  replaceRequestBody,
+} from "~/components/alerts/createAlertRequest";
+import { LEGACY_ALERTS_ROUTE_ID } from "~/components/alerts/legacyAlertChannels";
+import type { AlertChannel } from "~/components/dashboard-agent/alert-creation/CreationFlow";
+import {
+  useCreationFlowState,
+  type FlowAnswers,
+} from "~/components/dashboard-agent/alert-creation";
+import {
+  prefillToAnswers,
+  type DraftPrefillParams,
+} from "~/components/dashboard-agent/alert-creation/flow-state";
+import { ManualCreationForm } from "~/components/dashboard-agent/alert-creation/ManualCreationForm";
+import { environmentFullTitle } from "~/components/environments/EnvironmentLabel";
+import {
+  DashboardPanelHeader,
+  PANEL_TITLE_CLASS,
+} from "~/components/dashboard-agent/DashboardPanelChrome";
+import {
+  createDockedWidthController,
+  type DockedWidthAction,
+} from "~/components/dashboard-agent/docked-width";
+import { escapeClosesPanel, ownsEscape } from "~/components/dashboard-agent/panel-escape";
+import {
+  AGENT_PANEL_DEFAULT_WIDTH,
+  AGENT_PANEL_MAX_WIDTH,
+  AGENT_PANEL_MIN_WIDTH,
+  readAgentPanelWidth,
+  writeAgentPanelWidth,
+} from "~/components/dashboard-agent/panel-layout";
+import {
+  ResizableHandle,
+  ResizablePanel,
+  ResizablePanelGroup,
+} from "~/components/primitives/Resizable";
+import { useEnvironment } from "~/hooks/useEnvironment";
+import { useFeatures } from "~/hooks/useFeatures";
+import { useOrganization } from "~/hooks/useOrganizations";
+import { useProject } from "~/hooks/useProject";
+import { cn } from "~/utils/cn";
+import { v3ProjectLegacyAlertsPath } from "~/utils/pathBuilder";
+
+function prefillAnswers(prefill: DraftPrefillParams): FlowAnswers {
+  const base =
+    prefill.area || prefill.capability || prefill.scope || prefill.replace
+      ? prefillToAnswers(prefill)
+      : {};
+  return { notifiers: [], ...base };
+}
+
+type ReplacedResult = { legacyRemaining?: boolean; message?: string };
+
+function ManualAlertCreation({
+  prefill,
+  alertDetailPath,
+  onCreated,
+  onReplaced,
+}: {
+  prefill: DraftPrefillParams;
+  alertDetailPath: (alertId: string) => string;
+  onCreated: (alertId: string | undefined) => void;
+  onReplaced?: (result: ReplacedResult) => void;
+}) {
+  const organization = useOrganization();
+  const project = useProject();
+  const environment = useEnvironment();
+  const { queueMetricsEnabled } = useFeatures();
+  const [initialAnswers] = useState(() => prefillAnswers(prefill));
+  const [resetKey, setResetKey] = useState(0);
+
+  const onSubmit = useCallback(
+    async (answers: FlowAnswers) => {
+      try {
+        if (answers.replace) {
+          const resp = await fetch(
+            `${v3ProjectLegacyAlertsPath(organization, project, environment)}?_data=${encodeURIComponent(LEGACY_ALERTS_ROUTE_ID)}`,
+            { method: "POST", body: replaceRequestBody(answers) }
+          );
+          if (!resp.ok) return false;
+          onReplaced?.((await resp.json()) as ReplacedResult);
+          return true;
+        }
+        const resp = await fetch(CREATE_ALERT_PATH, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(
+            createAlertRequestBody(
+              {
+                organizationId: organization.id,
+                projectId: project.id,
+                environmentId: environment.id,
+              },
+              answers
+            )
+          ),
+        });
+        if (!resp.ok) return false;
+        const data = (await resp.json()) as { alertId?: string };
+        onCreated(data.alertId);
+        return data.alertId ? { alertId: data.alertId } : true;
+      } catch {
+        return false;
+      }
+    },
+    [organization, project, environment, onCreated, onReplaced]
+  );
+  const flow = useCreationFlowState(onSubmit, initialAnswers, resetKey);
+
+  const channelsFetcher = useFetcher<{
+    channels: AlertChannel[];
+    canWrite?: boolean;
+    limits?: { used: number; limit: number };
+  }>();
+  const channelsPath = alertChannelsResourcePath(
+    project.id,
+    false,
+    prefill.replace ? undefined : environment.id
+  );
+  useEffect(() => {
+    channelsFetcher.load(channelsPath);
+  }, [channelsPath]); // eslint-disable-line react-hooks/exhaustive-deps -- fetcher is stable
+  const limits = channelsFetcher.data?.limits;
+
+  return (
+    <ManualCreationForm
+      flow={flow}
+      channels={channelsFetcher.data?.channels ?? []}
+      addChannel={{
+        projectId: project.id,
+        canWrite: channelsFetcher.data?.canWrite ?? false,
+        atLimit: limits ? limits.used >= limits.limit : false,
+        onCreated: () => channelsFetcher.load(channelsPath),
+      }}
+      emptyAreas={queueMetricsEnabled ? [] : ["queues"]}
+      onStartOver={() => setResetKey((key) => key + 1)}
+      environmentTitle={environmentFullTitle(environment)}
+      alertDetailPath={flow.createdAlertId ? alertDetailPath(flow.createdAlertId) : undefined}
+    />
+  );
+}
+
+/* oxlint-disable jsx-a11y/no-static-element-interactions -- Escape bubbles from focused controls inside the panel. */
+function ManualAlertCreationPanel({
+  prefill,
+  alertDetailPath,
+  onCreated,
+  onReplaced,
+  onClose,
+}: {
+  prefill: DraftPrefillParams;
+  alertDetailPath: (alertId: string) => string;
+  onCreated: (alertId: string | undefined) => void;
+  onReplaced?: (result: ReplacedResult) => void;
+  onClose: () => void;
+}) {
+  const environment = useEnvironment();
+  const panelRef = useRef<HTMLDivElement | null>(null);
+  return (
+    <div
+      ref={panelRef}
+      data-testid="manual-alert-panel"
+      className="flex h-full flex-col bg-background-bright max-sm:fixed max-sm:inset-0 max-sm:z-40"
+      onKeyDown={(event) => {
+        if (
+          !escapeClosesPanel({
+            key: event.key,
+            defaultPrevented: event.defaultPrevented,
+            targetInsidePanel: panelRef.current?.contains(event.target as Node) ?? false,
+            targetInDialog: Boolean((event.target as Element).closest?.("[data-dialog]")),
+            targetExpanded: ownsEscape(event.target as Element),
+          })
+        )
+          return;
+        event.preventDefault();
+        onClose();
+      }}
+    >
+      <DashboardPanelHeader
+        title={<span className={cn("px-1", PANEL_TITLE_CLASS)}>New alert</span>}
+        onClose={onClose}
+      />
+      <CreationChatShell placement="docked" title="New alert">
+        <div className="min-h-0 flex-1 overflow-y-auto p-3">
+          <ManualAlertCreation
+            key={`${environment.id}:${JSON.stringify(prefill)}`}
+            prefill={prefill}
+            alertDetailPath={alertDetailPath}
+            onCreated={onCreated}
+            onReplaced={onReplaced}
+          />
+        </div>
+      </CreationChatShell>
+    </div>
+  );
+}
+
+/* oxlint-enable jsx-a11y/no-static-element-interactions */
+
+export function ManualAlertCreationDock({
+  open,
+  prefill,
+  alertDetailPath,
+  onCreated,
+  onReplaced,
+  onClose,
+  children,
+}: {
+  open: boolean;
+  prefill: DraftPrefillParams;
+  alertDetailPath: (alertId: string) => string;
+  onCreated: (alertId: string | undefined) => void;
+  onReplaced?: (result: ReplacedResult) => void;
+  onClose: () => void;
+  children: ReactNode;
+}) {
+  const panelHandle = useRef<PanelHandle>(null);
+  const dockedWidth = useRef(createDockedWidthController());
+  const runWidthAction = useCallback((action: DockedWidthAction) => {
+    if (action.type === "apply") panelHandle.current?.setSize(`${action.width}px`);
+    if (action.type === "persist") writeAgentPanelWidth(action.width);
+  }, []);
+  useEffect(() => {
+    const controller = dockedWidth.current;
+    runWidthAction(
+      open
+        ? controller.dock(readAgentPanelWidth(), panelHandle.current?.getPixelSize())
+        : controller.undock()
+    );
+  }, [open, runWidthAction]);
+
+  if (!open) return children;
+
+  return (
+    <ResizablePanelGroup orientation="horizontal" className="h-full min-h-0">
+      <ResizablePanel id="dashboard-content" min="320px">
+        <div className="h-full overflow-hidden">{children}</div>
+      </ResizablePanel>
+      <ResizableHandle
+        id="dashboard-agent-handle"
+        onDragEnd={() =>
+          runWidthAction(dockedWidth.current.dragEnd(panelHandle.current?.getPixelSize()))
+        }
+      />
+      <ResizablePanel
+        id="dashboard-agent-panel"
+        handle={panelHandle}
+        onResize={({ pixel }: { pixel: number }) =>
+          runWidthAction(dockedWidth.current.resize(pixel))
+        }
+        default={`${AGENT_PANEL_DEFAULT_WIDTH}px`}
+        min={`${AGENT_PANEL_MIN_WIDTH}px`}
+        max={`${AGENT_PANEL_MAX_WIDTH}px`}
+      >
+        <ManualAlertCreationPanel
+          prefill={prefill}
+          alertDetailPath={alertDetailPath}
+          onCreated={onCreated}
+          onReplaced={onReplaced}
+          onClose={onClose}
+        />
+      </ResizablePanel>
+    </ResizablePanelGroup>
+  );
+}
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts b/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
new file mode 100644
index 00000000000..19925fbde16
--- /dev/null
+++ b/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
@@ -0,0 +1,159 @@
+// @vitest-environment jsdom
+import type * as WindowSplitter from "@window-splitter/react";
+import type { PanelHandle } from "@window-splitter/react";
+import { createElement, type ComponentProps } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { act } from "react-dom/test-utils";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  AGENT_PANEL_DEFAULT_WIDTH,
+  readAgentPanelWidth,
+  writeAgentPanelWidth,
+} from "~/components/dashboard-agent/panel-layout";
+import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
+import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
+import { ManualAlertCreationDock } from "./ManualAlertCreation";
+
+const agentPanel = vi.hoisted(() => ({ handle: null as PanelHandle | null }));
+
+vi.mock("@window-splitter/react", async (importOriginal) => {
+  const original = await importOriginal<typeof WindowSplitter>();
+  return {
+    ...original,
+    Panel: (props: ComponentProps<typeof original.Panel>) =>
+      createElement(original.Panel, {
+        ...props,
+        handle: (handle: PanelHandle | null) => {
+          if (props.id === "dashboard-agent-panel") agentPanel.handle = handle;
+          const ref = props.handle;
+          if (typeof ref === "function") ref(handle);
+          else if (ref) (ref as { current: PanelHandle | null }).current = handle;
+        },
+      }),
+  };
+});
+vi.mock("@remix-run/react", () => ({
+  useFetcher: () => ({ data: undefined, load: () => {} }),
+}));
+vi.mock("~/hooks/useTypedMatchData", () => ({ useTypedMatchesData: () => undefined }));
+vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o", id: "org1" }) }));
+vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p", id: "proj1" }) }));
+vi.mock("~/hooks/useEnvironment", () => ({
+  useEnvironment: () => ({ slug: "e", id: "env1", type: "PRODUCTION" }),
+}));
+vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
+vi.mock("~/components/dashboard-agent/alert-creation/ManualCreationForm", () => ({
+  ManualCreationForm: () => null,
+}));
+
+const GROUP_WIDTH = 1400;
+const GROUP_HEIGHT = 800;
+
+type Observed = { element: Element; callback: ResizeObserverCallback };
+let observed: Observed[] = [];
+let container: HTMLDivElement;
+let root: Root;
+let originalObserver: typeof ResizeObserver | undefined;
+let originalRect: typeof Element.prototype.getBoundingClientRect;
+
+class StubResizeObserver {
+  constructor(private callback: ResizeObserverCallback) {}
+  observe(element: Element) {
+    observed.push({ element, callback: this.callback });
+  }
+  unobserve() {}
+  disconnect() {
+    observed = observed.filter((entry) => entry.callback !== this.callback);
+  }
+}
+
+function reportSizes(sizes: Record<string, number>) {
+  act(() => {
+    for (const { element, callback } of [...observed]) {
+      const id = element.getAttribute("data-splitter-id");
+      if (!id) continue;
+      const width = sizes[id];
+      if (width === undefined) continue;
+      callback(
+        [
+          {
+            target: element,
+            borderBoxSize: [{ inlineSize: width, blockSize: GROUP_HEIGHT }],
+            contentRect: { width, height: GROUP_HEIGHT },
+          } as unknown as ResizeObserverEntry,
+        ],
+        {} as ResizeObserver
+      );
+    }
+  });
+}
+
+function mount() {
+  act(() =>
+    root.render(
+      createElement(
+        OperatingSystemContextProvider,
+        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
+        createElement(
+          ShortcutsProvider,
+          null,
+          createElement(
+            ManualAlertCreationDock,
+            {
+              open: true,
+              prefill: {},
+              alertDetailPath: (id: string) => `/alerts/${id}`,
+              onCreated: () => {},
+              onClose: () => {},
+            },
+            createElement("div", null, "page")
+          )
+        )
+      )
+    )
+  );
+}
+
+const panelColumn = () =>
+  container.querySelector<HTMLElement>('[data-splitter-id="dashboard-agent-panel"]')!;
+describe("ManualAlertCreationDock, rendered", () => {
+  beforeEach(() => {
+    observed = [];
+    originalObserver = globalThis.ResizeObserver;
+    globalThis.ResizeObserver = StubResizeObserver as unknown as typeof ResizeObserver;
+    originalRect = Element.prototype.getBoundingClientRect;
+    Element.prototype.getBoundingClientRect = () =>
+      ({ width: GROUP_WIDTH, height: GROUP_HEIGHT, x: 0, y: 0, top: 0, left: 0 }) as DOMRect;
+    window.localStorage.clear();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+
+  afterEach(() => {
+    act(() => root.unmount());
+    container.remove();
+    Element.prototype.getBoundingClientRect = originalRect;
+    if (originalObserver) globalThis.ResizeObserver = originalObserver;
+  });
+
+  it("restores the saved width on the first size report", () => {
+    writeAgentPanelWidth(500);
+    mount();
+    expect(panelColumn()).not.toBeNull();
+    expect(Math.round(agentPanel.handle?.getPixelSize() ?? 0)).not.toBe(500);
+    reportSizes({
+      "dashboard-content": GROUP_WIDTH - AGENT_PANEL_DEFAULT_WIDTH - 3,
+      "dashboard-agent-panel": AGENT_PANEL_DEFAULT_WIDTH,
+    });
+    expect(Math.round(agentPanel.handle?.getPixelSize() ?? 0)).toBe(500);
+    expect(readAgentPanelWidth()).toBe(500);
+  });
+
+  it("covers the full width below the sm breakpoint", () => {
+    mount();
+    const surface = container.querySelector("[data-testid=manual-alert-panel]")!;
+    expect(surface.className).toContain("max-sm:fixed");
+    expect(surface.className).toContain("max-sm:inset-0");
+  });
+});
diff --git a/apps/webapp/app/components/alerts/createAlertRequest.ts b/apps/webapp/app/components/alerts/createAlertRequest.ts
new file mode 100644
index 00000000000..b65ff29eaaf
--- /dev/null
+++ b/apps/webapp/app/components/alerts/createAlertRequest.ts
@@ -0,0 +1,68 @@
+import { EXPIRY_TOKEN_PATTERN } from "~/components/alerts/alertCreatedCard";
+import {
+  alertName,
+  defaultWindowMinutes,
+  resolveCapability,
+  type FlowAnswers,
+} from "~/components/dashboard-agent/alert-creation/flow-state";
+
+export const CREATE_ALERT_PATH = "/resources/alerts/create";
+
+function expiryToIso(exp: string | undefined): string | undefined {
+  if (!exp || exp === "none") return undefined;
+  const EVENT_HOURS: Record<string, number> = { deploy: 168, incident: 720 };
+  const hoursMatch = exp.match(/^(\d+)h$/);
+  const hours = hoursMatch ? Number(hoursMatch[1]) : EVENT_HOURS[exp];
+  if (hours) return new Date(Date.now() + hours * 3600_000).toISOString();
+  return Number.isNaN(Date.parse(exp)) ? undefined : new Date(exp).toISOString();
+}
+
+export function replaceRequestBody(answers: FlowAnswers): FormData {
+  const target = answers.replace!;
+  const expiresAt = expiryToIso(answers.expiry);
+  const body = new FormData();
+  body.set("intent", "replace");
+  body.set("channelId", target.channelId);
+  body.set("alertType", target.alertType);
+  body.set("environmentIds", (answers.environments ?? []).join(","));
+  body.set("value", answers.condition ?? "0");
+  if (answers.windowMinutes) body.set("windowMinutes", String(answers.windowMinutes));
+  if (expiresAt) body.set("expiresAt", expiresAt);
+  if (answers.scope) body.set("scopeType", answers.scope);
+  if (answers.scopeValue) body.set("scopeValue", answers.scopeValue);
+  body.set("notifierChannelIds", (answers.notifiers ?? []).filter((n) => n !== "chat").join(","));
+  return body;
+}
+
+export function createAlertRequestBody(
+  ids: { organizationId: string; projectId: string; environmentId: string },
+  answers: FlowAnswers
+) {
+  const kind = resolveCapability(answers.what)?.allowedKinds[0] ?? "threshold";
+  return {
+    organizationId: ids.organizationId,
+    projectId: ids.projectId,
+    environmentId: ids.environmentId,
+    name: alertName(answers),
+    expiry:
+      answers.expiry && EXPIRY_TOKEN_PATTERN.test(answers.expiry) ? answers.expiry : undefined,
+    form: {
+      capabilityKey: answers.what,
+      scopeType: answers.scope,
+      scopeValue: answers.scopeValue,
+      conditionKind: kind,
+      operator: kind === "threshold" ? ">" : undefined,
+      value: answers.condition ? Number(answers.condition) : undefined,
+      windowMinutes:
+        kind === "threshold"
+          ? (answers.windowMinutes ?? defaultWindowMinutes(answers.what))
+          : undefined,
+      quietWindowMinutes:
+        kind === "absence" && answers.condition ? Number(answers.condition) : undefined,
+      conditionParams:
+        kind === "state" && answers.conditionParams ? answers.conditionParams : undefined,
+      expiresAt: expiryToIso(answers.expiry),
+      notifierChannelIds: (answers.notifiers ?? []).filter((n) => n !== "chat"),
+    },
+  };
+}
diff --git a/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx b/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
index 65522d876c8..a6306ce1b4d 100644
--- a/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
+++ b/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
@@ -1,6 +1,4 @@
 import { useEffect, useRef, useState } from "react";
-import { CrossIcon } from "~/assets/icons/CrossIcon";
-import { Button } from "~/components/primitives/Buttons";
 import {
   Popover,
   PopoverArrowTrigger,
@@ -8,7 +6,6 @@ import {
   PopoverMenuItem,
   PopoverTrigger,
 } from "~/components/primitives/Popover";
-import { ShortcutKey } from "~/components/primitives/ShortcutKey";
 import { SimpleTooltip } from "~/components/primitives/Tooltip";
 import type { Shortcut } from "~/hooks/useShortcutKeys";
 import { CHAT_MODE_OPTIONS } from "./chat-mode-options";
@@ -18,6 +15,7 @@ import {
   type DashboardAgentChat,
 } from "./DashboardAgentHistory";
 import { chatHistoryTriggerLabel } from "./header-labels";
+import { DashboardPanelHeader, PANEL_TITLE_CLASS } from "./DashboardPanelChrome";
 import type { DashboardAgentMode } from "./panel-layout";
 
 // Display only. The key is registered once, in `DashboardAgent`; registering it
@@ -171,75 +169,67 @@ export function DashboardAgentHeader({
   const [pendingDelete, setPendingDelete] = useState<DashboardAgentChat | null>(null);
 
   return (
-    <div className="flex h-10 shrink-0 items-center justify-between gap-2 border-b border-grid-bright px-2">
-      <Popover
-        open={isHistoryOpen}
-        onOpenChange={(open) => {
-          setHistoryOpen(open);
-          if (open) {
-            setHistoryOpenedAt(Date.now());
-            onOpenHistory();
-          }
-        }}
-      >
-        <PopoverArrowTrigger
-          variant="minimal"
-          isOpen={isHistoryOpen}
-          overflowHidden
-          className="min-w-0"
-          aria-label={chatHistoryTriggerLabel(title)}
-          title={title}
-        >
-          <span className="truncate text-sm font-medium text-text-bright">{title}</span>
-        </PopoverArrowTrigger>
-        <PopoverContent
-          // `min-w-0` over the popover's own `min-w-max`, which would stretch it to the longest
-          // title instead of truncating at this width.
-          className="w-72 min-w-0 max-w-(--radix-popover-content-available-width) p-0"
-          align="start"
-        >
-          {historyOpenedAt === null ? null : (
-            <DashboardAgentHistoryMenu
-              chats={chats}
-              currentChatId={currentChatId}
-              now={historyOpenedAt}
-              onSelect={(chatId) => {
-                setHistoryOpen(false);
-                onSelectChat(chatId);
-              }}
-              onRequestDelete={(chat) => {
-                setHistoryOpen(false);
-                setPendingDelete(chat);
-              }}
-            />
-          )}
-        </PopoverContent>
-      </Popover>
-
-      <DashboardAgentDeleteChatDialog
-        chat={pendingDelete}
-        onOpenChange={(open) => !open && setPendingDelete(null)}
-        onConfirm={onDeleteChat}
-      />
+    <DashboardPanelHeader
+      title={
+        <>
+          <Popover
+            open={isHistoryOpen}
+            onOpenChange={(open) => {
+              setHistoryOpen(open);
+              if (open) {
+                setHistoryOpenedAt(Date.now());
+                onOpenHistory();
+              }
+            }}
+          >
+            <PopoverArrowTrigger
+              variant="minimal"
+              isOpen={isHistoryOpen}
+              overflowHidden
+              className="min-w-0"
+              aria-label={chatHistoryTriggerLabel(title)}
+              title={title}
+            >
+              <span className={PANEL_TITLE_CLASS}>{title}</span>
+            </PopoverArrowTrigger>
+            <PopoverContent
+              // `min-w-0` over the popover's own `min-w-max`, which would stretch it to the longest
+              // title instead of truncating at this width.
+              className="w-72 min-w-0 max-w-(--radix-popover-content-available-width) p-0"
+              align="start"
+            >
+              {historyOpenedAt === null ? null : (
+                <DashboardAgentHistoryMenu
+                  chats={chats}
+                  currentChatId={currentChatId}
+                  now={historyOpenedAt}
+                  onSelect={(chatId) => {
+                    setHistoryOpen(false);
+                    onSelectChat(chatId);
+                  }}
+                  onRequestDelete={(chat) => {
+                    setHistoryOpen(false);
+                    setPendingDelete(chat);
+                  }}
+                />
+              )}
+            </PopoverContent>
+          </Popover>
 
-      <div className="flex shrink-0 items-center gap-1" data-agent-no-drag>
-        {actions}
-        <ModeMenu mode={mode} onModeChange={onModeChange} />
-        <Button
-          variant="minimal/small"
-          className="aspect-square h-6 p-1"
-          aria-label="Close (Esc)"
-          tooltipDelay={500}
-          tooltip={
-            <span className="flex items-center">
-              Close
-              <ShortcutKey shortcut={{ key: "esc" }} variant="medium" />
-            </span>
-          }
-          onClick={onClose}
-          LeadingIcon={<CrossIcon className="size-4 text-text-dimmed" />}
-        />
-      </div>
-    </div>
+          <DashboardAgentDeleteChatDialog
+            chat={pendingDelete}
+            onOpenChange={(open) => !open && setPendingDelete(null)}
+            onConfirm={onDeleteChat}
+          />
+        </>
+      }
+      actions={
+        <>
+          {actions}
+          <ModeMenu mode={mode} onModeChange={onModeChange} />
+        </>
+      }
+      onClose={onClose}
+    />
   );
 }
diff --git a/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx b/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
new file mode 100644
index 00000000000..39e0af01ff4
--- /dev/null
+++ b/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
@@ -0,0 +1,39 @@
+import type { ReactNode } from "react";
+import { CrossIcon } from "~/assets/icons/CrossIcon";
+import { Button } from "~/components/primitives/Buttons";
+import { ShortcutKey } from "~/components/primitives/ShortcutKey";
+
+export const PANEL_TITLE_CLASS = "truncate text-sm font-medium text-text-bright";
+
+export function DashboardPanelHeader({
+  title,
+  actions,
+  onClose,
+}: {
+  title: ReactNode;
+  actions?: ReactNode;
+  onClose: () => void;
+}) {
+  return (
+    <div className="flex h-10 shrink-0 items-center justify-between gap-2 border-b border-grid-bright px-2">
+      {title}
+      <div className="flex shrink-0 items-center gap-1" data-agent-no-drag>
+        {actions}
+        <Button
+          variant="minimal/small"
+          className="aspect-square h-6 p-1"
+          aria-label="Close (Esc)"
+          tooltipDelay={500}
+          tooltip={
+            <span className="flex items-center">
+              Close
+              <ShortcutKey shortcut={{ key: "esc" }} variant="medium" />
+            </span>
+          }
+          onClick={onClose}
+          LeadingIcon={<CrossIcon className="size-4 text-text-dimmed" />}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx b/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
index 34ef4a6ebbf..d7a9a6e4872 100644
--- a/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
+++ b/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
@@ -11,6 +11,7 @@ import { Input } from "../primitives/Input";
 import { InputGroup } from "../primitives/InputGroup";
 import { Paragraph } from "../primitives/Paragraph";
 import { CheckboxWithLabel } from "../primitives/Checkbox";
+import { RadioGroup, RadioGroupItem } from "../primitives/RadioButton";
 import { Spinner } from "../primitives/Spinner";
 
 type ModalProps = {
@@ -75,9 +76,7 @@ const RegenerateApiKeyModalContent = ({
   return (
     <div className="flex flex-col items-center gap-y-4 pt-4">
       <Callout variant="warning">
-        {`A new API key will be issued for the ${title} environment. The previous key stays valid
-        for 24 hours so you can roll out the new key in your environment variables without downtime.
-        After 24 hours, the previous key stops working.`}
+        {`A new API key will be issued for the ${title} environment. Choose what happens to the previous key.`}
       </Callout>
       <fetcher.Form
         method="post"
@@ -85,6 +84,24 @@ const RegenerateApiKeyModalContent = ({
         className="mt-2 w-full"
       >
         <Fieldset className="w-full">
+          <InputGroup className="max-w-full">
+            <RadioGroup name="previousKey" defaultValue="grace" className="flex flex-col gap-2">
+              <RadioGroupItem
+                id="previousKey-grace"
+                value="grace"
+                variant="description"
+                label="Keep the previous key working for 24 hours"
+                description="Roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours."
+              />
+              <RadioGroupItem
+                id="previousKey-revoke"
+                value="revoke"
+                variant="description"
+                label="Revoke the previous key immediately"
+                description="Choose this if the key may have leaked. Deployments and services still using the previous key will fail until they are updated with the new key."
+              />
+            </RadioGroup>
+          </InputGroup>
           <InputGroup className="max-w-full">
             <Paragraph variant="small/bright">Enter this text below to confirm:</Paragraph>
             <Paragraph
diff --git a/apps/webapp/app/components/navigation/SideMenu.tsx b/apps/webapp/app/components/navigation/SideMenu.tsx
index f07f03dc0b7..43f0163f4e0 100644
--- a/apps/webapp/app/components/navigation/SideMenu.tsx
+++ b/apps/webapp/app/components/navigation/SideMenu.tsx
@@ -346,7 +346,7 @@ export function SideMenu({
   const isFreeUser = currentPlan?.v3Subscription?.isPaying === false;
   const isAdmin = useHasAdminAccess();
   const isViewingAsUser = useIsViewingAsUser();
-  const { isManagedCloud } = useFeatures();
+  const { isManagedCloud, alertsConfigured } = useFeatures();
   const featureFlags = useFeatureFlags();
   const incidentStatus = useIncidentStatus();
   const isV3Project = project.engine === "V1";
@@ -749,6 +749,7 @@ export function SideMenu({
     project,
     environment,
     isAdmin,
+    alertsConfigured,
     featureFlags,
     isManagedCloud,
     dashboards: {
diff --git a/apps/webapp/app/components/navigation/sideMenuSections.tsx b/apps/webapp/app/components/navigation/sideMenuSections.tsx
index ea72c0438cb..0d90702addf 100644
--- a/apps/webapp/app/components/navigation/sideMenuSections.tsx
+++ b/apps/webapp/app/components/navigation/sideMenuSections.tsx
@@ -81,6 +81,7 @@ export function buildSideMenuSections({
   project,
   environment,
   isAdmin,
+  alertsConfigured,
   featureFlags,
   isManagedCloud,
   dashboards,
@@ -89,6 +90,7 @@ export function buildSideMenuSections({
   project: ProjectForPath;
   environment: EnvironmentForPath;
   isAdmin: boolean;
+  alertsConfigured: boolean;
   featureFlags: {
     hasAiAccess?: boolean;
     hasQueryAccess?: boolean;
@@ -138,7 +140,8 @@ export function buildSideMenuSections({
   const showObservability =
     isAdmin || featureFlags.hasQueryAccess || featureFlags.hasLogsPageAccess;
   const alertsInObservability =
-    showObservability && computeCanUseAlertsList(featureFlags.alertsEnabled === true, isAdmin);
+    showObservability &&
+    computeCanUseAlertsList(featureFlags.alertsEnabled === true, isAdmin, alertsConfigured);
 
   if (showObservability) {
     staticSections.push({
diff --git a/apps/webapp/app/features.server.ts b/apps/webapp/app/features.server.ts
index 3a0b1a79562..db84b9d6352 100644
--- a/apps/webapp/app/features.server.ts
+++ b/apps/webapp/app/features.server.ts
@@ -1,4 +1,5 @@
 import { env } from "./env.server";
+import { isAlertsConfigured } from "./v3/services/alerts/alertsConfigured.server";
 import { queueMetricsEnabled } from "./v3/services/alerts/offeredCapabilities.server";
 import { requestUrl } from "./utils/requestUrl.server";
 
@@ -7,6 +8,7 @@ export type TriggerFeatures = {
   hasPrivateConnections: boolean;
   queueMetricsQueryTables: boolean;
   queueMetricsEnabled: boolean;
+  alertsConfigured: boolean;
 };
 
 const MANAGED_CLOUD_HOSTS = ["cloud.trigger.dev", "test-cloud.trigger.dev", "internal.trigger.dev"];
@@ -34,6 +36,7 @@ function featuresForHost(host: string): TriggerFeatures {
     hasPrivateConnections: hasPrivateConnections(host),
     queueMetricsQueryTables: env.QUEUE_METRICS_QUERY_TABLES_VISIBLE === "1",
     queueMetricsEnabled: queueMetricsEnabled(),
+    alertsConfigured: isAlertsConfigured({ alertsEnabled: env.ALERTS_ENABLED }),
   };
 }
 
diff --git a/apps/webapp/app/hooks/useFeatures.ts b/apps/webapp/app/hooks/useFeatures.ts
index b63994faab2..844022c1fa5 100644
--- a/apps/webapp/app/hooks/useFeatures.ts
+++ b/apps/webapp/app/hooks/useFeatures.ts
@@ -11,6 +11,7 @@ export function useFeatures(): TriggerFeatures {
       hasPrivateConnections: false,
       queueMetricsQueryTables: false,
       queueMetricsEnabled: true,
+      alertsConfigured: false,
     }
   );
 }
diff --git a/apps/webapp/app/models/api-key.server.ts b/apps/webapp/app/models/api-key.server.ts
index 41364196a7d..7387d3d0ffd 100644
--- a/apps/webapp/app/models/api-key.server.ts
+++ b/apps/webapp/app/models/api-key.server.ts
@@ -25,6 +25,10 @@ type RootApiKeyMutationInput = {
   environmentId: string;
 };
 
+type RegenerateApiKeyInput = RootApiKeyMutationInput & {
+  revokeImmediately?: boolean;
+};
+
 export class RootApiKeyNotVisibleError extends Error {
   constructor() {
     super("The root API key is no longer visible");
@@ -110,7 +114,7 @@ async function lockVisibleRootApiKeyEnvironment(
 }
 
 export async function regenerateApiKey(
-  input: RootApiKeyMutationInput,
+  { revokeImmediately = false, ...input }: RegenerateApiKeyInput,
   { prismaClient = prisma }: { prismaClient?: PrismaClient } = {}
 ) {
   const environment = await findRootApiKeyEnvironment(input, prismaClient);
@@ -132,13 +136,15 @@ export async function regenerateApiKey(
         },
       });
 
-      await tx.revokedApiKey.create({
-        data: {
-          apiKey: currentEnvironment.apiKey,
-          runtimeEnvironmentId: environment.id,
-          expiresAt: revokedApiKeyExpiresAt,
-        },
-      });
+      if (!revokeImmediately) {
+        await tx.revokedApiKey.create({
+          data: {
+            apiKey: currentEnvironment.apiKey,
+            runtimeEnvironmentId: environment.id,
+            expiresAt: revokedApiKeyExpiresAt,
+          },
+        });
+      }
 
       return { ...environment, apiKey: newApiKey, pkApiKey: newPkApiKey };
     }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
index c2b8c277fcc..3f328c9f128 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
@@ -1,10 +1,13 @@
 // @vitest-environment jsdom
-import { act, createElement } from "react";
+import { act, createElement, type ReactNode } from "react";
 import { createRoot } from "react-dom/client";
 import { describe, expect, it, vi } from "vitest";
 
 const openCreateAlert = vi.fn();
+const navigate = vi.fn();
 let currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
+let agent: unknown = { openCreateAlert };
+let agentAvailable = true;
 
 vi.mock("@remix-run/react", () => ({
   Outlet: () => null,
@@ -18,14 +21,54 @@ vi.mock("@remix-run/react", () => ({
     hasMigratableLegacyAlerts: false,
     canWrite: true,
     canDelete: true,
+    agentAvailable,
   }),
   useSearchParams: () => [currentParams, vi.fn()],
+  useNavigate: () => navigate,
+  useFetcher: () => ({ load: vi.fn(), data: { channels: [], canWrite: true } }),
 }));
-vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o" }) }));
-vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p" }) }));
-vi.mock("~/hooks/useEnvironment", () => ({ useEnvironment: () => ({ slug: "e", type: "PROD" }) }));
+vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o", id: "org1" }) }));
+vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p", id: "proj1" }) }));
+vi.mock("~/hooks/useEnvironment", () => ({
+  useEnvironment: () => ({ slug: "e", type: "PRODUCTION", id: "env1" }),
+}));
+vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
 vi.mock("~/components/dashboard-agent/dashboardAgentLauncher", () => ({
-  useDashboardAgent: () => ({ openCreateAlert }),
+  useDashboardAgent: () => agent,
+}));
+vi.mock("~/components/primitives/Resizable", () => ({
+  ResizablePanelGroup: ({ children }: { children: ReactNode }) => children,
+  ResizablePanel: ({ children }: { children: ReactNode }) => children,
+  ResizableHandle: () => null,
+}));
+vi.mock("~/components/dashboard-agent/alert-creation/ManualCreationForm", () => ({
+  ManualCreationForm: ({ flow }: { flow: CreationFlowState }) =>
+    createElement(
+      "div",
+      { "data-testid": "manual-form", "data-answers": JSON.stringify(flow.answers) },
+      createElement(
+        "button",
+        {
+          type: "button",
+          "data-testid": "fill",
+          onClick: () =>
+            flow.patchAnswers({
+              ...flow.answers,
+              what: "runs.failed",
+              condition: "3",
+              windowMinutes: 10,
+              notifiers: ["ch1"],
+              expiry: "24h",
+            }),
+        },
+        "fill"
+      ),
+      createElement(
+        "button",
+        { type: "button", "data-testid": "create", onClick: () => flow.create() },
+        "create"
+      )
+    ),
 }));
 vi.mock("~/components/alerts/AlertsList", () => ({ AlertsList: () => null }));
 vi.mock("~/components/alerts/LegacyAlertsBanner", () => ({ LegacyAlertsBanner: () => null }));
@@ -36,15 +79,15 @@ vi.mock("~/components/dashboard-agent/WhenAgentUnavailable", () => ({
   WhenAgentUnavailable: () => null,
 }));
 vi.mock("~/components/layout/AppLayout", () => ({
-  PageContainer: () => null,
-  PageBody: () => null,
+  PageContainer: ({ children }: { children: ReactNode }) => children,
+  PageBody: ({ children }: { children: ReactNode }) => children,
 }));
 vi.mock("~/components/primitives/PageHeader", () => ({
   NavBar: () => null,
   PageAccessories: () => null,
   PageTitle: () => null,
 }));
-vi.mock("~/components/primitives/Buttons", () => ({ LinkButton: () => null }));
+vi.mock("~/components/primitives/Buttons", () => ({ LinkButton: () => null, Button: () => null }));
 vi.mock("~/components/alerts/hasLegacyAlerts.server", () => ({}));
 vi.mock("~/db.server", () => ({ prisma: {} }));
 vi.mock("~/models/message.server", () => ({}));
@@ -57,11 +100,14 @@ vi.mock("~/services/dashboardAgentDb.server", () => ({}));
 vi.mock("~/services/routeBuilders/dashboardBuilder", () => ({ dashboardLoader: () => ({}) }));
 vi.mock("~/services/rbac.server", () => ({}));
 vi.mock("~/services/session.server", () => ({}));
+vi.mock("~/services/impersonation.server", () => ({}));
+vi.mock("~/v3/canAccessDashboardAgent.server", () => ({}));
 vi.mock("~/v3/canUseAlertsList.server", () => ({}));
 vi.mock("~/v3/services/alerts/alertActions.server", () => ({}));
 vi.mock("~/v3/alertsWorker.server", () => ({}));
 vi.mock("~/v3/services/alerts/alertIdRouting", () => ({}));
 
+import type { CreationFlowState } from "~/components/dashboard-agent/alert-creation/CreationFlow";
 import Page from "./route";
 
 describe("alerts route ?create=1 prefill", () => {
@@ -94,3 +140,55 @@ describe("alerts route ?create=1 prefill", () => {
     act(() => root.unmount());
   });
 });
+
+describe("alerts route ?create=1 with the agent", () => {
+  it("does not open the manual sheet", () => {
+    agent = { openCreateAlert };
+    agentAvailable = true;
+    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
+    const container = document.createElement("div");
+    const root = createRoot(container);
+    act(() => root.render(createElement(Page)));
+    expect(container.querySelector("[data-testid=manual-alert-panel]")).toBeNull();
+    expect(container.querySelector("[data-testid=manual-form]")).toBeNull();
+    act(() => root.unmount());
+  });
+});
+
+describe("alerts route ?create=1 without the agent", () => {
+  it("opens the manual form seeded with the prefill", () => {
+    agent = null;
+    agentAvailable = false;
+    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
+    const container = document.createElement("div");
+    const root = createRoot(container);
+    act(() => root.render(createElement(Page)));
+    const form = container.querySelector("[data-testid=manual-form]");
+    expect(form).not.toBeNull();
+    expect(JSON.parse(form!.getAttribute("data-answers")!)).toMatchObject({
+      area: "runs",
+      scope: "task",
+      scopeValue: "x",
+    });
+    act(() => root.unmount());
+  });
+
+  it("navigates to the created alert", async () => {
+    agent = null;
+    agentAvailable = false;
+    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
+    const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ alertId: "a1" }) }));
+    vi.stubGlobal("fetch", fetchMock);
+    const container = document.createElement("div");
+    const root = createRoot(container);
+    act(() => root.render(createElement(Page)));
+    act(() => (container.querySelector("[data-testid=fill]") as HTMLButtonElement).click());
+    await act(async () =>
+      (container.querySelector("[data-testid=create]") as HTMLButtonElement).click()
+    );
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(navigate).toHaveBeenCalledWith("/orgs/o/projects/p/env/e/alerts/a1");
+    vi.unstubAllGlobals();
+    act(() => root.unmount());
+  });
+});
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
index 1a4a08ffc7e..6b79b5fbf12 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
@@ -1,6 +1,6 @@
 import { parseWithZod } from "@conform-to/zod/v4";
 import { BookOpenIcon } from "@heroicons/react/20/solid";
-import { Outlet, useLoaderData, useSearchParams } from "@remix-run/react";
+import { Outlet, useLoaderData, useNavigate, useSearchParams } from "@remix-run/react";
 import { type ActionFunctionArgs, defer, json, redirect } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { useEffect, useRef } from "react";
@@ -8,6 +8,7 @@ import { AlertsList } from "~/components/alerts/AlertsList";
 import { hasLegacyAlerts } from "~/components/alerts/hasLegacyAlerts.server";
 import { LegacyAlertChannelsPage } from "~/components/alerts/LegacyAlertChannelsPage";
 import { LegacyAlertsBanner } from "~/components/alerts/LegacyAlertsBanner";
+import { ManualAlertCreationDock } from "~/components/alerts/ManualAlertCreation";
 import { createAlertPrompt } from "~/components/dashboard-agent/investigate-prompts";
 import { useDashboardAgent } from "~/components/dashboard-agent/dashboardAgentLauncher";
 import {
@@ -39,7 +40,9 @@ import {
 import { resolveProjectAuthScope } from "~/services/projectAuthScope.server";
 import { dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { rbac } from "~/services/rbac.server";
-import { requireUserId } from "~/services/session.server";
+import { getImpersonationState } from "~/services/impersonation.server";
+import { hasAdminDisplayAccess, requireUserId } from "~/services/session.server";
+import { canAccessDashboardAgent } from "~/v3/canAccessDashboardAgent.server";
 import { canUseAlertsList } from "~/v3/canUseAlertsList.server";
 import {
   canAcrossEnvironments,
@@ -145,6 +148,16 @@ export const loader = dashboardLoader(
       return defer({ mode: "legacy" as const, canWrite, ...data }) as unknown as Response;
     }
 
+    const { isViewingAsUser } = await getImpersonationState(request, user.id);
+    const showAdminUi = hasAdminDisplayAccess({ ...user, isViewingAsUser });
+    const agentAvailable = await canAccessDashboardAgent({
+      userId: user.id,
+      isAdmin: showAdminUi && user.admin,
+      isImpersonating: showAdminUi && user.isImpersonating,
+      organizationSlug,
+      orgFeatureFlags: (project.organization.featureFlags as Record<string, unknown>) ?? {},
+    });
+
     const searchParams = new URL(request.url).searchParams;
     const listPresenter = new AlertsListPresenter();
     const {
@@ -170,6 +183,7 @@ export const loader = dashboardLoader(
       truncated,
       canWrite: ability.can("write", { type: "alerts", envType: environment.type }),
       canDelete: ability.can("delete", { type: "alerts", envType: environment.type }),
+      agentAvailable,
     }) as unknown as Response;
   }
 );
@@ -358,6 +372,7 @@ type NewLoaderData = {
   hasMigratableLegacyAlerts: boolean;
   canWrite: boolean;
   canDelete: boolean;
+  agentAvailable: boolean;
 };
 
 type LegacyLoaderData = {
@@ -383,6 +398,7 @@ export default function Page() {
         hasLegacyAlerts={data.hasLegacyAlerts}
         canWrite={data.canWrite}
         canDelete={data.canDelete}
+        agentAvailable={data.agentAvailable}
       />
     );
   }
@@ -399,6 +415,7 @@ function NewAlertsPage({
   hasLegacyAlerts,
   canWrite,
   canDelete,
+  agentAvailable,
 }: {
   alerts: NewLoaderData["alerts"];
   hasMigratableLegacyAlerts: boolean;
@@ -408,11 +425,13 @@ function NewAlertsPage({
   hasLegacyAlerts: boolean;
   canWrite: boolean;
   canDelete: boolean;
+  agentAvailable: boolean;
 }) {
   const organization = useOrganization();
   const project = useProject();
   const environment = useEnvironment();
   const agent = useDashboardAgent();
+  const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
   const wantCreate = searchParams.get("create") === "1";
   const listQuery = searchParams.toString();
@@ -450,44 +469,64 @@ function NewAlertsPage({
     setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true });
   }, [agent, setSearchParams]);
 
+  const manualCreate = wantCreate && !agentAvailable && !agent;
+  const alertPath = (alertId: string) => v3AlertPath(organization, project, environment, alertId);
+
   return (
-    <PageContainer>
-      <NavBar>
-        <PageTitle title="Alerts" />
-        <PageAccessories>
-          <WhenAgentUnavailable>
-            <LinkButton
-              LeadingIcon={BookOpenIcon}
-              to={docsPath("v3/troubleshooting-alerts")}
-              variant="docs/small"
-            >
-              Alerts docs
-            </LinkButton>
-          </WhenAgentUnavailable>
-        </PageAccessories>
-      </NavBar>
-      <div className="grid grid-rows-[auto_1fr] overflow-hidden">
-        <LegacyAlertsBanner show={hasMigratableLegacyAlerts} />
-        <PageBody scrollable={false}>
-          <AlertsList
-            alerts={alerts}
-            newAlertPath={v3AlertCreatePath(organization, project, environment)}
-            newAlertPrompt={createAlertPrompt(environmentFullTitle(environment))}
-            alertPath={(alertId) => v3AlertPath(organization, project, environment, alertId)}
-            canWrite={canWrite}
-            canDelete={canDelete}
-            hasLegacyAlerts={hasLegacyAlerts}
-            channelsTo={`${v3ProjectAlertChannelsPath(organization, project, environment)}${
-              listQuery ? `?${listQuery}` : ""
-            }`}
-            legacyTo={v3ProjectLegacyAlertsPath(organization, project, environment)}
-            page={page}
-            totalPages={totalPages}
-            truncated={truncated}
-          />
-          <Outlet />
-        </PageBody>
-      </div>
-    </PageContainer>
+    <ManualAlertCreationDock
+      open={manualCreate}
+      prefill={{
+        area: asArea(searchParams.get("area") ?? undefined),
+        capability: searchParams.get("capability") ?? undefined,
+        scope: searchParams.get("scope") ?? undefined,
+        scopeValue: searchParams.get("scopeValue") ?? undefined,
+      }}
+      alertDetailPath={alertPath}
+      onCreated={(alertId) =>
+        alertId
+          ? navigate(alertPath(alertId))
+          : setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true })
+      }
+      onClose={() => setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true })}
+    >
+      <PageContainer>
+        <NavBar>
+          <PageTitle title="Alerts" />
+          <PageAccessories>
+            <WhenAgentUnavailable>
+              <LinkButton
+                LeadingIcon={BookOpenIcon}
+                to={docsPath("v3/troubleshooting-alerts")}
+                variant="docs/small"
+              >
+                Alerts docs
+              </LinkButton>
+            </WhenAgentUnavailable>
+          </PageAccessories>
+        </NavBar>
+        <div className="grid grid-rows-[auto_1fr] overflow-hidden">
+          <LegacyAlertsBanner show={hasMigratableLegacyAlerts} />
+          <PageBody scrollable={false}>
+            <AlertsList
+              alerts={alerts}
+              newAlertPath={v3AlertCreatePath(organization, project, environment)}
+              newAlertPrompt={createAlertPrompt(environmentFullTitle(environment))}
+              alertPath={alertPath}
+              canWrite={canWrite}
+              canDelete={canDelete}
+              hasLegacyAlerts={hasLegacyAlerts}
+              channelsTo={`${v3ProjectAlertChannelsPath(organization, project, environment)}${
+                listQuery ? `?${listQuery}` : ""
+              }`}
+              legacyTo={v3ProjectLegacyAlertsPath(organization, project, environment)}
+              page={page}
+              totalPages={totalPages}
+              truncated={truncated}
+            />
+            <Outlet />
+          </PageBody>
+        </div>
+      </PageContainer>
+    </ManualAlertCreationDock>
   );
 }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
new file mode 100644
index 00000000000..ac33226d861
--- /dev/null
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
@@ -0,0 +1,140 @@
+// @vitest-environment jsdom
+import { act, createElement, type ComponentProps, type ReactNode } from "react";
+import { createRoot } from "react-dom/client";
+import { describe, expect, it, vi } from "vitest";
+import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
+import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
+import type { DraftPrefillParams } from "~/components/dashboard-agent/alert-creation/flow-state";
+
+const openCreateAlert = vi.fn();
+let agent: unknown = null;
+
+vi.mock("@remix-run/react", () => ({
+  useLoaderData: () => ({
+    legacyChannels: [
+      {
+        id: "ch1",
+        name: "Ops webhook",
+        channelKind: "Webhook",
+        enabled: true,
+        alertTypes: ["TASK_RUN"],
+        alertTypeLabels: ["Task run failure"],
+        environmentNames: ["production"],
+      },
+    ],
+    canWrite: true,
+    canDelete: true,
+    replaceEnvironments: {
+      ch1: [{ id: "env1", type: "PRODUCTION", slug: "prod", branchName: null }],
+    },
+  }),
+  useFetcher: () => ({ state: "idle", submit: vi.fn() }),
+  useNavigate: () => vi.fn(),
+  useRevalidator: () => ({ revalidate: vi.fn() }),
+}));
+vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o" }) }));
+vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p" }) }));
+vi.mock("~/hooks/useEnvironment", () => ({ useEnvironment: () => ({ slug: "e" }) }));
+vi.mock("~/components/dashboard-agent/dashboardAgentLauncher", () => ({
+  useDashboardAgent: () => agent,
+}));
+vi.mock("~/components/alerts/ManualAlertCreation", () => ({
+  ManualAlertCreationDock: ({
+    open,
+    prefill,
+    children,
+  }: {
+    open: boolean;
+    prefill: DraftPrefillParams;
+    children: ReactNode;
+  }) => [
+    children,
+    open
+      ? createElement("div", { key: "dock", "data-testid": "dock" }, JSON.stringify(prefill))
+      : null,
+  ],
+}));
+vi.mock("~/components/layout/AppLayout", () => ({
+  PageContainer: ({ children }: { children: ReactNode }) => children,
+  PageBody: ({ children }: { children: ReactNode }) => children,
+}));
+vi.mock("~/components/primitives/PageHeader", () => ({
+  NavBar: () => null,
+  PageTitle: () => null,
+}));
+vi.mock("~/components/alerts/hasLegacyAlerts.server", () => ({}));
+vi.mock("~/models/message.server", () => ({}));
+vi.mock("~/models/project.server", () => ({}));
+vi.mock("~/models/runtimeEnvironment.server", () => ({}));
+vi.mock("~/presenters/v3/AlertChannelListPresenter.server", () => ({}));
+vi.mock("~/services/logger.server", () => ({}));
+vi.mock("~/services/projectAuthScope.server", () => ({}));
+vi.mock("~/services/routeBuilders/dashboardBuilder", () => ({
+  dashboardLoader: () => ({}),
+  dashboardAction: () => ({}),
+}));
+vi.mock("~/db.server", () => ({ prisma: {} }));
+vi.mock("~/services/dashboardAgentDb.server", () => ({}));
+vi.mock("@internal/dashboard-agent-db", () => ({}));
+vi.mock("~/v3/services/alerts/validateNotifierChannels.server", () => ({}));
+vi.mock("~/v3/services/common.server", () => ({ ServiceValidationError: class {} }));
+vi.mock("~/v3/services/alerts/deleteLegacySubscription.server", () => ({}));
+vi.mock("~/v3/services/dashboardResourceAccess.server", () => ({}));
+vi.mock("~/v3/services/alerts/replaceLegacySubscription.server", () => ({}));
+vi.mock("~/v3/canUseAlertsList.server", () => ({}));
+
+import Page from "./route";
+
+function renderPage() {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  act(() =>
+    root.render(
+      createElement(
+        OperatingSystemContextProvider,
+        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
+        createElement(ShortcutsProvider, null, createElement(Page))
+      )
+    )
+  );
+  const replace = Array.from(container.querySelectorAll("button")).find(
+    (b) => b.textContent === "Replace with new Alert"
+  )!;
+  return { container, root, replace };
+}
+
+describe("legacy alerts replace without the agent", () => {
+  it("enables Replace with the Watch icon and opens the manual dock for the row", () => {
+    agent = null;
+    const { container, root, replace } = renderPage();
+    expect(replace.disabled).toBe(false);
+    expect(replace.querySelector("svg.text-alerts")).not.toBeNull();
+    expect(container.querySelector("[data-testid=dock]")).toBeNull();
+    act(() => replace.click());
+    const dock = container.querySelector("[data-testid=dock]");
+    expect(JSON.parse(dock!.textContent!)).toEqual({
+      capability: "runs.failed",
+      scope: "all",
+      replace: {
+        channelId: "ch1",
+        channelName: "Ops webhook",
+        alertType: "TASK_RUN",
+        environments: [{ id: "env1", type: "PRODUCTION", slug: "prod", branchName: null }],
+      },
+    });
+    act(() => root.unmount());
+    container.remove();
+  });
+
+  it("hands Replace to the agent when it is available", () => {
+    agent = { openCreateAlert };
+    const { container, root, replace } = renderPage();
+    expect(replace.querySelector("svg.text-alerts")).toBeNull();
+    act(() => replace.click());
+    expect(openCreateAlert).toHaveBeenCalledTimes(1);
+    expect(container.querySelector("[data-testid=dock]")).toBeNull();
+    act(() => root.unmount());
+    container.remove();
+  });
+});
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
index 8d19b214d76..e68f1d298da 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
@@ -1,12 +1,18 @@
-import { useFetcher, useLoaderData } from "@remix-run/react";
+import { useFetcher, useLoaderData, useNavigate, useRevalidator } from "@remix-run/react";
+import { useState } from "react";
 import { json, redirect } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { alertTypeTitle } from "~/components/alerts/AlertChannelsBody";
 import { hasLegacyAlerts } from "~/components/alerts/hasLegacyAlerts.server";
 import { LegacyAlertsSection } from "~/components/alerts/LegacyAlertsSection";
+import { ManualAlertCreationDock } from "~/components/alerts/ManualAlertCreation";
 import { useDashboardAgent } from "~/components/dashboard-agent/dashboardAgentLauncher";
-import { replacePrefill } from "~/components/dashboard-agent/alert-creation/flow-state";
 import {
+  replacePrefill,
+  type DraftPrefillParams,
+} from "~/components/dashboard-agent/alert-creation/flow-state";
+import {
+  afterReplace,
   replacedMessage,
   toLegacyAlertChannelRows,
   type LegacyAlertChannelRow,
@@ -25,6 +31,7 @@ import { resolveProjectAuthScope } from "~/services/projectAuthScope.server";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import {
   EnvironmentParamSchema,
+  v3AlertPath,
   v3ProjectAlertsPath,
   v3ProjectLegacyAlertsPath,
 } from "~/utils/pathBuilder";
@@ -326,35 +333,54 @@ export default function Page() {
   const environment = useEnvironment();
   const fetcher = useFetcher();
   const agent = useDashboardAgent();
+  const navigate = useNavigate();
+  const revalidator = useRevalidator();
+  const [manualReplace, setManualReplace] = useState<DraftPrefillParams | null>(null);
+  const alertsPath = v3ProjectAlertsPath(organization, project, environment);
 
   return (
-    <PageContainer>
-      <NavBar>
-        <PageTitle
-          title="Legacy alerts"
-          backButton={{
-            to: v3ProjectAlertsPath(organization, project, environment),
-            text: "Alerts",
-          }}
-        />
-      </NavBar>
-      <PageBody scrollable={legacyChannels.length > 0}>
-        <LegacyAlertsSection
-          channels={legacyChannels}
-          canWrite={canWrite}
-          canDelete={canDelete}
-          replacing={!agent || fetcher.state !== "idle"}
-          onDelete={(row) =>
-            fetcher.submit(
-              { intent: "deleteLegacyAlert", channelId: row.channelId, alertType: row.alertType },
-              { method: "post" }
-            )
-          }
-          onReplace={(row) =>
-            agent?.openCreateAlert(replacePrefill(row, replaceEnvironments[row.channelId] ?? []))
-          }
-        />
-      </PageBody>
-    </PageContainer>
+    <ManualAlertCreationDock
+      open={!agent && manualReplace !== null}
+      prefill={manualReplace ?? {}}
+      alertDetailPath={(alertId) => v3AlertPath(organization, project, environment, alertId)}
+      onCreated={() => setManualReplace(null)}
+      onReplaced={({ legacyRemaining }) => {
+        setManualReplace(null);
+        afterReplace(legacyRemaining, alertsPath, navigate, () => revalidator.revalidate());
+      }}
+      onClose={() => setManualReplace(null)}
+    >
+      <PageContainer>
+        <NavBar>
+          <PageTitle
+            title="Legacy alerts"
+            backButton={{
+              to: alertsPath,
+              text: "Alerts",
+            }}
+          />
+        </NavBar>
+        <PageBody scrollable={legacyChannels.length > 0}>
+          <LegacyAlertsSection
+            channels={legacyChannels}
+            canWrite={canWrite}
+            canDelete={canDelete}
+            replacing={fetcher.state !== "idle"}
+            manualReplace={!agent}
+            onDelete={(row) =>
+              fetcher.submit(
+                { intent: "deleteLegacyAlert", channelId: row.channelId, alertType: row.alertType },
+                { method: "post" }
+              )
+            }
+            onReplace={(row) => {
+              const prefill = replacePrefill(row, replaceEnvironments[row.channelId] ?? []);
+              if (agent) agent.openCreateAlert(prefill);
+              else setManualReplace(prefill);
+            }}
+          />
+        </PageBody>
+      </PageContainer>
+    </ManualAlertCreationDock>
   );
 }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
index ceb03abdb11..84739313690 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
@@ -8,7 +8,11 @@ import {
 } from "@remix-run/react";
 import { type ActionFunctionArgs, type LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { randomBytes } from "node:crypto";
-import { WebhookRoutingTarget, WebhookVerifierArtifact } from "@trigger.dev/core/v3";
+import {
+  WebhookPreviousSecretTtlSeconds,
+  WebhookRoutingTarget,
+  WebhookVerifierArtifact,
+} from "@trigger.dev/core/v3";
 import type { WebhookValueSource } from "@trigger.dev/core/v3";
 import { type MutableRefObject, Suspense, useEffect, useRef, useState } from "react";
 import { TypedAwait, typeddefer, useTypedLoaderData } from "remix-typedjson";
@@ -69,7 +73,6 @@ import { docsPath, EnvironmentParamSchema, v3WebhooksPath } from "~/utils/pathBu
 import { throwPermissionDenied } from "~/utils/permissionDenied";
 import { parseFiniteInt } from "~/utils/searchParams";
 import { webhookEngine, webhookVerifyTokenKey } from "~/v3/webhookEngine.server";
-import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import {
   generateWebhookSigningSecret,
   storeWebhookSigningSecret,
@@ -212,7 +215,7 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
 };
 
 const PreviousSecretTtlFormField = z.object({
-  previousSecretTtlSeconds: z.coerce.number().pipe(PreviousSecretTtlSeconds).optional(),
+  previousSecretTtlSeconds: z.coerce.number().pipe(WebhookPreviousSecretTtlSeconds).optional(),
 });
 
 const SetSecretSchema = PreviousSecretTtlFormField.extend({
diff --git a/apps/webapp/app/routes/account._index/route.tsx b/apps/webapp/app/routes/account._index/route.tsx
index 8b279c1a3b4..130038d18da 100644
--- a/apps/webapp/app/routes/account._index/route.tsx
+++ b/apps/webapp/app/routes/account._index/route.tsx
@@ -725,7 +725,7 @@ function CustomizeSidebarButton({
 }) {
   const user = useUser();
   const isAdmin = useHasAdminAccess();
-  const { isManagedCloud } = useFeatures();
+  const { isManagedCloud, alertsConfigured } = useFeatures();
   const favorites = useFavorites();
   const [isOpen, setIsOpen] = useState(false);
   const [isConfirming, setIsConfirming] = useState(false);
@@ -767,16 +767,18 @@ function CustomizeSidebarButton({
           },
         ]
       : []),
-    ...buildSideMenuSections({ ...context, isAdmin, isManagedCloud }).map((section) => ({
-      id: section.id,
-      title: section.title,
-      items: section.items.map((item) => ({
-        id: item.id,
-        name: item.name,
-        icon: item.icon,
-        defaultHidden: item.defaultHidden,
-      })),
-    })),
+    ...buildSideMenuSections({ ...context, isAdmin, alertsConfigured, isManagedCloud }).map(
+      (section) => ({
+        id: section.id,
+        title: section.title,
+        items: section.items.map((item) => ({
+          id: item.id,
+          name: item.name,
+          icon: item.icon,
+          defaultHidden: item.defaultHidden,
+        })),
+      })
+    ),
   ];
 
   return (
diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
index c0bb08f2e25..a534602bf8d 100644
--- a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
+++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
@@ -14,6 +14,10 @@ const ParamsSchema = z.object({
   env: z.enum(["dev", "staging", "prod", "preview"]),
 });
 
+const BodySchema = z.object({
+  revokeImmediately: z.boolean().default(false),
+});
+
 export async function action({ request, params }: ActionFunctionArgs) {
   if (request.method.toUpperCase() !== "POST") {
     return json({ error: "Method Not Allowed" }, { status: 405 });
@@ -42,6 +46,24 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });
     }
 
+    const rawBody = await request.text();
+    let body: unknown = {};
+    if (rawBody.trim().length > 0) {
+      try {
+        body = JSON.parse(rawBody);
+      } catch {
+        return json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+    }
+
+    const parsedBody = BodySchema.safeParse(body);
+
+    if (!parsedBody.success) {
+      return json({ error: "Invalid Body" }, { status: 400 });
+    }
+
+    const { revokeImmediately } = parsedBody.data;
+
     const environment = await authenticatedEnvironmentForAuthentication(
       authenticationResult,
       projectRef,
@@ -65,6 +87,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
     const updatedEnvironment = await regenerateApiKey({
       userId: authenticationResult.result.userId,
       environmentId: environment.id,
+      revokeImmediately,
     });
 
     return json({ apiKey: updatedEnvironment.apiKey });
diff --git a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
index 4a1b605e340..804d12ae251 100644
--- a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
+++ b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
@@ -1,19 +1,14 @@
 import { json } from "@remix-run/server-runtime";
+import { RotateWebhookEndpointSecretRequestBody } from "@trigger.dev/core/v3";
 import { z } from "zod";
 import { webhookPrisma } from "~/db.server";
 import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";
 import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";
 import { safeJsonParse } from "~/utils/json";
-import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import { generateWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";
 
 const ParamsSchema = z.object({ endpointId: z.string() });
 
-/** Optional: existing callers POST with no body, which keeps the replace-immediately behavior. */
-const RotateSecretRequestBody = z.object({
-  previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),
-});
-
 // POST /api/v1/webhooks/endpoints/:endpointId/rotate-secret — mint a new signing secret and return
 // it ONCE. Only for schemes we generate (hmac / shared-secret); asymmetric endpoints set a public key.
 const { action, loader } = createActionApiRoute(
@@ -26,7 +21,9 @@ const { action, loader } = createActionApiRoute(
   },
   async ({ params, authentication, request }) => {
     const rawBody = await request.text();
-    const body = RotateSecretRequestBody.safeParse(rawBody ? safeJsonParse(rawBody) : {});
+    const body = RotateWebhookEndpointSecretRequestBody.safeParse(
+      rawBody ? safeJsonParse(rawBody) : {}
+    );
     if (!body.success) {
       return json({ error: "Invalid request body", issues: body.error.issues }, { status: 400 });
     }
diff --git a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
index 16eb39fec3e..ebbd28fc970 100644
--- a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
+++ b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
@@ -4,19 +4,14 @@ import { z } from "zod";
 import { webhookPrisma } from "~/db.server";
 import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";
 import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";
-import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import { storeWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";
 
 const ParamsSchema = z.object({ endpointId: z.string() });
 
-const SetSecretRequestBody = SetWebhookEndpointSecretRequestBody.extend({
-  previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),
-});
-
 const { action, loader } = createActionApiRoute(
   {
     params: ParamsSchema,
-    body: SetSecretRequestBody,
+    body: SetWebhookEndpointSecretRequestBody,
     method: "PUT",
     allowJWT: true,
     corsStrategy: "all",
diff --git a/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx b/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
index ced2145f212..dc604e6f2ce 100644
--- a/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
+++ b/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
@@ -52,9 +52,14 @@ export const action = dashboardAction(
 
     const formData = await request.formData();
     const syncToVercel = formData.get("syncToVercel") === "on";
+    const revokeImmediately = formData.get("previousKey") === "revoke";
 
     try {
-      const updatedEnvironment = await regenerateApiKey({ userId: user.id, environmentId });
+      const updatedEnvironment = await regenerateApiKey({
+        userId: user.id,
+        environmentId,
+        revokeImmediately,
+      });
 
       // Sync the regenerated API key to Vercel only when requested and not for DEVELOPMENT
       if (syncToVercel && updatedEnvironment.type !== "DEVELOPMENT") {
diff --git a/apps/webapp/app/v3/canUseAlertsList.server.ts b/apps/webapp/app/v3/canUseAlertsList.server.ts
index d7936a08e26..b9c7fb40602 100644
--- a/apps/webapp/app/v3/canUseAlertsList.server.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.server.ts
@@ -5,6 +5,7 @@ import { v3ProjectAlertsPath } from "~/utils/pathBuilder";
 import { FEATURE_FLAG } from "~/v3/featureFlags";
 import { makeFlag } from "~/v3/featureFlags.server";
 import { computeCanUseAlertsList, isAlertsEnabledEnv } from "./canUseAlertsList";
+import { isAlertsConfigured } from "./services/alerts/alertsConfigured.server";
 
 async function isAlertsFlagEnabled(
   orgFeatureFlags: Record<string, unknown> | null | undefined
@@ -53,7 +54,11 @@ export async function canUseAlertsList(options: {
     isAdmin = user?.admin ?? false;
   }
 
-  return computeCanUseAlertsList(Boolean(flagResult), isAdmin);
+  return computeCanUseAlertsList(
+    Boolean(flagResult),
+    isAdmin,
+    isAlertsConfigured({ alertsEnabled: env.ALERTS_ENABLED })
+  );
 }
 
 type AlertsGateParams = {
diff --git a/apps/webapp/app/v3/canUseAlertsList.test.ts b/apps/webapp/app/v3/canUseAlertsList.test.ts
index 41d44cc5716..ad7bae2ed72 100644
--- a/apps/webapp/app/v3/canUseAlertsList.test.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.test.ts
@@ -2,16 +2,20 @@ import { describe, expect, it } from "vitest";
 import { computeCanUseAlertsList, isAlertsEnabledEnv } from "./canUseAlertsList";
 
 describe("computeCanUseAlertsList", () => {
-  it("admin, flag off -> true", () => {
-    expect(computeCanUseAlertsList(false, true)).toBe(true);
+  it("admin, flag off, configured -> true", () => {
+    expect(computeCanUseAlertsList(false, true, true)).toBe(true);
+  });
+
+  it("admin, flag off, not configured -> false", () => {
+    expect(computeCanUseAlertsList(false, true, false)).toBe(false);
   });
 
   it("non-admin, flag off -> false", () => {
-    expect(computeCanUseAlertsList(false, false)).toBe(false);
+    expect(computeCanUseAlertsList(false, false, true)).toBe(false);
   });
 
   it("non-admin, flag on -> true", () => {
-    expect(computeCanUseAlertsList(true, false)).toBe(true);
+    expect(computeCanUseAlertsList(true, false, false)).toBe(true);
   });
 });
 
diff --git a/apps/webapp/app/v3/canUseAlertsList.ts b/apps/webapp/app/v3/canUseAlertsList.ts
index b9c6492ed1e..27a8f51e9d7 100644
--- a/apps/webapp/app/v3/canUseAlertsList.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.ts
@@ -1,10 +1,14 @@
 /**
  * The single Alerts-list gating rule: the `alertsEnabled` flag (per-org override
- * winning), or the viewer being a platform admin. Off leaves the legacy channel-list
- * page unchanged for non-admins.
+ * winning), or a platform admin on an install where alerts are configured. Off leaves
+ * the legacy channel-list page unchanged.
  */
-export function computeCanUseAlertsList(flagEnabled: boolean, isAdmin: boolean): boolean {
-  return flagEnabled || isAdmin;
+export function computeCanUseAlertsList(
+  flagEnabled: boolean,
+  isAdmin: boolean,
+  alertsConfigured: boolean
+): boolean {
+  return flagEnabled || (isAdmin && alertsConfigured);
 }
 
 export function isAlertsEnabledEnv(value: string | undefined): boolean {
diff --git a/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts b/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
index 7ceb791029a..990a948cc83 100644
--- a/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
+++ b/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
@@ -1030,6 +1030,10 @@ async function resolveOverridableTriggerVariables(
       key: "TRIGGER_REALTIME_STREAM_VERSION",
       value: env.REALTIME_STREAM_VERSION,
     },
+    {
+      key: "TRIGGER_DASHBOARD_URL",
+      value: env.APP_ORIGIN.replace(/\/$/, ""),
+    },
   ];
 
   return result;
diff --git a/apps/webapp/app/v3/featureFlags.ts b/apps/webapp/app/v3/featureFlags.ts
index dedbbf63b3d..c8e31dd8945 100644
--- a/apps/webapp/app/v3/featureFlags.ts
+++ b/apps/webapp/app/v3/featureFlags.ts
@@ -2,6 +2,7 @@ import { z } from "zod";
 import { DeployBuildPath } from "@trigger.dev/core/v3";
 
 export const FEATURE_FLAG = {
+  waitpointStoreEnabled: "waitpointStoreEnabled",
   snapshotStoreMode: "snapshotStoreMode",
   allowEmptyEnvironmentVariableValues: "allowEmptyEnvironmentVariableValues",
   defaultWorkerInstanceGroupId: "defaultWorkerInstanceGroupId",
@@ -92,6 +93,7 @@ const WorkerQueueEnvironmentOverrideKey = z
   );
 
 export const FeatureFlagCatalog = {
+  [FEATURE_FLAG.waitpointStoreEnabled]: z.boolean(),
   // Organization override, then global default, then off.
   [FEATURE_FLAG.snapshotStoreMode]: z.enum(["off", "dual-write", "redis-read", "redis-only"]),
   [FEATURE_FLAG.allowEmptyEnvironmentVariableValues]: z.boolean(),
diff --git a/apps/webapp/app/v3/invocationUsage.server.ts b/apps/webapp/app/v3/invocationUsage.server.ts
new file mode 100644
index 00000000000..312d7eac10f
--- /dev/null
+++ b/apps/webapp/app/v3/invocationUsage.server.ts
@@ -0,0 +1,3 @@
+export function shouldReportAttemptInvocation(run: { attemptNumber: number }): boolean {
+  return run.attemptNumber === 1;
+}
diff --git a/apps/webapp/app/v3/runEngine.server.ts b/apps/webapp/app/v3/runEngine.server.ts
index 75c8f83240f..571c1c364c4 100644
--- a/apps/webapp/app/v3/runEngine.server.ts
+++ b/apps/webapp/app/v3/runEngine.server.ts
@@ -1,3 +1,5 @@
+import { createWaitpointStoreEnabledResolver } from "./utils/waitpointStoreEnabled.server";
+import { globalFlagsRegistry } from "./globalFlagsRegistry.server";
 import { RunEngine } from "@internal/run-engine";
 import { $replica, prisma } from "~/db.server";
 import { env } from "~/env.server";
@@ -20,6 +22,10 @@ export type { RunEngine };
 
 function createRunEngine() {
   const engine = new RunEngine({
+    waitpointStoreEnabled: createWaitpointStoreEnabledResolver(
+      () => globalFlagsRegistry.current(),
+      prisma
+    ),
     prisma,
     readOnlyPrisma: $replica,
     crossSeamGuard: pickRunOpsStoreForCompletion,
diff --git a/apps/webapp/app/v3/runEngineHandlers.server.ts b/apps/webapp/app/v3/runEngineHandlers.server.ts
index 7ce06198340..4dcdb21046f 100644
--- a/apps/webapp/app/v3/runEngineHandlers.server.ts
+++ b/apps/webapp/app/v3/runEngineHandlers.server.ts
@@ -30,6 +30,7 @@ import { tracer } from "~/v3/tracer.server";
 import { createExceptionPropertiesFromError } from "./eventRepository/common.server";
 import { getEventRepositoryForStore, recordRunDebugLog } from "./eventRepository/index.server";
 import { roomFromFriendlyRunId, socketIo } from "./handleSocketIo.server";
+import { shouldReportAttemptInvocation } from "./invocationUsage.server";
 import { engine } from "./runEngine.server";
 import { runStore } from "./runStore.server";
 import { mintAnchoredRunFriendlyId } from "~/v3/runOpsMigration/mintAnchoredRunFriendlyId.server";
@@ -587,7 +588,7 @@ export function registerRunEngineEventBusHandlers() {
   engine.eventBus.on("runAttemptStarted", async (event) => {
     const { run, organization } = event;
 
-    if (run.attemptNumber !== 1 || run.baseCostInCents <= 0) {
+    if (!shouldReportAttemptInvocation(run)) {
       return;
     }
 
diff --git a/apps/webapp/app/v3/services/alerts/alertTransport.server.ts b/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
index 0af0e06355e..e4d666844a4 100644
--- a/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
+++ b/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
@@ -24,23 +24,28 @@ const PERMANENT_WEBHOOK_STATUSES = [401, 403, 404, 410];
 
 export async function findSlackIntegration(
   prisma: { organizationIntegration: { findFirst: Function } },
-  params: { integrationId?: string | null; organizationId: string }
+  params: { integrationId?: string | null; organizationId: string },
+  options: { includeDeleted?: boolean } = {}
 ): Promise<OrganizationIntegrationForService<"SLACK"> | null> {
+  const findLatest = (where: { deletedAt?: null }) =>
+    prisma.organizationIntegration.findFirst({
+      where: { service: "SLACK", organizationId: params.organizationId, ...where },
+      orderBy: { createdAt: "desc" },
+      include: { tokenReference: true },
+    });
+
   const integration = params.integrationId
     ? await prisma.organizationIntegration.findFirst({
         where: {
           id: params.integrationId,
           service: "SLACK",
           organizationId: params.organizationId,
-          deletedAt: null,
+          ...(options.includeDeleted ? {} : { deletedAt: null }),
         },
         include: { tokenReference: true },
       })
-    : await prisma.organizationIntegration.findFirst({
-        where: { service: "SLACK", organizationId: params.organizationId, deletedAt: null },
-        orderBy: { createdAt: "desc" },
-        include: { tokenReference: true },
-      });
+    : ((await findLatest({ deletedAt: null })) ??
+      (options.includeDeleted ? await findLatest({}) : null));
 
   if (!integration || !isIntegrationForService(integration, "SLACK")) {
     return null;
diff --git a/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
index 3e3f6110549..e1aae778e9f 100644
--- a/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
@@ -761,10 +761,14 @@ export class DeliverAlertService extends BaseService {
       return;
     }
 
-    const integration = await findSlackIntegration(this._prisma, {
-      integrationId: slackProperties.data.integrationId,
-      organizationId: alert.project.organizationId,
-    });
+    const integration = await findSlackIntegration(
+      this._prisma,
+      {
+        integrationId: slackProperties.data.integrationId,
+        organizationId: alert.project.organizationId,
+      },
+      { includeDeleted: true }
+    );
 
     if (!integration) {
       logger.error("[DeliverAlert] Slack integration not found", {
diff --git a/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
index a0e42d69300..ae8fb78f250 100644
--- a/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
@@ -277,10 +277,14 @@ export class DeliverDashboardAgentWatchChannelAlertService {
       return;
     }
 
-    const integration = await findSlackIntegration(prisma, {
-      integrationId: slackProperties.data.integrationId,
-      organizationId: payload.organizationId,
-    });
+    const integration = await findSlackIntegration(
+      prisma,
+      {
+        integrationId: slackProperties.data.integrationId,
+        organizationId: payload.organizationId,
+      },
+      { includeDeleted: true }
+    );
 
     if (!integration) {
       logger.error("[DeliverDashboardAgentWatchAlert] Slack integration not found");
diff --git a/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
index 2ac291bdec4..d04246b0042 100644
--- a/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
@@ -28,6 +28,7 @@ import {
   buildErrorGroupSlackMessage,
   type ErrorAlertPayload,
 } from "./errorGroupSlackMessage.server";
+import { findSlackIntegration } from "./alertTransport.server";
 import { safeWebhookFetch } from "./safeWebhookFetch.server";
 
 class SkipRetryError extends Error {}
@@ -143,24 +144,14 @@ export class DeliverErrorGroupAlertService {
       return;
     }
 
-    const integration = slackProperties.data.integrationId
-      ? await prisma.organizationIntegration.findFirst({
-          where: {
-            id: slackProperties.data.integrationId,
-            organizationId: channel.project.organizationId,
-            deletedAt: null,
-          },
-          include: { tokenReference: true },
-        })
-      : await prisma.organizationIntegration.findFirst({
-          where: {
-            service: "SLACK",
-            organizationId: channel.project.organizationId,
-            deletedAt: null,
-          },
-          orderBy: { createdAt: "desc" },
-          include: { tokenReference: true },
-        });
+    const integration = await findSlackIntegration(
+      prisma,
+      {
+        integrationId: slackProperties.data.integrationId,
+        organizationId: channel.project.organizationId,
+      },
+      { includeDeleted: true }
+    );
 
     if (!integration || !isIntegrationForService(integration, "SLACK")) {
       logger.error("[DeliverErrorGroupAlert] Slack integration not found");
diff --git a/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts b/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
index dd232deffb4..3a9dc3cb57a 100644
--- a/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
+++ b/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
@@ -47,3 +47,60 @@ postgresTest("ignores a soft-deleted Slack integration", async ({ prisma }) => {
   ).toBeNull();
   expect(await findSlackIntegration(prisma, { organizationId: organization.id })).toBeNull();
 });
+
+postgresTest(
+  "resolves a soft-deleted integration by id when includeDeleted is set",
+  async ({ prisma }) => {
+    const { organization, integration } = await seed(prisma, true);
+
+    const byId = await findSlackIntegration(
+      prisma,
+      { integrationId: integration.id, organizationId: organization.id },
+      { includeDeleted: true }
+    );
+
+    expect(byId?.id).toBe(integration.id);
+  }
+);
+
+postgresTest(
+  "resolves a soft-deleted integration by organization when includeDeleted is set",
+  async ({ prisma }) => {
+    const { organization, integration } = await seed(prisma, true);
+
+    const byOrg = await findSlackIntegration(
+      prisma,
+      { organizationId: organization.id },
+      { includeDeleted: true }
+    );
+
+    expect(byOrg?.id).toBe(integration.id);
+  }
+);
+
+postgresTest(
+  "prefers an older live integration over a newer soft-deleted one when includeDeleted is set",
+  async ({ prisma }) => {
+    const { organization, integration: live } = await seed(prisma, false);
+    const secret = await prisma.secretReference.create({ data: { key: "slack-lookup-token-2" } });
+    await prisma.organizationIntegration.create({
+      data: {
+        friendlyId: generateFriendlyId("org_integration"),
+        service: "SLACK",
+        integrationData: {},
+        tokenReferenceId: secret.id,
+        organizationId: organization.id,
+        createdAt: new Date(Date.now() + 60_000),
+        deletedAt: new Date(),
+      },
+    });
+
+    const byOrg = await findSlackIntegration(
+      prisma,
+      { organizationId: organization.id },
+      { includeDeleted: true }
+    );
+
+    expect(byOrg?.id).toBe(live.id);
+  }
+);
diff --git a/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts b/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
new file mode 100644
index 00000000000..36a04638abc
--- /dev/null
+++ b/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
@@ -0,0 +1,26 @@
+import type { PrismaClient } from "@trigger.dev/database";
+import { FEATURE_FLAG, FeatureFlagCatalog } from "../featureFlags";
+
+/** The normal organization override, then global default, then off. No rollout history. */
+export function createWaitpointStoreEnabledResolver(
+  readFlags: () => { waitpointStoreEnabled?: boolean } | undefined,
+  prisma: Pick<PrismaClient, "organization">
+) {
+  return async (organizationId: string, organizationFlags?: unknown): Promise<boolean> => {
+    const overrides =
+      organizationFlags === undefined
+        ? (
+            await prisma.organization.findFirst({
+              where: { id: organizationId },
+              select: { featureFlags: true },
+            })
+          )?.featureFlags
+        : organizationFlags;
+    const value =
+      typeof overrides === "object" && overrides !== null && "waitpointStoreEnabled" in overrides
+        ? overrides.waitpointStoreEnabled
+        : undefined;
+    const parsed = FeatureFlagCatalog[FEATURE_FLAG.waitpointStoreEnabled].safeParse(value);
+    return parsed.success ? parsed.data : (readFlags()?.waitpointStoreEnabled ?? false);
+  };
+}
diff --git a/apps/webapp/app/v3/webhookSetupPrompt.ts b/apps/webapp/app/v3/webhookSetupPrompt.ts
index acdd23d95a2..a9363f05785 100644
--- a/apps/webapp/app/v3/webhookSetupPrompt.ts
+++ b/apps/webapp/app/v3/webhookSetupPrompt.ts
@@ -152,7 +152,7 @@ export function renderWebhookSetupPrompt(
 function secretStep(endpoint: WebhookSetupPromptEndpoint, asymmetric: boolean): string {
   const source = endpoint.source;
   const replacing = endpoint.hasSigningSecret
-    ? ` ${asymmetric ? "A public key" : "A secret"} is already set; replacing it breaks deliveries until ${source} uses the new one, so only replace it when you're creating or updating the webhook in ${source}.`
+    ? ` ${asymmetric ? "A public key" : "A secret"} is already set; only replace it when you're creating or updating the webhook in ${source}, and pass \`previousSecretTtlSeconds\` (for example 3600) so deliveries signed with the old one keep verifying until ${source} uses the new one.`
     : "";
 
   if (asymmetric) {
diff --git a/apps/webapp/app/v3/webhookSigningSecret.ts b/apps/webapp/app/v3/webhookSigningSecret.ts
index 3ae9117442f..e91774011c0 100644
--- a/apps/webapp/app/v3/webhookSigningSecret.ts
+++ b/apps/webapp/app/v3/webhookSigningSecret.ts
@@ -1,14 +1,5 @@
 import { z } from "zod";
 
-export const MAX_PREVIOUS_SECRET_TTL_SECONDS = 7 * 24 * 60 * 60;
-
-/** How long the replaced secret keeps verifying deliveries; 0 replaces it immediately. */
-export const PreviousSecretTtlSeconds = z
-  .number()
-  .int()
-  .min(0)
-  .max(MAX_PREVIOUS_SECRET_TTL_SECONDS);
-
 /**
  * An endpoint's signing secret as stored in the SecretStore. `previous` is the secret it replaced,
  * still accepted until `expiresAt` so a rotation doesn't fail deliveries the provider signs with it.
diff --git a/apps/webapp/test/alertsGateRoutes.test.ts b/apps/webapp/test/alertsGateRoutes.test.ts
index a135aa89f25..a4ec92dde7e 100644
--- a/apps/webapp/test/alertsGateRoutes.test.ts
+++ b/apps/webapp/test/alertsGateRoutes.test.ts
@@ -1,3 +1,4 @@
+import type * as AlertsGate from "~/v3/canUseAlertsList.server";
 import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.setConfig({ testTimeout: 30_000 });
@@ -35,8 +36,11 @@ vi.mock("~/services/routeBuilders/dashboardBuilder", () => {
 vi.mock("~/services/session.server", () => ({ requireUserId: async () => "user_1" }));
 
 vi.mock("~/db.server", () => ({
-  prisma: { organizationIntegration: { findFirst: async () => ({ id: "int_1" }) } },
-  $replica: {},
+  prisma: {
+    organizationIntegration: { findFirst: async () => ({ id: "int_1" }) },
+    user: { findFirst: async () => ({ admin: true }) },
+  },
+  $replica: { organization: { findFirst: async () => ({ featureFlags: {} }) } },
 }));
 
 vi.mock("~/models/project.server", async (importOriginal) => ({
@@ -132,6 +136,11 @@ vi.mock("~/v3/canUseAlertsList.server", async () => {
   };
 });
 
+vi.mock("~/v3/featureFlags.server", async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  makeFlag: () => async (opts: { defaultValue: unknown }) => opts.defaultValue,
+}));
+
 const P = "_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam";
 const params = { organizationSlug: "o", projectParam: "p", envParam: "dev", channelId: "c" };
 const request = (method = "GET") => new Request("http://localhost/x", { method });
@@ -189,6 +198,15 @@ describe("new alerts surfaces when alertsEnabled is off", () => {
   });
 });
 
+describe("admin preview when ALERTS_ENABLED is unset", () => {
+  it("the real gate redirects an admin to the old alerts page", async () => {
+    const real = await vi.importActual<typeof AlertsGate>("~/v3/canUseAlertsList.server");
+    const res = await thrown(() => real.requireAlertsEnabledOrRedirect("user_1", params));
+    expect(res?.status).toBe(302);
+    expect(await real.canUseAlertsList({ orgFeatureFlags: {}, user: { admin: true } })).toBe(false);
+  });
+});
+
 describe("preview-series authorization", () => {
   it("responds 403 to a member denied read:alerts", async () => {
     STATE.enabled = true;
diff --git a/apps/webapp/test/alertsListRouteLegacy.test.ts b/apps/webapp/test/alertsListRouteLegacy.test.ts
index bfa94c2aa1d..6e80d1aa4a8 100644
--- a/apps/webapp/test/alertsListRouteLegacy.test.ts
+++ b/apps/webapp/test/alertsListRouteLegacy.test.ts
@@ -38,6 +38,9 @@ vi.mock("~/models/runtimeEnvironment.server", () => ({
 }));
 
 vi.mock("~/v3/canUseAlertsList.server", () => ({ canUseAlertsList: async () => true }));
+vi.mock("~/v3/canAccessDashboardAgent.server", () => ({
+  canAccessDashboardAgent: async () => false,
+}));
 
 vi.mock("~/presenters/v3/AlertsListPresenter.server", () => ({
   AlertsListPresenter: class {
diff --git a/apps/webapp/test/alertsRequireEnabled.test.ts b/apps/webapp/test/alertsRequireEnabled.test.ts
index 3d91577198e..291a2a0c16e 100644
--- a/apps/webapp/test/alertsRequireEnabled.test.ts
+++ b/apps/webapp/test/alertsRequireEnabled.test.ts
@@ -1,8 +1,14 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const STATE = vi.hoisted(() => ({ member: true, flag: false, admin: false }));
+const STATE = vi.hoisted(() => ({ member: true, flag: false, admin: false, configured: "1" }));
 
-vi.mock("~/env.server", () => ({ env: {} }));
+vi.mock("~/env.server", () => ({
+  env: {
+    get ALERTS_ENABLED() {
+      return STATE.configured;
+    },
+  },
+}));
 vi.mock("~/v3/featureFlags.server", () => ({ makeFlag: () => async () => STATE.flag }));
 vi.mock("~/db.server", () => ({
   prisma: { user: { findFirst: async () => ({ admin: STATE.admin }) } },
@@ -34,6 +40,7 @@ beforeEach(() => {
   STATE.member = true;
   STATE.flag = false;
   STATE.admin = false;
+  STATE.configured = "1";
 });
 
 describe.each([
@@ -49,11 +56,17 @@ describe.each([
     expect(await thrown(run)).toBeUndefined();
   });
 
-  it("allows an admin member with the flag off", async () => {
+  it("allows an admin member with the flag off when alerts are configured", async () => {
     STATE.admin = true;
     expect(await thrown(run)).toBeUndefined();
   });
 
+  it("denies an admin member with the flag off when alerts are not configured", async () => {
+    STATE.admin = true;
+    STATE.configured = "";
+    expect((await thrown(run))?.status).toBe(deniedStatus);
+  });
+
   it("denies a non-member even with the flag on", async () => {
     STATE.member = false;
     STATE.flag = true;
diff --git a/apps/webapp/test/api-auth.e2e.test.ts b/apps/webapp/test/api-auth.e2e.test.ts
index 4e8c4346349..43140f2213b 100644
--- a/apps/webapp/test/api-auth.e2e.test.ts
+++ b/apps/webapp/test/api-auth.e2e.test.ts
@@ -538,3 +538,37 @@ describe("API bearer auth — environment/project edge cases", () => {
     expect(res.status).toBe(401);
   });
 });
+
+describe("admin waitpoint rollout controls", () => {
+  it("saves the normal org/global flag without writing derived global state", async () => {
+    const user = await seedTestUser(server.prisma, { admin: true });
+    const pat = await seedTestPAT(server.prisma, user.id);
+    const organization = await server.prisma.organization.create({
+      data: { title: "Waitpoint rollout", slug: `waitpoint-rollout-${user.id}` },
+    });
+    const post = async (path: string, body: unknown) => {
+      const response = await server.webapp.fetch(path, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${pat.token}`, "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      expect(response.status, await response.text()).toBe(200);
+    };
+    const globalPath = "/admin/api/v1/feature-flags";
+    try {
+      await post(`/admin/api/v1/orgs/${organization.id}/feature-flags`, {
+        waitpointStoreEnabled: true,
+      });
+      await post(globalPath, { waitpointStoreEnabled: false });
+      expect(
+        (await server.prisma.organization.findFirstOrThrow({ where: { id: organization.id } }))
+          .featureFlags
+      ).toMatchObject({ waitpointStoreEnabled: true });
+      expect(
+        await server.prisma.featureFlag.findFirst({ where: { key: "waitpointRolloutState" } })
+      ).toBeNull();
+    } finally {
+      await post(globalPath, { waitpointStoreEnabled: false });
+    }
+  });
+});
diff --git a/apps/webapp/test/canUseMonitoringAlerts.test.ts b/apps/webapp/test/canUseMonitoringAlerts.test.ts
index b3bb3ae8d0e..0d6951b36b6 100644
--- a/apps/webapp/test/canUseMonitoringAlerts.test.ts
+++ b/apps/webapp/test/canUseMonitoringAlerts.test.ts
@@ -50,9 +50,14 @@ describe("canUseMonitoringAlerts", () => {
     expect(await canUseMonitoringAlerts(project(null), "u")).toBe(false);
   });
 
-  it("allows an admin with the flag off", async () => {
-    STATE.alertsEnabledEnv = "";
+  it("allows an admin with the org flag off when alerts are configured", async () => {
     STATE.admin = true;
     expect(await canUseMonitoringAlerts(project({ alertsEnabled: false }), "u")).toBe(true);
   });
+
+  it("denies an admin when alerts are not configured", async () => {
+    STATE.alertsEnabledEnv = "";
+    STATE.admin = true;
+    expect(await canUseMonitoringAlerts(project({ alertsEnabled: false }), "u")).toBe(false);
+  });
 });
diff --git a/apps/webapp/test/dashboardAgentAlertsGate.test.ts b/apps/webapp/test/dashboardAgentAlertsGate.test.ts
index 6a1ee08faa9..5e4593ddbc4 100644
--- a/apps/webapp/test/dashboardAgentAlertsGate.test.ts
+++ b/apps/webapp/test/dashboardAgentAlertsGate.test.ts
@@ -2,9 +2,15 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.setConfig({ testTimeout: 30_000 });
 
-const STATE = vi.hoisted(() => ({ alerts: false, watch: true, admin: false }));
+const STATE = vi.hoisted(() => ({ alerts: false, watch: true, admin: false, configured: "1" }));
 
-vi.mock("~/env.server", () => ({ env: {} }));
+vi.mock("~/env.server", () => ({
+  env: {
+    get ALERTS_ENABLED() {
+      return STATE.configured;
+    },
+  },
+}));
 vi.mock("~/v3/featureFlags.server", () => ({
   makeFlag: () => async (opts: { key: string }) =>
     opts.key === "alertsEnabled" ? STATE.alerts : STATE.watch,
@@ -59,17 +65,24 @@ describe("api.v1.dashboard-agent.alerts gate", () => {
     STATE.alerts = false;
     STATE.watch = true;
     STATE.admin = false;
+    STATE.configured = "1";
   });
 
   it("404s a non-admin with alertsEnabled off even if the watch flag is on", async () => {
     expect((await call()).status).toBe(404);
   });
 
-  it("passes the gate for an admin with alertsEnabled off", async () => {
+  it("passes the gate for an admin with alertsEnabled off when alerts are configured", async () => {
     STATE.admin = true;
     expect((await call()).status).toBe(403);
   });
 
+  it("404s an admin with alertsEnabled off when alerts are not configured", async () => {
+    STATE.admin = true;
+    STATE.configured = "";
+    expect((await call()).status).toBe(404);
+  });
+
   it("passes the gate when alertsEnabled is on", async () => {
     STATE.alerts = true;
     expect((await call()).status).toBe(403);
diff --git a/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts b/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
index 28a2ed0231b..67ed8514600 100644
--- a/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
+++ b/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
@@ -34,6 +34,7 @@ const ctx = vi.hoisted(() => ({
 vi.hoisted(() => {
   process.env.QUEUE_METRICS_EMIT_ENABLED = "1";
   process.env.QUEUE_METRICS_CONSUMER_ENABLED = "1";
+  process.env.ALERTS_ENABLED = "1";
 });
 
 vi.mock("~/db.server", () => {
diff --git a/apps/webapp/test/helpers/seedTestUserProject.ts b/apps/webapp/test/helpers/seedTestUserProject.ts
index cfd3caf28b2..1ab8b94abe5 100644
--- a/apps/webapp/test/helpers/seedTestUserProject.ts
+++ b/apps/webapp/test/helpers/seedTestUserProject.ts
@@ -38,7 +38,9 @@ export async function seedTestUserProject(
       isActivated: true,
       members: { create: { userId: user.id, role: "ADMIN" } },
     },
+    include: { members: true },
   });
+  const orgMember = organization.members[0];
 
   const project = await prisma.project.create({
     data: {
@@ -60,6 +62,7 @@ export async function seedTestUserProject(
       shortcode: suffix.slice(0, 4),
       projectId: project.id,
       organizationId: organization.id,
+      orgMemberId: orgMember.id,
     },
   });
 
diff --git a/apps/webapp/test/invocationUsage.test.ts b/apps/webapp/test/invocationUsage.test.ts
new file mode 100644
index 00000000000..d84fd43232f
--- /dev/null
+++ b/apps/webapp/test/invocationUsage.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { shouldReportAttemptInvocation } from "~/v3/invocationUsage.server";
+
+describe("shouldReportAttemptInvocation", () => {
+  it("reports the first attempt", () => {
+    expect(shouldReportAttemptInvocation({ attemptNumber: 1 })).toBe(true);
+  });
+
+  it("reports the first attempt of a run with no base cost", () => {
+    const run = { attemptNumber: 1, baseCostInCents: 0 };
+
+    expect(shouldReportAttemptInvocation(run)).toBe(true);
+  });
+
+  it("skips retries", () => {
+    expect(shouldReportAttemptInvocation({ attemptNumber: 2 })).toBe(false);
+  });
+});
diff --git a/apps/webapp/test/monitoringAlertsApi.test.ts b/apps/webapp/test/monitoringAlertsApi.test.ts
index 41285e4c872..6fbc6a778f8 100644
--- a/apps/webapp/test/monitoringAlertsApi.test.ts
+++ b/apps/webapp/test/monitoringAlertsApi.test.ts
@@ -19,6 +19,10 @@ vi.setConfig({ testTimeout: 60_000 });
 
 type Resource = { type: string; envType?: string };
 
+vi.hoisted(() => {
+  process.env.ALERTS_ENABLED = "1";
+});
+
 const ctx = vi.hoisted(() => ({
   prisma: undefined as unknown as PrismaClient,
   agentDb: undefined as unknown as DashboardAgentDb,
diff --git a/apps/webapp/test/regenerateApiKey.test.ts b/apps/webapp/test/regenerateApiKey.test.ts
new file mode 100644
index 00000000000..d5ee0ae609a
--- /dev/null
+++ b/apps/webapp/test/regenerateApiKey.test.ts
@@ -0,0 +1,70 @@
+import { containerTest } from "@internal/testcontainers";
+import { expect, vi } from "vitest";
+import { regenerateApiKey } from "~/models/api-key.server";
+import { findEnvironmentByApiKey } from "~/models/runtimeEnvironment.server";
+import {
+  createRuntimeEnvironment,
+  createTestOrgProjectWithMember,
+} from "./fixtures/environmentVariablesFixtures";
+
+vi.setConfig({ testTimeout: 60_000 });
+
+containerTest(
+  "regenerating keeps the previous root key valid for a grace period",
+  async ({ prisma }) => {
+    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
+    const environment = await createRuntimeEnvironment(prisma, {
+      projectId: project.id,
+      organizationId: organization.id,
+      type: "PRODUCTION",
+    });
+    const oldRootApiKey = environment.apiKey;
+
+    const result = await regenerateApiKey(
+      { environmentId: environment.id, userId: user.id },
+      { prismaClient: prisma }
+    );
+
+    expect(result.apiKey).not.toBe(oldRootApiKey);
+    const revoked = await prisma.revokedApiKey.findMany({
+      where: { runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toHaveLength(1);
+    expect(revoked[0].apiKey).toBe(oldRootApiKey);
+    expect(revoked[0].expiresAt.getTime()).toBeGreaterThan(Date.now());
+    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+  }
+);
+
+containerTest(
+  "regenerating with revokeImmediately rejects the previous root key at once",
+  async ({ prisma }) => {
+    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
+    const environment = await createRuntimeEnvironment(prisma, {
+      projectId: project.id,
+      organizationId: organization.id,
+      type: "PRODUCTION",
+    });
+    const oldRootApiKey = environment.apiKey;
+
+    const result = await regenerateApiKey(
+      { environmentId: environment.id, userId: user.id, revokeImmediately: true },
+      { prismaClient: prisma }
+    );
+
+    expect(result.apiKey).not.toBe(oldRootApiKey);
+    const revoked = await prisma.revokedApiKey.findMany({
+      where: { runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toHaveLength(0);
+    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toBeNull();
+    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+  }
+);
diff --git a/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts b/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
index bf3786d7db8..8738f962b31 100644
--- a/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
+++ b/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
@@ -3,7 +3,7 @@ import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestUserProject } from "./helpers/seedTestUserProject";
 
 describe("regenerate API key branch handling", () => {
-  it.each(["feature", "", "default"])(
+  it.each(["feature", "default"])(
     "rejects a present branch header without rotating the root key (%s)",
     async (branch) => {
       const server = getTestServer();
@@ -53,4 +53,65 @@ describe("regenerate API key branch handling", () => {
     });
     expect(revoked?.expiresAt.getTime()).toBeGreaterThan(Date.now());
   });
+
+  it("revokes the previous key immediately when asked", async () => {
+    const server = getTestServer();
+    const { environment, pat, project } = await seedTestUserProject(server.prisma);
+    const apiKeyRoute = "/api/v1/runs/run_doesnotexist/result";
+
+    const response = await server.webapp.fetch(
+      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${pat.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ revokeImmediately: true }),
+      }
+    );
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { apiKey: string };
+    expect(body.apiKey).not.toBe(environment.apiKey);
+
+    const revoked = await server.prisma.revokedApiKey.findFirst({
+      where: { apiKey: environment.apiKey, runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toBeNull();
+
+    const oldKeyResponse = await server.webapp.fetch(apiKeyRoute, {
+      headers: { Authorization: `Bearer ${environment.apiKey}` },
+    });
+    expect(oldKeyResponse.status).toBe(401);
+
+    const newKeyResponse = await server.webapp.fetch(apiKeyRoute, {
+      headers: { Authorization: `Bearer ${body.apiKey}` },
+    });
+    expect(newKeyResponse.status).not.toBe(401);
+  });
+
+  it("rejects a malformed body without rotating the root key", async () => {
+    const server = getTestServer();
+    const { environment, pat, project } = await seedTestUserProject(server.prisma);
+
+    const response = await server.webapp.fetch(
+      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${pat.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ revokeImmediately: "yes" }),
+      }
+    );
+
+    expect(response.status).toBe(400);
+    const persisted = await server.prisma.runtimeEnvironment.findUniqueOrThrow({
+      where: { id: environment.id },
+      select: { apiKey: true },
+    });
+    expect(persisted.apiKey).toBe(environment.apiKey);
+  });
 });
diff --git a/apps/webapp/test/sideMenuSections.test.ts b/apps/webapp/test/sideMenuSections.test.ts
index 534cd3c50ae..6fd89f4fb7b 100644
--- a/apps/webapp/test/sideMenuSections.test.ts
+++ b/apps/webapp/test/sideMenuSections.test.ts
@@ -9,6 +9,7 @@ const build = (isAdmin: boolean) =>
     project: { slug: "proj" },
     environment: { slug: "dev" },
     isAdmin,
+    alertsConfigured: true,
     featureFlags: {},
     isManagedCloud: false,
   });
@@ -40,6 +41,7 @@ describe("buildSideMenuSections alerts placement", () => {
       project: { slug: "proj" },
       environment: { slug: "dev" },
       isAdmin: false,
+      alertsConfigured: false,
       featureFlags: { hasQueryAccess: true },
       isManagedCloud: false,
     });
@@ -60,6 +62,7 @@ describe("buildSideMenuSections alerts placement", () => {
       project: { slug: "proj" },
       environment: { slug: "dev" },
       isAdmin: false,
+      alertsConfigured: false,
       featureFlags: { hasQueryAccess: true, alertsEnabled: true },
       isManagedCloud: false,
     });
diff --git a/apps/webapp/test/waitpointRollout.test.ts b/apps/webapp/test/waitpointRollout.test.ts
new file mode 100644
index 00000000000..1f3b451c0b2
--- /dev/null
+++ b/apps/webapp/test/waitpointRollout.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect } from "vitest";
+import { postgresTest } from "@internal/testcontainers";
+import { createWaitpointStoreEnabledResolver } from "~/v3/utils/waitpointStoreEnabled.server";
+
+describe("waitpoint rollout", () => {
+  postgresTest(
+    "waitpoint enrollment uses ordinary org flags, global fallback, and immediate rollback",
+    async ({ prisma }) => {
+      const org = await prisma.organization.create({
+        data: { title: "Waitpoints", slug: "waitpoints" },
+      });
+      let global: { waitpointStoreEnabled?: boolean } | undefined;
+      const enabled = createWaitpointStoreEnabledResolver(() => global, prisma);
+      expect(await enabled(org.id)).toBe(false);
+      await prisma.organization.update({
+        where: { id: org.id },
+        data: { featureFlags: { waitpointStoreEnabled: true } },
+      });
+      expect(await enabled(org.id)).toBe(true);
+      global = { waitpointStoreEnabled: false };
+      expect(await enabled(org.id)).toBe(true);
+      await prisma.organization.update({
+        where: { id: org.id },
+        data: { featureFlags: { waitpointStoreEnabled: false } },
+      });
+      global = { waitpointStoreEnabled: true };
+      expect(await enabled(org.id)).toBe(false);
+      expect(await enabled(org.id, {})).toBe(true);
+      expect(await enabled(org.id, { waitpointStoreEnabled: false })).toBe(false);
+      global = { waitpointStoreEnabled: false };
+      expect(await enabled(org.id)).toBe(false);
+      expect(await prisma.featureFlag.count()).toBe(0);
+    }
+  );
+});
diff --git a/apps/webapp/test/webhookSetupPrompt.test.ts b/apps/webapp/test/webhookSetupPrompt.test.ts
index 0b716776ad3..8108dadc1ae 100644
--- a/apps/webapp/test/webhookSetupPrompt.test.ts
+++ b/apps/webapp/test/webhookSetupPrompt.test.ts
@@ -84,7 +84,8 @@ describe("renderWebhookSetupPrompt", () => {
 
     expect(prompt).toContain("Public key: set");
     expect(prompt).toContain("Copy its public key and store it with `set_webhook_secret`.");
-    expect(prompt).toContain("A public key is already set; replacing it breaks deliveries");
+    expect(prompt).toContain("A public key is already set; only replace it when");
+    expect(prompt).toContain("pass `previousSecretTtlSeconds`");
   });
 
   it("asks which events to send when nothing subscribes yet", () => {
diff --git a/apps/webapp/test/webhookSigningSecret.test.ts b/apps/webapp/test/webhookSigningSecret.test.ts
index 25cdbdb0cea..bf7616d7fb7 100644
--- a/apps/webapp/test/webhookSigningSecret.test.ts
+++ b/apps/webapp/test/webhookSigningSecret.test.ts
@@ -1,10 +1,9 @@
 import { describe, expect, it } from "vitest";
 import {
-  activeSigningSecrets,
-  MAX_PREVIOUS_SECRET_TTL_SECONDS,
-  PreviousSecretTtlSeconds,
-  replaceStoredSigningSecret,
-} from "~/v3/webhookSigningSecret";
+  MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS as MAX_PREVIOUS_SECRET_TTL_SECONDS,
+  WebhookPreviousSecretTtlSeconds as PreviousSecretTtlSeconds,
+} from "@trigger.dev/core/v3";
+import { activeSigningSecrets, replaceStoredSigningSecret } from "~/v3/webhookSigningSecret";
 
 const now = new Date("2026-10-20T12:00:00.000Z");
 const later = (seconds: number) => new Date(now.getTime() + seconds * 1000);
diff --git a/base-images/images.json b/base-images/images.json
index 878bc58bdb1..cf419a1bc89 100644
--- a/base-images/images.json
+++ b/base-images/images.json
@@ -11,17 +11,17 @@
     {
       "repo": "node",
       "tag": "22-bookworm",
-      "base": "node:22.16.0-bookworm-slim@sha256:048ed02c5fd52e86fda6fbd2f6a76cf0d4492fd6c6fee9e2c463ed5108da0e34"
+      "base": "node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d"
     },
     {
       "repo": "node",
       "tag": "24-bookworm",
-      "base": "node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d"
+      "base": "node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205"
     },
     {
       "repo": "node",
       "tag": "26-bookworm",
-      "base": "node:26.4.0-bookworm-slim@sha256:ec82d089a8ae2cf02628da7b34ea57dc357b24db724d557fe2d240e6beb659c1"
+      "base": "node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe"
     },
     {
       "repo": "bun",
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 699b8adc2ae..84fde6afd9a 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-ARG NODE_IMAGE=node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d
+ARG NODE_IMAGE=node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205
 # OS security patches come from apt, not from the node image, and the node image
 # rarely changes. Without a changing input the upgrade layers below stay cached
 # for months and ship known-fixed CVEs. Every workflow that publishes this image
diff --git a/docs/ai-chat/backend.mdx b/docs/ai-chat/backend.mdx
index 5f2b57abd5c..7924aacc26f 100644
--- a/docs/ai-chat/backend.mdx
+++ b/docs/ai-chat/backend.mdx
@@ -4,8 +4,6 @@ sidebarTitle: "Backend"
 description: "Three approaches to building your chat backend — chat.agent(), session iterator, or raw task primitives."
 ---
 
-import WebhooksBetaNote from "/snippets/webhooks-beta-note.mdx";
-
 There are three abstraction levels for a chat backend. All three speak the same wire protocol, so the [frontend transport](/ai-chat/frontend) works unchanged whichever you pick.
 
 | Capability                            | `chat.agent()` | `chat.createSession()`                                        | Raw primitives |
@@ -274,7 +272,7 @@ export const myChat = chat.agent({
 });
 ```
 
-The managed `streamText` carries the stored prompt's `system`, `model` (resolved through the agent's `registry`), sampling config, and `experimental_telemetry`. Options you pass at the call site win, apart from `system`, which throws when the prompt already set one.
+The managed `streamText` carries the stored prompt's `system`, `model` (resolved through the agent's `registry`), sampling config, and `experimental_telemetry`. AI SDK telemetry is on even without a stored prompt, so model steps and tool calls show in the run trace. Options you pass at the call site win, apart from `system`, which throws when the prompt already set one.
 
 `chat.toStreamTextOptions()` remains available for the same job, and is the only option in a [custom agent](#custom-agents), which has no `run` argument to take a bound `streamText` from. A `chat.headStart` route does get one, and there it also owns `messages`, `stopWhen` and `abortSignal`, since the handover depends on them. Pass `{ registry }` when a prompt names a provider-prefixed model, and `{ tools }` when you want HITL tool approvals, so the SDK knows which calls pause on `needsApproval`.
 
@@ -501,8 +499,6 @@ See [Actions](/ai-chat/actions).
 
 ### Webhook events and channels
 
-<WebhooksBetaNote />
-
 Two `chat.agent()` options wire an agent to verified inbound webhooks. `events` claims [`chat.event(...)`](/webhooks/session-routing) descriptors: each verified delivery is routed to this agent's session and arrives at `onAction` as an action (not a turn), so [session routing](/webhooks/session-routing) decides which conversation it lands on. `channels` claims channel connectors that turn an external chat surface into a frontend for the agent: an inbound message runs as a turn through `run()` and the reply is posted back. `slack()` ships in `@trigger.dev/slack`, and `chat.channels.custom(...)` builds a connector for any endpoint without a preset.
 
 ```ts
diff --git a/docs/ai-chat/patterns/redacting-telemetry.mdx b/docs/ai-chat/patterns/redacting-telemetry.mdx
index 2d4a587332a..dea985801b8 100644
--- a/docs/ai-chat/patterns/redacting-telemetry.mdx
+++ b/docs/ai-chat/patterns/redacting-telemetry.mdx
@@ -4,7 +4,7 @@ sidebarTitle: "Redact chat content"
 description: "Stop a chat agent recording user messages and clientData on its spans, turn off AI SDK prompt and response recording, or redact span content with a span processor before it leaves the worker."
 ---
 
-A chat agent's run trace records conversation content by default: the user's message and the `clientData` your frontend sends. When AI SDK telemetry is on, it also records the prompts and responses of each model call. This page covers the three controls that change that, and what they don't cover.
+A chat agent's run trace records conversation content by default: the user's message, the `clientData` your frontend sends, and, through AI SDK telemetry, the prompts and responses of each model call. This page covers the three controls that change that, and what they don't cover.
 
 ## What the run trace records
 
@@ -13,7 +13,7 @@ A chat agent's run trace records conversation content by default: the user's mes
 | `chat turn N` | The last user message (`chat.user_message`) and its first 80 characters as the span preview | `telemetry.recordUserMessage` |
 | `chat turn N` | The raw `clientData` (`chat.client_data`) | `telemetry.recordClientData` |
 | `pending message injected` | Messages sent mid-turn (`pending.messages`) | `telemetry.recordUserMessage` |
-| AI SDK model call spans, when AI SDK telemetry is on | Prompt messages, response text, tool calls | `experimental_telemetry` on the model call |
+| AI SDK model call spans (on by default with the `streamText` from `run`) | Prompt messages, response text, tool calls | `telemetry.recordUserMessage` for the default config, or `experimental_telemetry` on the model call |
 | Any span | Everything above, plus your own attributes and span events | A span processor |
 
 ## Stop recording chat content
@@ -32,11 +32,11 @@ export const supportAgent = chat.agent({
 });
 ```
 
-The spans still appear in the trace with their timings and token usage. The turn spans have no preview text.
+The spans still appear in the trace with their timings and token usage. The turn spans have no preview text. `recordUserMessage: false` also keeps prompts and responses out of the AI SDK spans that the `streamText` passed to `run()` turns on, with or without a prompt stored by `chat.prompt.set()`, and leaves a stored prompt's variables out of the span metadata, unless the call passes its own `experimental_telemetry`.
 
 ## Stop the AI SDK recording prompts and responses
 
-AI SDK model call spans appear when AI SDK telemetry is on: [`chat.prompt.set()`](/ai-chat/backend#using-prompts) turns it on for you, or you pass `experimental_telemetry` yourself. Those spans include prompts and responses unless you turn that off with `recordInputs` and `recordOutputs`:
+The `streamText` passed to `run()` turns AI SDK telemetry on, so each model call and tool call is a span in the run trace (pass `experimental_telemetry: { isEnabled: false }` to turn the spans off). If you call `streamText` from `ai` yourself, pass `experimental_telemetry` to get them. Those spans include prompts and responses unless you turn that off with `recordInputs` and `recordOutputs`:
 
 ```ts /trigger/support-agent.ts
 import { chat } from "@trigger.dev/sdk/ai";
@@ -50,7 +50,7 @@ export const supportAgent = chat.agent({
       model: anthropic("claude-sonnet-4-5"),
       messages,
       abortSignal: signal,
-      // Replaces any telemetry config from chat.prompt.set(), so keep isEnabled on
+      // Replaces the default telemetry config (and chat.prompt.set()'s), so keep isEnabled on
       experimental_telemetry: { isEnabled: true, recordInputs: false, recordOutputs: false },
     }),
 });
diff --git a/docs/ai-chat/pending-messages.mdx b/docs/ai-chat/pending-messages.mdx
index 9749c296b1e..26abf1954ad 100644
--- a/docs/ai-chat/pending-messages.mdx
+++ b/docs/ai-chat/pending-messages.mdx
@@ -12,7 +12,7 @@ By default (without `pendingMessages`), a message sent while the agent is respon
 
 The `pendingMessages` option enables steering instead, injecting user messages between tool-call steps via the AI SDK's `prepareStep`. Messages that arrive during streaming are queued and injected at the next step boundary. A message that is not injected becomes the next turn instead, whether that is because `shouldInject` returned `false` or because there were no more step boundaries (single-step response or final text generation). The backend handles that, so no client-side re-send is involved.
 
-Messages from a [channel](/webhooks/channels) such as [Slack](/webhooks/slack) are offered the same way, with `metadata.source` set to `"channel"` so `shouldInject` can tell them apart. A channel's stop control and approval clicks are never offered. The connector acknowledges a channel message as soon as it arrives (Slack reacts with 👀, Linear posts a thought), before `shouldInject` decides, so the acknowledgement is the same whether the message is folded in or answered next. Channels are part of the [webhooks private beta](https://trigger.dev/webhooks-beta).
+Messages from a [channel](/webhooks/channels) such as [Slack](/webhooks/slack) are offered the same way, with `metadata.source` set to `"channel"` so `shouldInject` can tell them apart. A channel's stop control and approval clicks are never offered. The connector acknowledges a channel message as soon as it arrives (Slack reacts with 👀, Linear posts a thought), before `shouldInject` decides, so the acknowledgement is the same whether the message is folded in or answered next.
 
 Use the `streamText` passed to your agent's `run` callback. It wires up pending-message injection automatically. If you import `streamText` directly from `ai`, spread `chat.toStreamTextOptions()` into its options to connect injection.
 
diff --git a/docs/ai-chat/reference.mdx b/docs/ai-chat/reference.mdx
index a5bbf06f7e9..5c8b74e9540 100644
--- a/docs/ai-chat/reference.mdx
+++ b/docs/ai-chat/reference.mdx
@@ -48,8 +48,8 @@ Options for `chat.agent()`.
 | `hydrateMessages`             | `(event: HydrateMessagesEvent) => UIMessage[] \| Promise<UIMessage[]>` | —                 | **Deprecated.** Load message history from backend, replacing the linear accumulator. Use `loadContext` on a `storage` instead; cannot be combined with `storage`. See [hydrateMessages](/ai-chat/lifecycle-hooks#hydratemessages) |
 | `actionSchema`                | `TaskSchema`                                                | —                              | Schema for validating custom actions sent via `transport.sendAction()`. See [Actions](/ai-chat/actions) |
 | `onAction`                    | `(event: ActionEvent) => Promise<void \| ActionTurn> \| void \| ActionTurn` | —                              | Handle custom actions. Actions are state edits: only `hydrateMessages` (or a storage's `loadContext`) + `onAction` fire. Return `chat.turn()` to run a turn on the edited history (`chat.turn(message)` to answer a new user message), or nothing for an edit only. See [Actions](/ai-chat/actions) |
-| `events`                      | `ChatEvent[]`                                               | —                              | Webhook event descriptors (from `chat.event()`) whose verified deliveries are routed to this agent as actions and handled in `onAction`. See [session routing](/webhooks/session-routing). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
-| `channels`                    | `ChannelConnector[]`                                        | —                              | Channel connectors (for example `slack()`) that turn an external chat surface into a frontend for the agent: inbound messages run as turns and the reply posts back. See [channels](/webhooks/channels). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
+| `events`                      | `ChatEvent[]`                                               | —                              | Webhook event descriptors (from `chat.event()`) whose verified deliveries are routed to this agent as actions and handled in `onAction`. See [session routing](/webhooks/session-routing). |
+| `channels`                    | `ChannelConnector[]`                                        | —                              | Channel connectors (for example `slack()`) that turn an external chat surface into a frontend for the agent: inbound messages run as turns and the reply posts back. See [channels](/webhooks/channels). |
 | `onTurnStart`                 | `(event: TurnStartEvent) => Promise<void> \| void`          | —                              | Fires every turn before `run()`                                                                     |
 | `onBeforeTurnComplete`        | `(event: BeforeTurnCompleteEvent) => Promise<void> \| void` | —                              | Fires after response but before stream closes. Includes `writer`.                                   |
 | `onTurnComplete`              | `(event: TurnCompleteEvent) => Promise<void> \| void`       | —                              | Fires after each turn completes (stream closed)                                                     |
@@ -542,8 +542,8 @@ All methods available on the `chat` object from `@trigger.dev/sdk/ai`.
 | Method                                      | Description                                                                                                                  |
 | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
 | `chat.agent(options)`                       | Create a chat agent                                                                                                          |
-| `chat.event(options)`                       | Declare an inbound webhook event descriptor an agent claims via `chat.agent({ events })`. See [session routing](/webhooks/session-routing). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
-| `chat.channels.custom(options)`             | Create a generic chat-frontend channel over any verified webhook source (you supply the egress). The `slack()` preset ships in `@trigger.dev/slack`. See [channels](/webhooks/channels). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
+| `chat.event(options)`                       | Declare an inbound webhook event descriptor an agent claims via `chat.agent({ events })`. See [session routing](/webhooks/session-routing). |
+| `chat.channels.custom(options)`             | Create a generic chat-frontend channel over any verified webhook source (you supply the egress). The `slack()` preset ships in `@trigger.dev/slack`. See [channels](/webhooks/channels). |
 | `chat.createSession(payload, options)`      | Create an async iterator for chat turns                                                                                      |
 | `chat.pipe(source, options?)`               | Pipe a stream to the frontend (from anywhere inside a task)                                                                  |
 | `chat.pipeAndCapture(source, options?)`     | Pipe and capture the response; returns `{ message, status, error }`                                                         |
diff --git a/docs/apikeys.mdx b/docs/apikeys.mdx
index ae3bda91a3e..694fde36583 100644
--- a/docs/apikeys.mdx
+++ b/docs/apikeys.mdx
@@ -83,7 +83,7 @@ Access presets define what a key can do. On the Free and Hobby plans only the **
 | **Task operator** | Trigger all or selected tasks and inspect or operate on their runs |
 | **Observer** | Read runs, tasks, batches, logs, traces, queues, errors, and webhooks |
 | **Operator** | Observe and operate on runs, queues, errors, and webhooks, and trigger tasks |
-| **Webhooks only** | Read and write [webhooks](/webhooks/overview), which are in private beta. Replaying deliveries that trigger tasks and creating webhook waiters require task or waitpoint scopes |
+| **Webhooks only** | Read and write [webhooks](/webhooks/overview). Replaying deliveries that trigger tasks and creating webhook waiters require task or waitpoint scopes |
 | **Waitpoints only** | Create, list, and retrieve [waitpoint tokens](/wait-for-token). No task or run access |
 | **Deploy only** | Deploy versions, sync environment variables, and manage Preview branches |
 | **Variables only** | Read and write environment variables in this environment |
diff --git a/docs/guides/examples/hookdeck-webhook.mdx b/docs/guides/examples/hookdeck-webhook.mdx
index 1920a06148a..8ef1778186a 100644
--- a/docs/guides/examples/hookdeck-webhook.mdx
+++ b/docs/guides/examples/hookdeck-webhook.mdx
@@ -1,71 +1,102 @@
 ---
 title: "Trigger tasks from Hookdeck webhooks"
 sidebarTitle: "Hookdeck webhooks"
-description: "This example demonstrates how to use Hookdeck to receive webhooks and trigger Trigger.dev tasks."
+description: "Forward webhooks from a Hookdeck connection to a hosted Trigger.dev endpoint, verified with the Hookdeck project's signing secret, and run a task for each event."
 ---
 
-## Overview
+[Hookdeck](https://hookdeck.com) receives webhooks from external services, then queues, logs and forwards them to a destination. Point a Hookdeck connection at a hosted webhook endpoint and Trigger.dev verifies each forwarded request with the Hookdeck project's signing secret, deduplicates Hookdeck's retries, and runs your task with the original provider's payload.
 
-This example shows how to use [Hookdeck](https://hookdeck.com) as your webhook infrastructure to trigger Trigger.dev tasks. Hookdeck receives webhooks from external services, and forwards them directly to the Trigger.dev API. This gives you the best of both worlds: Hookdeck's webhook management, logging, and replay capabilities, combined with Trigger.dev's reliable task execution.
+## Task code
+
+Declare the endpoint with `webhooks.hookdeck()` and subscribe a task to it. Hookdeck forwards the original provider's body unchanged, so pass that provider's event type. This example relays Stripe events:
+
+```ts /trigger/stripe-via-hookdeck.ts
+import type Stripe from "stripe";
+import { webhook, webhooks } from "@trigger.dev/sdk";
+
+export const stripeViaHookdeck = webhooks.endpoint.define({
+  id: "stripe-via-hookdeck",
+  source: webhooks.hookdeck<Stripe.Event>(),
+});
+
+export const paymentSucceeded = webhook({
+  id: "payment-succeeded",
+  endpoint: stripeViaHookdeck,
+  filter: "event.type == 'payment_intent.succeeded'",
+  onEvent: async ({ event }) => {
+    console.log("Payment succeeded", event.id);
+  },
+});
+```
 
-## Key features
+Run `trigger dev` or deploy, then copy the endpoint's URL from the Webhooks page in the dashboard.
 
-- Use Hookdeck as your webhook endpoint for external services
-- Hookdeck forwards webhooks directly to Trigger.dev tasks via the API
-- All webhooks are logged and replayable in Hookdeck
+## Set up Hookdeck
 
-## Setting up Hookdeck
+<Steps>
+  <Step title="Create a connection">
+    In the [Hookdeck dashboard](https://dashboard.hookdeck.com), create a [connection](https://hookdeck.com/docs/connections) from your source (for example a Stripe source) to an HTTP destination whose URL is the endpoint's URL. Keep the destination's authentication on **Hookdeck Signature**, the default for new destinations: Hookdeck only signs forwarded requests with it set.
+  </Step>
+  <Step title="Store the signing secret">
+    Copy the signing secret from **Settings > Secrets** in Hookdeck and set it as the endpoint's signing secret in the Trigger.dev dashboard. It's one secret for the whole Hookdeck project.
+  </Step>
+</Steps>
 
-You'll configure everything in the [Hookdeck dashboard](https://dashboard.hookdeck.com). No code changes needed in your app.
+## Test it
 
-### 1. Create a destination
+Send a webhook to your Hookdeck source URL, or trigger a real event in the upstream provider. In Hookdeck, the event shows a `200` response from the destination. In Trigger.dev, the endpoint shows a succeeded delivery and the `payment-succeeded` task has a completed run with the Stripe event as its payload.
 
-In Hookdeck, create a new [destination](https://hookdeck.com/docs/destinations) with the following settings:
+A request signed with a different secret gets a `400`, which Hookdeck reports as a failed attempt.
 
-- **URL**: `https://api.trigger.dev/api/v1/tasks/<task-id>/trigger` (replace `<task-id>` with your task ID)
-- **Method**: POST
-- **Authentication**: Bearer token (create a named **Trigger only** environment API key and use it as `TRIGGER_SECRET_KEY`)
+## Rotate the signing secret
 
-### 2. Add a transformation
+Roll the signing secret under **Settings > Secrets** in Hookdeck with an expiry instead of expiring it immediately. Until the old secret expires, Hookdeck signs each request with both secrets, sending the previous secret's signature in `X-Hookdeck-Signature-2`. The endpoint accepts either, so deliveries keep verifying while you copy the new secret to Trigger.dev. Set a grace period when you store it to keep accepting the old secret for a while.
 
-Create a [transformation](https://hookdeck.com/docs/transformations) to wrap the webhook body in the `payload` field that Trigger.dev expects:
+## Deduplication
 
-```javascript
-addHandler("transform", (request, context) => {
-  request.body = { payload: { ...request.body } };
-  return request;
+Hookdeck retries and manual replays of the same event carry the same `X-Hookdeck-Eventid`, and the endpoint uses it as the [deduplication](/webhooks/deliveries#deduplication) key, so a retried event runs your task once.
+
+If you changed the header prefix in the Hookdeck project's settings, the event id arrives under the new prefix. Pass the prefix so deduplication keeps working:
+
+```ts /trigger/stripe-via-hookdeck.ts
+import type Stripe from "stripe";
+import { webhooks } from "@trigger.dev/sdk";
+
+export const stripeViaHookdeck = webhooks.endpoint.define({
+  id: "stripe-via-hookdeck",
+  source: webhooks.hookdeck<Stripe.Event>({ headerPrefix: "x-acme" }),
 });
 ```
 
-### 3. Create a connection
+The signature headers keep the `X-Hookdeck-` name whatever the prefix.
 
-Create a [connection](https://hookdeck.com/docs/connections) that links your source (where webhooks come from) to the destination and transformation you created above.
+## Trigger a task through the API instead
 
-## Task code
+You can also point a Hookdeck destination at the [trigger task API](/management/tasks/trigger) without a hosted endpoint. Hookdeck authenticates with your API key instead of a signature, and a transformation wraps the body in the `payload` field the API expects.
+
+1. Create a destination with the URL `https://api.trigger.dev/api/v1/tasks/<task-id>/trigger`, method `POST`, and **Bearer token** authentication using a **Trigger only** environment API key.
+2. Add a [transformation](https://hookdeck.com/docs/transformations):
 
-This task will be triggered when Hookdeck forwards a webhook to the Trigger.dev API.
+   ```javascript
+   addHandler("transform", (request, context) => {
+     request.body = { payload: { ...request.body } };
+     return request;
+   });
+   ```
 
-```ts trigger/webhook-handler.ts
+3. Create a connection from your source to that destination and transformation.
+
+```ts /trigger/webhook-handler.ts
 import { task } from "@trigger.dev/sdk";
 
 export const webhookHandler = task({
   id: "webhook-handler",
   run: async (payload: Record<string, unknown>) => {
-    // The payload contains the original webhook data from the external service
     console.log("Received webhook:", payload);
-
-    // Add your custom logic here
   },
 });
 ```
 
-## Testing your setup
-
-To test everything is working:
-
-1. Set up your destination, transformation, and connection in [Hookdeck](https://dashboard.hookdeck.com)
-2. Send a test webhook to your Hookdeck source URL (use the Hookdeck Console or cURL)
-3. Check the Hookdeck dashboard to verify the webhook was received and forwarded
-4. Check the [Trigger.dev dashboard](https://cloud.trigger.dev) to see the successful run of your task
+This path has no deduplication of Hookdeck retries; each forwarded request triggers a run.
 
-For more information on setting up Hookdeck, refer to the [Hookdeck Documentation](https://hookdeck.com/docs).
+For more on Hookdeck, see the [Hookdeck documentation](https://hookdeck.com/docs).
diff --git a/docs/mcp-tools.mdx b/docs/mcp-tools.mdx
index 5b81109a755..5390f86f415 100644
--- a/docs/mcp-tools.mdx
+++ b/docs/mcp-tools.mdx
@@ -4,8 +4,6 @@ sidebarTitle: "Tools"
 description: "Learn about how to use the tools available in the Trigger.dev MCP Server"
 ---
 
-import WebhooksBetaNote from "/snippets/webhooks-beta-note.mdx";
-
 ## Documentation and Search Tools
 
 ### search_docs
@@ -352,8 +350,6 @@ Append one record to a named side channel's `in` stream. Sends control input to
 
 ## Webhook Tools
 
-<WebhooksBetaNote />
-
 Set up and debug [hosted webhook endpoints](/webhooks/overview). Endpoint ids start with `wh_` and delivery ids with `whd_`; endpoint tools also accept an endpoint's declared id. The same operations are on the [Webhooks API](/management/webhooks/list-endpoints).
 
 ### list_webhook_endpoints
diff --git a/docs/snippets/webhooks-beta-banner.mdx b/docs/snippets/webhooks-beta-banner.mdx
deleted file mode 100644
index b84bd405475..00000000000
--- a/docs/snippets/webhooks-beta-banner.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { PrivateBeta } from "/snippets/feature-status.jsx";
-
-<PrivateBeta flag="hasWebhooksAccess">
-  [Request access](https://trigger.dev/webhooks-beta) and we'll turn webhooks on for your
-  organization and send you the prerelease packages. Webhooks are open source, so they work
-  self-hosted too. APIs may change before general availability.
-</PrivateBeta>
diff --git a/docs/snippets/webhooks-beta-note.mdx b/docs/snippets/webhooks-beta-note.mdx
deleted file mode 100644
index 5997a4bcb2b..00000000000
--- a/docs/snippets/webhooks-beta-note.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-<Note>
-  Webhooks are in private beta. [Request access](https://trigger.dev/webhooks-beta) and we'll turn them on for your
-  organization.
-</Note>
diff --git a/docs/v3-openapi.yaml b/docs/v3-openapi.yaml
index e09cc060120..9d9b96aa067 100644
--- a/docs/v3-openapi.yaml
+++ b/docs/v3-openapi.yaml
@@ -4796,8 +4796,6 @@ paths:
       operationId: list_webhook_endpoints_v1
       summary: List webhook endpoints
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         List the hosted webhook endpoints in the environment, ordered by declared id. Each endpoint
         includes its webhook URL and whether its signing secret is set. The secret itself is never returned.
       parameters:
@@ -4834,8 +4832,6 @@ paths:
       operationId: retrieve_webhook_endpoint_v1
       summary: Retrieve a webhook endpoint
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Retrieve one webhook endpoint with its subscribers, the filter each one applies, and its
         setup prompt: instructions for registering the endpoint and its signing secret with the provider.
       responses:
@@ -4866,8 +4862,6 @@ paths:
       operationId: enable_webhook_endpoint_v1
       summary: Enable a webhook endpoint
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Resume a disabled endpoint so its URL accepts deliveries again. Returns the updated endpoint.
       responses:
         "200":
@@ -4897,8 +4891,6 @@ paths:
       operationId: disable_webhook_endpoint_v1
       summary: Disable a webhook endpoint
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Pause an endpoint. Its status becomes `inactive` and its URL responds with `404` until you
         enable it, so providers see failed deliveries and retry on their own schedule. Returns the updated endpoint.
       responses:
@@ -4929,13 +4921,11 @@ paths:
       operationId: rotate_webhook_endpoint_secret_v1
       summary: Generate a webhook signing secret
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers
-        where you choose the secret, such as GitHub. It replaces any existing secret, so deliveries fail
-        verification until the provider uses the new one, unless you pass `previousSecretTtlSeconds` to keep
-        the old secret valid for a while. Endpoints whose source verifies with a public key refuse this; set the
-        provider's key with the set secret endpoint instead.
+        where you choose the secret, such as GitHub. It replaces the existing secret. Pass
+        `previousSecretTtlSeconds` to keep accepting the old secret while you update the provider; without
+        it, deliveries signed with the old secret fail verification straight away. Endpoints whose source
+        verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.
       requestBody:
         required: false
         content:
@@ -4944,13 +4934,7 @@ paths:
               type: object
               properties:
                 previousSecretTtlSeconds:
-                  type: integer
-                  minimum: 0
-                  maximum: 604800
-                  description: >-
-                    How many seconds the replaced secret keeps verifying deliveries, up to 7 days. Omit or pass
-                    `0` to stop accepting the old secret immediately.
-                  example: 86400
+                  $ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"
       responses:
         "200":
           description: Successful request
@@ -4959,7 +4943,7 @@ paths:
               schema:
                 $ref: "#/components/schemas/RotateWebhookEndpointSecretResponse"
         "400":
-          description: The endpoint's source verifies with a public key, so a secret can't be generated
+          description: The endpoint's source verifies with a public key, so a secret can't be generated, or the body is invalid
           content:
             application/json:
               schema:
@@ -4977,7 +4961,9 @@ paths:
           label: Generate a signing secret
           source: |-
             curl -X POST "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret" \
-              -H "Authorization: Bearer $TRIGGER_SECRET_KEY"
+              -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
+              -H "Content-Type: application/json" \
+              -d '{ "previousSecretTtlSeconds": 3600 }'
   "/api/v1/webhooks/endpoints/{endpointId}/secret":
     parameters:
       - $ref: "#/components/parameters/webhookEndpointId"
@@ -4985,11 +4971,10 @@ paths:
       operationId: set_webhook_endpoint_secret_v1
       summary: Set a webhook signing secret
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Store the signing secret or public key the provider issued for this endpoint, such as the `whsec_`
-        secret Stripe returns when you create a webhook endpoint. It replaces any existing secret. Pass
-        `previousSecretTtlSeconds` to keep the old one valid for a while.
+        secret Stripe returns when you create a webhook endpoint. It replaces the existing secret. Pass
+        `previousSecretTtlSeconds` to keep accepting the old secret for a while, for example while the
+        provider rolls its secret.
       requestBody:
         required: true
         content:
@@ -5006,13 +4991,7 @@ paths:
                   description: The signing secret or public key. Leading and trailing whitespace is trimmed.
                   example: whsec_5f2b...
                 previousSecretTtlSeconds:
-                  type: integer
-                  minimum: 0
-                  maximum: 604800
-                  description: >-
-                    How many seconds the replaced secret keeps verifying deliveries, up to 7 days. Omit or pass
-                    `0` to stop accepting the old secret immediately.
-                  example: 86400
+                  $ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"
       responses:
         "200":
           description: Successful request
@@ -5045,8 +5024,6 @@ paths:
       operationId: create_webhook_waiter_v1
       summary: Create a webhook waiter
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Create a waiter on an endpoint. A waiter is a waitpoint that completes when a matching delivery
         arrives on the endpoint, so a run waiting on its id resumes with the verified event. It only matches
         deliveries that arrive after it was created. Omit `match` to get a waiter with its own `url`, for
@@ -5117,8 +5094,6 @@ paths:
       operationId: cancel_webhook_waiter_v1
       summary: Cancel a webhook waiter
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Cancel a waiter. It stops matching deliveries, frees its slot toward the endpoint's limit, and fails
         the run's wait. If a delivery already claimed the waiter, the cancel is too late: the response has
         `cancelled: false` with `reason: "too_late"`, and the run resumes with that delivery's event.
@@ -5156,8 +5131,6 @@ paths:
       operationId: list_webhook_deliveries_v1
       summary: List webhook deliveries
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         List the verified events providers sent to the environment's endpoints, newest first. Filter by
         endpoint, status and time range, and page with `page[after]` and `page[before]`.
       parameters:
@@ -5249,8 +5222,6 @@ paths:
       operationId: retrieve_webhook_delivery_v1
       summary: Retrieve a webhook delivery
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Retrieve one delivery: its status and error, the event body and headers it carried, and a `targets`
         entry per subscriber with the run or session it started or why its filter skipped the event. When
         the delivery resumed waiting runs, one more entry summarizes them.
@@ -5282,8 +5253,6 @@ paths:
       operationId: replay_webhook_delivery_v1
       summary: Replay a webhook delivery
       description: >-
-        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
-
         Route a delivery's stored event again as a new delivery. Without `targetId` every current subscriber
         is checked against its filter again. With `targetId` the event goes to that one subscriber, even if
         its filter skipped it. A replay never resumes waiting runs. Replays start real runs, so the key needs
@@ -5912,9 +5881,8 @@ components:
         previousSecretExpiresAt:
           type: string
           format: date-time
-          description: >-
-            When the replaced secret stops verifying deliveries. Present only when `previousSecretTtlSeconds`
-            kept the old secret valid.
+          description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.
+          example: "2026-10-21T12:00:00.000Z"
     SetWebhookEndpointSecretResponse:
       type: object
       required: [id, secretSet]
@@ -5929,9 +5897,16 @@ components:
         previousSecretExpiresAt:
           type: string
           format: date-time
-          description: >-
-            When the replaced secret stops verifying deliveries. Present only when `previousSecretTtlSeconds`
-            kept the old secret valid.
+          description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.
+          example: "2026-10-21T12:00:00.000Z"
+    WebhookPreviousSecretTtlSeconds:
+      type: integer
+      minimum: 0
+      maximum: 604800
+      description: >-
+        How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it
+        or pass 0 to replace the secret immediately, for example when it leaked.
+      example: 3600
     WebhookDeliveryStatus:
       type: string
       enum: [pending, processing, succeeded, failed, filtered, unmatched]
diff --git a/docs/webhooks/channels.mdx b/docs/webhooks/channels.mdx
index fe60b1a81f9..049b69f01ea 100644
--- a/docs/webhooks/channels.mdx
+++ b/docs/webhooks/channels.mdx
@@ -4,10 +4,6 @@ description: "Point Slack (or any chat surface) at an agent: messages become tur
 sidebarTitle: "Channels"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 A [session route](/webhooks/session-routing) delivers a verified event to an agent as an [action](/ai-chat/actions): the agent reacts, and the response is a side effect. A **channel** is the other half: the webhook IS the chat surface. Inbound messages become **turns** (the normal `run()` loop), and the agent's reply is posted **back** to the surface. A Slack thread becomes a real conversation with the agent, exactly like the browser chat, just a different frontend.
 
 List channels on a [`chat.agent`](/ai-chat/overview) alongside (or instead of) `events`:
diff --git a/docs/webhooks/connect.mdx b/docs/webhooks/connect.mdx
index 0c09270e907..f07f27d326a 100644
--- a/docs/webhooks/connect.mdx
+++ b/docs/webhooks/connect.mdx
@@ -4,10 +4,6 @@ description: "Register an endpoint's URL and signing secret with the provider, b
 sidebarTitle: "Connect a provider"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 Connect a provider to an [endpoint](/webhooks/overview) by registering the endpoint's URL with the provider and giving Trigger.dev the credential that verifies its requests.
 
 Deploy the project or start `trigger dev` first. Once the CLI finds the endpoint, it appears on the environment's **Webhooks** page. The **Signing secret** column shows **Ready** when the endpoint can verify deliveries and **Needs secret** until then. Every delivery is rejected while an endpoint needs its secret.
@@ -22,8 +18,8 @@ The prompt tells the agent to use the Trigger.dev MCP server (`npx trigger.dev@l
 | --- | --- |
 | `list_webhook_endpoints` | Lists the environment's endpoints, with their URL and whether a secret is set. |
 | `get_webhook_endpoint_details` | Reads one endpoint: URL, subscribers and their filters, secret state, and the setup prompt. |
-| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. |
-| `set_webhook_secret` | Stores a secret the provider issued. |
+| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |
+| `set_webhook_secret` | Stores a secret the provider issued. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |
 
 Without the MCP server, the same operations are available on the REST API with the environment's secret key:
 
@@ -78,9 +74,16 @@ The verify token answers the URL check. The signing secret verifies event delive
 
 Choose **Rotate signing secret** to replace a provider-supplied secret. For a secret you generate, choose **Regenerate secret**, copy the new value, and update the provider's configuration. Use **Rotate public key** when replacing an asymmetric provider's key.
 
-The rotate and regenerate dialogs include **Keep accepting the old signing secret for** (or the old public key). Trigger.dev keeps verifying deliveries signed with the old credential until that time passes, so you can update the provider without failing deliveries. Choose **1 hour**, **24 hours** (the default) or **7 days**. Choose **Stop immediately** if the old credential leaked.
+Both dialogs ask how long to keep accepting the old secret: **Stop immediately**, 1 hour, 24 hours (the default) or 7 days. Until then, deliveries signed with either secret verify, so you can update the provider without failing any. Choose **Stop immediately** if the old secret leaked.
 
-Over the API, pass `previousSecretTtlSeconds` (up to `604800`, 7 days) to [generate a secret](/management/webhooks/generate-secret) or [set a secret](/management/webhooks/set-secret). The response includes `previousSecretExpiresAt`. Without `previousSecretTtlSeconds`, the old secret stops verifying immediately.
+Through the MCP tools or the REST API, pass `previousSecretTtlSeconds` (at most 604800, 7 days). The response's `previousSecretExpiresAt` says when the old secret stops working. Without it, the old secret stops working straight away:
+
+```bash
+curl -X POST "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret" \
+  -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"previousSecretTtlSeconds": 3600}'
+```
 
 <Warning>
   Trigger.dev stores credentials encrypted and doesn't display saved values. Copy a generated secret
diff --git a/docs/webhooks/deliveries.mdx b/docs/webhooks/deliveries.mdx
index 5b4891699de..836c85524ed 100644
--- a/docs/webhooks/deliveries.mdx
+++ b/docs/webhooks/deliveries.mdx
@@ -4,10 +4,6 @@ description: "Inspect webhook payloads, where each delivery went, and the runs i
 sidebarTitle: "Deliveries and endpoints"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **A delivery records a verified webhook event and what happened to it at each subscriber.** Find deliveries on an endpoint's **Deliveries** tab. A run that a delivery triggered links back to it, and to its endpoint, from the run's **Detail** tab.
 
 ## Endpoints
@@ -89,7 +85,7 @@ When the source maps a provider event ID, that ID becomes the key, so the provid
 
 | Key | Sources |
 | --- | --- |
-| A header | GitHub (`X-GitHub-Delivery`), Svix and Autumn (`svix-id`), Standard Webhooks, Loops and Granola (`webhook-id`), Linear (`Linear-Delivery`), PagerDuty (`X-Webhook-Id`), Jira (`X-Atlassian-Webhook-Identifier`), Zendesk (`X-Zendesk-Webhook-Invocation-Id`), Attio (`Idempotency-Key`), Shopify (`X-Shopify-Webhook-Id`) |
+| A header | GitHub (`X-GitHub-Delivery`), Svix and Autumn (`svix-id`), Standard Webhooks, Loops and Granola (`webhook-id`), Linear (`Linear-Delivery`), PagerDuty (`X-Webhook-Id`), Jira (`X-Atlassian-Webhook-Identifier`), Zendesk (`X-Zendesk-Webhook-Invocation-Id`), Attio (`Idempotency-Key`), Shopify (`X-Shopify-Webhook-Id`), Hookdeck (`X-Hookdeck-Eventid`, or `<prefix>-eventid` with a custom header prefix) |
 | A body field | Stripe, Notion, Vercel, Intercom, WorkOS, Metronome, Mux, Langfuse and Plain (`id`), Square, Slack and Typeform (`event_id`), Firecrawl (`webhookId`) |
 
 The other named sources (Zoom, Calendly, Sentry, DocuSign, ElevenLabs, Vapi, Retell, Tailscale, Infisical, PlanetScale, Supabase, Discord) use the fallback below.
diff --git a/docs/webhooks/filters.mdx b/docs/webhooks/filters.mdx
index 53efbb7aed8..0c7495ee2da 100644
--- a/docs/webhooks/filters.mdx
+++ b/docs/webhooks/filters.mdx
@@ -4,10 +4,6 @@ description: "Choose which verified webhook events reach each subscriber, by pay
 sidebarTitle: "Filters"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **A filter selects which verified deliveries reach a subscriber.** Each subscriber on an [endpoint](/webhooks/overview) has its own filter, so one delivery can start one task and skip another. A delivery no subscriber takes is recorded with status `FILTERED`, so you can inspect it in the dashboard.
 
 ## Add a filter
diff --git a/docs/webhooks/human-in-the-loop.mdx b/docs/webhooks/human-in-the-loop.mdx
index e6affd393cd..f166806f604 100644
--- a/docs/webhooks/human-in-the-loop.mdx
+++ b/docs/webhooks/human-in-the-loop.mdx
@@ -4,10 +4,6 @@ sidebarTitle: "Human-in-the-loop"
 description: "Pause an agent mid-turn to get a human decision from the channel (Slack approve/deny), then resume with the answer."
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **An agent on a [channel](/webhooks/channels) can pause a turn to get a human decision, then resume once someone answers in the thread.** It posts controls into the conversation and picks up where it left off once someone clicks, with the decision merged into the turn. This is the channel counterpart of browser [human-in-the-loop](/ai-chat/patterns/human-in-the-loop): the same no-`execute` tool, but the controls live in Slack (or your own surface) instead of a React component. The [`slack()`](/webhooks/slack) connector ships Approve and Deny buttons out of the box.
 
 ## How it works
diff --git a/docs/webhooks/linear.mdx b/docs/webhooks/linear.mdx
index a478fa0e741..48694962103 100644
--- a/docs/webhooks/linear.mdx
+++ b/docs/webhooks/linear.mdx
@@ -4,10 +4,6 @@ description: "Turn a chat.agent into a Linear agent: assign it an issue or @ment
 sidebarTitle: "Linear agents"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 Linear opens an **agent session** when someone @mentions your app in an issue or delegates (assigns) an issue to it. `linear()` from `@trigger.dev/linear` is a [channel](/webhooks/channels) connector for those sessions: each one becomes a durable Trigger.dev [session](/ai-chat/sessions), the user's prompt runs as a turn, and the agent's work shows up in Linear as thoughts, actions, a plan, an approval card when it needs a decision, and a response when it is done.
 
 ```ts
diff --git a/docs/webhooks/overview.mdx b/docs/webhooks/overview.mdx
index 0613611f570..84d7f437470 100644
--- a/docs/webhooks/overview.mdx
+++ b/docs/webhooks/overview.mdx
@@ -4,10 +4,6 @@ description: "Receive provider webhooks on hosted, verified endpoints and route
 sidebarTitle: "Overview"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **A webhook endpoint is one hosted URL that you register with a provider.** Trigger.dev verifies every request against the endpoint's [source](/webhooks/sources), records it as a [delivery](/webhooks/deliveries), and hands the event to everything subscribed to the endpoint.
 
 Declare the endpoint once, then subscribe to it:
diff --git a/docs/webhooks/session-routing.mdx b/docs/webhooks/session-routing.mdx
index 84be1570daa..297e63bd85c 100644
--- a/docs/webhooks/session-routing.mdx
+++ b/docs/webhooks/session-routing.mdx
@@ -4,10 +4,6 @@ description: "Route verified webhook deliveries to a durable per-key session ins
 sidebarTitle: "Session routing"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 A plain [`webhook()`](/webhooks/overview) runs a fresh, stateless run for every delivery. Sometimes you want the opposite: deliveries that share a key (a customer, an installation, an issue) should land on **one durable [session](/ai-chat/sessions)** and be handled in order, with state carried across them. That is what session routing does.
 
 Instead of a handler, you declare a `chat.event` on an [endpoint](/webhooks/overview) and list it on an agent. The verified delivery is routed to a find-or-created session and arrives as an [action](/ai-chat/actions).
diff --git a/docs/webhooks/slack.mdx b/docs/webhooks/slack.mdx
index 0f8bf1d6542..1be48e5e2dd 100644
--- a/docs/webhooks/slack.mdx
+++ b/docs/webhooks/slack.mdx
@@ -4,10 +4,6 @@ description: "Turn a chat.agent into a Slack agent: users message it in Slack, i
 sidebarTitle: "Slack agents"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **`slack()` from `@trigger.dev/slack` turns a `chat.agent` into a native Slack agent.** Each Slack agent session (a conversation with the agent, or a thread in a channel) becomes a durable Trigger.dev [session](/ai-chat/sessions). A message runs as a turn, the session shows the agent working, the reply streams into the thread as the model writes it, and Slack's stop button stops the turn.
 
 ```ts /trigger/support.ts
diff --git a/docs/webhooks/sources.mdx b/docs/webhooks/sources.mdx
index 989343a9a35..643de74ae01 100644
--- a/docs/webhooks/sources.mdx
+++ b/docs/webhooks/sources.mdx
@@ -4,10 +4,6 @@ description: "Choose an endpoint's source, configure verification, and type the
 sidebarTitle: "Sources & verification"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 An endpoint's `source` defines how Trigger.dev verifies requests and types the event every subscriber receives. Choose a named provider source or supply a verification configuration with `webhooks.custom()`.
 
 ## Presets
@@ -101,6 +97,7 @@ Each function below returns a source with its provider's verification configurat
 | HMAC-SHA256 with `X-Hub-Signature-256` | `whatsapp()` |
 | Shared secret in `X-Gitlab-Token` | `gitlab()` |
 | Shared secret as `Authorization: Bearer` | `supabase()` |
+| Hookdeck relay (HMAC-SHA256 with `X-Hookdeck-Signature`) | `hookdeck()` |
 | Provider-specific HMAC | `calendly()`, `calCom()`, `sentry()`, `pagerduty()`, `vercel()`, `linear()`, `notion()`, `typeform()`, `docusign()`, `jira()`, `intercom()`, `zendesk()`, `attio()`, `workos()`, `elevenlabs()`, `vapi()`, `retell()`, `shopify()`, `metronome()`, `mux()`, `tailscale()`, `langfuse()`, `infisical()`, `planetscale()`, `plain()`, `firecrawl()` |
 
 Provider IDs containing a hyphen use a camel case function name: the `cal-com` provider is `webhooks.calCom()`.
@@ -109,6 +106,35 @@ Supabase database webhooks aren't signed, so `supabase()` checks a shared secret
 
 Slack also ships as a chat channel in `@trigger.dev/slack`.
 
+### Hookdeck
+
+`hookdeck()` verifies requests that a [Hookdeck](https://hookdeck.com) connection forwards to the endpoint. Hookdeck forwards the original provider's body unchanged, so pass that provider's event type:
+
+```ts /trigger/stripe-via-hookdeck.ts
+import type Stripe from "stripe";
+import { webhook, webhooks } from "@trigger.dev/sdk";
+
+export const stripeViaHookdeck = webhooks.endpoint.define({
+  id: "stripe-via-hookdeck",
+  source: webhooks.hookdeck<Stripe.Event>(),
+});
+
+export const paymentSucceeded = webhook({
+  id: "payment-succeeded",
+  endpoint: stripeViaHookdeck,
+  filter: "event.type == 'payment_intent.succeeded'",
+  onEvent: async ({ event }) => {
+    console.log(event.id);
+  },
+});
+```
+
+Use the endpoint URL as the connection's HTTP destination, keep the destination's authentication on Hookdeck Signature (the default for new destinations), and store the Hookdeck project's signing secret from **Settings > Secrets** as the endpoint's signing secret.
+
+- **Secret rotation:** when you roll the signing secret in Hookdeck with an expiry, Hookdeck also signs each request with the previous secret in `X-Hookdeck-Signature-2`, so deliveries keep verifying until you store the new secret.
+- **Deduplication:** retries dedupe on `X-Hookdeck-Eventid`, which is the same on every attempt of a Hookdeck event.
+- **Custom header prefix:** if you changed the header prefix in the Hookdeck project's settings, pass it with `webhooks.hookdeck({ headerPrefix: "x-acme" })`. The prefix renames the event id header; the signature headers keep the `X-Hookdeck-` name.
+
 ## Endpoint validation
 
 Some sources also define a response for the provider's endpoint-validation request. These requests don't create deliveries or task runs.
@@ -150,7 +176,7 @@ export const internalEvents = webhook({
 });
 ```
 
-To accept a signature from more than one header, list the extra headers in `additionalSignatureHeaders` (up to 4). Trigger.dev parses them like `signatureHeader` and accepts a match in any of them. This keeps deliveries verifying when a provider sends a second signature during a secret rotation, such as Hookdeck's `x-hookdeck-signature-2`. `signatureHeader` is still required.
+To accept a signature from more than one header, list the extra headers in `additionalSignatureHeaders` (up to 4). Trigger.dev parses each one like `signatureHeader` and accepts a match in any of them. Use this when a provider sends a second signature, for example one signed with the previous secret during a rotation. `signatureHeader` is still required. The built-in [`hookdeck()`](#hookdeck) source already checks `X-Hookdeck-Signature-2` this way.
 
 The optional `setupPrompt` is the provider-specific part of the endpoint's [setup prompt](/webhooks/connect#set-it-up-with-an-ai-agent): where the provider's webhook settings are and how to register a URL there. Trigger.dev adds the URL, the subscribers' filters and the signing secret steps around it.
 
diff --git a/docs/webhooks/waiters.mdx b/docs/webhooks/waiters.mdx
index d059cdf388f..1787e34cc90 100644
--- a/docs/webhooks/waiters.mdx
+++ b/docs/webhooks/waiters.mdx
@@ -4,10 +4,6 @@ description: "Pause a run until a matching webhook arrives on an endpoint, then
 sidebarTitle: "Waiters"
 ---
 
-import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
-
-<WebhooksBetaBanner />
-
 **A waiter pauses a run until a matching delivery arrives on an [endpoint](/webhooks/overview).** Use it when your task starts something in another system and needs to know when that system reports back: a payment that settles, a build that finishes, a document that gets signed.
 
 ```ts /trigger/checkout.ts
diff --git a/internal-packages/run-engine/src/engine/index.ts b/internal-packages/run-engine/src/engine/index.ts
index 528ce48266d..38428c29e3b 100644
--- a/internal-packages/run-engine/src/engine/index.ts
+++ b/internal-packages/run-engine/src/engine/index.ts
@@ -466,6 +466,7 @@ export class RunEngine {
     });
 
     this.waitpointSystem = new WaitpointSystem({
+      waitpointStoreEnabled: options.waitpointStoreEnabled,
       resources,
       executionSnapshotSystem: this.executionSnapshotSystem,
       enqueueSystem: this.enqueueSystem,
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
new file mode 100644
index 00000000000..d17dbccea0d
--- /dev/null
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
@@ -0,0 +1,209 @@
+// Pure mapping coverage; storage routing and failures use real stores in the integration suite.
+import { describe, expect, it } from "vitest";
+import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
+import type {
+  WaitpointCompletion,
+  WaitpointRecordInput,
+  WaitpointStoredRecord,
+} from "../waitpointCoordinator/storeCoordinator.js";
+import { storeRecordToCompletedWaitpointRecord } from "./completedWaitpointRecordAdapter.js";
+
+function storeRecordInput(
+  id: string,
+  overrides: Partial<WaitpointRecordInput> = {}
+): WaitpointRecordInput {
+  return {
+    id,
+    friendlyId: `waitpoint_${id}`,
+    type: "MANUAL",
+    environmentId: "env_1",
+    projectId: "proj_1",
+    createdAt: "2026-01-01T00:00:00.000Z",
+    updatedAt: "2026-01-01T00:00:00.000Z",
+    userProvidedIdempotencyKey: false,
+    tags: [],
+    ...overrides,
+  };
+}
+
+function storeCompletion(overrides: Partial<WaitpointCompletion> = {}): WaitpointCompletion {
+  return {
+    completedAt: "2026-01-01T00:00:00.000Z",
+    outputType: "application/json",
+    outputIsError: false,
+    output: null,
+    ...overrides,
+  };
+}
+
+function storeEntry(
+  id: string,
+  recordOverrides: Partial<WaitpointRecordInput> = {},
+  completion: WaitpointCompletion | undefined = storeCompletion(),
+  status: WaitpointStoredRecord["status"] = "COMPLETED"
+): WaitpointStoredRecord {
+  return { status, record: storeRecordInput(id, recordOverrides), completion };
+}
+
+// A fixed effective time for the mapping tests that do not exercise expiry.
+const NOW_MS = Date.parse("2026-08-21T12:00:00.000Z");
+const mapStoreRecord = (entry: WaitpointStoredRecord, nowMs: number = NOW_MS) =>
+  storeRecordToCompletedWaitpointRecord(entry, nowMs);
+
+describe("storeRecordToCompletedWaitpointRecord — envelope fidelity", () => {
+  it("preserves an inline output", () => {
+    const id = generateWaitpointId("MANUAL");
+    const record = mapStoreRecord(
+      storeEntry(id, {}, storeCompletion({ output: { inline: '{"value":42}' } }))
+    );
+    expect(record.output).toEqual({ inline: '{"value":42}' });
+  });
+
+  it("preserves a referenced (offloaded) output", () => {
+    const id = generateWaitpointId("MANUAL");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        {},
+        storeCompletion({ outputType: "application/store", output: { ref: "s3://bucket/key" } })
+      )
+    );
+    expect(record.output).toEqual({ ref: "s3://bucket/key" });
+    expect(record.outputType).toBe("application/store");
+  });
+
+  it("preserves an error output and its flag", () => {
+    const id = generateWaitpointId("MANUAL");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        {},
+        storeCompletion({ outputIsError: true, output: { inline: '{"type":"STRING_ERROR"}' } })
+      )
+    );
+    expect(record.outputIsError).toBe(true);
+    expect(record.output).toEqual({ inline: '{"type":"STRING_ERROR"}' });
+  });
+
+  it("keeps a RUN success on deriveFromRun, not a copy of its output", () => {
+    const id = generateWaitpointId("RUN");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        { type: "RUN", completedByTaskRunId: "run_child" },
+        storeCompletion({ output: { inline: '{"value":42}' } })
+      )
+    );
+    // The stored inline value is dropped: the read side re-derives it from TaskRun.output.
+    expect(record.output).toEqual({ deriveFromRun: true });
+    expect(record.completedByTaskRunId).toBe("run_child");
+  });
+
+  it("keeps a RUN success on deriveFromRun even when the stored output is null", () => {
+    // The store may keep a re-derivable RUN success's output null rather than copy it. That null must
+    // still resolve to deriveFromRun, NOT to no output — the completion is re-read from TaskRun.output.
+    const id = generateWaitpointId("RUN");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        { type: "RUN", completedByTaskRunId: "run_child" },
+        storeCompletion({ output: null })
+      )
+    );
+    expect(record.output).toEqual({ deriveFromRun: true });
+    expect(record.completedByTaskRunId).toBe("run_child");
+  });
+
+  it("carries a RUN ERROR inline, never deriveFromRun", () => {
+    const id = generateWaitpointId("RUN");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        { type: "RUN", completedByTaskRunId: "run_child" },
+        storeCompletion({ outputIsError: true, output: { inline: '{"type":"BUILT_IN_ERROR"}' } })
+      )
+    );
+    expect(record.output).toEqual({ inline: '{"type":"BUILT_IN_ERROR"}' });
+  });
+
+  it("preserves timestamps and type-specific metadata", () => {
+    const id = generateWaitpointId("DATETIME");
+    const record = mapStoreRecord(
+      storeEntry(
+        id,
+        { type: "DATETIME", completedAfter: "2026-02-02T00:00:00.000Z" },
+        storeCompletion({ completedAt: "2026-03-03T04:05:06.000Z" })
+      )
+    );
+    expect(record.type).toBe("DATETIME");
+    expect(record.completedAt).toBe("2026-03-03T04:05:06.000Z");
+    expect(record.completedAfter).toBe("2026-02-02T00:00:00.000Z");
+  });
+
+  it("exposes a user-provided idempotency key and hides a system one", () => {
+    const id = generateWaitpointId("MANUAL");
+    const withUserKey = mapStoreRecord(
+      storeEntry(id, { userProvidedIdempotencyKey: true, idempotencyKey: "idem_user" })
+    );
+    expect(withUserKey.idempotencyKey).toBe("idem_user");
+
+    const withSystemKey = mapStoreRecord(
+      storeEntry(id, { userProvidedIdempotencyKey: false, idempotencyKey: "idem_system" })
+    );
+    expect(withSystemKey.idempotencyKey).toBeUndefined();
+  });
+});
+
+describe("storeRecordToCompletedWaitpointRecord — idempotency key expiry", () => {
+  const iso = (ms: number) => new Date(ms).toISOString();
+  const userKey = (overrides: Partial<WaitpointRecordInput>) =>
+    storeEntry(generateWaitpointId("MANUAL"), {
+      userProvidedIdempotencyKey: true,
+      idempotencyKey: "idem_user",
+      ...overrides,
+    });
+
+  it("keeps a user key with no expiry visible", () => {
+    expect(mapStoreRecord(userKey({}), NOW_MS).idempotencyKey).toBe("idem_user");
+  });
+
+  it("keeps a user key with a future expiry visible", () => {
+    const record = mapStoreRecord(
+      userKey({ idempotencyKeyExpiresAt: iso(NOW_MS + 60_000) }),
+      NOW_MS
+    );
+    expect(record.idempotencyKey).toBe("idem_user");
+  });
+
+  it("omits a user key with a past expiry", () => {
+    const record = mapStoreRecord(
+      userKey({ idempotencyKeyExpiresAt: iso(NOW_MS - 60_000) }),
+      NOW_MS
+    );
+    expect(record.idempotencyKey).toBeUndefined();
+  });
+
+  it("omits a user key expiring exactly at the effective time (PEXPIREAT semantics)", () => {
+    const record = mapStoreRecord(userKey({ idempotencyKeyExpiresAt: iso(NOW_MS) }), NOW_MS);
+    expect(record.idempotencyKey).toBeUndefined();
+  });
+
+  it("fails loud on a malformed stored expiry", () => {
+    expect(() =>
+      mapStoreRecord(userKey({ idempotencyKeyExpiresAt: "not-a-date" }), NOW_MS)
+    ).toThrow(/malformed idempotencyKeyExpiresAt/);
+  });
+
+  it("keeps a system-generated key hidden regardless of expiry (never throws on its expiry)", () => {
+    const system = (expiry: string | undefined) =>
+      storeEntry(generateWaitpointId("MANUAL"), {
+        userProvidedIdempotencyKey: false,
+        idempotencyKey: "idem_system",
+        idempotencyKeyExpiresAt: expiry,
+      });
+    expect(mapStoreRecord(system(iso(NOW_MS - 60_000)), NOW_MS).idempotencyKey).toBeUndefined();
+    expect(mapStoreRecord(system(iso(NOW_MS + 60_000)), NOW_MS).idempotencyKey).toBeUndefined();
+    // A malformed expiry on a hidden key is never consulted, so it does not fail loud.
+    expect(mapStoreRecord(system("not-a-date"), NOW_MS).idempotencyKey).toBeUndefined();
+  });
+});
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
new file mode 100644
index 00000000000..f96d6deac82
--- /dev/null
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
@@ -0,0 +1,251 @@
+// The Waitpoint-side adapter TRES consumes when it builds a fresh Redis-primary completed-waitpoint
+// cycle. It turns the run's ordered blocker ids into exactly one frozen CompletedWaitpointRecord per
+// DISTINCT id, resolving each id through the coordinator its SHAPE names — legacy ids through Postgres,
+// store-format ids through MemoryDB — and combines the two residencies into one complete record set.
+//
+// The frozen record shape and the write-side rules live in completedWaitpointResolver.ts and
+// completedWaitpointFreeze.test.ts; this file only routes ids to the right source and maps a
+// store-resident completion into that same shape. It never touches Redis or Postgres directly: the
+// readers are injected, so the partition/coverage logic is a pure function of them.
+import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
+import type { CompletedWaitpointRecord } from "@internal/run-store";
+import type {
+  WaitpointCompletion,
+  WaitpointRecordInput,
+  WaitpointStoredRecord,
+} from "../waitpointCoordinator/storeCoordinator.js";
+
+/**
+ * The whole resolution failed loudly. Every path that leaves a distinct id without exactly one
+ * complete record throws this: a missing legacy or store record, a store record that is not
+ * COMPLETED, a store id with no store reader, or a coverage mismatch. TRES turns a throw here into a
+ * rolled-back transition, so a partial cycle is never published.
+ */
+export class UnresolvableCompletedWaitpointRecordsError extends Error {
+  constructor(
+    message: string,
+    readonly waitpointId?: string
+  ) {
+    super(message);
+    this.name = "UnresolvableCompletedWaitpointRecordsError";
+  }
+}
+
+/** Resolves the legacy (Postgres) half: one record per DISTINCT id, missing ids simply absent. */
+export type LegacyCompletedWaitpointReader = (ids: string[]) => Promise<CompletedWaitpointRecord[]>;
+
+/** Resolves the store (MemoryDB) half: a map of the ids PRESENT in the store. Absence != failure. */
+export type StoreCompletedWaitpointReader = (
+  ids: string[]
+) => Promise<Map<string, WaitpointStoredRecord>>;
+
+/**
+ * Map a store-resident record + completion to the frozen CompletedWaitpointRecord shape, as of
+ * `nowMs` (the resolver's single effective time).
+ *
+ * Output selection mirrors the Postgres write side (`recordOutputFor`): a RUN success re-derives its
+ * output byte-identically from TaskRun.output, so it carries `deriveFromRun` and NOT a copy — even an
+ * offloaded one — which keeps a potentially large inline value out of the cycle payload. Everything
+ * else passes the store's own inline/ref discrimination straight through.
+ *
+ * The idempotency key is the already-resolved user-visible value, gated on its expiry (see
+ * `idempotencyKeyIsActive`): the store keeps the original key on the immutable record even after its
+ * separate reservation has expired via `PEXPIREAT`, so exposing it unconditionally would let an old
+ * waitpoint present a key a replacement waitpoint has since taken over — the exact state the Postgres
+ * path drops through `inactiveIdempotencyKey`.
+ */
+export function storeRecordToCompletedWaitpointRecord(
+  entry: WaitpointStoredRecord,
+  nowMs: number
+): CompletedWaitpointRecord {
+  const { record, completion } = entry;
+  if (!completion) {
+    throw new UnresolvableCompletedWaitpointRecordsError(
+      `Waitpoint ${record.id} is COMPLETED in the store with no completion envelope`,
+      record.id
+    );
+  }
+
+  return {
+    id: record.id,
+    friendlyId: record.friendlyId,
+    type: record.type,
+    completedAt: completion.completedAt,
+    outputType: completion.outputType,
+    outputIsError: completion.outputIsError,
+    output: storeRecordOutput(record, completion),
+    completedByTaskRunId: record.completedByTaskRunId,
+    completedByBatchId: record.completedByBatchId,
+    completedAfter: record.completedAfter,
+    idempotencyKey: idempotencyKeyIsActive(record, nowMs) ? record.idempotencyKey : undefined,
+  };
+}
+
+/**
+ * Whether a store record's idempotency key is user-visible at `nowMs`.
+ *
+ * A system-generated or absent key is never exposed, and its expiry is not even consulted. A
+ * user-provided key with no expiry is always active. One with an expiry is active only STRICTLY before
+ * that instant: at the exact expiry ms the key is already gone, matching the `PEXPIREAT` that retires
+ * its reservation. A stored expiry that will not parse is corrupted durable state, so it fails loud
+ * rather than exposing the key or silently reinterpreting it.
+ */
+function idempotencyKeyIsActive(record: WaitpointRecordInput, nowMs: number): boolean {
+  if (!record.userProvidedIdempotencyKey || !record.idempotencyKey) {
+    return false;
+  }
+  const raw = record.idempotencyKeyExpiresAt;
+  if (raw === undefined) {
+    return true;
+  }
+  const expiresAtMs = Date.parse(raw);
+  if (Number.isNaN(expiresAtMs)) {
+    throw new UnresolvableCompletedWaitpointRecordsError(
+      `Waitpoint ${record.id} has a malformed idempotencyKeyExpiresAt: ${JSON.stringify(raw)}`,
+      record.id
+    );
+  }
+  return expiresAtMs > nowMs;
+}
+
+function storeRecordOutput(
+  record: WaitpointRecordInput,
+  completion: WaitpointCompletion
+): CompletedWaitpointRecord["output"] {
+  // FIRST, before the null and inline/ref branches: a RUN success re-derives its output
+  // byte-identically from TaskRun.output, so it carries deriveFromRun and never a copy. This
+  // precedes the null check deliberately — unlike the Postgres write side, where a null output means
+  // "none". The store may store a RUN success's output as null precisely BECAUSE it is re-derivable
+  // and was never copied, so a null here must still resolve to deriveFromRun, not to no output.
+  if (record.type === "RUN" && !completion.outputIsError && record.completedByTaskRunId) {
+    return { deriveFromRun: true };
+  }
+  const output = completion.output;
+  if (output === null) {
+    return null;
+  }
+  if ("ref" in output) {
+    return { ref: output.ref };
+  }
+  return { inline: output.inline };
+}
+
+/**
+ * Resolve the complete frozen record set for one Redis-primary resume.
+ *
+ * `requestedIds` is the caller's ordered, duplicate-preserving blocker list. The returned records are
+ * one per DISTINCT id, in first-seen order — the ordered/duplicate reference list and its indexes stay
+ * with the caller's separate `completedWaitpoints` array, which is what the read-time enhancement step
+ * expands. Every distinct id is resolved exactly once even when referenced repeatedly.
+ *
+ * Partitioning is by id SHAPE and is total and exclusive: `parseWaitpointId` classes every id as
+ * either legacy or store-format, never both and never neither. A store id therefore never reaches
+ * Postgres, and a missing store record never falls back to it.
+ */
+export async function resolveCompletedWaitpointRecords(args: {
+  requestedIds: string[];
+  legacyReader: LegacyCompletedWaitpointReader;
+  storeReader?: StoreCompletedWaitpointReader;
+  /** Effective-time clock, called exactly ONCE. Injectable for tests; defaults to `Date.now`. */
+  now?: () => number;
+}): Promise<CompletedWaitpointRecord[]> {
+  const { requestedIds, legacyReader, storeReader } = args;
+
+  // Captured ONCE for the whole invocation, so a cycle whose records straddle an idempotency-key
+  // expiry boundary judges every record against the same instant instead of a per-record clock.
+  const nowMs = (args.now ?? Date.now)();
+
+  // First-seen order, duplicates collapsed: the distinct set we must cover exactly once each.
+  const distinctIds: string[] = [];
+  const seen = new Set<string>();
+  const legacyIds: string[] = [];
+  const storeIds: string[] = [];
+  for (const id of requestedIds) {
+    if (seen.has(id)) continue;
+    seen.add(id);
+    distinctIds.push(id);
+    if (parseWaitpointId(id).format === "legacy") {
+      legacyIds.push(id);
+    } else {
+      storeIds.push(id);
+    }
+  }
+
+  if (storeIds.length > 0 && !storeReader) {
+    throw new UnresolvableCompletedWaitpointRecordsError(
+      `${storeIds.length} store-format waitpoint id(s) in the cycle but no store coordinator is available to resolve them`,
+      storeIds[0]
+    );
+  }
+
+  const byId = new Map<string, CompletedWaitpointRecord>();
+
+  if (legacyIds.length > 0) {
+    const legacySet = new Set(legacyIds);
+    const legacyRecords = await legacyReader(legacyIds);
+    for (const rec of legacyRecords) {
+      if (!legacySet.has(rec.id)) {
+        // The reader returned a record for an id we never asked for (or a store id): an integrity
+        // failure, not something to silently keep.
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `Legacy reader returned an unrequested record ${rec.id}`,
+          rec.id
+        );
+      }
+      if (byId.has(rec.id)) {
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `Legacy reader returned a duplicate record for ${rec.id}`,
+          rec.id
+        );
+      }
+      byId.set(rec.id, rec);
+    }
+    for (const id of legacyIds) {
+      if (!byId.has(id)) {
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `No completed legacy waitpoint record for ${id}`,
+          id
+        );
+      }
+    }
+  }
+
+  if (storeIds.length > 0) {
+    // storeReader is defined here (guarded above). A Redis failure throws out of it; a genuinely
+    // absent id comes back simply missing from the map — the two are never conflated.
+    const storeMap = await storeReader!(storeIds);
+    for (const id of storeIds) {
+      const entry = storeMap.get(id);
+      if (!entry) {
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `No store waitpoint record for ${id}`,
+          id
+        );
+      }
+      if (entry.record.id !== id) {
+        // The store returned a record whose own id is not the one we asked for: a wrong or corrupted
+        // blob. Trusting it would file the mismatched record under `id` and lose the real one.
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `Store returned record ${entry.record.id} for requested id ${id}`,
+          id
+        );
+      }
+      if (entry.status !== "COMPLETED") {
+        throw new UnresolvableCompletedWaitpointRecordsError(
+          `Store waitpoint ${id} is ${entry.status}, not COMPLETED`,
+          id
+        );
+      }
+      byId.set(id, storeRecordToCompletedWaitpointRecord(entry, nowMs));
+    }
+  }
+
+  // Belt and braces over the per-half checks: exactly one record per distinct id, nothing extra.
+  if (byId.size !== distinctIds.length) {
+    throw new UnresolvableCompletedWaitpointRecordsError(
+      `Resolved ${byId.size} record(s) for ${distinctIds.length} distinct waitpoint id(s)`
+    );
+  }
+
+  return distinctIds.map((id) => byId.get(id)!);
+}
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
index a0ada51e3fb..d4d5bde9795 100644
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
@@ -1,3 +1,4 @@
+import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
 // Two layers. The PURE-LOGIC layer proves buildCompletedWaitpointRecords + the expander agree
 // with the Postgres oracle (enhanceExecutionSnapshotWithWaitpoints) field-for-field across every
 // required case, with the deriveFromRun lookup injected as a closure per the branch rule. The
@@ -7,12 +8,13 @@ import { describe, expect, it } from "vitest";
 import { heteroRunOpsPostgresTest } from "@internal/testcontainers";
 import { PostgresRunStore, RoutingRunStore, type CreateRunInput } from "@internal/run-store";
 import type { CompletedWaitpoint } from "@trigger.dev/core/v3";
-import type { PrismaClient, Waitpoint } from "@trigger.dev/database";
+import { PrismaClient, type Waitpoint } from "@trigger.dev/database";
 import type { RunOpsPrismaClient } from "@internal/run-ops-database";
 import { enhanceExecutionSnapshotWithWaitpoints } from "./executionSnapshotSystem.js";
 import {
   buildCompletedWaitpointRecords,
   createCompletedWaitpointResolver,
+  createStoreRunCompletedWaitpointResolver,
   expandCompletedWaitpointRecords,
 } from "./completedWaitpointResolver.js";
 
@@ -393,7 +395,121 @@ async function seedCompletingRun(
   });
 }
 
+it("skips ID classification by default, when disabled, and without trusted organization context", async () => {
+  // Real clients/stores, with inline records so the original resolver needs no database I/O.
+  const prisma = new PrismaClient({ datasourceUrl: "postgresql://unused:unused@localhost/unused" });
+  const store = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+  const records = buildCompletedWaitpointRecords([
+    makeWaitpoint({ type: "RUN", output: "inline-result" }),
+  ]);
+  // This sentinel throws in parseWaitpointId; the legacy expander only carries the ID through.
+  records[0]!.id = null as unknown as string;
+  const args = {
+    runId: "parent",
+    pointer: { cycleSeq: 1, count: 1 },
+    order: [],
+    records,
+  };
+  try {
+    const defaultResolver = createStoreRunCompletedWaitpointResolver(store, prisma);
+    expect((await defaultResolver(args, { organizationId: "trusted-org" }))[0]!.output).toBe(
+      "inline-result"
+    );
+    const checkedOrganizations: string[] = [];
+    const disabled = createStoreRunCompletedWaitpointResolver(store, prisma, (organizationId) => {
+      checkedOrganizations.push(organizationId);
+      return false;
+    });
+    expect((await disabled(args, { organizationId: "trusted-org" }))[0]!.id).toBeNull();
+    expect(checkedOrganizations).toEqual(["trusted-org"]);
+    const enabled = createStoreRunCompletedWaitpointResolver(store, prisma, () => true);
+    expect((await enabled(args))[0]!.id).toBeNull();
+    await expect(enabled(args, { organizationId: "trusted-org" })).rejects.toThrow();
+  } finally {
+    await prisma.$disconnect();
+  }
+});
+
 describe("createCompletedWaitpointResolver reads TaskRun.output through the routed store", () => {
+  heteroRunOpsPostgresTest(
+    "MemoryDB RUN outputs use the owning primary under a real frozen reader while legacy records retain their read policy",
+    async ({ prisma14, prisma17 }) => {
+      const writer = makeRouter(prisma14 as unknown as PrismaClient, prisma17);
+      const env = await seedEnv(prisma14 as unknown as PrismaClient, "store-primary-lag");
+      await seedCompletingRun(writer, env, RUN_OPS_A, "stale-output", prisma17 as never);
+      await prisma17.$transaction(
+        async (frozenReader) => {
+          // REPEATABLE READ pins a real database snapshot before the primary commits the new output.
+          expect(
+            (await frozenReader.taskRun.findUniqueOrThrow({ where: { id: RUN_OPS_A } })).output
+          ).toBe("stale-output");
+          await prisma17.taskRun.update({
+            where: { id: RUN_OPS_A },
+            data: { output: "committed-output" },
+          });
+          const router = new RoutingRunStore({
+            new: new PostgresRunStore({
+              prisma: prisma17 as never,
+              readOnlyPrisma: frozenReader as never,
+              schemaVariant: "dedicated",
+            }),
+            legacy: new PostgresRunStore({
+              prisma: prisma14 as never,
+              readOnlyPrisma: prisma14 as never,
+            }),
+          });
+          const storeId = generateWaitpointId("RUN");
+          const records = buildCompletedWaitpointRecords([
+            makeWaitpoint({
+              id: storeId,
+              type: "RUN",
+              completedByTaskRunId: RUN_OPS_A,
+              output: "derive",
+            }),
+            makeWaitpoint({
+              id: "legacy_waitpoint",
+              type: "RUN",
+              completedByTaskRunId: RUN_OPS_A,
+              output: "derive",
+            }),
+          ]);
+          const args = {
+            runId: "parent",
+            pointer: { cycleSeq: 1, count: 2 },
+            order: [storeId, "legacy_waitpoint"],
+            records,
+          };
+          const unchanged = await createCompletedWaitpointResolver(router)(args);
+          expect(unchanged.map((row) => row.output)).toEqual(["stale-output", "stale-output"]);
+          const resolver = createStoreRunCompletedWaitpointResolver(
+            router,
+            prisma14 as never,
+            (organizationId) => organizationId === env.organization.id
+          );
+          const resolved = await resolver(args, { organizationId: env.organization.id });
+          expect(resolved.map((row) => row.id)).toEqual([storeId, "legacy_waitpoint"]);
+          expect(resolved.map((row) => row.output)).toEqual(["committed-output", "stale-output"]);
+          expect(
+            (await frozenReader.taskRun.findUniqueOrThrow({ where: { id: RUN_OPS_A } })).output
+          ).toBe("stale-output");
+          const missing = { ...records[0]!, completedByTaskRunId: RUN_OPS_B };
+          await expect(
+            resolver({ ...args, records: [missing] }, { organizationId: env.organization.id })
+          ).rejects.toThrow("No completing TaskRun");
+          expect(
+            (
+              await resolver(
+                { ...args, records: [{ ...missing, id: "legacy_missing" }] },
+                { organizationId: env.organization.id }
+              )
+            )[0]!.output
+          ).toBeNull();
+        },
+        { isolationLevel: "RepeatableRead", timeout: 15_000 }
+      );
+    }
+  );
+
   heteroRunOpsPostgresTest(
     "resolves a deriveFromRun record from the completing run on the #new shard",
     async ({ prisma14, prisma17 }) => {
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
index 4aebec2be7b..1a0c65db93f 100644
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
@@ -1,3 +1,4 @@
+import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
 // The production completed-waitpoint record builder + resolver. The reference implementation
 // this mirrors, and the shape contract, live in completedWaitpointFreeze.test.ts.
 import type { Waitpoint } from "@trigger.dev/database";
@@ -7,6 +8,7 @@ import type {
   CompletedWaitpointResolver,
   ResolveCompletedWaitpointsArgs,
   RunStore,
+  ReadClient,
   SnapshotReadWaitpoint,
 } from "@internal/run-store";
 
@@ -118,7 +120,9 @@ export function expandCompletedWaitpointRecords(
  * run on another shard is resolved correctly), then expands synchronously.
  */
 export function createCompletedWaitpointResolver(
-  runStore: Pick<RunStore, "findRunsByIds">
+  runStore: Pick<RunStore, "findRunsByIds">,
+  client?: ReadClient,
+  requireRunRows = false
 ): CompletedWaitpointResolver {
   return async (args) => {
     const runIds = new Set<string>();
@@ -130,8 +134,10 @@ export function createCompletedWaitpointResolver(
 
     const outputs = new Map<string, string | undefined>();
     if (runIds.size > 0) {
-      const runs = await runStore.findRunsByIds([...runIds], { select: { output: true } });
+      const runs = await runStore.findRunsByIds([...runIds], { select: { output: true } }, client);
       for (const id of runIds) {
+        if (requireRunRows && !runs.has(id))
+          throw new Error(`No completing TaskRun ${id} for shared waitpoint result`);
         outputs.set(id, runs.get(id)?.output ?? undefined);
       }
     }
@@ -139,3 +145,46 @@ export function createCompletedWaitpointResolver(
     return expandCompletedWaitpointRecords(args, (id) => outputs.get(id));
   };
 }
+
+/**
+ * Redis-primary cycles can mix old Postgres tokens with MemoryDB tokens. Only a MemoryDB RUN
+ * completion proves that its child output has committed independently of the snapshot replica.
+ * Resolve those children on their owning primary and fail closed on missing rows; retain the
+ * established read policy for every legacy record, including deployments using TRES alone.
+ */
+export function createStoreRunCompletedWaitpointResolver(
+  runStore: Pick<RunStore, "findRunsByIds">,
+  primaryReadClient: ReadClient,
+  isEnabled?: (organizationId: string) => boolean | Promise<boolean>
+): (
+  args: ResolveCompletedWaitpointsArgs,
+  context?: { organizationId: string }
+) => ReturnType<CompletedWaitpointResolver> {
+  const legacy = createCompletedWaitpointResolver(runStore);
+  const store = createCompletedWaitpointResolver(runStore, primaryReadClient, true);
+  return async (args, context) => {
+    // TRES alone retains the original resolver without partitioning or parsing completion IDs.
+    if (!context?.organizationId || (await isEnabled?.(context.organizationId)) !== true) {
+      return legacy(args);
+    }
+    const storeRecords: CompletedWaitpointRecord[] = [];
+    const legacyRecords: CompletedWaitpointRecord[] = [];
+    for (const record of args.records) {
+      (record.type === "RUN" &&
+      parseWaitpointId(record.id).format !== "legacy" &&
+      record.output &&
+      "deriveFromRun" in record.output
+        ? storeRecords
+        : legacyRecords
+      ).push(record);
+    }
+    if (storeRecords.length === 0) return legacy(args);
+    if (legacyRecords.length === 0) return store(args);
+    const [legacyRows, storeRows] = await Promise.all([
+      legacy({ ...args, records: legacyRecords }),
+      store({ ...args, records: storeRecords }),
+    ]);
+    const rows = new Map([...legacyRows, ...storeRows].map((row) => [row.id, row]));
+    return args.records.map((record) => rows.get(record.id)!);
+  };
+}
diff --git a/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts b/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
index 91ad43d7d3e..84e43257f1d 100644
--- a/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
@@ -16,12 +16,19 @@ import { describe, expect } from "vitest";
 import { containerTest } from "@internal/testcontainers";
 import {
   PostgresRunStore,
+  RoutingRunStore,
+  markReadReplicaClient,
   RedisSnapshotStore,
   TaskRunExecutionSnapshotStore,
   type CreateRunInput,
 } from "@internal/run-store";
-import { BatchId, generateInternalId, RunId } from "@trigger.dev/core/v3/isomorphic";
-import type { PrismaClient, Waitpoint } from "@trigger.dev/database";
+import {
+  BatchId,
+  generateInternalId,
+  generateWaitpointId,
+  RunId,
+} from "@trigger.dev/core/v3/isomorphic";
+import { PrismaClient, type Waitpoint } from "@trigger.dev/database";
 import {
   enhanceExecutionSnapshotWithWaitpoints,
   getLatestExecutionSnapshot,
@@ -31,6 +38,9 @@ import {
   createCompletedWaitpointResolver,
 } from "./completedWaitpointResolver.js";
 
+import { createWaitpointResultRunStore } from "./waitpointResultRunStore.js";
+import { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
+
 const ROUTE = "logical:1";
 
 async function seedEnv(prisma: PrismaClient, suffix: string) {
@@ -155,6 +165,166 @@ async function seedResumedRedisPrimaryRun(
 }
 
 describe("redis-primary resume keeps its completion associations (engine boundary)", () => {
+  containerTest(
+    "disabled hydration preserves snapshot reads without interpreting storage metadata",
+    async ({ prisma, redisOptions }) => {
+      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const waitpoints = new WaitpointStoreCoordinator({ redisOptions });
+      try {
+        const env = await seedEnv(prisma, "disabled-hydration");
+        const runId = generateInternalId();
+        await delegate.createRun(createRunInput(runId, env));
+        // The base Postgres reader carries metadata through unchanged. Hydration must not
+        // introduce parsing errors for disabled orgs, including future metadata versions.
+        await prisma.taskRunExecutionSnapshot.updateMany({
+          where: { runId },
+          data: { metadata: { snapshotStore: { version: 2, residency: "mirrored" } } },
+        });
+        const baseline = await delegate.findLatestExecutionSnapshot(runId);
+        const checkedOrganizations: string[] = [];
+        let enabledOrganization: string | undefined;
+        const reader = createWaitpointResultRunStore(delegate, {
+          store: waitpoints,
+          isEnabled: (organizationId) => {
+            checkedOrganizations.push(organizationId);
+            return organizationId === enabledOrganization;
+          },
+        });
+        expect(await reader.findLatestExecutionSnapshot(runId)).toEqual(baseline);
+        const args = { where: { runId }, include: { completedWaitpoints: true } } as const;
+        expect(await reader.findExecutionSnapshot(args)).toEqual(
+          await delegate.findExecutionSnapshot(args)
+        );
+        expect(checkedOrganizations).toEqual([env.organization.id, env.organization.id]);
+        enabledOrganization = env.organization.id;
+        await expect(reader.findLatestExecutionSnapshot(runId)).rejects.toThrow(
+          "Unsupported snapshot storage metadata"
+        );
+      } finally {
+        await waitpoints.quit();
+      }
+    }
+  );
+
+  containerTest(
+    "mirrored primary repair discovers shared MemoryDB completion links despite a frozen reader and empty order",
+    async ({ prisma, redisOptions, postgresContainer }) => {
+      await prisma.$executeRawUnsafe(
+        `ALTER TABLE "_completedWaitpoints" DROP CONSTRAINT IF EXISTS "_completedWaitpoints_B_fkey"`
+      );
+      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const snapshots = new RedisSnapshotStore({ redisOptions, completedTtlMs: 60_000 });
+      const waitpoints = new WaitpointStoreCoordinator({ redisOptions });
+      const readClient = new PrismaClient({
+        datasources: { db: { url: postgresContainer.getConnectionUri() } },
+      });
+      try {
+        const env = await seedEnv(prisma, "mirror-shared-repair");
+        const parent = generateInternalId();
+        const child = generateInternalId();
+        const birth = generateInternalId();
+        const resumed = generateInternalId();
+        const sharedId = generateWaitpointId("RUN");
+        await delegate.createRun(createRunInput(child, env));
+        await prisma.taskRun.update({
+          where: { id: child },
+          data: { output: '{"child":"shared"}' },
+        });
+        await waitpoints.createIfAbsent({
+          status: "PENDING",
+          record: {
+            id: sharedId,
+            friendlyId: `waitpoint_${sharedId}`,
+            type: "RUN",
+            completedByTaskRunId: child,
+            environmentId: env.environment.id,
+            projectId: env.project.id,
+            userProvidedIdempotencyKey: false,
+            tags: [],
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+          },
+        });
+        await waitpoints.complete({
+          waitpointId: sharedId,
+          completion: {
+            completedAt: new Date().toISOString(),
+            output: null,
+            outputType: "application/json",
+            outputIsError: false,
+          },
+        });
+        const writer = new TaskRunExecutionSnapshotStore(delegate, {
+          store: snapshots,
+          mode: "dual-write",
+          logicalRunStoreRoute: ROUTE,
+        });
+        await writer.createRun({
+          data: createRunInput(parent, env).data,
+          snapshot: { ...createRunInput(parent, env).snapshot, id: birth },
+        });
+        await readClient.$transaction(
+          async (frozenReader) => {
+            expect(
+              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: birth } })
+            ).not.toBeNull();
+            await writer.createExecutionSnapshot({
+              id: resumed,
+              createdAt: new Date(),
+              run: { id: parent, status: "EXECUTING", attemptNumber: 1 },
+              snapshot: { executionStatus: "EXECUTING", description: "Shared child completed" },
+              previousSnapshotId: birth,
+              environmentId: env.environment.id,
+              environmentType: env.environment.type,
+              projectId: env.project.id,
+              organizationId: env.organization.id,
+              completedWaitpoints: [{ id: sharedId }],
+            });
+            // This actual database reader has neither the repaired snapshot nor its completion links.
+            expect(
+              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: resumed } })
+            ).toBeNull();
+            const laggingLeaf = new PostgresRunStore({
+              prisma,
+              readOnlyPrisma: frozenReader as never,
+            });
+            const mirrorReader = new TaskRunExecutionSnapshotStore(laggingLeaf, {
+              store: snapshots,
+              mode: "redis-read",
+              logicalRunStoreRoute: ROUTE,
+              resolvePrimaryReadClient: () => prisma,
+            });
+            const routed = new RoutingRunStore({ new: delegate, legacy: mirrorReader });
+            const reader = createWaitpointResultRunStore(routed, {
+              store: waitpoints,
+              isEnabled: () => true,
+              primaryReadClient: prisma,
+            });
+            const snapshot = await getLatestExecutionSnapshot(
+              markReadReplicaClient(frozenReader),
+              parent,
+              reader
+            );
+            expect(snapshot.id).toBe(resumed);
+            expect(snapshot.completedWaitpointOrder).toEqual([]);
+            expect(snapshot.completedWaitpoints).toMatchObject([
+              { id: sharedId, output: '{"child":"shared"}', completedByTaskRun: { id: child } },
+            ]);
+            expect(
+              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: resumed } })
+            ).toBeNull();
+            expect(await prisma.waitpoint.count({ where: { id: sharedId } })).toBe(0);
+          },
+          { isolationLevel: "RepeatableRead", timeout: 15_000 }
+        );
+      } finally {
+        await readClient.$disconnect();
+        await waitpoints.quit();
+        await snapshots.quit();
+      }
+    }
+  );
+
   containerTest(
     "a RUN waitpoint keeps completedByTaskRun id + friendlyId, with the child's output",
     async ({ prisma, redisOptions }) => {
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts b/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
new file mode 100644
index 00000000000..be8fa3bd944
--- /dev/null
+++ b/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
@@ -0,0 +1,52 @@
+import {
+  CompletedWaitpointHydratingRunStore,
+  type ReadClient,
+  type RunStore,
+} from "@internal/run-store";
+import type { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
+import {
+  resolveCompletedWaitpointRecords,
+  UnresolvableCompletedWaitpointRecordsError,
+} from "./completedWaitpointRecordAdapter.js";
+import { createCompletedWaitpointResolver } from "./completedWaitpointResolver.js";
+
+/** Independent of TRES enrollment: an older parent can reuse a newer shared RUN child. */
+export function createWaitpointResultRunStore(
+  delegate: RunStore,
+  options: {
+    store: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
+    primaryReadClient?: ReadClient;
+    isEnabled: (organizationId: string) => boolean | Promise<boolean>;
+  }
+): RunStore {
+  if (delegate instanceof CompletedWaitpointHydratingRunStore) return delegate;
+  const expand = createCompletedWaitpointResolver(delegate, options.primaryReadClient, true);
+  return new CompletedWaitpointHydratingRunStore(delegate, {
+    primaryReadClient: options.primaryReadClient,
+    isEnabled: options.isEnabled,
+    resolve: async (ids, context) => {
+      const records = await resolveCompletedWaitpointRecords({
+        requestedIds: ids,
+        legacyReader: async () => [],
+        storeReader: async (requested) => {
+          const entries = await options.store.readCompletedRecords(requested);
+          for (const [id, entry] of entries) {
+            if (entry.record.environmentId !== context.environmentId) {
+              throw new UnresolvableCompletedWaitpointRecordsError(
+                `Waitpoint ${id} belongs to another environment`,
+                id
+              );
+            }
+          }
+          return entries;
+        },
+      });
+      return expand({
+        runId: context.runId,
+        order: [],
+        records,
+        pointer: { cycleSeq: 0, count: records.length },
+      });
+    },
+  });
+}
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts b/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
index 41174a8e2a2..e2abaa26ce0 100644
--- a/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
@@ -1,13 +1,21 @@
-import { assertNonNullable, containerTest, heteroPostgresTest } from "@internal/testcontainers";
+import {
+  assertNonNullable,
+  containerTest,
+  containerTestWithIsolatedRedis,
+  heteroPostgresTest,
+} from "@internal/testcontainers";
 import { trace } from "@internal/tracing";
 import { PostgresRunStore, RoutingRunStore } from "@internal/run-store";
-import { BatchId } from "@trigger.dev/core/v3/isomorphic";
+import { BatchId, generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
 import type { Prisma, PrismaClient } from "@trigger.dev/database";
 import { describe, expect } from "vitest";
 import { setTimeout } from "node:timers/promises";
 import { RunEngine } from "../index.js";
 import { UnclassifiableWaitpointId } from "../errors.js";
 import { setupAuthenticatedEnvironment, setupBackgroundWorker } from "../tests/setup.js";
+import { WaitpointSystem } from "./waitpointSystem.js";
+import { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
+import { buildCompletedWaitpointRecords } from "./completedWaitpointResolver.js";
 
 vi.setConfig({ testTimeout: 60_000 });
 
@@ -176,6 +184,67 @@ async function triggerExecutingRun(
 }
 
 describe("WaitpointSystem create/block write routing", () => {
+  containerTestWithIsolatedRedis(
+    "resume classifies store IDs only for an enabled organization with a wired reader",
+    async ({ prisma, redisOptions }) => {
+      const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
+      const engine = buildEngine(prisma, redisOptions);
+      const waitpointStore = new WaitpointStoreCoordinator({ redisOptions });
+      try {
+        // A store-shaped row in Postgres makes the legacy path observable. It is intentionally
+        // pending: disabled reads must retain both the original query and its result mapping.
+        const id = generateWaitpointId("DATETIME");
+        const row = await prisma.waitpoint.create({
+          data: {
+            id,
+            friendlyId: `waitpoint_${id}`,
+            type: "DATETIME",
+            status: "PENDING",
+            completedAt: new Date("2026-01-01T00:00:00.000Z"),
+            idempotencyKey: id,
+            userProvidedIdempotencyKey: false,
+            projectId: env.projectId,
+            environmentId: env.id,
+          },
+        });
+        const blockers = [{ waitpoint: { id } }];
+        const checkedOrganizations: string[] = [];
+        const isEnabled = (organizationId: string) => {
+          checkedOrganizations.push(organizationId);
+          return organizationId === env.organizationId;
+        };
+        const unwired = new WaitpointSystem({
+          ...engine.waitpointSystem["options"],
+          waitpointStoreEnabled: isEnabled,
+        });
+        const wired = new WaitpointSystem({
+          ...engine.waitpointSystem["options"],
+          waitpointStore,
+          waitpointStoreEnabled: isEnabled,
+        });
+        const legacy = buildCompletedWaitpointRecords([row]);
+        expect(
+          await unwired["resolveResumeCompletedWaitpointRecords"](
+            "parent",
+            blockers,
+            env.organizationId
+          )
+        ).toEqual(legacy);
+        expect(checkedOrganizations).toEqual([]);
+        expect(
+          await wired["resolveResumeCompletedWaitpointRecords"]("parent", blockers, "disabled-org")
+        ).toEqual(legacy);
+        await expect(
+          wired["resolveResumeCompletedWaitpointRecords"]("parent", blockers, env.organizationId)
+        ).rejects.toThrow(`No store waitpoint record for ${id}`);
+        expect(checkedOrganizations).toEqual(["disabled-org", env.organizationId]);
+      } finally {
+        await waitpointStore.quit();
+        await engine.quit();
+      }
+    }
+  );
+
   // DATETIME create routes the (env, idempotencyKey) upsert through the store.
   containerTest("DATETIME create routes through the store", async ({ prisma, redisOptions }) => {
     const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts b/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
index 6b7f7af37a2..1c4eb49636f 100644
--- a/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
+++ b/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
@@ -11,9 +11,11 @@ import type {
 import { assertNever } from "assert-never";
 import { WaitpointCompletionGuardArmedError } from "../errors.js";
 import { buildCompletedWaitpointRecords } from "./completedWaitpointResolver.js";
+import { resolveCompletedWaitpointRecords } from "./completedWaitpointRecordAdapter.js";
 import { sendNotificationToWorker } from "../eventBus.js";
 import { isFinalRunStatus } from "../statuses.js";
 import { LegacyPostgresWaitpointCoordinator } from "../waitpointCoordinator/legacyPostgresCoordinator.js";
+import type { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
 import type { RunBlockEdge, WaitpointCoordinator } from "../waitpointCoordinator/types.js";
 import type { EnqueueSystem } from "./enqueueSystem.js";
 import type { ExecutionSnapshotSystem } from "./executionSnapshotSystem.js";
@@ -25,11 +27,21 @@ import type { SystemResources } from "./systems.js";
 import { snapshotRouteFromSnapshot, type CompletedWaitpointRecord } from "@internal/run-store";
 
 export type WaitpointSystemOptions = {
+  waitpointStoreEnabled?: (
+    organizationId: string,
+    organizationFlags?: unknown
+  ) => boolean | Promise<boolean>;
   resources: SystemResources;
   executionSnapshotSystem: ExecutionSnapshotSystem;
   enqueueSystem: EnqueueSystem;
   /** Grace before an unacked completion guard fires. Short in tests. Defaults to 30s. */
   completionGuardDelayMs?: number;
+  /**
+   * The MemoryDB coordinator, for resolving store-format completed-waitpoint records in a
+   * Redis-primary resume cycle. Optional: undefined leaves the resolver Postgres-only, which is the
+   * only reachable state until store-format minting is wired. Only the record read is used here.
+   */
+  waitpointStore?: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
 };
 
 const DEFAULT_COMPLETION_GUARD_DELAY_MS = 30_000;
@@ -56,11 +68,13 @@ export class WaitpointSystem {
   private readonly enqueueSystem: EnqueueSystem;
   private readonly coordinator: WaitpointCoordinator;
   private readonly completionGuardDelayMs: number;
+  readonly #waitpointStore?: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
 
   constructor(private readonly options: WaitpointSystemOptions) {
     this.$ = options.resources;
     this.executionSnapshotSystem = options.executionSnapshotSystem;
     this.enqueueSystem = options.enqueueSystem;
+    this.#waitpointStore = options.waitpointStore;
     this.completionGuardDelayMs =
       options.completionGuardDelayMs ?? DEFAULT_COMPLETION_GUARD_DELAY_MS;
     this.coordinator = new LegacyPostgresWaitpointCoordinator({
@@ -910,26 +924,67 @@ export class WaitpointSystem {
       blockingWaitpoints.length > 0 &&
       snapshotRouteFromSnapshot(snapshot).residency === "redis-primary"
     ) {
-      const records = await this.#buildCompletedWaitpointRecords(runId, blockingWaitpoints);
+      const records = await this.resolveResumeCompletedWaitpointRecords(
+        runId,
+        blockingWaitpoints,
+        snapshot.organizationId
+      );
       return async () => records;
     }
-    return () => this.#buildCompletedWaitpointRecords(runId, blockingWaitpoints);
+    return () =>
+      this.resolveResumeCompletedWaitpointRecords(
+        runId,
+        blockingWaitpoints,
+        snapshot.organizationId
+      );
   }
 
   // The blocking edges carry only a 4-field waitpoint pick, but a redis-primary snapshot needs the FULL
-  // rows to reproduce the Postgres join. Passed to the snapshot store as a resolver thunk so this fetch
-  // runs ONLY when a redis-primary cycle actually needs it, never on a postgres-resident resume. Routed
-  // by runId with per-id shard fallback so a cross-shard token still resolves.
-  async #buildCompletedWaitpointRecords(
+  // records to reproduce the Postgres join. Passed to the snapshot store as a resolver thunk so this
+  // fetch runs ONLY when a redis-primary cycle actually needs it, never on a postgres-resident or
+  // mirrored resume.
+  //
+  // Each blocker id is routed by its SHAPE: a legacy id resolves through Postgres (routed by runId with
+  // per-id shard fallback so a cross-shard token still resolves, and filtered to COMPLETED so a stray
+  // PENDING row can never be described as a completion), a store-format id through MemoryDB. The
+  // adapter combines both into exactly one record per distinct id and fails loud rather than returning
+  // a partial set.
+  //
+  // TS-private rather than #private so a test can drive this exact reader wiring on a real
+  // WaitpointSystem; it is not part of the class's used-by-callers surface.
+  private async resolveResumeCompletedWaitpointRecords(
     runId: string,
-    blockingWaitpoints: { waitpoint: { id: string } }[]
+    blockingWaitpoints: { waitpoint: { id: string } }[],
+    organizationId?: string
   ) {
-    const rows = await this.$.runStore.findManyWaitpoints(
-      { where: { id: { in: boundedIn(blockingWaitpoints.map((b) => b.waitpoint.id)) } } },
-      this.$.prisma,
-      runId
-    );
-    return buildCompletedWaitpointRecords(rows);
+    // Unwired readers retain the original path without a flag lookup. Disabled organizations
+    // retain it without classifying IDs; only the enabled adapter below interprets store identities.
+    const organizationEnabled =
+      this.#waitpointStore !== undefined &&
+      organizationId !== undefined &&
+      (await this.options.waitpointStoreEnabled?.(organizationId)) === true;
+    if (!organizationEnabled) {
+      const rows = await this.$.runStore.findManyWaitpoints(
+        { where: { id: { in: boundedIn(blockingWaitpoints.map((b) => b.waitpoint.id)) } } },
+        this.$.prisma,
+        runId
+      );
+      return buildCompletedWaitpointRecords(rows);
+    }
+    return resolveCompletedWaitpointRecords({
+      requestedIds: blockingWaitpoints.map((b) => b.waitpoint.id),
+      legacyReader: async (ids) =>
+        buildCompletedWaitpointRecords(
+          await this.$.runStore.findManyWaitpoints(
+            { where: { id: { in: boundedIn(ids) }, status: "COMPLETED" } },
+            this.$.prisma,
+            runId
+          )
+        ),
+      storeReader: this.#waitpointStore
+        ? (ids) => this.#waitpointStore!.readCompletedRecords(ids)
+        : undefined,
+    });
   }
 
   public buildRunAssociatedWaitpoint({
diff --git a/internal-packages/run-engine/src/engine/types.ts b/internal-packages/run-engine/src/engine/types.ts
index 508a71bf715..68af8776cde 100644
--- a/internal-packages/run-engine/src/engine/types.ts
+++ b/internal-packages/run-engine/src/engine/types.ts
@@ -76,6 +76,11 @@ export type CrossSeamGuardHook = (input: {
 }) => Promise<CrossSeamGuardDecision>;
 
 export type RunEngineOptions = {
+  /** Independent of snapshot residency. Omitted means the existing Postgres waitpoint behavior. */
+  waitpointStoreEnabled?: (
+    organizationId: string,
+    organizationFlags?: unknown
+  ) => boolean | Promise<boolean>;
   prisma: PrismaClient;
   readOnlyPrisma?: PrismaReplicaClient;
   /** Optional RunStore implementation to inject. Defaults to a PostgresRunStore
diff --git a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
new file mode 100644
index 00000000000..5dd8b7a09ec
--- /dev/null
+++ b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
@@ -0,0 +1,136 @@
+// readCompletedRecords is the store half of the completed-waitpoint resolver. Proven against a REAL
+// Redis (redisTest FLUSHALLs per test): a completed record comes back with its frozen record blob and
+// completion envelope, an absent id is simply missing from the map (never an error), and a PENDING
+// record reports PENDING so the resolver can reject it.
+import { redisTest } from "@internal/testcontainers";
+import { type RedisOptions } from "@internal/redis";
+import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
+import { describe, expect } from "vitest";
+import {
+  WaitpointStoreCoordinator,
+  type WaitpointCompletion,
+  type WaitpointRecordInput,
+} from "./storeCoordinator.js";
+
+const ENV_ID = "env_1";
+const PROJECT_ID = "proj_1";
+const NOW = "2026-08-21T12:00:00.000Z";
+
+function coordinator(redisOptions: RedisOptions) {
+  return new WaitpointStoreCoordinator({ redisOptions });
+}
+
+function record(id: string, overrides: Partial<WaitpointRecordInput> = {}): WaitpointRecordInput {
+  return {
+    id,
+    friendlyId: `waitpoint_${id}`,
+    type: "MANUAL",
+    environmentId: ENV_ID,
+    projectId: PROJECT_ID,
+    createdAt: NOW,
+    updatedAt: NOW,
+    userProvidedIdempotencyKey: false,
+    tags: [],
+    ...overrides,
+  };
+}
+
+function completion(overrides: Partial<WaitpointCompletion> = {}): WaitpointCompletion {
+  return {
+    completedAt: "2026-08-21T12:34:56.000Z",
+    outputType: "application/json",
+    outputIsError: false,
+    output: { inline: '{"value":42}' },
+    ...overrides,
+  };
+}
+
+describe("WaitpointStoreCoordinator.readCompletedRecords", () => {
+  redisTest(
+    "returns the frozen record and completion for a completed waitpoint",
+    async ({ redisOptions }) => {
+      const store = coordinator(redisOptions);
+      try {
+        const id = generateWaitpointId("RUN");
+        const rec = record(id, { type: "RUN", completedByTaskRunId: "run_child" });
+        await store.createIfAbsent({ record: rec, status: "PENDING" });
+        await store.complete({ waitpointId: id, completion: completion() });
+
+        const out = await store.readCompletedRecords([id]);
+
+        expect(out.size).toBe(1);
+        const entry = out.get(id)!;
+        expect(entry.status).toBe("COMPLETED");
+        expect(entry.record).toEqual(rec);
+        expect(entry.completion).toEqual(completion());
+      } finally {
+        await store.quit();
+      }
+    }
+  );
+
+  redisTest("omits an absent id rather than erroring", async ({ redisOptions }) => {
+    const store = coordinator(redisOptions);
+    try {
+      const present = generateWaitpointId("MANUAL");
+      const absent = generateWaitpointId("MANUAL");
+      await store.createIfAbsent({ record: record(present), status: "PENDING" });
+      await store.complete({ waitpointId: present, completion: completion() });
+
+      const out = await store.readCompletedRecords([present, absent]);
+
+      // Absence is reported as omission, not a throw: the resolver decides it is an integrity error.
+      expect(out.has(present)).toBe(true);
+      expect(out.has(absent)).toBe(false);
+    } finally {
+      await store.quit();
+    }
+  });
+
+  redisTest("reports a still-PENDING record as PENDING", async ({ redisOptions }) => {
+    const store = coordinator(redisOptions);
+    try {
+      const id = generateWaitpointId("MANUAL");
+      await store.createIfAbsent({ record: record(id), status: "PENDING" });
+
+      const out = await store.readCompletedRecords([id]);
+
+      const entry = out.get(id)!;
+      expect(entry.status).toBe("PENDING");
+      expect(entry.completion).toBeUndefined();
+    } finally {
+      await store.quit();
+    }
+  });
+
+  redisTest("reads each distinct id once for a repeated id list", async ({ redisOptions }) => {
+    const store = coordinator(redisOptions);
+    try {
+      const id = generateWaitpointId("BATCH");
+      await store.createIfAbsent({ record: record(id, { type: "BATCH" }), status: "PENDING" });
+      await store.complete({ waitpointId: id, completion: completion() });
+
+      const out = await store.readCompletedRecords([id, id, id]);
+
+      expect(out.size).toBe(1);
+      expect(out.get(id)!.status).toBe("COMPLETED");
+    } finally {
+      await store.quit();
+    }
+  });
+
+  redisTest(
+    "surfaces a Redis failure as a throw, never as an absent record",
+    async ({ redisOptions }) => {
+      // A quit()ted client makes the HMGET reject: the failure must PROPAGATE, so the resolver can retry,
+      // and never be seen as the record simply being absent.
+      const store = coordinator(redisOptions);
+      const id = generateWaitpointId("MANUAL");
+      await store.createIfAbsent({ record: record(id), status: "PENDING" });
+      await store.complete({ waitpointId: id, completion: completion() });
+      await store.quit();
+
+      await expect(store.readCompletedRecords([id])).rejects.toBeInstanceOf(Error);
+    }
+  );
+});
diff --git a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
index 564750ed9fc..153c72e1c32 100644
--- a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
+++ b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
@@ -152,6 +152,11 @@ const ENVELOPE_LIMITS = {
 // caller-supplied value could throw inside pMap after the new block was installed.
 const SUPERSEDED_CLEANUP_CONCURRENCY = 10;
 
+// Bounds the concurrent per-id record reads a resume resolution issues. A resume reads one record
+// per distinct store-resident blocker; this caps the fan-out so a wide wait cannot open an
+// unbounded burst of Redis commands at once.
+const RESOLVER_READ_CONCURRENCY = 20;
+
 /** Thrown before any hashing, serialization or Redis call when a completion is too large. */
 export class WaitpointCompletionTooLargeError extends Error {
   constructor(
@@ -292,6 +297,17 @@ export function encodeCompletionForDelivery(
   return EncodedWaitpointCompletion.encode(completion, context);
 }
 
+/**
+ * One store-resident waitpoint as {@link WaitpointStoreCoordinator.readCompletedRecords} returns it.
+ * The completion stays the coordinator's OWN opaque {@link WaitpointCompletion}; the resolver, not the
+ * store, maps it to the frozen TRES record shape.
+ */
+export type WaitpointStoredRecord = {
+  status: WaitpointStatus;
+  record: WaitpointRecordInput;
+  completion?: WaitpointCompletion;
+};
+
 export type WatcherEntry = {
   runId: string;
   /**
@@ -1874,6 +1890,46 @@ export class WaitpointStoreCoordinator {
     };
   }
 
+  /**
+   * Read the frozen record + completion for a set of store-resident waitpoints, for the
+   * completed-waitpoint resolver.
+   *
+   * One `HMGET` per id, run concurrently: each waitpoint's keys carry the id as their own hash
+   * tag, so a pipeline or `MGET` would span cluster slots and be rejected under cluster mode.
+   *
+   * Returns ONLY the ids that are present. Absence is distinct from failure and is the caller's to
+   * fail loud on: a recognised store id missing from the store is an integrity error, never a
+   * signal to fall back to Postgres. A Redis error THROWS out of the `HMGET` and is never seen here
+   * as an absent record, so an availability failure can never be mistaken for a missing waitpoint.
+   */
+  async readCompletedRecords(ids: string[]): Promise<Map<string, WaitpointStoredRecord>> {
+    const out = new Map<string, WaitpointStoredRecord>();
+    const distinct = [...new Set(ids)];
+    await pMap(
+      distinct,
+      async (id) => {
+        const keys = waitpointKeys(id);
+        const [r, status, c] = await this.redis.hmget(keys.record, "r", "status", "c");
+        // No 'r' means no record hash under this id at all — absent, not an error.
+        if (r == null) {
+          return;
+        }
+        const record = parseJson<WaitpointRecordInput>(r);
+        if (!record) {
+          throw new Error(`Waitpoint ${id} is present in the store with no record blob`);
+        }
+        out.set(id, {
+          status: status === "COMPLETED" ? "COMPLETED" : "PENDING",
+          record,
+          completion: parseJson<WaitpointCompletion>(c ?? undefined),
+        });
+      },
+      { concurrency: RESOLVER_READ_CONCURRENCY }
+    );
+
+    return out;
+  }
+
   #fanoutIndex(
     waitpointId: string,
     op: "add" | "add-nx" | "reschedule" | "repair" | "remove" | "quarantine",
diff --git a/internal-packages/run-engine/src/index.ts b/internal-packages/run-engine/src/index.ts
index 7c4900c9d8b..187cef1c429 100644
--- a/internal-packages/run-engine/src/index.ts
+++ b/internal-packages/run-engine/src/index.ts
@@ -114,6 +114,11 @@ export {
   FANOUT_PARTITION_COUNT,
   WaitpointKeyTagError,
 } from "./engine/waitpointCoordinator/keys.js";
-export { createCompletedWaitpointResolver } from "./engine/systems/completedWaitpointResolver.js";
+export {
+  createCompletedWaitpointResolver,
+  createStoreRunCompletedWaitpointResolver,
+} from "./engine/systems/completedWaitpointResolver.js";
 export { enhanceExecutionSnapshotWithWaitpoints } from "./engine/systems/executionSnapshotSystem.js";
 export { parseGates, type ParsedGate } from "./engine/gateParsing.js";
+
+export { createWaitpointResultRunStore } from "./engine/systems/waitpointResultRunStore.js";
diff --git a/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts b/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
new file mode 100644
index 00000000000..e401bc12203
--- /dev/null
+++ b/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
@@ -0,0 +1,97 @@
+import type { Prisma } from "@trigger.dev/database";
+import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
+import { DelegatingRunStore } from "./delegatingRunStore.js";
+import type {
+  LatestExecutionSnapshotRead,
+  ReadClient,
+  RunStore,
+  SnapshotReadWaitpoint,
+} from "./types.js";
+import { snapshotRouteFromSnapshot, type SnapshotReadContext } from "./snapshotResidency.js";
+
+export type WaitpointResultReadContext = {
+  runId: string;
+  organizationId: string;
+  environmentId: string;
+};
+
+/** Completes Postgres snapshot joins without changing either record's authoritative store. */
+export class CompletedWaitpointHydratingRunStore extends DelegatingRunStore {
+  constructor(
+    delegate: RunStore,
+    private readonly options: {
+      /** Writer signal for routed delegates, which resolve their own primary by run id. */
+      primaryReadClient?: ReadClient;
+      isEnabled: (organizationId: string) => boolean | Promise<boolean>;
+      resolve: (
+        ids: string[],
+        context: WaitpointResultReadContext
+      ) => Promise<SnapshotReadWaitpoint[]>;
+    }
+  ) {
+    super(delegate);
+  }
+
+  async #hydrate(snapshot: LatestExecutionSnapshotRead): Promise<void> {
+    // Disabled reads skip residency parsing as well as all hydration queries and processing.
+    if (!(await this.options.isEnabled(snapshot.organizationId))) return;
+    const route = snapshotRouteFromSnapshot(snapshot);
+    // MemoryDB-primary reads already resolve their complete authoritative cycle.
+    if (route.residency === "redis-primary") return;
+    const present = new Set(snapshot.completedWaitpoints.map((w) => w.id));
+    const ids = await this.delegate.findSnapshotCompletedWaitpointIds(
+      snapshot.id,
+      // A mirrored read may have repaired the row from primary after a replica miss.
+      // Discover links on the owning primary too, so an older reader cannot erase its results.
+      this.options.primaryReadClient ?? this.delegate.primaryReadClient,
+      snapshot.runId,
+      route
+    );
+    const missing = [...new Set(ids)].filter(
+      (id) => !present.has(id) && parseWaitpointId(id).format !== "legacy"
+    );
+    if (missing.length === 0) return;
+    const recovered = await this.options.resolve(missing, {
+      runId: snapshot.runId,
+      organizationId: snapshot.organizationId,
+      environmentId: snapshot.environmentId,
+    });
+    const byId = new Map(recovered.map((w) => [w.id, w]));
+    if (byId.size !== missing.length || missing.some((id) => !byId.has(id))) {
+      throw new Error(`Incomplete shared waitpoint results for snapshot ${snapshot.id}`);
+    }
+    snapshot.completedWaitpoints = [
+      ...snapshot.completedWaitpoints,
+      ...missing.map((id) => byId.get(id)!),
+    ];
+  }
+
+  override async findLatestExecutionSnapshot(
+    runId: string,
+    client?: ReadClient,
+    environmentId?: string,
+    organizationId?: SnapshotReadContext
+  ): Promise<LatestExecutionSnapshotRead | null> {
+    const snapshot = await this.delegate.findLatestExecutionSnapshot(
+      runId,
+      client,
+      environmentId,
+      organizationId
+    );
+    if (snapshot) await this.#hydrate(snapshot);
+    return snapshot;
+  }
+
+  override async findExecutionSnapshot<T extends Prisma.TaskRunExecutionSnapshotFindFirstArgs>(
+    args: Prisma.SelectSubset<T, Prisma.TaskRunExecutionSnapshotFindFirstArgs>,
+    client?: ReadClient,
+    organizationId?: SnapshotReadContext
+  ): Promise<Prisma.TaskRunExecutionSnapshotGetPayload<T> | null> {
+    const snapshot = await this.delegate.findExecutionSnapshot(args, client, organizationId);
+    // Full include preserves the snapshot's own tenant context; scalar/select queries pass through.
+    if (snapshot && args.include?.completedWaitpoints === true && !args.select) {
+      await this.#hydrate(snapshot as unknown as LatestExecutionSnapshotRead);
+    }
+    return snapshot;
+  }
+}
diff --git a/internal-packages/run-store/src/index.ts b/internal-packages/run-store/src/index.ts
index 85459d85767..69e7f6a63ac 100644
--- a/internal-packages/run-store/src/index.ts
+++ b/internal-packages/run-store/src/index.ts
@@ -12,3 +12,4 @@ export * from "./snapshotEntry.js";
 export * from "./snapshotResidency.js";
 export * from "./snapshotResidencyResolver.js";
 export * from "./taskRunExecutionSnapshotStore.js";
+export * from "./completedWaitpointHydratingRunStore.js";
diff --git a/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts b/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
index 0c9fa475e84..ebc37b0b68b 100644
--- a/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
+++ b/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
@@ -2,7 +2,7 @@ import { containerTest, redisTest } from "@internal/testcontainers";
 import { createRedisClient } from "@internal/redis";
 import { setTimeout as sleep } from "node:timers/promises";
 import { Registry } from "prom-client";
-import { describe, expect } from "vitest";
+import { describe, expect, vi } from "vitest";
 import { PendingIndex } from "./pendingIndex.js";
 import {
   PendingRecoveryWorker,
@@ -10,6 +10,7 @@ import {
   type PostgresCommitStatus,
 } from "./pendingRecoveryWorker.js";
 import { RedisSnapshotStore, type SnapshotEntryInput } from "./redisSnapshotStore.js";
+import { runToPartition } from "./snapshotKeys.js";
 import { recoveryMetrics } from "./testFixtures/promMetrics.js";
 
 // The single-fleet recovery lease, proven on real Redis: exactly one owner holds it, takeover happens
@@ -187,6 +188,11 @@ describe("RecoverySweeper pending gauges and the recovery lease", () => {
         });
         expect(prepared.outcome).toBe("prepared");
 
+        const { oldestMs } = await index.summary(runToPartition(runId));
+        expect(oldestMs).toBeTypeOf("number");
+        vi.useFakeTimers({ toFake: ["Date"] });
+        vi.setSystemTime(oldestMs! + 1_000);
+
         const worker = new PendingRecoveryWorker({
           store,
           pendingIndex: index,
@@ -259,6 +265,7 @@ describe("RecoverySweeper pending gauges and the recovery lease", () => {
         // The unit itself is still pending: only A's view of it was withdrawn.
         expect(await store.hasPreparedUnit(runId)).toBe(true);
       } finally {
+        vi.useRealTimers();
         releaseTx();
         await held;
         await raw.quit();
diff --git a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
new file mode 100644
index 00000000000..20f6fb831c2
--- /dev/null
+++ b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
@@ -0,0 +1,123 @@
+// Laziness of the completed-waitpoint resolver thunk: it must be invoked ONLY when a fresh
+// redis-primary cycle is being built. A postgres transition returns before the cycle seam, and a
+// mirrored transition builds no fresh cycle, so neither may call the thunk — that is what keeps the
+// MemoryDB record read (and any Postgres widening it does) off every ordinary transition. Proven end
+// to end against real Postgres + real Redis, driving the production decorator at each residency.
+import { describe, expect } from "vitest";
+import { containerTest } from "@internal/testcontainers";
+import { generateInternalId } from "@trigger.dev/core/v3/isomorphic";
+import { PostgresRunStore } from "./PostgresRunStore.js";
+import { RedisSnapshotStore } from "./redisSnapshotStore.js";
+import {
+  TaskRunExecutionSnapshotStore,
+  type SnapshotStoreDial,
+} from "./taskRunExecutionSnapshotStore.js";
+import { SnapshotResidencyResolver } from "./snapshotResidencyResolver.js";
+import { buildCompletedWaitpointRecords } from "../../run-engine/src/engine/systems/completedWaitpointResolver.js";
+import { buildCreateRunData, seedSnapshotEnvironment } from "./testFixtures/snapshotIdFixture.js";
+
+const ROUTE = "logical:1";
+
+function birthSnapshot(env: Awaited<ReturnType<typeof seedSnapshotEnvironment>>, id: string) {
+  return {
+    id,
+    createdAt: new Date(),
+    engine: "V2" as const,
+    executionStatus: "RUN_CREATED" as const,
+    description: "Run was created",
+    runStatus: "PENDING" as const,
+    environmentId: env.id,
+    environmentType: env.type,
+    projectId: env.projectId,
+    organizationId: env.organizationId,
+  };
+}
+
+function realResolver(store: RedisSnapshotStore) {
+  return new SnapshotResidencyResolver({
+    store,
+  });
+}
+
+describe("completed-waitpoint resolver laziness", () => {
+  containerTest(
+    "the resolver thunk is called only for a fresh redis-primary cycle, never for postgres or mirrored",
+    async ({ prisma, redisOptions }) => {
+      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const store = new RedisSnapshotStore({ redisOptions, completedTtlMs: 60_000 });
+
+      try {
+        // A birth at each residency: off => inert postgres, dual-write => mirrored, redis-only =>
+        // redis-primary. The number is the expected resolver invocations on the following transition.
+        const cases: Array<{ dial: SnapshotStoreDial; expected: number }> = [
+          { dial: "off", expected: 0 },
+          { dial: "dual-write", expected: 0 },
+          { dial: "redis-only", expected: 1 },
+        ];
+
+        for (const c of cases) {
+          const env = await seedSnapshotEnvironment(prisma);
+          const runId = generateInternalId();
+          const birthId = generateInternalId();
+          const transitionId = generateInternalId();
+
+          const writer = new TaskRunExecutionSnapshotStore(delegate, {
+            store,
+            mode: c.dial === "redis-only" ? "redis-only" : "dual-write",
+            resolveDial: () => c.dial,
+            residencyResolver: realResolver(store),
+            logicalRunStoreRoute: ROUTE,
+          });
+
+          await writer.createRun({
+            data: buildCreateRunData(runId, env),
+            snapshot: birthSnapshot(env, birthId),
+          });
+
+          // A real completed Waitpoint row: the postgres and mirrored transitions connect it in the
+          // Postgres join (FK-constrained), so it must exist for those legs to reach the cycle seam.
+          const waitpointId = generateInternalId();
+          await prisma.waitpoint.create({
+            data: {
+              id: waitpointId,
+              friendlyId: `waitpoint_${waitpointId}`,
+              type: "MANUAL",
+              status: "COMPLETED",
+              completedAt: new Date("2026-08-21T12:00:00.000Z"),
+              idempotencyKey: `idem_${waitpointId}`,
+              userProvidedIdempotencyKey: false,
+              projectId: env.projectId,
+              environmentId: env.id,
+            },
+          });
+          let resolverCalls = 0;
+
+          await writer.createExecutionSnapshot({
+            id: transitionId,
+            createdAt: new Date(),
+            run: { id: runId, status: "EXECUTING" as const, attemptNumber: 1 },
+            snapshot: { executionStatus: "EXECUTING" as const, description: "resumed" },
+            previousSnapshotId: birthId,
+            environmentId: env.id,
+            environmentType: env.type,
+            projectId: env.projectId,
+            organizationId: env.organizationId,
+            completedWaitpoints: [{ id: waitpointId }],
+            resolveCompletedWaitpointRecords: async () => {
+              resolverCalls++;
+              return buildCompletedWaitpointRecords(
+                await delegate.findManyWaitpoints({
+                  where: { id: waitpointId, status: "COMPLETED" },
+                })
+              );
+            },
+          });
+
+          expect(resolverCalls, `dial=${c.dial}`).toBe(c.expected);
+        }
+      } finally {
+        await store.quit();
+      }
+    }
+  );
+});
diff --git a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
index a11c8ed817b..4bc8b724058 100644
--- a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
+++ b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
@@ -272,6 +272,11 @@ export type TaskRunExecutionSnapshotStoreOptions = {
    * read whose head carries completed waitpoints.
    */
   resolveCompletedWaitpoints?: CompletedWaitpointResolver;
+  /** Optional application hook with the trusted owner from the already-read snapshot entry. */
+  resolveCompletedWaitpointsWithContext?: (
+    args: Parameters<CompletedWaitpointResolver>[0],
+    context: { organizationId: string }
+  ) => ReturnType<CompletedWaitpointResolver>;
   /**
    * The primary-read repair seam. When MemoryDB names the authoritative mirrored head id but hydrating
    * THAT exact row from the caller's read client returns null (a lagging read replica), the row is
@@ -719,6 +724,7 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
   readonly #newToken: () => string;
   readonly #resolvePending: TaskRunExecutionSnapshotStoreOptions["resolvePending"];
   readonly #resolveCompletedWaitpoints?: CompletedWaitpointResolver;
+  readonly #resolveCompletedWaitpointsWithContext: TaskRunExecutionSnapshotStoreOptions["resolveCompletedWaitpointsWithContext"];
   readonly #resolvePrimaryReadClient?: (runId: string) => ReadClient | undefined;
   readonly #redisPrimaryBirthReady: () => boolean;
   readonly #metrics?: SnapshotDecoratorMetrics;
@@ -742,6 +748,7 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
     this.#newToken = options.generateTransitionToken ?? (() => generateInternalId());
     this.#resolvePending = options.resolvePending;
     this.#resolveCompletedWaitpoints = options.resolveCompletedWaitpoints;
+    this.#resolveCompletedWaitpointsWithContext = options.resolveCompletedWaitpointsWithContext;
     this.#resolvePrimaryReadClient = options.resolvePrimaryReadClient;
     this.#redisPrimaryBirthReady = options.redisPrimaryBirthReady ?? (() => true);
     this.#metrics = options.metrics;
@@ -1560,16 +1567,21 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
       if (cw.distinctIds.length > 0 && cw.records.length === 0) {
         throw new SnapshotReadUnavailableError(runId, "redis-primary cycle records missing");
       }
-      if (!this.#resolveCompletedWaitpoints) {
+      if (!this.#resolveCompletedWaitpoints && !this.#resolveCompletedWaitpointsWithContext) {
         throw new SnapshotReadUnavailableError(runId, "no completed-waitpoint resolver");
       }
-      completedWaitpoints = await this.#resolveCompletedWaitpoints({
+      const args = {
         runId,
         batchId: entry.batchId,
         pointer: head.cycle,
         order: cw.order,
         records: cw.records,
-      });
+      };
+      completedWaitpoints = this.#resolveCompletedWaitpointsWithContext
+        ? await this.#resolveCompletedWaitpointsWithContext(args, {
+            organizationId: entry.organizationId,
+          })
+        : await this.#resolveCompletedWaitpoints!(args);
       completedWaitpointOrder = cw.order;
     }
 
diff --git a/internal-packages/webhook-sources/catalog/providers.json b/internal-packages/webhook-sources/catalog/providers.json
index e3a0a5322a6..26030ff88f9 100644
--- a/internal-packages/webhook-sources/catalog/providers.json
+++ b/internal-packages/webhook-sources/catalog/providers.json
@@ -1119,6 +1119,27 @@
         "producer": true
       },
       "notes": ""
+    },
+    {
+      "id": "hookdeck",
+      "label": "Hookdeck",
+      "category": "hosting-infra",
+      "tier": "first-class",
+      "preset": null,
+      "signatureScheme": "hmac-sha256",
+      "aiRelevance": "medium",
+      "popularity": "medium",
+      "sampleSource": "handauthored",
+      "docsUrl": "https://hookdeck.com/docs/authentication",
+      "status": "complete",
+      "owner": "hookdeck-provider",
+      "checklist": {
+        "registryEntry": true,
+        "samples": true,
+        "roundTrip": true,
+        "producer": true
+      },
+      "notes": "relay: body is the upstream provider's payload; x-hookdeck-signature-2 carries the previous secret while a rotation is in progress"
     }
   ]
 }
diff --git a/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts b/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
new file mode 100644
index 00000000000..a5dd4f2dcbb
--- /dev/null
+++ b/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
@@ -0,0 +1,67 @@
+import { type SampleRecord } from "../sampleRecord.js";
+
+/**
+ * Hookdeck samples. Hookdeck forwards the original provider's body unchanged and adds its own
+ * headers, so each sample is an upstream payload plus informational `x-hookdeck-*` headers. The
+ * signature headers are added by the composer at send time. `x-hookdeck-eventid` is left out: it is
+ * the dedupe key, so a fixed value would fold every console send of a sample into one delivery.
+ */
+export const samples: SampleRecord[] = [
+  {
+    provider: "hookdeck",
+    providerLabel: "Hookdeck",
+    eventType: "payment_intent.succeeded",
+    name: "Stripe payment relayed",
+    description: "A Stripe `payment_intent.succeeded` event forwarded by a Hookdeck connection.",
+    body: {
+      id: "evt_3QhRb2LkdIwHu7ix0Wq1X9aB",
+      object: "event",
+      type: "payment_intent.succeeded",
+      created: 1792569600,
+      livemode: false,
+      data: {
+        object: {
+          id: "pi_3QhRb2LkdIwHu7ix0kT2mN4p",
+          object: "payment_intent",
+          amount: 4900,
+          currency: "usd",
+          customer: "cus_R8xQ2mLkd91Hu7",
+          status: "succeeded",
+        },
+      },
+    },
+    extraHeaders: {
+      "x-hookdeck-source-name": "stripe-production",
+      "x-hookdeck-attempt-count": "1",
+      "x-hookdeck-attempt-trigger": "INITIAL",
+    },
+    docsUrl: "https://hookdeck.com/docs/destinations",
+    provenance: { kind: "handauthored", snapshotDate: "2026-10" },
+  },
+  {
+    provider: "hookdeck",
+    providerLabel: "Hookdeck",
+    eventType: "order.created",
+    name: "Order created relayed",
+    description:
+      "A custom app's `order.created` event forwarded by a Hookdeck connection, on a manual retry.",
+    body: {
+      type: "order.created",
+      id: "ord_7Kp2Qw9Lm3",
+      created_at: "2026-10-21T09:00:00.000Z",
+      data: {
+        total: 129.5,
+        currency: "EUR",
+        customer: { id: "cust_48Fh2", email: "ada@example.com" },
+        items: [{ sku: "TEE-BLK-M", quantity: 2 }],
+      },
+    },
+    extraHeaders: {
+      "x-hookdeck-source-name": "shop-orders",
+      "x-hookdeck-attempt-count": "2",
+      "x-hookdeck-attempt-trigger": "MANUAL",
+    },
+    docsUrl: "https://hookdeck.com/docs/destinations",
+    provenance: { kind: "handauthored", snapshotDate: "2026-10" },
+  },
+];
diff --git a/internal-packages/webhook-sources/src/handAuthored/index.ts b/internal-packages/webhook-sources/src/handAuthored/index.ts
index 30c336ead6b..fd448088057 100644
--- a/internal-packages/webhook-sources/src/handAuthored/index.ts
+++ b/internal-packages/webhook-sources/src/handAuthored/index.ts
@@ -17,6 +17,7 @@ import { samples as s_elevenlabs } from "./elevenlabs.js";
 import { samples as s_firecrawl } from "./firecrawl.js";
 import { samples as s_gitlab } from "./gitlab.js";
 import { samples as s_granola } from "./granola.js";
+import { samples as s_hookdeck } from "./hookdeck.js";
 import { samples as s_infisical } from "./infisical.js";
 import { samples as s_intercom } from "./intercom.js";
 import { samples as s_jira } from "./jira.js";
@@ -70,6 +71,7 @@ export const handAuthoredSamples: SampleRecord[] = [
   ...s_firecrawl,
   ...s_gitlab,
   ...s_granola,
+  ...s_hookdeck,
   ...s_infisical,
   ...s_intercom,
   ...s_jira,
diff --git a/internal-packages/webhook-sources/src/providerSignatures.test.ts b/internal-packages/webhook-sources/src/providerSignatures.test.ts
index 932dfdee79e..50e95e9ee55 100644
--- a/internal-packages/webhook-sources/src/providerSignatures.test.ts
+++ b/internal-packages/webhook-sources/src/providerSignatures.test.ts
@@ -196,6 +196,30 @@ const fixtures: Fixture[] = [
     nowMs: NOW_MS,
     toleranceSeconds: 300,
   },
+  {
+    provider: "hookdeck",
+    source: "https://hookdeck.com/docs/authentication",
+    body: '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}',
+    secret: "hookdeck_fixture_secret",
+    headers: {
+      "x-hookdeck-signature": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
+      "x-hookdeck-eventid": "evt_hookdeck_fixture_delivery",
+    },
+    nowMs: NOW_MS,
+  },
+  {
+    provider: "hookdeck",
+    label: "hookdeck (secret rolled with a delay: old secret in x-hookdeck-signature-2)",
+    source: "https://hookdeck.com/docs/authentication",
+    body: '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}',
+    secret: "hookdeck_fixture_secret",
+    headers: {
+      "x-hookdeck-signature": "MRtBJRv3K6j8+CUcDsJuwYudgKi52qz9yfISiM3FKCw=",
+      "x-hookdeck-signature-2": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
+      "x-hookdeck-eventid": "evt_hookdeck_fixture_delivery",
+    },
+    nowMs: NOW_MS,
+  },
   {
     provider: "supabase",
     source: "https://supabase.com/docs/guides/database/webhooks",
@@ -250,3 +274,37 @@ describe("provider signature compatibility", () => {
     });
   }
 });
+
+describe("hookdeck headerPrefix", () => {
+  const body = '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}';
+  const run = (headerPrefix: string | undefined, headers: Record<string, string>) =>
+    verify(
+      { kind: "config", config: webhookProviderConfigs.hookdeck.config({ headerPrefix }) },
+      {
+        rawBytes: new TextEncoder().encode(body),
+        secret: "hookdeck_fixture_secret",
+        nowMs: NOW_MS,
+        headers,
+        url: "https://example.com/webhooks/v1/ingest/hookdeck_fixture",
+      }
+    );
+  const prefixed = {
+    "x-hookdeck-signature": "MRtBJRv3K6j8+CUcDsJuwYudgKi52qz9yfISiM3FKCw=",
+    "x-hookdeck-signature-2": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
+    "x-acme-eventid": "evt_acme_delivery",
+    "x-acme-requestid": "req_acme",
+  };
+
+  it("keeps verifying the x-hookdeck signature headers and dedupes on <prefix>-eventid", () => {
+    expect(run("X-Acme-", prefixed)).toMatchObject({
+      ok: true,
+      idempotencyKey: "evt_acme_delivery",
+    });
+  });
+
+  it("without the option, still verifies but cannot read the renamed event id", () => {
+    const verdict = run(undefined, prefixed);
+    expect(verdict.ok).toBe(true);
+    expect(verdict.idempotencyKey).not.toBe("evt_acme_delivery");
+  });
+});
diff --git a/internal-packages/webhook-sources/src/registry/hookdeck.ts b/internal-packages/webhook-sources/src/registry/hookdeck.ts
new file mode 100644
index 00000000000..c7178c7772e
--- /dev/null
+++ b/internal-packages/webhook-sources/src/registry/hookdeck.ts
@@ -0,0 +1,19 @@
+import { type ProviderRegistryEntry } from "./types.js";
+
+/**
+ * Hookdeck relays deliveries from another provider to a destination, so the body is the original
+ * provider's payload. It signs each forwarded request with an `x-hookdeck-signature` header: a
+ * base64-encoded HMAC-SHA256 of the raw body, keyed by the project's signing secret (used as UTF-8).
+ * While a secret is being rolled with a delay it also sends `x-hookdeck-signature-2`, signed with the
+ * previous secret. `x-hookdeck-eventid` names the Hookdeck event and is the same on every attempt.
+ * There is no timestamp. The event type depends on the source; `type` covers Stripe-style payloads.
+ */
+export const entry: ProviderRegistryEntry = {
+  id: "hookdeck",
+  label: "Hookdeck",
+  category: "hosting-infra",
+  docsUrl: "https://hookdeck.com/docs/authentication",
+  secretProvisioning: "provider",
+  eventTypeSource: { from: "body", path: "type" },
+  sampleSource: "handauthored",
+};
diff --git a/internal-packages/webhook-sources/src/registry/index.ts b/internal-packages/webhook-sources/src/registry/index.ts
index 111bfd7856b..ac5f4db6f0e 100644
--- a/internal-packages/webhook-sources/src/registry/index.ts
+++ b/internal-packages/webhook-sources/src/registry/index.ts
@@ -23,6 +23,7 @@ import { entry as e_firecrawl } from "./firecrawl.js";
 import { entry as e_github } from "./github.js";
 import { entry as e_gitlab } from "./gitlab.js";
 import { entry as e_granola } from "./granola.js";
+import { entry as e_hookdeck } from "./hookdeck.js";
 import { entry as e_hubspot } from "./hubspot.js";
 import { entry as e_infisical } from "./infisical.js";
 import { entry as e_intercom } from "./intercom.js";
@@ -91,6 +92,7 @@ export const registryEntries: ProviderRegistryEntry[] = [
   e_github,
   e_gitlab,
   e_granola,
+  e_hookdeck,
   e_hubspot,
   e_infisical,
   e_intercom,
diff --git a/packages/cli-v3/src/mcp/config.ts b/packages/cli-v3/src/mcp/config.ts
index a4fc2a9dd40..5b126bc6ce8 100644
--- a/packages/cli-v3/src/mcp/config.ts
+++ b/packages/cli-v3/src/mcp/config.ts
@@ -275,13 +275,13 @@ export const toolsMetadata = {
     name: "generate_webhook_secret",
     title: "Generate Webhook Secret",
     description:
-      "Generate a new signing secret for a hosted webhook endpoint and return it once, for providers where you choose the secret (for example GitHub). This replaces any existing secret, so deliveries fail until the provider uses the new one. Never print, log or commit the returned secret.",
+      "Generate a new signing secret for a hosted webhook endpoint and return it once, for providers where you choose the secret (for example GitHub). It replaces the existing secret; pass previousSecretTtlSeconds to keep accepting the old one while you update the provider, otherwise deliveries signed with it fail. Never print, log or commit the returned secret.",
   },
   set_webhook_secret: {
     name: "set_webhook_secret",
     title: "Set Webhook Secret",
     description:
-      "Store the signing secret (or public key) a provider issued for a hosted webhook endpoint, for example the whsec_ secret Stripe returns when a webhook endpoint is created. This replaces any existing secret.",
+      "Store the signing secret (or public key) a provider issued for a hosted webhook endpoint, for example the whsec_ secret Stripe returns when a webhook endpoint is created. It replaces the existing secret; pass previousSecretTtlSeconds to keep accepting the old one for a while.",
   },
   list_agents: {
     name: "list_agents",
diff --git a/packages/cli-v3/src/mcp/tools/webhooks.ts b/packages/cli-v3/src/mcp/tools/webhooks.ts
index ca0c315db3e..7364c24d252 100644
--- a/packages/cli-v3/src/mcp/tools/webhooks.ts
+++ b/packages/cli-v3/src/mcp/tools/webhooks.ts
@@ -1,7 +1,8 @@
-import type {
-  WebhookDeliveryListItem,
-  WebhookDeliveryObject,
-  WebhookDeliveryTargetObject,
+import {
+  WebhookPreviousSecretTtlSeconds,
+  type WebhookDeliveryListItem,
+  type WebhookDeliveryObject,
+  type WebhookDeliveryTargetObject,
 } from "@trigger.dev/core/v3";
 import { z } from "zod";
 import { toolsMetadata } from "../config.js";
@@ -60,10 +61,23 @@ const ReplayInput = DeliveryInput.extend({
     .optional(),
 });
 
+const PreviousSecretTtlInput = WebhookPreviousSecretTtlSeconds.optional().describe(
+  "Keep accepting the replaced secret for this many seconds (at most 604800, 7 days) so deliveries the provider still signs with it keep verifying. Omit or pass 0 to replace it immediately, for example when it leaked."
+);
+
+const GenerateSecretInput = EndpointInput.extend({
+  previousSecretTtlSeconds: PreviousSecretTtlInput,
+});
+
 const SetSecretInput = EndpointInput.extend({
   secret: z.string().min(1).describe("The signing secret or public key the provider issued"),
+  previousSecretTtlSeconds: PreviousSecretTtlInput,
 });
 
+function previousSecretNote(expiresAt: string | undefined): string {
+  return expiresAt ? ` The previous secret keeps verifying deliveries until ${expiresAt}.` : "";
+}
+
 function devOnlyError(devOnly: boolean | undefined, environment: string) {
   return devOnly && environment !== "dev"
     ? respondWithError(
@@ -152,8 +166,8 @@ export const generateWebhookSecretTool = {
   name: toolsMetadata.generate_webhook_secret.name,
   title: toolsMetadata.generate_webhook_secret.title,
   description: toolsMetadata.generate_webhook_secret.description,
-  inputSchema: EndpointInput.shape,
-  handler: toolHandler(EndpointInput.shape, async (input, { ctx }) => {
+  inputSchema: GenerateSecretInput.shape,
+  handler: toolHandler(GenerateSecretInput.shape, async (input, { ctx }) => {
     const blocked = devOnlyError(ctx.options.devOnly, input.environment);
     if (blocked) return blocked;
 
@@ -168,13 +182,15 @@ export const generateWebhookSecretTool = {
       branch: input.branch,
     });
 
-    const result = await apiClient.generateWebhookEndpointSecret(input.endpointId);
+    const result = await apiClient.generateWebhookEndpointSecret(input.endpointId, {
+      previousSecretTtlSeconds: input.previousSecretTtlSeconds,
+    });
 
     return {
       content: [
         {
           type: "text" as const,
-          text: `Generated a new signing secret for ${result.id}. It is shown once; give it to the provider and don't print, log or commit it.\n\n${result.secret}`,
+          text: `Generated a new signing secret for ${result.id}. It is shown once; give it to the provider and don't print, log or commit it.${previousSecretNote(result.previousSecretExpiresAt)}\n\n${result.secret}`,
         },
       ],
     };
@@ -203,10 +219,16 @@ export const setWebhookSecretTool = {
 
     const result = await apiClient.setWebhookEndpointSecret(input.endpointId, {
       secret: input.secret,
+      previousSecretTtlSeconds: input.previousSecretTtlSeconds,
     });
 
     return {
-      content: [{ type: "text" as const, text: `Stored the signing secret for ${result.id}.` }],
+      content: [
+        {
+          type: "text" as const,
+          text: `Stored the signing secret for ${result.id}.${previousSecretNote(result.previousSecretExpiresAt)}`,
+        },
+      ],
     };
   }),
 };
diff --git a/packages/core/src/v3/apiClient/index.ts b/packages/core/src/v3/apiClient/index.ts
index 14da6a9bdad..857da6dbaaa 100644
--- a/packages/core/src/v3/apiClient/index.ts
+++ b/packages/core/src/v3/apiClient/index.ts
@@ -23,6 +23,7 @@ import {
   CancelWebhookWaiterResponseBody,
   CreateWebhookWaiterResponseBody,
   type CreateWebhookWaiterRequestBody,
+  type RotateWebhookEndpointSecretRequestBody,
   RotateWebhookEndpointSecretResponse,
   SetWebhookEndpointSecretResponse,
   type SetWebhookEndpointSecretRequestBody,
@@ -2630,11 +2631,15 @@ export class ApiClient {
     );
   }
 
-  generateWebhookEndpointSecret(endpointId: string, requestOptions?: ZodFetchOptions) {
+  generateWebhookEndpointSecret(
+    endpointId: string,
+    body: RotateWebhookEndpointSecretRequestBody = {},
+    requestOptions?: ZodFetchOptions
+  ) {
     return zodfetch(
       RotateWebhookEndpointSecretResponse,
       `${this.baseUrl}/api/v1/webhooks/endpoints/${encodeURIComponent(endpointId)}/rotate-secret`,
-      { method: "POST", headers: this.#getHeaders(false) },
+      { method: "POST", headers: this.#getHeaders(false), body: JSON.stringify(body) },
       mergeRequestOptions(this.defaultRequestOptions, requestOptions)
     );
   }
diff --git a/packages/core/src/v3/schemas/webhookApi.ts b/packages/core/src/v3/schemas/webhookApi.ts
index 5c47247359c..023faeb072f 100644
--- a/packages/core/src/v3/schemas/webhookApi.ts
+++ b/packages/core/src/v3/schemas/webhookApi.ts
@@ -146,11 +146,33 @@ export type WebhookDeliveryObject = z.infer<typeof WebhookDeliveryObject>;
 
 // ── Write actions ──
 
+export const MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS = 7 * 24 * 60 * 60;
+
+/**
+ * How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it
+ * or pass 0 to replace the secret immediately.
+ */
+export const WebhookPreviousSecretTtlSeconds = z
+  .number()
+  .int()
+  .min(0)
+  .max(MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS);
+
+/** `POST /api/v1/webhooks/endpoints/:endpointId/rotate-secret`: the body is optional. */
+export const RotateWebhookEndpointSecretRequestBody = z.object({
+  previousSecretTtlSeconds: WebhookPreviousSecretTtlSeconds.optional(),
+});
+export type RotateWebhookEndpointSecretRequestBody = z.infer<
+  typeof RotateWebhookEndpointSecretRequestBody
+>;
+
 /** Rotating/setting a signing secret returns the plaintext ONCE; it is never readable again. */
 export const RotateWebhookEndpointSecretResponse = z.object({
   id: z.string(),
   secretSet: z.literal(true),
   secret: z.string(),
+  /** When the replaced secret stops verifying deliveries; absent when it was replaced immediately. */
+  previousSecretExpiresAt: z.string().optional(),
 });
 export type RotateWebhookEndpointSecretResponse = z.infer<
   typeof RotateWebhookEndpointSecretResponse
@@ -159,6 +181,7 @@ export type RotateWebhookEndpointSecretResponse = z.infer<
 /** `PUT /api/v1/webhooks/endpoints/:endpointId/secret`: store a secret or public key the provider issued. */
 export const SetWebhookEndpointSecretRequestBody = z.object({
   secret: z.string().trim().min(1).max(4096),
+  previousSecretTtlSeconds: WebhookPreviousSecretTtlSeconds.optional(),
 });
 export type SetWebhookEndpointSecretRequestBody = z.infer<
   typeof SetWebhookEndpointSecretRequestBody
@@ -167,6 +190,8 @@ export type SetWebhookEndpointSecretRequestBody = z.infer<
 export const SetWebhookEndpointSecretResponse = z.object({
   id: z.string(),
   secretSet: z.literal(true),
+  /** When the replaced secret stops verifying deliveries; absent when it was replaced immediately. */
+  previousSecretExpiresAt: z.string().optional(),
 });
 export type SetWebhookEndpointSecretResponse = z.infer<typeof SetWebhookEndpointSecretResponse>;
 
diff --git a/packages/core/src/v3/webhooks/index.ts b/packages/core/src/v3/webhooks/index.ts
index aa9f93b69e7..0731e111304 100644
--- a/packages/core/src/v3/webhooks/index.ts
+++ b/packages/core/src/v3/webhooks/index.ts
@@ -126,6 +126,7 @@ export type WebhookPresetId = (typeof WEBHOOK_PRESET_IDS)[number];
  */
 function hmacVerifierConfig(opts: {
   header: string;
+  additionalHeaders?: string[];
   algorithm?: "sha256" | "sha1";
   encoding?: "hex" | "base64";
   field?: string;
@@ -156,6 +157,7 @@ function hmacVerifierConfig(opts: {
     algorithm: opts.algorithm ?? "sha256",
     encoding: opts.encoding ?? "hex",
     signatureHeader: opts.header,
+    ...(opts.additionalHeaders ? { additionalSignatureHeaders: opts.additionalHeaders } : {}),
     signature,
     signingString: opts.signingTemplate
       ? {
@@ -188,6 +190,19 @@ function hmacVerifierConfig(opts: {
   return config;
 }
 
+export type HookdeckSourceOptions = {
+  /**
+   * The header prefix set in the Hookdeck project's settings, when it was changed from `x-hookdeck`.
+   * Hookdeck renames its event id header with it (`<prefix>-eventid`), which retries dedupe on. The
+   * signature headers keep the `x-hookdeck-` name whatever the prefix.
+   */
+  headerPrefix?: string;
+};
+
+function hookdeckHeaderPrefix(opts?: HookdeckSourceOptions): string {
+  return (opts?.headerPrefix?.trim() || "x-hookdeck").toLowerCase().replace(/-+$/, "");
+}
+
 /**
  * Per-provider verifier configs for providers whose signature maps onto the config primitives: a plain
  * HMAC variant (a different header name / prefix / signing template than the shared presets, but no
@@ -477,6 +492,16 @@ export const webhookProviderConfigs = {
         idempotencyField: { from: "body", name: "webhookId" },
       }),
   },
+  hookdeck: {
+    secretProvisioning: "provider",
+    config: (opts?: HookdeckSourceOptions) =>
+      hmacVerifierConfig({
+        header: "x-hookdeck-signature",
+        additionalHeaders: ["x-hookdeck-signature-2"],
+        encoding: "base64",
+        idempotencyField: { from: "header", name: `${hookdeckHeaderPrefix(opts)}-eventid` },
+      }),
+  },
   supabase: {
     secretProvisioning: "integrator",
     config: (): WebhookVerifierConfig => ({ scheme: "shared-secret", placement: "bearer" }),
@@ -599,6 +624,15 @@ export const webhookSetupPrompts: Partial<Record<WebhookPresetId | WebhookProvid
     'Firecrawl has no webhook settings page: each crawl, batch scrape, extract or agent request carries its own `webhook` object. Add `webhook: { url: "<webhook URL>", events: [...] }` to the requests the code makes (for a crawl the events are started, page and completed).',
     "Subscribers' filters compare `event.type`, which is prefixed with the operation, for example `crawl.completed`.",
   ].join("\n"),
+  hookdeck: [
+    "Hookdeck relays deliveries from another provider: the event is the original provider's payload, and Hookdeck signs what it forwards with the project's signing secret.",
+    "These settings are in the Hookdeck dashboard; tell the user each step. The Hookdeck CLI and API can also create connections.",
+    "1. Create a connection whose destination is an HTTP destination with the webhook URL. Keep the destination's authentication on Hookdeck Signature (the default, `auth_type: HOOKDECK_SIGNATURE` in the API); Hookdeck only signs with it set.",
+    "2. Read the signing secret from Settings > Secrets (https://dashboard.hookdeck.com/settings/project/secrets) and store it as the endpoint's signing secret. It is one secret for the whole project.",
+    "The signature headers are always `x-hookdeck-signature` and `x-hookdeck-signature-2`. If the project's header prefix was changed in the project settings, the event id arrives as `<prefix>-eventid` instead of `x-hookdeck-eventid`: pass the prefix as `webhooks.hookdeck({ headerPrefix })` so retries dedupe on it.",
+    "When the secret is rolled in Hookdeck with a delay, deliveries keep verifying through the old secret until the new one is stored here.",
+    "Subscribers' filters compare fields of the original provider's payload, for example `event.type` for a Stripe source.",
+  ].join("\n"),
 };
 
 export * from "../schemas/webhookConfig.js";
diff --git a/packages/core/test/runStream.test.ts b/packages/core/test/runStream.test.ts
index ef4cd8f9932..6b0b80efcb6 100644
--- a/packages/core/test/runStream.test.ts
+++ b/packages/core/test/runStream.test.ts
@@ -58,9 +58,24 @@ function createTestShapeStream(
   });
 }
 
+// Never closes, like a live run shape stream; a close here would race the stream chunks
+function createOpenTestShapeStream(
+  shapes: SubscribeRunRawShape[]
+): ReadableStream<SubscribeRunRawShape> {
+  return new ReadableStream({
+    start: (controller) => {
+      for (const shape of shapes) {
+        controller.enqueue(shape);
+      }
+    },
+  });
+}
+
 function createDelayedTestShapeStream(
   shapes: SubscribeRunRawShape[]
 ): ReadableStream<SubscribeRunRawShape> {
+  let interval: ReturnType<typeof setInterval> | undefined;
+
   return new ReadableStream({
     start: async (controller) => {
       // Emit first shape immediately
@@ -71,7 +86,7 @@ function createDelayedTestShapeStream(
       let currentShapeIndex = 1;
 
       // Emit remaining shapes with delay
-      const interval = setInterval(() => {
+      interval = setInterval(() => {
         if (currentShapeIndex >= shapes.length) {
           clearInterval(interval);
           controller.close();
@@ -80,6 +95,7 @@ function createDelayedTestShapeStream(
         controller.enqueue(shapes[currentShapeIndex++]!);
       }, 100);
     },
+    cancel: () => clearInterval(interval),
   });
 }
 
@@ -307,7 +323,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createTestShapeStream(shapes),
+      runShapeStream: createOpenTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
@@ -392,7 +408,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createTestShapeStream(shapes),
+      runShapeStream: createOpenTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
@@ -455,7 +471,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createTestShapeStream(shapes),
+      runShapeStream: createOpenTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
diff --git a/packages/trigger-sdk/src/v3/ai.ts b/packages/trigger-sdk/src/v3/ai.ts
index 00e98ed0f4b..83341cdf30a 100644
--- a/packages/trigger-sdk/src/v3/ai.ts
+++ b/packages/trigger-sdk/src/v3/ai.ts
@@ -5282,6 +5282,25 @@ function toStreamTextOptions(
     Object.assign(result, telemetry);
   }
 
+  const telemetry = (result.experimental_telemetry as Record<string, unknown> | undefined) ?? {
+    isEnabled: true,
+    metadata: { ...(options?.telemetry ?? {}) },
+  };
+  if (locals.get(chatTurnContextKey)?.recordUserMessage === false) {
+    const { "prompt.input": _input, ...metadata } = (telemetry.metadata ?? {}) as Record<
+      string,
+      unknown
+    >;
+    result.experimental_telemetry = {
+      ...telemetry,
+      metadata,
+      recordInputs: false,
+      recordOutputs: false,
+    };
+  } else {
+    result.experimental_telemetry = telemetry;
+  }
+
   // Skills: merge auto-injected tools with any user-provided tools.
   // User tools override on name conflict (though we namespace ours).
   if (skills && skills.length > 0) {
@@ -16873,7 +16892,8 @@ export const chat = {
   /**
    * Returns an options object ready to spread into `streamText()`.
    * Reads the stored prompt and returns `{ system, experimental_telemetry, ...config }`.
-   * Returns `{}` if no prompt has been set.
+   * With no stored prompt it still returns `experimental_telemetry` (on), so the model call is
+   * traced.
    */
   toStreamTextOptions,
   /**
diff --git a/packages/trigger-sdk/src/v3/webhooks.ts b/packages/trigger-sdk/src/v3/webhooks.ts
index 256714bf7ab..94d16f4b304 100644
--- a/packages/trigger-sdk/src/v3/webhooks.ts
+++ b/packages/trigger-sdk/src/v3/webhooks.ts
@@ -35,6 +35,7 @@ import {
   svixVerifierConfig,
   webhookProviderConfigs,
   webhookSetupPrompts,
+  type HookdeckSourceOptions,
   type WebhookProviderId,
 } from "@trigger.dev/core/webhooks";
 
@@ -289,6 +290,22 @@ export const webhookSources = {
       secretProvisioning: "provider",
     };
   },
+
+  /**
+   * Hookdeck relays deliveries from another provider, so `T` is the original provider's event. It
+   * verifies `x-hookdeck-signature` (and `x-hookdeck-signature-2` while a secret is being rolled)
+   * with the Hookdeck project's signing secret, and dedupes retries on `x-hookdeck-eventid`. Pass
+   * `headerPrefix` when the project's header prefix was changed from `x-hookdeck`.
+   */
+  hookdeck<T = unknown>(options?: HookdeckSourceOptions): WebhookSource<T> {
+    const setupPrompt = webhookSetupPrompts.hookdeck;
+    return {
+      provider: "hookdeck",
+      verifier: { kind: "config", config: webhookProviderConfigs.hookdeck.config(options) },
+      secretProvisioning: webhookProviderConfigs.hookdeck.secretProvisioning,
+      ...(setupPrompt ? { setupPrompt } : {}),
+    };
+  },
 } as const;
 
 type CamelCase<S extends string> = S extends `${infer Head}-${infer Tail}`
@@ -314,7 +331,7 @@ function producerName(provider: string): string {
 export const providerProducers = Object.fromEntries(
   Object.entries(webhookProviderConfigs)
     // Zoom needs a computed URL-validation response that the hosted ingress does not support yet.
-    .filter(([provider]) => provider !== "slack" && provider !== "zoom")
+    .filter(([provider]) => provider !== "slack" && provider !== "zoom" && provider !== "hookdeck")
     .map(([provider, entry]) => [
       producerName(provider),
       () => {
@@ -327,7 +344,7 @@ export const providerProducers = Object.fromEntries(
         };
       },
     ])
-) as Omit<ProviderProducers, "slack">;
+) as Omit<ProviderProducers, "slack" | "hookdeck">;
 
 // ── webhooks.endpoint.define(): one provider URL that subscribers and waiters attach to ──
 export type WebhookEndpointOptions<TIdentifier extends string, TSource extends AnyWebhookSource> = {
@@ -600,6 +617,7 @@ interface Webhooks {
   composio: typeof webhookSources.composio;
   gitlab: typeof webhookSources.gitlab;
   whatsapp: typeof webhookSources.whatsapp;
+  hookdeck: typeof webhookSources.hookdeck;
   /** Declare the URLs providers deliver to. */
   endpoint: { define: typeof defineWebhookEndpoint };
   /** Suspend a run until a matching webhook arrives. */
@@ -613,7 +631,7 @@ interface Webhooks {
 /**
  * Webhook utilities for handling incoming webhook requests
  */
-export const webhooks: Webhooks & Omit<ProviderProducers, "slack"> = {
+export const webhooks: Webhooks & Omit<ProviderProducers, "slack" | "hookdeck"> = {
   ...providerProducers,
   constructEvent,
   SIGNATURE_HEADER_NAME,
@@ -633,6 +651,7 @@ export const webhooks: Webhooks & Omit<ProviderProducers, "slack"> = {
   composio: webhookSources.composio,
   gitlab: webhookSources.gitlab,
   whatsapp: webhookSources.whatsapp,
+  hookdeck: webhookSources.hookdeck,
   endpoint: { define: defineWebhookEndpoint },
   waiter: { create: createWebhookWaiter, wait: waitForWebhookWaiter, cancel: cancelWebhookWaiter },
 };
diff --git a/packages/trigger-sdk/test/bound-streamtext.test.ts b/packages/trigger-sdk/test/bound-streamtext.test.ts
index 38dcfcea543..edfe2c9820d 100644
--- a/packages/trigger-sdk/test/bound-streamtext.test.ts
+++ b/packages/trigger-sdk/test/bound-streamtext.test.ts
@@ -5,6 +5,7 @@ import { mockChatAgent } from "../src/v3/test/index.js";
 import { describe, expect, it } from "vitest";
 import { chat, __buildManagedStreamTextOptionsForTests as buildManaged } from "../src/v3/ai.js";
 import { chat as chatServer } from "../src/v3/chat-server.js";
+import { definePrompt } from "../src/v3/prompt.js";
 import { simulateReadableStream, stepCountIs, tool } from "ai";
 import { MockLanguageModelV3 } from "ai/test";
 import type { LanguageModelV3StreamPart } from "@ai-sdk/provider";
@@ -401,6 +402,91 @@ describe("what the managed streamText passes through", () => {
     expect(merged.experimental_telemetry).toBe(callerTelemetry);
   });
 
+  it("turns AI SDK telemetry on when no prompt is stored, so model steps and tool calls are traced", () => {
+    const merged = buildManaged({ model: "m" }, {});
+    expect(merged.experimental_telemetry).toEqual({ isEnabled: true, metadata: {} });
+  });
+
+  it.each([
+    { name: "default telemetry", key: "default", prompt: undefined, metadata: {} },
+    {
+      name: "stored prompt telemetry",
+      key: "string-prompt",
+      prompt: async () => "You are terse.",
+      metadata: {},
+    },
+    {
+      name: "resolved prompt telemetry and its variables",
+      key: "resolved-prompt",
+      prompt: () =>
+        definePrompt({
+          id: "bound-streamtext-redacted",
+          content: "Help {{name}}.",
+        }).resolve({ name: "secret" }),
+      metadata: {
+        "prompt.slug": "bound-streamtext-redacted",
+        "prompt.id": "bound-streamtext-redacted",
+        "prompt.version": "0",
+        "prompt.labels": "local",
+      },
+    },
+  ])(
+    "keeps prompt and response content out of $name when recordUserMessage is off",
+    async ({ key, prompt, metadata }) => {
+      const stored = await prompt?.();
+      const seen: unknown[] = [];
+      const model = new MockLanguageModelV3({
+        doStream: async () => ({
+          stream: simulateReadableStream({
+            chunks: [
+              { type: "text-start", id: "t" },
+              { type: "text-delta", id: "t", delta: "ok" },
+              { type: "text-end", id: "t" },
+              {
+                type: "finish",
+                finishReason: { unified: "stop", raw: "stop" },
+                usage: {
+                  inputTokens: { total: 1, noCache: 1, cacheRead: 0, cacheWrite: 0 },
+                  outputTokens: { total: 1, text: 1, reasoning: 0 },
+                },
+              },
+            ] as LanguageModelV3StreamPart[],
+          }),
+        }),
+      });
+      const agent = chat.agent({
+        id: `bound-streamtext.redacted-telemetry-${key}`,
+        telemetry: { recordUserMessage: false },
+        run: async ({ messages, signal, streamText }) => {
+          if (stored) chat.prompt.set(stored);
+          seen.push(chat.toStreamTextOptions().experimental_telemetry);
+          return streamText({ model, messages, abortSignal: signal });
+        },
+      });
+      const harness = mockChatAgent(agent, { chatId: `bound-streamtext-redacted-${key}` });
+      try {
+        await harness.sendMessage({
+          id: "u1",
+          role: "user",
+          parts: [{ type: "text", text: "secret" }],
+        });
+        expect(seen[0]).toEqual({
+          isEnabled: true,
+          metadata,
+          recordInputs: false,
+          recordOutputs: false,
+        });
+      } finally {
+        await harness.close();
+      }
+    }
+  );
+
+  it("lets a caller turn telemetry off", () => {
+    const merged = buildManaged({ model: "m", experimental_telemetry: { isEnabled: false } }, {});
+    expect(merged.experimental_telemetry).toEqual({ isEnabled: false });
+  });
+
   it("carries the agent's system when the caller names none", () => {
     const merged = buildManaged({ model: "m" }, { system: "AGENT-SYSTEM" });
     expect(JSON.stringify(merged.system)).toContain("AGENT-SYSTEM");

From d574cf346d52a6e8d6e593aac7a0f244e611f200 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 09:13:31 +0000
Subject: [PATCH 3/3] docs(webhooks): drop rotation docs covered on main, keep
 additionalSignatureHeaders

---
 .changeset/chat-agent-telemetry-default.md    |   5 -
 .changeset/webhook-secret-grace-option.md     |   6 -
 .changeset/webhooks-hookdeck-source.md        |   6 -
 .github/workflows/changesets-pr.yml           |   2 +-
 .github/workflows/claude.yml                  |   2 +-
 .github/workflows/code-quality.yml            |   2 +-
 .github/workflows/e2e-webapp-auth-full.yml    |   2 +-
 .github/workflows/e2e-webapp.yml              |   2 +-
 .github/workflows/e2e.yml                     |   2 +-
 .github/workflows/fk-cascade-guard.yml        |   2 +-
 .github/workflows/migration-guard.yml         |   2 +-
 .github/workflows/observability-map.yml       |   4 +-
 .github/workflows/preview-packages.yml        |   2 +-
 .github/workflows/release.yml                 |   4 +-
 .github/workflows/runops-guard.yml            |   2 +-
 .github/workflows/sdk-compat.yml              |   8 +-
 .github/workflows/typecheck.yml               |   2 +-
 .github/workflows/unit-tests-internal.yml     |   4 +-
 .../unit-tests-observability-map.yml          |   2 +-
 .github/workflows/unit-tests-packages.yml     |   4 +-
 .github/workflows/unit-tests-webapp.yml       |   4 +-
 .nvmrc                                        |   2 +-
 .../alerts-create-without-agent.md            |   6 -
 .../legacy-slack-deleted-integration.md       |   6 -
 ...evoke-previous-root-api-key-immediately.md |   6 -
 .server-changes/trigger-dashboard-url.md      |   6 -
 CONTRIBUTING.md                               |   4 +-
 apps/supervisor/.nvmrc                        |   2 +-
 apps/supervisor/Containerfile                 |   2 +-
 .../components/alerts/LegacyAlertsSection.tsx |   8 +-
 .../alerts/ManualAlertCreation.dom.test.ts    | 256 -----------------
 .../components/alerts/ManualAlertCreation.tsx | 272 ------------------
 .../ManualAlertCreationDock.dom.test.ts       | 159 ----------
 .../components/alerts/createAlertRequest.ts   |  68 -----
 .../dashboard-agent/DashboardAgentHeader.tsx  | 134 +++++----
 .../dashboard-agent/DashboardPanelChrome.tsx  |  39 ---
 .../environments/RegenerateApiKeyModal.tsx    |  23 +-
 .../app/components/navigation/SideMenu.tsx    |   3 +-
 .../navigation/sideMenuSections.tsx           |   5 +-
 apps/webapp/app/features.server.ts            |   3 -
 apps/webapp/app/hooks/useFeatures.ts          |   1 -
 apps/webapp/app/models/api-key.server.ts      |  22 +-
 .../route.createPrefill.render.test.tsx       | 114 +-------
 .../route.tsx                                 | 119 +++-----
 .../route.replace.render.test.tsx             | 140 ---------
 .../route.tsx                                 |  86 ++----
 .../route.tsx                                 |   9 +-
 .../app/routes/account._index/route.tsx       |  24 +-
 ...cts.$projectRef.$env.regenerate-api-key.ts |  23 --
 ...oks.endpoints.$endpointId.rotate-secret.ts |  11 +-
 ...1.webhooks.endpoints.$endpointId.secret.ts |   7 +-
 ...ents.$environmentId.regenerate-api-key.tsx |   7 +-
 apps/webapp/app/v3/canUseAlertsList.server.ts |   7 +-
 apps/webapp/app/v3/canUseAlertsList.test.ts   |  12 +-
 apps/webapp/app/v3/canUseAlertsList.ts        |  12 +-
 .../environmentVariablesRepository.server.ts  |   4 -
 apps/webapp/app/v3/featureFlags.ts            |   2 -
 apps/webapp/app/v3/invocationUsage.server.ts  |   3 -
 apps/webapp/app/v3/runEngine.server.ts        |   6 -
 .../webapp/app/v3/runEngineHandlers.server.ts |   3 +-
 .../services/alerts/alertTransport.server.ts  |  19 +-
 .../v3/services/alerts/deliverAlert.server.ts |  12 +-
 .../deliverDashboardAgentWatchAlert.server.ts |  12 +-
 .../alerts/deliverErrorGroupAlert.server.ts   |  27 +-
 .../findSlackIntegration.server.test.ts       |  57 ----
 .../v3/utils/waitpointStoreEnabled.server.ts  |  26 --
 apps/webapp/app/v3/webhookSetupPrompt.ts      |   2 +-
 apps/webapp/app/v3/webhookSigningSecret.ts    |   9 +
 apps/webapp/test/alertsGateRoutes.test.ts     |  22 +-
 .../webapp/test/alertsListRouteLegacy.test.ts |   3 -
 apps/webapp/test/alertsRequireEnabled.test.ts |  19 +-
 apps/webapp/test/api-auth.e2e.test.ts         |  34 ---
 .../test/canUseMonitoringAlerts.test.ts       |   9 +-
 .../test/dashboardAgentAlertsGate.test.ts     |  19 +-
 .../dashboardAgentMonitoringAlerts.test.ts    |   1 -
 .../test/helpers/seedTestUserProject.ts       |   3 -
 apps/webapp/test/invocationUsage.test.ts      |  18 --
 apps/webapp/test/monitoringAlertsApi.test.ts  |   4 -
 apps/webapp/test/regenerateApiKey.test.ts     |  70 -----
 .../regenerateApiKeyBranch.e2e.full.test.ts   |  63 +---
 apps/webapp/test/sideMenuSections.test.ts     |   3 -
 apps/webapp/test/waitpointRollout.test.ts     |  35 ---
 apps/webapp/test/webhookSetupPrompt.test.ts   |   3 +-
 apps/webapp/test/webhookSigningSecret.test.ts |   9 +-
 base-images/images.json                       |   6 +-
 docker/Dockerfile                             |   2 +-
 docs/ai-chat/backend.mdx                      |   6 +-
 docs/ai-chat/patterns/redacting-telemetry.mdx |  10 +-
 docs/ai-chat/pending-messages.mdx             |   2 +-
 docs/ai-chat/reference.mdx                    |   8 +-
 docs/apikeys.mdx                              |   2 +-
 docs/guides/examples/hookdeck-webhook.mdx     | 105 +++----
 docs/mcp-tools.mdx                            |   4 +
 docs/snippets/webhooks-beta-banner.mdx        |   7 +
 docs/snippets/webhooks-beta-note.mdx          |   4 +
 docs/v3-openapi.yaml                          |  68 ++---
 docs/webhooks/channels.mdx                    |   4 +
 docs/webhooks/connect.mdx                     |  21 +-
 docs/webhooks/deliveries.mdx                  |   6 +-
 docs/webhooks/filters.mdx                     |   4 +
 docs/webhooks/human-in-the-loop.mdx           |   4 +
 docs/webhooks/linear.mdx                      |   4 +
 docs/webhooks/overview.mdx                    |   4 +
 docs/webhooks/session-routing.mdx             |   4 +
 docs/webhooks/slack.mdx                       |   4 +
 docs/webhooks/sources.mdx                     |  34 +--
 docs/webhooks/waiters.mdx                     |   4 +
 .../run-engine/src/engine/index.ts            |   1 -
 .../completedWaitpointRecordAdapter.test.ts   | 209 --------------
 .../completedWaitpointRecordAdapter.ts        | 251 ----------------
 .../completedWaitpointResolver.test.ts        | 118 +-------
 .../systems/completedWaitpointResolver.ts     |  53 +---
 .../redisPrimaryCompletionAssociation.test.ts | 174 +----------
 .../engine/systems/waitpointResultRunStore.ts |  52 ----
 .../engine/systems/waitpointSystem.test.ts    |  73 +----
 .../src/engine/systems/waitpointSystem.ts     |  81 +-----
 .../run-engine/src/engine/types.ts            |   5 -
 ...reCoordinator.readCompletedRecords.test.ts | 136 ---------
 .../waitpointCoordinator/storeCoordinator.ts  |  56 ----
 internal-packages/run-engine/src/index.ts     |   7 +-
 .../completedWaitpointHydratingRunStore.ts    |  97 -------
 internal-packages/run-store/src/index.ts      |   1 -
 .../redisSnapshotStore.recoveryLease.test.ts  |   9 +-
 ...tionSnapshotStore.resolverLaziness.test.ts | 123 --------
 .../src/taskRunExecutionSnapshotStore.ts      |  18 +-
 .../webhook-sources/catalog/providers.json    |  21 --
 .../src/handAuthored/hookdeck.ts              |  67 -----
 .../webhook-sources/src/handAuthored/index.ts |   2 -
 .../src/providerSignatures.test.ts            |  58 ----
 .../webhook-sources/src/registry/hookdeck.ts  |  19 --
 .../webhook-sources/src/registry/index.ts     |   2 -
 packages/cli-v3/src/mcp/config.ts             |   4 +-
 packages/cli-v3/src/mcp/tools/webhooks.ts     |  40 +--
 packages/core/src/v3/apiClient/index.ts       |   9 +-
 packages/core/src/v3/schemas/webhookApi.ts    |  25 --
 packages/core/src/v3/webhooks/index.ts        |  34 ---
 packages/core/test/runStream.test.ts          |  24 +-
 packages/trigger-sdk/src/v3/ai.ts             |  22 +-
 packages/trigger-sdk/src/v3/webhooks.ts       |  25 +-
 .../trigger-sdk/test/bound-streamtext.test.ts |  86 ------
 140 files changed, 488 insertions(+), 3895 deletions(-)
 delete mode 100644 .changeset/chat-agent-telemetry-default.md
 delete mode 100644 .changeset/webhook-secret-grace-option.md
 delete mode 100644 .changeset/webhooks-hookdeck-source.md
 delete mode 100644 .server-changes/alerts-create-without-agent.md
 delete mode 100644 .server-changes/legacy-slack-deleted-integration.md
 delete mode 100644 .server-changes/revoke-previous-root-api-key-immediately.md
 delete mode 100644 .server-changes/trigger-dashboard-url.md
 delete mode 100644 apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
 delete mode 100644 apps/webapp/app/components/alerts/ManualAlertCreation.tsx
 delete mode 100644 apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
 delete mode 100644 apps/webapp/app/components/alerts/createAlertRequest.ts
 delete mode 100644 apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
 delete mode 100644 apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
 delete mode 100644 apps/webapp/app/v3/invocationUsage.server.ts
 delete mode 100644 apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
 delete mode 100644 apps/webapp/test/invocationUsage.test.ts
 delete mode 100644 apps/webapp/test/regenerateApiKey.test.ts
 delete mode 100644 apps/webapp/test/waitpointRollout.test.ts
 create mode 100644 docs/snippets/webhooks-beta-banner.mdx
 create mode 100644 docs/snippets/webhooks-beta-note.mdx
 delete mode 100644 internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
 delete mode 100644 internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
 delete mode 100644 internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
 delete mode 100644 internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
 delete mode 100644 internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
 delete mode 100644 internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
 delete mode 100644 internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
 delete mode 100644 internal-packages/webhook-sources/src/registry/hookdeck.ts

diff --git a/.changeset/chat-agent-telemetry-default.md b/.changeset/chat-agent-telemetry-default.md
deleted file mode 100644
index 853de1a1b30..00000000000
--- a/.changeset/chat-agent-telemetry-default.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@trigger.dev/sdk": patch
----
-
-The `streamText` passed to a `chat.agent`'s `run()` now turns AI SDK telemetry on by default, so each model step and tool call shows up as a span in the run trace even when the agent doesn't store a prompt with `chat.prompt.set()`. An agent with `telemetry: { recordUserMessage: false }` gets these spans without prompt and response content, including when it stores a prompt (whose variables are left out of the span metadata). Pass `experimental_telemetry: { isEnabled: false }` at the call site to turn them off, or `recordInputs: false` / `recordOutputs: false` to keep them without content.
diff --git a/.changeset/webhook-secret-grace-option.md b/.changeset/webhook-secret-grace-option.md
deleted file mode 100644
index 7ee2f97de42..00000000000
--- a/.changeset/webhook-secret-grace-option.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@trigger.dev/core": patch
-"trigger.dev": patch
----
-
-The `generate_webhook_secret` and `set_webhook_secret` MCP tools take an optional `previousSecretTtlSeconds` to keep accepting a webhook endpoint's old signing secret while the provider switches to the new one (up to 7 days), and report when the old secret stops working.
diff --git a/.changeset/webhooks-hookdeck-source.md b/.changeset/webhooks-hookdeck-source.md
deleted file mode 100644
index 52590506d58..00000000000
--- a/.changeset/webhooks-hookdeck-source.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@trigger.dev/core": patch
-"@trigger.dev/sdk": patch
----
-
-Add `webhooks.hookdeck()`, a source for deliveries relayed through a Hookdeck connection. It verifies the `x-hookdeck-signature` header with the project's signing secret, keeps verifying while the secret is being rolled (Hookdeck sends the previous secret's signature in `x-hookdeck-signature-2`), and deduplicates retries on `x-hookdeck-eventid`. The event is the original provider's payload, so pass its type: `webhooks.hookdeck<Stripe.Event>()`. If the Hookdeck project's header prefix was changed, pass it as `webhooks.hookdeck({ headerPrefix })` so retries keep deduplicating.
diff --git a/.github/workflows/changesets-pr.yml b/.github/workflows/changesets-pr.yml
index 1f9210192cb..8e166211fa1 100644
--- a/.github/workflows/changesets-pr.yml
+++ b/.github/workflows/changesets-pr.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 486692691f4..6372bb2628b 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -44,7 +44,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 637c3c990ab..705233e839e 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/e2e-webapp-auth-full.yml b/.github/workflows/e2e-webapp-auth-full.yml
index 989c33fd1a2..8721c4bc201 100644
--- a/.github/workflows/e2e-webapp-auth-full.yml
+++ b/.github/workflows/e2e-webapp-auth-full.yml
@@ -85,7 +85,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🐳 Login to DockerHub
diff --git a/.github/workflows/e2e-webapp.yml b/.github/workflows/e2e-webapp.yml
index e4a95335f9e..7ef6a9b0722 100644
--- a/.github/workflows/e2e-webapp.yml
+++ b/.github/workflows/e2e-webapp.yml
@@ -66,7 +66,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index be6d8e81ddc..c024696e251 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -37,7 +37,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
 
       - name: 📥 Download deps
         run: pnpm install --frozen-lockfile --filter trigger.dev...
diff --git a/.github/workflows/fk-cascade-guard.yml b/.github/workflows/fk-cascade-guard.yml
index 48a5a4c3674..1c942a3ac39 100644
--- a/.github/workflows/fk-cascade-guard.yml
+++ b/.github/workflows/fk-cascade-guard.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/migration-guard.yml b/.github/workflows/migration-guard.yml
index 6a16b5404cc..72672c9d927 100644
--- a/.github/workflows/migration-guard.yml
+++ b/.github/workflows/migration-guard.yml
@@ -24,7 +24,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/observability-map.yml b/.github/workflows/observability-map.yml
index 1f590713571..ba283c6f603 100644
--- a/.github/workflows/observability-map.yml
+++ b/.github/workflows/observability-map.yml
@@ -184,7 +184,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
@@ -244,7 +244,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/preview-packages.yml b/.github/workflows/preview-packages.yml
index b822c72f847..ed0717c3bdd 100644
--- a/.github/workflows/preview-packages.yml
+++ b/.github/workflows/preview-packages.yml
@@ -59,7 +59,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf48afb0ccd..04333584916 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -90,7 +90,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support
@@ -303,7 +303,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # npm v11.5.1 or newer is required for OIDC support
diff --git a/.github/workflows/runops-guard.yml b/.github/workflows/runops-guard.yml
index 080a21e701a..c974aa1590f 100644
--- a/.github/workflows/runops-guard.yml
+++ b/.github/workflows/runops-guard.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/sdk-compat.yml b/.github/workflows/sdk-compat.yml
index 2c5a65a5281..26baca286bf 100644
--- a/.github/workflows/sdk-compat.yml
+++ b/.github/workflows/sdk-compat.yml
@@ -14,7 +14,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [warp-ubuntu-latest-x64-4x]
-        node: ["20.20", "22.23.4", "24.22.1", "26.12.1"]
+        node: ["20.20", "22.23", "24.18", "26.4"]
 
     steps:
       - name: ⬇️ Checkout repo
@@ -70,7 +70,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🥟 Setup Bun
@@ -112,7 +112,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 🦕 Setup Deno
@@ -158,7 +158,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 420ffceba3d..e9329191d05 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: Restore Turbo cache
diff --git a/.github/workflows/unit-tests-internal.yml b/.github/workflows/unit-tests-internal.yml
index 908f90d3455..b836907e2c1 100644
--- a/.github/workflows/unit-tests-internal.yml
+++ b/.github/workflows/unit-tests-internal.yml
@@ -67,7 +67,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -174,7 +174,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
 
       - name: Download blob reports
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/unit-tests-observability-map.yml b/.github/workflows/unit-tests-observability-map.yml
index 72b971f973d..2338bb6c51a 100644
--- a/.github/workflows/unit-tests-observability-map.yml
+++ b/.github/workflows/unit-tests-observability-map.yml
@@ -30,7 +30,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       - name: 📥 Download deps
diff --git a/.github/workflows/unit-tests-packages.yml b/.github/workflows/unit-tests-packages.yml
index 2a293fb4e9e..b7b8d7d01b6 100644
--- a/.github/workflows/unit-tests-packages.yml
+++ b/.github/workflows/unit-tests-packages.yml
@@ -66,7 +66,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -145,7 +145,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
diff --git a/.github/workflows/unit-tests-webapp.yml b/.github/workflows/unit-tests-webapp.yml
index 22a2fd48d1c..c2c3ca54f84 100644
--- a/.github/workflows/unit-tests-webapp.yml
+++ b/.github/workflows/unit-tests-webapp.yml
@@ -68,7 +68,7 @@ jobs:
       - name: ⎔ Setup node
         uses: WarpBuilds/setup-node@2867cf8f859d73439e1ad18b542617e5a29f0f10 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           cache: "pnpm"
 
       # ..to avoid rate limits when pulling images
@@ -180,7 +180,7 @@ jobs:
       - name: ⎔ Setup node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.22.1
+          node-version: 24.18.0
           # no cache enabled, we're not installing deps
 
       - name: Download blob reports from GitHub Actions Artifacts
diff --git a/.nvmrc b/.nvmrc
index 474d750b504..5bcf9c6e6ac 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v24.22.1
+v24.18.0
diff --git a/.server-changes/alerts-create-without-agent.md b/.server-changes/alerts-create-without-agent.md
deleted file mode 100644
index 258a93ebefd..00000000000
--- a/.server-changes/alerts-create-without-agent.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: fix
----
-
-Creating an alert works without the dashboard agent.
diff --git a/.server-changes/legacy-slack-deleted-integration.md b/.server-changes/legacy-slack-deleted-integration.md
deleted file mode 100644
index 9dc10131151..00000000000
--- a/.server-changes/legacy-slack-deleted-integration.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: fix
----
-
-Alerts sent to Slack channels connected through a removed Slack installation deliver again.
diff --git a/.server-changes/revoke-previous-root-api-key-immediately.md b/.server-changes/revoke-previous-root-api-key-immediately.md
deleted file mode 100644
index d88254905ca..00000000000
--- a/.server-changes/revoke-previous-root-api-key-immediately.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: feature
----
-
-When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
diff --git a/.server-changes/trigger-dashboard-url.md b/.server-changes/trigger-dashboard-url.md
deleted file mode 100644
index e36e0cbdd22..00000000000
--- a/.server-changes/trigger-dashboard-url.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: improvement
----
-
-Runs now get a `TRIGGER_DASHBOARD_URL` environment variable with the dashboard's address, so a task can link to its run (`${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}`) on any Trigger.dev instance. A `TRIGGER_DASHBOARD_URL` you set on the project still wins.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 88288a4b417..804c9cc5df1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -33,7 +33,7 @@ branch are tagged into a release periodically.
 
 ### Prerequisites
 
-- [Node.js](https://nodejs.org/en) version 24.22.1
+- [Node.js](https://nodejs.org/en) version 24.18.0
 - [pnpm package manager](https://pnpm.io/installation) version 10.33.2
 - [Docker](https://www.docker.com/get-started/) (Compose 2.24.4 or newer for `dev:docker`)
 - [protobuf](https://github.com/protocolbuffers/protobuf)
@@ -53,7 +53,7 @@ branch are tagged into a release periodically.
    ```
    cd trigger.dev
    ```
-3. Ensure you are on the correct version of Node.js (24.22.1). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
+3. Ensure you are on the correct version of Node.js (24.18.0). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
 
 4. Run `corepack enable` to use the correct version of pnpm (`10.33.2`) as specified in the root `package.json` file.
 
diff --git a/apps/supervisor/.nvmrc b/apps/supervisor/.nvmrc
index 474d750b504..5bcf9c6e6ac 100644
--- a/apps/supervisor/.nvmrc
+++ b/apps/supervisor/.nvmrc
@@ -1 +1 @@
-v24.22.1
+v24.18.0
diff --git a/apps/supervisor/Containerfile b/apps/supervisor/Containerfile
index a759e8f6f9d..727ae6db442 100644
--- a/apps/supervisor/Containerfile
+++ b/apps/supervisor/Containerfile
@@ -1,4 +1,4 @@
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS node-24-alpine
+FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS node-24-alpine
 
 WORKDIR /app
 
diff --git a/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx b/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
index b5be2f10f89..d70e6039f29 100644
--- a/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
+++ b/apps/webapp/app/components/alerts/LegacyAlertsSection.tsx
@@ -1,4 +1,3 @@
-import { BellAlertIcon } from "@heroicons/react/20/solid";
 import { TrashIcon } from "~/assets/icons/TrashIcon";
 import { useState } from "react";
 import { AgentIcon } from "~/components/dashboard-agent/agent-identity";
@@ -49,7 +48,6 @@ export function LegacyAlertsSection({
   canWrite = true,
   canDelete = true,
   replacing = false,
-  manualReplace = false,
 }: {
   channels: LegacyAlertChannelRow[];
   onReplace: (row: LegacySubscriptionRow) => void;
@@ -57,7 +55,6 @@ export function LegacyAlertsSection({
   canWrite?: boolean;
   canDelete?: boolean;
   replacing?: boolean;
-  manualReplace?: boolean;
 }) {
   const [deleting, setDeleting] = useState<LegacySubscriptionRow | undefined>();
   const rows = legacySubscriptions(channels);
@@ -90,9 +87,8 @@ export function LegacyAlertsSection({
               <TableCell actionClassName="py-1.5">
                 {row.migration.kind === "replace" ? (
                   <Button
-                    variant={manualReplace ? "secondary/small" : "ask-trigger/small"}
-                    LeadingIcon={manualReplace ? BellAlertIcon : AgentIcon}
-                    leadingIconClassName={manualReplace ? "text-alerts" : undefined}
+                    variant="ask-trigger/small"
+                    LeadingIcon={AgentIcon}
                     className="whitespace-nowrap"
                     disabled={replacing || !(canWrite && (row.canWrite ?? true))}
                     onClick={() => onReplace(row)}
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts b/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
deleted file mode 100644
index e404edc6bd9..00000000000
--- a/apps/webapp/app/components/alerts/ManualAlertCreation.dom.test.ts
+++ /dev/null
@@ -1,256 +0,0 @@
-// @vitest-environment jsdom
-import type * as RemixReactModule from "@remix-run/react";
-import { createElement, useState, type ComponentProps, type ReactNode } from "react";
-import { act } from "react-dom/test-utils";
-import { createRoot, type Root } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
-import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
-import type { DraftPrefillParams } from "~/components/dashboard-agent/alert-creation/flow-state";
-import { ManualAlertCreationDock } from "./ManualAlertCreation";
-
-const CURRENT_ENV_CHANNELS = [{ id: "ch1", name: "Ops webhook", type: "WEBHOOK" }];
-const PROJECT_CHANNELS = [
-  ...CURRENT_ENV_CHANNELS,
-  { id: "ch_prod", name: "Prod pager", type: "WEBHOOK" },
-];
-
-vi.mock("@remix-run/react", async (importOriginal) => ({
-  ...(await importOriginal<typeof RemixReactModule>()),
-  useInRouterContext: () => false,
-  Link: ({ to, children }: { to: string; children: ReactNode }) =>
-    createElement("a", { href: to }, children),
-  useNavigate: () => vi.fn(),
-  useLocation: () => ({ pathname: "/", search: "" }),
-  useFetcher: () => {
-    const [url, setUrl] = useState<string>();
-    return {
-      data: url?.startsWith("/resources/alerts/channels")
-        ? {
-            channels: url.includes("environmentId=") ? CURRENT_ENV_CHANNELS : PROJECT_CHANNELS,
-            canWrite: true,
-          }
-        : undefined,
-      load: setUrl,
-    };
-  },
-}));
-vi.mock("~/hooks/useOrganizations", () => ({
-  useOptionalOrganization: () => ({ slug: "org", id: "org1" }),
-  useOrganization: () => ({ slug: "org", id: "org1" }),
-}));
-vi.mock("~/hooks/useProject", () => ({
-  useOptionalProject: () => ({ slug: "proj", id: "proj1" }),
-  useProject: () => ({ slug: "proj", id: "proj1" }),
-}));
-vi.mock("~/hooks/useEnvironment", () => ({
-  useOptionalEnvironment: () => ({ slug: "prod", id: "env1", type: "PRODUCTION" }),
-  useEnvironment: () => ({ slug: "prod", id: "env1", type: "PRODUCTION" }),
-}));
-vi.mock("~/hooks/useTypedMatchData", () => ({ useTypedMatchesData: () => undefined }));
-vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
-
-const fetchMock = vi.fn(async (url: string | URL | Request) => {
-  if (String(url) === "/resources/alerts/create") {
-    return new Response(JSON.stringify({ ok: true, alertId: "a1" }));
-  }
-  if (String(url).includes("/alerts/legacy?_data=")) {
-    return new Response(
-      JSON.stringify({ count: 1, message: "Created 1 alert", legacyRemaining: false })
-    );
-  }
-  return new Response("{}");
-});
-
-Element.prototype.scrollIntoView ??= () => {};
-globalThis.ResizeObserver ??= class {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-} as unknown as typeof ResizeObserver;
-
-const fieldset = (step: string) =>
-  document.querySelector<HTMLFieldSetElement>(`fieldset[data-step="${step}"]`);
-const combobox = (step: string) =>
-  fieldset(step)?.querySelector<HTMLButtonElement>("button[role=combobox]") ?? null;
-const popover = (select: HTMLElement) =>
-  document.getElementById(select.getAttribute("aria-controls") ?? "");
-const options = (select: HTMLElement) =>
-  Array.from(popover(select)?.querySelectorAll<HTMLElement>("[role=option]") ?? []);
-const click = (el: HTMLElement) => act(() => el.click());
-const open = (select: HTMLElement) => {
-  act(() => select.focus());
-  act(() => select.click());
-};
-function pick(step: string, label: string) {
-  const select = combobox(step)!;
-  open(select);
-  const found = options(select).find((o) => o.textContent === label);
-  if (!found) throw new Error(`no ${label}: ${options(select).map((o) => o.textContent)}`);
-  click(found);
-}
-const checkbox = (step: string, label: string) =>
-  Array.from(fieldset(step)!.querySelectorAll<HTMLLabelElement>("[data-checkbox-list] label"))
-    .find((l) => l.textContent === label)!
-    .querySelector<HTMLInputElement>("input")!;
-const button = (label: string) =>
-  Array.from(document.querySelectorAll<HTMLButtonElement>("button")).find(
-    (b) => b.textContent === label
-  );
-
-let container: HTMLElement;
-let root: Root;
-const onCreated = vi.fn();
-const onClose = vi.fn();
-const onReplaced = vi.fn();
-
-function render(prefill: DraftPrefillParams) {
-  act(() =>
-    root.render(
-      createElement(
-        OperatingSystemContextProvider,
-        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
-        createElement(
-          ShortcutsProvider,
-          null,
-          createElement(
-            ManualAlertCreationDock,
-            {
-              open: true,
-              prefill,
-              alertDetailPath: (id: string) => `/alerts/${id}`,
-              onCreated,
-              onReplaced,
-              onClose,
-            },
-            createElement("div", { "data-testid": "page" }, "page")
-          )
-        )
-      )
-    )
-  );
-}
-
-describe("ManualAlertCreation", () => {
-  beforeEach(() => {
-    fetchMock.mockClear();
-    vi.stubGlobal("fetch", fetchMock);
-    container = document.createElement("div");
-    document.body.appendChild(container);
-    root = createRoot(container);
-  });
-  afterEach(() => {
-    act(() => root.unmount());
-    container.remove();
-    vi.unstubAllGlobals();
-  });
-
-  it("walks the real form, posts the alert and reports the created id", async () => {
-    vi.useFakeTimers({ toFake: ["Date"], now: new Date("2026-01-01T00:00:00.000Z") });
-    try {
-      render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
-      pick("condition", "50");
-      pick("expiry", "For 24 hours");
-      click(checkbox("notifiers", "Ops webhook"));
-      click(button("Done")!);
-      await act(async () => button("Create alert")!.click());
-      const calls = fetchMock.mock.calls.filter(([url]) => url === "/resources/alerts/create");
-      expect(calls).toHaveLength(1);
-      const init = (calls[0] as unknown as [string, RequestInit])[1];
-      expect(init.method).toBe("POST");
-      expect(JSON.parse(init.body as string)).toEqual({
-        organizationId: "org1",
-        projectId: "proj1",
-        environmentId: "env1",
-        name: "Failed runs above 50 on x",
-        expiry: "24h",
-        form: {
-          capabilityKey: "runs.failed",
-          scopeType: "task",
-          scopeValue: "x",
-          conditionKind: "threshold",
-          operator: ">",
-          value: 50,
-          windowMinutes: 10,
-          expiresAt: "2026-01-02T00:00:00.000Z",
-          notifierChannelIds: ["ch1"],
-        },
-      });
-      expect(onCreated).toHaveBeenCalledWith("a1");
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  it("starts a fresh draft when the prefill changes", () => {
-    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
-    pick("condition", "50");
-    expect(combobox("condition")!.textContent).toBe("50");
-    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "y" });
-    expect(combobox("condition")!.textContent).toBe("Select…");
-    pick("condition", "50");
-    expect(fieldset("scope")!.textContent).toContain("y");
-    expect(fieldset("scope")!.textContent).not.toContain("x");
-  });
-
-  it("docks beside the page with the panel header and no chat controls", () => {
-    render({ area: "runs", capability: "runs.failed", scope: "task", scopeValue: "x" });
-    expect(document.querySelector("[data-testid=page]")).not.toBeNull();
-    const panel = document.querySelector("[data-testid=manual-alert-panel]")!;
-    const title = Array.from(panel.querySelectorAll("span")).find(
-      (span) => span.textContent === "New alert"
-    )!;
-    expect(title.className).toContain("truncate text-sm font-medium text-text-bright");
-    expect(panel.querySelector("[aria-label^='Change layout']")).toBeNull();
-    expect(panel.querySelector("[aria-haspopup]:not([role=combobox])")).toBeNull();
-    expect(panel.querySelector("[data-testid=manual-mode-toggle]")).toBeNull();
-    expect(panel.querySelector("textarea")).toBeNull();
-    click(panel.querySelector<HTMLButtonElement>("[aria-label='Close (Esc)']")!);
-    expect(onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("replaces a legacy subscription through the legacy route", async () => {
-    render({
-      capability: "runs.failed",
-      scope: "all",
-      replace: {
-        channelId: "ch_prod",
-        channelName: "Prod pager",
-        alertType: "TASK_RUN",
-        environments: [
-          { id: "env1", type: "PRODUCTION", slug: "prod", branchName: null },
-          { id: "env2", type: "DEVELOPMENT", slug: "dev", branchName: null },
-        ],
-      },
-    });
-    pick("expiry", "No expiry");
-    expect(checkbox("notifiers", "Prod pager").checked).toBe(true);
-    click(button("Done")!);
-    await act(async () => button("Create alert")!.click());
-    const calls = fetchMock.mock.calls.filter(([url]) => String(url).includes("/alerts/legacy"));
-    expect(calls).toHaveLength(1);
-    const [url, init] = calls[0] as unknown as [string, RequestInit];
-    expect(url).toBe(
-      `/orgs/org/projects/proj/env/prod/alerts/legacy?_data=${encodeURIComponent(
-        "routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy"
-      )}`
-    );
-    expect(init.method).toBe("POST");
-    expect(Object.fromEntries(init.body as FormData)).toEqual({
-      intent: "replace",
-      channelId: "ch_prod",
-      alertType: "TASK_RUN",
-      environmentIds: "env1,env2",
-      value: "0",
-      windowMinutes: "10",
-      scopeType: "all",
-      notifierChannelIds: "ch_prod",
-    });
-    expect(fetchMock.mock.calls.some(([u]) => u === "/resources/alerts/create")).toBe(false);
-    expect(onReplaced).toHaveBeenCalledWith({
-      count: 1,
-      message: "Created 1 alert",
-      legacyRemaining: false,
-    });
-  });
-});
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreation.tsx b/apps/webapp/app/components/alerts/ManualAlertCreation.tsx
deleted file mode 100644
index 6e71fcde56b..00000000000
--- a/apps/webapp/app/components/alerts/ManualAlertCreation.tsx
+++ /dev/null
@@ -1,272 +0,0 @@
-import { useFetcher } from "@remix-run/react";
-import { type ReactNode, useCallback, useEffect, useRef, useState } from "react";
-import type { PanelHandle } from "@window-splitter/react";
-import { alertChannelsResourcePath } from "~/components/alerts/alertChannelsResourcePath";
-import { CreationChatShell } from "~/components/alerts/CreationChatShell";
-import {
-  CREATE_ALERT_PATH,
-  createAlertRequestBody,
-  replaceRequestBody,
-} from "~/components/alerts/createAlertRequest";
-import { LEGACY_ALERTS_ROUTE_ID } from "~/components/alerts/legacyAlertChannels";
-import type { AlertChannel } from "~/components/dashboard-agent/alert-creation/CreationFlow";
-import {
-  useCreationFlowState,
-  type FlowAnswers,
-} from "~/components/dashboard-agent/alert-creation";
-import {
-  prefillToAnswers,
-  type DraftPrefillParams,
-} from "~/components/dashboard-agent/alert-creation/flow-state";
-import { ManualCreationForm } from "~/components/dashboard-agent/alert-creation/ManualCreationForm";
-import { environmentFullTitle } from "~/components/environments/EnvironmentLabel";
-import {
-  DashboardPanelHeader,
-  PANEL_TITLE_CLASS,
-} from "~/components/dashboard-agent/DashboardPanelChrome";
-import {
-  createDockedWidthController,
-  type DockedWidthAction,
-} from "~/components/dashboard-agent/docked-width";
-import { escapeClosesPanel, ownsEscape } from "~/components/dashboard-agent/panel-escape";
-import {
-  AGENT_PANEL_DEFAULT_WIDTH,
-  AGENT_PANEL_MAX_WIDTH,
-  AGENT_PANEL_MIN_WIDTH,
-  readAgentPanelWidth,
-  writeAgentPanelWidth,
-} from "~/components/dashboard-agent/panel-layout";
-import {
-  ResizableHandle,
-  ResizablePanel,
-  ResizablePanelGroup,
-} from "~/components/primitives/Resizable";
-import { useEnvironment } from "~/hooks/useEnvironment";
-import { useFeatures } from "~/hooks/useFeatures";
-import { useOrganization } from "~/hooks/useOrganizations";
-import { useProject } from "~/hooks/useProject";
-import { cn } from "~/utils/cn";
-import { v3ProjectLegacyAlertsPath } from "~/utils/pathBuilder";
-
-function prefillAnswers(prefill: DraftPrefillParams): FlowAnswers {
-  const base =
-    prefill.area || prefill.capability || prefill.scope || prefill.replace
-      ? prefillToAnswers(prefill)
-      : {};
-  return { notifiers: [], ...base };
-}
-
-type ReplacedResult = { legacyRemaining?: boolean; message?: string };
-
-function ManualAlertCreation({
-  prefill,
-  alertDetailPath,
-  onCreated,
-  onReplaced,
-}: {
-  prefill: DraftPrefillParams;
-  alertDetailPath: (alertId: string) => string;
-  onCreated: (alertId: string | undefined) => void;
-  onReplaced?: (result: ReplacedResult) => void;
-}) {
-  const organization = useOrganization();
-  const project = useProject();
-  const environment = useEnvironment();
-  const { queueMetricsEnabled } = useFeatures();
-  const [initialAnswers] = useState(() => prefillAnswers(prefill));
-  const [resetKey, setResetKey] = useState(0);
-
-  const onSubmit = useCallback(
-    async (answers: FlowAnswers) => {
-      try {
-        if (answers.replace) {
-          const resp = await fetch(
-            `${v3ProjectLegacyAlertsPath(organization, project, environment)}?_data=${encodeURIComponent(LEGACY_ALERTS_ROUTE_ID)}`,
-            { method: "POST", body: replaceRequestBody(answers) }
-          );
-          if (!resp.ok) return false;
-          onReplaced?.((await resp.json()) as ReplacedResult);
-          return true;
-        }
-        const resp = await fetch(CREATE_ALERT_PATH, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(
-            createAlertRequestBody(
-              {
-                organizationId: organization.id,
-                projectId: project.id,
-                environmentId: environment.id,
-              },
-              answers
-            )
-          ),
-        });
-        if (!resp.ok) return false;
-        const data = (await resp.json()) as { alertId?: string };
-        onCreated(data.alertId);
-        return data.alertId ? { alertId: data.alertId } : true;
-      } catch {
-        return false;
-      }
-    },
-    [organization, project, environment, onCreated, onReplaced]
-  );
-  const flow = useCreationFlowState(onSubmit, initialAnswers, resetKey);
-
-  const channelsFetcher = useFetcher<{
-    channels: AlertChannel[];
-    canWrite?: boolean;
-    limits?: { used: number; limit: number };
-  }>();
-  const channelsPath = alertChannelsResourcePath(
-    project.id,
-    false,
-    prefill.replace ? undefined : environment.id
-  );
-  useEffect(() => {
-    channelsFetcher.load(channelsPath);
-  }, [channelsPath]); // eslint-disable-line react-hooks/exhaustive-deps -- fetcher is stable
-  const limits = channelsFetcher.data?.limits;
-
-  return (
-    <ManualCreationForm
-      flow={flow}
-      channels={channelsFetcher.data?.channels ?? []}
-      addChannel={{
-        projectId: project.id,
-        canWrite: channelsFetcher.data?.canWrite ?? false,
-        atLimit: limits ? limits.used >= limits.limit : false,
-        onCreated: () => channelsFetcher.load(channelsPath),
-      }}
-      emptyAreas={queueMetricsEnabled ? [] : ["queues"]}
-      onStartOver={() => setResetKey((key) => key + 1)}
-      environmentTitle={environmentFullTitle(environment)}
-      alertDetailPath={flow.createdAlertId ? alertDetailPath(flow.createdAlertId) : undefined}
-    />
-  );
-}
-
-/* oxlint-disable jsx-a11y/no-static-element-interactions -- Escape bubbles from focused controls inside the panel. */
-function ManualAlertCreationPanel({
-  prefill,
-  alertDetailPath,
-  onCreated,
-  onReplaced,
-  onClose,
-}: {
-  prefill: DraftPrefillParams;
-  alertDetailPath: (alertId: string) => string;
-  onCreated: (alertId: string | undefined) => void;
-  onReplaced?: (result: ReplacedResult) => void;
-  onClose: () => void;
-}) {
-  const environment = useEnvironment();
-  const panelRef = useRef<HTMLDivElement | null>(null);
-  return (
-    <div
-      ref={panelRef}
-      data-testid="manual-alert-panel"
-      className="flex h-full flex-col bg-background-bright max-sm:fixed max-sm:inset-0 max-sm:z-40"
-      onKeyDown={(event) => {
-        if (
-          !escapeClosesPanel({
-            key: event.key,
-            defaultPrevented: event.defaultPrevented,
-            targetInsidePanel: panelRef.current?.contains(event.target as Node) ?? false,
-            targetInDialog: Boolean((event.target as Element).closest?.("[data-dialog]")),
-            targetExpanded: ownsEscape(event.target as Element),
-          })
-        )
-          return;
-        event.preventDefault();
-        onClose();
-      }}
-    >
-      <DashboardPanelHeader
-        title={<span className={cn("px-1", PANEL_TITLE_CLASS)}>New alert</span>}
-        onClose={onClose}
-      />
-      <CreationChatShell placement="docked" title="New alert">
-        <div className="min-h-0 flex-1 overflow-y-auto p-3">
-          <ManualAlertCreation
-            key={`${environment.id}:${JSON.stringify(prefill)}`}
-            prefill={prefill}
-            alertDetailPath={alertDetailPath}
-            onCreated={onCreated}
-            onReplaced={onReplaced}
-          />
-        </div>
-      </CreationChatShell>
-    </div>
-  );
-}
-
-/* oxlint-enable jsx-a11y/no-static-element-interactions */
-
-export function ManualAlertCreationDock({
-  open,
-  prefill,
-  alertDetailPath,
-  onCreated,
-  onReplaced,
-  onClose,
-  children,
-}: {
-  open: boolean;
-  prefill: DraftPrefillParams;
-  alertDetailPath: (alertId: string) => string;
-  onCreated: (alertId: string | undefined) => void;
-  onReplaced?: (result: ReplacedResult) => void;
-  onClose: () => void;
-  children: ReactNode;
-}) {
-  const panelHandle = useRef<PanelHandle>(null);
-  const dockedWidth = useRef(createDockedWidthController());
-  const runWidthAction = useCallback((action: DockedWidthAction) => {
-    if (action.type === "apply") panelHandle.current?.setSize(`${action.width}px`);
-    if (action.type === "persist") writeAgentPanelWidth(action.width);
-  }, []);
-  useEffect(() => {
-    const controller = dockedWidth.current;
-    runWidthAction(
-      open
-        ? controller.dock(readAgentPanelWidth(), panelHandle.current?.getPixelSize())
-        : controller.undock()
-    );
-  }, [open, runWidthAction]);
-
-  if (!open) return children;
-
-  return (
-    <ResizablePanelGroup orientation="horizontal" className="h-full min-h-0">
-      <ResizablePanel id="dashboard-content" min="320px">
-        <div className="h-full overflow-hidden">{children}</div>
-      </ResizablePanel>
-      <ResizableHandle
-        id="dashboard-agent-handle"
-        onDragEnd={() =>
-          runWidthAction(dockedWidth.current.dragEnd(panelHandle.current?.getPixelSize()))
-        }
-      />
-      <ResizablePanel
-        id="dashboard-agent-panel"
-        handle={panelHandle}
-        onResize={({ pixel }: { pixel: number }) =>
-          runWidthAction(dockedWidth.current.resize(pixel))
-        }
-        default={`${AGENT_PANEL_DEFAULT_WIDTH}px`}
-        min={`${AGENT_PANEL_MIN_WIDTH}px`}
-        max={`${AGENT_PANEL_MAX_WIDTH}px`}
-      >
-        <ManualAlertCreationPanel
-          prefill={prefill}
-          alertDetailPath={alertDetailPath}
-          onCreated={onCreated}
-          onReplaced={onReplaced}
-          onClose={onClose}
-        />
-      </ResizablePanel>
-    </ResizablePanelGroup>
-  );
-}
diff --git a/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts b/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
deleted file mode 100644
index 19925fbde16..00000000000
--- a/apps/webapp/app/components/alerts/ManualAlertCreationDock.dom.test.ts
+++ /dev/null
@@ -1,159 +0,0 @@
-// @vitest-environment jsdom
-import type * as WindowSplitter from "@window-splitter/react";
-import type { PanelHandle } from "@window-splitter/react";
-import { createElement, type ComponentProps } from "react";
-import { createRoot, type Root } from "react-dom/client";
-import { act } from "react-dom/test-utils";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  AGENT_PANEL_DEFAULT_WIDTH,
-  readAgentPanelWidth,
-  writeAgentPanelWidth,
-} from "~/components/dashboard-agent/panel-layout";
-import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
-import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
-import { ManualAlertCreationDock } from "./ManualAlertCreation";
-
-const agentPanel = vi.hoisted(() => ({ handle: null as PanelHandle | null }));
-
-vi.mock("@window-splitter/react", async (importOriginal) => {
-  const original = await importOriginal<typeof WindowSplitter>();
-  return {
-    ...original,
-    Panel: (props: ComponentProps<typeof original.Panel>) =>
-      createElement(original.Panel, {
-        ...props,
-        handle: (handle: PanelHandle | null) => {
-          if (props.id === "dashboard-agent-panel") agentPanel.handle = handle;
-          const ref = props.handle;
-          if (typeof ref === "function") ref(handle);
-          else if (ref) (ref as { current: PanelHandle | null }).current = handle;
-        },
-      }),
-  };
-});
-vi.mock("@remix-run/react", () => ({
-  useFetcher: () => ({ data: undefined, load: () => {} }),
-}));
-vi.mock("~/hooks/useTypedMatchData", () => ({ useTypedMatchesData: () => undefined }));
-vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o", id: "org1" }) }));
-vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p", id: "proj1" }) }));
-vi.mock("~/hooks/useEnvironment", () => ({
-  useEnvironment: () => ({ slug: "e", id: "env1", type: "PRODUCTION" }),
-}));
-vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
-vi.mock("~/components/dashboard-agent/alert-creation/ManualCreationForm", () => ({
-  ManualCreationForm: () => null,
-}));
-
-const GROUP_WIDTH = 1400;
-const GROUP_HEIGHT = 800;
-
-type Observed = { element: Element; callback: ResizeObserverCallback };
-let observed: Observed[] = [];
-let container: HTMLDivElement;
-let root: Root;
-let originalObserver: typeof ResizeObserver | undefined;
-let originalRect: typeof Element.prototype.getBoundingClientRect;
-
-class StubResizeObserver {
-  constructor(private callback: ResizeObserverCallback) {}
-  observe(element: Element) {
-    observed.push({ element, callback: this.callback });
-  }
-  unobserve() {}
-  disconnect() {
-    observed = observed.filter((entry) => entry.callback !== this.callback);
-  }
-}
-
-function reportSizes(sizes: Record<string, number>) {
-  act(() => {
-    for (const { element, callback } of [...observed]) {
-      const id = element.getAttribute("data-splitter-id");
-      if (!id) continue;
-      const width = sizes[id];
-      if (width === undefined) continue;
-      callback(
-        [
-          {
-            target: element,
-            borderBoxSize: [{ inlineSize: width, blockSize: GROUP_HEIGHT }],
-            contentRect: { width, height: GROUP_HEIGHT },
-          } as unknown as ResizeObserverEntry,
-        ],
-        {} as ResizeObserver
-      );
-    }
-  });
-}
-
-function mount() {
-  act(() =>
-    root.render(
-      createElement(
-        OperatingSystemContextProvider,
-        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
-        createElement(
-          ShortcutsProvider,
-          null,
-          createElement(
-            ManualAlertCreationDock,
-            {
-              open: true,
-              prefill: {},
-              alertDetailPath: (id: string) => `/alerts/${id}`,
-              onCreated: () => {},
-              onClose: () => {},
-            },
-            createElement("div", null, "page")
-          )
-        )
-      )
-    )
-  );
-}
-
-const panelColumn = () =>
-  container.querySelector<HTMLElement>('[data-splitter-id="dashboard-agent-panel"]')!;
-describe("ManualAlertCreationDock, rendered", () => {
-  beforeEach(() => {
-    observed = [];
-    originalObserver = globalThis.ResizeObserver;
-    globalThis.ResizeObserver = StubResizeObserver as unknown as typeof ResizeObserver;
-    originalRect = Element.prototype.getBoundingClientRect;
-    Element.prototype.getBoundingClientRect = () =>
-      ({ width: GROUP_WIDTH, height: GROUP_HEIGHT, x: 0, y: 0, top: 0, left: 0 }) as DOMRect;
-    window.localStorage.clear();
-    container = document.createElement("div");
-    document.body.appendChild(container);
-    root = createRoot(container);
-  });
-
-  afterEach(() => {
-    act(() => root.unmount());
-    container.remove();
-    Element.prototype.getBoundingClientRect = originalRect;
-    if (originalObserver) globalThis.ResizeObserver = originalObserver;
-  });
-
-  it("restores the saved width on the first size report", () => {
-    writeAgentPanelWidth(500);
-    mount();
-    expect(panelColumn()).not.toBeNull();
-    expect(Math.round(agentPanel.handle?.getPixelSize() ?? 0)).not.toBe(500);
-    reportSizes({
-      "dashboard-content": GROUP_WIDTH - AGENT_PANEL_DEFAULT_WIDTH - 3,
-      "dashboard-agent-panel": AGENT_PANEL_DEFAULT_WIDTH,
-    });
-    expect(Math.round(agentPanel.handle?.getPixelSize() ?? 0)).toBe(500);
-    expect(readAgentPanelWidth()).toBe(500);
-  });
-
-  it("covers the full width below the sm breakpoint", () => {
-    mount();
-    const surface = container.querySelector("[data-testid=manual-alert-panel]")!;
-    expect(surface.className).toContain("max-sm:fixed");
-    expect(surface.className).toContain("max-sm:inset-0");
-  });
-});
diff --git a/apps/webapp/app/components/alerts/createAlertRequest.ts b/apps/webapp/app/components/alerts/createAlertRequest.ts
deleted file mode 100644
index b65ff29eaaf..00000000000
--- a/apps/webapp/app/components/alerts/createAlertRequest.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { EXPIRY_TOKEN_PATTERN } from "~/components/alerts/alertCreatedCard";
-import {
-  alertName,
-  defaultWindowMinutes,
-  resolveCapability,
-  type FlowAnswers,
-} from "~/components/dashboard-agent/alert-creation/flow-state";
-
-export const CREATE_ALERT_PATH = "/resources/alerts/create";
-
-function expiryToIso(exp: string | undefined): string | undefined {
-  if (!exp || exp === "none") return undefined;
-  const EVENT_HOURS: Record<string, number> = { deploy: 168, incident: 720 };
-  const hoursMatch = exp.match(/^(\d+)h$/);
-  const hours = hoursMatch ? Number(hoursMatch[1]) : EVENT_HOURS[exp];
-  if (hours) return new Date(Date.now() + hours * 3600_000).toISOString();
-  return Number.isNaN(Date.parse(exp)) ? undefined : new Date(exp).toISOString();
-}
-
-export function replaceRequestBody(answers: FlowAnswers): FormData {
-  const target = answers.replace!;
-  const expiresAt = expiryToIso(answers.expiry);
-  const body = new FormData();
-  body.set("intent", "replace");
-  body.set("channelId", target.channelId);
-  body.set("alertType", target.alertType);
-  body.set("environmentIds", (answers.environments ?? []).join(","));
-  body.set("value", answers.condition ?? "0");
-  if (answers.windowMinutes) body.set("windowMinutes", String(answers.windowMinutes));
-  if (expiresAt) body.set("expiresAt", expiresAt);
-  if (answers.scope) body.set("scopeType", answers.scope);
-  if (answers.scopeValue) body.set("scopeValue", answers.scopeValue);
-  body.set("notifierChannelIds", (answers.notifiers ?? []).filter((n) => n !== "chat").join(","));
-  return body;
-}
-
-export function createAlertRequestBody(
-  ids: { organizationId: string; projectId: string; environmentId: string },
-  answers: FlowAnswers
-) {
-  const kind = resolveCapability(answers.what)?.allowedKinds[0] ?? "threshold";
-  return {
-    organizationId: ids.organizationId,
-    projectId: ids.projectId,
-    environmentId: ids.environmentId,
-    name: alertName(answers),
-    expiry:
-      answers.expiry && EXPIRY_TOKEN_PATTERN.test(answers.expiry) ? answers.expiry : undefined,
-    form: {
-      capabilityKey: answers.what,
-      scopeType: answers.scope,
-      scopeValue: answers.scopeValue,
-      conditionKind: kind,
-      operator: kind === "threshold" ? ">" : undefined,
-      value: answers.condition ? Number(answers.condition) : undefined,
-      windowMinutes:
-        kind === "threshold"
-          ? (answers.windowMinutes ?? defaultWindowMinutes(answers.what))
-          : undefined,
-      quietWindowMinutes:
-        kind === "absence" && answers.condition ? Number(answers.condition) : undefined,
-      conditionParams:
-        kind === "state" && answers.conditionParams ? answers.conditionParams : undefined,
-      expiresAt: expiryToIso(answers.expiry),
-      notifierChannelIds: (answers.notifiers ?? []).filter((n) => n !== "chat"),
-    },
-  };
-}
diff --git a/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx b/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
index a6306ce1b4d..65522d876c8 100644
--- a/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
+++ b/apps/webapp/app/components/dashboard-agent/DashboardAgentHeader.tsx
@@ -1,4 +1,6 @@
 import { useEffect, useRef, useState } from "react";
+import { CrossIcon } from "~/assets/icons/CrossIcon";
+import { Button } from "~/components/primitives/Buttons";
 import {
   Popover,
   PopoverArrowTrigger,
@@ -6,6 +8,7 @@ import {
   PopoverMenuItem,
   PopoverTrigger,
 } from "~/components/primitives/Popover";
+import { ShortcutKey } from "~/components/primitives/ShortcutKey";
 import { SimpleTooltip } from "~/components/primitives/Tooltip";
 import type { Shortcut } from "~/hooks/useShortcutKeys";
 import { CHAT_MODE_OPTIONS } from "./chat-mode-options";
@@ -15,7 +18,6 @@ import {
   type DashboardAgentChat,
 } from "./DashboardAgentHistory";
 import { chatHistoryTriggerLabel } from "./header-labels";
-import { DashboardPanelHeader, PANEL_TITLE_CLASS } from "./DashboardPanelChrome";
 import type { DashboardAgentMode } from "./panel-layout";
 
 // Display only. The key is registered once, in `DashboardAgent`; registering it
@@ -169,67 +171,75 @@ export function DashboardAgentHeader({
   const [pendingDelete, setPendingDelete] = useState<DashboardAgentChat | null>(null);
 
   return (
-    <DashboardPanelHeader
-      title={
-        <>
-          <Popover
-            open={isHistoryOpen}
-            onOpenChange={(open) => {
-              setHistoryOpen(open);
-              if (open) {
-                setHistoryOpenedAt(Date.now());
-                onOpenHistory();
-              }
-            }}
-          >
-            <PopoverArrowTrigger
-              variant="minimal"
-              isOpen={isHistoryOpen}
-              overflowHidden
-              className="min-w-0"
-              aria-label={chatHistoryTriggerLabel(title)}
-              title={title}
-            >
-              <span className={PANEL_TITLE_CLASS}>{title}</span>
-            </PopoverArrowTrigger>
-            <PopoverContent
-              // `min-w-0` over the popover's own `min-w-max`, which would stretch it to the longest
-              // title instead of truncating at this width.
-              className="w-72 min-w-0 max-w-(--radix-popover-content-available-width) p-0"
-              align="start"
-            >
-              {historyOpenedAt === null ? null : (
-                <DashboardAgentHistoryMenu
-                  chats={chats}
-                  currentChatId={currentChatId}
-                  now={historyOpenedAt}
-                  onSelect={(chatId) => {
-                    setHistoryOpen(false);
-                    onSelectChat(chatId);
-                  }}
-                  onRequestDelete={(chat) => {
-                    setHistoryOpen(false);
-                    setPendingDelete(chat);
-                  }}
-                />
-              )}
-            </PopoverContent>
-          </Popover>
+    <div className="flex h-10 shrink-0 items-center justify-between gap-2 border-b border-grid-bright px-2">
+      <Popover
+        open={isHistoryOpen}
+        onOpenChange={(open) => {
+          setHistoryOpen(open);
+          if (open) {
+            setHistoryOpenedAt(Date.now());
+            onOpenHistory();
+          }
+        }}
+      >
+        <PopoverArrowTrigger
+          variant="minimal"
+          isOpen={isHistoryOpen}
+          overflowHidden
+          className="min-w-0"
+          aria-label={chatHistoryTriggerLabel(title)}
+          title={title}
+        >
+          <span className="truncate text-sm font-medium text-text-bright">{title}</span>
+        </PopoverArrowTrigger>
+        <PopoverContent
+          // `min-w-0` over the popover's own `min-w-max`, which would stretch it to the longest
+          // title instead of truncating at this width.
+          className="w-72 min-w-0 max-w-(--radix-popover-content-available-width) p-0"
+          align="start"
+        >
+          {historyOpenedAt === null ? null : (
+            <DashboardAgentHistoryMenu
+              chats={chats}
+              currentChatId={currentChatId}
+              now={historyOpenedAt}
+              onSelect={(chatId) => {
+                setHistoryOpen(false);
+                onSelectChat(chatId);
+              }}
+              onRequestDelete={(chat) => {
+                setHistoryOpen(false);
+                setPendingDelete(chat);
+              }}
+            />
+          )}
+        </PopoverContent>
+      </Popover>
+
+      <DashboardAgentDeleteChatDialog
+        chat={pendingDelete}
+        onOpenChange={(open) => !open && setPendingDelete(null)}
+        onConfirm={onDeleteChat}
+      />
 
-          <DashboardAgentDeleteChatDialog
-            chat={pendingDelete}
-            onOpenChange={(open) => !open && setPendingDelete(null)}
-            onConfirm={onDeleteChat}
-          />
-        </>
-      }
-      actions={
-        <>
-          {actions}
-          <ModeMenu mode={mode} onModeChange={onModeChange} />
-        </>
-      }
-      onClose={onClose}
-    />
+      <div className="flex shrink-0 items-center gap-1" data-agent-no-drag>
+        {actions}
+        <ModeMenu mode={mode} onModeChange={onModeChange} />
+        <Button
+          variant="minimal/small"
+          className="aspect-square h-6 p-1"
+          aria-label="Close (Esc)"
+          tooltipDelay={500}
+          tooltip={
+            <span className="flex items-center">
+              Close
+              <ShortcutKey shortcut={{ key: "esc" }} variant="medium" />
+            </span>
+          }
+          onClick={onClose}
+          LeadingIcon={<CrossIcon className="size-4 text-text-dimmed" />}
+        />
+      </div>
+    </div>
   );
 }
diff --git a/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx b/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
deleted file mode 100644
index 39e0af01ff4..00000000000
--- a/apps/webapp/app/components/dashboard-agent/DashboardPanelChrome.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import type { ReactNode } from "react";
-import { CrossIcon } from "~/assets/icons/CrossIcon";
-import { Button } from "~/components/primitives/Buttons";
-import { ShortcutKey } from "~/components/primitives/ShortcutKey";
-
-export const PANEL_TITLE_CLASS = "truncate text-sm font-medium text-text-bright";
-
-export function DashboardPanelHeader({
-  title,
-  actions,
-  onClose,
-}: {
-  title: ReactNode;
-  actions?: ReactNode;
-  onClose: () => void;
-}) {
-  return (
-    <div className="flex h-10 shrink-0 items-center justify-between gap-2 border-b border-grid-bright px-2">
-      {title}
-      <div className="flex shrink-0 items-center gap-1" data-agent-no-drag>
-        {actions}
-        <Button
-          variant="minimal/small"
-          className="aspect-square h-6 p-1"
-          aria-label="Close (Esc)"
-          tooltipDelay={500}
-          tooltip={
-            <span className="flex items-center">
-              Close
-              <ShortcutKey shortcut={{ key: "esc" }} variant="medium" />
-            </span>
-          }
-          onClick={onClose}
-          LeadingIcon={<CrossIcon className="size-4 text-text-dimmed" />}
-        />
-      </div>
-    </div>
-  );
-}
diff --git a/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx b/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
index d7a9a6e4872..34ef4a6ebbf 100644
--- a/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
+++ b/apps/webapp/app/components/environments/RegenerateApiKeyModal.tsx
@@ -11,7 +11,6 @@ import { Input } from "../primitives/Input";
 import { InputGroup } from "../primitives/InputGroup";
 import { Paragraph } from "../primitives/Paragraph";
 import { CheckboxWithLabel } from "../primitives/Checkbox";
-import { RadioGroup, RadioGroupItem } from "../primitives/RadioButton";
 import { Spinner } from "../primitives/Spinner";
 
 type ModalProps = {
@@ -76,7 +75,9 @@ const RegenerateApiKeyModalContent = ({
   return (
     <div className="flex flex-col items-center gap-y-4 pt-4">
       <Callout variant="warning">
-        {`A new API key will be issued for the ${title} environment. Choose what happens to the previous key.`}
+        {`A new API key will be issued for the ${title} environment. The previous key stays valid
+        for 24 hours so you can roll out the new key in your environment variables without downtime.
+        After 24 hours, the previous key stops working.`}
       </Callout>
       <fetcher.Form
         method="post"
@@ -84,24 +85,6 @@ const RegenerateApiKeyModalContent = ({
         className="mt-2 w-full"
       >
         <Fieldset className="w-full">
-          <InputGroup className="max-w-full">
-            <RadioGroup name="previousKey" defaultValue="grace" className="flex flex-col gap-2">
-              <RadioGroupItem
-                id="previousKey-grace"
-                value="grace"
-                variant="description"
-                label="Keep the previous key working for 24 hours"
-                description="Roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours."
-              />
-              <RadioGroupItem
-                id="previousKey-revoke"
-                value="revoke"
-                variant="description"
-                label="Revoke the previous key immediately"
-                description="Choose this if the key may have leaked. Deployments and services still using the previous key will fail until they are updated with the new key."
-              />
-            </RadioGroup>
-          </InputGroup>
           <InputGroup className="max-w-full">
             <Paragraph variant="small/bright">Enter this text below to confirm:</Paragraph>
             <Paragraph
diff --git a/apps/webapp/app/components/navigation/SideMenu.tsx b/apps/webapp/app/components/navigation/SideMenu.tsx
index 43f0163f4e0..f07f03dc0b7 100644
--- a/apps/webapp/app/components/navigation/SideMenu.tsx
+++ b/apps/webapp/app/components/navigation/SideMenu.tsx
@@ -346,7 +346,7 @@ export function SideMenu({
   const isFreeUser = currentPlan?.v3Subscription?.isPaying === false;
   const isAdmin = useHasAdminAccess();
   const isViewingAsUser = useIsViewingAsUser();
-  const { isManagedCloud, alertsConfigured } = useFeatures();
+  const { isManagedCloud } = useFeatures();
   const featureFlags = useFeatureFlags();
   const incidentStatus = useIncidentStatus();
   const isV3Project = project.engine === "V1";
@@ -749,7 +749,6 @@ export function SideMenu({
     project,
     environment,
     isAdmin,
-    alertsConfigured,
     featureFlags,
     isManagedCloud,
     dashboards: {
diff --git a/apps/webapp/app/components/navigation/sideMenuSections.tsx b/apps/webapp/app/components/navigation/sideMenuSections.tsx
index 0d90702addf..ea72c0438cb 100644
--- a/apps/webapp/app/components/navigation/sideMenuSections.tsx
+++ b/apps/webapp/app/components/navigation/sideMenuSections.tsx
@@ -81,7 +81,6 @@ export function buildSideMenuSections({
   project,
   environment,
   isAdmin,
-  alertsConfigured,
   featureFlags,
   isManagedCloud,
   dashboards,
@@ -90,7 +89,6 @@ export function buildSideMenuSections({
   project: ProjectForPath;
   environment: EnvironmentForPath;
   isAdmin: boolean;
-  alertsConfigured: boolean;
   featureFlags: {
     hasAiAccess?: boolean;
     hasQueryAccess?: boolean;
@@ -140,8 +138,7 @@ export function buildSideMenuSections({
   const showObservability =
     isAdmin || featureFlags.hasQueryAccess || featureFlags.hasLogsPageAccess;
   const alertsInObservability =
-    showObservability &&
-    computeCanUseAlertsList(featureFlags.alertsEnabled === true, isAdmin, alertsConfigured);
+    showObservability && computeCanUseAlertsList(featureFlags.alertsEnabled === true, isAdmin);
 
   if (showObservability) {
     staticSections.push({
diff --git a/apps/webapp/app/features.server.ts b/apps/webapp/app/features.server.ts
index db84b9d6352..3a0b1a79562 100644
--- a/apps/webapp/app/features.server.ts
+++ b/apps/webapp/app/features.server.ts
@@ -1,5 +1,4 @@
 import { env } from "./env.server";
-import { isAlertsConfigured } from "./v3/services/alerts/alertsConfigured.server";
 import { queueMetricsEnabled } from "./v3/services/alerts/offeredCapabilities.server";
 import { requestUrl } from "./utils/requestUrl.server";
 
@@ -8,7 +7,6 @@ export type TriggerFeatures = {
   hasPrivateConnections: boolean;
   queueMetricsQueryTables: boolean;
   queueMetricsEnabled: boolean;
-  alertsConfigured: boolean;
 };
 
 const MANAGED_CLOUD_HOSTS = ["cloud.trigger.dev", "test-cloud.trigger.dev", "internal.trigger.dev"];
@@ -36,7 +34,6 @@ function featuresForHost(host: string): TriggerFeatures {
     hasPrivateConnections: hasPrivateConnections(host),
     queueMetricsQueryTables: env.QUEUE_METRICS_QUERY_TABLES_VISIBLE === "1",
     queueMetricsEnabled: queueMetricsEnabled(),
-    alertsConfigured: isAlertsConfigured({ alertsEnabled: env.ALERTS_ENABLED }),
   };
 }
 
diff --git a/apps/webapp/app/hooks/useFeatures.ts b/apps/webapp/app/hooks/useFeatures.ts
index 844022c1fa5..b63994faab2 100644
--- a/apps/webapp/app/hooks/useFeatures.ts
+++ b/apps/webapp/app/hooks/useFeatures.ts
@@ -11,7 +11,6 @@ export function useFeatures(): TriggerFeatures {
       hasPrivateConnections: false,
       queueMetricsQueryTables: false,
       queueMetricsEnabled: true,
-      alertsConfigured: false,
     }
   );
 }
diff --git a/apps/webapp/app/models/api-key.server.ts b/apps/webapp/app/models/api-key.server.ts
index 7387d3d0ffd..41364196a7d 100644
--- a/apps/webapp/app/models/api-key.server.ts
+++ b/apps/webapp/app/models/api-key.server.ts
@@ -25,10 +25,6 @@ type RootApiKeyMutationInput = {
   environmentId: string;
 };
 
-type RegenerateApiKeyInput = RootApiKeyMutationInput & {
-  revokeImmediately?: boolean;
-};
-
 export class RootApiKeyNotVisibleError extends Error {
   constructor() {
     super("The root API key is no longer visible");
@@ -114,7 +110,7 @@ async function lockVisibleRootApiKeyEnvironment(
 }
 
 export async function regenerateApiKey(
-  { revokeImmediately = false, ...input }: RegenerateApiKeyInput,
+  input: RootApiKeyMutationInput,
   { prismaClient = prisma }: { prismaClient?: PrismaClient } = {}
 ) {
   const environment = await findRootApiKeyEnvironment(input, prismaClient);
@@ -136,15 +132,13 @@ export async function regenerateApiKey(
         },
       });
 
-      if (!revokeImmediately) {
-        await tx.revokedApiKey.create({
-          data: {
-            apiKey: currentEnvironment.apiKey,
-            runtimeEnvironmentId: environment.id,
-            expiresAt: revokedApiKeyExpiresAt,
-          },
-        });
-      }
+      await tx.revokedApiKey.create({
+        data: {
+          apiKey: currentEnvironment.apiKey,
+          runtimeEnvironmentId: environment.id,
+          expiresAt: revokedApiKeyExpiresAt,
+        },
+      });
 
       return { ...environment, apiKey: newApiKey, pkApiKey: newPkApiKey };
     }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
index 3f328c9f128..c2b8c277fcc 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.createPrefill.render.test.tsx
@@ -1,13 +1,10 @@
 // @vitest-environment jsdom
-import { act, createElement, type ReactNode } from "react";
+import { act, createElement } from "react";
 import { createRoot } from "react-dom/client";
 import { describe, expect, it, vi } from "vitest";
 
 const openCreateAlert = vi.fn();
-const navigate = vi.fn();
 let currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
-let agent: unknown = { openCreateAlert };
-let agentAvailable = true;
 
 vi.mock("@remix-run/react", () => ({
   Outlet: () => null,
@@ -21,54 +18,14 @@ vi.mock("@remix-run/react", () => ({
     hasMigratableLegacyAlerts: false,
     canWrite: true,
     canDelete: true,
-    agentAvailable,
   }),
   useSearchParams: () => [currentParams, vi.fn()],
-  useNavigate: () => navigate,
-  useFetcher: () => ({ load: vi.fn(), data: { channels: [], canWrite: true } }),
 }));
-vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o", id: "org1" }) }));
-vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p", id: "proj1" }) }));
-vi.mock("~/hooks/useEnvironment", () => ({
-  useEnvironment: () => ({ slug: "e", type: "PRODUCTION", id: "env1" }),
-}));
-vi.mock("~/hooks/useFeatures", () => ({ useFeatures: () => ({ queueMetricsEnabled: true }) }));
+vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o" }) }));
+vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p" }) }));
+vi.mock("~/hooks/useEnvironment", () => ({ useEnvironment: () => ({ slug: "e", type: "PROD" }) }));
 vi.mock("~/components/dashboard-agent/dashboardAgentLauncher", () => ({
-  useDashboardAgent: () => agent,
-}));
-vi.mock("~/components/primitives/Resizable", () => ({
-  ResizablePanelGroup: ({ children }: { children: ReactNode }) => children,
-  ResizablePanel: ({ children }: { children: ReactNode }) => children,
-  ResizableHandle: () => null,
-}));
-vi.mock("~/components/dashboard-agent/alert-creation/ManualCreationForm", () => ({
-  ManualCreationForm: ({ flow }: { flow: CreationFlowState }) =>
-    createElement(
-      "div",
-      { "data-testid": "manual-form", "data-answers": JSON.stringify(flow.answers) },
-      createElement(
-        "button",
-        {
-          type: "button",
-          "data-testid": "fill",
-          onClick: () =>
-            flow.patchAnswers({
-              ...flow.answers,
-              what: "runs.failed",
-              condition: "3",
-              windowMinutes: 10,
-              notifiers: ["ch1"],
-              expiry: "24h",
-            }),
-        },
-        "fill"
-      ),
-      createElement(
-        "button",
-        { type: "button", "data-testid": "create", onClick: () => flow.create() },
-        "create"
-      )
-    ),
+  useDashboardAgent: () => ({ openCreateAlert }),
 }));
 vi.mock("~/components/alerts/AlertsList", () => ({ AlertsList: () => null }));
 vi.mock("~/components/alerts/LegacyAlertsBanner", () => ({ LegacyAlertsBanner: () => null }));
@@ -79,15 +36,15 @@ vi.mock("~/components/dashboard-agent/WhenAgentUnavailable", () => ({
   WhenAgentUnavailable: () => null,
 }));
 vi.mock("~/components/layout/AppLayout", () => ({
-  PageContainer: ({ children }: { children: ReactNode }) => children,
-  PageBody: ({ children }: { children: ReactNode }) => children,
+  PageContainer: () => null,
+  PageBody: () => null,
 }));
 vi.mock("~/components/primitives/PageHeader", () => ({
   NavBar: () => null,
   PageAccessories: () => null,
   PageTitle: () => null,
 }));
-vi.mock("~/components/primitives/Buttons", () => ({ LinkButton: () => null, Button: () => null }));
+vi.mock("~/components/primitives/Buttons", () => ({ LinkButton: () => null }));
 vi.mock("~/components/alerts/hasLegacyAlerts.server", () => ({}));
 vi.mock("~/db.server", () => ({ prisma: {} }));
 vi.mock("~/models/message.server", () => ({}));
@@ -100,14 +57,11 @@ vi.mock("~/services/dashboardAgentDb.server", () => ({}));
 vi.mock("~/services/routeBuilders/dashboardBuilder", () => ({ dashboardLoader: () => ({}) }));
 vi.mock("~/services/rbac.server", () => ({}));
 vi.mock("~/services/session.server", () => ({}));
-vi.mock("~/services/impersonation.server", () => ({}));
-vi.mock("~/v3/canAccessDashboardAgent.server", () => ({}));
 vi.mock("~/v3/canUseAlertsList.server", () => ({}));
 vi.mock("~/v3/services/alerts/alertActions.server", () => ({}));
 vi.mock("~/v3/alertsWorker.server", () => ({}));
 vi.mock("~/v3/services/alerts/alertIdRouting", () => ({}));
 
-import type { CreationFlowState } from "~/components/dashboard-agent/alert-creation/CreationFlow";
 import Page from "./route";
 
 describe("alerts route ?create=1 prefill", () => {
@@ -140,55 +94,3 @@ describe("alerts route ?create=1 prefill", () => {
     act(() => root.unmount());
   });
 });
-
-describe("alerts route ?create=1 with the agent", () => {
-  it("does not open the manual sheet", () => {
-    agent = { openCreateAlert };
-    agentAvailable = true;
-    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
-    const container = document.createElement("div");
-    const root = createRoot(container);
-    act(() => root.render(createElement(Page)));
-    expect(container.querySelector("[data-testid=manual-alert-panel]")).toBeNull();
-    expect(container.querySelector("[data-testid=manual-form]")).toBeNull();
-    act(() => root.unmount());
-  });
-});
-
-describe("alerts route ?create=1 without the agent", () => {
-  it("opens the manual form seeded with the prefill", () => {
-    agent = null;
-    agentAvailable = false;
-    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
-    const container = document.createElement("div");
-    const root = createRoot(container);
-    act(() => root.render(createElement(Page)));
-    const form = container.querySelector("[data-testid=manual-form]");
-    expect(form).not.toBeNull();
-    expect(JSON.parse(form!.getAttribute("data-answers")!)).toMatchObject({
-      area: "runs",
-      scope: "task",
-      scopeValue: "x",
-    });
-    act(() => root.unmount());
-  });
-
-  it("navigates to the created alert", async () => {
-    agent = null;
-    agentAvailable = false;
-    currentParams = new URLSearchParams("create=1&area=runs&scope=task&scopeValue=x");
-    const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ alertId: "a1" }) }));
-    vi.stubGlobal("fetch", fetchMock);
-    const container = document.createElement("div");
-    const root = createRoot(container);
-    act(() => root.render(createElement(Page)));
-    act(() => (container.querySelector("[data-testid=fill]") as HTMLButtonElement).click());
-    await act(async () =>
-      (container.querySelector("[data-testid=create]") as HTMLButtonElement).click()
-    );
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(navigate).toHaveBeenCalledWith("/orgs/o/projects/p/env/e/alerts/a1");
-    vi.unstubAllGlobals();
-    act(() => root.unmount());
-  });
-});
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
index 6b79b5fbf12..1a4a08ffc7e 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx
@@ -1,6 +1,6 @@
 import { parseWithZod } from "@conform-to/zod/v4";
 import { BookOpenIcon } from "@heroicons/react/20/solid";
-import { Outlet, useLoaderData, useNavigate, useSearchParams } from "@remix-run/react";
+import { Outlet, useLoaderData, useSearchParams } from "@remix-run/react";
 import { type ActionFunctionArgs, defer, json, redirect } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { useEffect, useRef } from "react";
@@ -8,7 +8,6 @@ import { AlertsList } from "~/components/alerts/AlertsList";
 import { hasLegacyAlerts } from "~/components/alerts/hasLegacyAlerts.server";
 import { LegacyAlertChannelsPage } from "~/components/alerts/LegacyAlertChannelsPage";
 import { LegacyAlertsBanner } from "~/components/alerts/LegacyAlertsBanner";
-import { ManualAlertCreationDock } from "~/components/alerts/ManualAlertCreation";
 import { createAlertPrompt } from "~/components/dashboard-agent/investigate-prompts";
 import { useDashboardAgent } from "~/components/dashboard-agent/dashboardAgentLauncher";
 import {
@@ -40,9 +39,7 @@ import {
 import { resolveProjectAuthScope } from "~/services/projectAuthScope.server";
 import { dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { rbac } from "~/services/rbac.server";
-import { getImpersonationState } from "~/services/impersonation.server";
-import { hasAdminDisplayAccess, requireUserId } from "~/services/session.server";
-import { canAccessDashboardAgent } from "~/v3/canAccessDashboardAgent.server";
+import { requireUserId } from "~/services/session.server";
 import { canUseAlertsList } from "~/v3/canUseAlertsList.server";
 import {
   canAcrossEnvironments,
@@ -148,16 +145,6 @@ export const loader = dashboardLoader(
       return defer({ mode: "legacy" as const, canWrite, ...data }) as unknown as Response;
     }
 
-    const { isViewingAsUser } = await getImpersonationState(request, user.id);
-    const showAdminUi = hasAdminDisplayAccess({ ...user, isViewingAsUser });
-    const agentAvailable = await canAccessDashboardAgent({
-      userId: user.id,
-      isAdmin: showAdminUi && user.admin,
-      isImpersonating: showAdminUi && user.isImpersonating,
-      organizationSlug,
-      orgFeatureFlags: (project.organization.featureFlags as Record<string, unknown>) ?? {},
-    });
-
     const searchParams = new URL(request.url).searchParams;
     const listPresenter = new AlertsListPresenter();
     const {
@@ -183,7 +170,6 @@ export const loader = dashboardLoader(
       truncated,
       canWrite: ability.can("write", { type: "alerts", envType: environment.type }),
       canDelete: ability.can("delete", { type: "alerts", envType: environment.type }),
-      agentAvailable,
     }) as unknown as Response;
   }
 );
@@ -372,7 +358,6 @@ type NewLoaderData = {
   hasMigratableLegacyAlerts: boolean;
   canWrite: boolean;
   canDelete: boolean;
-  agentAvailable: boolean;
 };
 
 type LegacyLoaderData = {
@@ -398,7 +383,6 @@ export default function Page() {
         hasLegacyAlerts={data.hasLegacyAlerts}
         canWrite={data.canWrite}
         canDelete={data.canDelete}
-        agentAvailable={data.agentAvailable}
       />
     );
   }
@@ -415,7 +399,6 @@ function NewAlertsPage({
   hasLegacyAlerts,
   canWrite,
   canDelete,
-  agentAvailable,
 }: {
   alerts: NewLoaderData["alerts"];
   hasMigratableLegacyAlerts: boolean;
@@ -425,13 +408,11 @@ function NewAlertsPage({
   hasLegacyAlerts: boolean;
   canWrite: boolean;
   canDelete: boolean;
-  agentAvailable: boolean;
 }) {
   const organization = useOrganization();
   const project = useProject();
   const environment = useEnvironment();
   const agent = useDashboardAgent();
-  const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
   const wantCreate = searchParams.get("create") === "1";
   const listQuery = searchParams.toString();
@@ -469,64 +450,44 @@ function NewAlertsPage({
     setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true });
   }, [agent, setSearchParams]);
 
-  const manualCreate = wantCreate && !agentAvailable && !agent;
-  const alertPath = (alertId: string) => v3AlertPath(organization, project, environment, alertId);
-
   return (
-    <ManualAlertCreationDock
-      open={manualCreate}
-      prefill={{
-        area: asArea(searchParams.get("area") ?? undefined),
-        capability: searchParams.get("capability") ?? undefined,
-        scope: searchParams.get("scope") ?? undefined,
-        scopeValue: searchParams.get("scopeValue") ?? undefined,
-      }}
-      alertDetailPath={alertPath}
-      onCreated={(alertId) =>
-        alertId
-          ? navigate(alertPath(alertId))
-          : setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true })
-      }
-      onClose={() => setSearchParams((prev) => stripCreateSearchParams(prev), { replace: true })}
-    >
-      <PageContainer>
-        <NavBar>
-          <PageTitle title="Alerts" />
-          <PageAccessories>
-            <WhenAgentUnavailable>
-              <LinkButton
-                LeadingIcon={BookOpenIcon}
-                to={docsPath("v3/troubleshooting-alerts")}
-                variant="docs/small"
-              >
-                Alerts docs
-              </LinkButton>
-            </WhenAgentUnavailable>
-          </PageAccessories>
-        </NavBar>
-        <div className="grid grid-rows-[auto_1fr] overflow-hidden">
-          <LegacyAlertsBanner show={hasMigratableLegacyAlerts} />
-          <PageBody scrollable={false}>
-            <AlertsList
-              alerts={alerts}
-              newAlertPath={v3AlertCreatePath(organization, project, environment)}
-              newAlertPrompt={createAlertPrompt(environmentFullTitle(environment))}
-              alertPath={alertPath}
-              canWrite={canWrite}
-              canDelete={canDelete}
-              hasLegacyAlerts={hasLegacyAlerts}
-              channelsTo={`${v3ProjectAlertChannelsPath(organization, project, environment)}${
-                listQuery ? `?${listQuery}` : ""
-              }`}
-              legacyTo={v3ProjectLegacyAlertsPath(organization, project, environment)}
-              page={page}
-              totalPages={totalPages}
-              truncated={truncated}
-            />
-            <Outlet />
-          </PageBody>
-        </div>
-      </PageContainer>
-    </ManualAlertCreationDock>
+    <PageContainer>
+      <NavBar>
+        <PageTitle title="Alerts" />
+        <PageAccessories>
+          <WhenAgentUnavailable>
+            <LinkButton
+              LeadingIcon={BookOpenIcon}
+              to={docsPath("v3/troubleshooting-alerts")}
+              variant="docs/small"
+            >
+              Alerts docs
+            </LinkButton>
+          </WhenAgentUnavailable>
+        </PageAccessories>
+      </NavBar>
+      <div className="grid grid-rows-[auto_1fr] overflow-hidden">
+        <LegacyAlertsBanner show={hasMigratableLegacyAlerts} />
+        <PageBody scrollable={false}>
+          <AlertsList
+            alerts={alerts}
+            newAlertPath={v3AlertCreatePath(organization, project, environment)}
+            newAlertPrompt={createAlertPrompt(environmentFullTitle(environment))}
+            alertPath={(alertId) => v3AlertPath(organization, project, environment, alertId)}
+            canWrite={canWrite}
+            canDelete={canDelete}
+            hasLegacyAlerts={hasLegacyAlerts}
+            channelsTo={`${v3ProjectAlertChannelsPath(organization, project, environment)}${
+              listQuery ? `?${listQuery}` : ""
+            }`}
+            legacyTo={v3ProjectLegacyAlertsPath(organization, project, environment)}
+            page={page}
+            totalPages={totalPages}
+            truncated={truncated}
+          />
+          <Outlet />
+        </PageBody>
+      </div>
+    </PageContainer>
   );
 }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
deleted file mode 100644
index ac33226d861..00000000000
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.replace.render.test.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-// @vitest-environment jsdom
-import { act, createElement, type ComponentProps, type ReactNode } from "react";
-import { createRoot } from "react-dom/client";
-import { describe, expect, it, vi } from "vitest";
-import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
-import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
-import type { DraftPrefillParams } from "~/components/dashboard-agent/alert-creation/flow-state";
-
-const openCreateAlert = vi.fn();
-let agent: unknown = null;
-
-vi.mock("@remix-run/react", () => ({
-  useLoaderData: () => ({
-    legacyChannels: [
-      {
-        id: "ch1",
-        name: "Ops webhook",
-        channelKind: "Webhook",
-        enabled: true,
-        alertTypes: ["TASK_RUN"],
-        alertTypeLabels: ["Task run failure"],
-        environmentNames: ["production"],
-      },
-    ],
-    canWrite: true,
-    canDelete: true,
-    replaceEnvironments: {
-      ch1: [{ id: "env1", type: "PRODUCTION", slug: "prod", branchName: null }],
-    },
-  }),
-  useFetcher: () => ({ state: "idle", submit: vi.fn() }),
-  useNavigate: () => vi.fn(),
-  useRevalidator: () => ({ revalidate: vi.fn() }),
-}));
-vi.mock("~/hooks/useOrganizations", () => ({ useOrganization: () => ({ slug: "o" }) }));
-vi.mock("~/hooks/useProject", () => ({ useProject: () => ({ slug: "p" }) }));
-vi.mock("~/hooks/useEnvironment", () => ({ useEnvironment: () => ({ slug: "e" }) }));
-vi.mock("~/components/dashboard-agent/dashboardAgentLauncher", () => ({
-  useDashboardAgent: () => agent,
-}));
-vi.mock("~/components/alerts/ManualAlertCreation", () => ({
-  ManualAlertCreationDock: ({
-    open,
-    prefill,
-    children,
-  }: {
-    open: boolean;
-    prefill: DraftPrefillParams;
-    children: ReactNode;
-  }) => [
-    children,
-    open
-      ? createElement("div", { key: "dock", "data-testid": "dock" }, JSON.stringify(prefill))
-      : null,
-  ],
-}));
-vi.mock("~/components/layout/AppLayout", () => ({
-  PageContainer: ({ children }: { children: ReactNode }) => children,
-  PageBody: ({ children }: { children: ReactNode }) => children,
-}));
-vi.mock("~/components/primitives/PageHeader", () => ({
-  NavBar: () => null,
-  PageTitle: () => null,
-}));
-vi.mock("~/components/alerts/hasLegacyAlerts.server", () => ({}));
-vi.mock("~/models/message.server", () => ({}));
-vi.mock("~/models/project.server", () => ({}));
-vi.mock("~/models/runtimeEnvironment.server", () => ({}));
-vi.mock("~/presenters/v3/AlertChannelListPresenter.server", () => ({}));
-vi.mock("~/services/logger.server", () => ({}));
-vi.mock("~/services/projectAuthScope.server", () => ({}));
-vi.mock("~/services/routeBuilders/dashboardBuilder", () => ({
-  dashboardLoader: () => ({}),
-  dashboardAction: () => ({}),
-}));
-vi.mock("~/db.server", () => ({ prisma: {} }));
-vi.mock("~/services/dashboardAgentDb.server", () => ({}));
-vi.mock("@internal/dashboard-agent-db", () => ({}));
-vi.mock("~/v3/services/alerts/validateNotifierChannels.server", () => ({}));
-vi.mock("~/v3/services/common.server", () => ({ ServiceValidationError: class {} }));
-vi.mock("~/v3/services/alerts/deleteLegacySubscription.server", () => ({}));
-vi.mock("~/v3/services/dashboardResourceAccess.server", () => ({}));
-vi.mock("~/v3/services/alerts/replaceLegacySubscription.server", () => ({}));
-vi.mock("~/v3/canUseAlertsList.server", () => ({}));
-
-import Page from "./route";
-
-function renderPage() {
-  const container = document.createElement("div");
-  document.body.appendChild(container);
-  const root = createRoot(container);
-  act(() =>
-    root.render(
-      createElement(
-        OperatingSystemContextProvider,
-        { platform: "mac" } as ComponentProps<typeof OperatingSystemContextProvider>,
-        createElement(ShortcutsProvider, null, createElement(Page))
-      )
-    )
-  );
-  const replace = Array.from(container.querySelectorAll("button")).find(
-    (b) => b.textContent === "Replace with new Alert"
-  )!;
-  return { container, root, replace };
-}
-
-describe("legacy alerts replace without the agent", () => {
-  it("enables Replace with the Watch icon and opens the manual dock for the row", () => {
-    agent = null;
-    const { container, root, replace } = renderPage();
-    expect(replace.disabled).toBe(false);
-    expect(replace.querySelector("svg.text-alerts")).not.toBeNull();
-    expect(container.querySelector("[data-testid=dock]")).toBeNull();
-    act(() => replace.click());
-    const dock = container.querySelector("[data-testid=dock]");
-    expect(JSON.parse(dock!.textContent!)).toEqual({
-      capability: "runs.failed",
-      scope: "all",
-      replace: {
-        channelId: "ch1",
-        channelName: "Ops webhook",
-        alertType: "TASK_RUN",
-        environments: [{ id: "env1", type: "PRODUCTION", slug: "prod", branchName: null }],
-      },
-    });
-    act(() => root.unmount());
-    container.remove();
-  });
-
-  it("hands Replace to the agent when it is available", () => {
-    agent = { openCreateAlert };
-    const { container, root, replace } = renderPage();
-    expect(replace.querySelector("svg.text-alerts")).toBeNull();
-    act(() => replace.click());
-    expect(openCreateAlert).toHaveBeenCalledTimes(1);
-    expect(container.querySelector("[data-testid=dock]")).toBeNull();
-    act(() => root.unmount());
-    container.remove();
-  });
-});
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
index e68f1d298da..8d19b214d76 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts_.legacy/route.tsx
@@ -1,18 +1,12 @@
-import { useFetcher, useLoaderData, useNavigate, useRevalidator } from "@remix-run/react";
-import { useState } from "react";
+import { useFetcher, useLoaderData } from "@remix-run/react";
 import { json, redirect } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { alertTypeTitle } from "~/components/alerts/AlertChannelsBody";
 import { hasLegacyAlerts } from "~/components/alerts/hasLegacyAlerts.server";
 import { LegacyAlertsSection } from "~/components/alerts/LegacyAlertsSection";
-import { ManualAlertCreationDock } from "~/components/alerts/ManualAlertCreation";
 import { useDashboardAgent } from "~/components/dashboard-agent/dashboardAgentLauncher";
+import { replacePrefill } from "~/components/dashboard-agent/alert-creation/flow-state";
 import {
-  replacePrefill,
-  type DraftPrefillParams,
-} from "~/components/dashboard-agent/alert-creation/flow-state";
-import {
-  afterReplace,
   replacedMessage,
   toLegacyAlertChannelRows,
   type LegacyAlertChannelRow,
@@ -31,7 +25,6 @@ import { resolveProjectAuthScope } from "~/services/projectAuthScope.server";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import {
   EnvironmentParamSchema,
-  v3AlertPath,
   v3ProjectAlertsPath,
   v3ProjectLegacyAlertsPath,
 } from "~/utils/pathBuilder";
@@ -333,54 +326,35 @@ export default function Page() {
   const environment = useEnvironment();
   const fetcher = useFetcher();
   const agent = useDashboardAgent();
-  const navigate = useNavigate();
-  const revalidator = useRevalidator();
-  const [manualReplace, setManualReplace] = useState<DraftPrefillParams | null>(null);
-  const alertsPath = v3ProjectAlertsPath(organization, project, environment);
 
   return (
-    <ManualAlertCreationDock
-      open={!agent && manualReplace !== null}
-      prefill={manualReplace ?? {}}
-      alertDetailPath={(alertId) => v3AlertPath(organization, project, environment, alertId)}
-      onCreated={() => setManualReplace(null)}
-      onReplaced={({ legacyRemaining }) => {
-        setManualReplace(null);
-        afterReplace(legacyRemaining, alertsPath, navigate, () => revalidator.revalidate());
-      }}
-      onClose={() => setManualReplace(null)}
-    >
-      <PageContainer>
-        <NavBar>
-          <PageTitle
-            title="Legacy alerts"
-            backButton={{
-              to: alertsPath,
-              text: "Alerts",
-            }}
-          />
-        </NavBar>
-        <PageBody scrollable={legacyChannels.length > 0}>
-          <LegacyAlertsSection
-            channels={legacyChannels}
-            canWrite={canWrite}
-            canDelete={canDelete}
-            replacing={fetcher.state !== "idle"}
-            manualReplace={!agent}
-            onDelete={(row) =>
-              fetcher.submit(
-                { intent: "deleteLegacyAlert", channelId: row.channelId, alertType: row.alertType },
-                { method: "post" }
-              )
-            }
-            onReplace={(row) => {
-              const prefill = replacePrefill(row, replaceEnvironments[row.channelId] ?? []);
-              if (agent) agent.openCreateAlert(prefill);
-              else setManualReplace(prefill);
-            }}
-          />
-        </PageBody>
-      </PageContainer>
-    </ManualAlertCreationDock>
+    <PageContainer>
+      <NavBar>
+        <PageTitle
+          title="Legacy alerts"
+          backButton={{
+            to: v3ProjectAlertsPath(organization, project, environment),
+            text: "Alerts",
+          }}
+        />
+      </NavBar>
+      <PageBody scrollable={legacyChannels.length > 0}>
+        <LegacyAlertsSection
+          channels={legacyChannels}
+          canWrite={canWrite}
+          canDelete={canDelete}
+          replacing={!agent || fetcher.state !== "idle"}
+          onDelete={(row) =>
+            fetcher.submit(
+              { intent: "deleteLegacyAlert", channelId: row.channelId, alertType: row.alertType },
+              { method: "post" }
+            )
+          }
+          onReplace={(row) =>
+            agent?.openCreateAlert(replacePrefill(row, replaceEnvironments[row.channelId] ?? []))
+          }
+        />
+      </PageBody>
+    </PageContainer>
   );
 }
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
index 84739313690..ceb03abdb11 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx
@@ -8,11 +8,7 @@ import {
 } from "@remix-run/react";
 import { type ActionFunctionArgs, type LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { randomBytes } from "node:crypto";
-import {
-  WebhookPreviousSecretTtlSeconds,
-  WebhookRoutingTarget,
-  WebhookVerifierArtifact,
-} from "@trigger.dev/core/v3";
+import { WebhookRoutingTarget, WebhookVerifierArtifact } from "@trigger.dev/core/v3";
 import type { WebhookValueSource } from "@trigger.dev/core/v3";
 import { type MutableRefObject, Suspense, useEffect, useRef, useState } from "react";
 import { TypedAwait, typeddefer, useTypedLoaderData } from "remix-typedjson";
@@ -73,6 +69,7 @@ import { docsPath, EnvironmentParamSchema, v3WebhooksPath } from "~/utils/pathBu
 import { throwPermissionDenied } from "~/utils/permissionDenied";
 import { parseFiniteInt } from "~/utils/searchParams";
 import { webhookEngine, webhookVerifyTokenKey } from "~/v3/webhookEngine.server";
+import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import {
   generateWebhookSigningSecret,
   storeWebhookSigningSecret,
@@ -215,7 +212,7 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
 };
 
 const PreviousSecretTtlFormField = z.object({
-  previousSecretTtlSeconds: z.coerce.number().pipe(WebhookPreviousSecretTtlSeconds).optional(),
+  previousSecretTtlSeconds: z.coerce.number().pipe(PreviousSecretTtlSeconds).optional(),
 });
 
 const SetSecretSchema = PreviousSecretTtlFormField.extend({
diff --git a/apps/webapp/app/routes/account._index/route.tsx b/apps/webapp/app/routes/account._index/route.tsx
index 130038d18da..8b279c1a3b4 100644
--- a/apps/webapp/app/routes/account._index/route.tsx
+++ b/apps/webapp/app/routes/account._index/route.tsx
@@ -725,7 +725,7 @@ function CustomizeSidebarButton({
 }) {
   const user = useUser();
   const isAdmin = useHasAdminAccess();
-  const { isManagedCloud, alertsConfigured } = useFeatures();
+  const { isManagedCloud } = useFeatures();
   const favorites = useFavorites();
   const [isOpen, setIsOpen] = useState(false);
   const [isConfirming, setIsConfirming] = useState(false);
@@ -767,18 +767,16 @@ function CustomizeSidebarButton({
           },
         ]
       : []),
-    ...buildSideMenuSections({ ...context, isAdmin, alertsConfigured, isManagedCloud }).map(
-      (section) => ({
-        id: section.id,
-        title: section.title,
-        items: section.items.map((item) => ({
-          id: item.id,
-          name: item.name,
-          icon: item.icon,
-          defaultHidden: item.defaultHidden,
-        })),
-      })
-    ),
+    ...buildSideMenuSections({ ...context, isAdmin, isManagedCloud }).map((section) => ({
+      id: section.id,
+      title: section.title,
+      items: section.items.map((item) => ({
+        id: item.id,
+        name: item.name,
+        icon: item.icon,
+        defaultHidden: item.defaultHidden,
+      })),
+    })),
   ];
 
   return (
diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
index a534602bf8d..c0bb08f2e25 100644
--- a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
+++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
@@ -14,10 +14,6 @@ const ParamsSchema = z.object({
   env: z.enum(["dev", "staging", "prod", "preview"]),
 });
 
-const BodySchema = z.object({
-  revokeImmediately: z.boolean().default(false),
-});
-
 export async function action({ request, params }: ActionFunctionArgs) {
   if (request.method.toUpperCase() !== "POST") {
     return json({ error: "Method Not Allowed" }, { status: 405 });
@@ -46,24 +42,6 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });
     }
 
-    const rawBody = await request.text();
-    let body: unknown = {};
-    if (rawBody.trim().length > 0) {
-      try {
-        body = JSON.parse(rawBody);
-      } catch {
-        return json({ error: "Invalid JSON body" }, { status: 400 });
-      }
-    }
-
-    const parsedBody = BodySchema.safeParse(body);
-
-    if (!parsedBody.success) {
-      return json({ error: "Invalid Body" }, { status: 400 });
-    }
-
-    const { revokeImmediately } = parsedBody.data;
-
     const environment = await authenticatedEnvironmentForAuthentication(
       authenticationResult,
       projectRef,
@@ -87,7 +65,6 @@ export async function action({ request, params }: ActionFunctionArgs) {
     const updatedEnvironment = await regenerateApiKey({
       userId: authenticationResult.result.userId,
       environmentId: environment.id,
-      revokeImmediately,
     });
 
     return json({ apiKey: updatedEnvironment.apiKey });
diff --git a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
index 804d12ae251..4a1b605e340 100644
--- a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
+++ b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.rotate-secret.ts
@@ -1,14 +1,19 @@
 import { json } from "@remix-run/server-runtime";
-import { RotateWebhookEndpointSecretRequestBody } from "@trigger.dev/core/v3";
 import { z } from "zod";
 import { webhookPrisma } from "~/db.server";
 import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";
 import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";
 import { safeJsonParse } from "~/utils/json";
+import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import { generateWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";
 
 const ParamsSchema = z.object({ endpointId: z.string() });
 
+/** Optional: existing callers POST with no body, which keeps the replace-immediately behavior. */
+const RotateSecretRequestBody = z.object({
+  previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),
+});
+
 // POST /api/v1/webhooks/endpoints/:endpointId/rotate-secret — mint a new signing secret and return
 // it ONCE. Only for schemes we generate (hmac / shared-secret); asymmetric endpoints set a public key.
 const { action, loader } = createActionApiRoute(
@@ -21,9 +26,7 @@ const { action, loader } = createActionApiRoute(
   },
   async ({ params, authentication, request }) => {
     const rawBody = await request.text();
-    const body = RotateWebhookEndpointSecretRequestBody.safeParse(
-      rawBody ? safeJsonParse(rawBody) : {}
-    );
+    const body = RotateSecretRequestBody.safeParse(rawBody ? safeJsonParse(rawBody) : {});
     if (!body.success) {
       return json({ error: "Invalid request body", issues: body.error.issues }, { status: 400 });
     }
diff --git a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
index ebbd28fc970..16eb39fec3e 100644
--- a/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
+++ b/apps/webapp/app/routes/api.v1.webhooks.endpoints.$endpointId.secret.ts
@@ -4,14 +4,19 @@ import { z } from "zod";
 import { webhookPrisma } from "~/db.server";
 import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";
 import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";
+import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";
 import { storeWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";
 
 const ParamsSchema = z.object({ endpointId: z.string() });
 
+const SetSecretRequestBody = SetWebhookEndpointSecretRequestBody.extend({
+  previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),
+});
+
 const { action, loader } = createActionApiRoute(
   {
     params: ParamsSchema,
-    body: SetWebhookEndpointSecretRequestBody,
+    body: SetSecretRequestBody,
     method: "PUT",
     allowJWT: true,
     corsStrategy: "all",
diff --git a/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx b/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
index dc604e6f2ce..ced2145f212 100644
--- a/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
+++ b/apps/webapp/app/routes/resources.environments.$environmentId.regenerate-api-key.tsx
@@ -52,14 +52,9 @@ export const action = dashboardAction(
 
     const formData = await request.formData();
     const syncToVercel = formData.get("syncToVercel") === "on";
-    const revokeImmediately = formData.get("previousKey") === "revoke";
 
     try {
-      const updatedEnvironment = await regenerateApiKey({
-        userId: user.id,
-        environmentId,
-        revokeImmediately,
-      });
+      const updatedEnvironment = await regenerateApiKey({ userId: user.id, environmentId });
 
       // Sync the regenerated API key to Vercel only when requested and not for DEVELOPMENT
       if (syncToVercel && updatedEnvironment.type !== "DEVELOPMENT") {
diff --git a/apps/webapp/app/v3/canUseAlertsList.server.ts b/apps/webapp/app/v3/canUseAlertsList.server.ts
index b9c7fb40602..d7936a08e26 100644
--- a/apps/webapp/app/v3/canUseAlertsList.server.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.server.ts
@@ -5,7 +5,6 @@ import { v3ProjectAlertsPath } from "~/utils/pathBuilder";
 import { FEATURE_FLAG } from "~/v3/featureFlags";
 import { makeFlag } from "~/v3/featureFlags.server";
 import { computeCanUseAlertsList, isAlertsEnabledEnv } from "./canUseAlertsList";
-import { isAlertsConfigured } from "./services/alerts/alertsConfigured.server";
 
 async function isAlertsFlagEnabled(
   orgFeatureFlags: Record<string, unknown> | null | undefined
@@ -54,11 +53,7 @@ export async function canUseAlertsList(options: {
     isAdmin = user?.admin ?? false;
   }
 
-  return computeCanUseAlertsList(
-    Boolean(flagResult),
-    isAdmin,
-    isAlertsConfigured({ alertsEnabled: env.ALERTS_ENABLED })
-  );
+  return computeCanUseAlertsList(Boolean(flagResult), isAdmin);
 }
 
 type AlertsGateParams = {
diff --git a/apps/webapp/app/v3/canUseAlertsList.test.ts b/apps/webapp/app/v3/canUseAlertsList.test.ts
index ad7bae2ed72..41d44cc5716 100644
--- a/apps/webapp/app/v3/canUseAlertsList.test.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.test.ts
@@ -2,20 +2,16 @@ import { describe, expect, it } from "vitest";
 import { computeCanUseAlertsList, isAlertsEnabledEnv } from "./canUseAlertsList";
 
 describe("computeCanUseAlertsList", () => {
-  it("admin, flag off, configured -> true", () => {
-    expect(computeCanUseAlertsList(false, true, true)).toBe(true);
-  });
-
-  it("admin, flag off, not configured -> false", () => {
-    expect(computeCanUseAlertsList(false, true, false)).toBe(false);
+  it("admin, flag off -> true", () => {
+    expect(computeCanUseAlertsList(false, true)).toBe(true);
   });
 
   it("non-admin, flag off -> false", () => {
-    expect(computeCanUseAlertsList(false, false, true)).toBe(false);
+    expect(computeCanUseAlertsList(false, false)).toBe(false);
   });
 
   it("non-admin, flag on -> true", () => {
-    expect(computeCanUseAlertsList(true, false, false)).toBe(true);
+    expect(computeCanUseAlertsList(true, false)).toBe(true);
   });
 });
 
diff --git a/apps/webapp/app/v3/canUseAlertsList.ts b/apps/webapp/app/v3/canUseAlertsList.ts
index 27a8f51e9d7..b9c6492ed1e 100644
--- a/apps/webapp/app/v3/canUseAlertsList.ts
+++ b/apps/webapp/app/v3/canUseAlertsList.ts
@@ -1,14 +1,10 @@
 /**
  * The single Alerts-list gating rule: the `alertsEnabled` flag (per-org override
- * winning), or a platform admin on an install where alerts are configured. Off leaves
- * the legacy channel-list page unchanged.
+ * winning), or the viewer being a platform admin. Off leaves the legacy channel-list
+ * page unchanged for non-admins.
  */
-export function computeCanUseAlertsList(
-  flagEnabled: boolean,
-  isAdmin: boolean,
-  alertsConfigured: boolean
-): boolean {
-  return flagEnabled || (isAdmin && alertsConfigured);
+export function computeCanUseAlertsList(flagEnabled: boolean, isAdmin: boolean): boolean {
+  return flagEnabled || isAdmin;
 }
 
 export function isAlertsEnabledEnv(value: string | undefined): boolean {
diff --git a/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts b/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
index 990a948cc83..7ceb791029a 100644
--- a/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
+++ b/apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts
@@ -1030,10 +1030,6 @@ async function resolveOverridableTriggerVariables(
       key: "TRIGGER_REALTIME_STREAM_VERSION",
       value: env.REALTIME_STREAM_VERSION,
     },
-    {
-      key: "TRIGGER_DASHBOARD_URL",
-      value: env.APP_ORIGIN.replace(/\/$/, ""),
-    },
   ];
 
   return result;
diff --git a/apps/webapp/app/v3/featureFlags.ts b/apps/webapp/app/v3/featureFlags.ts
index c8e31dd8945..dedbbf63b3d 100644
--- a/apps/webapp/app/v3/featureFlags.ts
+++ b/apps/webapp/app/v3/featureFlags.ts
@@ -2,7 +2,6 @@ import { z } from "zod";
 import { DeployBuildPath } from "@trigger.dev/core/v3";
 
 export const FEATURE_FLAG = {
-  waitpointStoreEnabled: "waitpointStoreEnabled",
   snapshotStoreMode: "snapshotStoreMode",
   allowEmptyEnvironmentVariableValues: "allowEmptyEnvironmentVariableValues",
   defaultWorkerInstanceGroupId: "defaultWorkerInstanceGroupId",
@@ -93,7 +92,6 @@ const WorkerQueueEnvironmentOverrideKey = z
   );
 
 export const FeatureFlagCatalog = {
-  [FEATURE_FLAG.waitpointStoreEnabled]: z.boolean(),
   // Organization override, then global default, then off.
   [FEATURE_FLAG.snapshotStoreMode]: z.enum(["off", "dual-write", "redis-read", "redis-only"]),
   [FEATURE_FLAG.allowEmptyEnvironmentVariableValues]: z.boolean(),
diff --git a/apps/webapp/app/v3/invocationUsage.server.ts b/apps/webapp/app/v3/invocationUsage.server.ts
deleted file mode 100644
index 312d7eac10f..00000000000
--- a/apps/webapp/app/v3/invocationUsage.server.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-export function shouldReportAttemptInvocation(run: { attemptNumber: number }): boolean {
-  return run.attemptNumber === 1;
-}
diff --git a/apps/webapp/app/v3/runEngine.server.ts b/apps/webapp/app/v3/runEngine.server.ts
index 571c1c364c4..75c8f83240f 100644
--- a/apps/webapp/app/v3/runEngine.server.ts
+++ b/apps/webapp/app/v3/runEngine.server.ts
@@ -1,5 +1,3 @@
-import { createWaitpointStoreEnabledResolver } from "./utils/waitpointStoreEnabled.server";
-import { globalFlagsRegistry } from "./globalFlagsRegistry.server";
 import { RunEngine } from "@internal/run-engine";
 import { $replica, prisma } from "~/db.server";
 import { env } from "~/env.server";
@@ -22,10 +20,6 @@ export type { RunEngine };
 
 function createRunEngine() {
   const engine = new RunEngine({
-    waitpointStoreEnabled: createWaitpointStoreEnabledResolver(
-      () => globalFlagsRegistry.current(),
-      prisma
-    ),
     prisma,
     readOnlyPrisma: $replica,
     crossSeamGuard: pickRunOpsStoreForCompletion,
diff --git a/apps/webapp/app/v3/runEngineHandlers.server.ts b/apps/webapp/app/v3/runEngineHandlers.server.ts
index 4dcdb21046f..7ce06198340 100644
--- a/apps/webapp/app/v3/runEngineHandlers.server.ts
+++ b/apps/webapp/app/v3/runEngineHandlers.server.ts
@@ -30,7 +30,6 @@ import { tracer } from "~/v3/tracer.server";
 import { createExceptionPropertiesFromError } from "./eventRepository/common.server";
 import { getEventRepositoryForStore, recordRunDebugLog } from "./eventRepository/index.server";
 import { roomFromFriendlyRunId, socketIo } from "./handleSocketIo.server";
-import { shouldReportAttemptInvocation } from "./invocationUsage.server";
 import { engine } from "./runEngine.server";
 import { runStore } from "./runStore.server";
 import { mintAnchoredRunFriendlyId } from "~/v3/runOpsMigration/mintAnchoredRunFriendlyId.server";
@@ -588,7 +587,7 @@ export function registerRunEngineEventBusHandlers() {
   engine.eventBus.on("runAttemptStarted", async (event) => {
     const { run, organization } = event;
 
-    if (!shouldReportAttemptInvocation(run)) {
+    if (run.attemptNumber !== 1 || run.baseCostInCents <= 0) {
       return;
     }
 
diff --git a/apps/webapp/app/v3/services/alerts/alertTransport.server.ts b/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
index e4d666844a4..0af0e06355e 100644
--- a/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
+++ b/apps/webapp/app/v3/services/alerts/alertTransport.server.ts
@@ -24,28 +24,23 @@ const PERMANENT_WEBHOOK_STATUSES = [401, 403, 404, 410];
 
 export async function findSlackIntegration(
   prisma: { organizationIntegration: { findFirst: Function } },
-  params: { integrationId?: string | null; organizationId: string },
-  options: { includeDeleted?: boolean } = {}
+  params: { integrationId?: string | null; organizationId: string }
 ): Promise<OrganizationIntegrationForService<"SLACK"> | null> {
-  const findLatest = (where: { deletedAt?: null }) =>
-    prisma.organizationIntegration.findFirst({
-      where: { service: "SLACK", organizationId: params.organizationId, ...where },
-      orderBy: { createdAt: "desc" },
-      include: { tokenReference: true },
-    });
-
   const integration = params.integrationId
     ? await prisma.organizationIntegration.findFirst({
         where: {
           id: params.integrationId,
           service: "SLACK",
           organizationId: params.organizationId,
-          ...(options.includeDeleted ? {} : { deletedAt: null }),
+          deletedAt: null,
         },
         include: { tokenReference: true },
       })
-    : ((await findLatest({ deletedAt: null })) ??
-      (options.includeDeleted ? await findLatest({}) : null));
+    : await prisma.organizationIntegration.findFirst({
+        where: { service: "SLACK", organizationId: params.organizationId, deletedAt: null },
+        orderBy: { createdAt: "desc" },
+        include: { tokenReference: true },
+      });
 
   if (!integration || !isIntegrationForService(integration, "SLACK")) {
     return null;
diff --git a/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
index e1aae778e9f..3e3f6110549 100644
--- a/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverAlert.server.ts
@@ -761,14 +761,10 @@ export class DeliverAlertService extends BaseService {
       return;
     }
 
-    const integration = await findSlackIntegration(
-      this._prisma,
-      {
-        integrationId: slackProperties.data.integrationId,
-        organizationId: alert.project.organizationId,
-      },
-      { includeDeleted: true }
-    );
+    const integration = await findSlackIntegration(this._prisma, {
+      integrationId: slackProperties.data.integrationId,
+      organizationId: alert.project.organizationId,
+    });
 
     if (!integration) {
       logger.error("[DeliverAlert] Slack integration not found", {
diff --git a/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
index ae8fb78f250..a0e42d69300 100644
--- a/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverDashboardAgentWatchAlert.server.ts
@@ -277,14 +277,10 @@ export class DeliverDashboardAgentWatchChannelAlertService {
       return;
     }
 
-    const integration = await findSlackIntegration(
-      prisma,
-      {
-        integrationId: slackProperties.data.integrationId,
-        organizationId: payload.organizationId,
-      },
-      { includeDeleted: true }
-    );
+    const integration = await findSlackIntegration(prisma, {
+      integrationId: slackProperties.data.integrationId,
+      organizationId: payload.organizationId,
+    });
 
     if (!integration) {
       logger.error("[DeliverDashboardAgentWatchAlert] Slack integration not found");
diff --git a/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts b/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
index d04246b0042..2ac291bdec4 100644
--- a/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
+++ b/apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts
@@ -28,7 +28,6 @@ import {
   buildErrorGroupSlackMessage,
   type ErrorAlertPayload,
 } from "./errorGroupSlackMessage.server";
-import { findSlackIntegration } from "./alertTransport.server";
 import { safeWebhookFetch } from "./safeWebhookFetch.server";
 
 class SkipRetryError extends Error {}
@@ -144,14 +143,24 @@ export class DeliverErrorGroupAlertService {
       return;
     }
 
-    const integration = await findSlackIntegration(
-      prisma,
-      {
-        integrationId: slackProperties.data.integrationId,
-        organizationId: channel.project.organizationId,
-      },
-      { includeDeleted: true }
-    );
+    const integration = slackProperties.data.integrationId
+      ? await prisma.organizationIntegration.findFirst({
+          where: {
+            id: slackProperties.data.integrationId,
+            organizationId: channel.project.organizationId,
+            deletedAt: null,
+          },
+          include: { tokenReference: true },
+        })
+      : await prisma.organizationIntegration.findFirst({
+          where: {
+            service: "SLACK",
+            organizationId: channel.project.organizationId,
+            deletedAt: null,
+          },
+          orderBy: { createdAt: "desc" },
+          include: { tokenReference: true },
+        });
 
     if (!integration || !isIntegrationForService(integration, "SLACK")) {
       logger.error("[DeliverErrorGroupAlert] Slack integration not found");
diff --git a/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts b/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
index 3a9dc3cb57a..dd232deffb4 100644
--- a/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
+++ b/apps/webapp/app/v3/services/alerts/findSlackIntegration.server.test.ts
@@ -47,60 +47,3 @@ postgresTest("ignores a soft-deleted Slack integration", async ({ prisma }) => {
   ).toBeNull();
   expect(await findSlackIntegration(prisma, { organizationId: organization.id })).toBeNull();
 });
-
-postgresTest(
-  "resolves a soft-deleted integration by id when includeDeleted is set",
-  async ({ prisma }) => {
-    const { organization, integration } = await seed(prisma, true);
-
-    const byId = await findSlackIntegration(
-      prisma,
-      { integrationId: integration.id, organizationId: organization.id },
-      { includeDeleted: true }
-    );
-
-    expect(byId?.id).toBe(integration.id);
-  }
-);
-
-postgresTest(
-  "resolves a soft-deleted integration by organization when includeDeleted is set",
-  async ({ prisma }) => {
-    const { organization, integration } = await seed(prisma, true);
-
-    const byOrg = await findSlackIntegration(
-      prisma,
-      { organizationId: organization.id },
-      { includeDeleted: true }
-    );
-
-    expect(byOrg?.id).toBe(integration.id);
-  }
-);
-
-postgresTest(
-  "prefers an older live integration over a newer soft-deleted one when includeDeleted is set",
-  async ({ prisma }) => {
-    const { organization, integration: live } = await seed(prisma, false);
-    const secret = await prisma.secretReference.create({ data: { key: "slack-lookup-token-2" } });
-    await prisma.organizationIntegration.create({
-      data: {
-        friendlyId: generateFriendlyId("org_integration"),
-        service: "SLACK",
-        integrationData: {},
-        tokenReferenceId: secret.id,
-        organizationId: organization.id,
-        createdAt: new Date(Date.now() + 60_000),
-        deletedAt: new Date(),
-      },
-    });
-
-    const byOrg = await findSlackIntegration(
-      prisma,
-      { organizationId: organization.id },
-      { includeDeleted: true }
-    );
-
-    expect(byOrg?.id).toBe(live.id);
-  }
-);
diff --git a/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts b/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
deleted file mode 100644
index 36a04638abc..00000000000
--- a/apps/webapp/app/v3/utils/waitpointStoreEnabled.server.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import type { PrismaClient } from "@trigger.dev/database";
-import { FEATURE_FLAG, FeatureFlagCatalog } from "../featureFlags";
-
-/** The normal organization override, then global default, then off. No rollout history. */
-export function createWaitpointStoreEnabledResolver(
-  readFlags: () => { waitpointStoreEnabled?: boolean } | undefined,
-  prisma: Pick<PrismaClient, "organization">
-) {
-  return async (organizationId: string, organizationFlags?: unknown): Promise<boolean> => {
-    const overrides =
-      organizationFlags === undefined
-        ? (
-            await prisma.organization.findFirst({
-              where: { id: organizationId },
-              select: { featureFlags: true },
-            })
-          )?.featureFlags
-        : organizationFlags;
-    const value =
-      typeof overrides === "object" && overrides !== null && "waitpointStoreEnabled" in overrides
-        ? overrides.waitpointStoreEnabled
-        : undefined;
-    const parsed = FeatureFlagCatalog[FEATURE_FLAG.waitpointStoreEnabled].safeParse(value);
-    return parsed.success ? parsed.data : (readFlags()?.waitpointStoreEnabled ?? false);
-  };
-}
diff --git a/apps/webapp/app/v3/webhookSetupPrompt.ts b/apps/webapp/app/v3/webhookSetupPrompt.ts
index a9363f05785..acdd23d95a2 100644
--- a/apps/webapp/app/v3/webhookSetupPrompt.ts
+++ b/apps/webapp/app/v3/webhookSetupPrompt.ts
@@ -152,7 +152,7 @@ export function renderWebhookSetupPrompt(
 function secretStep(endpoint: WebhookSetupPromptEndpoint, asymmetric: boolean): string {
   const source = endpoint.source;
   const replacing = endpoint.hasSigningSecret
-    ? ` ${asymmetric ? "A public key" : "A secret"} is already set; only replace it when you're creating or updating the webhook in ${source}, and pass \`previousSecretTtlSeconds\` (for example 3600) so deliveries signed with the old one keep verifying until ${source} uses the new one.`
+    ? ` ${asymmetric ? "A public key" : "A secret"} is already set; replacing it breaks deliveries until ${source} uses the new one, so only replace it when you're creating or updating the webhook in ${source}.`
     : "";
 
   if (asymmetric) {
diff --git a/apps/webapp/app/v3/webhookSigningSecret.ts b/apps/webapp/app/v3/webhookSigningSecret.ts
index e91774011c0..3ae9117442f 100644
--- a/apps/webapp/app/v3/webhookSigningSecret.ts
+++ b/apps/webapp/app/v3/webhookSigningSecret.ts
@@ -1,5 +1,14 @@
 import { z } from "zod";
 
+export const MAX_PREVIOUS_SECRET_TTL_SECONDS = 7 * 24 * 60 * 60;
+
+/** How long the replaced secret keeps verifying deliveries; 0 replaces it immediately. */
+export const PreviousSecretTtlSeconds = z
+  .number()
+  .int()
+  .min(0)
+  .max(MAX_PREVIOUS_SECRET_TTL_SECONDS);
+
 /**
  * An endpoint's signing secret as stored in the SecretStore. `previous` is the secret it replaced,
  * still accepted until `expiresAt` so a rotation doesn't fail deliveries the provider signs with it.
diff --git a/apps/webapp/test/alertsGateRoutes.test.ts b/apps/webapp/test/alertsGateRoutes.test.ts
index a4ec92dde7e..a135aa89f25 100644
--- a/apps/webapp/test/alertsGateRoutes.test.ts
+++ b/apps/webapp/test/alertsGateRoutes.test.ts
@@ -1,4 +1,3 @@
-import type * as AlertsGate from "~/v3/canUseAlertsList.server";
 import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.setConfig({ testTimeout: 30_000 });
@@ -36,11 +35,8 @@ vi.mock("~/services/routeBuilders/dashboardBuilder", () => {
 vi.mock("~/services/session.server", () => ({ requireUserId: async () => "user_1" }));
 
 vi.mock("~/db.server", () => ({
-  prisma: {
-    organizationIntegration: { findFirst: async () => ({ id: "int_1" }) },
-    user: { findFirst: async () => ({ admin: true }) },
-  },
-  $replica: { organization: { findFirst: async () => ({ featureFlags: {} }) } },
+  prisma: { organizationIntegration: { findFirst: async () => ({ id: "int_1" }) } },
+  $replica: {},
 }));
 
 vi.mock("~/models/project.server", async (importOriginal) => ({
@@ -136,11 +132,6 @@ vi.mock("~/v3/canUseAlertsList.server", async () => {
   };
 });
 
-vi.mock("~/v3/featureFlags.server", async (importOriginal) => ({
-  ...(await importOriginal<object>()),
-  makeFlag: () => async (opts: { defaultValue: unknown }) => opts.defaultValue,
-}));
-
 const P = "_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam";
 const params = { organizationSlug: "o", projectParam: "p", envParam: "dev", channelId: "c" };
 const request = (method = "GET") => new Request("http://localhost/x", { method });
@@ -198,15 +189,6 @@ describe("new alerts surfaces when alertsEnabled is off", () => {
   });
 });
 
-describe("admin preview when ALERTS_ENABLED is unset", () => {
-  it("the real gate redirects an admin to the old alerts page", async () => {
-    const real = await vi.importActual<typeof AlertsGate>("~/v3/canUseAlertsList.server");
-    const res = await thrown(() => real.requireAlertsEnabledOrRedirect("user_1", params));
-    expect(res?.status).toBe(302);
-    expect(await real.canUseAlertsList({ orgFeatureFlags: {}, user: { admin: true } })).toBe(false);
-  });
-});
-
 describe("preview-series authorization", () => {
   it("responds 403 to a member denied read:alerts", async () => {
     STATE.enabled = true;
diff --git a/apps/webapp/test/alertsListRouteLegacy.test.ts b/apps/webapp/test/alertsListRouteLegacy.test.ts
index 6e80d1aa4a8..bfa94c2aa1d 100644
--- a/apps/webapp/test/alertsListRouteLegacy.test.ts
+++ b/apps/webapp/test/alertsListRouteLegacy.test.ts
@@ -38,9 +38,6 @@ vi.mock("~/models/runtimeEnvironment.server", () => ({
 }));
 
 vi.mock("~/v3/canUseAlertsList.server", () => ({ canUseAlertsList: async () => true }));
-vi.mock("~/v3/canAccessDashboardAgent.server", () => ({
-  canAccessDashboardAgent: async () => false,
-}));
 
 vi.mock("~/presenters/v3/AlertsListPresenter.server", () => ({
   AlertsListPresenter: class {
diff --git a/apps/webapp/test/alertsRequireEnabled.test.ts b/apps/webapp/test/alertsRequireEnabled.test.ts
index 291a2a0c16e..3d91577198e 100644
--- a/apps/webapp/test/alertsRequireEnabled.test.ts
+++ b/apps/webapp/test/alertsRequireEnabled.test.ts
@@ -1,14 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const STATE = vi.hoisted(() => ({ member: true, flag: false, admin: false, configured: "1" }));
+const STATE = vi.hoisted(() => ({ member: true, flag: false, admin: false }));
 
-vi.mock("~/env.server", () => ({
-  env: {
-    get ALERTS_ENABLED() {
-      return STATE.configured;
-    },
-  },
-}));
+vi.mock("~/env.server", () => ({ env: {} }));
 vi.mock("~/v3/featureFlags.server", () => ({ makeFlag: () => async () => STATE.flag }));
 vi.mock("~/db.server", () => ({
   prisma: { user: { findFirst: async () => ({ admin: STATE.admin }) } },
@@ -40,7 +34,6 @@ beforeEach(() => {
   STATE.member = true;
   STATE.flag = false;
   STATE.admin = false;
-  STATE.configured = "1";
 });
 
 describe.each([
@@ -56,17 +49,11 @@ describe.each([
     expect(await thrown(run)).toBeUndefined();
   });
 
-  it("allows an admin member with the flag off when alerts are configured", async () => {
+  it("allows an admin member with the flag off", async () => {
     STATE.admin = true;
     expect(await thrown(run)).toBeUndefined();
   });
 
-  it("denies an admin member with the flag off when alerts are not configured", async () => {
-    STATE.admin = true;
-    STATE.configured = "";
-    expect((await thrown(run))?.status).toBe(deniedStatus);
-  });
-
   it("denies a non-member even with the flag on", async () => {
     STATE.member = false;
     STATE.flag = true;
diff --git a/apps/webapp/test/api-auth.e2e.test.ts b/apps/webapp/test/api-auth.e2e.test.ts
index 43140f2213b..4e8c4346349 100644
--- a/apps/webapp/test/api-auth.e2e.test.ts
+++ b/apps/webapp/test/api-auth.e2e.test.ts
@@ -538,37 +538,3 @@ describe("API bearer auth — environment/project edge cases", () => {
     expect(res.status).toBe(401);
   });
 });
-
-describe("admin waitpoint rollout controls", () => {
-  it("saves the normal org/global flag without writing derived global state", async () => {
-    const user = await seedTestUser(server.prisma, { admin: true });
-    const pat = await seedTestPAT(server.prisma, user.id);
-    const organization = await server.prisma.organization.create({
-      data: { title: "Waitpoint rollout", slug: `waitpoint-rollout-${user.id}` },
-    });
-    const post = async (path: string, body: unknown) => {
-      const response = await server.webapp.fetch(path, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${pat.token}`, "Content-Type": "application/json" },
-        body: JSON.stringify(body),
-      });
-      expect(response.status, await response.text()).toBe(200);
-    };
-    const globalPath = "/admin/api/v1/feature-flags";
-    try {
-      await post(`/admin/api/v1/orgs/${organization.id}/feature-flags`, {
-        waitpointStoreEnabled: true,
-      });
-      await post(globalPath, { waitpointStoreEnabled: false });
-      expect(
-        (await server.prisma.organization.findFirstOrThrow({ where: { id: organization.id } }))
-          .featureFlags
-      ).toMatchObject({ waitpointStoreEnabled: true });
-      expect(
-        await server.prisma.featureFlag.findFirst({ where: { key: "waitpointRolloutState" } })
-      ).toBeNull();
-    } finally {
-      await post(globalPath, { waitpointStoreEnabled: false });
-    }
-  });
-});
diff --git a/apps/webapp/test/canUseMonitoringAlerts.test.ts b/apps/webapp/test/canUseMonitoringAlerts.test.ts
index 0d6951b36b6..b3bb3ae8d0e 100644
--- a/apps/webapp/test/canUseMonitoringAlerts.test.ts
+++ b/apps/webapp/test/canUseMonitoringAlerts.test.ts
@@ -50,14 +50,9 @@ describe("canUseMonitoringAlerts", () => {
     expect(await canUseMonitoringAlerts(project(null), "u")).toBe(false);
   });
 
-  it("allows an admin with the org flag off when alerts are configured", async () => {
-    STATE.admin = true;
-    expect(await canUseMonitoringAlerts(project({ alertsEnabled: false }), "u")).toBe(true);
-  });
-
-  it("denies an admin when alerts are not configured", async () => {
+  it("allows an admin with the flag off", async () => {
     STATE.alertsEnabledEnv = "";
     STATE.admin = true;
-    expect(await canUseMonitoringAlerts(project({ alertsEnabled: false }), "u")).toBe(false);
+    expect(await canUseMonitoringAlerts(project({ alertsEnabled: false }), "u")).toBe(true);
   });
 });
diff --git a/apps/webapp/test/dashboardAgentAlertsGate.test.ts b/apps/webapp/test/dashboardAgentAlertsGate.test.ts
index 5e4593ddbc4..6a1ee08faa9 100644
--- a/apps/webapp/test/dashboardAgentAlertsGate.test.ts
+++ b/apps/webapp/test/dashboardAgentAlertsGate.test.ts
@@ -2,15 +2,9 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.setConfig({ testTimeout: 30_000 });
 
-const STATE = vi.hoisted(() => ({ alerts: false, watch: true, admin: false, configured: "1" }));
+const STATE = vi.hoisted(() => ({ alerts: false, watch: true, admin: false }));
 
-vi.mock("~/env.server", () => ({
-  env: {
-    get ALERTS_ENABLED() {
-      return STATE.configured;
-    },
-  },
-}));
+vi.mock("~/env.server", () => ({ env: {} }));
 vi.mock("~/v3/featureFlags.server", () => ({
   makeFlag: () => async (opts: { key: string }) =>
     opts.key === "alertsEnabled" ? STATE.alerts : STATE.watch,
@@ -65,24 +59,17 @@ describe("api.v1.dashboard-agent.alerts gate", () => {
     STATE.alerts = false;
     STATE.watch = true;
     STATE.admin = false;
-    STATE.configured = "1";
   });
 
   it("404s a non-admin with alertsEnabled off even if the watch flag is on", async () => {
     expect((await call()).status).toBe(404);
   });
 
-  it("passes the gate for an admin with alertsEnabled off when alerts are configured", async () => {
+  it("passes the gate for an admin with alertsEnabled off", async () => {
     STATE.admin = true;
     expect((await call()).status).toBe(403);
   });
 
-  it("404s an admin with alertsEnabled off when alerts are not configured", async () => {
-    STATE.admin = true;
-    STATE.configured = "";
-    expect((await call()).status).toBe(404);
-  });
-
   it("passes the gate when alertsEnabled is on", async () => {
     STATE.alerts = true;
     expect((await call()).status).toBe(403);
diff --git a/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts b/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
index 67ed8514600..28a2ed0231b 100644
--- a/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
+++ b/apps/webapp/test/dashboardAgentMonitoringAlerts.test.ts
@@ -34,7 +34,6 @@ const ctx = vi.hoisted(() => ({
 vi.hoisted(() => {
   process.env.QUEUE_METRICS_EMIT_ENABLED = "1";
   process.env.QUEUE_METRICS_CONSUMER_ENABLED = "1";
-  process.env.ALERTS_ENABLED = "1";
 });
 
 vi.mock("~/db.server", () => {
diff --git a/apps/webapp/test/helpers/seedTestUserProject.ts b/apps/webapp/test/helpers/seedTestUserProject.ts
index 1ab8b94abe5..cfd3caf28b2 100644
--- a/apps/webapp/test/helpers/seedTestUserProject.ts
+++ b/apps/webapp/test/helpers/seedTestUserProject.ts
@@ -38,9 +38,7 @@ export async function seedTestUserProject(
       isActivated: true,
       members: { create: { userId: user.id, role: "ADMIN" } },
     },
-    include: { members: true },
   });
-  const orgMember = organization.members[0];
 
   const project = await prisma.project.create({
     data: {
@@ -62,7 +60,6 @@ export async function seedTestUserProject(
       shortcode: suffix.slice(0, 4),
       projectId: project.id,
       organizationId: organization.id,
-      orgMemberId: orgMember.id,
     },
   });
 
diff --git a/apps/webapp/test/invocationUsage.test.ts b/apps/webapp/test/invocationUsage.test.ts
deleted file mode 100644
index d84fd43232f..00000000000
--- a/apps/webapp/test/invocationUsage.test.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { shouldReportAttemptInvocation } from "~/v3/invocationUsage.server";
-
-describe("shouldReportAttemptInvocation", () => {
-  it("reports the first attempt", () => {
-    expect(shouldReportAttemptInvocation({ attemptNumber: 1 })).toBe(true);
-  });
-
-  it("reports the first attempt of a run with no base cost", () => {
-    const run = { attemptNumber: 1, baseCostInCents: 0 };
-
-    expect(shouldReportAttemptInvocation(run)).toBe(true);
-  });
-
-  it("skips retries", () => {
-    expect(shouldReportAttemptInvocation({ attemptNumber: 2 })).toBe(false);
-  });
-});
diff --git a/apps/webapp/test/monitoringAlertsApi.test.ts b/apps/webapp/test/monitoringAlertsApi.test.ts
index 6fbc6a778f8..41285e4c872 100644
--- a/apps/webapp/test/monitoringAlertsApi.test.ts
+++ b/apps/webapp/test/monitoringAlertsApi.test.ts
@@ -19,10 +19,6 @@ vi.setConfig({ testTimeout: 60_000 });
 
 type Resource = { type: string; envType?: string };
 
-vi.hoisted(() => {
-  process.env.ALERTS_ENABLED = "1";
-});
-
 const ctx = vi.hoisted(() => ({
   prisma: undefined as unknown as PrismaClient,
   agentDb: undefined as unknown as DashboardAgentDb,
diff --git a/apps/webapp/test/regenerateApiKey.test.ts b/apps/webapp/test/regenerateApiKey.test.ts
deleted file mode 100644
index d5ee0ae609a..00000000000
--- a/apps/webapp/test/regenerateApiKey.test.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import { containerTest } from "@internal/testcontainers";
-import { expect, vi } from "vitest";
-import { regenerateApiKey } from "~/models/api-key.server";
-import { findEnvironmentByApiKey } from "~/models/runtimeEnvironment.server";
-import {
-  createRuntimeEnvironment,
-  createTestOrgProjectWithMember,
-} from "./fixtures/environmentVariablesFixtures";
-
-vi.setConfig({ testTimeout: 60_000 });
-
-containerTest(
-  "regenerating keeps the previous root key valid for a grace period",
-  async ({ prisma }) => {
-    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
-    const environment = await createRuntimeEnvironment(prisma, {
-      projectId: project.id,
-      organizationId: organization.id,
-      type: "PRODUCTION",
-    });
-    const oldRootApiKey = environment.apiKey;
-
-    const result = await regenerateApiKey(
-      { environmentId: environment.id, userId: user.id },
-      { prismaClient: prisma }
-    );
-
-    expect(result.apiKey).not.toBe(oldRootApiKey);
-    const revoked = await prisma.revokedApiKey.findMany({
-      where: { runtimeEnvironmentId: environment.id },
-    });
-    expect(revoked).toHaveLength(1);
-    expect(revoked[0].apiKey).toBe(oldRootApiKey);
-    expect(revoked[0].expiresAt.getTime()).toBeGreaterThan(Date.now());
-    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toMatchObject({
-      id: environment.id,
-    });
-    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
-      id: environment.id,
-    });
-  }
-);
-
-containerTest(
-  "regenerating with revokeImmediately rejects the previous root key at once",
-  async ({ prisma }) => {
-    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
-    const environment = await createRuntimeEnvironment(prisma, {
-      projectId: project.id,
-      organizationId: organization.id,
-      type: "PRODUCTION",
-    });
-    const oldRootApiKey = environment.apiKey;
-
-    const result = await regenerateApiKey(
-      { environmentId: environment.id, userId: user.id, revokeImmediately: true },
-      { prismaClient: prisma }
-    );
-
-    expect(result.apiKey).not.toBe(oldRootApiKey);
-    const revoked = await prisma.revokedApiKey.findMany({
-      where: { runtimeEnvironmentId: environment.id },
-    });
-    expect(revoked).toHaveLength(0);
-    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toBeNull();
-    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
-      id: environment.id,
-    });
-  }
-);
diff --git a/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts b/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
index 8738f962b31..bf3786d7db8 100644
--- a/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
+++ b/apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts
@@ -3,7 +3,7 @@ import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestUserProject } from "./helpers/seedTestUserProject";
 
 describe("regenerate API key branch handling", () => {
-  it.each(["feature", "default"])(
+  it.each(["feature", "", "default"])(
     "rejects a present branch header without rotating the root key (%s)",
     async (branch) => {
       const server = getTestServer();
@@ -53,65 +53,4 @@ describe("regenerate API key branch handling", () => {
     });
     expect(revoked?.expiresAt.getTime()).toBeGreaterThan(Date.now());
   });
-
-  it("revokes the previous key immediately when asked", async () => {
-    const server = getTestServer();
-    const { environment, pat, project } = await seedTestUserProject(server.prisma);
-    const apiKeyRoute = "/api/v1/runs/run_doesnotexist/result";
-
-    const response = await server.webapp.fetch(
-      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${pat.token}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ revokeImmediately: true }),
-      }
-    );
-
-    expect(response.status).toBe(200);
-    const body = (await response.json()) as { apiKey: string };
-    expect(body.apiKey).not.toBe(environment.apiKey);
-
-    const revoked = await server.prisma.revokedApiKey.findFirst({
-      where: { apiKey: environment.apiKey, runtimeEnvironmentId: environment.id },
-    });
-    expect(revoked).toBeNull();
-
-    const oldKeyResponse = await server.webapp.fetch(apiKeyRoute, {
-      headers: { Authorization: `Bearer ${environment.apiKey}` },
-    });
-    expect(oldKeyResponse.status).toBe(401);
-
-    const newKeyResponse = await server.webapp.fetch(apiKeyRoute, {
-      headers: { Authorization: `Bearer ${body.apiKey}` },
-    });
-    expect(newKeyResponse.status).not.toBe(401);
-  });
-
-  it("rejects a malformed body without rotating the root key", async () => {
-    const server = getTestServer();
-    const { environment, pat, project } = await seedTestUserProject(server.prisma);
-
-    const response = await server.webapp.fetch(
-      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${pat.token}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ revokeImmediately: "yes" }),
-      }
-    );
-
-    expect(response.status).toBe(400);
-    const persisted = await server.prisma.runtimeEnvironment.findUniqueOrThrow({
-      where: { id: environment.id },
-      select: { apiKey: true },
-    });
-    expect(persisted.apiKey).toBe(environment.apiKey);
-  });
 });
diff --git a/apps/webapp/test/sideMenuSections.test.ts b/apps/webapp/test/sideMenuSections.test.ts
index 6fd89f4fb7b..534cd3c50ae 100644
--- a/apps/webapp/test/sideMenuSections.test.ts
+++ b/apps/webapp/test/sideMenuSections.test.ts
@@ -9,7 +9,6 @@ const build = (isAdmin: boolean) =>
     project: { slug: "proj" },
     environment: { slug: "dev" },
     isAdmin,
-    alertsConfigured: true,
     featureFlags: {},
     isManagedCloud: false,
   });
@@ -41,7 +40,6 @@ describe("buildSideMenuSections alerts placement", () => {
       project: { slug: "proj" },
       environment: { slug: "dev" },
       isAdmin: false,
-      alertsConfigured: false,
       featureFlags: { hasQueryAccess: true },
       isManagedCloud: false,
     });
@@ -62,7 +60,6 @@ describe("buildSideMenuSections alerts placement", () => {
       project: { slug: "proj" },
       environment: { slug: "dev" },
       isAdmin: false,
-      alertsConfigured: false,
       featureFlags: { hasQueryAccess: true, alertsEnabled: true },
       isManagedCloud: false,
     });
diff --git a/apps/webapp/test/waitpointRollout.test.ts b/apps/webapp/test/waitpointRollout.test.ts
deleted file mode 100644
index 1f3b451c0b2..00000000000
--- a/apps/webapp/test/waitpointRollout.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { describe, expect } from "vitest";
-import { postgresTest } from "@internal/testcontainers";
-import { createWaitpointStoreEnabledResolver } from "~/v3/utils/waitpointStoreEnabled.server";
-
-describe("waitpoint rollout", () => {
-  postgresTest(
-    "waitpoint enrollment uses ordinary org flags, global fallback, and immediate rollback",
-    async ({ prisma }) => {
-      const org = await prisma.organization.create({
-        data: { title: "Waitpoints", slug: "waitpoints" },
-      });
-      let global: { waitpointStoreEnabled?: boolean } | undefined;
-      const enabled = createWaitpointStoreEnabledResolver(() => global, prisma);
-      expect(await enabled(org.id)).toBe(false);
-      await prisma.organization.update({
-        where: { id: org.id },
-        data: { featureFlags: { waitpointStoreEnabled: true } },
-      });
-      expect(await enabled(org.id)).toBe(true);
-      global = { waitpointStoreEnabled: false };
-      expect(await enabled(org.id)).toBe(true);
-      await prisma.organization.update({
-        where: { id: org.id },
-        data: { featureFlags: { waitpointStoreEnabled: false } },
-      });
-      global = { waitpointStoreEnabled: true };
-      expect(await enabled(org.id)).toBe(false);
-      expect(await enabled(org.id, {})).toBe(true);
-      expect(await enabled(org.id, { waitpointStoreEnabled: false })).toBe(false);
-      global = { waitpointStoreEnabled: false };
-      expect(await enabled(org.id)).toBe(false);
-      expect(await prisma.featureFlag.count()).toBe(0);
-    }
-  );
-});
diff --git a/apps/webapp/test/webhookSetupPrompt.test.ts b/apps/webapp/test/webhookSetupPrompt.test.ts
index 8108dadc1ae..0b716776ad3 100644
--- a/apps/webapp/test/webhookSetupPrompt.test.ts
+++ b/apps/webapp/test/webhookSetupPrompt.test.ts
@@ -84,8 +84,7 @@ describe("renderWebhookSetupPrompt", () => {
 
     expect(prompt).toContain("Public key: set");
     expect(prompt).toContain("Copy its public key and store it with `set_webhook_secret`.");
-    expect(prompt).toContain("A public key is already set; only replace it when");
-    expect(prompt).toContain("pass `previousSecretTtlSeconds`");
+    expect(prompt).toContain("A public key is already set; replacing it breaks deliveries");
   });
 
   it("asks which events to send when nothing subscribes yet", () => {
diff --git a/apps/webapp/test/webhookSigningSecret.test.ts b/apps/webapp/test/webhookSigningSecret.test.ts
index bf7616d7fb7..25cdbdb0cea 100644
--- a/apps/webapp/test/webhookSigningSecret.test.ts
+++ b/apps/webapp/test/webhookSigningSecret.test.ts
@@ -1,9 +1,10 @@
 import { describe, expect, it } from "vitest";
 import {
-  MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS as MAX_PREVIOUS_SECRET_TTL_SECONDS,
-  WebhookPreviousSecretTtlSeconds as PreviousSecretTtlSeconds,
-} from "@trigger.dev/core/v3";
-import { activeSigningSecrets, replaceStoredSigningSecret } from "~/v3/webhookSigningSecret";
+  activeSigningSecrets,
+  MAX_PREVIOUS_SECRET_TTL_SECONDS,
+  PreviousSecretTtlSeconds,
+  replaceStoredSigningSecret,
+} from "~/v3/webhookSigningSecret";
 
 const now = new Date("2026-10-20T12:00:00.000Z");
 const later = (seconds: number) => new Date(now.getTime() + seconds * 1000);
diff --git a/base-images/images.json b/base-images/images.json
index cf419a1bc89..878bc58bdb1 100644
--- a/base-images/images.json
+++ b/base-images/images.json
@@ -11,17 +11,17 @@
     {
       "repo": "node",
       "tag": "22-bookworm",
-      "base": "node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d"
+      "base": "node:22.16.0-bookworm-slim@sha256:048ed02c5fd52e86fda6fbd2f6a76cf0d4492fd6c6fee9e2c463ed5108da0e34"
     },
     {
       "repo": "node",
       "tag": "24-bookworm",
-      "base": "node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205"
+      "base": "node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d"
     },
     {
       "repo": "node",
       "tag": "26-bookworm",
-      "base": "node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe"
+      "base": "node:26.4.0-bookworm-slim@sha256:ec82d089a8ae2cf02628da7b34ea57dc357b24db724d557fe2d240e6beb659c1"
     },
     {
       "repo": "bun",
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 84fde6afd9a..699b8adc2ae 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-ARG NODE_IMAGE=node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205
+ARG NODE_IMAGE=node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d
 # OS security patches come from apt, not from the node image, and the node image
 # rarely changes. Without a changing input the upgrade layers below stay cached
 # for months and ship known-fixed CVEs. Every workflow that publishes this image
diff --git a/docs/ai-chat/backend.mdx b/docs/ai-chat/backend.mdx
index 7924aacc26f..5f2b57abd5c 100644
--- a/docs/ai-chat/backend.mdx
+++ b/docs/ai-chat/backend.mdx
@@ -4,6 +4,8 @@ sidebarTitle: "Backend"
 description: "Three approaches to building your chat backend — chat.agent(), session iterator, or raw task primitives."
 ---
 
+import WebhooksBetaNote from "/snippets/webhooks-beta-note.mdx";
+
 There are three abstraction levels for a chat backend. All three speak the same wire protocol, so the [frontend transport](/ai-chat/frontend) works unchanged whichever you pick.
 
 | Capability                            | `chat.agent()` | `chat.createSession()`                                        | Raw primitives |
@@ -272,7 +274,7 @@ export const myChat = chat.agent({
 });
 ```
 
-The managed `streamText` carries the stored prompt's `system`, `model` (resolved through the agent's `registry`), sampling config, and `experimental_telemetry`. AI SDK telemetry is on even without a stored prompt, so model steps and tool calls show in the run trace. Options you pass at the call site win, apart from `system`, which throws when the prompt already set one.
+The managed `streamText` carries the stored prompt's `system`, `model` (resolved through the agent's `registry`), sampling config, and `experimental_telemetry`. Options you pass at the call site win, apart from `system`, which throws when the prompt already set one.
 
 `chat.toStreamTextOptions()` remains available for the same job, and is the only option in a [custom agent](#custom-agents), which has no `run` argument to take a bound `streamText` from. A `chat.headStart` route does get one, and there it also owns `messages`, `stopWhen` and `abortSignal`, since the handover depends on them. Pass `{ registry }` when a prompt names a provider-prefixed model, and `{ tools }` when you want HITL tool approvals, so the SDK knows which calls pause on `needsApproval`.
 
@@ -499,6 +501,8 @@ See [Actions](/ai-chat/actions).
 
 ### Webhook events and channels
 
+<WebhooksBetaNote />
+
 Two `chat.agent()` options wire an agent to verified inbound webhooks. `events` claims [`chat.event(...)`](/webhooks/session-routing) descriptors: each verified delivery is routed to this agent's session and arrives at `onAction` as an action (not a turn), so [session routing](/webhooks/session-routing) decides which conversation it lands on. `channels` claims channel connectors that turn an external chat surface into a frontend for the agent: an inbound message runs as a turn through `run()` and the reply is posted back. `slack()` ships in `@trigger.dev/slack`, and `chat.channels.custom(...)` builds a connector for any endpoint without a preset.
 
 ```ts
diff --git a/docs/ai-chat/patterns/redacting-telemetry.mdx b/docs/ai-chat/patterns/redacting-telemetry.mdx
index dea985801b8..2d4a587332a 100644
--- a/docs/ai-chat/patterns/redacting-telemetry.mdx
+++ b/docs/ai-chat/patterns/redacting-telemetry.mdx
@@ -4,7 +4,7 @@ sidebarTitle: "Redact chat content"
 description: "Stop a chat agent recording user messages and clientData on its spans, turn off AI SDK prompt and response recording, or redact span content with a span processor before it leaves the worker."
 ---
 
-A chat agent's run trace records conversation content by default: the user's message, the `clientData` your frontend sends, and, through AI SDK telemetry, the prompts and responses of each model call. This page covers the three controls that change that, and what they don't cover.
+A chat agent's run trace records conversation content by default: the user's message and the `clientData` your frontend sends. When AI SDK telemetry is on, it also records the prompts and responses of each model call. This page covers the three controls that change that, and what they don't cover.
 
 ## What the run trace records
 
@@ -13,7 +13,7 @@ A chat agent's run trace records conversation content by default: the user's mes
 | `chat turn N` | The last user message (`chat.user_message`) and its first 80 characters as the span preview | `telemetry.recordUserMessage` |
 | `chat turn N` | The raw `clientData` (`chat.client_data`) | `telemetry.recordClientData` |
 | `pending message injected` | Messages sent mid-turn (`pending.messages`) | `telemetry.recordUserMessage` |
-| AI SDK model call spans (on by default with the `streamText` from `run`) | Prompt messages, response text, tool calls | `telemetry.recordUserMessage` for the default config, or `experimental_telemetry` on the model call |
+| AI SDK model call spans, when AI SDK telemetry is on | Prompt messages, response text, tool calls | `experimental_telemetry` on the model call |
 | Any span | Everything above, plus your own attributes and span events | A span processor |
 
 ## Stop recording chat content
@@ -32,11 +32,11 @@ export const supportAgent = chat.agent({
 });
 ```
 
-The spans still appear in the trace with their timings and token usage. The turn spans have no preview text. `recordUserMessage: false` also keeps prompts and responses out of the AI SDK spans that the `streamText` passed to `run()` turns on, with or without a prompt stored by `chat.prompt.set()`, and leaves a stored prompt's variables out of the span metadata, unless the call passes its own `experimental_telemetry`.
+The spans still appear in the trace with their timings and token usage. The turn spans have no preview text.
 
 ## Stop the AI SDK recording prompts and responses
 
-The `streamText` passed to `run()` turns AI SDK telemetry on, so each model call and tool call is a span in the run trace (pass `experimental_telemetry: { isEnabled: false }` to turn the spans off). If you call `streamText` from `ai` yourself, pass `experimental_telemetry` to get them. Those spans include prompts and responses unless you turn that off with `recordInputs` and `recordOutputs`:
+AI SDK model call spans appear when AI SDK telemetry is on: [`chat.prompt.set()`](/ai-chat/backend#using-prompts) turns it on for you, or you pass `experimental_telemetry` yourself. Those spans include prompts and responses unless you turn that off with `recordInputs` and `recordOutputs`:
 
 ```ts /trigger/support-agent.ts
 import { chat } from "@trigger.dev/sdk/ai";
@@ -50,7 +50,7 @@ export const supportAgent = chat.agent({
       model: anthropic("claude-sonnet-4-5"),
       messages,
       abortSignal: signal,
-      // Replaces the default telemetry config (and chat.prompt.set()'s), so keep isEnabled on
+      // Replaces any telemetry config from chat.prompt.set(), so keep isEnabled on
       experimental_telemetry: { isEnabled: true, recordInputs: false, recordOutputs: false },
     }),
 });
diff --git a/docs/ai-chat/pending-messages.mdx b/docs/ai-chat/pending-messages.mdx
index 26abf1954ad..9749c296b1e 100644
--- a/docs/ai-chat/pending-messages.mdx
+++ b/docs/ai-chat/pending-messages.mdx
@@ -12,7 +12,7 @@ By default (without `pendingMessages`), a message sent while the agent is respon
 
 The `pendingMessages` option enables steering instead, injecting user messages between tool-call steps via the AI SDK's `prepareStep`. Messages that arrive during streaming are queued and injected at the next step boundary. A message that is not injected becomes the next turn instead, whether that is because `shouldInject` returned `false` or because there were no more step boundaries (single-step response or final text generation). The backend handles that, so no client-side re-send is involved.
 
-Messages from a [channel](/webhooks/channels) such as [Slack](/webhooks/slack) are offered the same way, with `metadata.source` set to `"channel"` so `shouldInject` can tell them apart. A channel's stop control and approval clicks are never offered. The connector acknowledges a channel message as soon as it arrives (Slack reacts with 👀, Linear posts a thought), before `shouldInject` decides, so the acknowledgement is the same whether the message is folded in or answered next.
+Messages from a [channel](/webhooks/channels) such as [Slack](/webhooks/slack) are offered the same way, with `metadata.source` set to `"channel"` so `shouldInject` can tell them apart. A channel's stop control and approval clicks are never offered. The connector acknowledges a channel message as soon as it arrives (Slack reacts with 👀, Linear posts a thought), before `shouldInject` decides, so the acknowledgement is the same whether the message is folded in or answered next. Channels are part of the [webhooks private beta](https://trigger.dev/webhooks-beta).
 
 Use the `streamText` passed to your agent's `run` callback. It wires up pending-message injection automatically. If you import `streamText` directly from `ai`, spread `chat.toStreamTextOptions()` into its options to connect injection.
 
diff --git a/docs/ai-chat/reference.mdx b/docs/ai-chat/reference.mdx
index 5c8b74e9540..a5bbf06f7e9 100644
--- a/docs/ai-chat/reference.mdx
+++ b/docs/ai-chat/reference.mdx
@@ -48,8 +48,8 @@ Options for `chat.agent()`.
 | `hydrateMessages`             | `(event: HydrateMessagesEvent) => UIMessage[] \| Promise<UIMessage[]>` | —                 | **Deprecated.** Load message history from backend, replacing the linear accumulator. Use `loadContext` on a `storage` instead; cannot be combined with `storage`. See [hydrateMessages](/ai-chat/lifecycle-hooks#hydratemessages) |
 | `actionSchema`                | `TaskSchema`                                                | —                              | Schema for validating custom actions sent via `transport.sendAction()`. See [Actions](/ai-chat/actions) |
 | `onAction`                    | `(event: ActionEvent) => Promise<void \| ActionTurn> \| void \| ActionTurn` | —                              | Handle custom actions. Actions are state edits: only `hydrateMessages` (or a storage's `loadContext`) + `onAction` fire. Return `chat.turn()` to run a turn on the edited history (`chat.turn(message)` to answer a new user message), or nothing for an edit only. See [Actions](/ai-chat/actions) |
-| `events`                      | `ChatEvent[]`                                               | —                              | Webhook event descriptors (from `chat.event()`) whose verified deliveries are routed to this agent as actions and handled in `onAction`. See [session routing](/webhooks/session-routing). |
-| `channels`                    | `ChannelConnector[]`                                        | —                              | Channel connectors (for example `slack()`) that turn an external chat surface into a frontend for the agent: inbound messages run as turns and the reply posts back. See [channels](/webhooks/channels). |
+| `events`                      | `ChatEvent[]`                                               | —                              | Webhook event descriptors (from `chat.event()`) whose verified deliveries are routed to this agent as actions and handled in `onAction`. See [session routing](/webhooks/session-routing). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
+| `channels`                    | `ChannelConnector[]`                                        | —                              | Channel connectors (for example `slack()`) that turn an external chat surface into a frontend for the agent: inbound messages run as turns and the reply posts back. See [channels](/webhooks/channels). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
 | `onTurnStart`                 | `(event: TurnStartEvent) => Promise<void> \| void`          | —                              | Fires every turn before `run()`                                                                     |
 | `onBeforeTurnComplete`        | `(event: BeforeTurnCompleteEvent) => Promise<void> \| void` | —                              | Fires after response but before stream closes. Includes `writer`.                                   |
 | `onTurnComplete`              | `(event: TurnCompleteEvent) => Promise<void> \| void`       | —                              | Fires after each turn completes (stream closed)                                                     |
@@ -542,8 +542,8 @@ All methods available on the `chat` object from `@trigger.dev/sdk/ai`.
 | Method                                      | Description                                                                                                                  |
 | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
 | `chat.agent(options)`                       | Create a chat agent                                                                                                          |
-| `chat.event(options)`                       | Declare an inbound webhook event descriptor an agent claims via `chat.agent({ events })`. See [session routing](/webhooks/session-routing). |
-| `chat.channels.custom(options)`             | Create a generic chat-frontend channel over any verified webhook source (you supply the egress). The `slack()` preset ships in `@trigger.dev/slack`. See [channels](/webhooks/channels). |
+| `chat.event(options)`                       | Declare an inbound webhook event descriptor an agent claims via `chat.agent({ events })`. See [session routing](/webhooks/session-routing). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
+| `chat.channels.custom(options)`             | Create a generic chat-frontend channel over any verified webhook source (you supply the egress). The `slack()` preset ships in `@trigger.dev/slack`. See [channels](/webhooks/channels). Part of the [webhooks private beta](https://trigger.dev/webhooks-beta). |
 | `chat.createSession(payload, options)`      | Create an async iterator for chat turns                                                                                      |
 | `chat.pipe(source, options?)`               | Pipe a stream to the frontend (from anywhere inside a task)                                                                  |
 | `chat.pipeAndCapture(source, options?)`     | Pipe and capture the response; returns `{ message, status, error }`                                                         |
diff --git a/docs/apikeys.mdx b/docs/apikeys.mdx
index 694fde36583..ae3bda91a3e 100644
--- a/docs/apikeys.mdx
+++ b/docs/apikeys.mdx
@@ -83,7 +83,7 @@ Access presets define what a key can do. On the Free and Hobby plans only the **
 | **Task operator** | Trigger all or selected tasks and inspect or operate on their runs |
 | **Observer** | Read runs, tasks, batches, logs, traces, queues, errors, and webhooks |
 | **Operator** | Observe and operate on runs, queues, errors, and webhooks, and trigger tasks |
-| **Webhooks only** | Read and write [webhooks](/webhooks/overview). Replaying deliveries that trigger tasks and creating webhook waiters require task or waitpoint scopes |
+| **Webhooks only** | Read and write [webhooks](/webhooks/overview), which are in private beta. Replaying deliveries that trigger tasks and creating webhook waiters require task or waitpoint scopes |
 | **Waitpoints only** | Create, list, and retrieve [waitpoint tokens](/wait-for-token). No task or run access |
 | **Deploy only** | Deploy versions, sync environment variables, and manage Preview branches |
 | **Variables only** | Read and write environment variables in this environment |
diff --git a/docs/guides/examples/hookdeck-webhook.mdx b/docs/guides/examples/hookdeck-webhook.mdx
index 8ef1778186a..1920a06148a 100644
--- a/docs/guides/examples/hookdeck-webhook.mdx
+++ b/docs/guides/examples/hookdeck-webhook.mdx
@@ -1,102 +1,71 @@
 ---
 title: "Trigger tasks from Hookdeck webhooks"
 sidebarTitle: "Hookdeck webhooks"
-description: "Forward webhooks from a Hookdeck connection to a hosted Trigger.dev endpoint, verified with the Hookdeck project's signing secret, and run a task for each event."
+description: "This example demonstrates how to use Hookdeck to receive webhooks and trigger Trigger.dev tasks."
 ---
 
-[Hookdeck](https://hookdeck.com) receives webhooks from external services, then queues, logs and forwards them to a destination. Point a Hookdeck connection at a hosted webhook endpoint and Trigger.dev verifies each forwarded request with the Hookdeck project's signing secret, deduplicates Hookdeck's retries, and runs your task with the original provider's payload.
+## Overview
 
-## Task code
-
-Declare the endpoint with `webhooks.hookdeck()` and subscribe a task to it. Hookdeck forwards the original provider's body unchanged, so pass that provider's event type. This example relays Stripe events:
-
-```ts /trigger/stripe-via-hookdeck.ts
-import type Stripe from "stripe";
-import { webhook, webhooks } from "@trigger.dev/sdk";
-
-export const stripeViaHookdeck = webhooks.endpoint.define({
-  id: "stripe-via-hookdeck",
-  source: webhooks.hookdeck<Stripe.Event>(),
-});
-
-export const paymentSucceeded = webhook({
-  id: "payment-succeeded",
-  endpoint: stripeViaHookdeck,
-  filter: "event.type == 'payment_intent.succeeded'",
-  onEvent: async ({ event }) => {
-    console.log("Payment succeeded", event.id);
-  },
-});
-```
+This example shows how to use [Hookdeck](https://hookdeck.com) as your webhook infrastructure to trigger Trigger.dev tasks. Hookdeck receives webhooks from external services, and forwards them directly to the Trigger.dev API. This gives you the best of both worlds: Hookdeck's webhook management, logging, and replay capabilities, combined with Trigger.dev's reliable task execution.
 
-Run `trigger dev` or deploy, then copy the endpoint's URL from the Webhooks page in the dashboard.
+## Key features
 
-## Set up Hookdeck
+- Use Hookdeck as your webhook endpoint for external services
+- Hookdeck forwards webhooks directly to Trigger.dev tasks via the API
+- All webhooks are logged and replayable in Hookdeck
 
-<Steps>
-  <Step title="Create a connection">
-    In the [Hookdeck dashboard](https://dashboard.hookdeck.com), create a [connection](https://hookdeck.com/docs/connections) from your source (for example a Stripe source) to an HTTP destination whose URL is the endpoint's URL. Keep the destination's authentication on **Hookdeck Signature**, the default for new destinations: Hookdeck only signs forwarded requests with it set.
-  </Step>
-  <Step title="Store the signing secret">
-    Copy the signing secret from **Settings > Secrets** in Hookdeck and set it as the endpoint's signing secret in the Trigger.dev dashboard. It's one secret for the whole Hookdeck project.
-  </Step>
-</Steps>
+## Setting up Hookdeck
 
-## Test it
+You'll configure everything in the [Hookdeck dashboard](https://dashboard.hookdeck.com). No code changes needed in your app.
 
-Send a webhook to your Hookdeck source URL, or trigger a real event in the upstream provider. In Hookdeck, the event shows a `200` response from the destination. In Trigger.dev, the endpoint shows a succeeded delivery and the `payment-succeeded` task has a completed run with the Stripe event as its payload.
+### 1. Create a destination
 
-A request signed with a different secret gets a `400`, which Hookdeck reports as a failed attempt.
+In Hookdeck, create a new [destination](https://hookdeck.com/docs/destinations) with the following settings:
 
-## Rotate the signing secret
+- **URL**: `https://api.trigger.dev/api/v1/tasks/<task-id>/trigger` (replace `<task-id>` with your task ID)
+- **Method**: POST
+- **Authentication**: Bearer token (create a named **Trigger only** environment API key and use it as `TRIGGER_SECRET_KEY`)
 
-Roll the signing secret under **Settings > Secrets** in Hookdeck with an expiry instead of expiring it immediately. Until the old secret expires, Hookdeck signs each request with both secrets, sending the previous secret's signature in `X-Hookdeck-Signature-2`. The endpoint accepts either, so deliveries keep verifying while you copy the new secret to Trigger.dev. Set a grace period when you store it to keep accepting the old secret for a while.
+### 2. Add a transformation
 
-## Deduplication
+Create a [transformation](https://hookdeck.com/docs/transformations) to wrap the webhook body in the `payload` field that Trigger.dev expects:
 
-Hookdeck retries and manual replays of the same event carry the same `X-Hookdeck-Eventid`, and the endpoint uses it as the [deduplication](/webhooks/deliveries#deduplication) key, so a retried event runs your task once.
-
-If you changed the header prefix in the Hookdeck project's settings, the event id arrives under the new prefix. Pass the prefix so deduplication keeps working:
-
-```ts /trigger/stripe-via-hookdeck.ts
-import type Stripe from "stripe";
-import { webhooks } from "@trigger.dev/sdk";
-
-export const stripeViaHookdeck = webhooks.endpoint.define({
-  id: "stripe-via-hookdeck",
-  source: webhooks.hookdeck<Stripe.Event>({ headerPrefix: "x-acme" }),
+```javascript
+addHandler("transform", (request, context) => {
+  request.body = { payload: { ...request.body } };
+  return request;
 });
 ```
 
-The signature headers keep the `X-Hookdeck-` name whatever the prefix.
-
-## Trigger a task through the API instead
-
-You can also point a Hookdeck destination at the [trigger task API](/management/tasks/trigger) without a hosted endpoint. Hookdeck authenticates with your API key instead of a signature, and a transformation wraps the body in the `payload` field the API expects.
+### 3. Create a connection
 
-1. Create a destination with the URL `https://api.trigger.dev/api/v1/tasks/<task-id>/trigger`, method `POST`, and **Bearer token** authentication using a **Trigger only** environment API key.
-2. Add a [transformation](https://hookdeck.com/docs/transformations):
+Create a [connection](https://hookdeck.com/docs/connections) that links your source (where webhooks come from) to the destination and transformation you created above.
 
-   ```javascript
-   addHandler("transform", (request, context) => {
-     request.body = { payload: { ...request.body } };
-     return request;
-   });
-   ```
+## Task code
 
-3. Create a connection from your source to that destination and transformation.
+This task will be triggered when Hookdeck forwards a webhook to the Trigger.dev API.
 
-```ts /trigger/webhook-handler.ts
+```ts trigger/webhook-handler.ts
 import { task } from "@trigger.dev/sdk";
 
 export const webhookHandler = task({
   id: "webhook-handler",
   run: async (payload: Record<string, unknown>) => {
+    // The payload contains the original webhook data from the external service
     console.log("Received webhook:", payload);
+
+    // Add your custom logic here
   },
 });
 ```
 
-This path has no deduplication of Hookdeck retries; each forwarded request triggers a run.
+## Testing your setup
+
+To test everything is working:
+
+1. Set up your destination, transformation, and connection in [Hookdeck](https://dashboard.hookdeck.com)
+2. Send a test webhook to your Hookdeck source URL (use the Hookdeck Console or cURL)
+3. Check the Hookdeck dashboard to verify the webhook was received and forwarded
+4. Check the [Trigger.dev dashboard](https://cloud.trigger.dev) to see the successful run of your task
 
-For more on Hookdeck, see the [Hookdeck documentation](https://hookdeck.com/docs).
+For more information on setting up Hookdeck, refer to the [Hookdeck Documentation](https://hookdeck.com/docs).
diff --git a/docs/mcp-tools.mdx b/docs/mcp-tools.mdx
index 5390f86f415..5b81109a755 100644
--- a/docs/mcp-tools.mdx
+++ b/docs/mcp-tools.mdx
@@ -4,6 +4,8 @@ sidebarTitle: "Tools"
 description: "Learn about how to use the tools available in the Trigger.dev MCP Server"
 ---
 
+import WebhooksBetaNote from "/snippets/webhooks-beta-note.mdx";
+
 ## Documentation and Search Tools
 
 ### search_docs
@@ -350,6 +352,8 @@ Append one record to a named side channel's `in` stream. Sends control input to
 
 ## Webhook Tools
 
+<WebhooksBetaNote />
+
 Set up and debug [hosted webhook endpoints](/webhooks/overview). Endpoint ids start with `wh_` and delivery ids with `whd_`; endpoint tools also accept an endpoint's declared id. The same operations are on the [Webhooks API](/management/webhooks/list-endpoints).
 
 ### list_webhook_endpoints
diff --git a/docs/snippets/webhooks-beta-banner.mdx b/docs/snippets/webhooks-beta-banner.mdx
new file mode 100644
index 00000000000..b84bd405475
--- /dev/null
+++ b/docs/snippets/webhooks-beta-banner.mdx
@@ -0,0 +1,7 @@
+import { PrivateBeta } from "/snippets/feature-status.jsx";
+
+<PrivateBeta flag="hasWebhooksAccess">
+  [Request access](https://trigger.dev/webhooks-beta) and we'll turn webhooks on for your
+  organization and send you the prerelease packages. Webhooks are open source, so they work
+  self-hosted too. APIs may change before general availability.
+</PrivateBeta>
diff --git a/docs/snippets/webhooks-beta-note.mdx b/docs/snippets/webhooks-beta-note.mdx
new file mode 100644
index 00000000000..5997a4bcb2b
--- /dev/null
+++ b/docs/snippets/webhooks-beta-note.mdx
@@ -0,0 +1,4 @@
+<Note>
+  Webhooks are in private beta. [Request access](https://trigger.dev/webhooks-beta) and we'll turn them on for your
+  organization.
+</Note>
diff --git a/docs/v3-openapi.yaml b/docs/v3-openapi.yaml
index 9d9b96aa067..1a9cfa5c31e 100644
--- a/docs/v3-openapi.yaml
+++ b/docs/v3-openapi.yaml
@@ -4796,6 +4796,8 @@ paths:
       operationId: list_webhook_endpoints_v1
       summary: List webhook endpoints
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         List the hosted webhook endpoints in the environment, ordered by declared id. Each endpoint
         includes its webhook URL and whether its signing secret is set. The secret itself is never returned.
       parameters:
@@ -4832,6 +4834,8 @@ paths:
       operationId: retrieve_webhook_endpoint_v1
       summary: Retrieve a webhook endpoint
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Retrieve one webhook endpoint with its subscribers, the filter each one applies, and its
         setup prompt: instructions for registering the endpoint and its signing secret with the provider.
       responses:
@@ -4862,6 +4866,8 @@ paths:
       operationId: enable_webhook_endpoint_v1
       summary: Enable a webhook endpoint
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Resume a disabled endpoint so its URL accepts deliveries again. Returns the updated endpoint.
       responses:
         "200":
@@ -4891,6 +4897,8 @@ paths:
       operationId: disable_webhook_endpoint_v1
       summary: Disable a webhook endpoint
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Pause an endpoint. Its status becomes `inactive` and its URL responds with `404` until you
         enable it, so providers see failed deliveries and retry on their own schedule. Returns the updated endpoint.
       responses:
@@ -4921,20 +4929,12 @@ paths:
       operationId: rotate_webhook_endpoint_secret_v1
       summary: Generate a webhook signing secret
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers
-        where you choose the secret, such as GitHub. It replaces the existing secret. Pass
-        `previousSecretTtlSeconds` to keep accepting the old secret while you update the provider; without
-        it, deliveries signed with the old secret fail verification straight away. Endpoints whose source
-        verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.
-      requestBody:
-        required: false
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                previousSecretTtlSeconds:
-                  $ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"
+        where you choose the secret, such as GitHub. It replaces any existing secret, so deliveries fail
+        verification until the provider uses the new one. Endpoints whose source verifies with a public key
+        refuse this; set the provider's key with the set secret endpoint instead.
       responses:
         "200":
           description: Successful request
@@ -4943,7 +4943,7 @@ paths:
               schema:
                 $ref: "#/components/schemas/RotateWebhookEndpointSecretResponse"
         "400":
-          description: The endpoint's source verifies with a public key, so a secret can't be generated, or the body is invalid
+          description: The endpoint's source verifies with a public key, so a secret can't be generated
           content:
             application/json:
               schema:
@@ -4961,9 +4961,7 @@ paths:
           label: Generate a signing secret
           source: |-
             curl -X POST "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret" \
-              -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
-              -H "Content-Type: application/json" \
-              -d '{ "previousSecretTtlSeconds": 3600 }'
+              -H "Authorization: Bearer $TRIGGER_SECRET_KEY"
   "/api/v1/webhooks/endpoints/{endpointId}/secret":
     parameters:
       - $ref: "#/components/parameters/webhookEndpointId"
@@ -4971,10 +4969,10 @@ paths:
       operationId: set_webhook_endpoint_secret_v1
       summary: Set a webhook signing secret
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Store the signing secret or public key the provider issued for this endpoint, such as the `whsec_`
-        secret Stripe returns when you create a webhook endpoint. It replaces the existing secret. Pass
-        `previousSecretTtlSeconds` to keep accepting the old secret for a while, for example while the
-        provider rolls its secret.
+        secret Stripe returns when you create a webhook endpoint. It replaces any existing secret.
       requestBody:
         required: true
         content:
@@ -4990,8 +4988,6 @@ paths:
                   maxLength: 4096
                   description: The signing secret or public key. Leading and trailing whitespace is trimmed.
                   example: whsec_5f2b...
-                previousSecretTtlSeconds:
-                  $ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"
       responses:
         "200":
           description: Successful request
@@ -5024,6 +5020,8 @@ paths:
       operationId: create_webhook_waiter_v1
       summary: Create a webhook waiter
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Create a waiter on an endpoint. A waiter is a waitpoint that completes when a matching delivery
         arrives on the endpoint, so a run waiting on its id resumes with the verified event. It only matches
         deliveries that arrive after it was created. Omit `match` to get a waiter with its own `url`, for
@@ -5094,6 +5092,8 @@ paths:
       operationId: cancel_webhook_waiter_v1
       summary: Cancel a webhook waiter
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Cancel a waiter. It stops matching deliveries, frees its slot toward the endpoint's limit, and fails
         the run's wait. If a delivery already claimed the waiter, the cancel is too late: the response has
         `cancelled: false` with `reason: "too_late"`, and the run resumes with that delivery's event.
@@ -5131,6 +5131,8 @@ paths:
       operationId: list_webhook_deliveries_v1
       summary: List webhook deliveries
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         List the verified events providers sent to the environment's endpoints, newest first. Filter by
         endpoint, status and time range, and page with `page[after]` and `page[before]`.
       parameters:
@@ -5222,6 +5224,8 @@ paths:
       operationId: retrieve_webhook_delivery_v1
       summary: Retrieve a webhook delivery
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Retrieve one delivery: its status and error, the event body and headers it carried, and a `targets`
         entry per subscriber with the run or session it started or why its filter skipped the event. When
         the delivery resumed waiting runs, one more entry summarizes them.
@@ -5253,6 +5257,8 @@ paths:
       operationId: replay_webhook_delivery_v1
       summary: Replay a webhook delivery
       description: >-
+        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
+
         Route a delivery's stored event again as a new delivery. Without `targetId` every current subscriber
         is checked against its filter again. With `targetId` the event goes to that one subscriber, even if
         its filter skipped it. A replay never resumes waiting runs. Replays start real runs, so the key needs
@@ -5878,11 +5884,6 @@ components:
           type: string
           description: The new signing secret. It is returned only in this response and can't be read again.
           example: whsec_5f2b...
-        previousSecretExpiresAt:
-          type: string
-          format: date-time
-          description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.
-          example: "2026-10-21T12:00:00.000Z"
     SetWebhookEndpointSecretResponse:
       type: object
       required: [id, secretSet]
@@ -5894,19 +5895,6 @@ components:
         secretSet:
           type: boolean
           const: true
-        previousSecretExpiresAt:
-          type: string
-          format: date-time
-          description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.
-          example: "2026-10-21T12:00:00.000Z"
-    WebhookPreviousSecretTtlSeconds:
-      type: integer
-      minimum: 0
-      maximum: 604800
-      description: >-
-        How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it
-        or pass 0 to replace the secret immediately, for example when it leaked.
-      example: 3600
     WebhookDeliveryStatus:
       type: string
       enum: [pending, processing, succeeded, failed, filtered, unmatched]
diff --git a/docs/webhooks/channels.mdx b/docs/webhooks/channels.mdx
index 049b69f01ea..fe60b1a81f9 100644
--- a/docs/webhooks/channels.mdx
+++ b/docs/webhooks/channels.mdx
@@ -4,6 +4,10 @@ description: "Point Slack (or any chat surface) at an agent: messages become tur
 sidebarTitle: "Channels"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 A [session route](/webhooks/session-routing) delivers a verified event to an agent as an [action](/ai-chat/actions): the agent reacts, and the response is a side effect. A **channel** is the other half: the webhook IS the chat surface. Inbound messages become **turns** (the normal `run()` loop), and the agent's reply is posted **back** to the surface. A Slack thread becomes a real conversation with the agent, exactly like the browser chat, just a different frontend.
 
 List channels on a [`chat.agent`](/ai-chat/overview) alongside (or instead of) `events`:
diff --git a/docs/webhooks/connect.mdx b/docs/webhooks/connect.mdx
index f07f27d326a..0f429810193 100644
--- a/docs/webhooks/connect.mdx
+++ b/docs/webhooks/connect.mdx
@@ -4,6 +4,10 @@ description: "Register an endpoint's URL and signing secret with the provider, b
 sidebarTitle: "Connect a provider"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 Connect a provider to an [endpoint](/webhooks/overview) by registering the endpoint's URL with the provider and giving Trigger.dev the credential that verifies its requests.
 
 Deploy the project or start `trigger dev` first. Once the CLI finds the endpoint, it appears on the environment's **Webhooks** page. The **Signing secret** column shows **Ready** when the endpoint can verify deliveries and **Needs secret** until then. Every delivery is rejected while an endpoint needs its secret.
@@ -18,8 +22,8 @@ The prompt tells the agent to use the Trigger.dev MCP server (`npx trigger.dev@l
 | --- | --- |
 | `list_webhook_endpoints` | Lists the environment's endpoints, with their URL and whether a secret is set. |
 | `get_webhook_endpoint_details` | Reads one endpoint: URL, subscribers and their filters, secret state, and the setup prompt. |
-| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |
-| `set_webhook_secret` | Stores a secret the provider issued. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |
+| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. |
+| `set_webhook_secret` | Stores a secret the provider issued. |
 
 Without the MCP server, the same operations are available on the REST API with the environment's secret key:
 
@@ -74,18 +78,7 @@ The verify token answers the URL check. The signing secret verifies event delive
 
 Choose **Rotate signing secret** to replace a provider-supplied secret. For a secret you generate, choose **Regenerate secret**, copy the new value, and update the provider's configuration. Use **Rotate public key** when replacing an asymmetric provider's key.
 
-Both dialogs ask how long to keep accepting the old secret: **Stop immediately**, 1 hour, 24 hours (the default) or 7 days. Until then, deliveries signed with either secret verify, so you can update the provider without failing any. Choose **Stop immediately** if the old secret leaked.
-
-Through the MCP tools or the REST API, pass `previousSecretTtlSeconds` (at most 604800, 7 days). The response's `previousSecretExpiresAt` says when the old secret stops working. Without it, the old secret stops working straight away:
-
-```bash
-curl -X POST "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret" \
-  -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"previousSecretTtlSeconds": 3600}'
-```
-
 <Warning>
   Trigger.dev stores credentials encrypted and doesn't display saved values. Copy a generated secret
-  before closing the dialog.
+  before closing the dialog. Deliveries signed with the old secret fail verification after rotation.
 </Warning>
diff --git a/docs/webhooks/deliveries.mdx b/docs/webhooks/deliveries.mdx
index 836c85524ed..5b4891699de 100644
--- a/docs/webhooks/deliveries.mdx
+++ b/docs/webhooks/deliveries.mdx
@@ -4,6 +4,10 @@ description: "Inspect webhook payloads, where each delivery went, and the runs i
 sidebarTitle: "Deliveries and endpoints"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **A delivery records a verified webhook event and what happened to it at each subscriber.** Find deliveries on an endpoint's **Deliveries** tab. A run that a delivery triggered links back to it, and to its endpoint, from the run's **Detail** tab.
 
 ## Endpoints
@@ -85,7 +89,7 @@ When the source maps a provider event ID, that ID becomes the key, so the provid
 
 | Key | Sources |
 | --- | --- |
-| A header | GitHub (`X-GitHub-Delivery`), Svix and Autumn (`svix-id`), Standard Webhooks, Loops and Granola (`webhook-id`), Linear (`Linear-Delivery`), PagerDuty (`X-Webhook-Id`), Jira (`X-Atlassian-Webhook-Identifier`), Zendesk (`X-Zendesk-Webhook-Invocation-Id`), Attio (`Idempotency-Key`), Shopify (`X-Shopify-Webhook-Id`), Hookdeck (`X-Hookdeck-Eventid`, or `<prefix>-eventid` with a custom header prefix) |
+| A header | GitHub (`X-GitHub-Delivery`), Svix and Autumn (`svix-id`), Standard Webhooks, Loops and Granola (`webhook-id`), Linear (`Linear-Delivery`), PagerDuty (`X-Webhook-Id`), Jira (`X-Atlassian-Webhook-Identifier`), Zendesk (`X-Zendesk-Webhook-Invocation-Id`), Attio (`Idempotency-Key`), Shopify (`X-Shopify-Webhook-Id`) |
 | A body field | Stripe, Notion, Vercel, Intercom, WorkOS, Metronome, Mux, Langfuse and Plain (`id`), Square, Slack and Typeform (`event_id`), Firecrawl (`webhookId`) |
 
 The other named sources (Zoom, Calendly, Sentry, DocuSign, ElevenLabs, Vapi, Retell, Tailscale, Infisical, PlanetScale, Supabase, Discord) use the fallback below.
diff --git a/docs/webhooks/filters.mdx b/docs/webhooks/filters.mdx
index 0c7495ee2da..53efbb7aed8 100644
--- a/docs/webhooks/filters.mdx
+++ b/docs/webhooks/filters.mdx
@@ -4,6 +4,10 @@ description: "Choose which verified webhook events reach each subscriber, by pay
 sidebarTitle: "Filters"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **A filter selects which verified deliveries reach a subscriber.** Each subscriber on an [endpoint](/webhooks/overview) has its own filter, so one delivery can start one task and skip another. A delivery no subscriber takes is recorded with status `FILTERED`, so you can inspect it in the dashboard.
 
 ## Add a filter
diff --git a/docs/webhooks/human-in-the-loop.mdx b/docs/webhooks/human-in-the-loop.mdx
index f166806f604..e6affd393cd 100644
--- a/docs/webhooks/human-in-the-loop.mdx
+++ b/docs/webhooks/human-in-the-loop.mdx
@@ -4,6 +4,10 @@ sidebarTitle: "Human-in-the-loop"
 description: "Pause an agent mid-turn to get a human decision from the channel (Slack approve/deny), then resume with the answer."
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **An agent on a [channel](/webhooks/channels) can pause a turn to get a human decision, then resume once someone answers in the thread.** It posts controls into the conversation and picks up where it left off once someone clicks, with the decision merged into the turn. This is the channel counterpart of browser [human-in-the-loop](/ai-chat/patterns/human-in-the-loop): the same no-`execute` tool, but the controls live in Slack (or your own surface) instead of a React component. The [`slack()`](/webhooks/slack) connector ships Approve and Deny buttons out of the box.
 
 ## How it works
diff --git a/docs/webhooks/linear.mdx b/docs/webhooks/linear.mdx
index 48694962103..a478fa0e741 100644
--- a/docs/webhooks/linear.mdx
+++ b/docs/webhooks/linear.mdx
@@ -4,6 +4,10 @@ description: "Turn a chat.agent into a Linear agent: assign it an issue or @ment
 sidebarTitle: "Linear agents"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 Linear opens an **agent session** when someone @mentions your app in an issue or delegates (assigns) an issue to it. `linear()` from `@trigger.dev/linear` is a [channel](/webhooks/channels) connector for those sessions: each one becomes a durable Trigger.dev [session](/ai-chat/sessions), the user's prompt runs as a turn, and the agent's work shows up in Linear as thoughts, actions, a plan, an approval card when it needs a decision, and a response when it is done.
 
 ```ts
diff --git a/docs/webhooks/overview.mdx b/docs/webhooks/overview.mdx
index 84d7f437470..0613611f570 100644
--- a/docs/webhooks/overview.mdx
+++ b/docs/webhooks/overview.mdx
@@ -4,6 +4,10 @@ description: "Receive provider webhooks on hosted, verified endpoints and route
 sidebarTitle: "Overview"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **A webhook endpoint is one hosted URL that you register with a provider.** Trigger.dev verifies every request against the endpoint's [source](/webhooks/sources), records it as a [delivery](/webhooks/deliveries), and hands the event to everything subscribed to the endpoint.
 
 Declare the endpoint once, then subscribe to it:
diff --git a/docs/webhooks/session-routing.mdx b/docs/webhooks/session-routing.mdx
index 297e63bd85c..84be1570daa 100644
--- a/docs/webhooks/session-routing.mdx
+++ b/docs/webhooks/session-routing.mdx
@@ -4,6 +4,10 @@ description: "Route verified webhook deliveries to a durable per-key session ins
 sidebarTitle: "Session routing"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 A plain [`webhook()`](/webhooks/overview) runs a fresh, stateless run for every delivery. Sometimes you want the opposite: deliveries that share a key (a customer, an installation, an issue) should land on **one durable [session](/ai-chat/sessions)** and be handled in order, with state carried across them. That is what session routing does.
 
 Instead of a handler, you declare a `chat.event` on an [endpoint](/webhooks/overview) and list it on an agent. The verified delivery is routed to a find-or-created session and arrives as an [action](/ai-chat/actions).
diff --git a/docs/webhooks/slack.mdx b/docs/webhooks/slack.mdx
index 1be48e5e2dd..0f8bf1d6542 100644
--- a/docs/webhooks/slack.mdx
+++ b/docs/webhooks/slack.mdx
@@ -4,6 +4,10 @@ description: "Turn a chat.agent into a Slack agent: users message it in Slack, i
 sidebarTitle: "Slack agents"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **`slack()` from `@trigger.dev/slack` turns a `chat.agent` into a native Slack agent.** Each Slack agent session (a conversation with the agent, or a thread in a channel) becomes a durable Trigger.dev [session](/ai-chat/sessions). A message runs as a turn, the session shows the agent working, the reply streams into the thread as the model writes it, and Slack's stop button stops the turn.
 
 ```ts /trigger/support.ts
diff --git a/docs/webhooks/sources.mdx b/docs/webhooks/sources.mdx
index 643de74ae01..ab31f39bd9b 100644
--- a/docs/webhooks/sources.mdx
+++ b/docs/webhooks/sources.mdx
@@ -4,6 +4,10 @@ description: "Choose an endpoint's source, configure verification, and type the
 sidebarTitle: "Sources & verification"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 An endpoint's `source` defines how Trigger.dev verifies requests and types the event every subscriber receives. Choose a named provider source or supply a verification configuration with `webhooks.custom()`.
 
 ## Presets
@@ -97,7 +101,6 @@ Each function below returns a source with its provider's verification configurat
 | HMAC-SHA256 with `X-Hub-Signature-256` | `whatsapp()` |
 | Shared secret in `X-Gitlab-Token` | `gitlab()` |
 | Shared secret as `Authorization: Bearer` | `supabase()` |
-| Hookdeck relay (HMAC-SHA256 with `X-Hookdeck-Signature`) | `hookdeck()` |
 | Provider-specific HMAC | `calendly()`, `calCom()`, `sentry()`, `pagerduty()`, `vercel()`, `linear()`, `notion()`, `typeform()`, `docusign()`, `jira()`, `intercom()`, `zendesk()`, `attio()`, `workos()`, `elevenlabs()`, `vapi()`, `retell()`, `shopify()`, `metronome()`, `mux()`, `tailscale()`, `langfuse()`, `infisical()`, `planetscale()`, `plain()`, `firecrawl()` |
 
 Provider IDs containing a hyphen use a camel case function name: the `cal-com` provider is `webhooks.calCom()`.
@@ -106,35 +109,6 @@ Supabase database webhooks aren't signed, so `supabase()` checks a shared secret
 
 Slack also ships as a chat channel in `@trigger.dev/slack`.
 
-### Hookdeck
-
-`hookdeck()` verifies requests that a [Hookdeck](https://hookdeck.com) connection forwards to the endpoint. Hookdeck forwards the original provider's body unchanged, so pass that provider's event type:
-
-```ts /trigger/stripe-via-hookdeck.ts
-import type Stripe from "stripe";
-import { webhook, webhooks } from "@trigger.dev/sdk";
-
-export const stripeViaHookdeck = webhooks.endpoint.define({
-  id: "stripe-via-hookdeck",
-  source: webhooks.hookdeck<Stripe.Event>(),
-});
-
-export const paymentSucceeded = webhook({
-  id: "payment-succeeded",
-  endpoint: stripeViaHookdeck,
-  filter: "event.type == 'payment_intent.succeeded'",
-  onEvent: async ({ event }) => {
-    console.log(event.id);
-  },
-});
-```
-
-Use the endpoint URL as the connection's HTTP destination, keep the destination's authentication on Hookdeck Signature (the default for new destinations), and store the Hookdeck project's signing secret from **Settings > Secrets** as the endpoint's signing secret.
-
-- **Secret rotation:** when you roll the signing secret in Hookdeck with an expiry, Hookdeck also signs each request with the previous secret in `X-Hookdeck-Signature-2`, so deliveries keep verifying until you store the new secret.
-- **Deduplication:** retries dedupe on `X-Hookdeck-Eventid`, which is the same on every attempt of a Hookdeck event.
-- **Custom header prefix:** if you changed the header prefix in the Hookdeck project's settings, pass it with `webhooks.hookdeck({ headerPrefix: "x-acme" })`. The prefix renames the event id header; the signature headers keep the `X-Hookdeck-` name.
-
 ## Endpoint validation
 
 Some sources also define a response for the provider's endpoint-validation request. These requests don't create deliveries or task runs.
diff --git a/docs/webhooks/waiters.mdx b/docs/webhooks/waiters.mdx
index 1787e34cc90..d059cdf388f 100644
--- a/docs/webhooks/waiters.mdx
+++ b/docs/webhooks/waiters.mdx
@@ -4,6 +4,10 @@ description: "Pause a run until a matching webhook arrives on an endpoint, then
 sidebarTitle: "Waiters"
 ---
 
+import WebhooksBetaBanner from "/snippets/webhooks-beta-banner.mdx";
+
+<WebhooksBetaBanner />
+
 **A waiter pauses a run until a matching delivery arrives on an [endpoint](/webhooks/overview).** Use it when your task starts something in another system and needs to know when that system reports back: a payment that settles, a build that finishes, a document that gets signed.
 
 ```ts /trigger/checkout.ts
diff --git a/internal-packages/run-engine/src/engine/index.ts b/internal-packages/run-engine/src/engine/index.ts
index 38428c29e3b..528ce48266d 100644
--- a/internal-packages/run-engine/src/engine/index.ts
+++ b/internal-packages/run-engine/src/engine/index.ts
@@ -466,7 +466,6 @@ export class RunEngine {
     });
 
     this.waitpointSystem = new WaitpointSystem({
-      waitpointStoreEnabled: options.waitpointStoreEnabled,
       resources,
       executionSnapshotSystem: this.executionSnapshotSystem,
       enqueueSystem: this.enqueueSystem,
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
deleted file mode 100644
index d17dbccea0d..00000000000
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.test.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-// Pure mapping coverage; storage routing and failures use real stores in the integration suite.
-import { describe, expect, it } from "vitest";
-import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
-import type {
-  WaitpointCompletion,
-  WaitpointRecordInput,
-  WaitpointStoredRecord,
-} from "../waitpointCoordinator/storeCoordinator.js";
-import { storeRecordToCompletedWaitpointRecord } from "./completedWaitpointRecordAdapter.js";
-
-function storeRecordInput(
-  id: string,
-  overrides: Partial<WaitpointRecordInput> = {}
-): WaitpointRecordInput {
-  return {
-    id,
-    friendlyId: `waitpoint_${id}`,
-    type: "MANUAL",
-    environmentId: "env_1",
-    projectId: "proj_1",
-    createdAt: "2026-01-01T00:00:00.000Z",
-    updatedAt: "2026-01-01T00:00:00.000Z",
-    userProvidedIdempotencyKey: false,
-    tags: [],
-    ...overrides,
-  };
-}
-
-function storeCompletion(overrides: Partial<WaitpointCompletion> = {}): WaitpointCompletion {
-  return {
-    completedAt: "2026-01-01T00:00:00.000Z",
-    outputType: "application/json",
-    outputIsError: false,
-    output: null,
-    ...overrides,
-  };
-}
-
-function storeEntry(
-  id: string,
-  recordOverrides: Partial<WaitpointRecordInput> = {},
-  completion: WaitpointCompletion | undefined = storeCompletion(),
-  status: WaitpointStoredRecord["status"] = "COMPLETED"
-): WaitpointStoredRecord {
-  return { status, record: storeRecordInput(id, recordOverrides), completion };
-}
-
-// A fixed effective time for the mapping tests that do not exercise expiry.
-const NOW_MS = Date.parse("2026-08-21T12:00:00.000Z");
-const mapStoreRecord = (entry: WaitpointStoredRecord, nowMs: number = NOW_MS) =>
-  storeRecordToCompletedWaitpointRecord(entry, nowMs);
-
-describe("storeRecordToCompletedWaitpointRecord — envelope fidelity", () => {
-  it("preserves an inline output", () => {
-    const id = generateWaitpointId("MANUAL");
-    const record = mapStoreRecord(
-      storeEntry(id, {}, storeCompletion({ output: { inline: '{"value":42}' } }))
-    );
-    expect(record.output).toEqual({ inline: '{"value":42}' });
-  });
-
-  it("preserves a referenced (offloaded) output", () => {
-    const id = generateWaitpointId("MANUAL");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        {},
-        storeCompletion({ outputType: "application/store", output: { ref: "s3://bucket/key" } })
-      )
-    );
-    expect(record.output).toEqual({ ref: "s3://bucket/key" });
-    expect(record.outputType).toBe("application/store");
-  });
-
-  it("preserves an error output and its flag", () => {
-    const id = generateWaitpointId("MANUAL");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        {},
-        storeCompletion({ outputIsError: true, output: { inline: '{"type":"STRING_ERROR"}' } })
-      )
-    );
-    expect(record.outputIsError).toBe(true);
-    expect(record.output).toEqual({ inline: '{"type":"STRING_ERROR"}' });
-  });
-
-  it("keeps a RUN success on deriveFromRun, not a copy of its output", () => {
-    const id = generateWaitpointId("RUN");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        { type: "RUN", completedByTaskRunId: "run_child" },
-        storeCompletion({ output: { inline: '{"value":42}' } })
-      )
-    );
-    // The stored inline value is dropped: the read side re-derives it from TaskRun.output.
-    expect(record.output).toEqual({ deriveFromRun: true });
-    expect(record.completedByTaskRunId).toBe("run_child");
-  });
-
-  it("keeps a RUN success on deriveFromRun even when the stored output is null", () => {
-    // The store may keep a re-derivable RUN success's output null rather than copy it. That null must
-    // still resolve to deriveFromRun, NOT to no output — the completion is re-read from TaskRun.output.
-    const id = generateWaitpointId("RUN");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        { type: "RUN", completedByTaskRunId: "run_child" },
-        storeCompletion({ output: null })
-      )
-    );
-    expect(record.output).toEqual({ deriveFromRun: true });
-    expect(record.completedByTaskRunId).toBe("run_child");
-  });
-
-  it("carries a RUN ERROR inline, never deriveFromRun", () => {
-    const id = generateWaitpointId("RUN");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        { type: "RUN", completedByTaskRunId: "run_child" },
-        storeCompletion({ outputIsError: true, output: { inline: '{"type":"BUILT_IN_ERROR"}' } })
-      )
-    );
-    expect(record.output).toEqual({ inline: '{"type":"BUILT_IN_ERROR"}' });
-  });
-
-  it("preserves timestamps and type-specific metadata", () => {
-    const id = generateWaitpointId("DATETIME");
-    const record = mapStoreRecord(
-      storeEntry(
-        id,
-        { type: "DATETIME", completedAfter: "2026-02-02T00:00:00.000Z" },
-        storeCompletion({ completedAt: "2026-03-03T04:05:06.000Z" })
-      )
-    );
-    expect(record.type).toBe("DATETIME");
-    expect(record.completedAt).toBe("2026-03-03T04:05:06.000Z");
-    expect(record.completedAfter).toBe("2026-02-02T00:00:00.000Z");
-  });
-
-  it("exposes a user-provided idempotency key and hides a system one", () => {
-    const id = generateWaitpointId("MANUAL");
-    const withUserKey = mapStoreRecord(
-      storeEntry(id, { userProvidedIdempotencyKey: true, idempotencyKey: "idem_user" })
-    );
-    expect(withUserKey.idempotencyKey).toBe("idem_user");
-
-    const withSystemKey = mapStoreRecord(
-      storeEntry(id, { userProvidedIdempotencyKey: false, idempotencyKey: "idem_system" })
-    );
-    expect(withSystemKey.idempotencyKey).toBeUndefined();
-  });
-});
-
-describe("storeRecordToCompletedWaitpointRecord — idempotency key expiry", () => {
-  const iso = (ms: number) => new Date(ms).toISOString();
-  const userKey = (overrides: Partial<WaitpointRecordInput>) =>
-    storeEntry(generateWaitpointId("MANUAL"), {
-      userProvidedIdempotencyKey: true,
-      idempotencyKey: "idem_user",
-      ...overrides,
-    });
-
-  it("keeps a user key with no expiry visible", () => {
-    expect(mapStoreRecord(userKey({}), NOW_MS).idempotencyKey).toBe("idem_user");
-  });
-
-  it("keeps a user key with a future expiry visible", () => {
-    const record = mapStoreRecord(
-      userKey({ idempotencyKeyExpiresAt: iso(NOW_MS + 60_000) }),
-      NOW_MS
-    );
-    expect(record.idempotencyKey).toBe("idem_user");
-  });
-
-  it("omits a user key with a past expiry", () => {
-    const record = mapStoreRecord(
-      userKey({ idempotencyKeyExpiresAt: iso(NOW_MS - 60_000) }),
-      NOW_MS
-    );
-    expect(record.idempotencyKey).toBeUndefined();
-  });
-
-  it("omits a user key expiring exactly at the effective time (PEXPIREAT semantics)", () => {
-    const record = mapStoreRecord(userKey({ idempotencyKeyExpiresAt: iso(NOW_MS) }), NOW_MS);
-    expect(record.idempotencyKey).toBeUndefined();
-  });
-
-  it("fails loud on a malformed stored expiry", () => {
-    expect(() =>
-      mapStoreRecord(userKey({ idempotencyKeyExpiresAt: "not-a-date" }), NOW_MS)
-    ).toThrow(/malformed idempotencyKeyExpiresAt/);
-  });
-
-  it("keeps a system-generated key hidden regardless of expiry (never throws on its expiry)", () => {
-    const system = (expiry: string | undefined) =>
-      storeEntry(generateWaitpointId("MANUAL"), {
-        userProvidedIdempotencyKey: false,
-        idempotencyKey: "idem_system",
-        idempotencyKeyExpiresAt: expiry,
-      });
-    expect(mapStoreRecord(system(iso(NOW_MS - 60_000)), NOW_MS).idempotencyKey).toBeUndefined();
-    expect(mapStoreRecord(system(iso(NOW_MS + 60_000)), NOW_MS).idempotencyKey).toBeUndefined();
-    // A malformed expiry on a hidden key is never consulted, so it does not fail loud.
-    expect(mapStoreRecord(system("not-a-date"), NOW_MS).idempotencyKey).toBeUndefined();
-  });
-});
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
deleted file mode 100644
index f96d6deac82..00000000000
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointRecordAdapter.ts
+++ /dev/null
@@ -1,251 +0,0 @@
-// The Waitpoint-side adapter TRES consumes when it builds a fresh Redis-primary completed-waitpoint
-// cycle. It turns the run's ordered blocker ids into exactly one frozen CompletedWaitpointRecord per
-// DISTINCT id, resolving each id through the coordinator its SHAPE names — legacy ids through Postgres,
-// store-format ids through MemoryDB — and combines the two residencies into one complete record set.
-//
-// The frozen record shape and the write-side rules live in completedWaitpointResolver.ts and
-// completedWaitpointFreeze.test.ts; this file only routes ids to the right source and maps a
-// store-resident completion into that same shape. It never touches Redis or Postgres directly: the
-// readers are injected, so the partition/coverage logic is a pure function of them.
-import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
-import type { CompletedWaitpointRecord } from "@internal/run-store";
-import type {
-  WaitpointCompletion,
-  WaitpointRecordInput,
-  WaitpointStoredRecord,
-} from "../waitpointCoordinator/storeCoordinator.js";
-
-/**
- * The whole resolution failed loudly. Every path that leaves a distinct id without exactly one
- * complete record throws this: a missing legacy or store record, a store record that is not
- * COMPLETED, a store id with no store reader, or a coverage mismatch. TRES turns a throw here into a
- * rolled-back transition, so a partial cycle is never published.
- */
-export class UnresolvableCompletedWaitpointRecordsError extends Error {
-  constructor(
-    message: string,
-    readonly waitpointId?: string
-  ) {
-    super(message);
-    this.name = "UnresolvableCompletedWaitpointRecordsError";
-  }
-}
-
-/** Resolves the legacy (Postgres) half: one record per DISTINCT id, missing ids simply absent. */
-export type LegacyCompletedWaitpointReader = (ids: string[]) => Promise<CompletedWaitpointRecord[]>;
-
-/** Resolves the store (MemoryDB) half: a map of the ids PRESENT in the store. Absence != failure. */
-export type StoreCompletedWaitpointReader = (
-  ids: string[]
-) => Promise<Map<string, WaitpointStoredRecord>>;
-
-/**
- * Map a store-resident record + completion to the frozen CompletedWaitpointRecord shape, as of
- * `nowMs` (the resolver's single effective time).
- *
- * Output selection mirrors the Postgres write side (`recordOutputFor`): a RUN success re-derives its
- * output byte-identically from TaskRun.output, so it carries `deriveFromRun` and NOT a copy — even an
- * offloaded one — which keeps a potentially large inline value out of the cycle payload. Everything
- * else passes the store's own inline/ref discrimination straight through.
- *
- * The idempotency key is the already-resolved user-visible value, gated on its expiry (see
- * `idempotencyKeyIsActive`): the store keeps the original key on the immutable record even after its
- * separate reservation has expired via `PEXPIREAT`, so exposing it unconditionally would let an old
- * waitpoint present a key a replacement waitpoint has since taken over — the exact state the Postgres
- * path drops through `inactiveIdempotencyKey`.
- */
-export function storeRecordToCompletedWaitpointRecord(
-  entry: WaitpointStoredRecord,
-  nowMs: number
-): CompletedWaitpointRecord {
-  const { record, completion } = entry;
-  if (!completion) {
-    throw new UnresolvableCompletedWaitpointRecordsError(
-      `Waitpoint ${record.id} is COMPLETED in the store with no completion envelope`,
-      record.id
-    );
-  }
-
-  return {
-    id: record.id,
-    friendlyId: record.friendlyId,
-    type: record.type,
-    completedAt: completion.completedAt,
-    outputType: completion.outputType,
-    outputIsError: completion.outputIsError,
-    output: storeRecordOutput(record, completion),
-    completedByTaskRunId: record.completedByTaskRunId,
-    completedByBatchId: record.completedByBatchId,
-    completedAfter: record.completedAfter,
-    idempotencyKey: idempotencyKeyIsActive(record, nowMs) ? record.idempotencyKey : undefined,
-  };
-}
-
-/**
- * Whether a store record's idempotency key is user-visible at `nowMs`.
- *
- * A system-generated or absent key is never exposed, and its expiry is not even consulted. A
- * user-provided key with no expiry is always active. One with an expiry is active only STRICTLY before
- * that instant: at the exact expiry ms the key is already gone, matching the `PEXPIREAT` that retires
- * its reservation. A stored expiry that will not parse is corrupted durable state, so it fails loud
- * rather than exposing the key or silently reinterpreting it.
- */
-function idempotencyKeyIsActive(record: WaitpointRecordInput, nowMs: number): boolean {
-  if (!record.userProvidedIdempotencyKey || !record.idempotencyKey) {
-    return false;
-  }
-  const raw = record.idempotencyKeyExpiresAt;
-  if (raw === undefined) {
-    return true;
-  }
-  const expiresAtMs = Date.parse(raw);
-  if (Number.isNaN(expiresAtMs)) {
-    throw new UnresolvableCompletedWaitpointRecordsError(
-      `Waitpoint ${record.id} has a malformed idempotencyKeyExpiresAt: ${JSON.stringify(raw)}`,
-      record.id
-    );
-  }
-  return expiresAtMs > nowMs;
-}
-
-function storeRecordOutput(
-  record: WaitpointRecordInput,
-  completion: WaitpointCompletion
-): CompletedWaitpointRecord["output"] {
-  // FIRST, before the null and inline/ref branches: a RUN success re-derives its output
-  // byte-identically from TaskRun.output, so it carries deriveFromRun and never a copy. This
-  // precedes the null check deliberately — unlike the Postgres write side, where a null output means
-  // "none". The store may store a RUN success's output as null precisely BECAUSE it is re-derivable
-  // and was never copied, so a null here must still resolve to deriveFromRun, not to no output.
-  if (record.type === "RUN" && !completion.outputIsError && record.completedByTaskRunId) {
-    return { deriveFromRun: true };
-  }
-  const output = completion.output;
-  if (output === null) {
-    return null;
-  }
-  if ("ref" in output) {
-    return { ref: output.ref };
-  }
-  return { inline: output.inline };
-}
-
-/**
- * Resolve the complete frozen record set for one Redis-primary resume.
- *
- * `requestedIds` is the caller's ordered, duplicate-preserving blocker list. The returned records are
- * one per DISTINCT id, in first-seen order — the ordered/duplicate reference list and its indexes stay
- * with the caller's separate `completedWaitpoints` array, which is what the read-time enhancement step
- * expands. Every distinct id is resolved exactly once even when referenced repeatedly.
- *
- * Partitioning is by id SHAPE and is total and exclusive: `parseWaitpointId` classes every id as
- * either legacy or store-format, never both and never neither. A store id therefore never reaches
- * Postgres, and a missing store record never falls back to it.
- */
-export async function resolveCompletedWaitpointRecords(args: {
-  requestedIds: string[];
-  legacyReader: LegacyCompletedWaitpointReader;
-  storeReader?: StoreCompletedWaitpointReader;
-  /** Effective-time clock, called exactly ONCE. Injectable for tests; defaults to `Date.now`. */
-  now?: () => number;
-}): Promise<CompletedWaitpointRecord[]> {
-  const { requestedIds, legacyReader, storeReader } = args;
-
-  // Captured ONCE for the whole invocation, so a cycle whose records straddle an idempotency-key
-  // expiry boundary judges every record against the same instant instead of a per-record clock.
-  const nowMs = (args.now ?? Date.now)();
-
-  // First-seen order, duplicates collapsed: the distinct set we must cover exactly once each.
-  const distinctIds: string[] = [];
-  const seen = new Set<string>();
-  const legacyIds: string[] = [];
-  const storeIds: string[] = [];
-  for (const id of requestedIds) {
-    if (seen.has(id)) continue;
-    seen.add(id);
-    distinctIds.push(id);
-    if (parseWaitpointId(id).format === "legacy") {
-      legacyIds.push(id);
-    } else {
-      storeIds.push(id);
-    }
-  }
-
-  if (storeIds.length > 0 && !storeReader) {
-    throw new UnresolvableCompletedWaitpointRecordsError(
-      `${storeIds.length} store-format waitpoint id(s) in the cycle but no store coordinator is available to resolve them`,
-      storeIds[0]
-    );
-  }
-
-  const byId = new Map<string, CompletedWaitpointRecord>();
-
-  if (legacyIds.length > 0) {
-    const legacySet = new Set(legacyIds);
-    const legacyRecords = await legacyReader(legacyIds);
-    for (const rec of legacyRecords) {
-      if (!legacySet.has(rec.id)) {
-        // The reader returned a record for an id we never asked for (or a store id): an integrity
-        // failure, not something to silently keep.
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `Legacy reader returned an unrequested record ${rec.id}`,
-          rec.id
-        );
-      }
-      if (byId.has(rec.id)) {
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `Legacy reader returned a duplicate record for ${rec.id}`,
-          rec.id
-        );
-      }
-      byId.set(rec.id, rec);
-    }
-    for (const id of legacyIds) {
-      if (!byId.has(id)) {
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `No completed legacy waitpoint record for ${id}`,
-          id
-        );
-      }
-    }
-  }
-
-  if (storeIds.length > 0) {
-    // storeReader is defined here (guarded above). A Redis failure throws out of it; a genuinely
-    // absent id comes back simply missing from the map — the two are never conflated.
-    const storeMap = await storeReader!(storeIds);
-    for (const id of storeIds) {
-      const entry = storeMap.get(id);
-      if (!entry) {
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `No store waitpoint record for ${id}`,
-          id
-        );
-      }
-      if (entry.record.id !== id) {
-        // The store returned a record whose own id is not the one we asked for: a wrong or corrupted
-        // blob. Trusting it would file the mismatched record under `id` and lose the real one.
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `Store returned record ${entry.record.id} for requested id ${id}`,
-          id
-        );
-      }
-      if (entry.status !== "COMPLETED") {
-        throw new UnresolvableCompletedWaitpointRecordsError(
-          `Store waitpoint ${id} is ${entry.status}, not COMPLETED`,
-          id
-        );
-      }
-      byId.set(id, storeRecordToCompletedWaitpointRecord(entry, nowMs));
-    }
-  }
-
-  // Belt and braces over the per-half checks: exactly one record per distinct id, nothing extra.
-  if (byId.size !== distinctIds.length) {
-    throw new UnresolvableCompletedWaitpointRecordsError(
-      `Resolved ${byId.size} record(s) for ${distinctIds.length} distinct waitpoint id(s)`
-    );
-  }
-
-  return distinctIds.map((id) => byId.get(id)!);
-}
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
index d4d5bde9795..a0ada51e3fb 100644
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.test.ts
@@ -1,4 +1,3 @@
-import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
 // Two layers. The PURE-LOGIC layer proves buildCompletedWaitpointRecords + the expander agree
 // with the Postgres oracle (enhanceExecutionSnapshotWithWaitpoints) field-for-field across every
 // required case, with the deriveFromRun lookup injected as a closure per the branch rule. The
@@ -8,13 +7,12 @@ import { describe, expect, it } from "vitest";
 import { heteroRunOpsPostgresTest } from "@internal/testcontainers";
 import { PostgresRunStore, RoutingRunStore, type CreateRunInput } from "@internal/run-store";
 import type { CompletedWaitpoint } from "@trigger.dev/core/v3";
-import { PrismaClient, type Waitpoint } from "@trigger.dev/database";
+import type { PrismaClient, Waitpoint } from "@trigger.dev/database";
 import type { RunOpsPrismaClient } from "@internal/run-ops-database";
 import { enhanceExecutionSnapshotWithWaitpoints } from "./executionSnapshotSystem.js";
 import {
   buildCompletedWaitpointRecords,
   createCompletedWaitpointResolver,
-  createStoreRunCompletedWaitpointResolver,
   expandCompletedWaitpointRecords,
 } from "./completedWaitpointResolver.js";
 
@@ -395,121 +393,7 @@ async function seedCompletingRun(
   });
 }
 
-it("skips ID classification by default, when disabled, and without trusted organization context", async () => {
-  // Real clients/stores, with inline records so the original resolver needs no database I/O.
-  const prisma = new PrismaClient({ datasourceUrl: "postgresql://unused:unused@localhost/unused" });
-  const store = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
-  const records = buildCompletedWaitpointRecords([
-    makeWaitpoint({ type: "RUN", output: "inline-result" }),
-  ]);
-  // This sentinel throws in parseWaitpointId; the legacy expander only carries the ID through.
-  records[0]!.id = null as unknown as string;
-  const args = {
-    runId: "parent",
-    pointer: { cycleSeq: 1, count: 1 },
-    order: [],
-    records,
-  };
-  try {
-    const defaultResolver = createStoreRunCompletedWaitpointResolver(store, prisma);
-    expect((await defaultResolver(args, { organizationId: "trusted-org" }))[0]!.output).toBe(
-      "inline-result"
-    );
-    const checkedOrganizations: string[] = [];
-    const disabled = createStoreRunCompletedWaitpointResolver(store, prisma, (organizationId) => {
-      checkedOrganizations.push(organizationId);
-      return false;
-    });
-    expect((await disabled(args, { organizationId: "trusted-org" }))[0]!.id).toBeNull();
-    expect(checkedOrganizations).toEqual(["trusted-org"]);
-    const enabled = createStoreRunCompletedWaitpointResolver(store, prisma, () => true);
-    expect((await enabled(args))[0]!.id).toBeNull();
-    await expect(enabled(args, { organizationId: "trusted-org" })).rejects.toThrow();
-  } finally {
-    await prisma.$disconnect();
-  }
-});
-
 describe("createCompletedWaitpointResolver reads TaskRun.output through the routed store", () => {
-  heteroRunOpsPostgresTest(
-    "MemoryDB RUN outputs use the owning primary under a real frozen reader while legacy records retain their read policy",
-    async ({ prisma14, prisma17 }) => {
-      const writer = makeRouter(prisma14 as unknown as PrismaClient, prisma17);
-      const env = await seedEnv(prisma14 as unknown as PrismaClient, "store-primary-lag");
-      await seedCompletingRun(writer, env, RUN_OPS_A, "stale-output", prisma17 as never);
-      await prisma17.$transaction(
-        async (frozenReader) => {
-          // REPEATABLE READ pins a real database snapshot before the primary commits the new output.
-          expect(
-            (await frozenReader.taskRun.findUniqueOrThrow({ where: { id: RUN_OPS_A } })).output
-          ).toBe("stale-output");
-          await prisma17.taskRun.update({
-            where: { id: RUN_OPS_A },
-            data: { output: "committed-output" },
-          });
-          const router = new RoutingRunStore({
-            new: new PostgresRunStore({
-              prisma: prisma17 as never,
-              readOnlyPrisma: frozenReader as never,
-              schemaVariant: "dedicated",
-            }),
-            legacy: new PostgresRunStore({
-              prisma: prisma14 as never,
-              readOnlyPrisma: prisma14 as never,
-            }),
-          });
-          const storeId = generateWaitpointId("RUN");
-          const records = buildCompletedWaitpointRecords([
-            makeWaitpoint({
-              id: storeId,
-              type: "RUN",
-              completedByTaskRunId: RUN_OPS_A,
-              output: "derive",
-            }),
-            makeWaitpoint({
-              id: "legacy_waitpoint",
-              type: "RUN",
-              completedByTaskRunId: RUN_OPS_A,
-              output: "derive",
-            }),
-          ]);
-          const args = {
-            runId: "parent",
-            pointer: { cycleSeq: 1, count: 2 },
-            order: [storeId, "legacy_waitpoint"],
-            records,
-          };
-          const unchanged = await createCompletedWaitpointResolver(router)(args);
-          expect(unchanged.map((row) => row.output)).toEqual(["stale-output", "stale-output"]);
-          const resolver = createStoreRunCompletedWaitpointResolver(
-            router,
-            prisma14 as never,
-            (organizationId) => organizationId === env.organization.id
-          );
-          const resolved = await resolver(args, { organizationId: env.organization.id });
-          expect(resolved.map((row) => row.id)).toEqual([storeId, "legacy_waitpoint"]);
-          expect(resolved.map((row) => row.output)).toEqual(["committed-output", "stale-output"]);
-          expect(
-            (await frozenReader.taskRun.findUniqueOrThrow({ where: { id: RUN_OPS_A } })).output
-          ).toBe("stale-output");
-          const missing = { ...records[0]!, completedByTaskRunId: RUN_OPS_B };
-          await expect(
-            resolver({ ...args, records: [missing] }, { organizationId: env.organization.id })
-          ).rejects.toThrow("No completing TaskRun");
-          expect(
-            (
-              await resolver(
-                { ...args, records: [{ ...missing, id: "legacy_missing" }] },
-                { organizationId: env.organization.id }
-              )
-            )[0]!.output
-          ).toBeNull();
-        },
-        { isolationLevel: "RepeatableRead", timeout: 15_000 }
-      );
-    }
-  );
-
   heteroRunOpsPostgresTest(
     "resolves a deriveFromRun record from the completing run on the #new shard",
     async ({ prisma14, prisma17 }) => {
diff --git a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
index 1a0c65db93f..4aebec2be7b 100644
--- a/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
+++ b/internal-packages/run-engine/src/engine/systems/completedWaitpointResolver.ts
@@ -1,4 +1,3 @@
-import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
 // The production completed-waitpoint record builder + resolver. The reference implementation
 // this mirrors, and the shape contract, live in completedWaitpointFreeze.test.ts.
 import type { Waitpoint } from "@trigger.dev/database";
@@ -8,7 +7,6 @@ import type {
   CompletedWaitpointResolver,
   ResolveCompletedWaitpointsArgs,
   RunStore,
-  ReadClient,
   SnapshotReadWaitpoint,
 } from "@internal/run-store";
 
@@ -120,9 +118,7 @@ export function expandCompletedWaitpointRecords(
  * run on another shard is resolved correctly), then expands synchronously.
  */
 export function createCompletedWaitpointResolver(
-  runStore: Pick<RunStore, "findRunsByIds">,
-  client?: ReadClient,
-  requireRunRows = false
+  runStore: Pick<RunStore, "findRunsByIds">
 ): CompletedWaitpointResolver {
   return async (args) => {
     const runIds = new Set<string>();
@@ -134,10 +130,8 @@ export function createCompletedWaitpointResolver(
 
     const outputs = new Map<string, string | undefined>();
     if (runIds.size > 0) {
-      const runs = await runStore.findRunsByIds([...runIds], { select: { output: true } }, client);
+      const runs = await runStore.findRunsByIds([...runIds], { select: { output: true } });
       for (const id of runIds) {
-        if (requireRunRows && !runs.has(id))
-          throw new Error(`No completing TaskRun ${id} for shared waitpoint result`);
         outputs.set(id, runs.get(id)?.output ?? undefined);
       }
     }
@@ -145,46 +139,3 @@ export function createCompletedWaitpointResolver(
     return expandCompletedWaitpointRecords(args, (id) => outputs.get(id));
   };
 }
-
-/**
- * Redis-primary cycles can mix old Postgres tokens with MemoryDB tokens. Only a MemoryDB RUN
- * completion proves that its child output has committed independently of the snapshot replica.
- * Resolve those children on their owning primary and fail closed on missing rows; retain the
- * established read policy for every legacy record, including deployments using TRES alone.
- */
-export function createStoreRunCompletedWaitpointResolver(
-  runStore: Pick<RunStore, "findRunsByIds">,
-  primaryReadClient: ReadClient,
-  isEnabled?: (organizationId: string) => boolean | Promise<boolean>
-): (
-  args: ResolveCompletedWaitpointsArgs,
-  context?: { organizationId: string }
-) => ReturnType<CompletedWaitpointResolver> {
-  const legacy = createCompletedWaitpointResolver(runStore);
-  const store = createCompletedWaitpointResolver(runStore, primaryReadClient, true);
-  return async (args, context) => {
-    // TRES alone retains the original resolver without partitioning or parsing completion IDs.
-    if (!context?.organizationId || (await isEnabled?.(context.organizationId)) !== true) {
-      return legacy(args);
-    }
-    const storeRecords: CompletedWaitpointRecord[] = [];
-    const legacyRecords: CompletedWaitpointRecord[] = [];
-    for (const record of args.records) {
-      (record.type === "RUN" &&
-      parseWaitpointId(record.id).format !== "legacy" &&
-      record.output &&
-      "deriveFromRun" in record.output
-        ? storeRecords
-        : legacyRecords
-      ).push(record);
-    }
-    if (storeRecords.length === 0) return legacy(args);
-    if (legacyRecords.length === 0) return store(args);
-    const [legacyRows, storeRows] = await Promise.all([
-      legacy({ ...args, records: legacyRecords }),
-      store({ ...args, records: storeRecords }),
-    ]);
-    const rows = new Map([...legacyRows, ...storeRows].map((row) => [row.id, row]));
-    return args.records.map((record) => rows.get(record.id)!);
-  };
-}
diff --git a/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts b/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
index 84e43257f1d..91ad43d7d3e 100644
--- a/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/redisPrimaryCompletionAssociation.test.ts
@@ -16,19 +16,12 @@ import { describe, expect } from "vitest";
 import { containerTest } from "@internal/testcontainers";
 import {
   PostgresRunStore,
-  RoutingRunStore,
-  markReadReplicaClient,
   RedisSnapshotStore,
   TaskRunExecutionSnapshotStore,
   type CreateRunInput,
 } from "@internal/run-store";
-import {
-  BatchId,
-  generateInternalId,
-  generateWaitpointId,
-  RunId,
-} from "@trigger.dev/core/v3/isomorphic";
-import { PrismaClient, type Waitpoint } from "@trigger.dev/database";
+import { BatchId, generateInternalId, RunId } from "@trigger.dev/core/v3/isomorphic";
+import type { PrismaClient, Waitpoint } from "@trigger.dev/database";
 import {
   enhanceExecutionSnapshotWithWaitpoints,
   getLatestExecutionSnapshot,
@@ -38,9 +31,6 @@ import {
   createCompletedWaitpointResolver,
 } from "./completedWaitpointResolver.js";
 
-import { createWaitpointResultRunStore } from "./waitpointResultRunStore.js";
-import { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
-
 const ROUTE = "logical:1";
 
 async function seedEnv(prisma: PrismaClient, suffix: string) {
@@ -165,166 +155,6 @@ async function seedResumedRedisPrimaryRun(
 }
 
 describe("redis-primary resume keeps its completion associations (engine boundary)", () => {
-  containerTest(
-    "disabled hydration preserves snapshot reads without interpreting storage metadata",
-    async ({ prisma, redisOptions }) => {
-      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
-      const waitpoints = new WaitpointStoreCoordinator({ redisOptions });
-      try {
-        const env = await seedEnv(prisma, "disabled-hydration");
-        const runId = generateInternalId();
-        await delegate.createRun(createRunInput(runId, env));
-        // The base Postgres reader carries metadata through unchanged. Hydration must not
-        // introduce parsing errors for disabled orgs, including future metadata versions.
-        await prisma.taskRunExecutionSnapshot.updateMany({
-          where: { runId },
-          data: { metadata: { snapshotStore: { version: 2, residency: "mirrored" } } },
-        });
-        const baseline = await delegate.findLatestExecutionSnapshot(runId);
-        const checkedOrganizations: string[] = [];
-        let enabledOrganization: string | undefined;
-        const reader = createWaitpointResultRunStore(delegate, {
-          store: waitpoints,
-          isEnabled: (organizationId) => {
-            checkedOrganizations.push(organizationId);
-            return organizationId === enabledOrganization;
-          },
-        });
-        expect(await reader.findLatestExecutionSnapshot(runId)).toEqual(baseline);
-        const args = { where: { runId }, include: { completedWaitpoints: true } } as const;
-        expect(await reader.findExecutionSnapshot(args)).toEqual(
-          await delegate.findExecutionSnapshot(args)
-        );
-        expect(checkedOrganizations).toEqual([env.organization.id, env.organization.id]);
-        enabledOrganization = env.organization.id;
-        await expect(reader.findLatestExecutionSnapshot(runId)).rejects.toThrow(
-          "Unsupported snapshot storage metadata"
-        );
-      } finally {
-        await waitpoints.quit();
-      }
-    }
-  );
-
-  containerTest(
-    "mirrored primary repair discovers shared MemoryDB completion links despite a frozen reader and empty order",
-    async ({ prisma, redisOptions, postgresContainer }) => {
-      await prisma.$executeRawUnsafe(
-        `ALTER TABLE "_completedWaitpoints" DROP CONSTRAINT IF EXISTS "_completedWaitpoints_B_fkey"`
-      );
-      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
-      const snapshots = new RedisSnapshotStore({ redisOptions, completedTtlMs: 60_000 });
-      const waitpoints = new WaitpointStoreCoordinator({ redisOptions });
-      const readClient = new PrismaClient({
-        datasources: { db: { url: postgresContainer.getConnectionUri() } },
-      });
-      try {
-        const env = await seedEnv(prisma, "mirror-shared-repair");
-        const parent = generateInternalId();
-        const child = generateInternalId();
-        const birth = generateInternalId();
-        const resumed = generateInternalId();
-        const sharedId = generateWaitpointId("RUN");
-        await delegate.createRun(createRunInput(child, env));
-        await prisma.taskRun.update({
-          where: { id: child },
-          data: { output: '{"child":"shared"}' },
-        });
-        await waitpoints.createIfAbsent({
-          status: "PENDING",
-          record: {
-            id: sharedId,
-            friendlyId: `waitpoint_${sharedId}`,
-            type: "RUN",
-            completedByTaskRunId: child,
-            environmentId: env.environment.id,
-            projectId: env.project.id,
-            userProvidedIdempotencyKey: false,
-            tags: [],
-            createdAt: new Date().toISOString(),
-            updatedAt: new Date().toISOString(),
-          },
-        });
-        await waitpoints.complete({
-          waitpointId: sharedId,
-          completion: {
-            completedAt: new Date().toISOString(),
-            output: null,
-            outputType: "application/json",
-            outputIsError: false,
-          },
-        });
-        const writer = new TaskRunExecutionSnapshotStore(delegate, {
-          store: snapshots,
-          mode: "dual-write",
-          logicalRunStoreRoute: ROUTE,
-        });
-        await writer.createRun({
-          data: createRunInput(parent, env).data,
-          snapshot: { ...createRunInput(parent, env).snapshot, id: birth },
-        });
-        await readClient.$transaction(
-          async (frozenReader) => {
-            expect(
-              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: birth } })
-            ).not.toBeNull();
-            await writer.createExecutionSnapshot({
-              id: resumed,
-              createdAt: new Date(),
-              run: { id: parent, status: "EXECUTING", attemptNumber: 1 },
-              snapshot: { executionStatus: "EXECUTING", description: "Shared child completed" },
-              previousSnapshotId: birth,
-              environmentId: env.environment.id,
-              environmentType: env.environment.type,
-              projectId: env.project.id,
-              organizationId: env.organization.id,
-              completedWaitpoints: [{ id: sharedId }],
-            });
-            // This actual database reader has neither the repaired snapshot nor its completion links.
-            expect(
-              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: resumed } })
-            ).toBeNull();
-            const laggingLeaf = new PostgresRunStore({
-              prisma,
-              readOnlyPrisma: frozenReader as never,
-            });
-            const mirrorReader = new TaskRunExecutionSnapshotStore(laggingLeaf, {
-              store: snapshots,
-              mode: "redis-read",
-              logicalRunStoreRoute: ROUTE,
-              resolvePrimaryReadClient: () => prisma,
-            });
-            const routed = new RoutingRunStore({ new: delegate, legacy: mirrorReader });
-            const reader = createWaitpointResultRunStore(routed, {
-              store: waitpoints,
-              isEnabled: () => true,
-              primaryReadClient: prisma,
-            });
-            const snapshot = await getLatestExecutionSnapshot(
-              markReadReplicaClient(frozenReader),
-              parent,
-              reader
-            );
-            expect(snapshot.id).toBe(resumed);
-            expect(snapshot.completedWaitpointOrder).toEqual([]);
-            expect(snapshot.completedWaitpoints).toMatchObject([
-              { id: sharedId, output: '{"child":"shared"}', completedByTaskRun: { id: child } },
-            ]);
-            expect(
-              await frozenReader.taskRunExecutionSnapshot.findFirst({ where: { id: resumed } })
-            ).toBeNull();
-            expect(await prisma.waitpoint.count({ where: { id: sharedId } })).toBe(0);
-          },
-          { isolationLevel: "RepeatableRead", timeout: 15_000 }
-        );
-      } finally {
-        await readClient.$disconnect();
-        await waitpoints.quit();
-        await snapshots.quit();
-      }
-    }
-  );
-
   containerTest(
     "a RUN waitpoint keeps completedByTaskRun id + friendlyId, with the child's output",
     async ({ prisma, redisOptions }) => {
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts b/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
deleted file mode 100644
index be8fa3bd944..00000000000
--- a/internal-packages/run-engine/src/engine/systems/waitpointResultRunStore.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import {
-  CompletedWaitpointHydratingRunStore,
-  type ReadClient,
-  type RunStore,
-} from "@internal/run-store";
-import type { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
-import {
-  resolveCompletedWaitpointRecords,
-  UnresolvableCompletedWaitpointRecordsError,
-} from "./completedWaitpointRecordAdapter.js";
-import { createCompletedWaitpointResolver } from "./completedWaitpointResolver.js";
-
-/** Independent of TRES enrollment: an older parent can reuse a newer shared RUN child. */
-export function createWaitpointResultRunStore(
-  delegate: RunStore,
-  options: {
-    store: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
-    primaryReadClient?: ReadClient;
-    isEnabled: (organizationId: string) => boolean | Promise<boolean>;
-  }
-): RunStore {
-  if (delegate instanceof CompletedWaitpointHydratingRunStore) return delegate;
-  const expand = createCompletedWaitpointResolver(delegate, options.primaryReadClient, true);
-  return new CompletedWaitpointHydratingRunStore(delegate, {
-    primaryReadClient: options.primaryReadClient,
-    isEnabled: options.isEnabled,
-    resolve: async (ids, context) => {
-      const records = await resolveCompletedWaitpointRecords({
-        requestedIds: ids,
-        legacyReader: async () => [],
-        storeReader: async (requested) => {
-          const entries = await options.store.readCompletedRecords(requested);
-          for (const [id, entry] of entries) {
-            if (entry.record.environmentId !== context.environmentId) {
-              throw new UnresolvableCompletedWaitpointRecordsError(
-                `Waitpoint ${id} belongs to another environment`,
-                id
-              );
-            }
-          }
-          return entries;
-        },
-      });
-      return expand({
-        runId: context.runId,
-        order: [],
-        records,
-        pointer: { cycleSeq: 0, count: records.length },
-      });
-    },
-  });
-}
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts b/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
index e2abaa26ce0..41174a8e2a2 100644
--- a/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
+++ b/internal-packages/run-engine/src/engine/systems/waitpointSystem.test.ts
@@ -1,21 +1,13 @@
-import {
-  assertNonNullable,
-  containerTest,
-  containerTestWithIsolatedRedis,
-  heteroPostgresTest,
-} from "@internal/testcontainers";
+import { assertNonNullable, containerTest, heteroPostgresTest } from "@internal/testcontainers";
 import { trace } from "@internal/tracing";
 import { PostgresRunStore, RoutingRunStore } from "@internal/run-store";
-import { BatchId, generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
+import { BatchId } from "@trigger.dev/core/v3/isomorphic";
 import type { Prisma, PrismaClient } from "@trigger.dev/database";
 import { describe, expect } from "vitest";
 import { setTimeout } from "node:timers/promises";
 import { RunEngine } from "../index.js";
 import { UnclassifiableWaitpointId } from "../errors.js";
 import { setupAuthenticatedEnvironment, setupBackgroundWorker } from "../tests/setup.js";
-import { WaitpointSystem } from "./waitpointSystem.js";
-import { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
-import { buildCompletedWaitpointRecords } from "./completedWaitpointResolver.js";
 
 vi.setConfig({ testTimeout: 60_000 });
 
@@ -184,67 +176,6 @@ async function triggerExecutingRun(
 }
 
 describe("WaitpointSystem create/block write routing", () => {
-  containerTestWithIsolatedRedis(
-    "resume classifies store IDs only for an enabled organization with a wired reader",
-    async ({ prisma, redisOptions }) => {
-      const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
-      const engine = buildEngine(prisma, redisOptions);
-      const waitpointStore = new WaitpointStoreCoordinator({ redisOptions });
-      try {
-        // A store-shaped row in Postgres makes the legacy path observable. It is intentionally
-        // pending: disabled reads must retain both the original query and its result mapping.
-        const id = generateWaitpointId("DATETIME");
-        const row = await prisma.waitpoint.create({
-          data: {
-            id,
-            friendlyId: `waitpoint_${id}`,
-            type: "DATETIME",
-            status: "PENDING",
-            completedAt: new Date("2026-01-01T00:00:00.000Z"),
-            idempotencyKey: id,
-            userProvidedIdempotencyKey: false,
-            projectId: env.projectId,
-            environmentId: env.id,
-          },
-        });
-        const blockers = [{ waitpoint: { id } }];
-        const checkedOrganizations: string[] = [];
-        const isEnabled = (organizationId: string) => {
-          checkedOrganizations.push(organizationId);
-          return organizationId === env.organizationId;
-        };
-        const unwired = new WaitpointSystem({
-          ...engine.waitpointSystem["options"],
-          waitpointStoreEnabled: isEnabled,
-        });
-        const wired = new WaitpointSystem({
-          ...engine.waitpointSystem["options"],
-          waitpointStore,
-          waitpointStoreEnabled: isEnabled,
-        });
-        const legacy = buildCompletedWaitpointRecords([row]);
-        expect(
-          await unwired["resolveResumeCompletedWaitpointRecords"](
-            "parent",
-            blockers,
-            env.organizationId
-          )
-        ).toEqual(legacy);
-        expect(checkedOrganizations).toEqual([]);
-        expect(
-          await wired["resolveResumeCompletedWaitpointRecords"]("parent", blockers, "disabled-org")
-        ).toEqual(legacy);
-        await expect(
-          wired["resolveResumeCompletedWaitpointRecords"]("parent", blockers, env.organizationId)
-        ).rejects.toThrow(`No store waitpoint record for ${id}`);
-        expect(checkedOrganizations).toEqual(["disabled-org", env.organizationId]);
-      } finally {
-        await waitpointStore.quit();
-        await engine.quit();
-      }
-    }
-  );
-
   // DATETIME create routes the (env, idempotencyKey) upsert through the store.
   containerTest("DATETIME create routes through the store", async ({ prisma, redisOptions }) => {
     const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
diff --git a/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts b/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
index 1c4eb49636f..6b7f7af37a2 100644
--- a/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
+++ b/internal-packages/run-engine/src/engine/systems/waitpointSystem.ts
@@ -11,11 +11,9 @@ import type {
 import { assertNever } from "assert-never";
 import { WaitpointCompletionGuardArmedError } from "../errors.js";
 import { buildCompletedWaitpointRecords } from "./completedWaitpointResolver.js";
-import { resolveCompletedWaitpointRecords } from "./completedWaitpointRecordAdapter.js";
 import { sendNotificationToWorker } from "../eventBus.js";
 import { isFinalRunStatus } from "../statuses.js";
 import { LegacyPostgresWaitpointCoordinator } from "../waitpointCoordinator/legacyPostgresCoordinator.js";
-import type { WaitpointStoreCoordinator } from "../waitpointCoordinator/storeCoordinator.js";
 import type { RunBlockEdge, WaitpointCoordinator } from "../waitpointCoordinator/types.js";
 import type { EnqueueSystem } from "./enqueueSystem.js";
 import type { ExecutionSnapshotSystem } from "./executionSnapshotSystem.js";
@@ -27,21 +25,11 @@ import type { SystemResources } from "./systems.js";
 import { snapshotRouteFromSnapshot, type CompletedWaitpointRecord } from "@internal/run-store";
 
 export type WaitpointSystemOptions = {
-  waitpointStoreEnabled?: (
-    organizationId: string,
-    organizationFlags?: unknown
-  ) => boolean | Promise<boolean>;
   resources: SystemResources;
   executionSnapshotSystem: ExecutionSnapshotSystem;
   enqueueSystem: EnqueueSystem;
   /** Grace before an unacked completion guard fires. Short in tests. Defaults to 30s. */
   completionGuardDelayMs?: number;
-  /**
-   * The MemoryDB coordinator, for resolving store-format completed-waitpoint records in a
-   * Redis-primary resume cycle. Optional: undefined leaves the resolver Postgres-only, which is the
-   * only reachable state until store-format minting is wired. Only the record read is used here.
-   */
-  waitpointStore?: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
 };
 
 const DEFAULT_COMPLETION_GUARD_DELAY_MS = 30_000;
@@ -68,13 +56,11 @@ export class WaitpointSystem {
   private readonly enqueueSystem: EnqueueSystem;
   private readonly coordinator: WaitpointCoordinator;
   private readonly completionGuardDelayMs: number;
-  readonly #waitpointStore?: Pick<WaitpointStoreCoordinator, "readCompletedRecords">;
 
   constructor(private readonly options: WaitpointSystemOptions) {
     this.$ = options.resources;
     this.executionSnapshotSystem = options.executionSnapshotSystem;
     this.enqueueSystem = options.enqueueSystem;
-    this.#waitpointStore = options.waitpointStore;
     this.completionGuardDelayMs =
       options.completionGuardDelayMs ?? DEFAULT_COMPLETION_GUARD_DELAY_MS;
     this.coordinator = new LegacyPostgresWaitpointCoordinator({
@@ -924,67 +910,26 @@ export class WaitpointSystem {
       blockingWaitpoints.length > 0 &&
       snapshotRouteFromSnapshot(snapshot).residency === "redis-primary"
     ) {
-      const records = await this.resolveResumeCompletedWaitpointRecords(
-        runId,
-        blockingWaitpoints,
-        snapshot.organizationId
-      );
+      const records = await this.#buildCompletedWaitpointRecords(runId, blockingWaitpoints);
       return async () => records;
     }
-    return () =>
-      this.resolveResumeCompletedWaitpointRecords(
-        runId,
-        blockingWaitpoints,
-        snapshot.organizationId
-      );
+    return () => this.#buildCompletedWaitpointRecords(runId, blockingWaitpoints);
   }
 
   // The blocking edges carry only a 4-field waitpoint pick, but a redis-primary snapshot needs the FULL
-  // records to reproduce the Postgres join. Passed to the snapshot store as a resolver thunk so this
-  // fetch runs ONLY when a redis-primary cycle actually needs it, never on a postgres-resident or
-  // mirrored resume.
-  //
-  // Each blocker id is routed by its SHAPE: a legacy id resolves through Postgres (routed by runId with
-  // per-id shard fallback so a cross-shard token still resolves, and filtered to COMPLETED so a stray
-  // PENDING row can never be described as a completion), a store-format id through MemoryDB. The
-  // adapter combines both into exactly one record per distinct id and fails loud rather than returning
-  // a partial set.
-  //
-  // TS-private rather than #private so a test can drive this exact reader wiring on a real
-  // WaitpointSystem; it is not part of the class's used-by-callers surface.
-  private async resolveResumeCompletedWaitpointRecords(
+  // rows to reproduce the Postgres join. Passed to the snapshot store as a resolver thunk so this fetch
+  // runs ONLY when a redis-primary cycle actually needs it, never on a postgres-resident resume. Routed
+  // by runId with per-id shard fallback so a cross-shard token still resolves.
+  async #buildCompletedWaitpointRecords(
     runId: string,
-    blockingWaitpoints: { waitpoint: { id: string } }[],
-    organizationId?: string
+    blockingWaitpoints: { waitpoint: { id: string } }[]
   ) {
-    // Unwired readers retain the original path without a flag lookup. Disabled organizations
-    // retain it without classifying IDs; only the enabled adapter below interprets store identities.
-    const organizationEnabled =
-      this.#waitpointStore !== undefined &&
-      organizationId !== undefined &&
-      (await this.options.waitpointStoreEnabled?.(organizationId)) === true;
-    if (!organizationEnabled) {
-      const rows = await this.$.runStore.findManyWaitpoints(
-        { where: { id: { in: boundedIn(blockingWaitpoints.map((b) => b.waitpoint.id)) } } },
-        this.$.prisma,
-        runId
-      );
-      return buildCompletedWaitpointRecords(rows);
-    }
-    return resolveCompletedWaitpointRecords({
-      requestedIds: blockingWaitpoints.map((b) => b.waitpoint.id),
-      legacyReader: async (ids) =>
-        buildCompletedWaitpointRecords(
-          await this.$.runStore.findManyWaitpoints(
-            { where: { id: { in: boundedIn(ids) }, status: "COMPLETED" } },
-            this.$.prisma,
-            runId
-          )
-        ),
-      storeReader: this.#waitpointStore
-        ? (ids) => this.#waitpointStore!.readCompletedRecords(ids)
-        : undefined,
-    });
+    const rows = await this.$.runStore.findManyWaitpoints(
+      { where: { id: { in: boundedIn(blockingWaitpoints.map((b) => b.waitpoint.id)) } } },
+      this.$.prisma,
+      runId
+    );
+    return buildCompletedWaitpointRecords(rows);
   }
 
   public buildRunAssociatedWaitpoint({
diff --git a/internal-packages/run-engine/src/engine/types.ts b/internal-packages/run-engine/src/engine/types.ts
index 68af8776cde..508a71bf715 100644
--- a/internal-packages/run-engine/src/engine/types.ts
+++ b/internal-packages/run-engine/src/engine/types.ts
@@ -76,11 +76,6 @@ export type CrossSeamGuardHook = (input: {
 }) => Promise<CrossSeamGuardDecision>;
 
 export type RunEngineOptions = {
-  /** Independent of snapshot residency. Omitted means the existing Postgres waitpoint behavior. */
-  waitpointStoreEnabled?: (
-    organizationId: string,
-    organizationFlags?: unknown
-  ) => boolean | Promise<boolean>;
   prisma: PrismaClient;
   readOnlyPrisma?: PrismaReplicaClient;
   /** Optional RunStore implementation to inject. Defaults to a PostgresRunStore
diff --git a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
deleted file mode 100644
index 5dd8b7a09ec..00000000000
--- a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.readCompletedRecords.test.ts
+++ /dev/null
@@ -1,136 +0,0 @@
-// readCompletedRecords is the store half of the completed-waitpoint resolver. Proven against a REAL
-// Redis (redisTest FLUSHALLs per test): a completed record comes back with its frozen record blob and
-// completion envelope, an absent id is simply missing from the map (never an error), and a PENDING
-// record reports PENDING so the resolver can reject it.
-import { redisTest } from "@internal/testcontainers";
-import { type RedisOptions } from "@internal/redis";
-import { generateWaitpointId } from "@trigger.dev/core/v3/isomorphic";
-import { describe, expect } from "vitest";
-import {
-  WaitpointStoreCoordinator,
-  type WaitpointCompletion,
-  type WaitpointRecordInput,
-} from "./storeCoordinator.js";
-
-const ENV_ID = "env_1";
-const PROJECT_ID = "proj_1";
-const NOW = "2026-08-21T12:00:00.000Z";
-
-function coordinator(redisOptions: RedisOptions) {
-  return new WaitpointStoreCoordinator({ redisOptions });
-}
-
-function record(id: string, overrides: Partial<WaitpointRecordInput> = {}): WaitpointRecordInput {
-  return {
-    id,
-    friendlyId: `waitpoint_${id}`,
-    type: "MANUAL",
-    environmentId: ENV_ID,
-    projectId: PROJECT_ID,
-    createdAt: NOW,
-    updatedAt: NOW,
-    userProvidedIdempotencyKey: false,
-    tags: [],
-    ...overrides,
-  };
-}
-
-function completion(overrides: Partial<WaitpointCompletion> = {}): WaitpointCompletion {
-  return {
-    completedAt: "2026-08-21T12:34:56.000Z",
-    outputType: "application/json",
-    outputIsError: false,
-    output: { inline: '{"value":42}' },
-    ...overrides,
-  };
-}
-
-describe("WaitpointStoreCoordinator.readCompletedRecords", () => {
-  redisTest(
-    "returns the frozen record and completion for a completed waitpoint",
-    async ({ redisOptions }) => {
-      const store = coordinator(redisOptions);
-      try {
-        const id = generateWaitpointId("RUN");
-        const rec = record(id, { type: "RUN", completedByTaskRunId: "run_child" });
-        await store.createIfAbsent({ record: rec, status: "PENDING" });
-        await store.complete({ waitpointId: id, completion: completion() });
-
-        const out = await store.readCompletedRecords([id]);
-
-        expect(out.size).toBe(1);
-        const entry = out.get(id)!;
-        expect(entry.status).toBe("COMPLETED");
-        expect(entry.record).toEqual(rec);
-        expect(entry.completion).toEqual(completion());
-      } finally {
-        await store.quit();
-      }
-    }
-  );
-
-  redisTest("omits an absent id rather than erroring", async ({ redisOptions }) => {
-    const store = coordinator(redisOptions);
-    try {
-      const present = generateWaitpointId("MANUAL");
-      const absent = generateWaitpointId("MANUAL");
-      await store.createIfAbsent({ record: record(present), status: "PENDING" });
-      await store.complete({ waitpointId: present, completion: completion() });
-
-      const out = await store.readCompletedRecords([present, absent]);
-
-      // Absence is reported as omission, not a throw: the resolver decides it is an integrity error.
-      expect(out.has(present)).toBe(true);
-      expect(out.has(absent)).toBe(false);
-    } finally {
-      await store.quit();
-    }
-  });
-
-  redisTest("reports a still-PENDING record as PENDING", async ({ redisOptions }) => {
-    const store = coordinator(redisOptions);
-    try {
-      const id = generateWaitpointId("MANUAL");
-      await store.createIfAbsent({ record: record(id), status: "PENDING" });
-
-      const out = await store.readCompletedRecords([id]);
-
-      const entry = out.get(id)!;
-      expect(entry.status).toBe("PENDING");
-      expect(entry.completion).toBeUndefined();
-    } finally {
-      await store.quit();
-    }
-  });
-
-  redisTest("reads each distinct id once for a repeated id list", async ({ redisOptions }) => {
-    const store = coordinator(redisOptions);
-    try {
-      const id = generateWaitpointId("BATCH");
-      await store.createIfAbsent({ record: record(id, { type: "BATCH" }), status: "PENDING" });
-      await store.complete({ waitpointId: id, completion: completion() });
-
-      const out = await store.readCompletedRecords([id, id, id]);
-
-      expect(out.size).toBe(1);
-      expect(out.get(id)!.status).toBe("COMPLETED");
-    } finally {
-      await store.quit();
-    }
-  });
-
-  redisTest(
-    "surfaces a Redis failure as a throw, never as an absent record",
-    async ({ redisOptions }) => {
-      // A quit()ted client makes the HMGET reject: the failure must PROPAGATE, so the resolver can retry,
-      // and never be seen as the record simply being absent.
-      const store = coordinator(redisOptions);
-      const id = generateWaitpointId("MANUAL");
-      await store.createIfAbsent({ record: record(id), status: "PENDING" });
-      await store.complete({ waitpointId: id, completion: completion() });
-      await store.quit();
-
-      await expect(store.readCompletedRecords([id])).rejects.toBeInstanceOf(Error);
-    }
-  );
-});
diff --git a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
index 153c72e1c32..564750ed9fc 100644
--- a/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
+++ b/internal-packages/run-engine/src/engine/waitpointCoordinator/storeCoordinator.ts
@@ -152,11 +152,6 @@ const ENVELOPE_LIMITS = {
 // caller-supplied value could throw inside pMap after the new block was installed.
 const SUPERSEDED_CLEANUP_CONCURRENCY = 10;
 
-// Bounds the concurrent per-id record reads a resume resolution issues. A resume reads one record
-// per distinct store-resident blocker; this caps the fan-out so a wide wait cannot open an
-// unbounded burst of Redis commands at once.
-const RESOLVER_READ_CONCURRENCY = 20;
-
 /** Thrown before any hashing, serialization or Redis call when a completion is too large. */
 export class WaitpointCompletionTooLargeError extends Error {
   constructor(
@@ -297,17 +292,6 @@ export function encodeCompletionForDelivery(
   return EncodedWaitpointCompletion.encode(completion, context);
 }
 
-/**
- * One store-resident waitpoint as {@link WaitpointStoreCoordinator.readCompletedRecords} returns it.
- * The completion stays the coordinator's OWN opaque {@link WaitpointCompletion}; the resolver, not the
- * store, maps it to the frozen TRES record shape.
- */
-export type WaitpointStoredRecord = {
-  status: WaitpointStatus;
-  record: WaitpointRecordInput;
-  completion?: WaitpointCompletion;
-};
-
 export type WatcherEntry = {
   runId: string;
   /**
@@ -1890,46 +1874,6 @@ export class WaitpointStoreCoordinator {
     };
   }
 
-  /**
-   * Read the frozen record + completion for a set of store-resident waitpoints, for the
-   * completed-waitpoint resolver.
-   *
-   * One `HMGET` per id, run concurrently: each waitpoint's keys carry the id as their own hash
-   * tag, so a pipeline or `MGET` would span cluster slots and be rejected under cluster mode.
-   *
-   * Returns ONLY the ids that are present. Absence is distinct from failure and is the caller's to
-   * fail loud on: a recognised store id missing from the store is an integrity error, never a
-   * signal to fall back to Postgres. A Redis error THROWS out of the `HMGET` and is never seen here
-   * as an absent record, so an availability failure can never be mistaken for a missing waitpoint.
-   */
-  async readCompletedRecords(ids: string[]): Promise<Map<string, WaitpointStoredRecord>> {
-    const out = new Map<string, WaitpointStoredRecord>();
-    const distinct = [...new Set(ids)];
-    await pMap(
-      distinct,
-      async (id) => {
-        const keys = waitpointKeys(id);
-        const [r, status, c] = await this.redis.hmget(keys.record, "r", "status", "c");
-        // No 'r' means no record hash under this id at all — absent, not an error.
-        if (r == null) {
-          return;
-        }
-        const record = parseJson<WaitpointRecordInput>(r);
-        if (!record) {
-          throw new Error(`Waitpoint ${id} is present in the store with no record blob`);
-        }
-        out.set(id, {
-          status: status === "COMPLETED" ? "COMPLETED" : "PENDING",
-          record,
-          completion: parseJson<WaitpointCompletion>(c ?? undefined),
-        });
-      },
-      { concurrency: RESOLVER_READ_CONCURRENCY }
-    );
-
-    return out;
-  }
-
   #fanoutIndex(
     waitpointId: string,
     op: "add" | "add-nx" | "reschedule" | "repair" | "remove" | "quarantine",
diff --git a/internal-packages/run-engine/src/index.ts b/internal-packages/run-engine/src/index.ts
index 187cef1c429..7c4900c9d8b 100644
--- a/internal-packages/run-engine/src/index.ts
+++ b/internal-packages/run-engine/src/index.ts
@@ -114,11 +114,6 @@ export {
   FANOUT_PARTITION_COUNT,
   WaitpointKeyTagError,
 } from "./engine/waitpointCoordinator/keys.js";
-export {
-  createCompletedWaitpointResolver,
-  createStoreRunCompletedWaitpointResolver,
-} from "./engine/systems/completedWaitpointResolver.js";
+export { createCompletedWaitpointResolver } from "./engine/systems/completedWaitpointResolver.js";
 export { enhanceExecutionSnapshotWithWaitpoints } from "./engine/systems/executionSnapshotSystem.js";
 export { parseGates, type ParsedGate } from "./engine/gateParsing.js";
-
-export { createWaitpointResultRunStore } from "./engine/systems/waitpointResultRunStore.js";
diff --git a/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts b/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
deleted file mode 100644
index e401bc12203..00000000000
--- a/internal-packages/run-store/src/completedWaitpointHydratingRunStore.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-import type { Prisma } from "@trigger.dev/database";
-import { parseWaitpointId } from "@trigger.dev/core/v3/isomorphic";
-import { DelegatingRunStore } from "./delegatingRunStore.js";
-import type {
-  LatestExecutionSnapshotRead,
-  ReadClient,
-  RunStore,
-  SnapshotReadWaitpoint,
-} from "./types.js";
-import { snapshotRouteFromSnapshot, type SnapshotReadContext } from "./snapshotResidency.js";
-
-export type WaitpointResultReadContext = {
-  runId: string;
-  organizationId: string;
-  environmentId: string;
-};
-
-/** Completes Postgres snapshot joins without changing either record's authoritative store. */
-export class CompletedWaitpointHydratingRunStore extends DelegatingRunStore {
-  constructor(
-    delegate: RunStore,
-    private readonly options: {
-      /** Writer signal for routed delegates, which resolve their own primary by run id. */
-      primaryReadClient?: ReadClient;
-      isEnabled: (organizationId: string) => boolean | Promise<boolean>;
-      resolve: (
-        ids: string[],
-        context: WaitpointResultReadContext
-      ) => Promise<SnapshotReadWaitpoint[]>;
-    }
-  ) {
-    super(delegate);
-  }
-
-  async #hydrate(snapshot: LatestExecutionSnapshotRead): Promise<void> {
-    // Disabled reads skip residency parsing as well as all hydration queries and processing.
-    if (!(await this.options.isEnabled(snapshot.organizationId))) return;
-    const route = snapshotRouteFromSnapshot(snapshot);
-    // MemoryDB-primary reads already resolve their complete authoritative cycle.
-    if (route.residency === "redis-primary") return;
-    const present = new Set(snapshot.completedWaitpoints.map((w) => w.id));
-    const ids = await this.delegate.findSnapshotCompletedWaitpointIds(
-      snapshot.id,
-      // A mirrored read may have repaired the row from primary after a replica miss.
-      // Discover links on the owning primary too, so an older reader cannot erase its results.
-      this.options.primaryReadClient ?? this.delegate.primaryReadClient,
-      snapshot.runId,
-      route
-    );
-    const missing = [...new Set(ids)].filter(
-      (id) => !present.has(id) && parseWaitpointId(id).format !== "legacy"
-    );
-    if (missing.length === 0) return;
-    const recovered = await this.options.resolve(missing, {
-      runId: snapshot.runId,
-      organizationId: snapshot.organizationId,
-      environmentId: snapshot.environmentId,
-    });
-    const byId = new Map(recovered.map((w) => [w.id, w]));
-    if (byId.size !== missing.length || missing.some((id) => !byId.has(id))) {
-      throw new Error(`Incomplete shared waitpoint results for snapshot ${snapshot.id}`);
-    }
-    snapshot.completedWaitpoints = [
-      ...snapshot.completedWaitpoints,
-      ...missing.map((id) => byId.get(id)!),
-    ];
-  }
-
-  override async findLatestExecutionSnapshot(
-    runId: string,
-    client?: ReadClient,
-    environmentId?: string,
-    organizationId?: SnapshotReadContext
-  ): Promise<LatestExecutionSnapshotRead | null> {
-    const snapshot = await this.delegate.findLatestExecutionSnapshot(
-      runId,
-      client,
-      environmentId,
-      organizationId
-    );
-    if (snapshot) await this.#hydrate(snapshot);
-    return snapshot;
-  }
-
-  override async findExecutionSnapshot<T extends Prisma.TaskRunExecutionSnapshotFindFirstArgs>(
-    args: Prisma.SelectSubset<T, Prisma.TaskRunExecutionSnapshotFindFirstArgs>,
-    client?: ReadClient,
-    organizationId?: SnapshotReadContext
-  ): Promise<Prisma.TaskRunExecutionSnapshotGetPayload<T> | null> {
-    const snapshot = await this.delegate.findExecutionSnapshot(args, client, organizationId);
-    // Full include preserves the snapshot's own tenant context; scalar/select queries pass through.
-    if (snapshot && args.include?.completedWaitpoints === true && !args.select) {
-      await this.#hydrate(snapshot as unknown as LatestExecutionSnapshotRead);
-    }
-    return snapshot;
-  }
-}
diff --git a/internal-packages/run-store/src/index.ts b/internal-packages/run-store/src/index.ts
index 69e7f6a63ac..85459d85767 100644
--- a/internal-packages/run-store/src/index.ts
+++ b/internal-packages/run-store/src/index.ts
@@ -12,4 +12,3 @@ export * from "./snapshotEntry.js";
 export * from "./snapshotResidency.js";
 export * from "./snapshotResidencyResolver.js";
 export * from "./taskRunExecutionSnapshotStore.js";
-export * from "./completedWaitpointHydratingRunStore.js";
diff --git a/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts b/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
index ebc37b0b68b..0c9fa475e84 100644
--- a/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
+++ b/internal-packages/run-store/src/redisSnapshotStore.recoveryLease.test.ts
@@ -2,7 +2,7 @@ import { containerTest, redisTest } from "@internal/testcontainers";
 import { createRedisClient } from "@internal/redis";
 import { setTimeout as sleep } from "node:timers/promises";
 import { Registry } from "prom-client";
-import { describe, expect, vi } from "vitest";
+import { describe, expect } from "vitest";
 import { PendingIndex } from "./pendingIndex.js";
 import {
   PendingRecoveryWorker,
@@ -10,7 +10,6 @@ import {
   type PostgresCommitStatus,
 } from "./pendingRecoveryWorker.js";
 import { RedisSnapshotStore, type SnapshotEntryInput } from "./redisSnapshotStore.js";
-import { runToPartition } from "./snapshotKeys.js";
 import { recoveryMetrics } from "./testFixtures/promMetrics.js";
 
 // The single-fleet recovery lease, proven on real Redis: exactly one owner holds it, takeover happens
@@ -188,11 +187,6 @@ describe("RecoverySweeper pending gauges and the recovery lease", () => {
         });
         expect(prepared.outcome).toBe("prepared");
 
-        const { oldestMs } = await index.summary(runToPartition(runId));
-        expect(oldestMs).toBeTypeOf("number");
-        vi.useFakeTimers({ toFake: ["Date"] });
-        vi.setSystemTime(oldestMs! + 1_000);
-
         const worker = new PendingRecoveryWorker({
           store,
           pendingIndex: index,
@@ -265,7 +259,6 @@ describe("RecoverySweeper pending gauges and the recovery lease", () => {
         // The unit itself is still pending: only A's view of it was withdrawn.
         expect(await store.hasPreparedUnit(runId)).toBe(true);
       } finally {
-        vi.useRealTimers();
         releaseTx();
         await held;
         await raw.quit();
diff --git a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
deleted file mode 100644
index 20f6fb831c2..00000000000
--- a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.resolverLaziness.test.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-// Laziness of the completed-waitpoint resolver thunk: it must be invoked ONLY when a fresh
-// redis-primary cycle is being built. A postgres transition returns before the cycle seam, and a
-// mirrored transition builds no fresh cycle, so neither may call the thunk — that is what keeps the
-// MemoryDB record read (and any Postgres widening it does) off every ordinary transition. Proven end
-// to end against real Postgres + real Redis, driving the production decorator at each residency.
-import { describe, expect } from "vitest";
-import { containerTest } from "@internal/testcontainers";
-import { generateInternalId } from "@trigger.dev/core/v3/isomorphic";
-import { PostgresRunStore } from "./PostgresRunStore.js";
-import { RedisSnapshotStore } from "./redisSnapshotStore.js";
-import {
-  TaskRunExecutionSnapshotStore,
-  type SnapshotStoreDial,
-} from "./taskRunExecutionSnapshotStore.js";
-import { SnapshotResidencyResolver } from "./snapshotResidencyResolver.js";
-import { buildCompletedWaitpointRecords } from "../../run-engine/src/engine/systems/completedWaitpointResolver.js";
-import { buildCreateRunData, seedSnapshotEnvironment } from "./testFixtures/snapshotIdFixture.js";
-
-const ROUTE = "logical:1";
-
-function birthSnapshot(env: Awaited<ReturnType<typeof seedSnapshotEnvironment>>, id: string) {
-  return {
-    id,
-    createdAt: new Date(),
-    engine: "V2" as const,
-    executionStatus: "RUN_CREATED" as const,
-    description: "Run was created",
-    runStatus: "PENDING" as const,
-    environmentId: env.id,
-    environmentType: env.type,
-    projectId: env.projectId,
-    organizationId: env.organizationId,
-  };
-}
-
-function realResolver(store: RedisSnapshotStore) {
-  return new SnapshotResidencyResolver({
-    store,
-  });
-}
-
-describe("completed-waitpoint resolver laziness", () => {
-  containerTest(
-    "the resolver thunk is called only for a fresh redis-primary cycle, never for postgres or mirrored",
-    async ({ prisma, redisOptions }) => {
-      const delegate = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
-      const store = new RedisSnapshotStore({ redisOptions, completedTtlMs: 60_000 });
-
-      try {
-        // A birth at each residency: off => inert postgres, dual-write => mirrored, redis-only =>
-        // redis-primary. The number is the expected resolver invocations on the following transition.
-        const cases: Array<{ dial: SnapshotStoreDial; expected: number }> = [
-          { dial: "off", expected: 0 },
-          { dial: "dual-write", expected: 0 },
-          { dial: "redis-only", expected: 1 },
-        ];
-
-        for (const c of cases) {
-          const env = await seedSnapshotEnvironment(prisma);
-          const runId = generateInternalId();
-          const birthId = generateInternalId();
-          const transitionId = generateInternalId();
-
-          const writer = new TaskRunExecutionSnapshotStore(delegate, {
-            store,
-            mode: c.dial === "redis-only" ? "redis-only" : "dual-write",
-            resolveDial: () => c.dial,
-            residencyResolver: realResolver(store),
-            logicalRunStoreRoute: ROUTE,
-          });
-
-          await writer.createRun({
-            data: buildCreateRunData(runId, env),
-            snapshot: birthSnapshot(env, birthId),
-          });
-
-          // A real completed Waitpoint row: the postgres and mirrored transitions connect it in the
-          // Postgres join (FK-constrained), so it must exist for those legs to reach the cycle seam.
-          const waitpointId = generateInternalId();
-          await prisma.waitpoint.create({
-            data: {
-              id: waitpointId,
-              friendlyId: `waitpoint_${waitpointId}`,
-              type: "MANUAL",
-              status: "COMPLETED",
-              completedAt: new Date("2026-08-21T12:00:00.000Z"),
-              idempotencyKey: `idem_${waitpointId}`,
-              userProvidedIdempotencyKey: false,
-              projectId: env.projectId,
-              environmentId: env.id,
-            },
-          });
-          let resolverCalls = 0;
-
-          await writer.createExecutionSnapshot({
-            id: transitionId,
-            createdAt: new Date(),
-            run: { id: runId, status: "EXECUTING" as const, attemptNumber: 1 },
-            snapshot: { executionStatus: "EXECUTING" as const, description: "resumed" },
-            previousSnapshotId: birthId,
-            environmentId: env.id,
-            environmentType: env.type,
-            projectId: env.projectId,
-            organizationId: env.organizationId,
-            completedWaitpoints: [{ id: waitpointId }],
-            resolveCompletedWaitpointRecords: async () => {
-              resolverCalls++;
-              return buildCompletedWaitpointRecords(
-                await delegate.findManyWaitpoints({
-                  where: { id: waitpointId, status: "COMPLETED" },
-                })
-              );
-            },
-          });
-
-          expect(resolverCalls, `dial=${c.dial}`).toBe(c.expected);
-        }
-      } finally {
-        await store.quit();
-      }
-    }
-  );
-});
diff --git a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
index 4bc8b724058..a11c8ed817b 100644
--- a/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
+++ b/internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts
@@ -272,11 +272,6 @@ export type TaskRunExecutionSnapshotStoreOptions = {
    * read whose head carries completed waitpoints.
    */
   resolveCompletedWaitpoints?: CompletedWaitpointResolver;
-  /** Optional application hook with the trusted owner from the already-read snapshot entry. */
-  resolveCompletedWaitpointsWithContext?: (
-    args: Parameters<CompletedWaitpointResolver>[0],
-    context: { organizationId: string }
-  ) => ReturnType<CompletedWaitpointResolver>;
   /**
    * The primary-read repair seam. When MemoryDB names the authoritative mirrored head id but hydrating
    * THAT exact row from the caller's read client returns null (a lagging read replica), the row is
@@ -724,7 +719,6 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
   readonly #newToken: () => string;
   readonly #resolvePending: TaskRunExecutionSnapshotStoreOptions["resolvePending"];
   readonly #resolveCompletedWaitpoints?: CompletedWaitpointResolver;
-  readonly #resolveCompletedWaitpointsWithContext: TaskRunExecutionSnapshotStoreOptions["resolveCompletedWaitpointsWithContext"];
   readonly #resolvePrimaryReadClient?: (runId: string) => ReadClient | undefined;
   readonly #redisPrimaryBirthReady: () => boolean;
   readonly #metrics?: SnapshotDecoratorMetrics;
@@ -748,7 +742,6 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
     this.#newToken = options.generateTransitionToken ?? (() => generateInternalId());
     this.#resolvePending = options.resolvePending;
     this.#resolveCompletedWaitpoints = options.resolveCompletedWaitpoints;
-    this.#resolveCompletedWaitpointsWithContext = options.resolveCompletedWaitpointsWithContext;
     this.#resolvePrimaryReadClient = options.resolvePrimaryReadClient;
     this.#redisPrimaryBirthReady = options.redisPrimaryBirthReady ?? (() => true);
     this.#metrics = options.metrics;
@@ -1567,21 +1560,16 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
       if (cw.distinctIds.length > 0 && cw.records.length === 0) {
         throw new SnapshotReadUnavailableError(runId, "redis-primary cycle records missing");
       }
-      if (!this.#resolveCompletedWaitpoints && !this.#resolveCompletedWaitpointsWithContext) {
+      if (!this.#resolveCompletedWaitpoints) {
         throw new SnapshotReadUnavailableError(runId, "no completed-waitpoint resolver");
       }
-      const args = {
+      completedWaitpoints = await this.#resolveCompletedWaitpoints({
         runId,
         batchId: entry.batchId,
         pointer: head.cycle,
         order: cw.order,
         records: cw.records,
-      };
-      completedWaitpoints = this.#resolveCompletedWaitpointsWithContext
-        ? await this.#resolveCompletedWaitpointsWithContext(args, {
-            organizationId: entry.organizationId,
-          })
-        : await this.#resolveCompletedWaitpoints!(args);
+      });
       completedWaitpointOrder = cw.order;
     }
 
diff --git a/internal-packages/webhook-sources/catalog/providers.json b/internal-packages/webhook-sources/catalog/providers.json
index 26030ff88f9..e3a0a5322a6 100644
--- a/internal-packages/webhook-sources/catalog/providers.json
+++ b/internal-packages/webhook-sources/catalog/providers.json
@@ -1119,27 +1119,6 @@
         "producer": true
       },
       "notes": ""
-    },
-    {
-      "id": "hookdeck",
-      "label": "Hookdeck",
-      "category": "hosting-infra",
-      "tier": "first-class",
-      "preset": null,
-      "signatureScheme": "hmac-sha256",
-      "aiRelevance": "medium",
-      "popularity": "medium",
-      "sampleSource": "handauthored",
-      "docsUrl": "https://hookdeck.com/docs/authentication",
-      "status": "complete",
-      "owner": "hookdeck-provider",
-      "checklist": {
-        "registryEntry": true,
-        "samples": true,
-        "roundTrip": true,
-        "producer": true
-      },
-      "notes": "relay: body is the upstream provider's payload; x-hookdeck-signature-2 carries the previous secret while a rotation is in progress"
     }
   ]
 }
diff --git a/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts b/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
deleted file mode 100644
index a5dd4f2dcbb..00000000000
--- a/internal-packages/webhook-sources/src/handAuthored/hookdeck.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { type SampleRecord } from "../sampleRecord.js";
-
-/**
- * Hookdeck samples. Hookdeck forwards the original provider's body unchanged and adds its own
- * headers, so each sample is an upstream payload plus informational `x-hookdeck-*` headers. The
- * signature headers are added by the composer at send time. `x-hookdeck-eventid` is left out: it is
- * the dedupe key, so a fixed value would fold every console send of a sample into one delivery.
- */
-export const samples: SampleRecord[] = [
-  {
-    provider: "hookdeck",
-    providerLabel: "Hookdeck",
-    eventType: "payment_intent.succeeded",
-    name: "Stripe payment relayed",
-    description: "A Stripe `payment_intent.succeeded` event forwarded by a Hookdeck connection.",
-    body: {
-      id: "evt_3QhRb2LkdIwHu7ix0Wq1X9aB",
-      object: "event",
-      type: "payment_intent.succeeded",
-      created: 1792569600,
-      livemode: false,
-      data: {
-        object: {
-          id: "pi_3QhRb2LkdIwHu7ix0kT2mN4p",
-          object: "payment_intent",
-          amount: 4900,
-          currency: "usd",
-          customer: "cus_R8xQ2mLkd91Hu7",
-          status: "succeeded",
-        },
-      },
-    },
-    extraHeaders: {
-      "x-hookdeck-source-name": "stripe-production",
-      "x-hookdeck-attempt-count": "1",
-      "x-hookdeck-attempt-trigger": "INITIAL",
-    },
-    docsUrl: "https://hookdeck.com/docs/destinations",
-    provenance: { kind: "handauthored", snapshotDate: "2026-10" },
-  },
-  {
-    provider: "hookdeck",
-    providerLabel: "Hookdeck",
-    eventType: "order.created",
-    name: "Order created relayed",
-    description:
-      "A custom app's `order.created` event forwarded by a Hookdeck connection, on a manual retry.",
-    body: {
-      type: "order.created",
-      id: "ord_7Kp2Qw9Lm3",
-      created_at: "2026-10-21T09:00:00.000Z",
-      data: {
-        total: 129.5,
-        currency: "EUR",
-        customer: { id: "cust_48Fh2", email: "ada@example.com" },
-        items: [{ sku: "TEE-BLK-M", quantity: 2 }],
-      },
-    },
-    extraHeaders: {
-      "x-hookdeck-source-name": "shop-orders",
-      "x-hookdeck-attempt-count": "2",
-      "x-hookdeck-attempt-trigger": "MANUAL",
-    },
-    docsUrl: "https://hookdeck.com/docs/destinations",
-    provenance: { kind: "handauthored", snapshotDate: "2026-10" },
-  },
-];
diff --git a/internal-packages/webhook-sources/src/handAuthored/index.ts b/internal-packages/webhook-sources/src/handAuthored/index.ts
index fd448088057..30c336ead6b 100644
--- a/internal-packages/webhook-sources/src/handAuthored/index.ts
+++ b/internal-packages/webhook-sources/src/handAuthored/index.ts
@@ -17,7 +17,6 @@ import { samples as s_elevenlabs } from "./elevenlabs.js";
 import { samples as s_firecrawl } from "./firecrawl.js";
 import { samples as s_gitlab } from "./gitlab.js";
 import { samples as s_granola } from "./granola.js";
-import { samples as s_hookdeck } from "./hookdeck.js";
 import { samples as s_infisical } from "./infisical.js";
 import { samples as s_intercom } from "./intercom.js";
 import { samples as s_jira } from "./jira.js";
@@ -71,7 +70,6 @@ export const handAuthoredSamples: SampleRecord[] = [
   ...s_firecrawl,
   ...s_gitlab,
   ...s_granola,
-  ...s_hookdeck,
   ...s_infisical,
   ...s_intercom,
   ...s_jira,
diff --git a/internal-packages/webhook-sources/src/providerSignatures.test.ts b/internal-packages/webhook-sources/src/providerSignatures.test.ts
index 50e95e9ee55..932dfdee79e 100644
--- a/internal-packages/webhook-sources/src/providerSignatures.test.ts
+++ b/internal-packages/webhook-sources/src/providerSignatures.test.ts
@@ -196,30 +196,6 @@ const fixtures: Fixture[] = [
     nowMs: NOW_MS,
     toleranceSeconds: 300,
   },
-  {
-    provider: "hookdeck",
-    source: "https://hookdeck.com/docs/authentication",
-    body: '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}',
-    secret: "hookdeck_fixture_secret",
-    headers: {
-      "x-hookdeck-signature": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
-      "x-hookdeck-eventid": "evt_hookdeck_fixture_delivery",
-    },
-    nowMs: NOW_MS,
-  },
-  {
-    provider: "hookdeck",
-    label: "hookdeck (secret rolled with a delay: old secret in x-hookdeck-signature-2)",
-    source: "https://hookdeck.com/docs/authentication",
-    body: '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}',
-    secret: "hookdeck_fixture_secret",
-    headers: {
-      "x-hookdeck-signature": "MRtBJRv3K6j8+CUcDsJuwYudgKi52qz9yfISiM3FKCw=",
-      "x-hookdeck-signature-2": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
-      "x-hookdeck-eventid": "evt_hookdeck_fixture_delivery",
-    },
-    nowMs: NOW_MS,
-  },
   {
     provider: "supabase",
     source: "https://supabase.com/docs/guides/database/webhooks",
@@ -274,37 +250,3 @@ describe("provider signature compatibility", () => {
     });
   }
 });
-
-describe("hookdeck headerPrefix", () => {
-  const body = '{"id":"evt_hookdeck_fixture","type":"payment_intent.succeeded","note":"Zoë"}';
-  const run = (headerPrefix: string | undefined, headers: Record<string, string>) =>
-    verify(
-      { kind: "config", config: webhookProviderConfigs.hookdeck.config({ headerPrefix }) },
-      {
-        rawBytes: new TextEncoder().encode(body),
-        secret: "hookdeck_fixture_secret",
-        nowMs: NOW_MS,
-        headers,
-        url: "https://example.com/webhooks/v1/ingest/hookdeck_fixture",
-      }
-    );
-  const prefixed = {
-    "x-hookdeck-signature": "MRtBJRv3K6j8+CUcDsJuwYudgKi52qz9yfISiM3FKCw=",
-    "x-hookdeck-signature-2": "3gqjNEFqbs5p4dNxA9fIzpEkE+YKzHRHZpA1gc9Z6QM=",
-    "x-acme-eventid": "evt_acme_delivery",
-    "x-acme-requestid": "req_acme",
-  };
-
-  it("keeps verifying the x-hookdeck signature headers and dedupes on <prefix>-eventid", () => {
-    expect(run("X-Acme-", prefixed)).toMatchObject({
-      ok: true,
-      idempotencyKey: "evt_acme_delivery",
-    });
-  });
-
-  it("without the option, still verifies but cannot read the renamed event id", () => {
-    const verdict = run(undefined, prefixed);
-    expect(verdict.ok).toBe(true);
-    expect(verdict.idempotencyKey).not.toBe("evt_acme_delivery");
-  });
-});
diff --git a/internal-packages/webhook-sources/src/registry/hookdeck.ts b/internal-packages/webhook-sources/src/registry/hookdeck.ts
deleted file mode 100644
index c7178c7772e..00000000000
--- a/internal-packages/webhook-sources/src/registry/hookdeck.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { type ProviderRegistryEntry } from "./types.js";
-
-/**
- * Hookdeck relays deliveries from another provider to a destination, so the body is the original
- * provider's payload. It signs each forwarded request with an `x-hookdeck-signature` header: a
- * base64-encoded HMAC-SHA256 of the raw body, keyed by the project's signing secret (used as UTF-8).
- * While a secret is being rolled with a delay it also sends `x-hookdeck-signature-2`, signed with the
- * previous secret. `x-hookdeck-eventid` names the Hookdeck event and is the same on every attempt.
- * There is no timestamp. The event type depends on the source; `type` covers Stripe-style payloads.
- */
-export const entry: ProviderRegistryEntry = {
-  id: "hookdeck",
-  label: "Hookdeck",
-  category: "hosting-infra",
-  docsUrl: "https://hookdeck.com/docs/authentication",
-  secretProvisioning: "provider",
-  eventTypeSource: { from: "body", path: "type" },
-  sampleSource: "handauthored",
-};
diff --git a/internal-packages/webhook-sources/src/registry/index.ts b/internal-packages/webhook-sources/src/registry/index.ts
index ac5f4db6f0e..111bfd7856b 100644
--- a/internal-packages/webhook-sources/src/registry/index.ts
+++ b/internal-packages/webhook-sources/src/registry/index.ts
@@ -23,7 +23,6 @@ import { entry as e_firecrawl } from "./firecrawl.js";
 import { entry as e_github } from "./github.js";
 import { entry as e_gitlab } from "./gitlab.js";
 import { entry as e_granola } from "./granola.js";
-import { entry as e_hookdeck } from "./hookdeck.js";
 import { entry as e_hubspot } from "./hubspot.js";
 import { entry as e_infisical } from "./infisical.js";
 import { entry as e_intercom } from "./intercom.js";
@@ -92,7 +91,6 @@ export const registryEntries: ProviderRegistryEntry[] = [
   e_github,
   e_gitlab,
   e_granola,
-  e_hookdeck,
   e_hubspot,
   e_infisical,
   e_intercom,
diff --git a/packages/cli-v3/src/mcp/config.ts b/packages/cli-v3/src/mcp/config.ts
index 5b126bc6ce8..a4fc2a9dd40 100644
--- a/packages/cli-v3/src/mcp/config.ts
+++ b/packages/cli-v3/src/mcp/config.ts
@@ -275,13 +275,13 @@ export const toolsMetadata = {
     name: "generate_webhook_secret",
     title: "Generate Webhook Secret",
     description:
-      "Generate a new signing secret for a hosted webhook endpoint and return it once, for providers where you choose the secret (for example GitHub). It replaces the existing secret; pass previousSecretTtlSeconds to keep accepting the old one while you update the provider, otherwise deliveries signed with it fail. Never print, log or commit the returned secret.",
+      "Generate a new signing secret for a hosted webhook endpoint and return it once, for providers where you choose the secret (for example GitHub). This replaces any existing secret, so deliveries fail until the provider uses the new one. Never print, log or commit the returned secret.",
   },
   set_webhook_secret: {
     name: "set_webhook_secret",
     title: "Set Webhook Secret",
     description:
-      "Store the signing secret (or public key) a provider issued for a hosted webhook endpoint, for example the whsec_ secret Stripe returns when a webhook endpoint is created. It replaces the existing secret; pass previousSecretTtlSeconds to keep accepting the old one for a while.",
+      "Store the signing secret (or public key) a provider issued for a hosted webhook endpoint, for example the whsec_ secret Stripe returns when a webhook endpoint is created. This replaces any existing secret.",
   },
   list_agents: {
     name: "list_agents",
diff --git a/packages/cli-v3/src/mcp/tools/webhooks.ts b/packages/cli-v3/src/mcp/tools/webhooks.ts
index 7364c24d252..ca0c315db3e 100644
--- a/packages/cli-v3/src/mcp/tools/webhooks.ts
+++ b/packages/cli-v3/src/mcp/tools/webhooks.ts
@@ -1,8 +1,7 @@
-import {
-  WebhookPreviousSecretTtlSeconds,
-  type WebhookDeliveryListItem,
-  type WebhookDeliveryObject,
-  type WebhookDeliveryTargetObject,
+import type {
+  WebhookDeliveryListItem,
+  WebhookDeliveryObject,
+  WebhookDeliveryTargetObject,
 } from "@trigger.dev/core/v3";
 import { z } from "zod";
 import { toolsMetadata } from "../config.js";
@@ -61,23 +60,10 @@ const ReplayInput = DeliveryInput.extend({
     .optional(),
 });
 
-const PreviousSecretTtlInput = WebhookPreviousSecretTtlSeconds.optional().describe(
-  "Keep accepting the replaced secret for this many seconds (at most 604800, 7 days) so deliveries the provider still signs with it keep verifying. Omit or pass 0 to replace it immediately, for example when it leaked."
-);
-
-const GenerateSecretInput = EndpointInput.extend({
-  previousSecretTtlSeconds: PreviousSecretTtlInput,
-});
-
 const SetSecretInput = EndpointInput.extend({
   secret: z.string().min(1).describe("The signing secret or public key the provider issued"),
-  previousSecretTtlSeconds: PreviousSecretTtlInput,
 });
 
-function previousSecretNote(expiresAt: string | undefined): string {
-  return expiresAt ? ` The previous secret keeps verifying deliveries until ${expiresAt}.` : "";
-}
-
 function devOnlyError(devOnly: boolean | undefined, environment: string) {
   return devOnly && environment !== "dev"
     ? respondWithError(
@@ -166,8 +152,8 @@ export const generateWebhookSecretTool = {
   name: toolsMetadata.generate_webhook_secret.name,
   title: toolsMetadata.generate_webhook_secret.title,
   description: toolsMetadata.generate_webhook_secret.description,
-  inputSchema: GenerateSecretInput.shape,
-  handler: toolHandler(GenerateSecretInput.shape, async (input, { ctx }) => {
+  inputSchema: EndpointInput.shape,
+  handler: toolHandler(EndpointInput.shape, async (input, { ctx }) => {
     const blocked = devOnlyError(ctx.options.devOnly, input.environment);
     if (blocked) return blocked;
 
@@ -182,15 +168,13 @@ export const generateWebhookSecretTool = {
       branch: input.branch,
     });
 
-    const result = await apiClient.generateWebhookEndpointSecret(input.endpointId, {
-      previousSecretTtlSeconds: input.previousSecretTtlSeconds,
-    });
+    const result = await apiClient.generateWebhookEndpointSecret(input.endpointId);
 
     return {
       content: [
         {
           type: "text" as const,
-          text: `Generated a new signing secret for ${result.id}. It is shown once; give it to the provider and don't print, log or commit it.${previousSecretNote(result.previousSecretExpiresAt)}\n\n${result.secret}`,
+          text: `Generated a new signing secret for ${result.id}. It is shown once; give it to the provider and don't print, log or commit it.\n\n${result.secret}`,
         },
       ],
     };
@@ -219,16 +203,10 @@ export const setWebhookSecretTool = {
 
     const result = await apiClient.setWebhookEndpointSecret(input.endpointId, {
       secret: input.secret,
-      previousSecretTtlSeconds: input.previousSecretTtlSeconds,
     });
 
     return {
-      content: [
-        {
-          type: "text" as const,
-          text: `Stored the signing secret for ${result.id}.${previousSecretNote(result.previousSecretExpiresAt)}`,
-        },
-      ],
+      content: [{ type: "text" as const, text: `Stored the signing secret for ${result.id}.` }],
     };
   }),
 };
diff --git a/packages/core/src/v3/apiClient/index.ts b/packages/core/src/v3/apiClient/index.ts
index 857da6dbaaa..14da6a9bdad 100644
--- a/packages/core/src/v3/apiClient/index.ts
+++ b/packages/core/src/v3/apiClient/index.ts
@@ -23,7 +23,6 @@ import {
   CancelWebhookWaiterResponseBody,
   CreateWebhookWaiterResponseBody,
   type CreateWebhookWaiterRequestBody,
-  type RotateWebhookEndpointSecretRequestBody,
   RotateWebhookEndpointSecretResponse,
   SetWebhookEndpointSecretResponse,
   type SetWebhookEndpointSecretRequestBody,
@@ -2631,15 +2630,11 @@ export class ApiClient {
     );
   }
 
-  generateWebhookEndpointSecret(
-    endpointId: string,
-    body: RotateWebhookEndpointSecretRequestBody = {},
-    requestOptions?: ZodFetchOptions
-  ) {
+  generateWebhookEndpointSecret(endpointId: string, requestOptions?: ZodFetchOptions) {
     return zodfetch(
       RotateWebhookEndpointSecretResponse,
       `${this.baseUrl}/api/v1/webhooks/endpoints/${encodeURIComponent(endpointId)}/rotate-secret`,
-      { method: "POST", headers: this.#getHeaders(false), body: JSON.stringify(body) },
+      { method: "POST", headers: this.#getHeaders(false) },
       mergeRequestOptions(this.defaultRequestOptions, requestOptions)
     );
   }
diff --git a/packages/core/src/v3/schemas/webhookApi.ts b/packages/core/src/v3/schemas/webhookApi.ts
index 023faeb072f..5c47247359c 100644
--- a/packages/core/src/v3/schemas/webhookApi.ts
+++ b/packages/core/src/v3/schemas/webhookApi.ts
@@ -146,33 +146,11 @@ export type WebhookDeliveryObject = z.infer<typeof WebhookDeliveryObject>;
 
 // ── Write actions ──
 
-export const MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS = 7 * 24 * 60 * 60;
-
-/**
- * How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it
- * or pass 0 to replace the secret immediately.
- */
-export const WebhookPreviousSecretTtlSeconds = z
-  .number()
-  .int()
-  .min(0)
-  .max(MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS);
-
-/** `POST /api/v1/webhooks/endpoints/:endpointId/rotate-secret`: the body is optional. */
-export const RotateWebhookEndpointSecretRequestBody = z.object({
-  previousSecretTtlSeconds: WebhookPreviousSecretTtlSeconds.optional(),
-});
-export type RotateWebhookEndpointSecretRequestBody = z.infer<
-  typeof RotateWebhookEndpointSecretRequestBody
->;
-
 /** Rotating/setting a signing secret returns the plaintext ONCE; it is never readable again. */
 export const RotateWebhookEndpointSecretResponse = z.object({
   id: z.string(),
   secretSet: z.literal(true),
   secret: z.string(),
-  /** When the replaced secret stops verifying deliveries; absent when it was replaced immediately. */
-  previousSecretExpiresAt: z.string().optional(),
 });
 export type RotateWebhookEndpointSecretResponse = z.infer<
   typeof RotateWebhookEndpointSecretResponse
@@ -181,7 +159,6 @@ export type RotateWebhookEndpointSecretResponse = z.infer<
 /** `PUT /api/v1/webhooks/endpoints/:endpointId/secret`: store a secret or public key the provider issued. */
 export const SetWebhookEndpointSecretRequestBody = z.object({
   secret: z.string().trim().min(1).max(4096),
-  previousSecretTtlSeconds: WebhookPreviousSecretTtlSeconds.optional(),
 });
 export type SetWebhookEndpointSecretRequestBody = z.infer<
   typeof SetWebhookEndpointSecretRequestBody
@@ -190,8 +167,6 @@ export type SetWebhookEndpointSecretRequestBody = z.infer<
 export const SetWebhookEndpointSecretResponse = z.object({
   id: z.string(),
   secretSet: z.literal(true),
-  /** When the replaced secret stops verifying deliveries; absent when it was replaced immediately. */
-  previousSecretExpiresAt: z.string().optional(),
 });
 export type SetWebhookEndpointSecretResponse = z.infer<typeof SetWebhookEndpointSecretResponse>;
 
diff --git a/packages/core/src/v3/webhooks/index.ts b/packages/core/src/v3/webhooks/index.ts
index 0731e111304..aa9f93b69e7 100644
--- a/packages/core/src/v3/webhooks/index.ts
+++ b/packages/core/src/v3/webhooks/index.ts
@@ -126,7 +126,6 @@ export type WebhookPresetId = (typeof WEBHOOK_PRESET_IDS)[number];
  */
 function hmacVerifierConfig(opts: {
   header: string;
-  additionalHeaders?: string[];
   algorithm?: "sha256" | "sha1";
   encoding?: "hex" | "base64";
   field?: string;
@@ -157,7 +156,6 @@ function hmacVerifierConfig(opts: {
     algorithm: opts.algorithm ?? "sha256",
     encoding: opts.encoding ?? "hex",
     signatureHeader: opts.header,
-    ...(opts.additionalHeaders ? { additionalSignatureHeaders: opts.additionalHeaders } : {}),
     signature,
     signingString: opts.signingTemplate
       ? {
@@ -190,19 +188,6 @@ function hmacVerifierConfig(opts: {
   return config;
 }
 
-export type HookdeckSourceOptions = {
-  /**
-   * The header prefix set in the Hookdeck project's settings, when it was changed from `x-hookdeck`.
-   * Hookdeck renames its event id header with it (`<prefix>-eventid`), which retries dedupe on. The
-   * signature headers keep the `x-hookdeck-` name whatever the prefix.
-   */
-  headerPrefix?: string;
-};
-
-function hookdeckHeaderPrefix(opts?: HookdeckSourceOptions): string {
-  return (opts?.headerPrefix?.trim() || "x-hookdeck").toLowerCase().replace(/-+$/, "");
-}
-
 /**
  * Per-provider verifier configs for providers whose signature maps onto the config primitives: a plain
  * HMAC variant (a different header name / prefix / signing template than the shared presets, but no
@@ -492,16 +477,6 @@ export const webhookProviderConfigs = {
         idempotencyField: { from: "body", name: "webhookId" },
       }),
   },
-  hookdeck: {
-    secretProvisioning: "provider",
-    config: (opts?: HookdeckSourceOptions) =>
-      hmacVerifierConfig({
-        header: "x-hookdeck-signature",
-        additionalHeaders: ["x-hookdeck-signature-2"],
-        encoding: "base64",
-        idempotencyField: { from: "header", name: `${hookdeckHeaderPrefix(opts)}-eventid` },
-      }),
-  },
   supabase: {
     secretProvisioning: "integrator",
     config: (): WebhookVerifierConfig => ({ scheme: "shared-secret", placement: "bearer" }),
@@ -624,15 +599,6 @@ export const webhookSetupPrompts: Partial<Record<WebhookPresetId | WebhookProvid
     'Firecrawl has no webhook settings page: each crawl, batch scrape, extract or agent request carries its own `webhook` object. Add `webhook: { url: "<webhook URL>", events: [...] }` to the requests the code makes (for a crawl the events are started, page and completed).',
     "Subscribers' filters compare `event.type`, which is prefixed with the operation, for example `crawl.completed`.",
   ].join("\n"),
-  hookdeck: [
-    "Hookdeck relays deliveries from another provider: the event is the original provider's payload, and Hookdeck signs what it forwards with the project's signing secret.",
-    "These settings are in the Hookdeck dashboard; tell the user each step. The Hookdeck CLI and API can also create connections.",
-    "1. Create a connection whose destination is an HTTP destination with the webhook URL. Keep the destination's authentication on Hookdeck Signature (the default, `auth_type: HOOKDECK_SIGNATURE` in the API); Hookdeck only signs with it set.",
-    "2. Read the signing secret from Settings > Secrets (https://dashboard.hookdeck.com/settings/project/secrets) and store it as the endpoint's signing secret. It is one secret for the whole project.",
-    "The signature headers are always `x-hookdeck-signature` and `x-hookdeck-signature-2`. If the project's header prefix was changed in the project settings, the event id arrives as `<prefix>-eventid` instead of `x-hookdeck-eventid`: pass the prefix as `webhooks.hookdeck({ headerPrefix })` so retries dedupe on it.",
-    "When the secret is rolled in Hookdeck with a delay, deliveries keep verifying through the old secret until the new one is stored here.",
-    "Subscribers' filters compare fields of the original provider's payload, for example `event.type` for a Stripe source.",
-  ].join("\n"),
 };
 
 export * from "../schemas/webhookConfig.js";
diff --git a/packages/core/test/runStream.test.ts b/packages/core/test/runStream.test.ts
index 6b0b80efcb6..ef4cd8f9932 100644
--- a/packages/core/test/runStream.test.ts
+++ b/packages/core/test/runStream.test.ts
@@ -58,24 +58,9 @@ function createTestShapeStream(
   });
 }
 
-// Never closes, like a live run shape stream; a close here would race the stream chunks
-function createOpenTestShapeStream(
-  shapes: SubscribeRunRawShape[]
-): ReadableStream<SubscribeRunRawShape> {
-  return new ReadableStream({
-    start: (controller) => {
-      for (const shape of shapes) {
-        controller.enqueue(shape);
-      }
-    },
-  });
-}
-
 function createDelayedTestShapeStream(
   shapes: SubscribeRunRawShape[]
 ): ReadableStream<SubscribeRunRawShape> {
-  let interval: ReturnType<typeof setInterval> | undefined;
-
   return new ReadableStream({
     start: async (controller) => {
       // Emit first shape immediately
@@ -86,7 +71,7 @@ function createDelayedTestShapeStream(
       let currentShapeIndex = 1;
 
       // Emit remaining shapes with delay
-      interval = setInterval(() => {
+      const interval = setInterval(() => {
         if (currentShapeIndex >= shapes.length) {
           clearInterval(interval);
           controller.close();
@@ -95,7 +80,6 @@ function createDelayedTestShapeStream(
         controller.enqueue(shapes[currentShapeIndex++]!);
       }, 100);
     },
-    cancel: () => clearInterval(interval),
   });
 }
 
@@ -323,7 +307,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createOpenTestShapeStream(shapes),
+      runShapeStream: createTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
@@ -408,7 +392,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createOpenTestShapeStream(shapes),
+      runShapeStream: createTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
@@ -471,7 +455,7 @@ describe("RunSubscription", () => {
     ];
 
     const subscription = new RunSubscription({
-      runShapeStream: createOpenTestShapeStream(shapes),
+      runShapeStream: createTestShapeStream(shapes),
       stopRunShapeStream: () => {},
       streamFactory,
       abortController: new AbortController(),
diff --git a/packages/trigger-sdk/src/v3/ai.ts b/packages/trigger-sdk/src/v3/ai.ts
index 83341cdf30a..00e98ed0f4b 100644
--- a/packages/trigger-sdk/src/v3/ai.ts
+++ b/packages/trigger-sdk/src/v3/ai.ts
@@ -5282,25 +5282,6 @@ function toStreamTextOptions(
     Object.assign(result, telemetry);
   }
 
-  const telemetry = (result.experimental_telemetry as Record<string, unknown> | undefined) ?? {
-    isEnabled: true,
-    metadata: { ...(options?.telemetry ?? {}) },
-  };
-  if (locals.get(chatTurnContextKey)?.recordUserMessage === false) {
-    const { "prompt.input": _input, ...metadata } = (telemetry.metadata ?? {}) as Record<
-      string,
-      unknown
-    >;
-    result.experimental_telemetry = {
-      ...telemetry,
-      metadata,
-      recordInputs: false,
-      recordOutputs: false,
-    };
-  } else {
-    result.experimental_telemetry = telemetry;
-  }
-
   // Skills: merge auto-injected tools with any user-provided tools.
   // User tools override on name conflict (though we namespace ours).
   if (skills && skills.length > 0) {
@@ -16892,8 +16873,7 @@ export const chat = {
   /**
    * Returns an options object ready to spread into `streamText()`.
    * Reads the stored prompt and returns `{ system, experimental_telemetry, ...config }`.
-   * With no stored prompt it still returns `experimental_telemetry` (on), so the model call is
-   * traced.
+   * Returns `{}` if no prompt has been set.
    */
   toStreamTextOptions,
   /**
diff --git a/packages/trigger-sdk/src/v3/webhooks.ts b/packages/trigger-sdk/src/v3/webhooks.ts
index 94d16f4b304..256714bf7ab 100644
--- a/packages/trigger-sdk/src/v3/webhooks.ts
+++ b/packages/trigger-sdk/src/v3/webhooks.ts
@@ -35,7 +35,6 @@ import {
   svixVerifierConfig,
   webhookProviderConfigs,
   webhookSetupPrompts,
-  type HookdeckSourceOptions,
   type WebhookProviderId,
 } from "@trigger.dev/core/webhooks";
 
@@ -290,22 +289,6 @@ export const webhookSources = {
       secretProvisioning: "provider",
     };
   },
-
-  /**
-   * Hookdeck relays deliveries from another provider, so `T` is the original provider's event. It
-   * verifies `x-hookdeck-signature` (and `x-hookdeck-signature-2` while a secret is being rolled)
-   * with the Hookdeck project's signing secret, and dedupes retries on `x-hookdeck-eventid`. Pass
-   * `headerPrefix` when the project's header prefix was changed from `x-hookdeck`.
-   */
-  hookdeck<T = unknown>(options?: HookdeckSourceOptions): WebhookSource<T> {
-    const setupPrompt = webhookSetupPrompts.hookdeck;
-    return {
-      provider: "hookdeck",
-      verifier: { kind: "config", config: webhookProviderConfigs.hookdeck.config(options) },
-      secretProvisioning: webhookProviderConfigs.hookdeck.secretProvisioning,
-      ...(setupPrompt ? { setupPrompt } : {}),
-    };
-  },
 } as const;
 
 type CamelCase<S extends string> = S extends `${infer Head}-${infer Tail}`
@@ -331,7 +314,7 @@ function producerName(provider: string): string {
 export const providerProducers = Object.fromEntries(
   Object.entries(webhookProviderConfigs)
     // Zoom needs a computed URL-validation response that the hosted ingress does not support yet.
-    .filter(([provider]) => provider !== "slack" && provider !== "zoom" && provider !== "hookdeck")
+    .filter(([provider]) => provider !== "slack" && provider !== "zoom")
     .map(([provider, entry]) => [
       producerName(provider),
       () => {
@@ -344,7 +327,7 @@ export const providerProducers = Object.fromEntries(
         };
       },
     ])
-) as Omit<ProviderProducers, "slack" | "hookdeck">;
+) as Omit<ProviderProducers, "slack">;
 
 // ── webhooks.endpoint.define(): one provider URL that subscribers and waiters attach to ──
 export type WebhookEndpointOptions<TIdentifier extends string, TSource extends AnyWebhookSource> = {
@@ -617,7 +600,6 @@ interface Webhooks {
   composio: typeof webhookSources.composio;
   gitlab: typeof webhookSources.gitlab;
   whatsapp: typeof webhookSources.whatsapp;
-  hookdeck: typeof webhookSources.hookdeck;
   /** Declare the URLs providers deliver to. */
   endpoint: { define: typeof defineWebhookEndpoint };
   /** Suspend a run until a matching webhook arrives. */
@@ -631,7 +613,7 @@ interface Webhooks {
 /**
  * Webhook utilities for handling incoming webhook requests
  */
-export const webhooks: Webhooks & Omit<ProviderProducers, "slack" | "hookdeck"> = {
+export const webhooks: Webhooks & Omit<ProviderProducers, "slack"> = {
   ...providerProducers,
   constructEvent,
   SIGNATURE_HEADER_NAME,
@@ -651,7 +633,6 @@ export const webhooks: Webhooks & Omit<ProviderProducers, "slack" | "hookdeck">
   composio: webhookSources.composio,
   gitlab: webhookSources.gitlab,
   whatsapp: webhookSources.whatsapp,
-  hookdeck: webhookSources.hookdeck,
   endpoint: { define: defineWebhookEndpoint },
   waiter: { create: createWebhookWaiter, wait: waitForWebhookWaiter, cancel: cancelWebhookWaiter },
 };
diff --git a/packages/trigger-sdk/test/bound-streamtext.test.ts b/packages/trigger-sdk/test/bound-streamtext.test.ts
index edfe2c9820d..38dcfcea543 100644
--- a/packages/trigger-sdk/test/bound-streamtext.test.ts
+++ b/packages/trigger-sdk/test/bound-streamtext.test.ts
@@ -5,7 +5,6 @@ import { mockChatAgent } from "../src/v3/test/index.js";
 import { describe, expect, it } from "vitest";
 import { chat, __buildManagedStreamTextOptionsForTests as buildManaged } from "../src/v3/ai.js";
 import { chat as chatServer } from "../src/v3/chat-server.js";
-import { definePrompt } from "../src/v3/prompt.js";
 import { simulateReadableStream, stepCountIs, tool } from "ai";
 import { MockLanguageModelV3 } from "ai/test";
 import type { LanguageModelV3StreamPart } from "@ai-sdk/provider";
@@ -402,91 +401,6 @@ describe("what the managed streamText passes through", () => {
     expect(merged.experimental_telemetry).toBe(callerTelemetry);
   });
 
-  it("turns AI SDK telemetry on when no prompt is stored, so model steps and tool calls are traced", () => {
-    const merged = buildManaged({ model: "m" }, {});
-    expect(merged.experimental_telemetry).toEqual({ isEnabled: true, metadata: {} });
-  });
-
-  it.each([
-    { name: "default telemetry", key: "default", prompt: undefined, metadata: {} },
-    {
-      name: "stored prompt telemetry",
-      key: "string-prompt",
-      prompt: async () => "You are terse.",
-      metadata: {},
-    },
-    {
-      name: "resolved prompt telemetry and its variables",
-      key: "resolved-prompt",
-      prompt: () =>
-        definePrompt({
-          id: "bound-streamtext-redacted",
-          content: "Help {{name}}.",
-        }).resolve({ name: "secret" }),
-      metadata: {
-        "prompt.slug": "bound-streamtext-redacted",
-        "prompt.id": "bound-streamtext-redacted",
-        "prompt.version": "0",
-        "prompt.labels": "local",
-      },
-    },
-  ])(
-    "keeps prompt and response content out of $name when recordUserMessage is off",
-    async ({ key, prompt, metadata }) => {
-      const stored = await prompt?.();
-      const seen: unknown[] = [];
-      const model = new MockLanguageModelV3({
-        doStream: async () => ({
-          stream: simulateReadableStream({
-            chunks: [
-              { type: "text-start", id: "t" },
-              { type: "text-delta", id: "t", delta: "ok" },
-              { type: "text-end", id: "t" },
-              {
-                type: "finish",
-                finishReason: { unified: "stop", raw: "stop" },
-                usage: {
-                  inputTokens: { total: 1, noCache: 1, cacheRead: 0, cacheWrite: 0 },
-                  outputTokens: { total: 1, text: 1, reasoning: 0 },
-                },
-              },
-            ] as LanguageModelV3StreamPart[],
-          }),
-        }),
-      });
-      const agent = chat.agent({
-        id: `bound-streamtext.redacted-telemetry-${key}`,
-        telemetry: { recordUserMessage: false },
-        run: async ({ messages, signal, streamText }) => {
-          if (stored) chat.prompt.set(stored);
-          seen.push(chat.toStreamTextOptions().experimental_telemetry);
-          return streamText({ model, messages, abortSignal: signal });
-        },
-      });
-      const harness = mockChatAgent(agent, { chatId: `bound-streamtext-redacted-${key}` });
-      try {
-        await harness.sendMessage({
-          id: "u1",
-          role: "user",
-          parts: [{ type: "text", text: "secret" }],
-        });
-        expect(seen[0]).toEqual({
-          isEnabled: true,
-          metadata,
-          recordInputs: false,
-          recordOutputs: false,
-        });
-      } finally {
-        await harness.close();
-      }
-    }
-  );
-
-  it("lets a caller turn telemetry off", () => {
-    const merged = buildManaged({ model: "m", experimental_telemetry: { isEnabled: false } }, {});
-    expect(merged.experimental_telemetry).toEqual({ isEnabled: false });
-  });
-
   it("carries the agent's system when the caller names none", () => {
     const merged = buildManaged({ model: "m" }, { system: "AGENT-SYSTEM" });
     expect(JSON.stringify(merged.system)).toContain("AGENT-SYSTEM");