@abelxiaoxing/cadence 2.0.14 → 2.0.16

package/src/service-cli.mjs

@@ -6,7 +6,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync as mkdirSync6 } from "node:fs";
 import { request } from "node:http";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname13, join as join15, resolve as resolve7 } from "node:path";
+import { dirname as dirname13, join as join16, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/install-config.mjs
@@ -327,6 +327,7 @@ var ERROR_CODES = [
   "quarantine",
   "capacity",
   "unavailable",
+  "registry-locked",
   "auth-unavailable",
   "recording-exhausted",
   "receipt-inconclusive"
@@ -3232,6 +3233,7 @@ function buildUnit(u) {
     "KillMode=mixed",
     "TimeoutStopSec=90",
     "Restart=on-failure",
+    "RestartPreventExitStatus=78",
     "RestartSec=10",
     "",
     "[Install]",
@@ -3425,7 +3427,7 @@ function autostartStatus(s) {
 
 // src/service/coordination.ts
 import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
-import { opendirSync, realpathSync as realpathSync4 } from "node:fs";
+import { opendirSync } from "node:fs";
 import { hostname as hostname2 } from "node:os";
 import { dirname as dirname5, isAbsolute as isAbsolute4, join as join5, relative as relative3, sep as sep4 } from "node:path";
 var registrationKeys = [
@@ -3517,6 +3519,21 @@ function names(path2, allowed) {
     dir.closeSync();
   }
 }
+function decodeRegistryLock(snapshot) {
+  const o = closed(json(snapshot), ["schema", "token", "pid", "host"]);
+  return {
+    schema: literal(o.schema, "cadence-service-registry-lock/1"),
+    token: decodeId(o.token),
+    pid: integer(o.pid, 1, 2147483647),
+    host: text(o.host, 255, true)
+  };
+}
+var registryNames = [
+  "format.json",
+  "roots.json",
+  "registry.lock",
+  "recovery-v1"
+];
 function recoveryOwnerStatus(pid, host) {
   if (host !== hostname2())
     return "ambiguous";
@@ -3546,19 +3563,25 @@ function recoveryDigest(registry, selected) {
 }
 
 class ServiceCoordination {
-  store;
+  project;
   files;
-  directory;
   registryDirectory;
   stateHome;
   constructor(workspace, stateHome) {
-    this.store = new TaskStore(resolveWorkspace(workspace).root, stateHome);
-    const namespace = dirname5(this.store.privateRoot);
+    this.project = workspace === null ? undefined : new TaskStore(resolveWorkspace(workspace).root, stateHome);
+    this.stateHome = this.project ? dirname5(dirname5(this.project.privateRoot)) : canonicalAmbientRoot(stateHome ?? defaultStateHome());
+    const namespace = join5(this.stateHome, "cadence-assistant-v1");
     this.files = new PrivateFiles(namespace);
-    this.stateHome = dirname5(namespace);
-    this.directory = join5(this.store.privateRoot, "service-v1");
     this.registryDirectory = join5(namespace, "service-registry-v1");
   }
+  get store() {
+    if (!this.project)
+      throw new ContractError("forbidden");
+    return this.project;
+  }
+  get directory() {
+    return join5(this.store.privateRoot, "service-v1");
+  }
   path(name) {
     return join5(this.directory, name);
   }
@@ -3568,11 +3591,7 @@ class ServiceCoordination {
   registry() {
     if (!this.files.directory(this.registryDirectory))
       return;
-    names(this.registryDirectory, [
-      "format.json",
-      "roots.json",
-      "registry.lock"
-    ]);
+    names(this.registryDirectory, registryNames);
     const format = this.files.read(this.registryPath("format.json"));
     const snapshot = this.files.read(this.registryPath("roots.json"), REGISTRY_BYTES);
     if (!format || !snapshot)
@@ -3583,7 +3602,7 @@ class ServiceCoordination {
     const o = closed(json(snapshot, REGISTRY_BYTES), ["schema", "entries"]);
     const entries = list(o.entries, REGISTRY_ENTRIES, decodeReservation);
     for (const [i, row] of entries.entries()) {
-      if (row.stateHome !== this.stateHome || realpathSync4(row.root) !== row.root)
+      if (row.stateHome !== this.stateHome || canonicalAmbientRoot(row.root) !== row.root)
         refused();
       if (entries.slice(0, i).some((other) => rootsOverlap(row.root, other.root) || row.endpoint === other.endpoint))
         refused();
@@ -3597,10 +3616,10 @@ class ServiceCoordination {
       }
     };
   }
-  assertNamespace(walks) {
-    if (!this.files.directory(this.directory, false, walks))
+  assertNamespace(walks, directory2 = this.directory) {
+    if (!this.files.directory(directory2, false, walks))
       refused();
-    names(this.directory, [
+    names(directory2, [
       "format.json",
       "config.json",
       "registration.json",
@@ -3612,15 +3631,16 @@ class ServiceCoordination {
       "history-v2",
       "conversations-v1"
     ]);
-    this.files.directory(join5(this.directory, "history-v2"), false, walks);
+    this.files.directory(join5(directory2, "history-v2"), false, walks);
   }
-  selected() {
+  selected(directory2 = this.directory, root = this.store.root, stoppedOnly = false) {
     const walks = new DirectoryWalks;
-    if (!this.files.directory(this.directory, false, walks))
+    if (!this.files.directory(directory2, false, walks))
       return;
-    this.assertNamespace(walks);
-    const manifest = this.files.read(this.path("format.json"), undefined, walks);
-    const config = this.files.read(this.path("config.json"), undefined, walks);
+    this.assertNamespace(walks, directory2);
+    const path2 = (name) => join5(directory2, name);
+    const manifest = this.files.read(path2("format.json"), undefined, walks);
+    const config = this.files.read(path2("config.json"), undefined, walks);
     if (!manifest || !config)
       refused();
     const f = closed(json(manifest), [
@@ -3630,20 +3650,22 @@ class ServiceCoordination {
       "configIdentity"
     ]);
     literal(f.schema, "cadence-service-format/1");
-    literal(f.root, this.store.root);
+    literal(f.root, root);
     literal(f.stateHome, this.stateHome);
     literal(f.configIdentity, config.identity);
     const c = decodeOwnerConfig(json(config));
-    const hostConfig = this.files.read(this.path("host-config.json"), undefined, walks);
+    const hostConfig = this.files.read(path2("host-config.json"), undefined, walks);
     if (hostConfig && hostConfig.identity !== c.policyIdentity)
       refused();
-    const registration = this.files.read(this.path("registration.json"), undefined, walks);
-    const owner = this.files.read(this.path("owner.lock"), undefined, walks);
-    const capability = this.files.read(this.path("local-capability.json"), undefined, walks);
-    const checkout = this.files.read(this.store.lockPath, 8192, walks);
+    const registration = this.files.read(path2("registration.json"), undefined, walks);
+    const owner = this.files.read(path2("owner.lock"), undefined, walks);
+    const capability = this.files.read(path2("local-capability.json"), undefined, walks);
+    const checkout = this.files.read(join5(dirname5(directory2), "checkout.lock"), 8192, walks);
     const value = registration ? decodeRegistration(json(registration)) : undefined;
-    if (value && (value.root !== this.store.root || value.stateHome !== this.stateHome || value.configIdentity !== config.identity || !endpointMatches(c.endpoint, value.endpoint)))
+    if (value && (value.root !== root || value.stateHome !== this.stateHome || value.configIdentity !== config.identity || !endpointMatches(c.endpoint, value.endpoint)))
       refused();
+    if (stoppedOnly && (checkout || value && value.phase !== "stopped"))
+      throw new ContractError("quarantine");
     if (value && value.phase !== "stopped") {
       if (!owner || !checkout || !capability)
         refused();
@@ -3723,18 +3745,21 @@ class ServiceCoordination {
   }
   withRegistry(operation) {
     this.files.directory(this.registryDirectory, true);
-    names(this.registryDirectory, [
-      "format.json",
-      "roots.json",
-      "registry.lock"
-    ]);
+    names(this.registryDirectory, registryNames);
     const lockPath = this.registryPath("registry.lock");
-    const lock = this.files.create(lockPath, encoded({
-      schema: "cadence-service-registry-lock/1",
-      token: randomUUID3(),
-      pid: process.pid,
-      host: hostname2()
-    }));
+    let lock;
+    try {
+      lock = this.files.create(lockPath, encoded({
+        schema: "cadence-service-registry-lock/1",
+        token: randomUUID3(),
+        pid: process.pid,
+        host: hostname2()
+      }));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "EEXIST")
+        throw new ContractError("registry-locked");
+      throw error;
+    }
     let dirty = false;
     try {
       let format = this.files.read(this.registryPath("format.json"));
@@ -3758,11 +3783,7 @@ class ServiceCoordination {
       }, () => {
         this.files.assert(lockPath, lock);
         this.files.assert(this.registryPath("format.json"), format);
-        names(this.registryDirectory, [
-          "format.json",
-          "roots.json",
-          "registry.lock"
-        ]);
+        names(this.registryDirectory, registryNames);
       });
       this.files.remove(lockPath, lock);
       return result;
@@ -3773,6 +3794,7 @@ class ServiceCoordination {
     }
   }
   acquire(input, resolvedEndpoint = input.endpoint, initializeNew, reselectExisting) {
+    this.store;
     const config = decodeOwnerConfig(input);
     const bound = endpoint(resolvedEndpoint);
     if (!endpointMatches(config.endpoint, bound))
@@ -3894,6 +3916,154 @@ class ServiceCoordination {
       });
     });
   }
+  registryLockDiagnostic() {
+    try {
+      const lock = this.files.read(this.registryPath("registry.lock"));
+      if (!lock)
+        return;
+      const value = decodeRegistryLock(lock);
+      return {
+        reason: "registry-locked",
+        owner: recoveryOwnerStatus(value.pid, value.host)
+      };
+    } catch {
+      return { reason: "registry-locked", owner: "unreadable" };
+    }
+  }
+  registryRecoveryState() {
+    const lock = this.files.read(this.registryPath("registry.lock"));
+    if (!lock)
+      throw new ContractError("conflict");
+    const value = decodeRegistryLock(lock);
+    names(this.registryDirectory, registryNames);
+    const format = this.files.read(this.registryPath("format.json"));
+    const roots = this.files.read(this.registryPath("roots.json"), REGISTRY_BYTES);
+    const registry = !format && !roots ? undefined : this.registry();
+    const entries = registry?.value.entries ?? [];
+    const protectedRoots = new Set(entries.map((row) => hash(row.root)));
+    const proofs = [];
+    const directory2 = opendirSync(this.files.namespace);
+    try {
+      let count = 0;
+      for (let entry = directory2.readSync();entry; entry = directory2.readSync()) {
+        if (++count > 1024)
+          throw new ContractError("capacity");
+        if (!/^[a-f0-9]{64}$/.test(entry.name) || protectedRoots.has(entry.name))
+          continue;
+        const service = join5(this.files.namespace, entry.name, "service-v1");
+        if (!this.files.directory(service))
+          continue;
+        const manifest = this.files.read(join5(service, "format.json"));
+        if (!manifest)
+          refused();
+        const f = closed(json(manifest), [
+          "schema",
+          "root",
+          "stateHome",
+          "configIdentity"
+        ]);
+        const root = pathValue(f.root);
+        if (hash(root) !== entry.name)
+          refused();
+        const selected = this.selected(service, root, true);
+        if (!selected)
+          throw new ContractError("quarantine");
+        proofs.push([
+          entry.name,
+          ...[
+            selected.manifest,
+            selected.config,
+            selected.hostConfig,
+            selected.registration
+          ].map((file) => file ? [file.identity, file.stamp] : null)
+        ]);
+      }
+    } finally {
+      directory2.closeSync();
+    }
+    proofs.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b), "en"));
+    const stateDigest = hash(encoded([
+      lock.identity,
+      lock.stamp,
+      format ? [format.identity, format.stamp] : null,
+      roots ? [roots.identity, roots.stamp] : null,
+      proofs
+    ]));
+    const epoch = hash(encoded([lock.identity, lock.stamp]));
+    const archive = this.registryPath(join5("recovery-v1", epoch));
+    const attempts = [];
+    let previousResolver = null;
+    if (this.files.directory(archive)) {
+      names(archive, Array.from({ length: 128 }, (_, n) => `${n}.json`));
+      for (let n = 0;n < 128; n++) {
+        const attempt = this.files.read(join5(archive, `${n}.json`), 32768);
+        if (!attempt) {
+          names(archive, attempts.map((_, i) => `${i}.json`));
+          break;
+        }
+        const o = closed(json(attempt, 32768), [
+          "schema",
+          "lock",
+          "pid",
+          "host",
+          "digest"
+        ]);
+        literal(o.schema, "cadence-registry-recovery/1");
+        literal(o.lock, lock.bytes.toString("utf8"));
+        decodeHash(o.digest);
+        previousResolver = recoveryOwnerStatus(integer(o.pid, 1, 2147483647), text(o.host, 255, true));
+        attempts.push(attempt);
+      }
+    }
+    const inspection = {
+      scope: "global-registry",
+      epoch,
+      coordinationDigest: hash(encoded([stateDigest, attempts.map((a) => [a.identity, a.stamp])])),
+      owner: recoveryOwnerStatus(value.pid, value.host),
+      process: { pid: value.pid, host: value.host },
+      reservations: entries.length,
+      previousResolver,
+      resolution: "local-interactive-only"
+    };
+    return { lock, archive, attempts, stateDigest, inspection };
+  }
+  inspectRegistryRecovery() {
+    return this.registryRecoveryState().inspection;
+  }
+  resolveRegistryRecovery(expected, assertAuthority) {
+    assertAuthority();
+    const state = this.registryRecoveryState();
+    if (encoded(state.inspection) !== encoded(expected))
+      throw new ContractError("conflict");
+    if (expected.owner !== "absent" || expected.previousResolver !== null && expected.previousResolver !== "absent")
+      throw new ContractError("quarantine");
+    if (state.attempts.length >= 128)
+      throw new ContractError("capacity");
+    assertAuthority();
+    const receiptPath = join5(state.archive, `${state.attempts.length}.json`);
+    const receipt = this.files.create(receiptPath, encoded({
+      schema: "cadence-registry-recovery/1",
+      lock: state.lock.bytes.toString("utf8"),
+      pid: process.pid,
+      host: hostname2(),
+      digest: expected.coordinationDigest
+    }), 32768);
+    assertAuthority();
+    const current = this.registryRecoveryState();
+    if (current.stateDigest !== state.stateDigest || current.inspection.owner !== "absent" || current.attempts.length !== state.attempts.length + 1)
+      throw new ContractError("conflict");
+    for (const [n, attempt] of state.attempts.entries())
+      this.files.assert(join5(state.archive, `${n}.json`), attempt, 32768);
+    this.files.assert(receiptPath, receipt, 32768);
+    assertAuthority();
+    this.files.remove(this.registryPath("registry.lock"), state.lock);
+    return {
+      status: "resolved",
+      scope: "global-registry",
+      recoveryId: expected.epoch,
+      notice: "registry-only-project-fences-preserved"
+    };
+  }
   prepareRecoveryRelease(expected, assertAuthority) {
     assertAuthority();
     if (this.recoverySnapshot().digest !== expected)
@@ -4045,7 +4215,7 @@ class OwnerLease {
 
 // src/service/gateway-cli.ts
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname8, join as join9, resolve as resolve6 } from "node:path";
+import { dirname as dirname10, join as join12, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/service/config.ts
@@ -4099,6 +4269,7 @@ function localOrigin(policy, actualPort) {
 // src/service/gateway-store.ts
 import { randomBytes as randomBytes4, randomUUID as randomUUID5 } from "node:crypto";
 import { opendirSync as opendirSync2 } from "node:fs";
+import { hostname as hostname3 } from "node:os";
 import { join as join7, resolve as resolve4 } from "node:path";
 
 // src/service/auth.ts
@@ -4473,6 +4644,8 @@ function decodeGatewayProject(value) {
   return project;
 }
 function registration(value) {
+  const hasHost = !!value && typeof value === "object" && Object.hasOwn(value, "host");
+  const hasRecovery = !!value && typeof value === "object" && Object.hasOwn(value, "recovery");
   const o = closed(value, [
     "schema",
     "epoch",
@@ -4481,8 +4654,22 @@ function registration(value) {
     "capability",
     "selection",
     "pid",
-    "phase"
+    "phase",
+    ...hasHost ? ["host"] : [],
+    ...hasRecovery ? ["recovery"] : []
   ]);
+  let recovery;
+  if (hasRecovery) {
+    const r = closed(o.recovery, ["receipt", "sha256", "stamp"]);
+    const receipt = text(r.receipt, 128, true);
+    if (!/^recovery-v1\/[a-f0-9]{64}\/(?:0|[1-9][0-9]{0,2})\.json$/.test(receipt))
+      throw new ContractError("corrupt-selected");
+    recovery = {
+      receipt,
+      sha256: decodeHash(r.sha256),
+      stamp: text(r.stamp, 512, true)
+    };
+  }
   const endpoint2 = text(o.endpoint, 128, true), capability = text(o.capability, 43, true);
   if (!/^http:\/\/(?:127\.0\.0\.1|\[::1\]):[1-9][0-9]{0,4}$/.test(endpoint2) || !/^[A-Za-z0-9_-]{43}$/.test(capability))
     throw new ContractError("corrupt-selected");
@@ -4493,7 +4680,9 @@ function registration(value) {
     endpoint: endpoint2,
     capability,
     selection: decodeHash(o.selection),
-    pid: integer(o.pid, 1),
+    pid: integer(o.pid, 1, 2147483647),
+    ...hasHost ? { host: text(o.host, 255, true) } : {},
+    ...recovery ? { recovery } : {},
     phase: oneOf(o.phase, ["alive", "stopping", "stopped", "quarantined"])
   };
 }
@@ -4553,6 +4742,8 @@ class GatewayStore {
     const previous = this.read();
     if (previous && previous.phase !== "stopped")
       throw new ContractError("quarantine");
+    if (previous?.recovery)
+      this.associatedProjects();
     this.lock = this.files.create(this.path("gateway.lock"), encoded({ epoch: randomUUID5() }));
     const source = { serverConfig: this.serverConfig, token };
     if (!previous)
@@ -4572,6 +4763,8 @@ class GatewayStore {
       capability: randomBytes4(32).toString("base64url"),
       selection: hash(inputBytes),
       pid: process.pid,
+      host: hostname3(),
+      ...previous?.recovery ? { recovery: previous.recovery } : {},
       phase: "alive"
     };
     this.selected = this.selected ? this.files.replace(this.path("gateway.json"), this.selected, encoded(this.value)) : this.files.create(this.path("gateway.json"), encoded(this.value));
@@ -4615,6 +4808,21 @@ class GatewayStore {
     }
     return out;
   }
+  associatedProjects() {
+    const projects = this.projects(), recovery = this.read()?.recovery;
+    if (!recovery)
+      return projects;
+    const receipt = this.files.read(this.path(recovery.receipt), 65536);
+    if (!receipt || receipt.identity !== recovery.sha256 || receipt.stamp !== recovery.stamp)
+      throw new ContractError("corrupt-selected");
+    const value = json(receipt, 65536);
+    literal(value.schema, "cadence-workbench-recovery/1");
+    const retired = list(value.retiredProjects, 128, (entry) => {
+      const row = closed(entry, ["id", "stamp"]);
+      return { id: decodeHash(row.id), stamp: text(row.stamp, 512, true) };
+    });
+    return projects.filter((project) => !retired.some((row) => row.id === project.id && row.stamp === this.files.read(this.path(`projects/${project.id}.json`))?.stamp));
+  }
   saveProject(project) {
     this.assert();
     const p = decodeGatewayProject(project), path2 = this.path(`projects/${p.id}.json`), before = this.files.read(path2);
@@ -4630,1202 +4838,660 @@ class GatewayStore {
   }
 }
 
-// src/service/runtime.ts
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute6, join as join8, resolve as resolve5 } from "node:path";
-var STARTUP_INPUT_BYTES = 16 * 1024;
-function absolute(value) {
-  const result = text(value, 4096, true);
-  if (!isAbsolute6(result))
-    throw new ContractError("invalid");
-  return result;
-}
-function decodeHostConfig(value) {
-  const o = closed(value, [
-    "schema",
-    "http",
-    "cwd",
-    "agentDir",
-    "tokenSource",
-    "tokenFile"
-  ]);
-  const tokenSource = oneOf(o.tokenSource, [
-    "generated",
-    "environment",
-    "file",
-    "config"
-  ]);
-  const tokenFile = o.tokenFile === null ? null : absolute(o.tokenFile);
-  if ((tokenSource === "file" || tokenSource === "config") !== !!tokenFile)
-    throw new ContractError("invalid");
+// src/service/recovery-cli.ts
+import { isatty } from "node:tty";
+
+// src/history/recovery.ts
+import { createHash as createHash6, randomUUID as randomUUID7 } from "node:crypto";
+import { lstatSync as lstatSync7, opendirSync as opendirSync4 } from "node:fs";
+import { join as join9, relative as relative4 } from "node:path";
+
+// src/service/recovery.ts
+async function inspectRecovery(coordination, history) {
+  const selected = coordination.recoverySnapshot();
+  const facts = history ? await history.inspect(selected.registration.epoch) : null;
+  if (facts)
+    decodeHash(facts.digest);
+  if (coordination.recoverySnapshot().digest !== selected.digest)
+    throw new ContractError("conflict");
   return {
-    schema: literal(o.schema, "cadence-service-host/1"),
-    http: decodeHttpPolicy(o.http),
-    cwd: absolute(o.cwd),
-    agentDir: absolute(o.agentDir),
-    tokenSource,
-    tokenFile
+    epoch: selected.registration.epoch,
+    coordinationDigest: selected.digest,
+    history: facts,
+    owner: recoveryOwnerStatus(selected.registration.pid, selected.registration.host),
+    resolution: "local-interactive-only"
   };
 }
-function readHostConfig(c) {
-  const owner = c.configuration();
-  if (!owner)
-    return;
-  const snapshot = c.files.read(c.path("host-config.json"));
-  if (!snapshot)
-    throw new ContractError("corrupt-selected");
-  const config = decodeHostConfig(json(snapshot));
-  if (!config.http.port || owner.endpoint !== localOrigin(config.http, config.http.port) || owner.policyIdentity !== hash(encoded(config)))
+async function resolveRecovery(coordination, confirmation, history) {
+  if (typeof confirmation.assertLocalAuthority !== "function" || confirmation.acknowledgeEscapedProcesses !== true || confirmation.processes !== "externally-resolved" || confirmation.credentials !== "independently-resolved" || confirmation.storage !== "independently-resolved")
+    throw new ContractError("forbidden");
+  const expected = structuredClone(confirmation.expected);
+  const authority = () => confirmation.assertLocalAuthority(structuredClone(expected));
+  authority();
+  const release = coordination.prepareRecoveryRelease(expected.coordinationDigest, authority);
+  const current = await inspectRecovery(coordination, history);
+  if (JSON.stringify(current) !== JSON.stringify(expected))
     throw new ContractError("conflict");
-  return config;
-}
-function hostEnvironment(ambient) {
-  let route;
-  const facts = networkSnapshot(ambient);
-  try {
-    if (facts.NODE_OPTIONS.present)
-      throw new Error;
-    route = sdkNetworkEnvironment(facts, networkSnapshot(undefined));
-  } catch {
-    throw new ContractError("unsupported-context");
-  }
-  const result = Object.create(null);
-  for (const key of Object.keys(ambient)) {
-    const d = Object.getOwnPropertyDescriptor(ambient, key);
-    if (!d || !("value" in d) || typeof d.value !== "string")
-      throw new ContractError("invalid");
-    if (/^(?:CADENCE_|PI_|ABEL_|TRELLIS_|GIT_)/i.test(key) || networkKeys.some((name) => name === key))
-      continue;
-    result[key] = d.value;
-  }
-  if (route.redactionLiterals.length) {
-    result.HTTP_PROXY = route.env.HTTP_PROXY;
-    result.HTTPS_PROXY = route.env.HTTPS_PROXY;
-    result.NODE_USE_ENV_PROXY = "1";
-  }
-  result.PI_OFFLINE = "1";
-  result.NO_COLOR = "1";
-  if (!sameNetwork(facts, networkSnapshot(ambient)))
-    throw new ContractError("stale");
-  return result;
-}
-function selectStart(options, ambient) {
-  const workspace = resolveWorkspace(options.workspace), c = new ServiceCoordination(workspace.root, options.stateHome);
-  const old = readHostConfig(c);
-  const env = Object.getOwnPropertyDescriptor(ambient, "CADENCE_WEB_TOKEN");
-  if (env && (!("value" in env) || typeof env.value !== "string"))
-    throw new ContractError("invalid");
-  let fromFile;
-  if (options.config) {
-    const path2 = resolve5(options.config), f = new PrivateFiles(dirname7(path2));
-    const bytes = f.read(path2);
-    if (!bytes)
-      throw new ContractError("corrupt-selected");
-    fromFile = decodeHostConfig(json(bytes));
-  }
-  const base = old ?? fromFile ?? decodeHostConfig({
-    schema: "cadence-service-host/1",
-    cwd: workspace.cwd,
-    http: {
-      schema: "cadence-service-http/1",
-      host: options.host ?? "127.0.0.1",
-      port: options.port ?? 17423,
-      proxy: null
-    },
-    agentDir: resolve5(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join8(ambient.HOME ?? ambient.USERPROFILE ?? homedir4(), ".pi", "agent")),
-    tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
-    tokenFile: options.tokenFile ? resolve5(options.tokenFile) : null
+  if (current.owner !== "absent" || !current.history)
+    throw new ContractError("quarantine");
+  const fact = await history.append({
+    ...confirmation,
+    expected
   });
-  const server = options.serverConfig !== undefined ? resolve5(options.serverConfig) : old?.tokenSource === "config" ? old.tokenFile : null;
-  let selected = base;
-  if (server) {
-    if (options.tokenFile !== undefined)
-      throw new ContractError("conflict");
-    const { port } = readServerConfig(server).config;
-    selected = decodeHostConfig({
-      ...base,
-      http: { ...base.http, port },
-      tokenSource: "config",
-      tokenFile: server
-    });
-  }
-  if (fromFile && encoded(fromFile) !== encoded(selected) || options.port !== undefined && options.port !== selected.http.port || options.host !== undefined && options.host !== selected.http.host || options.agentDir !== undefined && resolve5(options.agentDir) !== selected.agentDir || options.tokenFile !== undefined && resolve5(options.tokenFile) !== selected.tokenFile || env && selected.tokenSource !== "environment" || selected.tokenSource === "environment" && !env || resolveWorkspace(selected.cwd).root !== workspace.root)
+  authority();
+  if (fact.epoch !== expected.epoch || fact.coordinationDigest !== expected.coordinationDigest || fact.historyDigest !== expected.history?.digest)
     throw new ContractError("conflict");
+  release(() => history.assertCommitted(fact));
   return {
-    workspace: workspace.root,
-    stateHome: c.stateHome,
-    config: selected,
-    environmentToken: env?.value ?? null
-  };
-}
-function decodeHostInput(value) {
-  const o = closed(value, [
-    "workspace",
-    "stateHome",
-    "config",
-    "environmentToken"
-  ]);
-  const config = decodeHostConfig(o.config);
-  const environmentToken = o.environmentToken === null ? null : text(o.environmentToken, 1024, true);
-  if (config.tokenSource === "environment" !== (environmentToken !== null))
-    throw new ContractError("invalid");
-  return {
-    workspace: absolute(o.workspace),
-    stateHome: absolute(o.stateHome),
-    config,
-    environmentToken
-  };
-}
-function portValue(value) {
-  if (!/^(0|[1-9][0-9]{0,4})$/.test(value))
-    throw new ContractError("invalid");
-  return integer(Number(value), 0, 65535);
-}
-var STARTUP_STAGES = [
-  "package",
-  "pi-agent-directory",
-  "pi-auth",
-  "pi-models",
-  "pi-runtime",
-  "service"
-];
-function decodeStartupReport(value) {
-  const o = closed(value, ["status", "error", "stage"]);
-  return {
-    status: oneOf(o.status, ["refused", "quarantined"]),
-    error: oneOf(o.error, ERROR_CODES),
-    stage: oneOf(o.stage, STARTUP_STAGES)
+    status: "resolved",
+    epoch: fact.epoch,
+    recoveryId: fact.recoveryId,
+    committedSeq: fact.committedSeq,
+    notice: "operator-acknowledgment-not-certification"
   };
 }
 
-// src/service/gateway-cli.ts
-async function gatewayMain(argv, hostUrl) {
-  const operation = argv.shift();
-  if (![
-    "start",
-    "status",
-    "diagnose",
-    "stop",
-    "token-link",
-    "token-rotate"
-  ].includes(operation ?? ""))
+// src/history/files.ts
+import { createHash as createHash5, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "node:crypto";
+import {
+  closeSync as closeSync5,
+  constants as constants5,
+  fstatSync as fstatSync4,
+  fsyncSync as fsyncSync3,
+  lstatSync as lstatSync6,
+  opendirSync as opendirSync3,
+  openSync as openSync5,
+  statfsSync
+} from "node:fs";
+import { open } from "node:fs/promises";
+import { dirname as dirname8, join as join8 } from "node:path";
+
+// src/history/admission.ts
+function decodeRunAdmission(value) {
+  const o = closed(value, ["schema", "runId", "identity", "graph"]);
+  const result = {
+    schema: literal(o.schema, "cadence-run-admission/2"),
+    runId: decodeId(o.runId),
+    identity: decodeRunIdentity(o.identity),
+    graph: nullable(o.graph, decodeGraph)
+  };
+  const { identity, graph } = result;
+  if (identity.kind === "start" !== (graph !== null))
     throw new ContractError("invalid");
-  let config = serverConfigPath(homedir5()), stateHome = defaultStateHome(), agentDir, policyFile;
-  let foreground = false, reveal = false;
-  const seen = new Set;
-  while (argv.length) {
-    const key = argv.shift();
-    if (seen.has(key))
-      throw new ContractError("invalid");
-    seen.add(key);
-    if (key === "--foreground" && operation === "start")
-      foreground = true;
-    else if (key === "--reveal" && operation === "token-link")
-      reveal = true;
-    else if (argv[0] && ["--server-config", "--state-home", "--agent-dir", "--config"].includes(key)) {
-      const value = resolve6(argv.shift());
-      if (key === "--server-config")
-        config = value;
-      if (key === "--state-home")
-        stateHome = value;
-      if (key === "--agent-dir")
-        agentDir = value;
-      if (key === "--config")
-        policyFile = value;
-    } else
-      throw new ContractError("invalid");
-  }
-  const store = new GatewayStore(config, stateHome);
-  let result;
-  if (operation === "start") {
-    const network = networkSnapshot(process.env), env = hostEnvironment(process.env);
-    if (!seen.has("--server-config"))
-      ensureServerConfig(homedir5());
-    const server = readServerConfig(config).config;
-    const selectedFile = store.files.read(store.path("input.json"));
-    const selected = selectedFile ? decodeGatewayInput(json(selectedFile)) : undefined;
-    let policy = selected?.policy ?? decodeHttpPolicy({
-      schema: "cadence-service-http/1",
-      host: "127.0.0.1",
-      port: server.port,
-      proxy: null
-    });
-    if (policyFile) {
-      const file = new PrivateFiles(dirname8(policyFile)).read(policyFile);
-      if (!file)
-        throw new ContractError("invalid");
-      policy = decodeHttpPolicy(json(file));
-    }
-    const input = decodeGatewayInput({
-      kind: "workbench",
-      serverConfig: config,
-      stateHome: store.stateHome,
-      agentDir: agentDir ?? selected?.agentDir ?? resolve6(process.env.PI_CODING_AGENT_DIR ?? join9(homedir5(), ".pi", "agent")),
-      policy: { ...policy, port: server.port }
-    });
-    const status = await serviceStatus(store);
-    if (status && typeof status === "object" && "status" in status && status.status === "alive") {
-      if (!selected || encoded(selected) !== encoded(input))
-        throw new ContractError("conflict");
-      result = status;
-    } else
-      result = await launchHost(input, store, foreground, hostUrl, dirname8(dirname8(fileURLToPath(hostUrl))), env, network);
-    if (!foreground && result && typeof result === "object" && "status" in result && result.status === "alive") {
-      const reply = closed(await nativeCall(store, "token-link", true), [
-        "link"
-      ]);
-      process.stderr.write(`Cadence workbench: ${text(reply.link, 4096, true)}
-No project or default workspace was created.
-`);
-    }
-  } else if (operation === "stop")
-    result = await stopService(store);
-  else if (operation === "status" || operation === "diagnose")
-    result = await serviceStatus(store, operation === "diagnose");
-  else {
-    if (operation === "token-link" && !reveal)
-      throw new ContractError("forbidden");
-    result = await nativeCall(store, operation, reveal);
-  }
-  if (result !== null)
-    process.stdout.write(`${JSON.stringify(result)}
-`);
-  if (result && typeof result === "object" && "status" in result && ["unconfirmed", "unavailable", "quarantined", "refused"].includes(String(result.status)))
-    process.exitCode = 1;
+  if (graph && (graph.taskId !== identity.context.task?.id || graph.taskKind !== identity.context.task.kind || graph.taskRevision > identity.context.task.revision || graph.revision !== identity.graph?.revision || hash(canonicalJson(graph)) !== identity.graph.sha256 || canonicalJson(graph.assignments.map((a) => a.id)) !== canonicalJson(identity.assignments.map((a) => a.assignmentId)) || graph.assignments.some((a) => canonicalJson(a.model) !== canonicalJson(identity.context.model))))
+    throw new ContractError("conflict");
+  return result;
 }
 
-// src/service/launchd.ts
-import { rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname9, join as join10 } from "node:path";
-var LABEL = "com.abelxiaoxing.cadence";
-var MARKER2 = `<?xml version="1.0" encoding="UTF-8"?>
-<!-- Generated by @abelxiaoxing/cadence`;
-function plistPath(s) {
-  return join10(s.home, "Library", "LaunchAgents", `${LABEL}.plist`);
+// src/history/read-io.ts
+import {
+  closeSync as closeSync4,
+  constants as constants4,
+  fstatSync as fstatSync3,
+  lstatSync as lstatSync5,
+  openSync as openSync4,
+  readSync as readSync3
+} from "node:fs";
+import { dirname as dirname7 } from "node:path";
+function bad() {
+  throw new ContractError("corrupt-selected");
 }
-var xml = (value) => checked(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-function buildPlist(u) {
-  const string = (value) => `		<string>${xml(value)}</string>`;
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    "<!-- Generated by @abelxiaoxing/cadence; `cadence server install` and `restart` rewrite this file. -->",
-    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
-    '<plist version="1.0">',
-    "<dict>",
-    "\t<key>Label</key>",
-    `	<string>${LABEL}</string>`,
-    "\t<key>ProgramArguments</key>",
-    "\t<array>",
-    ...[
-      u.node,
-      u.cli,
-      ...u.workspace === null ? ["workbench", "start", "--foreground"] : ["start", "--foreground", "--workspace", u.workspace],
-      "--server-config",
-      u.serverConfig
-    ].map(string),
-    "\t</array>",
-    ...u.workspace === null ? ["<!-- Cadence workbench gateway; no project workspace -->"] : [],
-    "\t<key>WorkingDirectory</key>",
-    `	<string>${xml(u.workspace ?? dirname9(dirname9(u.cli)))}</string>`,
-    "\t<key>EnvironmentVariables</key>",
-    "\t<dict>",
-    ...u.environment.flatMap(([k, v]) => [
-      `		<key>${xml(k)}</key>`,
-      string(v)
-    ]),
-    "\t</dict>",
-    "\t<key>RunAtLoad</key>",
-    "\t<true/>",
-    "\t<key>ProcessType</key>",
-    "\t<string>Background</string>",
-    "\t<key>StandardOutPath</key>",
-    `	<string>${xml(u.log)}</string>`,
-    "\t<key>StandardErrorPath</key>",
-    `	<string>${xml(u.log)}</string>`,
-    "</dict>",
-    "</plist>",
-    ""
-  ].join(`
-`);
+var stamp2 = (s) => [s.dev, s.ino, s.size, s.mode, s.uid, s.nlink, s.ctimeMs, s.mtimeMs].join(":");
+function selected(files, path2, read, walks) {
+  if (!files.files.directory(dirname7(path2), false, walks))
+    bad();
+  const before = lstatSync5(path2);
+  if (!before.isFile() || before.nlink !== 1 || process.platform !== "win32" && (before.mode & 63 || process.getuid && before.uid !== process.getuid()))
+    bad();
+  const fd = openSync4(path2, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
+  try {
+    if (stamp2(fstatSync3(fd)) !== stamp2(before))
+      bad();
+    const result = read(fd, before.size, stamp2(before));
+    if (stamp2(fstatSync3(fd)) !== stamp2(before) || stamp2(lstatSync5(path2)) !== stamp2(before))
+      bad();
+    return result;
+  } finally {
+    closeSync4(fd);
+  }
 }
-function plistWorkspace(text2) {
-  if (text2?.includes("<!-- Cadence workbench gateway; no project workspace -->"))
-    return null;
-  const m = text2?.match(/^\t<key>WorkingDirectory<\/key>\n\t<string>([^<]*)<\/string>$/m);
-  return m?.[1].replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+function assertIncarnation(files, path2, expected) {
+  selected(files, path2, (_fd, _size, current) => {
+    if (current !== expected)
+      bad();
+  });
 }
-var domain = (s) => `gui/${s.uid}`;
-var target = (s) => `${domain(s)}/${LABEL}`;
-var loaded = (s) => s.launchctl(["print", target(s)]).status === 0;
-function disabled(s) {
-  return new RegExp(`"${LABEL.replaceAll(".", "\\.")}" => (true|disabled)`).test(s.launchctl(["print-disabled", domain(s)]).stdout);
+function statSize(files, path2, maximum) {
+  return selected(files, path2, (_fd, size) => {
+    if (size > maximum)
+      bad();
+    return size;
+  });
 }
-async function configureLaunchAgent(s, mode, requested) {
-  if (s.uid === undefined)
-    return { status: "unavailable" };
-  const path2 = plistPath(s);
-  const previous = readGenerated(path2, MARKER2);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (mode === "restart" && previous === undefined)
-    return { status: "absent" };
-  const sdk = sdkPackages(s.root);
-  const kept = plistWorkspace(previous);
-  const { workspace, redirectedFrom } = selectWorkspace(s, requested, mode === "install" && requested === undefined ? null : kept);
-  if (workspace !== null && !sdk)
-    return { status: "missing-pi-sdk" };
-  const refused2 = await settle(s, kept);
-  if (refused2)
-    return { ...refused2, unit: path2 };
-  if (loaded(s))
-    s.launchctl(["bootout", target(s)]);
-  write(path2, buildPlist({
-    node: s.node,
-    cli: join10(s.root, "src", "service-cli.mjs"),
-    workspace,
-    serverConfig: serverConfigPath(s.home),
-    environment: serviceEnvironment(s),
-    log: join10(s.home, "Library", "Logs", "cadence.log")
-  }));
-  const result = {
-    unit: path2,
-    workspace,
-    ...redirectedFrom ? { redirectedFrom } : {}
+
+// src/history/types.ts
+import { createHash as createHash4 } from "node:crypto";
+var RECORD_BYTES = LIMITS.controlBytes + 64 * 1024;
+var LEGACY_FORMAT = "cadence-history-store/2";
+var FORMAT = "cadence-history-store/3";
+function decodeFormat(value) {
+  const o = closed(value, ["schema", "storeId", "workspaceId", "rootIdentity"]);
+  return {
+    schema: oneOf(o.schema, [FORMAT, LEGACY_FORMAT]),
+    storeId: decodeId(o.storeId),
+    workspaceId: decodeId(o.workspaceId),
+    rootIdentity: decodeHash(o.rootIdentity)
   };
-  if (mode === "install")
-    s.launchctl(["enable", target(s)]);
-  else if (disabled(s))
-    return { status: "disabled", ...result };
-  if (workspace !== null && !regularFile(join10(agentDirectory(s), "auth.json")))
-    return { status: "waiting-for-pi-login", ...result };
-  const started = s.launchctl(["bootstrap", domain(s), path2]).status === 0;
-  return { status: started ? "started" : "failed", ...result };
-}
-async function stopLaunchAgent(s) {
-  const path2 = plistPath(s);
-  const previous = readGenerated(path2, MARKER2);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const workspace = plistWorkspace(previous);
-  const refused2 = await settle(s, workspace);
-  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
-}
-async function removeLaunchAgent(s) {
-  const path2 = plistPath(s);
-  const previous = readGenerated(path2, MARKER2);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const refused2 = await settle(s, plistWorkspace(previous));
-  if (refused2)
-    return { ...refused2, unit: path2 };
-  if (s.uid !== undefined && loaded(s))
-    s.launchctl(["bootout", target(s)]);
-  rmSync2(path2);
-  return { status: "removed", unit: path2 };
 }
-function launchAgentStatus(s) {
-  const path2 = plistPath(s);
-  const previous = readGenerated(path2, MARKER2);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const printed = s.uid === undefined ? undefined : s.launchctl(["print", target(s)]);
+function decodeArtifact(value) {
+  const o = closed(value, ["runId", "artifactId", "part", "bytes", "sha256"]);
   return {
-    status: printed?.status !== 0 ? "unloaded" : /^\s*state = running$/m.test(printed.stdout) ? "active" : "inactive",
-    enabled: s.uid !== undefined && disabled(s) ? "disabled" : "enabled",
-    unit: path2,
-    workspace: plistWorkspace(previous)
+    runId: decodeId(o.runId),
+    artifactId: decodeId(o.artifactId),
+    part: integer(o.part),
+    bytes: integer(o.bytes, 1, LIMITS.artifactPartBytes),
+    sha256: decodeHash(o.sha256)
   };
 }
-
-// src/service/login-run.ts
-import { rmSync as rmSync3 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute7, join as join11 } from "node:path";
-var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
-var APPROVED_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run";
-var RUN_VALUE = "Cadence";
-var MARKER3 = "' Generated by @abelxiaoxing/cadence";
-function launcherPath(s) {
-  const local = s.env.LOCALAPPDATA;
-  return join11(local && isAbsolute7(local) ? local : join11(s.home, "AppData", "Local"), "cadence-server", "cadence.vbs");
-}
-var literal2 = (value) => `"${checked(value).replaceAll('"', '""')}"`;
-function argument2(value) {
-  if (checked(value).includes('"'))
-    throw new ContractError("invalid");
-  return `"${value}"`;
+function decodeRetainedDetail(value) {
+  const o = closed(value, [
+    "detailId",
+    "origin",
+    "owner",
+    "descriptor",
+    "content",
+    "coverage"
+  ]);
+  const origin = closed(o.origin, ["kind", "id"]);
+  const r = {
+    detailId: decodeId(o.detailId),
+    origin: {
+      kind: oneOf(origin.kind, ["worker", "owner"]),
+      id: decodeId(origin.id)
+    },
+    owner: decodeRecordOwner(o.owner),
+    descriptor: nullable(o.descriptor, decodeDetailDescriptor),
+    content: decodeContentRef(o.content),
+    coverage: decodeCoverage(o.coverage)
+  };
+  if (r.origin.kind === "worker" !== (r.descriptor !== null) || r.descriptor && r.content.field !== r.descriptor.field)
+    invalid();
+  return r;
 }
-function buildLauncher(u) {
-  const command = `${argument2(u.node)} ${argument2(u.cli)} ${u.workspace === null ? "workbench start" : `start --workspace ${argument2(u.workspace)}`} --server-config ${argument2(u.serverConfig)}`;
-  return [
-    `${MARKER3}; \`cadence server install\` and \`restart\` rewrite this file.`,
-    `' Started at login by ${RUN_KEY}\\${RUN_VALUE}; window style 0 hides the console.`,
-    'Set shell = CreateObject("WScript.Shell")',
-    ...u.environment.length ? ['Set env = shell.Environment("Process")'] : [],
-    ...u.environment.map(([k, v]) => `env(${literal2(k)}) = ${literal2(v)}`),
-    ...u.workspace === null ? ["' Cadence workbench gateway; no project workspace"] : [],
-    `shell.CurrentDirectory = ${literal2(u.workspace ?? dirname10(dirname10(u.cli)))}`,
-    `shell.Run ${literal2(command)}, 0, False`,
-    ""
-  ].join(`\r
-`);
+function decodeSavedEvent(value, owner) {
+  const kind = closedTag(value);
+  if (kind === "capture") {
+    const o2 = closed(value, ["kind", "id", "value"]), v = decodeRecordingEvent(o2.value);
+    if (owner || v.event.kind === "stored-chunk" || v.event.kind === "stored-end")
+      invalid();
+    return { kind, id: decodeId(o2.id), value: v };
+  }
+  if (kind === "owner") {
+    const o2 = closed(value, ["kind", "id", "value"]);
+    if (!owner)
+      invalid();
+    const v = decodeOwnerRecordingInput({
+      link: owner,
+      observedMs: 0,
+      events: [o2.value]
+    }).events[0];
+    if (v.kind === "content-chunk" || v.kind === "content-end")
+      invalid();
+    return { kind, id: decodeId(o2.id), value: v };
+  }
+  if (kind === "chunk") {
+    const o2 = closed(value, [
+      "kind",
+      "detailId",
+      "source",
+      "artifact",
+      "offset",
+      "start",
+      "length"
+    ]);
+    const source2 = nullable(o2.source, decodeSourceRange);
+    if (source2 === null !== (owner !== null))
+      invalid();
+    const artifact = decodeArtifact(o2.artifact), offset = integer(o2.offset, 0, LIMITS.detailBytes), start = integer(o2.start, 0, LIMITS.artifactPartBytes), length = integer(o2.length, 1, LIMITS.chunkBytes);
+    if (start + length > artifact.bytes || offset + length > LIMITS.detailBytes)
+      invalid();
+    return {
+      kind,
+      detailId: decodeId(o2.detailId),
+      source: source2,
+      artifact,
+      offset,
+      start,
+      length
+    };
+  }
+  const o = closed(value, ["kind", "detail", "source"]);
+  literal(kind, "end");
+  const detail = decodeRetainedDetail(o.detail), source = nullable(o.source, decodeSourceRange);
+  if (detail.origin.kind === "owner" !== (owner !== null) || source === null !== (owner !== null))
+    invalid();
+  return { kind: "end", detail, source };
 }
-var utf16 = (text2) => Buffer.concat([Buffer.from([255, 254]), Buffer.from(text2, "utf16le")]);
-function launcherWorkspace(text2) {
-  if (text2?.includes("' Cadence workbench gateway; no project workspace"))
-    return null;
-  return text2?.match(/^shell\.CurrentDirectory = "((?:[^"]|"")*)"\r?$/m)?.[1].replaceAll('""', '"');
+function closedTag(value) {
+  if (!value || typeof value !== "object" || !("kind" in value) || typeof value.kind !== "string")
+    invalid();
+  return value.kind;
 }
-var runEntry = (path2, s) => `"${wscript(s.env)}" "${path2}"`;
-var present = (s, key) => s.reg(["query", key, "/v", RUN_VALUE]).status === 0;
-function approvedOff(s) {
-  const r = s.reg(["query", APPROVED_KEY, "/v", RUN_VALUE]);
-  const first = r.status === 0 && /REG_BINARY\s+([0-9A-F]{2})/i.exec(r.stdout);
-  return !!first && (Number.parseInt(first[1], 16) & 1) === 1;
+function decodeAdmissionIntent(value) {
+  const o = closed(value, [
+    "commandId",
+    "operationId",
+    "runId",
+    "identity",
+    "createdTaskId"
+  ]);
+  return {
+    commandId: decodeId(o.commandId),
+    operationId: decodeId(o.operationId),
+    runId: nullable(o.runId, decodeId),
+    identity: decodeCommandIdentity(o.identity),
+    createdTaskId: nullable(o.createdTaskId, decodeId)
+  };
 }
-async function configureLoginRun(s, mode, requested) {
-  const path2 = launcherPath(s);
-  const previous = readGenerated(path2, MARKER3);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined && present(s, RUN_KEY))
-    return { status: "foreign", unit: `${RUN_KEY}\\${RUN_VALUE}` };
-  if (mode === "restart" && previous === undefined)
-    return { status: "absent" };
-  const sdk = sdkPackages(s.root);
-  const kept = launcherWorkspace(previous);
-  const { workspace, redirectedFrom } = selectWorkspace(s, requested, mode === "install" && requested === undefined ? null : kept);
-  if (workspace !== null && !sdk)
-    return { status: "missing-pi-sdk" };
-  const refused2 = await settle(s, kept);
-  if (refused2)
-    return { ...refused2, unit: path2 };
-  const environment = s.env.PI_CODING_AGENT_DIR ? [["PI_CODING_AGENT_DIR", agentDirectory(s)]] : [];
-  write(path2, utf16(buildLauncher({
-    node: s.node,
-    cli: join11(s.root, "src", "service-cli.mjs"),
-    workspace,
-    serverConfig: serverConfigPath(s.home),
-    environment
-  })));
-  const result = {
-    unit: path2,
-    workspace,
-    ...redirectedFrom ? { redirectedFrom } : {}
+function decodeAuthIntent(value) {
+  const o = closed(value, [
+    "operationId",
+    "epoch",
+    "runId",
+    "childRunId",
+    "sourceSelectionId",
+    "validityMs"
+  ]);
+  return {
+    operationId: decodeId(o.operationId),
+    epoch: decodeId(o.epoch),
+    runId: decodeId(o.runId),
+    childRunId: decodeId(o.childRunId),
+    sourceSelectionId: decodeId(o.sourceSelectionId),
+    validityMs: integer(o.validityMs, 1)
   };
-  if (mode === "install") {
-    const entry = ["/v", RUN_VALUE, "/t", "REG_SZ", "/d", runEntry(path2, s)];
-    if (s.reg(["add", RUN_KEY, ...entry, "/f"]).status !== 0)
-      return { status: "failed", ...result };
-    s.reg(["delete", APPROVED_KEY, "/v", RUN_VALUE, "/f"]);
-  }
-  if (workspace !== null && !regularFile(join11(agentDirectory(s), "auth.json")))
-    return { status: "waiting-for-pi-login", ...result };
-  return { status: s.launch(path2) ? "started" : "failed", ...result };
 }
-async function stopLoginRun(s) {
-  const path2 = launcherPath(s);
-  const previous = readGenerated(path2, MARKER3);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const workspace = launcherWorkspace(previous);
-  const refused2 = await settle(s, workspace);
-  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
+function decodeAuthSettlement(value) {
+  const o = closed(value, ["operationId", "outcome", "admissionClosed"]);
+  return {
+    operationId: decodeId(o.operationId),
+    outcome: oneOf(o.outcome, ["resolved", "refused", "failed"]),
+    admissionClosed: bool(o.admissionClosed)
+  };
 }
-async function removeLoginRun(s) {
-  const path2 = launcherPath(s);
-  const previous = readGenerated(path2, MARKER3);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const refused2 = await settle(s, launcherWorkspace(previous));
-  if (refused2)
-    return { ...refused2, unit: path2 };
-  for (const key of [RUN_KEY, APPROVED_KEY])
-    if (present(s, key))
-      s.reg(["delete", key, "/v", RUN_VALUE, "/f"]);
-  rmSync3(path2);
-  return { status: "removed", unit: path2 };
-}
-async function loginRunStatus(s) {
-  const path2 = launcherPath(s);
-  const previous = readGenerated(path2, MARKER3);
-  if (previous === null)
-    return { status: "foreign", unit: path2 };
-  if (previous === undefined)
-    return { status: "absent" };
-  const workspace = launcherWorkspace(previous);
-  const owner = workspace !== undefined ? await s.ownerStatus(workspace, serverConfigPath(s.home)) : "unavailable";
+function decodeRecoveryBridge(v) {
+  const o = closed(v, [
+    "kind",
+    "recoveryId",
+    "epoch",
+    "coordinationDigest",
+    "historyDigest",
+    "previous",
+    "acknowledgments"
+  ]);
+  const p = closed(o.previous, [
+    "segment",
+    "bytes",
+    "sha256",
+    "committedBytes",
+    "committedSeq",
+    "highSeq"
+  ]);
+  const a = closed(o.acknowledgments, ["processes", "credentials", "storage"]);
+  const previous = {
+    segment: integer(p.segment),
+    bytes: integer(p.bytes, 0, LIMITS.segmentBytes),
+    sha256: decodeHash(p.sha256),
+    committedBytes: integer(p.committedBytes, 0, LIMITS.segmentBytes),
+    committedSeq: decodeSequence(p.committedSeq),
+    highSeq: decodeSequence(p.highSeq)
+  };
+  if (previous.committedBytes > previous.bytes || BigInt(previous.highSeq) < BigInt(previous.committedSeq))
+    invalid();
+  if (a.processes !== true || a.credentials !== true || a.storage !== true)
+    invalid();
   return {
-    status: owner === "alive" ? "active" : "inactive",
-    enabled: present(s, RUN_KEY) && !approvedOff(s) ? "enabled" : "disabled",
-    unit: path2,
-    workspace
+    kind: literal(o.kind, "recovery"),
+    recoveryId: decodeId(o.recoveryId),
+    epoch: decodeId(o.epoch),
+    coordinationDigest: decodeHash(o.coordinationDigest),
+    historyDigest: decodeHash(o.historyDigest),
+    previous,
+    acknowledgments: { processes: true, credentials: true, storage: true }
   };
 }
-
-// src/service/recovery-cli.ts
-import { isatty } from "node:tty";
-
-// src/history/recovery.ts
-import { createHash as createHash6, randomUUID as randomUUID7 } from "node:crypto";
-import { lstatSync as lstatSync7, opendirSync as opendirSync4 } from "node:fs";
-import { join as join13, relative as relative4 } from "node:path";
-
-// src/service/recovery.ts
-async function inspectRecovery(coordination, history) {
-  const selected = coordination.recoverySnapshot();
-  const facts = history ? await history.inspect(selected.registration.epoch) : null;
-  if (facts)
-    decodeHash(facts.digest);
-  if (coordination.recoverySnapshot().digest !== selected.digest)
-    throw new ContractError("conflict");
+function validBatchSequence(rows, previous) {
+  const bridge = rows[0]?.value;
+  const base = bridge?.kind === "recovery" ? bridge.previous.highSeq : previous;
+  if (bridge?.kind === "recovery" && (rows.length !== 1 || bridge.previous.committedSeq !== previous))
+    return false;
+  return rows.every((row, i) => row.seq === String(BigInt(base) + BigInt(i) + 1n) && (i === 0 || row.value.kind !== "recovery"));
+}
+function decodeResourcePolicy(v) {
+  const o = closed(v, [
+    "generation",
+    "quotaBytes",
+    "episodeReservationBytes",
+    "freeSpaceFloorBytes",
+    "episodeControlBytes"
+  ]);
   return {
-    epoch: selected.registration.epoch,
-    coordinationDigest: selected.digest,
-    history: facts,
-    owner: recoveryOwnerStatus(selected.registration.pid, selected.registration.host),
-    resolution: "local-interactive-only"
+    generation: integer(o.generation, 1),
+    quotaBytes: integer(o.quotaBytes, LIMITS.episodeControlBytes),
+    episodeReservationBytes: integer(o.episodeReservationBytes, LIMITS.episodeControlBytes),
+    freeSpaceFloorBytes: literal(o.freeSpaceFloorBytes, LIMITS.freeSpaceFloorBytes),
+    episodeControlBytes: literal(o.episodeControlBytes, LIMITS.episodeControlBytes)
   };
 }
-async function resolveRecovery(coordination, confirmation, history) {
-  if (typeof confirmation.assertLocalAuthority !== "function" || confirmation.acknowledgeEscapedProcesses !== true || confirmation.processes !== "externally-resolved" || confirmation.credentials !== "independently-resolved" || confirmation.storage !== "independently-resolved")
-    throw new ContractError("forbidden");
-  const expected = structuredClone(confirmation.expected);
-  const authority = () => confirmation.assertLocalAuthority(structuredClone(expected));
-  authority();
-  const release = coordination.prepareRecoveryRelease(expected.coordinationDigest, authority);
-  const current = await inspectRecovery(coordination, history);
-  if (JSON.stringify(current) !== JSON.stringify(expected))
-    throw new ContractError("conflict");
-  if (current.owner !== "absent" || !current.history)
-    throw new ContractError("quarantine");
-  const fact = await history.append({
-    ...confirmation,
-    expected
-  });
-  authority();
-  if (fact.epoch !== expected.epoch || fact.coordinationDigest !== expected.coordinationDigest || fact.historyDigest !== expected.history?.digest)
-    throw new ContractError("conflict");
-  release(() => history.assertCommitted(fact));
+function decodeJournalValue(value) {
+  const kind = closedTag(value);
+  switch (kind) {
+    case "recovery":
+      return decodeRecoveryBridge(value);
+    case "owner-epoch": {
+      const o = closed(value, ["kind", "epoch"]);
+      return { kind, epoch: decodeId(o.epoch) };
+    }
+    case "admission-compact": {
+      const hasPolicy = Object.hasOwn(value, "policy");
+      const o = closed(value, [
+        "kind",
+        "intent",
+        "receipt",
+        ...hasPolicy ? ["policy"] : []
+      ]);
+      const intent = decodeAdmissionIntent(o.intent);
+      return decodeJournalValue({
+        kind: "admission",
+        intent,
+        record: { identity: intent.identity, receipt: o.receipt },
+        ...hasPolicy ? { policy: o.policy } : {}
+      });
+    }
+    case "admission": {
+      const hasPolicy = typeof value === "object" && value !== null && Object.hasOwn(value, "policy");
+      const o = closed(value, [
+        "kind",
+        "intent",
+        "record",
+        ...hasPolicy ? ["policy"] : []
+      ]), intent = decodeAdmissionIntent(o.intent), record = decodeStoredCommand(o.record);
+      if (record.receipt.commandId !== intent.commandId || record.receipt.operationId !== intent.operationId || record.receipt.runId !== intent.runId || canonicalJson(record.identity) !== canonicalJson(intent.identity) || (record.receipt.created?.taskId ?? null) !== intent.createdTaskId)
+        invalid();
+      const policy = hasPolicy ? decodeResourcePolicy(o.policy) : undefined;
+      if (policy && intent.identity.kind === "action" && policy.generation !== intent.identity.expected.configRev)
+        invalid();
+      return { kind, intent, record, ...policy ? { policy } : {} };
+    }
+    case "auth-preparation": {
+      const o = closed(value, ["kind", "intent"]);
+      return { kind, intent: decodeAuthIntent(o.intent) };
+    }
+    case "auth-settlement": {
+      const o = closed(value, ["kind", "result"]);
+      return { kind, result: decodeAuthSettlement(o.result) };
+    }
+    case "launch": {
+      const o = closed(value, ["kind", "link", "operationId"]);
+      return {
+        kind,
+        link: decodeRecordingLink(o.link),
+        operationId: decodeId(o.operationId)
+      };
+    }
+    case "settlement": {
+      const o = closed(value, ["kind", "link", "completion"]), link = decodeRecordingLink(o.link), completion = decodeWorkerCompletion(o.completion);
+      if (link.childRunId !== completion.childRunId)
+        invalid();
+      return { kind, link, completion };
+    }
+    case "capture": {
+      const o = closed(value, ["kind", "link", "source", "events"]);
+      return {
+        kind,
+        link: decodeRecordingLink(o.link),
+        source: decodeSourceRange(o.source),
+        events: list(o.events, LIMITS.ownerQueueFrames, (v) => decodeSavedEvent(v, null))
+      };
+    }
+    case "owner": {
+      const o = closed(value, ["kind", "link", "observedMs", "events"]), link = decodeOwnerLink(o.link);
+      return {
+        kind,
+        link,
+        observedMs: integer(o.observedMs),
+        events: list(o.events, LIMITS.ownerQueueFrames, (v) => decodeSavedEvent(v, link))
+      };
+    }
+    default:
+      return invalid();
+  }
+}
+function decodeJournalLine(value) {
+  if (closedTag(value) === "record") {
+    const o2 = closed(value, ["kind", "seq", "id", "value"]);
+    return {
+      kind: "record",
+      seq: decodeSequence(o2.seq),
+      id: decodeId(o2.id),
+      value: decodeJournalValue(o2.value)
+    };
+  }
+  const indexed = typeof value === "object" && value !== null && Object.hasOwn(value, "navigationRoot");
+  const o = closed(value, [
+    ...indexed ? ["navigationRoot"] : [],
+    "kind",
+    "previous",
+    "first",
+    "last",
+    "count",
+    "sha256",
+    "artifacts"
+  ]);
+  literal(o.kind, "commit");
   return {
-    status: "resolved",
-    epoch: fact.epoch,
-    recoveryId: fact.recoveryId,
-    committedSeq: fact.committedSeq,
-    notice: "operator-acknowledgment-not-certification"
+    kind: "commit",
+    ...indexed ? { navigationRoot: nullable(o.navigationRoot, decodeHash) } : {},
+    previous: decodeSequence(o.previous),
+    first: decodeSequence(o.first),
+    last: decodeSequence(o.last),
+    count: integer(o.count, 1, LIMITS.segmentRecords),
+    sha256: decodeHash(o.sha256),
+    artifacts: list(o.artifacts, LIMITS.ownerQueueFrames, decodeArtifact)
   };
 }
-
-// src/history/files.ts
-import { createHash as createHash5, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "node:crypto";
-import {
-  closeSync as closeSync5,
-  constants as constants5,
-  fstatSync as fstatSync4,
-  fsyncSync as fsyncSync3,
-  lstatSync as lstatSync6,
-  opendirSync as opendirSync3,
-  openSync as openSync5,
-  statfsSync
-} from "node:fs";
-import { open } from "node:fs/promises";
-import { dirname as dirname12, join as join12 } from "node:path";
-
-// src/history/admission.ts
-function decodeRunAdmission(value) {
-  const o = closed(value, ["schema", "runId", "identity", "graph"]);
-  const result = {
-    schema: literal(o.schema, "cadence-run-admission/2"),
-    runId: decodeId(o.runId),
-    identity: decodeRunIdentity(o.identity),
-    graph: nullable(o.graph, decodeGraph)
+var COMPLETE = {
+  observed: "complete",
+  source: "complete",
+  redacted: false,
+  omissions: []
+};
+function captureCoverage(event) {
+  if (event.kind === "capture-status")
+    return event.coverage;
+  if (event.kind === "omitted-block")
+    return { ...COMPLETE, source: "limited", omissions: [event.block.reason] };
+  return null;
+}
+function combineCoverage(a, b) {
+  return {
+    observed: a.observed === "complete" && b.observed === "complete" ? "complete" : "incomplete",
+    source: a.source === "unavailable" || b.source === "unavailable" ? "unavailable" : a.source === "limited" || b.source === "limited" ? "limited" : "complete",
+    redacted: a.redacted || b.redacted,
+    omissions: [...new Set([...a.omissions, ...b.omissions])]
   };
-  const { identity, graph } = result;
-  if (identity.kind === "start" !== (graph !== null))
-    throw new ContractError("invalid");
-  if (graph && (graph.taskId !== identity.context.task?.id || graph.taskKind !== identity.context.task.kind || graph.taskRevision > identity.context.task.revision || graph.revision !== identity.graph?.revision || hash(canonicalJson(graph)) !== identity.graph.sha256 || canonicalJson(graph.assignments.map((a) => a.id)) !== canonicalJson(identity.assignments.map((a) => a.assignmentId)) || graph.assignments.some((a) => canonicalJson(a.model) !== canonicalJson(identity.context.model))))
-    throw new ContractError("conflict");
-  return result;
 }
-
-// src/history/read-io.ts
-import {
-  closeSync as closeSync4,
-  constants as constants4,
-  fstatSync as fstatSync3,
-  lstatSync as lstatSync5,
-  openSync as openSync4,
-  readSync as readSync3
-} from "node:fs";
-import { dirname as dirname11 } from "node:path";
-function bad() {
-  throw new ContractError("corrupt-selected");
+function rowArtifacts(row) {
+  return row.value.kind === "capture" || row.value.kind === "owner" ? row.value.events.flatMap((e) => e.kind === "chunk" ? [e.artifact] : []) : [];
 }
-var stamp2 = (s) => [s.dev, s.ino, s.size, s.mode, s.uid, s.nlink, s.ctimeMs, s.mtimeMs].join(":");
-function selected(files, path2, read, walks) {
-  if (!files.files.directory(dirname11(path2), false, walks))
-    bad();
-  const before = lstatSync5(path2);
-  if (!before.isFile() || before.nlink !== 1 || process.platform !== "win32" && (before.mode & 63 || process.getuid && before.uid !== process.getuid()))
-    bad();
-  const fd = openSync4(path2, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
-  try {
-    if (stamp2(fstatSync3(fd)) !== stamp2(before))
-      bad();
-    const result = read(fd, before.size, stamp2(before));
-    if (stamp2(fstatSync3(fd)) !== stamp2(before) || stamp2(lstatSync5(path2)) !== stamp2(before))
-      bad();
-    return result;
-  } finally {
-    closeSync4(fd);
+function batchArtifacts(rows) {
+  const unique = new Map;
+  for (const ref of rows.flatMap(rowArtifacts)) {
+    const key = `${ref.runId}/${ref.artifactId}/${ref.part}`, previous = unique.get(key);
+    if (previous && canonicalJson(previous) !== canonicalJson(ref))
+      invalid();
+    unique.set(key, ref);
   }
+  return [...unique.values()];
 }
-function assertIncarnation(files, path2, expected) {
-  selected(files, path2, (_fd, _size, current) => {
-    if (current !== expected)
-      bad();
-  });
-}
-function statSize(files, path2, maximum) {
-  return selected(files, path2, (_fd, size) => {
-    if (size > maximum)
-      bad();
-    return size;
-  });
+var decodedLines = new Map;
+var decodedBytes = 0;
+var lineKey = (text2) => createHash4("sha256").update(text2).digest("hex");
+function remember(text2, value) {
+  const key = lineKey(text2);
+  if (decodedLines.has(key))
+    return;
+  const bytes = Buffer.byteLength(text2);
+  while (decodedLines.size && (decodedLines.size >= 2 * LIMITS.segmentRecords || decodedBytes + bytes > 2 * LIMITS.segmentBytes)) {
+    const first = decodedLines.keys().next().value;
+    if (!first)
+      break;
+    decodedBytes -= decodedLines.get(first)?.bytes ?? 0;
+    decodedLines.delete(first);
+  }
+  if (bytes <= 2 * LIMITS.segmentBytes) {
+    decodedLines.set(key, { bytes, value });
+    decodedBytes += bytes;
+  }
 }
-
-// src/history/types.ts
-import { createHash as createHash4 } from "node:crypto";
-var RECORD_BYTES = LIMITS.controlBytes + 64 * 1024;
-var LEGACY_FORMAT = "cadence-history-store/2";
-var FORMAT = "cadence-history-store/3";
-function decodeFormat(value) {
-  const o = closed(value, ["schema", "storeId", "workspaceId", "rootIdentity"]);
+function compactAdmission(value) {
+  if (value.kind !== "record" || value.value.kind !== "admission")
+    return value;
+  const { intent, record, policy } = value.value;
   return {
-    schema: oneOf(o.schema, [FORMAT, LEGACY_FORMAT]),
-    storeId: decodeId(o.storeId),
-    workspaceId: decodeId(o.workspaceId),
-    rootIdentity: decodeHash(o.rootIdentity)
+    ...value,
+    value: {
+      kind: "admission-compact",
+      intent,
+      receipt: record.receipt,
+      ...policy ? { policy } : {}
+    }
   };
 }
-function decodeArtifact(value) {
-  const o = closed(value, ["runId", "artifactId", "part", "bytes", "sha256"]);
-  return {
-    runId: decodeId(o.runId),
-    artifactId: decodeId(o.artifactId),
-    part: integer(o.part),
-    bytes: integer(o.bytes, 1, LIMITS.artifactPartBytes),
-    sha256: decodeHash(o.sha256)
-  };
+function encodeJournalText(input) {
+  const value = decodeJournalLine(input), text2 = canonicalJson(compactAdmission(value), RECORD_BYTES);
+  remember(text2, value);
+  return `${text2}
+`;
 }
-function decodeRetainedDetail(value) {
-  const o = closed(value, [
-    "detailId",
-    "origin",
-    "owner",
-    "descriptor",
-    "content",
-    "coverage"
-  ]);
-  const origin = closed(o.origin, ["kind", "id"]);
-  const r = {
-    detailId: decodeId(o.detailId),
-    origin: {
-      kind: oneOf(origin.kind, ["worker", "owner"]),
-      id: decodeId(origin.id)
-    },
-    owner: decodeRecordOwner(o.owner),
-    descriptor: nullable(o.descriptor, decodeDetailDescriptor),
-    content: decodeContentRef(o.content),
-    coverage: decodeCoverage(o.coverage)
-  };
-  if (r.origin.kind === "worker" !== (r.descriptor !== null) || r.descriptor && r.content.field !== r.descriptor.field)
+function decodeJournalText(line) {
+  const text2 = line.endsWith(`
+`) ? line.slice(0, -1) : line;
+  const epoch = /^\{"id":"([0-9a-f-]{36})","kind":"record","seq":"([0-9]+)","value":\{"epoch":"([0-9a-f-]{36})","kind":"owner-epoch"\}\}$/.exec(text2);
+  if (epoch)
+    return {
+      kind: "record",
+      id: decodeId(epoch[1]),
+      seq: decodeSequence(epoch[2]),
+      value: { kind: "owner-epoch", epoch: decodeId(epoch[3]) }
+    };
+  const key = lineKey(text2), cached = decodedLines.get(key);
+  if (cached)
+    return structuredClone(cached.value);
+  const raw = JSON.parse(text2);
+  const value = decodeJournalLine(raw);
+  const compact = raw?.kind === "record" && raw.value?.kind === "admission-compact";
+  if (canonicalJson(compact ? compactAdmission(value) : value, RECORD_BYTES) !== text2)
     invalid();
-  return r;
+  remember(text2, value);
+  return structuredClone(value);
 }
-function decodeSavedEvent(value, owner) {
-  const kind = closedTag(value);
-  if (kind === "capture") {
-    const o2 = closed(value, ["kind", "id", "value"]), v = decodeRecordingEvent(o2.value);
-    if (owner || v.event.kind === "stored-chunk" || v.event.kind === "stored-end")
-      invalid();
-    return { kind, id: decodeId(o2.id), value: v };
+
+// src/history/files.ts
+class HistoryReadBudget {
+  clock;
+  started = performance.now();
+  bytes = 0;
+  walks = new DirectoryWalks;
+  constructor(clock = true) {
+    this.clock = clock;
   }
-  if (kind === "owner") {
-    const o2 = closed(value, ["kind", "id", "value"]);
-    if (!owner)
-      invalid();
-    const v = decodeOwnerRecordingInput({
-      link: owner,
-      observedMs: 0,
-      events: [o2.value]
-    }).events[0];
-    if (v.kind === "content-chunk" || v.kind === "content-end")
-      invalid();
-    return { kind, id: decodeId(o2.id), value: v };
+  static authority() {
+    return new HistoryReadBudget(false);
   }
-  if (kind === "chunk") {
-    const o2 = closed(value, [
-      "kind",
-      "detailId",
-      "source",
-      "artifact",
-      "offset",
-      "start",
-      "length"
-    ]);
-    const source2 = nullable(o2.source, decodeSourceRange);
-    if (source2 === null !== (owner !== null))
-      invalid();
-    const artifact = decodeArtifact(o2.artifact), offset = integer(o2.offset, 0, LIMITS.detailBytes), start = integer(o2.start, 0, LIMITS.artifactPartBytes), length = integer(o2.length, 1, LIMITS.chunkBytes);
-    if (start + length > artifact.bytes || offset + length > LIMITS.detailBytes)
-      invalid();
-    return {
-      kind,
-      detailId: decodeId(o2.detailId),
-      source: source2,
-      artifact,
-      offset,
-      start,
-      length
-    };
+  reserve(bytes) {
+    if (!Number.isSafeInteger(bytes) || bytes < 0 || this.bytes + bytes > LIMITS.searchBytes || this.elapsed)
+      throw new ContractError("receipt-inconclusive");
+    this.bytes += bytes;
+  }
+  get elapsed() {
+    return this.clock && performance.now() - this.started >= LIMITS.searchMs;
   }
-  const o = closed(value, ["kind", "detail", "source"]);
-  literal(kind, "end");
-  const detail = decodeRetainedDetail(o.detail), source = nullable(o.source, decodeSourceRange);
-  if (detail.origin.kind === "owner" !== (owner !== null) || source === null !== (owner !== null))
-    invalid();
-  return { kind: "end", detail, source };
 }
-function closedTag(value) {
-  if (!value || typeof value !== "object" || !("kind" in value) || typeof value.kind !== "string")
-    invalid();
-  return value.kind;
-}
-function decodeAdmissionIntent(value) {
-  const o = closed(value, [
-    "commandId",
-    "operationId",
-    "runId",
-    "identity",
-    "createdTaskId"
-  ]);
-  return {
-    commandId: decodeId(o.commandId),
-    operationId: decodeId(o.operationId),
-    runId: nullable(o.runId, decodeId),
-    identity: decodeCommandIdentity(o.identity),
-    createdTaskId: nullable(o.createdTaskId, decodeId)
-  };
-}
-function decodeAuthIntent(value) {
-  const o = closed(value, [
-    "operationId",
-    "epoch",
-    "runId",
-    "childRunId",
-    "sourceSelectionId",
-    "validityMs"
-  ]);
-  return {
-    operationId: decodeId(o.operationId),
-    epoch: decodeId(o.epoch),
-    runId: decodeId(o.runId),
-    childRunId: decodeId(o.childRunId),
-    sourceSelectionId: decodeId(o.sourceSelectionId),
-    validityMs: integer(o.validityMs, 1)
-  };
-}
-function decodeAuthSettlement(value) {
-  const o = closed(value, ["operationId", "outcome", "admissionClosed"]);
-  return {
-    operationId: decodeId(o.operationId),
-    outcome: oneOf(o.outcome, ["resolved", "refused", "failed"]),
-    admissionClosed: bool(o.admissionClosed)
-  };
-}
-function decodeRecoveryBridge(v) {
-  const o = closed(v, [
-    "kind",
-    "recoveryId",
-    "epoch",
-    "coordinationDigest",
-    "historyDigest",
-    "previous",
-    "acknowledgments"
-  ]);
-  const p = closed(o.previous, [
-    "segment",
-    "bytes",
-    "sha256",
-    "committedBytes",
-    "committedSeq",
-    "highSeq"
-  ]);
-  const a = closed(o.acknowledgments, ["processes", "credentials", "storage"]);
-  const previous = {
-    segment: integer(p.segment),
-    bytes: integer(p.bytes, 0, LIMITS.segmentBytes),
-    sha256: decodeHash(p.sha256),
-    committedBytes: integer(p.committedBytes, 0, LIMITS.segmentBytes),
-    committedSeq: decodeSequence(p.committedSeq),
-    highSeq: decodeSequence(p.highSeq)
-  };
-  if (previous.committedBytes > previous.bytes || BigInt(previous.highSeq) < BigInt(previous.committedSeq))
-    invalid();
-  if (a.processes !== true || a.credentials !== true || a.storage !== true)
-    invalid();
-  return {
-    kind: literal(o.kind, "recovery"),
-    recoveryId: decodeId(o.recoveryId),
-    epoch: decodeId(o.epoch),
-    coordinationDigest: decodeHash(o.coordinationDigest),
-    historyDigest: decodeHash(o.historyDigest),
-    previous,
-    acknowledgments: { processes: true, credentials: true, storage: true }
-  };
-}
-function validBatchSequence(rows, previous) {
-  const bridge = rows[0]?.value;
-  const base = bridge?.kind === "recovery" ? bridge.previous.highSeq : previous;
-  if (bridge?.kind === "recovery" && (rows.length !== 1 || bridge.previous.committedSeq !== previous))
-    return false;
-  return rows.every((row, i) => row.seq === String(BigInt(base) + BigInt(i) + 1n) && (i === 0 || row.value.kind !== "recovery"));
-}
-function decodeResourcePolicy(v) {
-  const o = closed(v, [
-    "generation",
-    "quotaBytes",
-    "episodeReservationBytes",
-    "freeSpaceFloorBytes",
-    "episodeControlBytes"
-  ]);
-  return {
-    generation: integer(o.generation, 1),
-    quotaBytes: integer(o.quotaBytes, LIMITS.episodeControlBytes),
-    episodeReservationBytes: integer(o.episodeReservationBytes, LIMITS.episodeControlBytes),
-    freeSpaceFloorBytes: literal(o.freeSpaceFloorBytes, LIMITS.freeSpaceFloorBytes),
-    episodeControlBytes: literal(o.episodeControlBytes, LIMITS.episodeControlBytes)
-  };
+function corrupt() {
+  throw new ContractError("corrupt-selected");
 }
-function decodeJournalValue(value) {
-  const kind = closedTag(value);
-  switch (kind) {
-    case "recovery":
-      return decodeRecoveryBridge(value);
-    case "owner-epoch": {
-      const o = closed(value, ["kind", "epoch"]);
-      return { kind, epoch: decodeId(o.epoch) };
-    }
-    case "admission-compact": {
-      const hasPolicy = Object.hasOwn(value, "policy");
-      const o = closed(value, [
-        "kind",
-        "intent",
-        "receipt",
-        ...hasPolicy ? ["policy"] : []
-      ]);
-      const intent = decodeAdmissionIntent(o.intent);
-      return decodeJournalValue({
-        kind: "admission",
-        intent,
-        record: { identity: intent.identity, receipt: o.receipt },
-        ...hasPolicy ? { policy: o.policy } : {}
-      });
-    }
-    case "admission": {
-      const hasPolicy = typeof value === "object" && value !== null && Object.hasOwn(value, "policy");
-      const o = closed(value, [
-        "kind",
-        "intent",
-        "record",
-        ...hasPolicy ? ["policy"] : []
-      ]), intent = decodeAdmissionIntent(o.intent), record = decodeStoredCommand(o.record);
-      if (record.receipt.commandId !== intent.commandId || record.receipt.operationId !== intent.operationId || record.receipt.runId !== intent.runId || canonicalJson(record.identity) !== canonicalJson(intent.identity) || (record.receipt.created?.taskId ?? null) !== intent.createdTaskId)
-        invalid();
-      const policy = hasPolicy ? decodeResourcePolicy(o.policy) : undefined;
-      if (policy && intent.identity.kind === "action" && policy.generation !== intent.identity.expected.configRev)
-        invalid();
-      return { kind, intent, record, ...policy ? { policy } : {} };
-    }
-    case "auth-preparation": {
-      const o = closed(value, ["kind", "intent"]);
-      return { kind, intent: decodeAuthIntent(o.intent) };
-    }
-    case "auth-settlement": {
-      const o = closed(value, ["kind", "result"]);
-      return { kind, result: decodeAuthSettlement(o.result) };
-    }
-    case "launch": {
-      const o = closed(value, ["kind", "link", "operationId"]);
-      return {
-        kind,
-        link: decodeRecordingLink(o.link),
-        operationId: decodeId(o.operationId)
-      };
-    }
-    case "settlement": {
-      const o = closed(value, ["kind", "link", "completion"]), link = decodeRecordingLink(o.link), completion = decodeWorkerCompletion(o.completion);
-      if (link.childRunId !== completion.childRunId)
-        invalid();
-      return { kind, link, completion };
+var publicationFences = new Map;
+var activity = new Map;
+
+class HistoryFiles {
+  coordination;
+  format;
+  formatSnapshot;
+  directory;
+  files;
+  proofSnapshot;
+  constructor(coordination, format, formatSnapshot) {
+    this.coordination = coordination;
+    this.format = format;
+    this.formatSnapshot = formatSnapshot;
+    this.directory = join8(coordination.directory, "history-v2");
+    this.files = coordination.files;
+  }
+  static open(coordination) {
+    const dir = join8(coordination.directory, "history-v2");
+    if (!coordination.files.directory(dir))
+      return;
+    const file = coordination.files.read(join8(dir, "format.json"));
+    if (!file)
+      corrupt();
+    const format = decodeFormat(json(file));
+    if (format.rootIdentity !== hash(coordination.store.root))
+      corrupt();
+    return new HistoryFiles(coordination, format, file);
+  }
+  static initialize(lease) {
+    lease.assert();
+    const c = lease.coordination;
+    const existing = HistoryFiles.open(c);
+    if (existing) {
+      existing.assertWritable();
+      return existing;
     }
-    case "capture": {
-      const o = closed(value, ["kind", "link", "source", "events"]);
-      return {
-        kind,
-        link: decodeRecordingLink(o.link),
-        source: decodeSourceRange(o.source),
-        events: list(o.events, LIMITS.ownerQueueFrames, (v) => decodeSavedEvent(v, null))
-      };
+    const dir = join8(c.directory, "history-v2");
+    const format = {
+      schema: FORMAT,
+      storeId: randomUUID6(),
+      workspaceId: randomUUID6(),
+      rootIdentity: hash(c.store.root)
+    };
+    c.files.directory(dir, true);
+    for (const name of ["commands", "ledger", "runs", "indexes"]) {
+      lease.assert();
+      c.files.directory(join8(dir, name), true);
     }
-    case "owner": {
-      const o = closed(value, ["kind", "link", "observedMs", "events"]), link = decodeOwnerLink(o.link);
-      return {
-        kind,
-        link,
-        observedMs: integer(o.observedMs),
-        events: list(o.events, LIMITS.ownerQueueFrames, (v) => decodeSavedEvent(v, link))
-      };
+    lease.assert();
+    const keyPath = join8(dir, "read-proof-key.json");
+    c.files.create(keyPath, encoded({
+      schema: "cadence-history-read-key/1",
+      storeId: format.storeId,
+      key: randomBytes5(32).toString("base64url")
+    }));
+    lease.assert();
+    const snapshot = c.files.create(join8(dir, "format.json"), encoded(format));
+    const result = new HistoryFiles(c, format, snapshot);
+    result.syncParents(join8(dir, "format.json"));
+    result.assertWritable();
+    return result;
+  }
+  activity() {
+    const key = `${this.directory}/${this.format.storeId}`;
+    let state = activity.get(key);
+    if (!state) {
+      state = { pending: 0, generation: 0 };
+      activity.set(key, state);
     }
-    default:
-      return invalid();
-  }
-}
-function decodeJournalLine(value) {
-  if (closedTag(value) === "record") {
-    const o2 = closed(value, ["kind", "seq", "id", "value"]);
-    return {
-      kind: "record",
-      seq: decodeSequence(o2.seq),
-      id: decodeId(o2.id),
-      value: decodeJournalValue(o2.value)
-    };
-  }
-  const indexed = typeof value === "object" && value !== null && Object.hasOwn(value, "navigationRoot");
-  const o = closed(value, [
-    ...indexed ? ["navigationRoot"] : [],
-    "kind",
-    "previous",
-    "first",
-    "last",
-    "count",
-    "sha256",
-    "artifacts"
-  ]);
-  literal(o.kind, "commit");
-  return {
-    kind: "commit",
-    ...indexed ? { navigationRoot: nullable(o.navigationRoot, decodeHash) } : {},
-    previous: decodeSequence(o.previous),
-    first: decodeSequence(o.first),
-    last: decodeSequence(o.last),
-    count: integer(o.count, 1, LIMITS.segmentRecords),
-    sha256: decodeHash(o.sha256),
-    artifacts: list(o.artifacts, LIMITS.ownerQueueFrames, decodeArtifact)
-  };
-}
-var COMPLETE = {
-  observed: "complete",
-  source: "complete",
-  redacted: false,
-  omissions: []
-};
-function captureCoverage(event) {
-  if (event.kind === "capture-status")
-    return event.coverage;
-  if (event.kind === "omitted-block")
-    return { ...COMPLETE, source: "limited", omissions: [event.block.reason] };
-  return null;
-}
-function combineCoverage(a, b) {
-  return {
-    observed: a.observed === "complete" && b.observed === "complete" ? "complete" : "incomplete",
-    source: a.source === "unavailable" || b.source === "unavailable" ? "unavailable" : a.source === "limited" || b.source === "limited" ? "limited" : "complete",
-    redacted: a.redacted || b.redacted,
-    omissions: [...new Set([...a.omissions, ...b.omissions])]
-  };
-}
-function rowArtifacts(row) {
-  return row.value.kind === "capture" || row.value.kind === "owner" ? row.value.events.flatMap((e) => e.kind === "chunk" ? [e.artifact] : []) : [];
-}
-function batchArtifacts(rows) {
-  const unique = new Map;
-  for (const ref of rows.flatMap(rowArtifacts)) {
-    const key = `${ref.runId}/${ref.artifactId}/${ref.part}`, previous = unique.get(key);
-    if (previous && canonicalJson(previous) !== canonicalJson(ref))
-      invalid();
-    unique.set(key, ref);
-  }
-  return [...unique.values()];
-}
-var decodedLines = new Map;
-var decodedBytes = 0;
-var lineKey = (text2) => createHash4("sha256").update(text2).digest("hex");
-function remember(text2, value) {
-  const key = lineKey(text2);
-  if (decodedLines.has(key))
-    return;
-  const bytes = Buffer.byteLength(text2);
-  while (decodedLines.size && (decodedLines.size >= 2 * LIMITS.segmentRecords || decodedBytes + bytes > 2 * LIMITS.segmentBytes)) {
-    const first = decodedLines.keys().next().value;
-    if (!first)
-      break;
-    decodedBytes -= decodedLines.get(first)?.bytes ?? 0;
-    decodedLines.delete(first);
-  }
-  if (bytes <= 2 * LIMITS.segmentBytes) {
-    decodedLines.set(key, { bytes, value });
-    decodedBytes += bytes;
-  }
-}
-function compactAdmission(value) {
-  if (value.kind !== "record" || value.value.kind !== "admission")
-    return value;
-  const { intent, record, policy } = value.value;
-  return {
-    ...value,
-    value: {
-      kind: "admission-compact",
-      intent,
-      receipt: record.receipt,
-      ...policy ? { policy } : {}
-    }
-  };
-}
-function encodeJournalText(input) {
-  const value = decodeJournalLine(input), text2 = canonicalJson(compactAdmission(value), RECORD_BYTES);
-  remember(text2, value);
-  return `${text2}
-`;
-}
-function decodeJournalText(line) {
-  const text2 = line.endsWith(`
-`) ? line.slice(0, -1) : line;
-  const epoch = /^\{"id":"([0-9a-f-]{36})","kind":"record","seq":"([0-9]+)","value":\{"epoch":"([0-9a-f-]{36})","kind":"owner-epoch"\}\}$/.exec(text2);
-  if (epoch)
-    return {
-      kind: "record",
-      id: decodeId(epoch[1]),
-      seq: decodeSequence(epoch[2]),
-      value: { kind: "owner-epoch", epoch: decodeId(epoch[3]) }
-    };
-  const key = lineKey(text2), cached = decodedLines.get(key);
-  if (cached)
-    return structuredClone(cached.value);
-  const raw = JSON.parse(text2);
-  const value = decodeJournalLine(raw);
-  const compact = raw?.kind === "record" && raw.value?.kind === "admission-compact";
-  if (canonicalJson(compact ? compactAdmission(value) : value, RECORD_BYTES) !== text2)
-    invalid();
-  remember(text2, value);
-  return structuredClone(value);
-}
-
-// src/history/files.ts
-class HistoryReadBudget {
-  clock;
-  started = performance.now();
-  bytes = 0;
-  walks = new DirectoryWalks;
-  constructor(clock = true) {
-    this.clock = clock;
-  }
-  static authority() {
-    return new HistoryReadBudget(false);
-  }
-  reserve(bytes) {
-    if (!Number.isSafeInteger(bytes) || bytes < 0 || this.bytes + bytes > LIMITS.searchBytes || this.elapsed)
-      throw new ContractError("receipt-inconclusive");
-    this.bytes += bytes;
-  }
-  get elapsed() {
-    return this.clock && performance.now() - this.started >= LIMITS.searchMs;
-  }
-}
-function corrupt() {
-  throw new ContractError("corrupt-selected");
-}
-var publicationFences = new Map;
-var activity = new Map;
-
-class HistoryFiles {
-  coordination;
-  format;
-  formatSnapshot;
-  directory;
-  files;
-  proofSnapshot;
-  constructor(coordination, format, formatSnapshot) {
-    this.coordination = coordination;
-    this.format = format;
-    this.formatSnapshot = formatSnapshot;
-    this.directory = join12(coordination.directory, "history-v2");
-    this.files = coordination.files;
-  }
-  static open(coordination) {
-    const dir = join12(coordination.directory, "history-v2");
-    if (!coordination.files.directory(dir))
-      return;
-    const file = coordination.files.read(join12(dir, "format.json"));
-    if (!file)
-      corrupt();
-    const format = decodeFormat(json(file));
-    if (format.rootIdentity !== hash(coordination.store.root))
-      corrupt();
-    return new HistoryFiles(coordination, format, file);
-  }
-  static initialize(lease) {
-    lease.assert();
-    const c = lease.coordination;
-    const existing = HistoryFiles.open(c);
-    if (existing) {
-      existing.assertWritable();
-      return existing;
-    }
-    const dir = join12(c.directory, "history-v2");
-    const format = {
-      schema: FORMAT,
-      storeId: randomUUID6(),
-      workspaceId: randomUUID6(),
-      rootIdentity: hash(c.store.root)
-    };
-    c.files.directory(dir, true);
-    for (const name of ["commands", "ledger", "runs", "indexes"]) {
-      lease.assert();
-      c.files.directory(join12(dir, name), true);
-    }
-    lease.assert();
-    const keyPath = join12(dir, "read-proof-key.json");
-    c.files.create(keyPath, encoded({
-      schema: "cadence-history-read-key/1",
-      storeId: format.storeId,
-      key: randomBytes5(32).toString("base64url")
-    }));
-    lease.assert();
-    const snapshot = c.files.create(join12(dir, "format.json"), encoded(format));
-    const result = new HistoryFiles(c, format, snapshot);
-    result.syncParents(join12(dir, "format.json"));
-    result.assertWritable();
-    return result;
-  }
-  activity() {
-    const key = `${this.directory}/${this.format.storeId}`;
-    let state = activity.get(key);
-    if (!state) {
-      state = { pending: 0, generation: 0 };
-      activity.set(key, state);
-    }
-    return state;
+    return state;
   }
   get writeGeneration() {
     return this.activity().generation;
@@ -5849,7 +5515,7 @@ class HistoryFiles {
       throw new ContractError("quarantine");
   }
   assertFormat() {
-    this.files.assert(join12(this.directory, "format.json"), this.formatSnapshot);
+    this.files.assert(join8(this.directory, "format.json"), this.formatSnapshot);
   }
   readProofMaterial(budget) {
     if (this.format.schema !== FORMAT)
@@ -5858,7 +5524,7 @@ class HistoryFiles {
       this.assertReadFormat(budget);
     else
       this.assertFormat();
-    const selected2 = this.readBudgeted(join12(this.directory, "read-proof-key.json"), 512, budget);
+    const selected2 = this.readBudgeted(join8(this.directory, "read-proof-key.json"), 512, budget);
     if (!selected2 || this.proofSnapshot && (selected2.identity !== this.proofSnapshot.identity || selected2.stamp !== this.proofSnapshot.stamp))
       corrupt();
     try {
@@ -5886,17 +5552,17 @@ class HistoryFiles {
       return;
     }
     this.assertFormat();
-    assertIncarnation(this, join12(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
+    assertIncarnation(this, join8(this.directory, "read-proof-key.json"), this.proofSnapshot.stamp);
   }
   segmentPath(segment) {
-    return join12(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
+    return join8(this.directory, "ledger", `${String(segment).padStart(12, "0")}.jsonl`);
   }
   artifactPath(ref) {
-    return join12(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
+    return join8(this.directory, "runs", ref.runId, "artifacts", ref.artifactId, `${ref.part}.part`);
   }
   admissionPath(runId) {
     decodeId(runId);
-    return join12(this.directory, "runs", runId, "admission.json");
+    return join8(this.directory, "runs", runId, "admission.json");
   }
   writeAdmission(lease, input) {
     lease.assert();
@@ -5922,7 +5588,7 @@ class HistoryFiles {
   readCommand(commandId, budget) {
     decodeId(commandId);
     this.assertReadFormat(budget);
-    return this.readBudgeted(join12(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
+    return this.readBudgeted(join8(this.directory, "commands", commandId, "intent.json"), RECORD_BYTES, budget);
   }
   readAdmission(runId, identity, budget) {
     return this.readAdmissionIdentity(runId, hash(canonicalJson(identity)), budget);
@@ -5943,7 +5609,7 @@ class HistoryFiles {
   syncParents(file) {
     if (process.platform === "win32")
       return;
-    for (let path2 = dirname12(file);; path2 = dirname12(path2)) {
+    for (let path2 = dirname8(file);; path2 = dirname8(path2)) {
       if (!this.files.directory(path2))
         corrupt();
       const fd = openSync5(path2, constants5.O_RDONLY | constants5.O_DIRECTORY);
@@ -5954,13 +5620,13 @@ class HistoryFiles {
       }
       if (path2 === this.coordination.directory)
         break;
-      if (path2 === dirname12(path2))
+      if (path2 === dirname8(path2))
         corrupt();
     }
   }
   assertReadFormat(budget) {
     budget.reserve(this.formatSnapshot.bytes.length);
-    this.files.assert(join12(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
+    this.files.assert(join8(this.directory, "format.json"), this.formatSnapshot, this.formatSnapshot.bytes.length);
   }
   assertPublished(segment, end, seq) {
     const fence = publicationFences.get(this.directory);
@@ -5998,7 +5664,7 @@ class HistoryFiles {
       const dir = opendirSync3(path2);
       try {
         for (let e = dir.readSync();e; e = dir.readSync()) {
-          const p = join12(path2, e.name), st = lstatSync6(p);
+          const p = join8(path2, e.name), st = lstatSync6(p);
           if (st.isDirectory())
             bytes += walk(p, depth + 1);
           else {
@@ -6033,7 +5699,7 @@ class HistoryFiles {
     state.bytes = 0;
     state.identity = null;
     let count = 0;
-    const ledger = join12(this.directory, "ledger");
+    const ledger = join8(this.directory, "ledger");
     if (!this.files.directory(ledger))
       corrupt();
     const dir = opendirSync3(ledger);
@@ -6350,7 +6016,7 @@ class HistoryFiles {
   checkpoint(lease, state) {
     lease.assert();
     this.assertWritable();
-    const path2 = join12(this.directory, "checkpoint.json"), old = this.files.read(path2);
+    const path2 = join8(this.directory, "checkpoint.json"), old = this.files.read(path2);
     const body = encoded({
       schema: "cadence-history-checkpoint/2",
       storeId: this.format.storeId,
@@ -6754,341 +6420,1216 @@ function projectRunObservation(runId, epoch, o, child) {
     result: null
   };
 }
-
-// src/history/recovery.ts
-function digestHistory(files, exclude) {
-  files.assertFormat();
-  const digest = createHash6("sha256");
-  let count = 0;
-  const walk = (path2, depth) => {
-    if (depth > 8 || !files.files.directory(path2))
-      throw new ContractError("corrupt-selected");
-    const directory2 = lstatSync7(path2);
-    digest.update(`incarnation:${directory2.dev}:${directory2.ino}
-`);
-    const dir = opendirSync4(path2), names2 = [];
-    try {
-      for (let e = dir.readSync();e; e = dir.readSync()) {
-        if (++count > LIMITS.dataFrames)
-          throw new ContractError("capacity");
-        names2.push(e.name);
-      }
-    } finally {
-      dir.closeSync();
-    }
-    for (const name of names2.sort()) {
-      const selected2 = join13(path2, name);
-      if (selected2 === exclude)
-        continue;
-      const rel = relative4(files.directory, selected2);
-      if (lstatSync7(selected2).isDirectory()) {
-        digest.update(`directory:${Buffer.byteLength(rel)}:${rel}
-`);
-        walk(selected2, depth + 1);
-      } else {
-        const value = files.files.read(selected2, LIMITS.segmentBytes);
-        if (!value)
-          throw new ContractError("conflict");
-        digest.update(`file:${Buffer.byteLength(rel)}:${rel}:${value.stamp}:${value.bytes.length}:`).update(value.bytes);
-      }
-    }
+
+// src/history/recovery.ts
+function digestHistory(files, exclude) {
+  files.assertFormat();
+  const digest = createHash6("sha256");
+  let count = 0;
+  const walk = (path2, depth) => {
+    if (depth > 8 || !files.files.directory(path2))
+      throw new ContractError("corrupt-selected");
+    const directory2 = lstatSync7(path2);
+    digest.update(`incarnation:${directory2.dev}:${directory2.ino}
+`);
+    const dir = opendirSync4(path2), names2 = [];
+    try {
+      for (let e = dir.readSync();e; e = dir.readSync()) {
+        if (++count > LIMITS.dataFrames)
+          throw new ContractError("capacity");
+        names2.push(e.name);
+      }
+    } finally {
+      dir.closeSync();
+    }
+    for (const name of names2.sort()) {
+      const selected2 = join9(path2, name);
+      if (selected2 === exclude)
+        continue;
+      const rel = relative4(files.directory, selected2);
+      if (lstatSync7(selected2).isDirectory()) {
+        digest.update(`directory:${Buffer.byteLength(rel)}:${rel}
+`);
+        walk(selected2, depth + 1);
+      } else {
+        const value = files.files.read(selected2, LIMITS.segmentBytes);
+        if (!value)
+          throw new ContractError("conflict");
+        digest.update(`file:${Buffer.byteLength(rel)}:${rel}:${value.stamp}:${value.bytes.length}:`).update(value.bytes);
+      }
+    }
+  };
+  walk(files.directory, 0);
+  files.assertFormat();
+  return digest.digest("hex");
+}
+
+class HistoryRecovery {
+  coordination;
+  committed = new WeakMap;
+  constructor(coordination) {
+    this.coordination = coordination;
+  }
+  files() {
+    const files = HistoryFiles.open(this.coordination);
+    if (!files)
+      throw new ContractError("unavailable");
+    return files;
+  }
+  assertCommitted(fact) {
+    const assert = this.committed.get(fact);
+    if (!assert)
+      throw new ContractError("conflict");
+    assert();
+  }
+  async inspect(epoch) {
+    decodeId(epoch);
+    const files = this.files(), before = digestHistory(files), state = emptyScan();
+    const auth = new Set, processes = new Set, publication = new Set, unfinished = new Set, metadata = new Set, runs = new Map;
+    for (const batch of files.scan(state))
+      for (const row of batch.rows) {
+        const v = row.value;
+        if (v.kind === "recovery") {
+          auth.clear();
+          processes.clear();
+          publication.clear();
+          unfinished.clear();
+          metadata.clear();
+          runs.clear();
+        }
+        if (v.kind === "admission" && v.intent.identity.kind === "action") {
+          if (v.intent.runId) {
+            if (runs.size >= LIMITS.episodes || runs.has(v.intent.runId))
+              throw new ContractError("corrupt-selected");
+            runs.set(v.intent.runId, new RunState(v.intent.runId));
+          } else
+            metadata.add(v.intent.operationId);
+        }
+        for (const [id, state2] of runs) {
+          state2.apply(row, batch.marker.last);
+          if (state2.drained)
+            runs.delete(id);
+        }
+        if (v.kind === "capture" || v.kind === "owner")
+          for (const e of v.events) {
+            if (e.kind === "capture" && e.value.event.kind === "detail-begin" && v.kind === "capture")
+              unfinished.add(`worker/${v.link.childRunId}/${e.value.event.detailId}`);
+            if (e.kind === "owner" && e.value.kind === "content-begin" && v.kind === "owner")
+              unfinished.add(`owner/${v.link.operationId}/${e.value.detailId}`);
+            if (e.kind === "end")
+              unfinished.delete(`${e.detail.origin.kind}/${e.detail.origin.id}/${e.detail.detailId}`);
+          }
+        if (v.kind === "auth-preparation")
+          auth.add(v.intent.operationId);
+        if (v.kind === "auth-settlement")
+          auth.delete(v.result.operationId);
+        if (v.kind === "launch")
+          processes.add(v.link.childRunId);
+        if (v.kind === "settlement" && v.completion.native.closure !== "unconfirmed")
+          processes.delete(v.link.childRunId);
+        if (v.kind === "owner") {
+          for (const e of v.events)
+            if (e.kind === "owner" && e.value.kind === "fact") {
+              const f = e.value.fact;
+              if (f.kind === "check-start")
+                processes.add(f.checkId);
+              if (f.kind === "check-settled" && f.native.closure !== "unconfirmed")
+                processes.delete(f.checkId);
+              if (f.kind === "publication-intent")
+                publication.add(f.publicationId);
+              if (f.kind === "publication-settled") {
+                if (f.status === "published") {
+                  publication.delete(f.publicationId);
+                  metadata.delete(v.link.operationId);
+                } else
+                  publication.add(f.publicationId);
+              }
+            }
+        }
+      }
+    if (before !== digestHistory(files))
+      throw new ContractError("conflict");
+    return {
+      digest: before,
+      processes: processes.size ? "unknown" : "externally-resolved",
+      credentials: auth.size ? "unknown" : "independently-resolved",
+      storage: state.tail || publication.size || unfinished.size || metadata.size || runs.size ? "unknown" : "independently-resolved"
+    };
+  }
+  async append(confirmation, observeWrite) {
+    if (typeof confirmation.assertLocalAuthority !== "function" || confirmation.acknowledgeEscapedProcesses !== true || confirmation.processes !== "externally-resolved" || confirmation.credentials !== "independently-resolved" || confirmation.storage !== "independently-resolved")
+      throw new ContractError("forbidden");
+    const expected = structuredClone(confirmation.expected), files = this.files();
+    files.assertWritable();
+    if (!expected.history || expected.owner !== "absent")
+      throw new ContractError("quarantine");
+    const current = await inspectRecovery(this.coordination, this);
+    if (JSON.stringify(current) !== JSON.stringify(expected))
+      throw new ContractError("conflict");
+    const state = files.inspect(), recoveryId = randomUUID7();
+    const bridge = {
+      kind: "recovery",
+      recoveryId,
+      epoch: expected.epoch,
+      coordinationDigest: expected.coordinationDigest,
+      historyDigest: expected.history.digest,
+      previous: {
+        segment: state.segment,
+        bytes: state.bytes,
+        sha256: state.identity ?? hash(""),
+        committedBytes: state.committedBytes ?? state.bytes,
+        committedSeq: state.committedSeq,
+        highSeq: state.highSeq ?? state.committedSeq
+      },
+      acknowledgments: { processes: true, credentials: true, storage: true }
+    };
+    const path2 = files.segmentPath(state.segment + 1);
+    const assertCurrent = async () => {
+      await confirmation.assertLocalAuthority(structuredClone(expected));
+      const selected2 = await inspectRecovery(this.coordination);
+      if (selected2.owner !== "absent")
+        throw new ContractError("quarantine");
+      if (selected2.epoch !== expected.epoch || selected2.coordinationDigest !== expected.coordinationDigest || digestHistory(files, path2) !== expected.history?.digest || this.coordination.recoverySnapshot().digest !== expected.coordinationDigest)
+        throw new ContractError("conflict");
+    };
+    await confirmation.assertLocalAuthority(structuredClone(expected));
+    if (digestHistory(files) !== expected.history.digest)
+      throw new ContractError("conflict");
+    const row = {
+      kind: "record",
+      id: randomUUID7(),
+      seq: String(BigInt(bridge.previous.highSeq) + 1n),
+      value: bridge
+    };
+    let quota = LIMITS.checkoutQuotaBytes;
+    for (const batch of files.scan())
+      for (const row2 of batch.rows)
+        if (row2.value.kind === "admission" && row2.value.policy)
+          quota = row2.value.policy.quotaBytes;
+    const bytes = Buffer.byteLength(files.encodeBatch(state, [row]).body + files.encodeBatch(state, [row]).trailer);
+    if (files.usage() + bytes > quota || files.freeBytes() < LIMITS.freeSpaceFloorBytes + bytes)
+      throw new ContractError("recording-exhausted");
+    const after = await files.appendRecovery(state, row, assertCurrent, observeWrite);
+    const assert = () => {
+      files.assertWritable();
+      files.assertRecoveryIdle();
+      files.files.assert(path2, after.snapshot, LIMITS.segmentBytes);
+      if (digestHistory(files, path2) !== expected.history?.digest)
+        throw new ContractError("conflict");
+    };
+    assert();
+    const fact = {
+      recoveryId,
+      committedSeq: after.state.committedSeq,
+      epoch: expected.epoch,
+      coordinationDigest: expected.coordinationDigest,
+      historyDigest: expected.history.digest,
+      segmentIdentity: after.state.identity ?? ""
+    };
+    this.committed.set(fact, assert);
+    return fact;
+  }
+}
+
+// src/service/gateway-recovery.ts
+import { opendirSync as opendirSync5 } from "node:fs";
+import { hostname as hostname4 } from "node:os";
+import { join as join10 } from "node:path";
+function required(resources, name) {
+  const file = resources.get(name);
+  if (!file)
+    throw new ContractError("corrupt-selected");
+  return file;
+}
+function names2(store, path2, maximum) {
+  if (!store.files.directory(path2))
+    return [];
+  const stream = opendirSync5(path2), out = [];
+  try {
+    for (let row = stream.readSync();row; row = stream.readSync()) {
+      if (out.length >= maximum || !row.isFile() && !row.isDirectory())
+        throw new ContractError("corrupt-selected");
+      out.push(row.name);
+    }
+  } finally {
+    stream.closeSync();
+  }
+  return out.sort();
+}
+function capture(store) {
+  const out = new Map;
+  const keep = (name) => {
+    const file = store.files.read(store.path(name));
+    if (!file)
+      throw new ContractError("corrupt-selected");
+    out.set(name, file);
+  };
+  for (const name of names2(store, store.directory, 9)) {
+    if ([
+      "gateway.json",
+      "gateway.lock",
+      "input.json",
+      "access-config.json",
+      "access.json"
+    ].includes(name))
+      keep(name);
+    else if (name === "projects" || name === "commands") {
+      for (const child of names2(store, store.path(name), name === "projects" ? 128 : 2048)) {
+        if (name === "projects" ? !/^[a-f0-9]{64}\.json$/.test(child) : !/^[a-f0-9-]{36}(?:\.result)?\.json$/.test(child))
+          throw new ContractError("corrupt-selected");
+        keep(`${name}/${child}`);
+      }
+    } else if (name !== "recovery-v1" || !store.files.directory(store.path(name)))
+      throw new ContractError("corrupt-selected");
+  }
+  for (const name of [
+    "gateway.json",
+    "input.json",
+    "access-config.json",
+    "access.json"
+  ])
+    if (!out.has(name))
+      throw new ContractError("corrupt-selected");
+  for (const [name, file] of out) {
+    if (!name.startsWith("commands/"))
+      continue;
+    if (name.endsWith(".result.json")) {
+      if (!out.has(name.replace(".result.json", ".json")))
+        throw new ContractError("corrupt-selected");
+      decodeProjectEntry(json(file));
+    } else {
+      decodeId(name.slice("commands/".length, -5));
+      const intent = closed(json(file), ["path", "epoch"]);
+      text(intent.path, 4096, true);
+      decodeId(intent.epoch);
+    }
+  }
+  return out;
+}
+function signature(resources) {
+  return hash(encoded([...resources].sort(([a], [b]) => a.localeCompare(b, "en")).map(([name, file]) => [
+    name,
+    file.stamp,
+    ["gateway.json", "access.json", "access-config.json"].includes(name) ? null : file.identity
+  ])));
+}
+function state(store) {
+  const registration2 = store.read();
+  if (!registration2)
+    throw new ContractError("unavailable");
+  const resources = capture(store), lock = resources.get("gateway.lock");
+  if (!lock)
+    throw new ContractError("unavailable");
+  decodeId(closed(json(lock), ["epoch"]).epoch);
+  const input = decodeGatewayInput(json(required(resources, "input.json")));
+  if (input.serverConfig !== store.serverConfig || input.stateHome !== store.stateHome)
+    throw new ContractError("conflict");
+  const projects = store.projects();
+  store.associatedProjects();
+  const incarnation = hash(encoded([lock.identity, lock.stamp]));
+  if (registration2.phase === "stopped" && !registration2.recovery?.receipt.startsWith(`recovery-v1/${incarnation}/`))
+    throw new ContractError("corrupt-selected");
+  const archive = store.path(`recovery-v1/${incarnation}`);
+  const attempts = [];
+  let previousResolver = null;
+  const entries = names2(store, archive, 128);
+  for (let n = 0;n < entries.length; n++) {
+    if (!entries.includes(`${n}.json`))
+      throw new ContractError("corrupt-selected");
+    const file = store.files.read(join10(archive, `${n}.json`), 65536);
+    if (!file)
+      throw new ContractError("corrupt-selected");
+    const row = closed(json(file, 65536), [
+      "schema",
+      "lock",
+      "epoch",
+      "digest",
+      "pid",
+      "host",
+      "legacyHost",
+      "retiredProjects"
+    ]);
+    literal(row.schema, "cadence-workbench-recovery/1");
+    literal(row.lock, lock.bytes.toString("utf8"));
+    literal(row.epoch, registration2.epoch);
+    decodeHash(row.digest);
+    if (!Array.isArray(row.retiredProjects) || row.retiredProjects.length > 128)
+      throw new ContractError("corrupt-selected");
+    for (const entry of row.retiredProjects) {
+      const project = closed(entry, ["id", "stamp"]);
+      decodeHash(project.id);
+      text(project.stamp, 512, true);
+    }
+    if (typeof row.legacyHost !== "boolean")
+      throw new ContractError("corrupt-selected");
+    previousResolver = recoveryOwnerStatus(integer(row.pid, 1, 2147483647), text(row.host, 255, true));
+    attempts.push(file);
+  }
+  if (encoded(store.read()) !== encoded(registration2))
+    throw new ContractError("conflict");
+  for (const [name, file] of resources)
+    store.files.assert(store.path(name), file);
+  const localOwner = recoveryOwnerStatus(registration2.pid, registration2.host ?? hostname4());
+  const inspection = {
+    scope: "workbench",
+    epoch: registration2.epoch,
+    coordinationDigest: hash(encoded([
+      signature(resources),
+      attempts.map((a) => [a.identity, a.stamp])
+    ])),
+    owner: registration2.host ? localOwner : localOwner === "live" ? "live" : "ambiguous",
+    process: { pid: registration2.pid, host: registration2.host ?? null },
+    legacyHost: !registration2.host,
+    previousResolver,
+    projects: projects.length,
+    openings: [...resources.keys()].filter((name) => name.startsWith("commands/") && !name.endsWith(".result.json")).length,
+    resolution: registration2.host ? "local-interactive-only" : "local-host-confirmation-required"
+  };
+  return {
+    registration: registration2,
+    resources,
+    lock,
+    archive,
+    incarnation,
+    attempts,
+    localOwner,
+    inspection
+  };
+}
+function inspectGatewayRecovery(store) {
+  const before = state(store), after = state(store);
+  if (encoded(before.inspection) !== encoded(after.inspection))
+    throw new ContractError("conflict");
+  return before.inspection;
+}
+function resolveGatewayRecovery(store, expected, assertAuthority, legacyHostConfirmed = false) {
+  assertAuthority();
+  const selected2 = state(store);
+  if (encoded(selected2.inspection) !== encoded(expected))
+    throw new ContractError("conflict");
+  const absent2 = () => {
+    assertAuthority();
+    if (expected.legacyHost && !legacyHostConfirmed || recoveryOwnerStatus(selected2.registration.pid, selected2.registration.host ?? hostname4()) !== "absent")
+      throw new ContractError("quarantine");
+  };
+  absent2();
+  if (expected.previousResolver !== null && expected.previousResolver !== "absent")
+    throw new ContractError("quarantine");
+  if (selected2.attempts.length >= 128)
+    throw new ContractError("capacity");
+  const receiptPath = join10(selected2.archive, `${selected2.attempts.length}.json`);
+  const receipt = store.files.create(receiptPath, encoded({
+    schema: "cadence-workbench-recovery/1",
+    lock: selected2.lock.bytes.toString("utf8"),
+    epoch: expected.epoch,
+    digest: expected.coordinationDigest,
+    pid: process.pid,
+    host: hostname4(),
+    legacyHost: expected.legacyHost,
+    retiredProjects: [...selected2.resources].filter(([name]) => name.startsWith("projects/")).map(([name, file]) => ({
+      id: name.slice("projects/".length, -5),
+      stamp: file.stamp
+    }))
+  }), 65536);
+  const assert = () => {
+    absent2();
+    store.associatedProjects();
+    const current = capture(store);
+    if (signature(current) !== signature(selected2.resources))
+      throw new ContractError("conflict");
+    for (const [name, file] of selected2.resources)
+      store.files.assert(store.path(name), file);
+    if (names2(store, selected2.archive, 128).length !== selected2.attempts.length + 1)
+      throw new ContractError("conflict");
+    for (const [n, file] of selected2.attempts.entries())
+      store.files.assert(join10(selected2.archive, `${n}.json`), file, 65536);
+    store.files.assert(receiptPath, receipt, 65536);
+  };
+  assert();
+  const registration2 = store.files.replace(store.path("gateway.json"), required(selected2.resources, "gateway.json"), encoded({
+    ...selected2.registration,
+    phase: "stopped",
+    recovery: {
+      receipt: `recovery-v1/${selected2.incarnation}/${selected2.attempts.length}.json`,
+      sha256: receipt.identity,
+      stamp: receipt.stamp
+    }
+  }));
+  selected2.resources.set("gateway.json", registration2);
+  assert();
+  store.files.remove(store.path("gateway.lock"), selected2.lock);
+  return {
+    status: "resolved",
+    scope: "workbench",
+    epoch: expected.epoch,
+    notice: "operator-acknowledgment-only-project-fences-preserved"
+  };
+}
+
+// src/service/recovery-cli.ts
+var warning = "PID absence is not proof that descendants stopped or credential writes settled. Inspect/stop old processes externally, independently inspect the selected Pi credential store and SDK locks, and inspect retained history/storage. Cadence does not kill, repair, reset, migrate or certify those resources. Unknown historical outcomes remain unknown. A new Start is required.";
+function native() {
+  if (!isatty(0) || !isatty(1) || !process.stdin.isTTY || !process.stdout.isTTY)
+    throw new ContractError("forbidden");
+}
+async function confirm(expected) {
+  native();
+  if (process.stdin.readableLength)
+    throw new ContractError("forbidden");
+  const identity = JSON.stringify(expected);
+  const deadline = performance.now() + LIMITS.grantMs;
+  const prompts = [
+    ...expected.legacyHost ? [
+      [
+        "Legacy registration has no host identity. Independently verify this state originated on THIS host and is not shared/copied from another host. Type local-host",
+        "local-host"
+      ]
+    ] : [],
+    [
+      "Confirm old processes stopped externally; acknowledge escaped-descendant uncertainty. Type processes",
+      "processes"
+    ],
+    [
+      "Confirm independent credential/refresh/writeback inspection; PID absence does not settle auth. Type credentials",
+      "credentials"
+    ],
+    [
+      "Confirm independent storage inspection; preserve damaged bytes and unknown outcomes. Type storage",
+      "storage"
+    ],
+    [
+      `${expected.scope === "global-registry" ? "Release ONLY the global registry lock; all project fences remain." : expected.scope === "workbench" ? "Release ONLY the workbench fence and retire its old project associations; all project fences remain." : "Release ONLY the displayed unchanged service-owned fences."} Type resolve ${expected.epoch}`,
+      `resolve ${expected.epoch}`
+    ]
+  ];
+  await new Promise((resolve5, reject) => {
+    let index = 0, line = "", done = false;
+    const raw = process.stdin.isRaw;
+    const finish = (ok) => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      process.stdin.removeListener("data", input);
+      process.stdin.removeListener("end", fail);
+      process.stdin.removeListener("error", fail);
+      process.stdin.setRawMode(raw);
+      process.stdin.pause();
+      process.stdout.write(`\x1B[?2004l
+`);
+      if (ok)
+        resolve5();
+      else
+        reject(new ContractError("forbidden"));
+    };
+    const fail = () => finish(false);
+    const show = () => process.stdout.write(`${prompts[index]?.[0]}: `);
+    const input = (chunk) => {
+      if (performance.now() >= deadline || chunk.length > 128)
+        return fail();
+      for (let n = 0;n < chunk.length; n++) {
+        const byte = chunk[n];
+        if (byte === 13 || byte === 10) {
+          if (n !== chunk.length - 1 || line !== prompts[index]?.[1])
+            return fail();
+          line = "";
+          process.stdout.write(`
+`);
+          if (++index === prompts.length)
+            return finish(true);
+          show();
+        } else if (byte === 127) {
+          line = line.slice(0, -1);
+        } else if (byte !== undefined && byte >= 32 && byte <= 126 && line.length < 80) {
+          line += String.fromCharCode(byte);
+        } else
+          return fail();
+      }
+    };
+    const timer = setTimeout(fail, LIMITS.grantMs);
+    process.stdin.setRawMode(true);
+    process.stdout.write("\x1B[?2004h");
+    process.stdin.on("data", input).once("end", fail).once("error", fail).resume();
+    show();
+  });
+  return () => {
+    native();
+    if (performance.now() >= deadline || JSON.stringify(expected) !== identity)
+      throw new ContractError("stale");
+  };
+}
+async function localRegistryRecovery(c, operation) {
+  if (operation === "resolve")
+    native();
+  const registryLock = c.registryLockDiagnostic();
+  if (registryLock) {
+    let expected;
+    try {
+      expected = c.inspectRegistryRecovery();
+    } catch {
+      const blocked = {
+        scope: "global-registry",
+        ...registryLock,
+        coordination: "unavailable",
+        resolution: "blocked-preserve-state",
+        notice: "Registry state is incomplete, changed or unsafe. Preserve it; no lock or project resource was released."
+      };
+      if (operation === "inspect")
+        return blocked;
+      process.stdout.write(`${JSON.stringify(blocked)}
+`);
+      throw new ContractError("quarantine");
+    }
+    const view = {
+      ...expected,
+      process: {
+        ...expected.process,
+        host: diagnosticText(expected.process.host, 255)
+      },
+      notice: `Global registry lock blocks every project in this state home. Recovery preserves its original bytes and all project reservations, owner/checkout locks and history. Inspect project fences separately afterward. ${warning}`
+    };
+    if (operation === "inspect")
+      return view;
+    process.stdout.write(`${JSON.stringify(view)}
+`);
+    if (expected.owner !== "absent" || expected.previousResolver !== null && expected.previousResolver !== "absent")
+      throw new ContractError("quarantine");
+    const assertFresh = await confirm(expected);
+    return c.resolveRegistryRecovery(expected, assertFresh);
+  }
+  return;
+}
+async function localRecovery(c, operation) {
+  const registry = await localRegistryRecovery(c, operation);
+  if (registry !== undefined)
+    return registry;
+  const history = new HistoryRecovery(c);
+  const expected = await inspectRecovery(c, history);
+  const registration2 = c.recoverySnapshot().registration;
+  const view = {
+    ...expected,
+    process: {
+      pid: registration2.pid,
+      host: diagnosticText(registration2.host, 255)
+    },
+    notice: warning
+  };
+  if (operation === "inspect")
+    return view;
+  process.stdout.write(`${JSON.stringify(view)}
+`);
+  if (expected.owner !== "absent")
+    throw new ContractError("quarantine");
+  const assertFresh = await confirm(expected);
+  return resolveRecovery(c, {
+    expected,
+    acknowledgeEscapedProcesses: true,
+    processes: "externally-resolved",
+    credentials: "independently-resolved",
+    storage: "independently-resolved",
+    assertLocalAuthority: (choice) => {
+      assertFresh();
+      if (JSON.stringify(choice) !== JSON.stringify(expected))
+        throw new ContractError("stale");
+    }
+  }, history);
+}
+async function localGatewayRecovery(store, operation) {
+  const registry = await localRegistryRecovery(new ServiceCoordination(null, store.stateHome), operation);
+  if (registry !== undefined)
+    return registry;
+  let expected;
+  try {
+    const observed = store.inspect();
+    if (observed.status === "absent" || observed.status === "stopped") {
+      if (operation === "resolve")
+        throw new ContractError("unavailable");
+      return { ...observed, scope: "workbench" };
+    }
+    expected = inspectGatewayRecovery(store);
+  } catch (error) {
+    if (operation === "resolve")
+      throw error;
+    return {
+      status: "unavailable",
+      scope: "workbench",
+      resolution: "blocked-preserve-state",
+      error: error instanceof ContractError ? error.code : "unavailable",
+      notice: "Workbench state is incomplete, changed or unsafe. Preserve it; no resource was released."
+    };
+  }
+  const view = {
+    ...expected,
+    process: {
+      ...expected.process,
+      host: expected.process.host === null ? null : diagnosticText(expected.process.host, 255)
+    },
+    notice: `Recovery releases ONLY the workbench fence and retires its exact old project associations. Project references, reservations, owner/checkout locks, opening receipts and history remain unchanged. Explicit Open must associate a project again; recover affected project owners separately. ${warning}`
+  };
+  if (operation === "inspect")
+    return view;
+  process.stdout.write(`${JSON.stringify(view)}
+`);
+  if (!expected.legacyHost && expected.owner !== "absent" || expected.owner === "live" || expected.previousResolver !== null && expected.previousResolver !== "absent")
+    throw new ContractError("quarantine");
+  const authority = await confirm(expected);
+  return resolveGatewayRecovery(store, expected, authority, expected.legacyHost);
+}
+
+// src/service/runtime.ts
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname9, isAbsolute as isAbsolute6, join as join11, resolve as resolve5 } from "node:path";
+var STARTUP_INPUT_BYTES = 16 * 1024;
+function absolute(value) {
+  const result = text(value, 4096, true);
+  if (!isAbsolute6(result))
+    throw new ContractError("invalid");
+  return result;
+}
+function decodeHostConfig(value) {
+  const o = closed(value, [
+    "schema",
+    "http",
+    "cwd",
+    "agentDir",
+    "tokenSource",
+    "tokenFile"
+  ]);
+  const tokenSource = oneOf(o.tokenSource, [
+    "generated",
+    "environment",
+    "file",
+    "config"
+  ]);
+  const tokenFile = o.tokenFile === null ? null : absolute(o.tokenFile);
+  if ((tokenSource === "file" || tokenSource === "config") !== !!tokenFile)
+    throw new ContractError("invalid");
+  return {
+    schema: literal(o.schema, "cadence-service-host/1"),
+    http: decodeHttpPolicy(o.http),
+    cwd: absolute(o.cwd),
+    agentDir: absolute(o.agentDir),
+    tokenSource,
+    tokenFile
+  };
+}
+function readHostConfig(c) {
+  const owner = c.configuration();
+  if (!owner)
+    return;
+  const snapshot = c.files.read(c.path("host-config.json"));
+  if (!snapshot)
+    throw new ContractError("corrupt-selected");
+  const config = decodeHostConfig(json(snapshot));
+  if (!config.http.port || owner.endpoint !== localOrigin(config.http, config.http.port) || owner.policyIdentity !== hash(encoded(config)))
+    throw new ContractError("conflict");
+  return config;
+}
+function hostEnvironment(ambient) {
+  let route;
+  const facts = networkSnapshot(ambient);
+  try {
+    if (facts.NODE_OPTIONS.present)
+      throw new Error;
+    route = sdkNetworkEnvironment(facts, networkSnapshot(undefined));
+  } catch {
+    throw new ContractError("unsupported-context");
+  }
+  const result = Object.create(null);
+  for (const key of Object.keys(ambient)) {
+    const d = Object.getOwnPropertyDescriptor(ambient, key);
+    if (!d || !("value" in d) || typeof d.value !== "string")
+      throw new ContractError("invalid");
+    if (/^(?:CADENCE_|PI_|ABEL_|TRELLIS_|GIT_)/i.test(key) || networkKeys.some((name) => name === key))
+      continue;
+    result[key] = d.value;
+  }
+  if (route.redactionLiterals.length) {
+    result.HTTP_PROXY = route.env.HTTP_PROXY;
+    result.HTTPS_PROXY = route.env.HTTPS_PROXY;
+    result.NODE_USE_ENV_PROXY = "1";
+  }
+  result.PI_OFFLINE = "1";
+  result.NO_COLOR = "1";
+  if (!sameNetwork(facts, networkSnapshot(ambient)))
+    throw new ContractError("stale");
+  return result;
+}
+function selectStart(options, ambient) {
+  const workspace = resolveWorkspace(options.workspace), c = new ServiceCoordination(workspace.root, options.stateHome);
+  const old = readHostConfig(c);
+  const env = Object.getOwnPropertyDescriptor(ambient, "CADENCE_WEB_TOKEN");
+  if (env && (!("value" in env) || typeof env.value !== "string"))
+    throw new ContractError("invalid");
+  let fromFile;
+  if (options.config) {
+    const path2 = resolve5(options.config), f = new PrivateFiles(dirname9(path2));
+    const bytes = f.read(path2);
+    if (!bytes)
+      throw new ContractError("corrupt-selected");
+    fromFile = decodeHostConfig(json(bytes));
+  }
+  const base = old ?? fromFile ?? decodeHostConfig({
+    schema: "cadence-service-host/1",
+    cwd: workspace.cwd,
+    http: {
+      schema: "cadence-service-http/1",
+      host: options.host ?? "127.0.0.1",
+      port: options.port ?? 17423,
+      proxy: null
+    },
+    agentDir: resolve5(options.agentDir ?? ambient.PI_CODING_AGENT_DIR ?? join11(ambient.HOME ?? ambient.USERPROFILE ?? homedir4(), ".pi", "agent")),
+    tokenSource: options.tokenFile ? "file" : env ? "environment" : "generated",
+    tokenFile: options.tokenFile ? resolve5(options.tokenFile) : null
+  });
+  const server = options.serverConfig !== undefined ? resolve5(options.serverConfig) : old?.tokenSource === "config" ? old.tokenFile : null;
+  let selected2 = base;
+  if (server) {
+    if (options.tokenFile !== undefined)
+      throw new ContractError("conflict");
+    const { port } = readServerConfig(server).config;
+    selected2 = decodeHostConfig({
+      ...base,
+      http: { ...base.http, port },
+      tokenSource: "config",
+      tokenFile: server
+    });
+  }
+  if (fromFile && encoded(fromFile) !== encoded(selected2) || options.port !== undefined && options.port !== selected2.http.port || options.host !== undefined && options.host !== selected2.http.host || options.agentDir !== undefined && resolve5(options.agentDir) !== selected2.agentDir || options.tokenFile !== undefined && resolve5(options.tokenFile) !== selected2.tokenFile || env && selected2.tokenSource !== "environment" || selected2.tokenSource === "environment" && !env || resolveWorkspace(selected2.cwd).root !== workspace.root)
+    throw new ContractError("conflict");
+  return {
+    workspace: workspace.root,
+    stateHome: c.stateHome,
+    config: selected2,
+    environmentToken: env?.value ?? null
+  };
+}
+function decodeHostInput(value) {
+  const o = closed(value, [
+    "workspace",
+    "stateHome",
+    "config",
+    "environmentToken"
+  ]);
+  const config = decodeHostConfig(o.config);
+  const environmentToken = o.environmentToken === null ? null : text(o.environmentToken, 1024, true);
+  if (config.tokenSource === "environment" !== (environmentToken !== null))
+    throw new ContractError("invalid");
+  return {
+    workspace: absolute(o.workspace),
+    stateHome: absolute(o.stateHome),
+    config,
+    environmentToken
+  };
+}
+function portValue(value) {
+  if (!/^(0|[1-9][0-9]{0,4})$/.test(value))
+    throw new ContractError("invalid");
+  return integer(Number(value), 0, 65535);
+}
+var STARTUP_STAGES = [
+  "package",
+  "pi-agent-directory",
+  "pi-auth",
+  "pi-models",
+  "pi-runtime",
+  "service"
+];
+function decodeStartupReport(value) {
+  const o = closed(value, ["status", "error", "stage"]);
+  return {
+    status: oneOf(o.status, ["refused", "quarantined"]),
+    error: oneOf(o.error, ERROR_CODES),
+    stage: oneOf(o.stage, STARTUP_STAGES)
+  };
+}
+
+// src/service/gateway-cli.ts
+async function gatewayMain(argv, hostUrl) {
+  const operation = argv.shift();
+  if (![
+    "start",
+    "status",
+    "diagnose",
+    "stop",
+    "token-link",
+    "token-rotate",
+    "recover"
+  ].includes(operation ?? ""))
+    throw new ContractError("invalid");
+  const recovery = operation === "recover" ? argv.shift() : undefined;
+  if (operation === "recover" && recovery !== "inspect" && recovery !== "resolve")
+    throw new ContractError("invalid");
+  let config = serverConfigPath(homedir5()), stateHome = defaultStateHome(), agentDir, policyFile;
+  let foreground = false, reveal = false;
+  const seen = new Set;
+  while (argv.length) {
+    const key = argv.shift();
+    if (seen.has(key))
+      throw new ContractError("invalid");
+    seen.add(key);
+    if (key === "--foreground" && operation === "start")
+      foreground = true;
+    else if (key === "--reveal" && operation === "token-link")
+      reveal = true;
+    else if (argv[0] && (operation === "recover" ? ["--server-config", "--state-home"] : ["--server-config", "--state-home", "--agent-dir", "--config"]).includes(key)) {
+      const value = resolve6(argv.shift());
+      if (key === "--server-config")
+        config = value;
+      if (key === "--state-home")
+        stateHome = value;
+      if (key === "--agent-dir")
+        agentDir = value;
+      if (key === "--config")
+        policyFile = value;
+    } else
+      throw new ContractError("invalid");
+  }
+  const store = new GatewayStore(config, stateHome);
+  let result;
+  if (operation === "start") {
+    const network = networkSnapshot(process.env), env = hostEnvironment(process.env);
+    if (!seen.has("--server-config"))
+      ensureServerConfig(homedir5());
+    const server = readServerConfig(config).config;
+    const selectedFile = store.files.read(store.path("input.json"));
+    const selected2 = selectedFile ? decodeGatewayInput(json(selectedFile)) : undefined;
+    let policy = selected2?.policy ?? decodeHttpPolicy({
+      schema: "cadence-service-http/1",
+      host: "127.0.0.1",
+      port: server.port,
+      proxy: null
+    });
+    if (policyFile) {
+      const file = new PrivateFiles(dirname10(policyFile)).read(policyFile);
+      if (!file)
+        throw new ContractError("invalid");
+      policy = decodeHttpPolicy(json(file));
+    }
+    const input = decodeGatewayInput({
+      kind: "workbench",
+      serverConfig: config,
+      stateHome: store.stateHome,
+      agentDir: agentDir ?? selected2?.agentDir ?? resolve6(process.env.PI_CODING_AGENT_DIR ?? join12(homedir5(), ".pi", "agent")),
+      policy: { ...policy, port: server.port }
+    });
+    const status = await serviceStatus(store);
+    if (status && typeof status === "object" && "status" in status && status.status === "alive") {
+      if (!selected2 || encoded(selected2) !== encoded(input))
+        throw new ContractError("conflict");
+      result = status;
+    } else
+      result = await launchHost(input, store, foreground, hostUrl, dirname10(dirname10(fileURLToPath(hostUrl))), env, network);
+    if (!foreground && result && typeof result === "object" && "status" in result && result.status === "alive") {
+      const reply = closed(await nativeCall(store, "token-link", true), [
+        "link"
+      ]);
+      process.stderr.write(`Cadence workbench: ${text(reply.link, 4096, true)}
+No project or default workspace was created.
+`);
+    }
+  } else if (operation === "recover" && (recovery === "inspect" || recovery === "resolve"))
+    result = await localGatewayRecovery(store, recovery);
+  else if (operation === "stop")
+    result = await stopService(store);
+  else if (operation === "status" || operation === "diagnose")
+    result = await serviceStatus(store, operation === "diagnose");
+  else {
+    if (operation === "token-link" && !reveal)
+      throw new ContractError("forbidden");
+    result = await nativeCall(store, operation, reveal);
+  }
+  if (result !== null)
+    process.stdout.write(`${JSON.stringify(result)}
+`);
+  if (result && typeof result === "object" && "status" in result && ["unconfirmed", "unavailable", "quarantined", "refused"].includes(String(result.status)))
+    process.exitCode = managementExitCode(result, foreground);
+  if (result && typeof result === "object" && "status" in result && ["unavailable", "quarantined", "refused", "unconfirmed"].includes(String(result.status)))
+    process.stderr.write(`Preserve state; inspect locally: cadence workbench recover inspect --server-config ${JSON.stringify(config)} --state-home ${JSON.stringify(store.stateHome)}. Eligible recovery requires recover resolve in a local terminal; it never starts work.
+`);
+}
+
+// src/service/launchd.ts
+import { rmSync as rmSync2 } from "node:fs";
+import { dirname as dirname11, join as join13 } from "node:path";
+var LABEL = "com.abelxiaoxing.cadence";
+var MARKER2 = `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated by @abelxiaoxing/cadence`;
+function plistPath(s) {
+  return join13(s.home, "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+var xml = (value) => checked(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function buildPlist(u) {
+  const string = (value) => `		<string>${xml(value)}</string>`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    "<!-- Generated by @abelxiaoxing/cadence; `cadence server install` and `restart` rewrite this file. -->",
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    "\t<key>Label</key>",
+    `	<string>${LABEL}</string>`,
+    "\t<key>ProgramArguments</key>",
+    "\t<array>",
+    ...[
+      u.node,
+      u.cli,
+      ...u.workspace === null ? ["workbench", "start", "--foreground"] : ["start", "--foreground", "--workspace", u.workspace],
+      "--server-config",
+      u.serverConfig
+    ].map(string),
+    "\t</array>",
+    ...u.workspace === null ? ["<!-- Cadence workbench gateway; no project workspace -->"] : [],
+    "\t<key>WorkingDirectory</key>",
+    `	<string>${xml(u.workspace ?? dirname11(dirname11(u.cli)))}</string>`,
+    "\t<key>EnvironmentVariables</key>",
+    "\t<dict>",
+    ...u.environment.flatMap(([k, v]) => [
+      `		<key>${xml(k)}</key>`,
+      string(v)
+    ]),
+    "\t</dict>",
+    "\t<key>RunAtLoad</key>",
+    "\t<true/>",
+    "\t<key>ProcessType</key>",
+    "\t<string>Background</string>",
+    "\t<key>StandardOutPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "\t<key>StandardErrorPath</key>",
+    `	<string>${xml(u.log)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join(`
+`);
+}
+function plistWorkspace(text2) {
+  if (text2?.includes("<!-- Cadence workbench gateway; no project workspace -->"))
+    return null;
+  const m = text2?.match(/^\t<key>WorkingDirectory<\/key>\n\t<string>([^<]*)<\/string>$/m);
+  return m?.[1].replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+var domain = (s) => `gui/${s.uid}`;
+var target = (s) => `${domain(s)}/${LABEL}`;
+var loaded = (s) => s.launchctl(["print", target(s)]).status === 0;
+function disabled(s) {
+  return new RegExp(`"${LABEL.replaceAll(".", "\\.")}" => (true|disabled)`).test(s.launchctl(["print-disabled", domain(s)]).stdout);
+}
+async function configureLaunchAgent(s, mode, requested) {
+  if (s.uid === undefined)
+    return { status: "unavailable" };
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  const kept = plistWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, mode === "install" && requested === undefined ? null : kept);
+  if (workspace !== null && !sdk)
+    return { status: "missing-pi-sdk" };
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  if (loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  write(path2, buildPlist({
+    node: s.node,
+    cli: join13(s.root, "src", "service-cli.mjs"),
+    workspace,
+    serverConfig: serverConfigPath(s.home),
+    environment: serviceEnvironment(s),
+    log: join13(s.home, "Library", "Logs", "cadence.log")
+  }));
+  const result = {
+    unit: path2,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
+  };
+  if (mode === "install")
+    s.launchctl(["enable", target(s)]);
+  else if (disabled(s))
+    return { status: "disabled", ...result };
+  if (workspace !== null && !regularFile(join13(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  const started = s.launchctl(["bootstrap", domain(s), path2]).status === 0;
+  return { status: started ? "started" : "failed", ...result };
+}
+async function stopLaunchAgent(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = plistWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
+}
+async function removeLaunchAgent(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, plistWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  if (s.uid !== undefined && loaded(s))
+    s.launchctl(["bootout", target(s)]);
+  rmSync2(path2);
+  return { status: "removed", unit: path2 };
+}
+function launchAgentStatus(s) {
+  const path2 = plistPath(s);
+  const previous = readGenerated(path2, MARKER2);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const printed = s.uid === undefined ? undefined : s.launchctl(["print", target(s)]);
+  return {
+    status: printed?.status !== 0 ? "unloaded" : /^\s*state = running$/m.test(printed.stdout) ? "active" : "inactive",
+    enabled: s.uid !== undefined && disabled(s) ? "disabled" : "enabled",
+    unit: path2,
+    workspace: plistWorkspace(previous)
   };
-  walk(files.directory, 0);
-  files.assertFormat();
-  return digest.digest("hex");
 }
 
-class HistoryRecovery {
-  coordination;
-  committed = new WeakMap;
-  constructor(coordination) {
-    this.coordination = coordination;
-  }
-  files() {
-    const files = HistoryFiles.open(this.coordination);
-    if (!files)
-      throw new ContractError("unavailable");
-    return files;
-  }
-  assertCommitted(fact) {
-    const assert = this.committed.get(fact);
-    if (!assert)
-      throw new ContractError("conflict");
-    assert();
-  }
-  async inspect(epoch) {
-    decodeId(epoch);
-    const files = this.files(), before = digestHistory(files), state = emptyScan();
-    const auth = new Set, processes = new Set, publication = new Set, unfinished = new Set, metadata = new Set, runs = new Map;
-    for (const batch of files.scan(state))
-      for (const row of batch.rows) {
-        const v = row.value;
-        if (v.kind === "recovery") {
-          auth.clear();
-          processes.clear();
-          publication.clear();
-          unfinished.clear();
-          metadata.clear();
-          runs.clear();
-        }
-        if (v.kind === "admission" && v.intent.identity.kind === "action") {
-          if (v.intent.runId) {
-            if (runs.size >= LIMITS.episodes || runs.has(v.intent.runId))
-              throw new ContractError("corrupt-selected");
-            runs.set(v.intent.runId, new RunState(v.intent.runId));
-          } else
-            metadata.add(v.intent.operationId);
-        }
-        for (const [id, state2] of runs) {
-          state2.apply(row, batch.marker.last);
-          if (state2.drained)
-            runs.delete(id);
-        }
-        if (v.kind === "capture" || v.kind === "owner")
-          for (const e of v.events) {
-            if (e.kind === "capture" && e.value.event.kind === "detail-begin" && v.kind === "capture")
-              unfinished.add(`worker/${v.link.childRunId}/${e.value.event.detailId}`);
-            if (e.kind === "owner" && e.value.kind === "content-begin" && v.kind === "owner")
-              unfinished.add(`owner/${v.link.operationId}/${e.value.detailId}`);
-            if (e.kind === "end")
-              unfinished.delete(`${e.detail.origin.kind}/${e.detail.origin.id}/${e.detail.detailId}`);
-          }
-        if (v.kind === "auth-preparation")
-          auth.add(v.intent.operationId);
-        if (v.kind === "auth-settlement")
-          auth.delete(v.result.operationId);
-        if (v.kind === "launch")
-          processes.add(v.link.childRunId);
-        if (v.kind === "settlement" && v.completion.native.closure !== "unconfirmed")
-          processes.delete(v.link.childRunId);
-        if (v.kind === "owner") {
-          for (const e of v.events)
-            if (e.kind === "owner" && e.value.kind === "fact") {
-              const f = e.value.fact;
-              if (f.kind === "check-start")
-                processes.add(f.checkId);
-              if (f.kind === "check-settled" && f.native.closure !== "unconfirmed")
-                processes.delete(f.checkId);
-              if (f.kind === "publication-intent")
-                publication.add(f.publicationId);
-              if (f.kind === "publication-settled") {
-                if (f.status === "published") {
-                  publication.delete(f.publicationId);
-                  metadata.delete(v.link.operationId);
-                } else
-                  publication.add(f.publicationId);
-              }
-            }
-        }
-      }
-    if (before !== digestHistory(files))
-      throw new ContractError("conflict");
-    return {
-      digest: before,
-      processes: processes.size ? "unknown" : "externally-resolved",
-      credentials: auth.size ? "unknown" : "independently-resolved",
-      storage: state.tail || publication.size || unfinished.size || metadata.size || runs.size ? "unknown" : "independently-resolved"
-    };
-  }
-  async append(confirmation, observeWrite) {
-    if (typeof confirmation.assertLocalAuthority !== "function" || confirmation.acknowledgeEscapedProcesses !== true || confirmation.processes !== "externally-resolved" || confirmation.credentials !== "independently-resolved" || confirmation.storage !== "independently-resolved")
-      throw new ContractError("forbidden");
-    const expected = structuredClone(confirmation.expected), files = this.files();
-    files.assertWritable();
-    if (!expected.history || expected.owner !== "absent")
-      throw new ContractError("quarantine");
-    const current = await inspectRecovery(this.coordination, this);
-    if (JSON.stringify(current) !== JSON.stringify(expected))
-      throw new ContractError("conflict");
-    const state = files.inspect(), recoveryId = randomUUID7();
-    const bridge = {
-      kind: "recovery",
-      recoveryId,
-      epoch: expected.epoch,
-      coordinationDigest: expected.coordinationDigest,
-      historyDigest: expected.history.digest,
-      previous: {
-        segment: state.segment,
-        bytes: state.bytes,
-        sha256: state.identity ?? hash(""),
-        committedBytes: state.committedBytes ?? state.bytes,
-        committedSeq: state.committedSeq,
-        highSeq: state.highSeq ?? state.committedSeq
-      },
-      acknowledgments: { processes: true, credentials: true, storage: true }
-    };
-    const path2 = files.segmentPath(state.segment + 1);
-    const assertCurrent = async () => {
-      await confirmation.assertLocalAuthority(structuredClone(expected));
-      const selected2 = await inspectRecovery(this.coordination);
-      if (selected2.owner !== "absent")
-        throw new ContractError("quarantine");
-      if (selected2.epoch !== expected.epoch || selected2.coordinationDigest !== expected.coordinationDigest || digestHistory(files, path2) !== expected.history?.digest || this.coordination.recoverySnapshot().digest !== expected.coordinationDigest)
-        throw new ContractError("conflict");
-    };
-    await confirmation.assertLocalAuthority(structuredClone(expected));
-    if (digestHistory(files) !== expected.history.digest)
-      throw new ContractError("conflict");
-    const row = {
-      kind: "record",
-      id: randomUUID7(),
-      seq: String(BigInt(bridge.previous.highSeq) + 1n),
-      value: bridge
-    };
-    let quota = LIMITS.checkoutQuotaBytes;
-    for (const batch of files.scan())
-      for (const row2 of batch.rows)
-        if (row2.value.kind === "admission" && row2.value.policy)
-          quota = row2.value.policy.quotaBytes;
-    const bytes = Buffer.byteLength(files.encodeBatch(state, [row]).body + files.encodeBatch(state, [row]).trailer);
-    if (files.usage() + bytes > quota || files.freeBytes() < LIMITS.freeSpaceFloorBytes + bytes)
-      throw new ContractError("recording-exhausted");
-    const after = await files.appendRecovery(state, row, assertCurrent, observeWrite);
-    const assert = () => {
-      files.assertWritable();
-      files.assertRecoveryIdle();
-      files.files.assert(path2, after.snapshot, LIMITS.segmentBytes);
-      if (digestHistory(files, path2) !== expected.history?.digest)
-        throw new ContractError("conflict");
-    };
-    assert();
-    const fact = {
-      recoveryId,
-      committedSeq: after.state.committedSeq,
-      epoch: expected.epoch,
-      coordinationDigest: expected.coordinationDigest,
-      historyDigest: expected.history.digest,
-      segmentIdentity: after.state.identity ?? ""
-    };
-    this.committed.set(fact, assert);
-    return fact;
-  }
+// src/service/login-run.ts
+import { rmSync as rmSync3 } from "node:fs";
+import { dirname as dirname12, isAbsolute as isAbsolute7, join as join14 } from "node:path";
+var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+var APPROVED_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run";
+var RUN_VALUE = "Cadence";
+var MARKER3 = "' Generated by @abelxiaoxing/cadence";
+function launcherPath(s) {
+  const local = s.env.LOCALAPPDATA;
+  return join14(local && isAbsolute7(local) ? local : join14(s.home, "AppData", "Local"), "cadence-server", "cadence.vbs");
 }
-
-// src/service/recovery-cli.ts
-var warning = "PID absence is not proof that descendants stopped or credential writes settled. Inspect/stop old processes externally, independently inspect the selected Pi credential store and SDK locks, and inspect retained history/storage. Cadence does not kill, repair, reset, migrate or certify those resources. Unknown historical outcomes remain unknown. A new Start is required.";
-function native() {
-  if (!isatty(0) || !isatty(1) || !process.stdin.isTTY || !process.stdout.isTTY)
-    throw new ContractError("forbidden");
+var literal2 = (value) => `"${checked(value).replaceAll('"', '""')}"`;
+function argument2(value) {
+  if (checked(value).includes('"'))
+    throw new ContractError("invalid");
+  return `"${value}"`;
 }
-async function confirm(expected) {
-  native();
-  if (process.stdin.readableLength)
-    throw new ContractError("forbidden");
-  const identity = JSON.stringify(expected);
-  const deadline = performance.now() + LIMITS.grantMs;
-  const prompts = [
-    [
-      "Confirm old processes stopped externally; acknowledge escaped-descendant uncertainty. Type processes",
-      "processes"
-    ],
-    [
-      "Confirm independent credential/refresh/writeback inspection; PID absence does not settle auth. Type credentials",
-      "credentials"
-    ],
-    [
-      "Confirm independent storage inspection; preserve damaged bytes and unknown outcomes. Type storage",
-      "storage"
-    ],
-    [
-      `Release ONLY the displayed unchanged service-owned fences. Type resolve ${expected.epoch}`,
-      `resolve ${expected.epoch}`
-    ]
-  ];
-  await new Promise((resolve7, reject) => {
-    let index = 0, line = "", done = false;
-    const raw = process.stdin.isRaw;
-    const finish = (ok) => {
-      if (done)
-        return;
-      done = true;
-      clearTimeout(timer);
-      process.stdin.removeListener("data", input);
-      process.stdin.removeListener("end", fail);
-      process.stdin.removeListener("error", fail);
-      process.stdin.setRawMode(raw);
-      process.stdin.pause();
-      process.stdout.write(`\x1B[?2004l
-`);
-      if (ok)
-        resolve7();
-      else
-        reject(new ContractError("forbidden"));
-    };
-    const fail = () => finish(false);
-    const show = () => process.stdout.write(`${prompts[index]?.[0]}: `);
-    const input = (chunk) => {
-      if (performance.now() >= deadline || chunk.length > 128)
-        return fail();
-      for (let n = 0;n < chunk.length; n++) {
-        const byte = chunk[n];
-        if (byte === 13 || byte === 10) {
-          if (n !== chunk.length - 1 || line !== prompts[index]?.[1])
-            return fail();
-          line = "";
-          process.stdout.write(`
+function buildLauncher(u) {
+  const command = `${argument2(u.node)} ${argument2(u.cli)} ${u.workspace === null ? "workbench start" : `start --workspace ${argument2(u.workspace)}`} --server-config ${argument2(u.serverConfig)}`;
+  return [
+    `${MARKER3}; \`cadence server install\` and \`restart\` rewrite this file.`,
+    `' Started at login by ${RUN_KEY}\\${RUN_VALUE}; window style 0 hides the console.`,
+    'Set shell = CreateObject("WScript.Shell")',
+    ...u.environment.length ? ['Set env = shell.Environment("Process")'] : [],
+    ...u.environment.map(([k, v]) => `env(${literal2(k)}) = ${literal2(v)}`),
+    ...u.workspace === null ? ["' Cadence workbench gateway; no project workspace"] : [],
+    `shell.CurrentDirectory = ${literal2(u.workspace ?? dirname12(dirname12(u.cli)))}`,
+    `shell.Run ${literal2(command)}, 0, False`,
+    ""
+  ].join(`\r
 `);
-          if (++index === prompts.length)
-            return finish(true);
-          show();
-        } else if (byte === 127) {
-          line = line.slice(0, -1);
-        } else if (byte !== undefined && byte >= 32 && byte <= 126 && line.length < 80) {
-          line += String.fromCharCode(byte);
-        } else
-          return fail();
-      }
-    };
-    const timer = setTimeout(fail, LIMITS.grantMs);
-    process.stdin.setRawMode(true);
-    process.stdout.write("\x1B[?2004h");
-    process.stdin.on("data", input).once("end", fail).once("error", fail).resume();
-    show();
-  });
-  return () => {
-    native();
-    if (performance.now() >= deadline || JSON.stringify(expected) !== identity)
-      throw new ContractError("stale");
+}
+var utf16 = (text2) => Buffer.concat([Buffer.from([255, 254]), Buffer.from(text2, "utf16le")]);
+function launcherWorkspace(text2) {
+  if (text2?.includes("' Cadence workbench gateway; no project workspace"))
+    return null;
+  return text2?.match(/^shell\.CurrentDirectory = "((?:[^"]|"")*)"\r?$/m)?.[1].replaceAll('""', '"');
+}
+var runEntry = (path2, s) => `"${wscript(s.env)}" "${path2}"`;
+var present = (s, key) => s.reg(["query", key, "/v", RUN_VALUE]).status === 0;
+function approvedOff(s) {
+  const r = s.reg(["query", APPROVED_KEY, "/v", RUN_VALUE]);
+  const first = r.status === 0 && /REG_BINARY\s+([0-9A-F]{2})/i.exec(r.stdout);
+  return !!first && (Number.parseInt(first[1], 16) & 1) === 1;
+}
+async function configureLoginRun(s, mode, requested) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined && present(s, RUN_KEY))
+    return { status: "foreign", unit: `${RUN_KEY}\\${RUN_VALUE}` };
+  if (mode === "restart" && previous === undefined)
+    return { status: "absent" };
+  const sdk = sdkPackages(s.root);
+  const kept = launcherWorkspace(previous);
+  const { workspace, redirectedFrom } = selectWorkspace(s, requested, mode === "install" && requested === undefined ? null : kept);
+  if (workspace !== null && !sdk)
+    return { status: "missing-pi-sdk" };
+  const refused2 = await settle(s, kept);
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  const environment = s.env.PI_CODING_AGENT_DIR ? [["PI_CODING_AGENT_DIR", agentDirectory(s)]] : [];
+  write(path2, utf16(buildLauncher({
+    node: s.node,
+    cli: join14(s.root, "src", "service-cli.mjs"),
+    workspace,
+    serverConfig: serverConfigPath(s.home),
+    environment
+  })));
+  const result = {
+    unit: path2,
+    workspace,
+    ...redirectedFrom ? { redirectedFrom } : {}
   };
+  if (mode === "install") {
+    const entry = ["/v", RUN_VALUE, "/t", "REG_SZ", "/d", runEntry(path2, s)];
+    if (s.reg(["add", RUN_KEY, ...entry, "/f"]).status !== 0)
+      return { status: "failed", ...result };
+    s.reg(["delete", APPROVED_KEY, "/v", RUN_VALUE, "/f"]);
+  }
+  if (workspace !== null && !regularFile(join14(agentDirectory(s), "auth.json")))
+    return { status: "waiting-for-pi-login", ...result };
+  return { status: s.launch(path2) ? "started" : "failed", ...result };
 }
-async function localRecovery(c, operation) {
-  if (operation === "resolve")
-    native();
-  const history = new HistoryRecovery(c);
-  const expected = await inspectRecovery(c, history);
-  const registration2 = c.recoverySnapshot().registration;
-  const view = {
-    ...expected,
-    process: {
-      pid: registration2.pid,
-      host: diagnosticText(registration2.host, 255)
-    },
-    notice: warning
+async function stopLoginRun(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const refused2 = await settle(s, workspace);
+  return { ...refused2 ?? { status: "stopped", workspace }, unit: path2 };
+}
+async function removeLoginRun(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const refused2 = await settle(s, launcherWorkspace(previous));
+  if (refused2)
+    return { ...refused2, unit: path2 };
+  for (const key of [RUN_KEY, APPROVED_KEY])
+    if (present(s, key))
+      s.reg(["delete", key, "/v", RUN_VALUE, "/f"]);
+  rmSync3(path2);
+  return { status: "removed", unit: path2 };
+}
+async function loginRunStatus(s) {
+  const path2 = launcherPath(s);
+  const previous = readGenerated(path2, MARKER3);
+  if (previous === null)
+    return { status: "foreign", unit: path2 };
+  if (previous === undefined)
+    return { status: "absent" };
+  const workspace = launcherWorkspace(previous);
+  const owner = workspace !== undefined ? await s.ownerStatus(workspace, serverConfigPath(s.home)) : "unavailable";
+  return {
+    status: owner === "alive" ? "active" : "inactive",
+    enabled: present(s, RUN_KEY) && !approvedOff(s) ? "enabled" : "disabled",
+    unit: path2,
+    workspace
   };
-  if (operation === "inspect")
-    return view;
-  process.stdout.write(`${JSON.stringify(view)}
-`);
-  if (expected.owner !== "absent")
-    throw new ContractError("quarantine");
-  const assertFresh = await confirm(expected);
-  return resolveRecovery(c, {
-    expected,
-    acknowledgeEscapedProcesses: true,
-    processes: "externally-resolved",
-    credentials: "independently-resolved",
-    storage: "independently-resolved",
-    assertLocalAuthority: (choice) => {
-      assertFresh();
-      if (JSON.stringify(choice) !== JSON.stringify(expected))
-        throw new ContractError("stale");
-    }
-  }, history);
 }
 
 // src/service/system-service.ts
-import { existsSync as existsSync2, realpathSync as realpathSync5, rmSync as rmSync4 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join14 } from "node:path";
+import { existsSync as existsSync2, realpathSync as realpathSync4, rmSync as rmSync4 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join15 } from "node:path";
 var MARKER4 = "# Generated by @abelxiaoxing/cadence";
 function boundary(s) {
   if (s.platform !== "linux" || s.scope !== "system")
@@ -7130,8 +7671,8 @@ function sameStateEnvironment(s, previous) {
         return false;
       values.set(key, value.slice(at + 1).replaceAll("%%", "%"));
     }
-    const state = s.env.XDG_STATE_HOME;
-    return values.get("HOME") === s.home && values.get("XDG_STATE_HOME") === (state && isAbsolute8(state) ? state : undefined);
+    const state2 = s.env.XDG_STATE_HOME;
+    return values.get("HOME") === s.home && values.get("XDG_STATE_HOME") === (state2 && isAbsolute8(state2) ? state2 : undefined);
   } catch {
     return false;
   }
@@ -7169,12 +7710,12 @@ async function configureSystemService(s, mode, requested) {
   const selected2 = selectWorkspace(s, requested, mode === "install" && requested === undefined ? null : unitWorkspace(previous), false);
   if (selected2.workspace !== null && !sdk)
     return { status: "missing-pi-sdk", scope: "system" };
-  const selectedReal = selected2.workspace && existsSync2(selected2.workspace) ? realpathSync5(selected2.workspace) : undefined;
+  const selectedReal = selected2.workspace && existsSync2(selected2.workspace) ? realpathSync4(selected2.workspace) : undefined;
   const agentDir = agentDirectory(s);
   const content = buildUnit({
     system: true,
     node: s.node,
-    cli: join14(s.root, "src", "service-cli.mjs"),
+    cli: join15(s.root, "src", "service-cli.mjs"),
     workspace: selected2.workspace,
     serverConfig: serviceConfigPath(s),
     agentDir,
@@ -7206,7 +7747,7 @@ async function configureSystemService(s, mode, requested) {
     return { status: "foreign", ...result };
   if (selectedReal && selected2.workspace) {
     try {
-      if (realpathSync5(selected2.workspace) !== selectedReal)
+      if (realpathSync4(selected2.workspace) !== selectedReal)
         return { status: "workspace-changed", ...result };
     } catch {
       return { status: "workspace-changed", ...result };
@@ -7223,7 +7764,7 @@ async function configureSystemService(s, mode, requested) {
     return { status: "failed", ...result, ...selected2 };
   if (mode === "install" && s.systemctl(["enable", s.unit]).status !== 0)
     return { status: "failed", ...result, ...selected2 };
-  if (selected2.workspace !== null && !regularFile(join14(agentDir, "auth.json")))
+  if (selected2.workspace !== null && !regularFile(join15(agentDir, "auth.json")))
     return { status: "waiting-for-pi-login", ...result, ...selected2 };
   s.systemctl(["reset-failed", s.unit]);
   return {
@@ -7355,6 +7896,13 @@ function nativeCall(c, operation, reveal = false, controlBody) {
 }
 var pause = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 async function serviceStatus(c, diagnose = false) {
+  const registryLock = c.registryLockDiagnostic?.();
+  if (registryLock)
+    return {
+      status: "unavailable",
+      ...registryLock,
+      recovery: "cadence recover inspect --workspace <project> [--state-home <state-home>]"
+    };
   const observed2 = c.inspect();
   if (observed2.status === "absent" || observed2.status === "stopped")
     return observed2;
@@ -7378,7 +7926,12 @@ async function stopService(c) {
   }
   const deadline = performance.now() + LIMITS.stopWaitMs;
   while (performance.now() < deadline) {
-    const observed2 = c.inspect();
+    let observed2;
+    try {
+      observed2 = c.inspect();
+    } catch {
+      observed2 = { status: "unavailable" };
+    }
     if ("epoch" in observed2 && observed2.epoch === epoch && observed2.status === "stopped")
       return { status: "stopped", epoch };
     if (observed2.status === "quarantined")
@@ -7392,11 +7945,34 @@ async function stopService(c) {
 function failedStatus(result) {
   return !!(result && typeof result === "object" && ("status" in result) && ["unconfirmed", "unavailable", "quarantined", "refused"].includes(String(result.status)));
 }
+function managementExitCode(result, foreground = false) {
+  if (foreground) {
+    try {
+      decodeStartupReport(result);
+      return 78;
+    } catch {}
+  }
+  return 1;
+}
+function observedServerResult(result, service) {
+  return {
+    ...result,
+    service,
+    ...result.status === "started" && service !== "alive" ? {
+      managerStatus: result.status,
+      status: service === "quarantined" ? "quarantined" : "unconfirmed"
+    } : {}
+  };
+}
 function serverConfigHint(error) {
   return `Cadence changed nothing: ${error.path} ${error.reason}.
 Fix it and run the command again; the file holds the WebUI port and token as ${PORT_KEY}=<1-65535> and ${TOKEN_KEY}=<at least 32 characters>, one line each.
 `;
 }
+function registryGuidance(workspace, stateHome) {
+  return `The shared registry lock blocks project access in this state home. No automatic lock deletion. Inspect locally: cadence recover inspect --workspace ${JSON.stringify(workspace)} --state-home ${JSON.stringify(stateHome)}; eligible dead locks require cadence recover resolve in a local terminal.
+`;
+}
 function startupGuidance(result, input) {
   let report;
   try {
@@ -7404,6 +7980,8 @@ function startupGuidance(result, input) {
   } catch {
     return "";
   }
+  if (report.error === "registry-locked")
+    return registryGuidance(input.workspace, input.stateHome);
   const agent = input.config.agentDir;
   const inspect = `Inspect: cadence-service diagnose|recover inspect --workspace ${JSON.stringify(input.workspace)}
 `;
@@ -7415,10 +7993,10 @@ function startupGuidance(result, input) {
       return `Pi's agent directory ${agent} must be an existing real directory (not a symlink) owned by you.
 `;
     case "pi-auth":
-      return `${join15(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
+      return `${join16(agent, "auth.json")} must be your own single-link regular file holding valid Pi credentials; log in to Pi first.
 `;
     case "pi-models":
-      return `${join15(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
+      return `${join16(agent, "models.json")} must be your own single-link regular file using only fields Cadence's pinned Pi SDK supports; a field only newer Pi understands is refused.
 `;
     case "pi-runtime":
       return `Loading Pi's SDK model runtime failed after the owner registered (optional SDK packages missing, or sources the SDK refuses); it stays quarantined.
@@ -7431,6 +8009,15 @@ ${inspect}` : "";
 async function startService(options, foreground, hostUrl) {
   const network = networkSnapshot(process.env);
   const env = hostEnvironment(process.env);
+  const c = new ServiceCoordination(options.workspace, options.stateHome);
+  if (c.registryLockDiagnostic()) {
+    process.stderr.write(registryGuidance(c.store.root, c.stateHome));
+    return {
+      status: "refused",
+      error: "registry-locked",
+      stage: "service"
+    };
+  }
   let input;
   try {
     input = decodeHostInput(selectStart(options, process.env));
@@ -7443,7 +8030,6 @@ async function startService(options, foreground, hostUrl) {
 `;
   if (Buffer.byteLength(serialized) > STARTUP_INPUT_BYTES)
     throw new ContractError("oversize");
-  const c = new ServiceCoordination(input.workspace, input.stateHome);
   const existing = await serviceStatus(c);
   if (existing && typeof existing === "object" && "status" in existing && existing.status === "alive") {
     const running = readHostConfig(c);
@@ -7540,6 +8126,8 @@ async function launchHost(input, c, foreground, hostUrl, cwd, env, network) {
     process.stdout.write(`${JSON.stringify(result)}
 `);
     await closure;
+    if (failedStatus(result))
+      process.exitCode = managementExitCode(result, true);
     return null;
   }
   return result;
@@ -7626,7 +8214,7 @@ async function serverAction(s, action, requested, linger) {
   }
 }
 function serverGuidance(s, action, result, link) {
-  const cli = piUserInstall(s) ? `node ${JSON.stringify(join15(s.root, "src", "service-cli.mjs"))}` : "cadence";
+  const cli = piUserInstall(s) ? `node ${JSON.stringify(join16(s.root, "src", "service-cli.mjs"))}` : "cadence";
   const note = result.redirectedFrom ? `Cadence workspace: ${result.workspace} (${result.redirectedFrom} contains Cadence's private state)
 ` : "";
   return note + serverStatusGuidance(s, action, result, cli, link);
@@ -7658,6 +8246,11 @@ function managerDetail(s) {
 }
 function serverStatusGuidance(s, action, result, cli, link) {
   const workspace = JSON.stringify(result.workspace ?? "");
+  if (result.workspace === null && ["quarantined", "unconfirmed", "unavailable"].includes(result.status))
+    return `Cadence workbench is not ready (${result.status}); no successful startup or Stop is inferred.
+Inspect locally: ${cli} workbench recover inspect --server-config ${JSON.stringify(serviceConfigPath(s))}
+Use the definition's same account and state home; eligible recovery requires recover resolve in a local terminal. Preserve locks and history.
+`;
   if (result.workspace === null && result.status === "started")
     return `Cadence unified workbench: ${link ?? result.endpoint ?? result.service ?? "unconfirmed"}
 No default workspace was created. Projects are opened explicitly.
@@ -7688,7 +8281,7 @@ ${manage}
 ${linger}`;
     }
     case "waiting-for-pi-login":
-      return `Cadence is registered for ${result.workspace}; it starts once Pi has ${join15(agentDirectory(s), "auth.json")}.
+      return `Cadence is registered for ${result.workspace}; it starts once Pi has ${join16(agentDirectory(s), "auth.json")}.
 Log in to Pi, then: ${cli} server restart${flags}
 ${config}
 ${lingerGuidance(result.linger)}`;
@@ -7734,7 +8327,10 @@ ${lingerGuidance(result.linger)}`;
 `;
     case "unconfirmed":
     case "quarantined":
-      return `Cadence changed nothing: its owner's orderly Stop was not confirmed (${result.status}). Inspect: ${cli} diagnose --workspace ${workspace}
+      return `Cadence owner reports ${result.status}; successful startup or orderly Stop is not confirmed.
+Inspect: ${cli} diagnose --workspace ${workspace}
+Local recovery: ${cli} recover inspect --workspace ${workspace}
+Preserve uncertain state; recovery requires separate fresh terminal confirmation.
 `;
     case "failed":
       return `Could not register or start Cadence's service; ${managerDetail(s)}.
@@ -7838,9 +8434,26 @@ async function serverMain(argv, hostUrl) {
   }
   let link;
   if (result.status === "started" && result.workspace !== undefined) {
-    Object.assign(result, await observeStarted(result.workspace, serviceConfigPath(s)));
+    const workspace = result.workspace;
+    const observation = await observeStarted(workspace, serviceConfigPath(s));
+    result = {
+      ...observedServerResult(result, observation.service),
+      ...observation
+    };
     if (result.service === "alive")
-      link = await privateLink(result.workspace, undefined, serviceConfigPath(s));
+      link = await privateLink(workspace, undefined, serviceConfigPath(s));
+  }
+  if (action === "status" && result.workspace !== undefined && ["active", "activating", "failed"].includes(result.status)) {
+    const target2 = result.workspace === null ? new GatewayStore(serviceConfigPath(s)) : new ServiceCoordination(result.workspace);
+    const observed2 = await serviceStatus(target2);
+    if (observed2 && typeof observed2 === "object" && "status" in observed2) {
+      const service = String(observed2.status);
+      result = {
+        ...result,
+        service,
+        ...service === "quarantined" ? { managerStatus: result.status, status: service } : {}
+      };
+    }
   }
   process.stderr.write(serverGuidance(s, action, result, link));
   process.stdout.write(`${JSON.stringify(result)}
@@ -7891,7 +8504,7 @@ async function projectMain(argv, hostUrl) {
     mkdirSync6(options.workspace, { recursive: true });
   effectiveWorkspace(options.workspace, options.stateHome);
   const c = new ServiceCoordination(options.workspace, options.stateHome);
-  const kept = readHostConfig(c);
+  const kept = c.registryLockDiagnostic() ? undefined : readHostConfig(c);
   if (!kept)
     options.port = 0;
   const result = await startService(options, false, hostUrl);
@@ -7913,6 +8526,8 @@ async function projectMain(argv, hostUrl) {
     process.exitCode = 1;
 }
 async function managementMain(argv, hostUrl) {
+  const foregroundStart = argv.includes("--foreground") && (argv[0] === "start" || argv[0] === "workbench" && argv[1] === "start");
+  const recoveryCommand = argv[0] === "recover" || argv[0] === "workbench" && argv[1] === "recover";
   try {
     if (!process.versions.node || process.versions.bun)
       throw new ContractError("unsupported-context");
@@ -7927,15 +8542,16 @@ async function managementMain(argv, hostUrl) {
       "diagnose",
       "stop",
       "token-link",
-      "token-rotate"
+      "token-rotate",
+      "recover"
     ].includes(command ?? "") && !argv.includes("--workspace")) {
       await gatewayMain([command, ...argv], hostUrl);
       return;
     }
     if (command === "--help" && !argv.length) {
       process.stdout.write(`cadence start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--workspace PATH] [--state-home PATH]
-Without --workspace these commands address the unified workbench (except project recovery); no default project directory is created.
-cadence workbench start|status|diagnose|stop|token-link --reveal|token-rotate [--server-config PATH] [--state-home PATH]
+Without --workspace these commands (including recover) address the unified workbench, never cwd; no default project directory is created. Project recovery requires explicit --workspace PATH. Recovery checks the account-wide registry lock first.
+cadence workbench start|status|diagnose|stop|token-link --reveal|token-rotate|recover inspect|recover resolve [--server-config PATH] [--state-home PATH]
 cadence server install [--workspace PATH] [--no-linger]|status|restart|stop|uninstall
 Linux server options: --system (root, no linger) or --user; --name NAME selects an independent service; install also accepts --port PORT (required for a new named service). Root defaults to --system. No automatic sudo or profile migration.
 cadence project open [PATH] [--create] [--agent-dir PATH] [--state-home PATH]
@@ -8039,11 +8655,18 @@ Recovery resolve requires this local native terminal, exact unchanged dead-owner
       process.stdout.write(`${JSON.stringify(result)}
 `);
     if (failedStatus(result))
-      process.exitCode = 1;
-  } catch {
-    process.stderr.write(`{"error":"service-refused"}
+      process.exitCode = managementExitCode(result, foreground);
+  } catch (error) {
+    process.stderr.write(`${JSON.stringify({
+      error: "service-refused",
+      ...recoveryCommand ? {
+        code: error instanceof ContractError ? error.code : "unavailable",
+        stage: "recovery",
+        notice: "Use workbench recover for account/workbench state or explicit --workspace for an existing project; preserve state on refusal."
+      } : {}
+    })}
 `);
-    process.exitCode = 1;
+    process.exitCode = foregroundStart && (error instanceof ContractError || error instanceof ServerConfigRefusal) ? 78 : 1;
   }
 }