@ametyst/cli 0.3.0 → 0.3.5

package/dist/index.js

@@ -112016,12 +112016,17 @@ var init_core = __esm({
 // src/commands/init-claim.ts
 var init_claim_exports = {};
 __export(init_claim_exports, {
+  CLAIM_HOT_RELOAD_NOTICE: () => CLAIM_HOT_RELOAD_NOTICE,
   WRAP_KEY_BYTES: () => WRAP_KEY_BYTES,
+  backupVaultFile: () => backupVaultFile,
   claimErrorMessage: () => claimErrorMessage,
   decryptBootstrapBlob: () => decryptBootstrapBlob,
   exchangeClaimToken: () => exchangeClaimToken,
-  parseClaimArgument: () => parseClaimArgument
+  parseClaimArgument: () => parseClaimArgument,
+  vaultBackupPath: () => vaultBackupPath,
+  vaultBackupSuffix: () => vaultBackupSuffix
 });
+import { chmodSync as chmodSync3, constants as fsConstants, copyFileSync as copyFileSync3, existsSync as existsSync7 } from "fs";
 import { createDecipheriv as createDecipheriv2 } from "crypto";
 function claimErrorMessage(failure) {
   switch (failure.kind) {
@@ -112157,13 +112162,32 @@ function decryptBootstrapBlob(wrapKey, blob) {
     return null;
   }
 }
-var WRAP_KEY_BYTES, BASE64URL;
+function vaultBackupSuffix(at) {
+  return `${at.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z")}`;
+}
+function vaultBackupPath(vaultPath, at) {
+  return `${vaultPath}.bak-${vaultBackupSuffix(at)}`;
+}
+function backupVaultFile(vaultPath, at = /* @__PURE__ */ new Date()) {
+  if (!existsSync7(vaultPath)) return null;
+  const target = vaultBackupPath(vaultPath, at);
+  try {
+    copyFileSync3(vaultPath, target, fsConstants.COPYFILE_EXCL);
+  } catch (e) {
+    if (e?.code === "EEXIST") return target;
+    throw e;
+  }
+  chmodSync3(target, 384);
+  return target;
+}
+var WRAP_KEY_BYTES, BASE64URL, CLAIM_HOT_RELOAD_NOTICE;
 var init_init_claim = __esm({
   "src/commands/init-claim.ts"() {
     "use strict";
     init_esm_shims();
     WRAP_KEY_BYTES = 32;
     BASE64URL = /^[A-Za-z0-9_-]+$/;
+    CLAIM_HOT_RELOAD_NOTICE = "Running MCP servers pick up the new identity on their next call. If an agent host still shows the old workspace, restart it fully (Claude desktop: Cmd+Q).";
   }
 });
 
@@ -112173,12 +112197,12 @@ var init_version5 = __esm({
   "src/version.ts"() {
     "use strict";
     init_esm_shims();
-    CLI_VERSION = true ? "0.3.0" : "0.0.0-dev";
+    CLI_VERSION = true ? "0.3.5" : "0.0.0-dev";
   }
 });
 
 // src/connections/catalog.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
 import { join as join6 } from "path";
 function declaredVerbsHeader() {
   return SUPPORTED_HTTP_METHODS.join(",");
@@ -112435,7 +112459,7 @@ function parseConnectorsResponseDetailed(body, onWarn = warnToStderr) {
 function readCachedCatalogStatus() {
   let raw;
   try {
-    if (!existsSync7(CONNECTOR_CACHE_PATH)) return { state: "absent" };
+    if (!existsSync8(CONNECTOR_CACHE_PATH)) return { state: "absent" };
     raw = JSON.parse(readFileSync7(CONNECTOR_CACHE_PATH, "utf-8"));
   } catch (e) {
     return { state: "unreadable", reason: e instanceof Error ? e.message : String(e) };
@@ -112472,7 +112496,7 @@ function readMirrorRowsFromDisk() {
 }
 function readMirrorContainer() {
   try {
-    if (!existsSync7(CONNECTOR_CACHE_PATH)) return { state: "absent" };
+    if (!existsSync8(CONNECTOR_CACHE_PATH)) return { state: "absent" };
     const raw = JSON.parse(readFileSync7(CONNECTOR_CACHE_PATH, "utf-8"));
     if (!isRecord(raw)) {
       return { state: "unreadable", reason: "the mirror's top level is not an object" };
@@ -112487,7 +112511,7 @@ function readMirrorContainer() {
 }
 function readMirrorFetchedAt() {
   try {
-    if (!existsSync7(CONNECTOR_CACHE_PATH)) return "";
+    if (!existsSync8(CONNECTOR_CACHE_PATH)) return "";
     const raw = JSON.parse(readFileSync7(CONNECTOR_CACHE_PATH, "utf-8"));
     if (!isRecord(raw)) return "";
     return typeof raw.fetchedAt === "string" ? raw.fetchedAt : "";
@@ -113477,7 +113501,7 @@ var init_call2 = __esm({
 });
 
 // src/connections/engine-store.ts
-import { chmodSync as chmodSync3, closeSync as closeSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, openSync as openSync2 } from "fs";
+import { chmodSync as chmodSync4, closeSync as closeSync2, existsSync as existsSync11, mkdirSync as mkdirSync7, openSync as openSync2 } from "fs";
 import { dirname as dirname7, join as join16 } from "path";
 function connectionsDbPath() {
   return join16(AMETYST_DIR, CONNECTIONS_DB_FILENAME);
@@ -113485,8 +113509,8 @@ function connectionsDbPath() {
 function ensureOwnerOnlyFile(path2) {
   if (path2 === IN_MEMORY_DB) return;
   mkdirSync7(dirname7(path2), { recursive: true, mode: DIR_MODE });
-  if (!existsSync10(path2)) closeSync2(openSync2(path2, "a", CONNECTIONS_DB_FILE_MODE));
-  chmodSync3(path2, CONNECTIONS_DB_FILE_MODE);
+  if (!existsSync11(path2)) closeSync2(openSync2(path2, "a", CONNECTIONS_DB_FILE_MODE));
+  chmodSync4(path2, CONNECTIONS_DB_FILE_MODE);
 }
 function sqliteWasmDriver(db, raw) {
   const connection = {
@@ -114884,6 +114908,7 @@ walletCommand.command("import").description("Import a pasted session private key
 
 // src/commands/init.ts
 init_config();
+init_paths();
 init_core();
 
 // src/mcp-server/policy-access.ts
@@ -115199,7 +115224,14 @@ confirm. No need to re-run init.`);
   return false;
 }
 async function claimInit(claim, options) {
-  const { parseClaimArgument: parseClaimArgument2, exchangeClaimToken: exchangeClaimToken2, decryptBootstrapBlob: decryptBootstrapBlob2, claimErrorMessage: claimErrorMessage2 } = await Promise.resolve().then(() => (init_init_claim(), init_claim_exports));
+  const {
+    parseClaimArgument: parseClaimArgument2,
+    exchangeClaimToken: exchangeClaimToken2,
+    decryptBootstrapBlob: decryptBootstrapBlob2,
+    claimErrorMessage: claimErrorMessage2,
+    backupVaultFile: backupVaultFile2,
+    CLAIM_HOT_RELOAD_NOTICE: CLAIM_HOT_RELOAD_NOTICE2
+  } = await Promise.resolve().then(() => (init_init_claim(), init_claim_exports));
   const parsed = parseClaimArgument2(claim);
   if (!parsed.ok) {
     console.error(claimErrorMessage2(parsed.failure));
@@ -115226,11 +115258,21 @@ ${claimErrorMessage2({ kind: "decrypt" })}`);
   }
   await loginCommand({ apiKey: exchanged.result.apiKey, preseedAll: options.preseedAll });
   const effective = applyWorkspacePassphraseStance(options);
+  try {
+    const backup = backupVaultFile2(VAULT_PATH);
+    if (backup) console.log(`Previous wallet backed up to ${backup}`);
+  } catch (e) {
+    console.error(
+      `Could not back up the existing wallet (${e instanceof Error ? e.message : String(e)}) \u2014 continuing with the claim.`
+    );
+  }
   await walletImportCommand({
     walletKey: privateKey,
     force: effective.force,
     noPassphrase: effective.noPassphrase
   });
+  console.log(`
+${CLAIM_HOT_RELOAD_NOTICE2}`);
   return exchanged.result.apiKey;
 }
 async function initCommand(options = {}) {
@@ -115375,6 +115417,46 @@ var McpEventLogger = class {
   }
 };
 
+// src/mcp-server/newest-grant.ts
+init_esm_shims();
+function nonEmptyLowerCase(value2) {
+  return typeof value2 === "string" && value2.trim() !== "" ? value2.toLowerCase() : null;
+}
+function isNewerGrant(candidate, incumbent) {
+  const candidateId = Number(candidate?.id);
+  const incumbentId = Number(incumbent?.id);
+  const candidateIdUsable = Number.isFinite(candidateId);
+  const incumbentIdUsable = Number.isFinite(incumbentId);
+  if (candidateIdUsable && incumbentIdUsable && candidateId !== incumbentId) {
+    return candidateId > incumbentId;
+  }
+  const candidateAt = Date.parse(typeof candidate?.createdAt === "string" ? candidate.createdAt : "");
+  const incumbentAt = Date.parse(typeof incumbent?.createdAt === "string" ? incumbent.createdAt : "");
+  if (Number.isFinite(candidateAt) && Number.isFinite(incumbentAt) && candidateAt !== incumbentAt) {
+    return candidateAt > incumbentAt;
+  }
+  return candidateIdUsable && !incumbentIdUsable;
+}
+function selectNewestApprovedWallet(wallets, eoaAddress) {
+  if (!Array.isArray(wallets)) return void 0;
+  const eoa = nonEmptyLowerCase(eoaAddress);
+  if (!eoa) return void 0;
+  let newest;
+  for (const wallet of wallets) {
+    if (wallet?.status !== "approved") continue;
+    if (nonEmptyLowerCase(wallet?.address) !== eoa) continue;
+    if (newest === void 0 || isNewerGrant(wallet, newest)) newest = wallet;
+  }
+  return newest;
+}
+function findCurrentApprovedWallet(wallets, eoaAddress, pendingWalletId) {
+  if (!Array.isArray(wallets)) return void 0;
+  if (pendingWalletId) {
+    return wallets.find((w) => String(w?.id) === String(pendingWalletId) && w?.status === "approved");
+  }
+  return selectNewestApprovedWallet(wallets, eoaAddress);
+}
+
 // src/mcp-server/start-session.ts
 init_esm_shims();
 init_dist();
@@ -115509,38 +115591,57 @@ async function runStartSession(ctx, timing = new TimingCollector("start_session"
   let virtualWalletId = ctx.virtualWalletId;
   let paymentManagerAddress = ctx.paymentManagerAddress;
   let policyId = ctx.policyId;
-  if (!walletAddress || !virtualWalletId) {
-    try {
-      const approvedWallet = wallets.find(
-        (w) => w.address?.toLowerCase() === ctx.eoaAddress?.toLowerCase() && w.status === "approved"
-      );
-      if (approvedWallet) {
-        walletAddress = approvedWallet.walletAddress || approvedWallet.kernelAccountAddress;
-        virtualWalletId = String(approvedWallet.id);
-        paymentManagerAddress = approvedWallet.paymentManagerAddress;
-        policyId = String(approvedWallet.policyAssociated);
-        credentials.walletAddress = walletAddress;
-        credentials.virtualWalletId = virtualWalletId;
-        credentials.paymentManagerAddress = paymentManagerAddress;
-        credentials.policyId = policyId;
-        credentials.authorizationStatus = "approved";
-        if (approvedWallet.policyValidUntil != null) {
-          credentials.policyValidUntil = BigInt(approvedWallet.policyValidUntil);
-        }
-      }
-    } catch (backendError) {
+  let activeWallet;
+  let grantChanged = false;
+  try {
+    activeWallet = selectNewestApprovedWallet(wallets, ctx.eoaAddress);
+    if (activeWallet) {
+      const newestId = String(activeWallet.id);
+      const rowWalletAddress = activeWallet.walletAddress || activeWallet.kernelAccountAddress;
+      const rowPaymentManagerAddress = activeWallet.paymentManagerAddress;
+      const rowPolicyId = activeWallet.policyAssociated != null ? String(activeWallet.policyAssociated) : void 0;
+      grantChanged = !!virtualWalletId && virtualWalletId !== newestId;
+      if (grantChanged) {
+        console.error(
+          `[start_session] The active grant moved on \u2014 virtual wallet ${virtualWalletId} -> ${newestId}. Adopting the newest approved grant and dropping the session state derived from the old one.`
+        );
+        walletAddress = rowWalletAddress;
+        paymentManagerAddress = rowPaymentManagerAddress;
+        policyId = rowPolicyId;
+      } else {
+        walletAddress = rowWalletAddress || walletAddress;
+        paymentManagerAddress = rowPaymentManagerAddress || paymentManagerAddress;
+        policyId = rowPolicyId ?? policyId;
+      }
+      virtualWalletId = newestId;
+      credentials.walletAddress = walletAddress;
+      credentials.virtualWalletId = virtualWalletId;
+      credentials.paymentManagerAddress = paymentManagerAddress;
+      credentials.policyId = policyId;
+      credentials.authorizationStatus = "approved";
+      if (activeWallet.policyName != null) {
+        credentials.policyName = activeWallet.policyName;
+      }
+      if (activeWallet.policyValidUntil != null) {
+        credentials.policyValidUntil = BigInt(activeWallet.policyValidUntil);
+      }
+    } else if (walletsFetchFailed && virtualWalletId) {
       console.warn(
-        "[start_session] Could not check backend:",
-        backendError instanceof Error ? backendError.message : String(backendError)
+        `[start_session] \u26A0\uFE0F  could not verify the active grant \u2014 signing with the cached one (virtual wallet ${virtualWalletId}, policy ${policyId ?? "unknown"}). If a newer grant was approved since, spends are metered against the older one and may hit its spending limit.`
       );
     }
+  } catch (backendError) {
+    console.warn(
+      "[start_session] Could not check backend:",
+      backendError instanceof Error ? backendError.message : String(backendError)
+    );
   }
   const mergedAuth = credentials.authorizationStatus !== void 0 ? credentials.authorizationStatus : ctx.authorizationStatus;
   console.error(
     `[start_session] State check \u2014 walletAddress: ${walletAddress}, virtualWalletId: ${virtualWalletId}, paymentManagerAddress: ${paymentManagerAddress}, policyId: ${policyId}`
   );
   if (mergedAuth === "expired") {
-    return { responseKey: "unlocked_expired", credentials, timingReport: timing.report() };
+    return { responseKey: "unlocked_expired", credentials, timingReport: timing.report(), grantChanged };
   }
   if (walletAddress && virtualWalletId && paymentManagerAddress && policyId) {
     let privateKey = null;
@@ -115562,12 +115663,9 @@ async function runStartSession(ctx, timing = new TimingCollector("start_session"
       }
       credentials.walletAddress = walletAddress;
       credentials.paymentManagerAddress = paymentManagerAddress;
-      const approvedWallet = wallets.find(
-        (w) => w.address?.toLowerCase() === ctx.eoaAddress?.toLowerCase() && w.status === "approved"
-      );
-      const preloadedWalletData = approvedWallet != null && approvedWallet.policyValidAfter != null && approvedWallet.policyValidUntil != null ? {
-        policyValidAfter: Number(approvedWallet.policyValidAfter),
-        policyValidUntil: Number(approvedWallet.policyValidUntil)
+      const preloadedWalletData = activeWallet != null && activeWallet.policyValidAfter != null && activeWallet.policyValidUntil != null ? {
+        policyValidAfter: Number(activeWallet.policyValidAfter),
+        policyValidUntil: Number(activeWallet.policyValidUntil)
       } : void 0;
       if (ctx.readPolicyActiveOnchain) {
         const nowSeconds = Math.floor(Date.now() / 1e3);
@@ -115589,7 +115687,7 @@ async function runStartSession(ctx, timing = new TimingCollector("start_session"
           maxAttempts
         });
         if (bootAction === "reauthorize") {
-          return { responseKey: "unlocked_pending_authorization", credentials, timingReport: timing.report() };
+          return { responseKey: "unlocked_pending_authorization", credentials, timingReport: timing.report(), grantChanged };
         }
       }
       const { kernelClient: virtualWalletKernelAccountClient, permissionPlugin: virtualWalletPermissionPlugin, kernelDomain } = await virtualWalletsManagers2.configureVirtualWalletKernelAccount(
@@ -115619,13 +115717,14 @@ async function runStartSession(ctx, timing = new TimingCollector("start_session"
           console.warn("[start_session] \u26A0\uFE0F  Could not fetch credit token address (Path B routing disabled):", e);
         }
       }
-      return { responseKey: "unlocked_and_authorized", credentials, timingReport: timing.report() };
+      return { responseKey: "unlocked_and_authorized", credentials, timingReport: timing.report(), grantChanged };
     } catch (error) {
       console.error("\u274C [start_session] Kernel client creation failed:", error);
       return {
         responseKey: "unlocked_not_configured",
         credentials,
         timingReport: timing.report(),
+        grantChanged,
         kernelErrorMessage: error instanceof Error ? error.message : String(error)
       };
     } finally {
@@ -115633,9 +115732,9 @@ async function runStartSession(ctx, timing = new TimingCollector("start_session"
     }
   }
   if (!walletsFetchFailed && wallets.length === 0) {
-    return { responseKey: "unlocked_provisioning_pending", credentials, timingReport: timing.report() };
+    return { responseKey: "unlocked_provisioning_pending", credentials, timingReport: timing.report(), grantChanged };
   }
-  return { responseKey: "unlocked_pending_authorization", credentials, timingReport: timing.report() };
+  return { responseKey: "unlocked_pending_authorization", credentials, timingReport: timing.report(), grantChanged };
 }
 var WALLET_SCOPED_CREDENTIAL_KEYS = [
   "virtualWalletId",
@@ -115665,9 +115764,9 @@ function clearWalletScopedCredentials(target) {
 function sameAddress(a, b) {
   return String(a ?? "").toLowerCase() === String(b ?? "").toLowerCase();
 }
-function mergeStartSessionCredentials(target, patch, responseKey) {
+function mergeStartSessionCredentials(target, patch, responseKey, options = {}) {
   const walletChanged = patch.eoaAddress !== void 0 && !sameAddress(patch.eoaAddress, target.eoaAddress);
-  if (walletChanged) {
+  if (walletChanged || options.grantChanged) {
     clearWalletScopedCredentials(target);
   }
   if (patch.walletKeystoreJson !== void 0) {
@@ -116848,1012 +116947,1047 @@ init_local_state();
 init_esm_shims();
 init_paths();
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync8 } from "fs";
+import { join as join8 } from "path";
+
+// src/loops/state-docs.ts
+init_esm_shims();
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
-var TASK_DEFINITION_FILES = [
-  ["skill", "SKILL.md", "markdownBody"],
-  ["vision", "VISION.md", "visionMd"],
-  ["constraints", "CONSTRAINTS.md", "constraintsMd"],
-  ["readme", "README.md", "readmeMd"],
-  ["dashboardHtml", "dashboard.html", "dashboardHtml"],
-  ["dashboardManifest", "dashboard.manifest.json", "dashboardManifest"]
-];
-function materializeTask(task, runId) {
-  const dir = loopFireDir(task.slug, runId);
-  mkdirSync6(dir, { recursive: true, mode: 448 });
-  const files = {};
-  const skipped = [];
-  for (const [label2, filename, field] of TASK_DEFINITION_FILES) {
-    const body = task[field];
-    if (typeof body === "string" && body.length > 0) {
-      writeFileSync8(join7(dir, filename), body, { mode: 384 });
-      files[label2] = filename;
-    } else {
-      skipped.push(label2);
+
+// src/loops/shipback.ts
+init_esm_shims();
+function scanHeadings(text) {
+  return scanDoc(text).items;
+}
+function scanDoc(text) {
+  const out = [];
+  let offset = 0;
+  let inFence = false;
+  for (const line of text.split("\n")) {
+    const bare = line.endsWith("\r") ? line.slice(0, -1) : line;
+    const trimmed = bare.trimStart();
+    if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) inFence = !inFence;
+    else if (!inFence) {
+      const m = /^###\s+(.*)$/.exec(bare);
+      if (m) out.push({ heading: m[1].trim(), start: offset });
     }
+    offset += line.length + 1;
   }
-  writeFileSync8(
-    join7(dir, "STATUS.md"),
-    `# STATUS \u2014 ${task.slug}
-
-task_id: ${task.id}
-run_id: ${runId}
-started: pending
-queue: not started
-`,
-    { mode: 384 }
-  );
-  files.status = "STATUS.md";
-  return { dir, files, skipped };
+  return { items: out, unbalanced: inFence };
 }
-
-// src/loops/dashboard.ts
-init_esm_shims();
-import { createServer as createServer2 } from "http";
-import * as realFs from "fs";
-import { spawn as realSpawn } from "child_process";
-import { join as join8 } from "path";
-var DEFAULT_PORT = 4477;
-var DASHBOARD_PORT_ENV = "AMETYST_LOOP_DASHBOARD_PORT";
-var DASHBOARD_NO_OPEN_ENV = "AMETYST_DASHBOARD_NO_OPEN";
-var NO_DASHBOARD_MESSAGE = "no dashboard on this task \u2014 ask your agent to create one";
-var MAX_PORT_RETRIES = 20;
-var SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-function parseManifestFiles(manifest) {
-  if (typeof manifest !== "string" || !manifest.trim()) return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(manifest);
-  } catch {
-    return [];
+function headingsIgnoringFences(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    const bare = line.endsWith("\r") ? line.slice(0, -1) : line;
+    const m = /^ {0,3}###\s+(.*)$/.exec(bare);
+    if (m) out.push(m[1].trim());
   }
-  const list2 = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.files) ? parsed.files : [];
-  return list2.filter((f) => typeof f === "string" && SAFE_NAME.test(f));
+  return out;
 }
-function dashboardPort(env = process.env) {
-  const raw = Number(env[DASHBOARD_PORT_ENV]);
-  return Number.isInteger(raw) && raw > 0 && raw < 65536 ? raw : DEFAULT_PORT;
+function headings(text) {
+  return scanHeadings(text).map((h) => h.heading);
 }
-function openDashboardInBrowser(url2, deps = {}) {
-  const env = deps.env ?? process.env;
-  if (env[DASHBOARD_NO_OPEN_ENV] === "1") return false;
-  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
-  if (!isTTY) return false;
-  const platform = deps.platform ?? process.platform;
-  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
-  if (!cmd) return false;
-  const spawn4 = deps.spawn ?? realSpawn;
-  try {
-    const child = spawn4(cmd, [url2], { stdio: "ignore", detached: true });
-    child.once?.("error", () => {
-    });
-    child.unref?.();
-    return true;
-  } catch {
-    return false;
-  }
+function countByHeading(list2) {
+  const m = /* @__PURE__ */ new Map();
+  for (const h of list2) m.set(h, (m.get(h) ?? 0) + 1);
+  return m;
 }
-function startDashboardServer(args) {
-  const html = args.loop.dashboardHtml;
-  if (typeof html !== "string" || !html) return Promise.resolve(null);
-  const fs = args.deps?.fs ?? realFs;
-  const log = args.deps?.log ?? ((line) => console.error(line));
-  const make = args.deps?.createServer ?? createServer2;
-  const basePort = args.port ?? dashboardPort();
-  const files = parseManifestFiles(args.loop.dashboardManifest);
-  const handler = (req, res) => {
-    try {
-      const url2 = (req.url ?? "/").split("?")[0];
-      if (req.method === "GET" && url2 === "/") {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-        res.end(html);
-        return;
-      }
-      if (req.method === "GET" && url2 === "/data") {
-        const data = {};
-        for (const name of files) {
-          try {
-            const p = join8(args.loopDir, name);
-            if (fs.existsSync(p)) data[name] = fs.readFileSync(p, "utf-8");
-          } catch {
-          }
-        }
-        const state = {};
-        try {
-          const p = join8(args.loopDir, ".state", "fires.jsonl");
-          if (fs.existsSync(p)) state["fires.jsonl"] = fs.readFileSync(p, "utf-8");
-        } catch {
-        }
-        res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
-        res.end(
-          JSON.stringify({
-            loop: args.loop.slug,
-            files: data,
-            state,
-            mode: "live",
-            asOf: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-        return;
-      }
-      res.writeHead(404, { "content-type": "text/plain" });
-      res.end("not found");
-    } catch {
-      try {
-        res.writeHead(500);
-        res.end();
-      } catch {
-      }
+function sections(fragment) {
+  const found = scanHeadings(fragment);
+  if (found.length === 0) return { preamble: fragment, blocks: [] };
+  const preamble = fragment.slice(0, found[0].start);
+  const blocks = found.map((h, i) => ({
+    heading: h.heading,
+    text: fragment.slice(h.start, i + 1 < found.length ? found[i + 1].start : fragment.length)
+  }));
+  return { preamble, blocks };
+}
+function norm(s) {
+  return s.replace(/\r\n/g, "\n").trimEnd();
+}
+function mergeConstraints(boot, materialized, fresh) {
+  if (materialized === boot) return { next: void 0, added: [], addedBlocks: [], cleanAppend: true };
+  const recordUnchanged = fresh === boot;
+  let next;
+  let cleanAppend;
+  if (materialized.startsWith(boot)) {
+    const suffix = materialized.slice(boot.length);
+    if (recordUnchanged) {
+      next = materialized;
+    } else {
+      const { preamble, blocks } = sections(suffix);
+      const present = new Set(sections(fresh).blocks.map((b) => norm(b.text)));
+      const novel = blocks.filter((b) => !present.has(norm(b.text)));
+      const keepPreamble = preamble.trim().length > 0 && !norm(fresh).endsWith(norm(preamble));
+      const appended = (keepPreamble ? preamble : "") + novel.map((b) => b.text).join("");
+      const seam = appended.length > 0 && fresh.length > 0 && !fresh.endsWith("\n") ? "\n" : "";
+      next = fresh + seam + appended;
     }
-  };
-  const bind = (port) => new Promise((resolve) => {
-    const server2 = make(handler);
-    server2.once("error", (err) => {
-      try {
-        server2.close();
-      } catch {
-      }
-      resolve({ ok: false, err });
-    });
-    server2.listen(port, "127.0.0.1", () => {
-      server2.unref();
-      resolve({
-        ok: true,
-        handle: {
-          server: server2,
-          port,
-          close() {
-            try {
-              server2.close();
-              server2.closeAllConnections?.();
-            } catch {
-            }
-          }
-        }
-      });
-    });
-  });
-  return (async () => {
-    const lastPort = Math.min(basePort + MAX_PORT_RETRIES, 65535);
-    for (let port = basePort; port <= lastPort; port++) {
-      const attempt = await bind(port);
-      if (attempt.ok) {
-        log(`  loop dashboard: http://localhost:${attempt.handle.port}`);
-        return attempt.handle;
-      }
-      if (attempt.err.code !== "EADDRINUSE") {
-        log(
-          `  (loop dashboard not started on :${port} \u2014 ${attempt.err.code ?? attempt.err.message}; run continues)`
-        );
-        return null;
-      }
+    cleanAppend = true;
+  } else {
+    next = materialized;
+    cleanAppend = false;
+  }
+  const guardCounts = (text) => countByHeading(headingsIgnoringFences(text));
+  const freshCounts = guardCounts(fresh);
+  const nextCounts = guardCounts(next);
+  const countAll = (m) => [...m.values()].reduce((a, b) => a + b, 0);
+  const lost = [];
+  for (const [h, n] of freshCounts) {
+    const kept = nextCounts.get(h) ?? 0;
+    if (kept < n) lost.push(`${h}${n > 1 ? ` (${n}\u2192${kept})` : ""}`);
+  }
+  if (lost.length > 0) {
+    const before = countAll(freshCounts);
+    const after = countAll(nextCounts);
+    return {
+      refusal: `ship-back REFUSED: ${lost.length} section(s) present on the record would be lost by this write (${before} \u2192 ${after} headings). Lost: ${lost.slice(0, 5).map((h) => JSON.stringify(h)).join(", ")}${lost.length > 5 ? ` \u2026and ${lost.length - 5} more` : ""}. TO RECOVER: put the bare \`### \` heading line(s) named above back into the refused document and re-run \u2014 the guard counts headings, so an empty section is enough to let the write through.`,
+      added: [],
+      addedBlocks: [],
+      cleanAppend
+    };
+  }
+  if (!cleanAppend) {
+    const bootBlocks = new Set(sections(boot).blocks.map((b) => norm(b.text)));
+    const nextBlocks = new Set(sections(next).blocks.map((b) => norm(b.text)));
+    const clobbered = sections(fresh).blocks.filter((b) => !bootBlocks.has(norm(b.text))).filter((b) => !nextBlocks.has(norm(b.text)));
+    if (clobbered.length > 0) {
+      return {
+        refusal: `ship-back REFUSED: ${clobbered.length} section(s) added to the record while this fire was running would be REWRITTEN by this fire's document, which never saw them. Affected: ${clobbered.slice(0, 5).map((b) => JSON.stringify(b.heading)).join(", ")}${clobbered.length > 5 ? ` \u2026and ${clobbered.length - 5} more` : ""}. TO RECOVER: copy those section(s) verbatim off the record into the refused document and re-run \u2014 here it is the section BODY that must survive, so a bare heading is not enough on this branch.`,
+        added: [],
+        addedBlocks: [],
+        cleanAppend
+      };
     }
-    log(`  (loop dashboard not started \u2014 :${basePort}-${lastPort} all in use; run continues)`);
-    return null;
-  })();
+  }
+  if (next === fresh) return { next: void 0, added: [], addedBlocks: [], cleanAppend };
+  const added = [];
+  const remaining = new Map(freshCounts);
+  for (const h of headings(next)) {
+    const owed = remaining.get(h) ?? 0;
+    if (owed > 0) remaining.set(h, owed - 1);
+    else added.push(h);
+  }
+  const freshBlocks = new Set(sections(fresh).blocks.map((b) => norm(b.text)));
+  const addedBlocks = sections(next).blocks.map((b) => norm(b.text)).filter((t) => !freshBlocks.has(t));
+  return { next, added, addedBlocks, cleanAppend };
+}
+function verifyLanded(afterWrite, expectedBlocks) {
+  const have = new Set(sections(afterWrite).blocks.map((b) => norm(b.text)));
+  return expectedBlocks.filter((t) => !have.has(t));
 }
 
-// src/mcp-server/task-run-mode.ts
+// src/loops/memory-manifest.ts
 init_esm_shims();
-var ACCEPTED_RUN_MODES = ["in-chat", "headless"];
-var FRONTMATTER_SCAN_LIMIT = 8192;
-function normalizeRunMode(raw) {
-  if (typeof raw !== "string") return void 0;
-  const v = raw.trim().toLowerCase();
-  if (v === "headless") return "headless";
-  if (v === "in-chat" || v === "inchat" || v === "in_chat") return "in-chat";
-  return void 0;
+var MEMORY_MANIFEST_MAX_DOCS = 64;
+var MEMORY_MANIFEST_MAX_RECORDS = 16;
+var KEY_MAX_LENGTH = 128;
+function isReservedManifestKey(key, reserved) {
+  const k = key.toLowerCase();
+  return reserved.some((r) => {
+    const name = r.toLowerCase();
+    return k === name || name.endsWith(".md") && k === name.slice(0, -3);
+  });
 }
-function describeProvided(raw) {
-  if (typeof raw === "string") return raw.trim();
-  try {
-    return JSON.stringify(raw) ?? String(raw);
-  } catch {
-    return String(raw);
-  }
+function isSafeKey(key) {
+  if (key.length === 0 || key.length > KEY_MAX_LENGTH) return false;
+  if (key === "." || key === "..") return false;
+  if (key.startsWith(".")) return false;
+  if (key.includes("/") || key.includes("\\") || key.includes("\0")) return false;
+  return true;
 }
-function classifyRunModeArgument(raw) {
-  if (raw === void 0 || raw === null) return { kind: "omitted" };
-  if (typeof raw === "string" && raw.trim() === "") return { kind: "omitted" };
-  const mode2 = normalizeRunMode(raw);
-  if (mode2) return { kind: "valid", mode: mode2 };
-  return { kind: "invalid", provided: describeProvided(raw) };
+function normalizeMemoryScope(scope) {
+  switch (scope) {
+    case "shared":
+    case "workspace":
+      return "shared";
+    case "member":
+    case "profile":
+      return "member";
+    default:
+      return void 0;
+  }
 }
-function unquoteScalar(raw) {
-  let v = raw.trim();
-  const comment = v.match(/(?:^|\s)#.*$/);
-  if (comment) v = v.slice(0, comment.index === 0 ? 0 : comment.index).trim();
-  if (v.length >= 2 && (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'"))) {
-    v = v.slice(1, -1).trim();
+function validateMemoryManifest(value2, reserved) {
+  if (value2 === null) return { ok: true, manifest: null };
+  if (Array.isArray(value2)) {
+    return {
+      ok: false,
+      error: 'stateDocs is an ARRAY \u2014 that is the retired declaration shape. The memory manifest is an object: {"docs":[{"key":"\u2026","scope":"shared|member"}],"records":[{"kind":"run|decision|error|import|<free kind>","scope":"shared|member"}]}. Send "null" to clear, or the object form.'
+    };
   }
-  return v;
+  if (typeof value2 !== "object") {
+    return { ok: false, error: "stateDocs must be a JSON object with `docs` and `records` arrays, or null." };
+  }
+  const obj = value2;
+  const extra = Object.keys(obj).filter((k) => k !== "docs" && k !== "records");
+  if (extra.length > 0) {
+    return { ok: false, error: `stateDocs carries unknown propert${extra.length === 1 ? "y" : "ies"} ${extra.join(", ")} \u2014 only \`docs\` and \`records\` are allowed.` };
+  }
+  if (!Array.isArray(obj.docs) || !Array.isArray(obj.records)) {
+    return { ok: false, error: "stateDocs needs BOTH `docs` and `records` arrays (either may be empty)." };
+  }
+  if (obj.docs.length > MEMORY_MANIFEST_MAX_DOCS) {
+    return { ok: false, error: `stateDocs.docs holds ${obj.docs.length} entries \u2014 the maximum is ${MEMORY_MANIFEST_MAX_DOCS}.` };
+  }
+  if (obj.records.length > MEMORY_MANIFEST_MAX_RECORDS) {
+    return { ok: false, error: `stateDocs.records holds ${obj.records.length} entries \u2014 the maximum is ${MEMORY_MANIFEST_MAX_RECORDS}.` };
+  }
+  const docs = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const [i, raw] of obj.docs.entries()) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      return { ok: false, error: `stateDocs.docs[${i}] must be an object {key, scope}.` };
+    }
+    const d = raw;
+    const extraDoc = Object.keys(d).filter((k) => k !== "key" && k !== "scope");
+    if (extraDoc.length > 0) {
+      return { ok: false, error: `stateDocs.docs[${i}] carries unknown propert${extraDoc.length === 1 ? "y" : "ies"} ${extraDoc.join(", ")} \u2014 a doc is exactly {key, scope}.` };
+    }
+    if (typeof d.key !== "string" || !isSafeKey(d.key)) {
+      return { ok: false, error: `stateDocs.docs[${i}].key must be a safe basename of 1..${KEY_MAX_LENGTH} chars (no \`/\`, \`\\\`, NUL, no leading dot).` };
+    }
+    if (isReservedManifestKey(d.key, reserved)) {
+      return { ok: false, error: `stateDocs.docs[${i}].key "${d.key}" names a file the runner writes itself (${reserved.join(", ")}) \u2014 pick another key.` };
+    }
+    const lower = d.key.toLowerCase();
+    if (seenKeys.has(lower)) {
+      return { ok: false, error: `stateDocs.docs has "${d.key}" more than once (keys are unique case-insensitively).` };
+    }
+    seenKeys.add(lower);
+    if (d.scope !== "shared" && d.scope !== "member") {
+      return { ok: false, error: `stateDocs.docs[${i}].scope must be "shared" or "member".` };
+    }
+    docs.push({ key: d.key, scope: d.scope });
+  }
+  const records = [];
+  const seenKinds = /* @__PURE__ */ new Set();
+  for (const [i, raw] of obj.records.entries()) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      return { ok: false, error: `stateDocs.records[${i}] must be an object {kind, scope}.` };
+    }
+    const r = raw;
+    const extraRec = Object.keys(r).filter((k) => k !== "kind" && k !== "scope");
+    if (extraRec.length > 0) {
+      return { ok: false, error: `stateDocs.records[${i}] carries unknown propert${extraRec.length === 1 ? "y" : "ies"} ${extraRec.join(", ")} \u2014 a record is exactly {kind, scope}.` };
+    }
+    if (!isRecordKindToken(r.kind)) {
+      return {
+        ok: false,
+        error: `stateDocs.records[${i}].kind must be a token matching [a-z0-9-]{1,64} \u2014 a reserved kind (${RESERVED_RECORD_KINDS.join(", ")}) or a free kind of the task's own (e.g. "pbi").`
+      };
+    }
+    if (seenKinds.has(r.kind)) {
+      return { ok: false, error: `stateDocs.records declares "${r.kind}" more than once.` };
+    }
+    seenKinds.add(r.kind);
+    if (r.scope !== "shared" && r.scope !== "member") {
+      return { ok: false, error: `stateDocs.records[${i}].scope must be "shared" or "member".` };
+    }
+    records.push({ kind: r.kind, scope: r.scope });
+  }
+  return { ok: true, manifest: { docs, records } };
 }
-function parseDefaultRunMode(body) {
-  if (typeof body !== "string" || !body) return void 0;
-  const head = body.replace(/^\uFEFF/, "").slice(0, FRONTMATTER_SCAN_LIMIT);
-  const opener = head.match(/^---[ \t]*\r?\n/);
-  if (!opener) return void 0;
-  const rest = head.slice(opener[0].length);
-  const closer = rest.search(/^(?:---|\.\.\.)[ \t]*(?:\r?\n|$)/m);
-  if (closer < 0) return void 0;
-  const block = rest.slice(0, closer);
-  const hit = block.match(/^defaultRunMode[ \t]*:[ \t]*(.*)$/m);
-  if (!hit) return void 0;
-  return normalizeRunMode(unquoteScalar(hit[1] ?? ""));
+function normalizeMemoryManifest(manifest) {
+  if (!manifest || typeof manifest !== "object") return null;
+  const docs = [];
+  for (const d of Array.isArray(manifest.docs) ? manifest.docs : []) {
+    const scope = normalizeMemoryScope(d?.scope);
+    if (typeof d?.key !== "string" || d.key.length === 0 || !scope) continue;
+    docs.push({ key: d.key, scope });
+  }
+  const records = [];
+  for (const r of Array.isArray(manifest.records) ? manifest.records : []) {
+    const scope = normalizeMemoryScope(r?.scope);
+    if (!isRecordKindToken(r?.kind) || !scope) continue;
+    records.push({ kind: r.kind, scope });
+  }
+  return { docs, records };
 }
-function resolveRunMode(explicit, body) {
-  const arg = classifyRunModeArgument(explicit);
-  if (arg.kind === "invalid") {
-    return { ok: false, error: "invalid_mode", provided: arg.provided, accepted: ACCEPTED_RUN_MODES };
+async function readTaskManifest(sdk, apiKey, slug) {
+  try {
+    const got = await sdk.tasks.get(apiKey, slug);
+    if (got?.status !== "ok") return void 0;
+    return normalizeMemoryManifest(got.task?.stateDocs ?? null);
+  } catch {
+    return void 0;
   }
-  if (arg.kind === "valid") return { ok: true, mode: arg.mode, source: "explicit" };
-  const fromBody = parseDefaultRunMode(body);
-  if (fromBody) return { ok: true, mode: fromBody, source: "frontmatter" };
-  return { ok: true, mode: "in-chat", source: "default" };
 }
-
-// src/loops/estimate.ts
-init_esm_shims();
-function estimateBlastRadius(loop2) {
-  const g = loop2.graphJson ?? {};
-  const nodes = Array.isArray(g.nodes) ? g.nodes : [];
-  const steps = nodes.length;
-  const paidSteps = nodes.filter(
-    (n) => n?.type === "spend" || n?.data?.paid === true || n?.paid === true
-  ).length;
-  const costHints = nodes.map((n) => Number(n?.data?.estCostEur ?? n?.estCostEur)).filter((x) => !Number.isNaN(x));
-  const estCostEur = costHints.length ? costHints.reduce((a, b) => a + b, 0) : null;
-  return { steps, paidSteps, estCostEur };
+function declaredDocScope(manifest, key) {
+  return manifest?.docs.find((d) => d.key.toLowerCase() === key.toLowerCase())?.scope;
+}
+function declaredRecordScope(manifest, kind) {
+  return manifest?.records.find((r) => r.kind === kind)?.scope;
+}
+function declaredRecordKinds(manifest) {
+  if (manifest === void 0) return void 0;
+  return manifest?.records.map((r) => r.kind) ?? [];
+}
+function formatMemoryManifest(manifest) {
+  const normalized = normalizeMemoryManifest(manifest);
+  if (!normalized) return "(none)";
+  const lines = [
+    ...normalized.docs.map((d) => `doc     ${d.key}  \xB7  ${d.scope}`),
+    ...normalized.records.map((r) => `record  ${r.kind}  \xB7  ${r.scope}`)
+  ];
+  return lines.length ? lines.join("\n") : "(declared empty: no docs, no records)";
 }
 
-// src/loops/dashboard-template.ts
-init_esm_shims();
-var DEFAULT_DASHBOARD_FILES = [
+// src/loops/state-docs.ts
+var RESERVED_FIRE_FILENAMES = [
+  "SKILL.md",
   "VISION.md",
   "CONSTRAINTS.md",
-  "QUEUE.md",
-  "STATUS.md",
   "README.md",
-  "rounds.jsonl"
+  "STATUS.md",
+  "dashboard.html",
+  "dashboard.manifest.json"
 ];
-function parseProcessSpec(manifest) {
-  if (typeof manifest !== "string" || !manifest.trim()) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(manifest);
-  } catch {
-    return null;
-  }
-  const raw = parsed?.processSpec;
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
-  const spec = raw;
-  const stages = (Array.isArray(spec.stages) ? spec.stages : []).map((s) => {
-    if (typeof s === "string" && s.trim()) return { label: s.trim() };
-    if (s && typeof s === "object" && !Array.isArray(s)) {
-      const o = s;
-      if (typeof o.label === "string" && o.label.trim()) {
-        return {
-          label: o.label.trim(),
-          ...typeof o.id === "string" && o.id.trim() ? { id: o.id.trim() } : {},
-          ...typeof o.detail === "string" && o.detail.trim() ? { detail: o.detail.trim() } : {}
-        };
-      }
-    }
-    return null;
-  }).filter((s) => s !== null);
-  const strings = (v) => (Array.isArray(v) ? v : []).filter((x) => typeof x === "string" && x.trim() !== "");
-  const out = {
-    stages,
-    inputs: strings(spec.inputs),
-    outputs: strings(spec.outputs),
-    ...typeof spec.title === "string" && spec.title.trim() ? { title: spec.title.trim() } : {}
-  };
-  return stages.length || out.inputs.length || out.outputs.length ? out : null;
-}
-function defaultDashboardManifest() {
-  return JSON.stringify({ files: [...DEFAULT_DASHBOARD_FILES] });
+var KEY_EXTENSION = /\.[A-Za-z0-9]{1,8}$/;
+function filenameForKey(key) {
+  return KEY_EXTENSION.test(key) ? key : `${key}.md`;
 }
-function embedJson(value2) {
-  return JSON.stringify(value2).replace(/</g, "\\u003c");
+function isSafeBasename(filename) {
+  if (filename.length === 0) return false;
+  if (filename.startsWith(".")) return false;
+  if (filename.includes("/") || filename.includes("\\")) return false;
+  if (filename === ".." || filename.includes("\0")) return false;
+  return true;
 }
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function isReservedName(filename) {
+  return RESERVED_FIRE_FILENAMES.some((r) => r.toLowerCase() === filename.toLowerCase());
 }
-function renderLoopDashboardTemplate(args) {
-  const title = escapeHtml(args.processSpec?.title ?? args.slug);
-  const seed = embedJson({
-    slug: args.slug,
-    descriptionShort: args.descriptionShort ?? "",
-    processSpec: args.processSpec ?? null
-  });
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title} \u2014 loop dashboard</title>
-<style>
-  :root { --bg:#f7f7fb; --panel:#fff; --border:#e3e3ee; --muted:#6b6b80; --accent:#5b5bd6; --ok:#1a7f37; --bad:#b42318; }
-  * { box-sizing: border-box; }
-  body { margin:0; font:14px/1.5 -apple-system, "Segoe UI", Roboto, sans-serif; background:var(--bg); color:#1d1d2b; padding:24px; }
-  h1 { font-size:20px; margin:0 0 4px; }
-  h2 { font-size:14px; margin:24px 0 8px; text-transform:uppercase; letter-spacing:.05em; color:var(--muted); }
-  .sub { color:var(--muted); margin:0 0 16px; }
-  .panel { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:16px; }
-  .map { display:flex; flex-wrap:wrap; align-items:stretch; gap:8px; }
-  .stage { background:var(--panel); border:1px solid var(--border); border-left:3px solid var(--accent); border-radius:10px; padding:10px 14px; min-width:140px; flex:1; }
-  .stage .label { font-weight:600; }
-  .stage .detail { color:var(--muted); font-size:12px; margin-top:2px; }
-  .arrow { align-self:center; color:var(--muted); }
-  .io { display:grid; grid-template-columns:1fr 1fr; gap:12px; }
-  ul { margin:6px 0 0; padding-left:18px; }
-  table { width:100%; border-collapse:collapse; background:var(--panel); border:1px solid var(--border); border-radius:12px; overflow:hidden; }
-  th, td { text-align:left; padding:8px 12px; border-top:1px solid var(--border); font-size:13px; vertical-align:top; }
-  thead th { border-top:none; background:var(--bg); color:var(--muted); font-weight:600; }
-  .ok { color:var(--ok); } .bad { color:var(--bad); }
-  details { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:10px 14px; margin-bottom:8px; }
-  summary { cursor:pointer; font-weight:600; }
-  pre { overflow-x:auto; font-size:12px; background:var(--bg); border-radius:8px; padding:10px; }
-  .empty { color:var(--muted); font-style:italic; }
-  #live { font-size:12px; color:var(--muted); float:right; }
-</style>
-</head>
-<body>
-<span id="live">loading\u2026</span>
-<h1 id="title"></h1>
-<p class="sub" id="desc"></p>
-
-<h2>Process</h2>
-<div id="map" class="map panel"></div>
-
-<h2>Inputs &amp; outputs</h2>
-<div class="io">
-  <div class="panel"><strong>Inputs</strong><ul id="inputs"></ul></div>
-  <div class="panel"><strong>Outputs</strong><ul id="outputs"></ul></div>
-</div>
-
-<h2>Rounds</h2>
-<div id="rounds"></div>
-
-<h2>Files</h2>
-<div id="files"></div>
-
-<script type="application/json" id="loop-seed">${seed}</script>
-<script>
-(function () {
-  "use strict";
-  var seed = JSON.parse(document.getElementById("loop-seed").textContent);
-  document.getElementById("title").textContent = (seed.processSpec && seed.processSpec.title) || seed.slug;
-  document.getElementById("desc").textContent = seed.descriptionShort || "";
-  document.title = seed.slug + " \u2014 loop dashboard";
-
-  function el(tag, cls, text) {
-    var e = document.createElement(tag);
-    if (cls) e.className = cls;
-    if (text !== undefined) e.textContent = text;
-    return e;
-  }
-
-  // \u2500\u2500 Process map + IO from the embedded spec (static \u2014 rendered once). \u2500\u2500
-  var map = document.getElementById("map");
-  var spec = seed.processSpec;
-  if (spec && spec.stages && spec.stages.length) {
-    spec.stages.forEach(function (s, i) {
-      if (i > 0) map.appendChild(el("div", "arrow", "\\u2192"));
-      var box = el("div", "stage");
-      box.appendChild(el("div", "label", s.label));
-      if (s.detail) box.appendChild(el("div", "detail", s.detail));
-      map.appendChild(box);
-    });
-  } else {
-    map.appendChild(el("span", "empty", "No process spec on this loop \\u2014 live files and rounds below."));
+var DOC_LIST_LIMIT = 500;
+async function discoverMemoryDocs(sdk, apiKey, slug) {
+  const out = { own: [], shared: [], failed: [], truncated: [] };
+  for (const scope of ["member", "shared"]) {
+    const res = await sdk.loops.memory.listDocs(apiKey, slug, { scope, limit: DOC_LIST_LIMIT });
+    if (res.status !== "ok") {
+      if (scope === "member" && isNotFound(res)) continue;
+      out.failed.push(scope);
+      continue;
+    }
+    if (res.items.length >= DOC_LIST_LIMIT) out.truncated.push(scope);
+    if (scope === "member") out.own = res.items;
+    else out.shared = res.items;
   }
-  function fillList(id, items) {
-    var ul = document.getElementById(id);
-    ul.textContent = "";
-    if (!items || !items.length) { ul.appendChild(el("li", "empty", "\\u2014")); return; }
-    items.forEach(function (x) { ul.appendChild(el("li", null, x)); });
+  return out;
+}
+function planStateDocs(stateDocs, discovered) {
+  const manifest = normalizeMemoryManifest(stateDocs);
+  const candidates = [];
+  const claimed = /* @__PURE__ */ new Set();
+  for (const d of manifest?.docs ?? []) {
+    claimed.add(d.key);
+    candidates.push({ key: d.key, scope: d.scope, declared: true });
   }
-  fillList("inputs", spec && spec.inputs);
-  fillList("outputs", spec && spec.outputs);
-
-  // \u2500\u2500 Live data: rounds + files, refreshed from GET /data. \u2500\u2500
-  function parseJsonl(text) {
-    var rows = [];
-    (text || "").split("\\n").forEach(function (line) {
-      line = line.trim();
-      if (!line) return;
-      try { rows.push(JSON.parse(line)); } catch (e) { /* skip malformed line */ }
-    });
-    return rows;
+  for (const [rows, scope] of [
+    [discovered.own, "member"],
+    [discovered.shared, "shared"]
+  ]) {
+    for (const m of rows) {
+      if (claimed.has(m.key)) continue;
+      claimed.add(m.key);
+      candidates.push({ key: m.key, scope, declared: false });
+    }
   }
-
-  function renderRounds(fires, rounds) {
-    var host = document.getElementById("rounds");
-    host.textContent = "";
-    if (!fires.length && !rounds.length) {
-      var p = el("div", "panel"); p.appendChild(el("span", "empty", "No rounds yet \\u2014 this fills in as the loop runs."));
-      host.appendChild(p);
-      return;
+  const docs = [];
+  const skipped = [];
+  const taken = /* @__PURE__ */ new Map();
+  for (const c of candidates) {
+    const filename = filenameForKey(c.key);
+    if (!isSafeBasename(filename)) {
+      skipped.push({ key: c.key, reason: `'${filename}' is not a safe basename` });
+      continue;
     }
-    var table = document.createElement("table");
-    var thead = document.createElement("thead");
-    var hr = document.createElement("tr");
-    ["when", "duration", "turns", "tokens", "exit", "round detail (rounds.jsonl)"].forEach(function (h) {
-      hr.appendChild(el("th", null, h));
-    });
-    thead.appendChild(hr); table.appendChild(thead);
-    var tbody = document.createElement("tbody");
-    var n = Math.max(fires.length, rounds.length);
-    for (var i = n - 1; i >= 0; i--) { // newest first
-      var f = fires[i] || {};
-      var r = rounds[i];
-      var tr = document.createElement("tr");
-      tr.appendChild(el("td", null, f.ts || (r && r.ts) || "\\u2014"));
-      tr.appendChild(el("td", null, f.duration_s != null ? f.duration_s + "s" : "\\u2014"));
-      tr.appendChild(el("td", null, f.turns != null ? String(f.turns) : "\\u2014"));
-      tr.appendChild(el("td", null, f.tokens_total != null ? Number(f.tokens_total).toLocaleString() : "\\u2014"));
-      tr.appendChild(el("td", f.exit === 0 ? "ok" : f.exit != null ? "bad" : null, f.exit != null ? String(f.exit) : "\\u2014"));
-      var detail = el("td");
-      if (f.launch_failed) { detail.textContent = "launch failed \\u2014 " + (f.reason || "unknown reason"); }
-      else if (r) { var pre = document.createElement("pre"); pre.textContent = JSON.stringify(r, null, 1); detail.appendChild(pre); }
-      else detail.textContent = "\\u2014";
-      tr.appendChild(detail);
-      tbody.appendChild(tr);
+    if (isReservedName(filename)) {
+      skipped.push({
+        key: c.key,
+        reason: `'${filename}' is a file the wrapper writes itself \u2014 rename the key`
+      });
+      continue;
     }
-    table.appendChild(tbody);
-    host.appendChild(table);
+    const owner = taken.get(filename.toLowerCase());
+    if (owner !== void 0) {
+      skipped.push({ key: c.key, reason: `'${filename}' is already taken by key '${owner}'` });
+      continue;
+    }
+    taken.set(filename.toLowerCase(), c.key);
+    docs.push({ key: c.key, filename, scope: c.scope, declared: c.declared });
   }
-
-  function renderFiles(files) {
-    var host = document.getElementById("files");
-    host.textContent = "";
-    var names = Object.keys(files || {}).filter(function (n) { return n !== "rounds.jsonl"; });
-    if (!names.length) { var p = el("div", "panel"); p.appendChild(el("span", "empty", "No files surfaced by the manifest.")); host.appendChild(p); return; }
-    names.forEach(function (name) {
-      var d = document.createElement("details");
-      d.appendChild(el("summary", null, name));
-      var pre = document.createElement("pre");
-      pre.textContent = files[name];
-      d.appendChild(pre);
-      host.appendChild(d);
-    });
+  return { docs, skipped, manifest };
+}
+function describeSource(doc) {
+  const from14 = doc.scope === "shared" ? "shared" : "own";
+  const notes = [];
+  if (doc.created) notes.push(doc.seeded ? "created, seeded from shared" : "created");
+  if (!doc.declared) notes.push("not in manifest");
+  return `${doc.filename} \u2190 ${from14}${notes.length ? ` (${notes.join(", ")})` : ""}`;
+}
+async function readScoped(sdk, apiKey, slug, key, scope) {
+  const res = await sdk.loops.memory.getDoc(apiKey, slug, key, { scope });
+  if (res.status === "ok") return { status: "ok", body: res.doc.content ?? "" };
+  if (isNotFound(res)) return { status: "absent" };
+  return { status: "failed" };
+}
+async function fetchStateDocs(sdk, apiKey, slug, docs) {
+  const fetched = [];
+  const failed = [];
+  for (const doc of docs) {
+    const read = await readScoped(sdk, apiKey, slug, doc.key, doc.scope);
+    if (read.status === "ok") {
+      fetched.push({ ...doc, body: read.body, created: false, seeded: false });
+      continue;
+    }
+    if (read.status === "failed") {
+      failed.push({ key: doc.key, reason: `could not read the ${doc.scope} row` });
+      continue;
+    }
+    if (!doc.declared) {
+      failed.push({ key: doc.key, reason: `the ${doc.scope} row vanished after the listing` });
+      continue;
+    }
+    let seed = "";
+    let seeded = false;
+    if (doc.scope === "member") {
+      const shared = await readScoped(sdk, apiKey, slug, doc.key, "shared");
+      if (shared.status === "failed") {
+        failed.push({ key: doc.key, reason: "could not read the shared row to seed the member row" });
+        continue;
+      }
+      if (shared.status === "ok") {
+        seed = shared.body;
+        seeded = true;
+      }
+    }
+    const put = await sdk.loops.memory.putDoc(apiKey, slug, doc.key, { content: seed, scope: doc.scope });
+    if (put.status !== "ok") {
+      failed.push({ key: doc.key, reason: `could not create the ${doc.scope} row (${put.error ?? "write refused"})` });
+      continue;
+    }
+    fetched.push({ ...doc, body: seed, created: true, seeded });
   }
-
-  function refresh() {
-    fetch("/data").then(function (res) { return res.json(); }).then(function (data) {
-      var fires = parseJsonl(data.state && data.state["fires.jsonl"]);
-      var rounds = parseJsonl(data.files && data.files["rounds.jsonl"]);
-      renderRounds(fires, rounds);
-      renderFiles(data.files);
-      document.getElementById("live").textContent = "updated " + new Date().toLocaleTimeString();
-    }).catch(function () {
-      document.getElementById("live").textContent = "server stopped";
-    });
+  return { fetched, failed };
+}
+function isNotFound(res) {
+  if (typeof res !== "object" || res === null) return false;
+  return res.code === 404;
+}
+function docMergeRefusal(boot, fresh, next, cleanAppend) {
+  if (next.trim() === "" && fresh.trim() !== "") {
+    return "would TRUNCATE the stored document to empty while the record still holds content \u2014 an emptied file is not an instruction to erase the record";
   }
-  refresh();
-  setInterval(refresh, 5000);
-})();
-</script>
-</body>
-</html>
-`;
+  if (!cleanAppend && fresh !== boot && headings(fresh).length === 0) {
+    return "this fire rewrote the document rather than appending to it, the record MOVED under us, and the document has no headings for the shrink guard to count \u2014 so accepting this write would silently discard whatever the concurrent writer added";
+  }
+  return void 0;
 }
-function injectDefaultDashboard(loop2) {
-  const hasHtml = typeof loop2.dashboardHtml === "string" && loop2.dashboardHtml.trim() !== "";
-  if (hasHtml) return;
-  if (loop2.dashboardManifest && typeof loop2.dashboardManifest === "object") {
-    try {
-      loop2.dashboardManifest = JSON.stringify(loop2.dashboardManifest);
-    } catch {
+async function shipBackStateDocs(sdk, apiKey, slug, dir, boot) {
+  const outcomes = [];
+  for (const doc of boot) {
+    const path2 = join7(dir, doc.filename);
+    if (!existsSync9(path2)) {
+      outcomes.push({ key: doc.key, outcome: "unchanged" });
+      continue;
+    }
+    const materialized = readFileSync8(path2, "utf-8");
+    const reread = await readScoped(sdk, apiKey, slug, doc.key, doc.scope);
+    const fresh = reread.status === "ok" ? reread.body : reread.status === "absent" && doc.body === "" ? "" : void 0;
+    if (fresh === void 0) {
+      outcomes.push({
+        key: doc.key,
+        outcome: "failed",
+        detail: `could not re-read the ${doc.scope} row; ${path2} kept for recovery`
+      });
+      continue;
+    }
+    const merged = mergeConstraints(doc.body, materialized, fresh);
+    if (merged.refusal) {
+      outcomes.push({ key: doc.key, outcome: "refused", detail: merged.refusal });
+      continue;
+    }
+    if (merged.next === void 0) {
+      outcomes.push({ key: doc.key, outcome: "unchanged" });
+      continue;
+    }
+    const docRefusal = docMergeRefusal(doc.body, fresh, merged.next, merged.cleanAppend);
+    if (docRefusal) {
+      outcomes.push({
+        key: doc.key,
+        outcome: "refused",
+        detail: `${docRefusal}; ${path2} kept for recovery`
+      });
+      continue;
+    }
+    const put = await sdk.loops.memory.putDoc(apiKey, slug, doc.key, {
+      content: merged.next,
+      scope: doc.scope
+    });
+    if (put.status !== "ok") {
+      outcomes.push({
+        key: doc.key,
+        outcome: "failed",
+        detail: `write to the ${doc.scope} row rejected; ${path2} kept for recovery`
+      });
+      continue;
+    }
+    const after = await sdk.loops.memory.getDoc(apiKey, slug, doc.key, { scope: doc.scope });
+    if (after.status !== "ok") {
+      outcomes.push({ key: doc.key, outcome: "shipped", detail: "could not verify it landed" });
+      continue;
     }
+    const afterText = after.doc.content ?? "";
+    const missing = merged.addedBlocks.length > 0 ? verifyLanded(afterText, merged.addedBlocks) : afterText === merged.next ? [] : ["<rewrite did not survive>"];
+    outcomes.push(
+      missing.length === 0 ? { key: doc.key, outcome: "shipped" } : {
+        key: doc.key,
+        outcome: "failed",
+        detail: `${missing.length} section(s) did not survive a concurrent write; ${path2} kept`
+      }
+    );
   }
-  const manifest = typeof loop2.dashboardManifest === "string" ? loop2.dashboardManifest : void 0;
-  loop2.dashboardHtml = renderLoopDashboardTemplate({
-    slug: typeof loop2.slug === "string" ? loop2.slug : "loop",
-    descriptionShort: typeof loop2.descriptionShort === "string" ? loop2.descriptionShort : void 0,
-    processSpec: parseProcessSpec(manifest)
-  });
-  if (!manifest || !manifest.trim()) loop2.dashboardManifest = defaultDashboardManifest();
+  return outcomes;
 }
 
-// src/loops/state-docs.ts
-init_esm_shims();
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join9 } from "path";
+// src/mcp-server/materialize-task.ts
+var TASK_DEFINITION_FILES = [
+  ["skill", "SKILL.md", "markdownBody"],
+  ["vision", "VISION.md", "visionMd"],
+  ["constraints", "CONSTRAINTS.md", "constraintsMd"],
+  ["readme", "README.md", "readmeMd"],
+  ["dashboardHtml", "dashboard.html", "dashboardHtml"],
+  ["dashboardManifest", "dashboard.manifest.json", "dashboardManifest"]
+];
+function materializeTask(task, runId) {
+  const dir = loopFireDir(task.slug, runId);
+  mkdirSync6(dir, { recursive: true, mode: 448 });
+  const files = {};
+  const skipped = [];
+  for (const [label2, filename, field] of TASK_DEFINITION_FILES) {
+    const body = task[field];
+    if (typeof body === "string" && body.length > 0) {
+      writeFileSync8(join8(dir, filename), body, { mode: 384 });
+      files[label2] = filename;
+    } else {
+      skipped.push(label2);
+    }
+  }
+  writeFileSync8(
+    join8(dir, "STATUS.md"),
+    `# STATUS \u2014 ${task.slug}
 
-// src/loops/shipback.ts
-init_esm_shims();
-function scanHeadings(text) {
-  return scanDoc(text).items;
+task_id: ${task.id}
+run_id: ${runId}
+started: pending
+queue: not started
+`,
+    { mode: 384 }
+  );
+  files.status = "STATUS.md";
+  return { dir, files, skipped };
 }
-function scanDoc(text) {
-  const out = [];
-  let offset = 0;
-  let inFence = false;
-  for (const line of text.split("\n")) {
-    const bare = line.endsWith("\r") ? line.slice(0, -1) : line;
-    const trimmed = bare.trimStart();
-    if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) inFence = !inFence;
-    else if (!inFence) {
-      const m = /^###\s+(.*)$/.exec(bare);
-      if (m) out.push({ heading: m[1].trim(), start: offset });
+async function materializeMemoryDocs(sdk, apiKey, task, dir) {
+  const files = {};
+  const notes = [];
+  try {
+    const discovered = await discoverMemoryDocs(sdk, apiKey, task.slug);
+    for (const scope of discovered.failed) {
+      notes.push(`could not list the ${scope} memory docs \u2014 undeclared docs there are not materialized`);
     }
-    offset += line.length + 1;
+    const plan = planStateDocs(task.stateDocs ?? null, discovered);
+    for (const s of plan.skipped) {
+      notes.push(`memory doc '${s.key}' not materialized: ${s.reason}`);
+    }
+    if (plan.docs.length === 0) return { files, notes };
+    const { fetched, failed } = await fetchStateDocs(sdk, apiKey, task.slug, plan.docs);
+    for (const f of failed) {
+      notes.push(`memory doc '${f.key}' not materialized: ${f.reason}`);
+    }
+    for (const doc of fetched) {
+      writeFileSync8(join8(dir, doc.filename), doc.body, { mode: 384 });
+      files[`doc:${doc.key}`] = doc.filename;
+      notes.push(describeSource(doc));
+    }
+    return { files, notes };
+  } catch (err) {
+    notes.push(
+      `memory docs not materialized (${err instanceof Error ? err.message : String(err)}) \u2014 the run continues; read them with taskMemoryGet instead`
+    );
+    return { files, notes };
   }
-  return { items: out, unbalanced: inFence };
-}
-function headingsIgnoringFences(text) {
-  const out = [];
-  for (const line of text.split("\n")) {
-    const bare = line.endsWith("\r") ? line.slice(0, -1) : line;
-    const m = /^ {0,3}###\s+(.*)$/.exec(bare);
-    if (m) out.push(m[1].trim());
-  }
-  return out;
-}
-function headings(text) {
-  return scanHeadings(text).map((h) => h.heading);
-}
-function countByHeading(list2) {
-  const m = /* @__PURE__ */ new Map();
-  for (const h of list2) m.set(h, (m.get(h) ?? 0) + 1);
-  return m;
-}
-function sections(fragment) {
-  const found = scanHeadings(fragment);
-  if (found.length === 0) return { preamble: fragment, blocks: [] };
-  const preamble = fragment.slice(0, found[0].start);
-  const blocks = found.map((h, i) => ({
-    heading: h.heading,
-    text: fragment.slice(h.start, i + 1 < found.length ? found[i + 1].start : fragment.length)
-  }));
-  return { preamble, blocks };
-}
-function norm(s) {
-  return s.replace(/\r\n/g, "\n").trimEnd();
-}
-function mergeConstraints(boot, materialized, fresh) {
-  if (materialized === boot) return { next: void 0, added: [], addedBlocks: [], cleanAppend: true };
-  const recordUnchanged = fresh === boot;
-  let next;
-  let cleanAppend;
-  if (materialized.startsWith(boot)) {
-    const suffix = materialized.slice(boot.length);
-    if (recordUnchanged) {
-      next = materialized;
-    } else {
-      const { preamble, blocks } = sections(suffix);
-      const present = new Set(sections(fresh).blocks.map((b) => norm(b.text)));
-      const novel = blocks.filter((b) => !present.has(norm(b.text)));
-      const keepPreamble = preamble.trim().length > 0 && !norm(fresh).endsWith(norm(preamble));
-      const appended = (keepPreamble ? preamble : "") + novel.map((b) => b.text).join("");
-      const seam = appended.length > 0 && fresh.length > 0 && !fresh.endsWith("\n") ? "\n" : "";
-      next = fresh + seam + appended;
-    }
-    cleanAppend = true;
-  } else {
-    next = materialized;
-    cleanAppend = false;
-  }
-  const guardCounts = (text) => countByHeading(headingsIgnoringFences(text));
-  const freshCounts = guardCounts(fresh);
-  const nextCounts = guardCounts(next);
-  const countAll = (m) => [...m.values()].reduce((a, b) => a + b, 0);
-  const lost = [];
-  for (const [h, n] of freshCounts) {
-    const kept = nextCounts.get(h) ?? 0;
-    if (kept < n) lost.push(`${h}${n > 1 ? ` (${n}\u2192${kept})` : ""}`);
-  }
-  if (lost.length > 0) {
-    const before = countAll(freshCounts);
-    const after = countAll(nextCounts);
-    return {
-      refusal: `ship-back REFUSED: ${lost.length} section(s) present on the record would be lost by this write (${before} \u2192 ${after} headings). Lost: ${lost.slice(0, 5).map((h) => JSON.stringify(h)).join(", ")}${lost.length > 5 ? ` \u2026and ${lost.length - 5} more` : ""}. TO RECOVER: put the bare \`### \` heading line(s) named above back into the refused document and re-run \u2014 the guard counts headings, so an empty section is enough to let the write through.`,
-      added: [],
-      addedBlocks: [],
-      cleanAppend
-    };
-  }
-  if (!cleanAppend) {
-    const bootBlocks = new Set(sections(boot).blocks.map((b) => norm(b.text)));
-    const nextBlocks = new Set(sections(next).blocks.map((b) => norm(b.text)));
-    const clobbered = sections(fresh).blocks.filter((b) => !bootBlocks.has(norm(b.text))).filter((b) => !nextBlocks.has(norm(b.text)));
-    if (clobbered.length > 0) {
-      return {
-        refusal: `ship-back REFUSED: ${clobbered.length} section(s) added to the record while this fire was running would be REWRITTEN by this fire's document, which never saw them. Affected: ${clobbered.slice(0, 5).map((b) => JSON.stringify(b.heading)).join(", ")}${clobbered.length > 5 ? ` \u2026and ${clobbered.length - 5} more` : ""}. TO RECOVER: copy those section(s) verbatim off the record into the refused document and re-run \u2014 here it is the section BODY that must survive, so a bare heading is not enough on this branch.`,
-        added: [],
-        addedBlocks: [],
-        cleanAppend
-      };
-    }
-  }
-  if (next === fresh) return { next: void 0, added: [], addedBlocks: [], cleanAppend };
-  const added = [];
-  const remaining = new Map(freshCounts);
-  for (const h of headings(next)) {
-    const owed = remaining.get(h) ?? 0;
-    if (owed > 0) remaining.set(h, owed - 1);
-    else added.push(h);
-  }
-  const freshBlocks = new Set(sections(fresh).blocks.map((b) => norm(b.text)));
-  const addedBlocks = sections(next).blocks.map((b) => norm(b.text)).filter((t) => !freshBlocks.has(t));
-  return { next, added, addedBlocks, cleanAppend };
-}
-function verifyLanded(afterWrite, expectedBlocks) {
-  const have = new Set(sections(afterWrite).blocks.map((b) => norm(b.text)));
-  return expectedBlocks.filter((t) => !have.has(t));
 }
 
-// src/loops/memory-manifest.ts
+// src/mcp-server/index.ts
+import { existsSync as existsSync12 } from "fs";
+
+// src/loops/dashboard.ts
 init_esm_shims();
-var MEMORY_MANIFEST_MAX_DOCS = 64;
-var MEMORY_MANIFEST_MAX_RECORDS = 16;
-var KEY_MAX_LENGTH = 128;
-function isReservedManifestKey(key, reserved) {
-  const k = key.toLowerCase();
-  return reserved.some((r) => {
-    const name = r.toLowerCase();
-    return k === name || name.endsWith(".md") && k === name.slice(0, -3);
-  });
+import { createServer as createServer2 } from "http";
+import * as realFs from "fs";
+import { spawn as realSpawn } from "child_process";
+import { join as join9 } from "path";
+var DEFAULT_PORT = 4477;
+var DASHBOARD_PORT_ENV = "AMETYST_LOOP_DASHBOARD_PORT";
+var DASHBOARD_NO_OPEN_ENV = "AMETYST_DASHBOARD_NO_OPEN";
+var NO_DASHBOARD_MESSAGE = "no dashboard on this task \u2014 ask your agent to create one";
+var MAX_PORT_RETRIES = 20;
+var SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function parseManifestFiles(manifest) {
+  if (typeof manifest !== "string" || !manifest.trim()) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return [];
+  }
+  const list2 = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.files) ? parsed.files : [];
+  return list2.filter((f) => typeof f === "string" && SAFE_NAME.test(f));
 }
-function isSafeKey(key) {
-  if (key.length === 0 || key.length > KEY_MAX_LENGTH) return false;
-  if (key === "." || key === "..") return false;
-  if (key.startsWith(".")) return false;
-  if (key.includes("/") || key.includes("\\") || key.includes("\0")) return false;
-  return true;
+function dashboardPort(env = process.env) {
+  const raw = Number(env[DASHBOARD_PORT_ENV]);
+  return Number.isInteger(raw) && raw > 0 && raw < 65536 ? raw : DEFAULT_PORT;
 }
-function normalizeMemoryScope(scope) {
-  switch (scope) {
-    case "shared":
-    case "workspace":
-      return "shared";
-    case "member":
-    case "profile":
-      return "member";
-    default:
-      return void 0;
+function openDashboardInBrowser(url2, deps = {}) {
+  const env = deps.env ?? process.env;
+  if (env[DASHBOARD_NO_OPEN_ENV] === "1") return false;
+  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
+  if (!isTTY) return false;
+  const platform = deps.platform ?? process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
+  if (!cmd) return false;
+  const spawn4 = deps.spawn ?? realSpawn;
+  try {
+    const child = spawn4(cmd, [url2], { stdio: "ignore", detached: true });
+    child.once?.("error", () => {
+    });
+    child.unref?.();
+    return true;
+  } catch {
+    return false;
   }
 }
-function validateMemoryManifest(value2, reserved) {
-  if (value2 === null) return { ok: true, manifest: null };
-  if (Array.isArray(value2)) {
-    return {
-      ok: false,
-      error: 'stateDocs is an ARRAY \u2014 that is the retired declaration shape. The memory manifest is an object: {"docs":[{"key":"\u2026","scope":"shared|member"}],"records":[{"kind":"run|decision|error|import|<free kind>","scope":"shared|member"}]}. Send "null" to clear, or the object form.'
-    };
-  }
-  if (typeof value2 !== "object") {
-    return { ok: false, error: "stateDocs must be a JSON object with `docs` and `records` arrays, or null." };
-  }
-  const obj = value2;
-  const extra = Object.keys(obj).filter((k) => k !== "docs" && k !== "records");
-  if (extra.length > 0) {
-    return { ok: false, error: `stateDocs carries unknown propert${extra.length === 1 ? "y" : "ies"} ${extra.join(", ")} \u2014 only \`docs\` and \`records\` are allowed.` };
-  }
-  if (!Array.isArray(obj.docs) || !Array.isArray(obj.records)) {
-    return { ok: false, error: "stateDocs needs BOTH `docs` and `records` arrays (either may be empty)." };
-  }
-  if (obj.docs.length > MEMORY_MANIFEST_MAX_DOCS) {
-    return { ok: false, error: `stateDocs.docs holds ${obj.docs.length} entries \u2014 the maximum is ${MEMORY_MANIFEST_MAX_DOCS}.` };
-  }
-  if (obj.records.length > MEMORY_MANIFEST_MAX_RECORDS) {
-    return { ok: false, error: `stateDocs.records holds ${obj.records.length} entries \u2014 the maximum is ${MEMORY_MANIFEST_MAX_RECORDS}.` };
-  }
-  const docs = [];
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const [i, raw] of obj.docs.entries()) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      return { ok: false, error: `stateDocs.docs[${i}] must be an object {key, scope}.` };
-    }
-    const d = raw;
-    const extraDoc = Object.keys(d).filter((k) => k !== "key" && k !== "scope");
-    if (extraDoc.length > 0) {
-      return { ok: false, error: `stateDocs.docs[${i}] carries unknown propert${extraDoc.length === 1 ? "y" : "ies"} ${extraDoc.join(", ")} \u2014 a doc is exactly {key, scope}.` };
-    }
-    if (typeof d.key !== "string" || !isSafeKey(d.key)) {
-      return { ok: false, error: `stateDocs.docs[${i}].key must be a safe basename of 1..${KEY_MAX_LENGTH} chars (no \`/\`, \`\\\`, NUL, no leading dot).` };
-    }
-    if (isReservedManifestKey(d.key, reserved)) {
-      return { ok: false, error: `stateDocs.docs[${i}].key "${d.key}" names a file the runner writes itself (${reserved.join(", ")}) \u2014 pick another key.` };
-    }
-    const lower = d.key.toLowerCase();
-    if (seenKeys.has(lower)) {
-      return { ok: false, error: `stateDocs.docs has "${d.key}" more than once (keys are unique case-insensitively).` };
-    }
-    seenKeys.add(lower);
-    if (d.scope !== "shared" && d.scope !== "member") {
-      return { ok: false, error: `stateDocs.docs[${i}].scope must be "shared" or "member".` };
-    }
-    docs.push({ key: d.key, scope: d.scope });
-  }
-  const records = [];
-  const seenKinds = /* @__PURE__ */ new Set();
-  for (const [i, raw] of obj.records.entries()) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      return { ok: false, error: `stateDocs.records[${i}] must be an object {kind, scope}.` };
-    }
-    const r = raw;
-    const extraRec = Object.keys(r).filter((k) => k !== "kind" && k !== "scope");
-    if (extraRec.length > 0) {
-      return { ok: false, error: `stateDocs.records[${i}] carries unknown propert${extraRec.length === 1 ? "y" : "ies"} ${extraRec.join(", ")} \u2014 a record is exactly {kind, scope}.` };
-    }
-    if (!isRecordKindToken(r.kind)) {
-      return {
-        ok: false,
-        error: `stateDocs.records[${i}].kind must be a token matching [a-z0-9-]{1,64} \u2014 a reserved kind (${RESERVED_RECORD_KINDS.join(", ")}) or a free kind of the task's own (e.g. "pbi").`
-      };
-    }
-    if (seenKinds.has(r.kind)) {
-      return { ok: false, error: `stateDocs.records declares "${r.kind}" more than once.` };
+function startDashboardServer(args) {
+  const html = args.loop.dashboardHtml;
+  if (typeof html !== "string" || !html) return Promise.resolve(null);
+  const fs = args.deps?.fs ?? realFs;
+  const log = args.deps?.log ?? ((line) => console.error(line));
+  const make = args.deps?.createServer ?? createServer2;
+  const basePort = args.port ?? dashboardPort();
+  const files = parseManifestFiles(args.loop.dashboardManifest);
+  const handler = (req, res) => {
+    try {
+      const url2 = (req.url ?? "/").split("?")[0];
+      if (req.method === "GET" && url2 === "/") {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(html);
+        return;
+      }
+      if (req.method === "GET" && url2 === "/data") {
+        const data = {};
+        for (const name of files) {
+          try {
+            const p = join9(args.loopDir, name);
+            if (fs.existsSync(p)) data[name] = fs.readFileSync(p, "utf-8");
+          } catch {
+          }
+        }
+        const state = {};
+        try {
+          const p = join9(args.loopDir, ".state", "fires.jsonl");
+          if (fs.existsSync(p)) state["fires.jsonl"] = fs.readFileSync(p, "utf-8");
+        } catch {
+        }
+        res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+        res.end(
+          JSON.stringify({
+            loop: args.loop.slug,
+            files: data,
+            state,
+            mode: "live",
+            asOf: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+        return;
+      }
+      res.writeHead(404, { "content-type": "text/plain" });
+      res.end("not found");
+    } catch {
+      try {
+        res.writeHead(500);
+        res.end();
+      } catch {
+      }
     }
-    seenKinds.add(r.kind);
-    if (r.scope !== "shared" && r.scope !== "member") {
-      return { ok: false, error: `stateDocs.records[${i}].scope must be "shared" or "member".` };
+  };
+  const bind = (port) => new Promise((resolve) => {
+    const server2 = make(handler);
+    server2.once("error", (err) => {
+      try {
+        server2.close();
+      } catch {
+      }
+      resolve({ ok: false, err });
+    });
+    server2.listen(port, "127.0.0.1", () => {
+      server2.unref();
+      resolve({
+        ok: true,
+        handle: {
+          server: server2,
+          port,
+          close() {
+            try {
+              server2.close();
+              server2.closeAllConnections?.();
+            } catch {
+            }
+          }
+        }
+      });
+    });
+  });
+  return (async () => {
+    const lastPort = Math.min(basePort + MAX_PORT_RETRIES, 65535);
+    for (let port = basePort; port <= lastPort; port++) {
+      const attempt = await bind(port);
+      if (attempt.ok) {
+        log(`  loop dashboard: http://localhost:${attempt.handle.port}`);
+        return attempt.handle;
+      }
+      if (attempt.err.code !== "EADDRINUSE") {
+        log(
+          `  (loop dashboard not started on :${port} \u2014 ${attempt.err.code ?? attempt.err.message}; run continues)`
+        );
+        return null;
+      }
     }
-    records.push({ kind: r.kind, scope: r.scope });
-  }
-  return { ok: true, manifest: { docs, records } };
+    log(`  (loop dashboard not started \u2014 :${basePort}-${lastPort} all in use; run continues)`);
+    return null;
+  })();
 }
-function normalizeMemoryManifest(manifest) {
-  if (!manifest || typeof manifest !== "object") return null;
-  const docs = [];
-  for (const d of Array.isArray(manifest.docs) ? manifest.docs : []) {
-    const scope = normalizeMemoryScope(d?.scope);
-    if (typeof d?.key !== "string" || d.key.length === 0 || !scope) continue;
-    docs.push({ key: d.key, scope });
-  }
-  const records = [];
-  for (const r of Array.isArray(manifest.records) ? manifest.records : []) {
-    const scope = normalizeMemoryScope(r?.scope);
-    if (!isRecordKindToken(r?.kind) || !scope) continue;
-    records.push({ kind: r.kind, scope });
-  }
-  return { docs, records };
+
+// src/mcp-server/task-run-mode.ts
+init_esm_shims();
+var ACCEPTED_RUN_MODES = ["in-chat", "headless"];
+var FRONTMATTER_SCAN_LIMIT = 8192;
+function normalizeRunMode(raw) {
+  if (typeof raw !== "string") return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "headless") return "headless";
+  if (v === "in-chat" || v === "inchat" || v === "in_chat") return "in-chat";
+  return void 0;
 }
-async function readTaskManifest(sdk, apiKey, slug) {
+function describeProvided(raw) {
+  if (typeof raw === "string") return raw.trim();
   try {
-    const got = await sdk.tasks.get(apiKey, slug);
-    if (got?.status !== "ok") return void 0;
-    return normalizeMemoryManifest(got.task?.stateDocs ?? null);
+    return JSON.stringify(raw) ?? String(raw);
   } catch {
-    return void 0;
+    return String(raw);
   }
 }
-function declaredDocScope(manifest, key) {
-  return manifest?.docs.find((d) => d.key.toLowerCase() === key.toLowerCase())?.scope;
+function classifyRunModeArgument(raw) {
+  if (raw === void 0 || raw === null) return { kind: "omitted" };
+  if (typeof raw === "string" && raw.trim() === "") return { kind: "omitted" };
+  const mode2 = normalizeRunMode(raw);
+  if (mode2) return { kind: "valid", mode: mode2 };
+  return { kind: "invalid", provided: describeProvided(raw) };
 }
-function declaredRecordScope(manifest, kind) {
-  return manifest?.records.find((r) => r.kind === kind)?.scope;
+function unquoteScalar(raw) {
+  let v = raw.trim();
+  const comment = v.match(/(?:^|\s)#.*$/);
+  if (comment) v = v.slice(0, comment.index === 0 ? 0 : comment.index).trim();
+  if (v.length >= 2 && (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'"))) {
+    v = v.slice(1, -1).trim();
+  }
+  return v;
 }
-function declaredRecordKinds(manifest) {
-  if (manifest === void 0) return void 0;
-  return manifest?.records.map((r) => r.kind) ?? [];
+function parseDefaultRunMode(body) {
+  if (typeof body !== "string" || !body) return void 0;
+  const head = body.replace(/^\uFEFF/, "").slice(0, FRONTMATTER_SCAN_LIMIT);
+  const opener = head.match(/^---[ \t]*\r?\n/);
+  if (!opener) return void 0;
+  const rest = head.slice(opener[0].length);
+  const closer = rest.search(/^(?:---|\.\.\.)[ \t]*(?:\r?\n|$)/m);
+  if (closer < 0) return void 0;
+  const block = rest.slice(0, closer);
+  const hit = block.match(/^defaultRunMode[ \t]*:[ \t]*(.*)$/m);
+  if (!hit) return void 0;
+  return normalizeRunMode(unquoteScalar(hit[1] ?? ""));
 }
-function formatMemoryManifest(manifest) {
-  const normalized = normalizeMemoryManifest(manifest);
-  if (!normalized) return "(none)";
-  const lines = [
-    ...normalized.docs.map((d) => `doc     ${d.key}  \xB7  ${d.scope}`),
-    ...normalized.records.map((r) => `record  ${r.kind}  \xB7  ${r.scope}`)
-  ];
-  return lines.length ? lines.join("\n") : "(declared empty: no docs, no records)";
+function resolveRunMode(explicit, body) {
+  const arg = classifyRunModeArgument(explicit);
+  if (arg.kind === "invalid") {
+    return { ok: false, error: "invalid_mode", provided: arg.provided, accepted: ACCEPTED_RUN_MODES };
+  }
+  if (arg.kind === "valid") return { ok: true, mode: arg.mode, source: "explicit" };
+  const fromBody = parseDefaultRunMode(body);
+  if (fromBody) return { ok: true, mode: fromBody, source: "frontmatter" };
+  return { ok: true, mode: "in-chat", source: "default" };
+}
+
+// src/loops/estimate.ts
+init_esm_shims();
+function estimateBlastRadius(loop2) {
+  const g = loop2.graphJson ?? {};
+  const nodes = Array.isArray(g.nodes) ? g.nodes : [];
+  const steps = nodes.length;
+  const paidSteps = nodes.filter(
+    (n) => n?.type === "spend" || n?.data?.paid === true || n?.paid === true
+  ).length;
+  const costHints = nodes.map((n) => Number(n?.data?.estCostEur ?? n?.estCostEur)).filter((x) => !Number.isNaN(x));
+  const estCostEur = costHints.length ? costHints.reduce((a, b) => a + b, 0) : null;
+  return { steps, paidSteps, estCostEur };
 }
 
-// src/loops/state-docs.ts
-var RESERVED_FIRE_FILENAMES = [
-  "SKILL.md",
+// src/loops/dashboard-template.ts
+init_esm_shims();
+var DEFAULT_DASHBOARD_FILES = [
   "VISION.md",
   "CONSTRAINTS.md",
-  "README.md",
+  "QUEUE.md",
   "STATUS.md",
-  "dashboard.html",
-  "dashboard.manifest.json"
+  "README.md",
+  "rounds.jsonl"
 ];
-var KEY_EXTENSION = /\.[A-Za-z0-9]{1,8}$/;
-function filenameForKey(key) {
-  return KEY_EXTENSION.test(key) ? key : `${key}.md`;
-}
-function isSafeBasename(filename) {
-  if (filename.length === 0) return false;
-  if (filename.startsWith(".")) return false;
-  if (filename.includes("/") || filename.includes("\\")) return false;
-  if (filename === ".." || filename.includes("\0")) return false;
-  return true;
-}
-function isReservedName(filename) {
-  return RESERVED_FIRE_FILENAMES.some((r) => r.toLowerCase() === filename.toLowerCase());
-}
-var DOC_LIST_LIMIT = 500;
-async function discoverMemoryDocs(sdk, apiKey, slug) {
-  const out = { own: [], shared: [], failed: [], truncated: [] };
-  for (const scope of ["member", "shared"]) {
-    const res = await sdk.loops.memory.listDocs(apiKey, slug, { scope, limit: DOC_LIST_LIMIT });
-    if (res.status !== "ok") {
-      if (scope === "member" && isNotFound(res)) continue;
-      out.failed.push(scope);
-      continue;
-    }
-    if (res.items.length >= DOC_LIST_LIMIT) out.truncated.push(scope);
-    if (scope === "member") out.own = res.items;
-    else out.shared = res.items;
-  }
-  return out;
-}
-function planStateDocs(stateDocs, discovered) {
-  const manifest = normalizeMemoryManifest(stateDocs);
-  const candidates = [];
-  const claimed = /* @__PURE__ */ new Set();
-  for (const d of manifest?.docs ?? []) {
-    claimed.add(d.key);
-    candidates.push({ key: d.key, scope: d.scope, declared: true });
-  }
-  for (const [rows, scope] of [
-    [discovered.own, "member"],
-    [discovered.shared, "shared"]
-  ]) {
-    for (const m of rows) {
-      if (claimed.has(m.key)) continue;
-      claimed.add(m.key);
-      candidates.push({ key: m.key, scope, declared: false });
-    }
+function parseProcessSpec(manifest) {
+  if (typeof manifest !== "string" || !manifest.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(manifest);
+  } catch {
+    return null;
   }
-  const docs = [];
-  const skipped = [];
-  const taken = /* @__PURE__ */ new Map();
-  for (const c of candidates) {
-    const filename = filenameForKey(c.key);
-    if (!isSafeBasename(filename)) {
-      skipped.push({ key: c.key, reason: `'${filename}' is not a safe basename` });
-      continue;
-    }
-    if (isReservedName(filename)) {
-      skipped.push({
-        key: c.key,
-        reason: `'${filename}' is a file the wrapper writes itself \u2014 rename the key`
-      });
-      continue;
-    }
-    const owner = taken.get(filename.toLowerCase());
-    if (owner !== void 0) {
-      skipped.push({ key: c.key, reason: `'${filename}' is already taken by key '${owner}'` });
-      continue;
+  const raw = parsed?.processSpec;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const spec = raw;
+  const stages = (Array.isArray(spec.stages) ? spec.stages : []).map((s) => {
+    if (typeof s === "string" && s.trim()) return { label: s.trim() };
+    if (s && typeof s === "object" && !Array.isArray(s)) {
+      const o = s;
+      if (typeof o.label === "string" && o.label.trim()) {
+        return {
+          label: o.label.trim(),
+          ...typeof o.id === "string" && o.id.trim() ? { id: o.id.trim() } : {},
+          ...typeof o.detail === "string" && o.detail.trim() ? { detail: o.detail.trim() } : {}
+        };
+      }
     }
-    taken.set(filename.toLowerCase(), c.key);
-    docs.push({ key: c.key, filename, scope: c.scope, declared: c.declared });
-  }
-  return { docs, skipped, manifest };
+    return null;
+  }).filter((s) => s !== null);
+  const strings = (v) => (Array.isArray(v) ? v : []).filter((x) => typeof x === "string" && x.trim() !== "");
+  const out = {
+    stages,
+    inputs: strings(spec.inputs),
+    outputs: strings(spec.outputs),
+    ...typeof spec.title === "string" && spec.title.trim() ? { title: spec.title.trim() } : {}
+  };
+  return stages.length || out.inputs.length || out.outputs.length ? out : null;
 }
-function describeSource(doc) {
-  const from14 = doc.scope === "shared" ? "shared" : "own";
-  const notes = [];
-  if (doc.created) notes.push(doc.seeded ? "created, seeded from shared" : "created");
-  if (!doc.declared) notes.push("not in manifest");
-  return `${doc.filename} \u2190 ${from14}${notes.length ? ` (${notes.join(", ")})` : ""}`;
+function defaultDashboardManifest() {
+  return JSON.stringify({ files: [...DEFAULT_DASHBOARD_FILES] });
 }
-async function readScoped(sdk, apiKey, slug, key, scope) {
-  const res = await sdk.loops.memory.getDoc(apiKey, slug, key, { scope });
-  if (res.status === "ok") return { status: "ok", body: res.doc.content ?? "" };
-  if (isNotFound(res)) return { status: "absent" };
-  return { status: "failed" };
+function embedJson(value2) {
+  return JSON.stringify(value2).replace(/</g, "\\u003c");
 }
-async function fetchStateDocs(sdk, apiKey, slug, docs) {
-  const fetched = [];
-  const failed = [];
-  for (const doc of docs) {
-    const read = await readScoped(sdk, apiKey, slug, doc.key, doc.scope);
-    if (read.status === "ok") {
-      fetched.push({ ...doc, body: read.body, created: false, seeded: false });
-      continue;
-    }
-    if (read.status === "failed") {
-      failed.push({ key: doc.key, reason: `could not read the ${doc.scope} row` });
-      continue;
-    }
-    if (!doc.declared) {
-      failed.push({ key: doc.key, reason: `the ${doc.scope} row vanished after the listing` });
-      continue;
-    }
-    let seed = "";
-    let seeded = false;
-    if (doc.scope === "member") {
-      const shared = await readScoped(sdk, apiKey, slug, doc.key, "shared");
-      if (shared.status === "failed") {
-        failed.push({ key: doc.key, reason: "could not read the shared row to seed the member row" });
-        continue;
-      }
-      if (shared.status === "ok") {
-        seed = shared.body;
-        seeded = true;
-      }
-    }
-    const put = await sdk.loops.memory.putDoc(apiKey, slug, doc.key, { content: seed, scope: doc.scope });
-    if (put.status !== "ok") {
-      failed.push({ key: doc.key, reason: `could not create the ${doc.scope} row (${put.error ?? "write refused"})` });
-      continue;
-    }
-    fetched.push({ ...doc, body: seed, created: true, seeded });
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function renderLoopDashboardTemplate(args) {
+  const title = escapeHtml(args.processSpec?.title ?? args.slug);
+  const seed = embedJson({
+    slug: args.slug,
+    descriptionShort: args.descriptionShort ?? "",
+    processSpec: args.processSpec ?? null
+  });
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} \u2014 loop dashboard</title>
+<style>
+  :root { --bg:#f7f7fb; --panel:#fff; --border:#e3e3ee; --muted:#6b6b80; --accent:#5b5bd6; --ok:#1a7f37; --bad:#b42318; }
+  * { box-sizing: border-box; }
+  body { margin:0; font:14px/1.5 -apple-system, "Segoe UI", Roboto, sans-serif; background:var(--bg); color:#1d1d2b; padding:24px; }
+  h1 { font-size:20px; margin:0 0 4px; }
+  h2 { font-size:14px; margin:24px 0 8px; text-transform:uppercase; letter-spacing:.05em; color:var(--muted); }
+  .sub { color:var(--muted); margin:0 0 16px; }
+  .panel { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:16px; }
+  .map { display:flex; flex-wrap:wrap; align-items:stretch; gap:8px; }
+  .stage { background:var(--panel); border:1px solid var(--border); border-left:3px solid var(--accent); border-radius:10px; padding:10px 14px; min-width:140px; flex:1; }
+  .stage .label { font-weight:600; }
+  .stage .detail { color:var(--muted); font-size:12px; margin-top:2px; }
+  .arrow { align-self:center; color:var(--muted); }
+  .io { display:grid; grid-template-columns:1fr 1fr; gap:12px; }
+  ul { margin:6px 0 0; padding-left:18px; }
+  table { width:100%; border-collapse:collapse; background:var(--panel); border:1px solid var(--border); border-radius:12px; overflow:hidden; }
+  th, td { text-align:left; padding:8px 12px; border-top:1px solid var(--border); font-size:13px; vertical-align:top; }
+  thead th { border-top:none; background:var(--bg); color:var(--muted); font-weight:600; }
+  .ok { color:var(--ok); } .bad { color:var(--bad); }
+  details { background:var(--panel); border:1px solid var(--border); border-radius:12px; padding:10px 14px; margin-bottom:8px; }
+  summary { cursor:pointer; font-weight:600; }
+  pre { overflow-x:auto; font-size:12px; background:var(--bg); border-radius:8px; padding:10px; }
+  .empty { color:var(--muted); font-style:italic; }
+  #live { font-size:12px; color:var(--muted); float:right; }
+</style>
+</head>
+<body>
+<span id="live">loading\u2026</span>
+<h1 id="title"></h1>
+<p class="sub" id="desc"></p>
+
+<h2>Process</h2>
+<div id="map" class="map panel"></div>
+
+<h2>Inputs &amp; outputs</h2>
+<div class="io">
+  <div class="panel"><strong>Inputs</strong><ul id="inputs"></ul></div>
+  <div class="panel"><strong>Outputs</strong><ul id="outputs"></ul></div>
+</div>
+
+<h2>Rounds</h2>
+<div id="rounds"></div>
+
+<h2>Files</h2>
+<div id="files"></div>
+
+<script type="application/json" id="loop-seed">${seed}</script>
+<script>
+(function () {
+  "use strict";
+  var seed = JSON.parse(document.getElementById("loop-seed").textContent);
+  document.getElementById("title").textContent = (seed.processSpec && seed.processSpec.title) || seed.slug;
+  document.getElementById("desc").textContent = seed.descriptionShort || "";
+  document.title = seed.slug + " \u2014 loop dashboard";
+
+  function el(tag, cls, text) {
+    var e = document.createElement(tag);
+    if (cls) e.className = cls;
+    if (text !== undefined) e.textContent = text;
+    return e;
+  }
+
+  // \u2500\u2500 Process map + IO from the embedded spec (static \u2014 rendered once). \u2500\u2500
+  var map = document.getElementById("map");
+  var spec = seed.processSpec;
+  if (spec && spec.stages && spec.stages.length) {
+    spec.stages.forEach(function (s, i) {
+      if (i > 0) map.appendChild(el("div", "arrow", "\\u2192"));
+      var box = el("div", "stage");
+      box.appendChild(el("div", "label", s.label));
+      if (s.detail) box.appendChild(el("div", "detail", s.detail));
+      map.appendChild(box);
+    });
+  } else {
+    map.appendChild(el("span", "empty", "No process spec on this loop \\u2014 live files and rounds below."));
   }
-  return { fetched, failed };
-}
-function isNotFound(res) {
-  if (typeof res !== "object" || res === null) return false;
-  return res.code === 404;
-}
-function docMergeRefusal(boot, fresh, next, cleanAppend) {
-  if (next.trim() === "" && fresh.trim() !== "") {
-    return "would TRUNCATE the stored document to empty while the record still holds content \u2014 an emptied file is not an instruction to erase the record";
+  function fillList(id, items) {
+    var ul = document.getElementById(id);
+    ul.textContent = "";
+    if (!items || !items.length) { ul.appendChild(el("li", "empty", "\\u2014")); return; }
+    items.forEach(function (x) { ul.appendChild(el("li", null, x)); });
   }
-  if (!cleanAppend && fresh !== boot && headings(fresh).length === 0) {
-    return "this fire rewrote the document rather than appending to it, the record MOVED under us, and the document has no headings for the shrink guard to count \u2014 so accepting this write would silently discard whatever the concurrent writer added";
+  fillList("inputs", spec && spec.inputs);
+  fillList("outputs", spec && spec.outputs);
+
+  // \u2500\u2500 Live data: rounds + files, refreshed from GET /data. \u2500\u2500
+  function parseJsonl(text) {
+    var rows = [];
+    (text || "").split("\\n").forEach(function (line) {
+      line = line.trim();
+      if (!line) return;
+      try { rows.push(JSON.parse(line)); } catch (e) { /* skip malformed line */ }
+    });
+    return rows;
   }
-  return void 0;
-}
-async function shipBackStateDocs(sdk, apiKey, slug, dir, boot) {
-  const outcomes = [];
-  for (const doc of boot) {
-    const path2 = join9(dir, doc.filename);
-    if (!existsSync8(path2)) {
-      outcomes.push({ key: doc.key, outcome: "unchanged" });
-      continue;
-    }
-    const materialized = readFileSync8(path2, "utf-8");
-    const reread = await readScoped(sdk, apiKey, slug, doc.key, doc.scope);
-    const fresh = reread.status === "ok" ? reread.body : reread.status === "absent" && doc.body === "" ? "" : void 0;
-    if (fresh === void 0) {
-      outcomes.push({
-        key: doc.key,
-        outcome: "failed",
-        detail: `could not re-read the ${doc.scope} row; ${path2} kept for recovery`
-      });
-      continue;
-    }
-    const merged = mergeConstraints(doc.body, materialized, fresh);
-    if (merged.refusal) {
-      outcomes.push({ key: doc.key, outcome: "refused", detail: merged.refusal });
-      continue;
-    }
-    if (merged.next === void 0) {
-      outcomes.push({ key: doc.key, outcome: "unchanged" });
-      continue;
-    }
-    const docRefusal = docMergeRefusal(doc.body, fresh, merged.next, merged.cleanAppend);
-    if (docRefusal) {
-      outcomes.push({
-        key: doc.key,
-        outcome: "refused",
-        detail: `${docRefusal}; ${path2} kept for recovery`
-      });
-      continue;
+
+  function renderRounds(fires, rounds) {
+    var host = document.getElementById("rounds");
+    host.textContent = "";
+    if (!fires.length && !rounds.length) {
+      var p = el("div", "panel"); p.appendChild(el("span", "empty", "No rounds yet \\u2014 this fills in as the loop runs."));
+      host.appendChild(p);
+      return;
     }
-    const put = await sdk.loops.memory.putDoc(apiKey, slug, doc.key, {
-      content: merged.next,
-      scope: doc.scope
+    var table = document.createElement("table");
+    var thead = document.createElement("thead");
+    var hr = document.createElement("tr");
+    ["when", "duration", "turns", "tokens", "exit", "round detail (rounds.jsonl)"].forEach(function (h) {
+      hr.appendChild(el("th", null, h));
     });
-    if (put.status !== "ok") {
-      outcomes.push({
-        key: doc.key,
-        outcome: "failed",
-        detail: `write to the ${doc.scope} row rejected; ${path2} kept for recovery`
-      });
-      continue;
+    thead.appendChild(hr); table.appendChild(thead);
+    var tbody = document.createElement("tbody");
+    var n = Math.max(fires.length, rounds.length);
+    for (var i = n - 1; i >= 0; i--) { // newest first
+      var f = fires[i] || {};
+      var r = rounds[i];
+      var tr = document.createElement("tr");
+      tr.appendChild(el("td", null, f.ts || (r && r.ts) || "\\u2014"));
+      tr.appendChild(el("td", null, f.duration_s != null ? f.duration_s + "s" : "\\u2014"));
+      tr.appendChild(el("td", null, f.turns != null ? String(f.turns) : "\\u2014"));
+      tr.appendChild(el("td", null, f.tokens_total != null ? Number(f.tokens_total).toLocaleString() : "\\u2014"));
+      tr.appendChild(el("td", f.exit === 0 ? "ok" : f.exit != null ? "bad" : null, f.exit != null ? String(f.exit) : "\\u2014"));
+      var detail = el("td");
+      if (f.launch_failed) { detail.textContent = "launch failed \\u2014 " + (f.reason || "unknown reason"); }
+      else if (r) { var pre = document.createElement("pre"); pre.textContent = JSON.stringify(r, null, 1); detail.appendChild(pre); }
+      else detail.textContent = "\\u2014";
+      tr.appendChild(detail);
+      tbody.appendChild(tr);
     }
-    const after = await sdk.loops.memory.getDoc(apiKey, slug, doc.key, { scope: doc.scope });
-    if (after.status !== "ok") {
-      outcomes.push({ key: doc.key, outcome: "shipped", detail: "could not verify it landed" });
-      continue;
+    table.appendChild(tbody);
+    host.appendChild(table);
+  }
+
+  function renderFiles(files) {
+    var host = document.getElementById("files");
+    host.textContent = "";
+    var names = Object.keys(files || {}).filter(function (n) { return n !== "rounds.jsonl"; });
+    if (!names.length) { var p = el("div", "panel"); p.appendChild(el("span", "empty", "No files surfaced by the manifest.")); host.appendChild(p); return; }
+    names.forEach(function (name) {
+      var d = document.createElement("details");
+      d.appendChild(el("summary", null, name));
+      var pre = document.createElement("pre");
+      pre.textContent = files[name];
+      d.appendChild(pre);
+      host.appendChild(d);
+    });
+  }
+
+  function refresh() {
+    fetch("/data").then(function (res) { return res.json(); }).then(function (data) {
+      var fires = parseJsonl(data.state && data.state["fires.jsonl"]);
+      var rounds = parseJsonl(data.files && data.files["rounds.jsonl"]);
+      renderRounds(fires, rounds);
+      renderFiles(data.files);
+      document.getElementById("live").textContent = "updated " + new Date().toLocaleTimeString();
+    }).catch(function () {
+      document.getElementById("live").textContent = "server stopped";
+    });
+  }
+  refresh();
+  setInterval(refresh, 5000);
+})();
+</script>
+</body>
+</html>
+`;
+}
+function injectDefaultDashboard(loop2) {
+  const hasHtml = typeof loop2.dashboardHtml === "string" && loop2.dashboardHtml.trim() !== "";
+  if (hasHtml) return;
+  if (loop2.dashboardManifest && typeof loop2.dashboardManifest === "object") {
+    try {
+      loop2.dashboardManifest = JSON.stringify(loop2.dashboardManifest);
+    } catch {
     }
-    const afterText = after.doc.content ?? "";
-    const missing = merged.addedBlocks.length > 0 ? verifyLanded(afterText, merged.addedBlocks) : afterText === merged.next ? [] : ["<rewrite did not survive>"];
-    outcomes.push(
-      missing.length === 0 ? { key: doc.key, outcome: "shipped" } : {
-        key: doc.key,
-        outcome: "failed",
-        detail: `${missing.length} section(s) did not survive a concurrent write; ${path2} kept`
-      }
-    );
   }
-  return outcomes;
+  const manifest = typeof loop2.dashboardManifest === "string" ? loop2.dashboardManifest : void 0;
+  loop2.dashboardHtml = renderLoopDashboardTemplate({
+    slug: typeof loop2.slug === "string" ? loop2.slug : "loop",
+    descriptionShort: typeof loop2.descriptionShort === "string" ? loop2.descriptionShort : void 0,
+    processSpec: parseProcessSpec(manifest)
+  });
+  if (!manifest || !manifest.trim()) loop2.dashboardManifest = defaultDashboardManifest();
 }
 
 // src/loops/memory-verbs.ts
@@ -118178,6 +118312,27 @@ async function taskMemoryArchiveVerb(rawSlug, opts) {
   );
 }
 
+// src/mcp-server/memory-scope.ts
+init_esm_shims();
+var MEMORY_SCOPE_EXPLANATION = "Global memory: everyone who uses this task (when it is shared) reads and writes the same copy \u2014 edits can conflict and build up over time. Per-member memory: each person who uses it gets their own copy. For a private task the difference doesn't matter. If unsure, choose per-member to avoid conflicts. Examples: a product PBI someone picks up and leaves half-done \u2192 per member; competitor signals the whole workspace should see \u2192 global.";
+function memorySummaryLine(manifest) {
+  const normalized = normalizeMemoryManifest(manifest);
+  const entries = normalized ? [...normalized.docs, ...normalized.records] : [];
+  const global2 = entries.filter((e) => e.scope === "shared").length;
+  const perMember = entries.filter((e) => e.scope === "member").length;
+  if (global2 > 0 && perMember > 0) return `Memory: mixed \u2014 ${global2} global \xB7 ${perMember} per member`;
+  if (global2 > 0) return "Memory: global";
+  if (perMember > 0) return "Memory: per member";
+  return "Memory: none";
+}
+function defaultMemoryManifest() {
+  return { docs: [], records: [{ kind: "run", scope: "member" }] };
+}
+var MEMORY_DEFAULTED_SUFFIX = " (defaulted \u2014 no manifest declared)";
+function declaresNoMemory(manifest) {
+  return memorySummaryLine(manifest ?? null) === "Memory: none";
+}
+
 // src/mcp-server/prompt-descriptors.ts
 init_esm_shims();
 
@@ -118456,6 +118611,15 @@ function buildReceipt(input) {
   if (typeof sent.draft === "boolean") {
     out.push({ field: "draft", action: classify(sent.draft, prev ? prev.draft : void 0) });
   }
+  if (sent.stateDocs !== void 0) {
+    const sentJson = JSON.stringify(sent.stateDocs ?? null);
+    const prevHas = prev !== void 0 && prev.stateDocs !== void 0;
+    const prevJson = prevHas ? JSON.stringify(prev.stateDocs ?? null) : void 0;
+    const action = mode2 === "created" ? "set" : !previous || !previous.available ? "sent" : prevJson === void 0 ? "changed" : sentJson === prevJson ? "unchanged" : "changed";
+    const rec = { field: "stateDocs", action, bytes: Buffer.byteLength(sentJson, "utf8") };
+    if (prevJson !== void 0) rec.previousBytes = Buffer.byteLength(prevJson, "utf8");
+    out.push(rec);
+  }
   return out;
 }
 function deriveChanges(input, receipt) {
@@ -118542,7 +118706,15 @@ function enforceResponseCap(payload) {
   }
   if (size6(out) > MAX_RESPONSE_CHARS && Array.isArray(out.receipt?.fields)) {
     const r = out.receipt;
-    out.receipt = { fieldCount: r.fields.length, note: "receipt omitted \u2014 response cap" };
+    out.receipt = {
+      fieldCount: r.fields.length,
+      note: "receipt omitted \u2014 response cap",
+      // WHERE IT LANDED SURVIVES THE CAP. It is two short strings, and it is the
+      // one line on this receipt whose absence was an incident: shrinking the
+      // response must not be how a caller stops being told which workspace it
+      // just wrote to.
+      ...r.workspace !== void 0 ? { workspace: r.workspace } : {}
+    };
   }
   if (size6(out) > MAX_RESPONSE_CHARS) {
     out.summary = TRUNCATION_MARKER;
@@ -118553,7 +118725,7 @@ function enforceResponseCap(payload) {
 
 // src/mcp-server/delegate-tools.ts
 init_esm_shims();
-import { existsSync as existsSync9, statSync as statSync2 } from "fs";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 import { z as z3 } from "zod";
 
 // src/delegate/jobs.ts
@@ -121047,7 +121219,7 @@ function registerDelegateTools(deps) {
     const validated = validateStartInput(params, {
       isDirectory: (path2) => {
         try {
-          return existsSync9(path2) && statSync2(path2).isDirectory();
+          return existsSync10(path2) && statSync2(path2).isDirectory();
         } catch {
           return false;
         }
@@ -121297,6 +121469,82 @@ function applyResolvedMethod(url2, method, inputs) {
 
 // src/mcp-server/index.ts
 init_plaintext_vault();
+init_paths();
+init_resolve();
+
+// src/mcp-server/identity-reload.ts
+init_esm_shims();
+import { readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+var NO_VAULT = "absent";
+var IDENTITY_CHECK_THROTTLE_MS = 1e3;
+function fingerprintVault(stat) {
+  return stat ? `${stat.mtimeMs}:${stat.size}` : NO_VAULT;
+}
+function statVaultFile(path2) {
+  try {
+    const s = statSync3(path2);
+    return { mtimeMs: s.mtimeMs, size: s.size };
+  } catch {
+    return null;
+  }
+}
+var IdentityWatch = class {
+  vaultPath;
+  now;
+  throttleMs;
+  stat;
+  /** False for an env-supplied key: `poll` is then a guaranteed no-op. */
+  armed;
+  fingerprint;
+  lastCheckedAt = null;
+  constructor(options) {
+    this.vaultPath = options.vaultPath;
+    this.now = options.now ?? Date.now;
+    this.throttleMs = options.throttleMs ?? IDENTITY_CHECK_THROTTLE_MS;
+    this.stat = options.stat ?? statVaultFile;
+    this.armed = options.source !== "env";
+    this.fingerprint = fingerprintVault(this.stat(this.vaultPath));
+  }
+  /** The fingerprint this watch currently considers current. */
+  currentFingerprint() {
+    return this.fingerprint;
+  }
+  /**
+   * One throttled `stat`. Returns the change when the vault file differs from
+   * the fingerprint on record — and ADOPTS it in the same step, so a reload the
+   * caller then fails to apply is not retried on every subsequent tool call.
+   * Returns `null` when nothing changed, when the throttle window is still open,
+   * or when the watch is not armed.
+   */
+  poll() {
+    if (!this.armed) return null;
+    const at = this.now();
+    if (this.lastCheckedAt !== null && at - this.lastCheckedAt < this.throttleMs) return null;
+    this.lastCheckedAt = at;
+    const next = fingerprintVault(this.stat(this.vaultPath));
+    if (next === this.fingerprint) return null;
+    const from14 = this.fingerprint;
+    this.fingerprint = next;
+    return { from: from14, to: next };
+  }
+  /**
+   * The vault bytes this watch is pointed at, or `null` when there is none.
+   *
+   * Reading THROUGH the watch rather than through `loadVault()` is deliberate:
+   * the freshness check and the reload must address the same file, and having
+   * one owner of the path is what makes that true by construction instead of by
+   * two constants agreeing.
+   */
+  readVault() {
+    try {
+      return readFileSync12(this.vaultPath, "utf-8");
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/mcp-server/index.ts
 function buildDeclaredConnectorsSentence(catalog, unreadable) {
   const read = catalog === void 0 ? { connectors: cachedCatalogOrEmpty(), unreadable: mirrorGap() } : { connectors: catalog, unreadable: unreadable ?? [] };
   const gap = describeCatalogGap(read.unreadable);
@@ -121428,6 +121676,8 @@ var loopIndexCache = null;
 var taskIndexCache = null;
 var cardCounts = null;
 var lastNudgeAtCall = null;
+var WORKSPACE_IDENTITY_TTL_MS = 6e4;
+var workspaceIdentityCache = null;
 var sessionId = randomUUID4();
 var mcpEventLogger = null;
 var PROCESSED_APPROVAL_IDS_CAP = 50;
@@ -121524,6 +121774,83 @@ function maybeAppendCardNudge(res, toolName, toolCallIndex) {
   if (next !== res) lastNudgeAtCall = toolCallIndex;
   return next;
 }
+async function resolveWorkspaceIdentity() {
+  const apiKey = currentCredentials.apiKey;
+  if (!apiKey?.trim()) return { companyName: null, employeeName: null };
+  const now = Date.now();
+  if (workspaceIdentityCache && now - workspaceIdentityCache.at < WORKSPACE_IDENTITY_TTL_MS) {
+    return workspaceIdentityCache.value;
+  }
+  let value2 = { companyName: null, employeeName: null };
+  try {
+    const sdk = await getSDK();
+    const me = await sdk.virtualWalletsManagers.getManagerMe(apiKey);
+    value2 = {
+      companyName: typeof me?.companyName === "string" ? me.companyName : null,
+      employeeName: typeof me?.employeeName === "string" ? me.employeeName : null
+    };
+  } catch (err) {
+    console.error(
+      `\u26A0\uFE0F  workspace identity read failed \u2014 reporting nulls: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  workspaceIdentityCache = { at: now, value: value2 };
+  return value2;
+}
+var identityWatch = null;
+function dropIdentityScopedCaches() {
+  walletsCache = null;
+  policiesCache = null;
+  transactionsCache = null;
+  allowlistCache = null;
+  capabilityIndexCache = null;
+  compoundIndexCache = null;
+  loopIndexCache = null;
+  taskIndexCache = null;
+  cardCounts = null;
+  servicesDiscovered = null;
+  workspaceIdentityCache = null;
+  endpointSessionCache.clear();
+}
+async function applyIdentityReload() {
+  const watch = identityWatch;
+  if (!watch) return;
+  const { readVaultAddress: readVaultAddress2 } = await Promise.resolve().then(() => (init_core(), core_exports));
+  const vault = watch.readVault();
+  const nextEoa = vault ? readVaultAddress2(vault) : "";
+  const resolved = await resolveApiKey(cliConfig?.credentialStore ?? "keychain");
+  const previousKey = currentCredentials.apiKey ?? "";
+  const previousEoa = currentCredentials.eoaAddress ?? "";
+  currentCredentials.walletKeystoreJson = vault ?? "";
+  currentCredentials.eoaAddress = nextEoa;
+  currentCredentials.signerAddress = nextEoa;
+  if (resolved.apiKey) currentCredentials.apiKey = resolved.apiKey;
+  refreshPlaintextVaultMode();
+  clearWalletScopedCredentials(currentCredentials);
+  delete currentCredentials.passphrase;
+  delete currentCredentials.wrongPassphraseAttempts;
+  delete currentCredentials.requiresNewPolicy;
+  dropIdentityScopedCaches();
+  console.error(
+    `identity reloaded: ${maskApiKey(previousKey)} -> ${maskApiKey(currentCredentials.apiKey ?? "")}, eoa ${previousEoa || "(none)"} -> ${nextEoa || "(none)"}`
+  );
+}
+async function ensureIdentityFresh() {
+  let change = null;
+  try {
+    change = identityWatch?.poll() ?? null;
+  } catch {
+    return;
+  }
+  if (!change) return;
+  try {
+    await applyIdentityReload();
+  } catch (err) {
+    console.error(
+      `\u26A0\uFE0F  identity reload failed \u2014 continuing with the identity loaded at boot: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
 var __registerTool = server.tool.bind(server);
 server.tool = (def, handler) => __registerTool(
   def,
@@ -121534,6 +121861,7 @@ server.tool = (def, handler) => __registerTool(
     // session, unconditionally. Only `severity: "block"` (an unsupported CLI)
     // still refuses, and that refusal happens inside the gate.
     runToolThroughInterstitialGate(def?.name, async () => {
+      await ensureIdentityFresh();
       const res = await handler(params);
       maybeAutoShareOnToolCall();
       const withNudge = maybeAppendCardNudge(res, def?.name, toolCallCount);
@@ -122248,6 +122576,7 @@ async function initializeCredentials(walletKeystoreJson, eoaAddress, config) {
     currentCredentials.signerAddress = eoaAddress;
     currentCredentials.eoaAddress = eoaAddress;
     currentCredentials.apiKey = config.apiKey;
+    identityWatch = new IdentityWatch({ vaultPath: VAULT_PATH, source: config.apiKeySource ?? null });
     mcpEventLogger = new McpEventLogger(
       () => getSDK(),
       () => currentCredentials.apiKey,
@@ -122467,17 +122796,6 @@ var approvalWaitConfig = (() => {
     delay: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
   };
 })();
-function findCurrentApprovedWallet(wallets, eoaAddress, pendingWalletId) {
-  if (!Array.isArray(wallets)) return void 0;
-  if (pendingWalletId) {
-    return wallets.find(
-      (w) => String(w?.id) === String(pendingWalletId) && w?.status === "approved"
-    );
-  }
-  return wallets.find(
-    (w) => w?.address?.toLowerCase() === eoaAddress?.toLowerCase() && w?.status === "approved"
-  );
-}
 async function tryResolvePendingApproval(probe) {
   if (currentCredentials.authorizationStatus === "approved") return true;
   if (currentCredentials.authorizationStatus !== "pending" || !currentCredentials.apiKey || !currentCredentials.eoaAddress) {
@@ -122615,11 +122933,20 @@ async function applyStartSessionUnlock(passphrase, resetRequested) {
       persistVault: persistVault2,
       wipeVault: wipeVault2,
       sdk,
-      fetchWallets: () => fetchVirtualWalletsFromBackend(currentCredentials.apiKey),
+      // FORCED REFRESH. `start_session` verifies the session's grant against the
+      // backend (see `runStartSession`), and a verification run against the cache
+      // this process loaded at boot verifies nothing: a grant approved since boot
+      // would be invisible to exactly the check that exists to find it.
+      fetchWallets: () => fetchVirtualWalletsFromBackend(currentCredentials.apiKey, true),
       readPolicyActiveOnchain: buildPolicyActiveOnchainReader(sdk)
     }
   );
-  const { walletChanged } = mergeStartSessionCredentials(currentCredentials, result.credentials, result.responseKey);
+  const { walletChanged } = mergeStartSessionCredentials(
+    currentCredentials,
+    result.credentials,
+    result.responseKey,
+    { grantChanged: result.grantChanged }
+  );
   refreshPlaintextVaultMode();
   if (walletChanged) {
     walletsCache = null;
@@ -123086,7 +123413,7 @@ server.tool(
 server.tool(
   {
     name: "getWalletStatus",
-    description: "Get wallet status: auth, balance, policy, allowlist, and the last 10 transactions (amount, merchant, timestamp, status). A transaction `amount` is a EUR display string like `\u20AC0.0126`, or the em dash `\u2014` when the row carries no usable amount (none recorded, or a value that is not a base-units integer) \u2014 `\u2014` means UNKNOWN, never zero. The unformatted base-units value is on `amountRaw`, which is null for exactly those rows.",
+    description: "Get wallet status: auth, balance, policy, allowlist, WHICH WORKSPACE this server is acting in, and the last 10 transactions (amount, merchant, timestamp, status). `workspace` is `{companyName, employeeName}` \u2014 the Ametyst workspace every task, memory document and payment from this server lands in; both fields are null when the profile could not be read, which means UNKNOWN, never 'no workspace'. A transaction `amount` is a EUR display string like `\u20AC0.0126`, or the em dash `\u2014` when the row carries no usable amount (none recorded, or a value that is not a base-units integer) \u2014 `\u2014` means UNKNOWN, never zero. The unformatted base-units value is on `amountRaw`, which is null for exactly those rows.",
     inputs: []
   },
   async () => {
@@ -123118,10 +123445,9 @@ server.tool(
             fetchVirtualWalletsFromBackend(currentCredentials.apiKey, !refreshedFromBackend),
             fetchPoliciesFromBackend(currentCredentials.apiKey, true)
           ]);
-          const freshWallet = freshWallets.find(
-            (w) => w.address?.toLowerCase() === currentCredentials.eoaAddress?.toLowerCase()
-          );
-          if (freshWallet && freshWallet.status === "approved") {
+          const freshWallet = selectNewestApprovedWallet(freshWallets, currentCredentials.eoaAddress);
+          const freshWalletIsActiveGrant = String(freshWallet?.id) === String(currentCredentials.virtualWalletId);
+          if (freshWallet && freshWalletIsActiveGrant) {
             if (freshWallet.policyAssociated != null) {
               currentCredentials.policyId = String(freshWallet.policyAssociated);
             }
@@ -123141,7 +123467,20 @@ server.tool(
         status: currentCredentials.authorizationStatus || "none",
         eoaAddress: currentCredentials.eoaAddress || null,
         walletAddress: currentCredentials.walletAddress || null,
-        kernelClientActive: !!currentCredentials.virtualWalletKernelAccountClient
+        kernelClientActive: !!currentCredentials.virtualWalletKernelAccountClient,
+        // WHICH GRANT THIS SESSION SIGNS WITH. The 2026-09-01 incident — three
+        // approved rows for one EOA, every session silently signing with the oldest
+        // — was invisible in every payload: diagnosing it took a nonce-key autopsy.
+        // These two ids are the row `start_session` actually selected, so the next
+        // stale grant is a field to read rather than a forensic exercise. Null until
+        // a session has adopted one.
+        activeVirtualWalletId: currentCredentials.virtualWalletId != null ? String(currentCredentials.virtualWalletId) : null,
+        activePolicyId: currentCredentials.policyId != null ? String(currentCredentials.policyId) : null,
+        // WHICH WORKSPACE THIS IS. The 2026-08-31 incident produced writes into
+        // the wrong workspace with nothing in any payload naming one — an agent
+        // reading wallet status could not have told, and neither could a human
+        // reading the transcript afterwards. Nulls when `me` could not be read.
+        workspace: await resolveWorkspaceIdentity()
       };
       if (policiesCache && currentCredentials.policyId) {
         const policy = policiesCache.find((p) => p.id === parseInt(currentCredentials.policyId, 10));
@@ -123150,7 +123489,7 @@ server.tool(
         }
       }
       if (walletsCache && currentCredentials.eoaAddress) {
-        const wallet = walletsCache.find(
+        const wallet = selectNewestApprovedWallet(walletsCache, currentCredentials.eoaAddress) ?? walletsCache.find(
           (w) => w.address?.toLowerCase() === currentCredentials.eoaAddress?.toLowerCase()
         );
         if (wallet) {
@@ -123597,6 +123936,7 @@ async function resolveTasksCore(params, flavor) {
           if (slug && flavor.fetchManifest) {
             const manifest = await flavor.fetchManifest(sdk, currentCredentials.apiKey, slug);
             if (manifest) payload.stateDocs = manifest;
+            if (manifest !== void 0) payload.memory = memorySummaryLine(manifest);
           }
         }
       }
@@ -123642,6 +123982,7 @@ function taskMemoryBlock(slug, docKey) {
   };
 }
 var liveDashboards = /* @__PURE__ */ new Map();
+var LIVE_DASHBOARD_WATCH_MS = 15e3;
 function closeAllLiveDashboards() {
   for (const h of liveDashboards.values()) {
     try {
@@ -123669,6 +124010,22 @@ async function startLiveDashboard(entity, dir) {
     });
     if (!handle) return null;
     liveDashboards.set(slug, handle);
+    const watcher = setInterval(() => {
+      if (liveDashboards.get(slug) !== handle) {
+        clearInterval(watcher);
+        return;
+      }
+      if (!existsSync12(dir)) {
+        clearInterval(watcher);
+        liveDashboards.delete(slug);
+        try {
+          handle.close();
+        } catch {
+        }
+        console.error(`(live dashboard for ${slug} closed \u2014 run folder ${dir} is gone)`);
+      }
+    }, LIVE_DASHBOARD_WATCH_MS);
+    watcher.unref?.();
     const url2 = `http://localhost:${handle.port}`;
     openDashboardInBrowser(url2, { isTTY: true });
     return url2;
@@ -123733,6 +124090,9 @@ async function runTaskCore(params, flavor) {
     }
     const memoryDocKey = defaultDocKey(normalizeMemoryManifest(entity?.stateDocs ?? null));
     const materialized = flavor.materialize(entity, randomUUID4());
+    const docBoot = await materializeMemoryDocs(sdk, apiKey, entity, materialized.dir);
+    for (const note of docBoot.notes) console.error(`(${entity.slug} memory docs: ${note})`);
+    const runFiles = { ...materialized.files, ...docBoot.files };
     const est = estimateBlastRadius(entity);
     const shipBack = flavor.buildShipBack({ dir: materialized.dir, entity });
     const dashboardUrl = await startLiveDashboard(entity, materialized.dir);
@@ -123744,14 +124104,14 @@ async function runTaskCore(params, flavor) {
       dir: materialized.dir,
       ...dashboardUrl ? { dashboard: dashboardUrl } : {},
       blastRadius: est,
-      files: materialized.files,
+      files: runFiles,
       ...materialized.skipped ? { skippedEmptyFiles: materialized.skipped } : {},
       // The run's durable memory (loop-memory-primitive). `dir` dies with the run, so
       // anything the NEXT run needs has to be written here instead. Named explicitly with
       // the slug because the run context carries no task identity — which is exactly why
       // the taskMemory* tools take an explicit `taskSlug`.
       memory: taskMemoryBlock(entity.slug, memoryDocKey),
-      directive: flavor.buildDirective({ dir: materialized.dir, slug: entity.slug, files: materialized.files, docKey: memoryDocKey }),
+      directive: flavor.buildDirective({ dir: materialized.dir, slug: entity.slug, files: runFiles, docKey: memoryDocKey }),
       ...shipBack ? { shipBack } : {}
     }) }, { type: "text", text: dashboardLine }] };
   } catch (error) {
@@ -124281,7 +124641,7 @@ async function upsertTaskCore(params, flavor) {
         return { available: false, reason: err instanceof Error ? err.message : String(err) };
       }
     };
-    const upsert = async (entity, sourcePaths = {}) => {
+    const upsert = async (entity, sourcePaths = {}, memoryDefaulted = false) => {
       if (!id && flavor.injectDashboardOnCreate) {
         try {
           injectDefaultDashboard(entity);
@@ -124293,6 +124653,7 @@ async function upsertTaskCore(params, flavor) {
       if (res.status === "ok") {
         void refreshDynamicPrompts();
         const mode2 = id ? "modified" : "created";
+        const effectiveManifest = "stateDocs" in entity ? entity.stateDocs : !id ? null : previous && previous.available ? previous.content.stateDocs ?? null : void 0;
         const summary = buildLoopUpsertSummary({
           mode: mode2,
           sent: entity,
@@ -124303,7 +124664,26 @@ async function upsertTaskCore(params, flavor) {
           success: true,
           mode: mode2,
           [flavor.responseKey]: projectLoopIdentity(flavor.pick(res)),
-          receipt: { fields: summary.receipt },
+          // WHERE IT LANDED, on the receipt itself. The 2026-08-31 incident put a
+          // task into the wrong (admin) workspace and the success payload named
+          // no workspace at all, so neither the agent nor the human reading the
+          // transcript afterwards could tell. Nulls when `me` could not be read —
+          // unknown, never a guess.
+          receipt: {
+            fields: summary.receipt,
+            workspace: await resolveWorkspaceIdentity(),
+            // WHERE THE TASK'S MEMORY LANDED, said in the user's vocabulary rather than left
+            // implicit in the manifest bytes. `effectiveManifest` is what the task HAS after
+            // this call: what this call sent, or — on a MODIFY that did not send one — the
+            // stored manifest the diff already read. Never a fourth read.
+            //
+            // ⛔ THE FLOOR IS NAMED, NOT HIDDEN. When the default fired the line still reports
+            // where the memory landed (`Memory: per member` — it really is per member), with a
+            // suffix saying the author declared nothing. A receipt printing the bare line would
+            // present the floor as an authored choice, which is the one thing this injection
+            // must never be allowed to look like.
+            ...effectiveManifest !== void 0 ? { memory: memorySummaryLine(effectiveManifest) + (memoryDefaulted ? MEMORY_DEFAULTED_SUFFIX : "") } : {}
+          },
           summary: summary.text,
           summaryTruncated: summary.truncated,
           // ON CREATE ONLY. A task lands PRIVATE to the author, and the one step
@@ -124394,8 +124774,13 @@ async function upsertTaskCore(params, flavor) {
         }
         stateDocs = checked.manifest;
       }
+      let memoryDefaulted = false;
+      if (!id && declaresNoMemory(stateDocs)) {
+        stateDocs = defaultMemoryManifest();
+        memoryDefaulted = true;
+      }
       const body = { ...resolvedMd };
-      if (stateDocsProvided) body.stateDocs = stateDocs;
+      if (stateDocsProvided || memoryDefaulted) body.stateDocs = stateDocs;
       if (slug) body.slug = slug;
       if (descriptionShort) body.descriptionShort = descriptionShort;
       if (markdownBody) body.markdownBody = markdownBody;
@@ -124410,7 +124795,7 @@ async function upsertTaskCore(params, flavor) {
           sourcePaths[mdKey] = params[fileKey].trim();
         }
       }
-      return await upsert(body, sourcePaths);
+      return await upsert(body, sourcePaths, memoryDefaulted);
     }
     const hasMessages = typeof params.messages === "string" && params.messages.trim();
     const hasBrief = typeof params.brief === "string" && params.brief.trim();
@@ -124435,7 +124820,7 @@ async function upsertTaskCore(params, flavor) {
 server.tool(
   {
     name: "createTask",
-    description: "Create OR modify a workspace TASK (upsert). A task is the unified card \u2014 what used to be published as either a 'compound skill' or a 'loop' is ONE row now, so this ONE tool authors both: a task with only a `markdownBody` is what a compound was, a task that also carries visionMd/constraintsMd/readmeMd is what a loop was. Pass `id` to MODIFY, omit it to CREATE. MODIFY IS A NO-CLOBBER PATCH: send `id` plus ONLY the field(s) you want to change \u2014 any of markdownBody/visionMd/constraintsMd/readmeMd/dashboardHtml/dashboardManifest/stateDocs/descriptionShort/category/draft/graphJson \u2014 fields you don't send are preserved, so a constraints-only ship-back never has to resend the body. VERBATIM BODIES: for any LONG markdown field, WRITE it to a local file first and pass the matching *FilePath (`filePath` for the body, `visionFilePath`/`constraintsFilePath`/`readmeFilePath`/`dashboardHtmlFilePath`/`dashboardManifestFilePath`) INSTEAD of inlining it \u2014 the local MCP server reads the bytes from disk and pushes them verbatim (no arg-size limit, no drift). RESPONSE: a closing `summary` derived strictly from the published content (never invented) plus a compact `receipt` of per-field byte counts and source paths; the full bodies are NOT echoed back. NOT AN AUTHORING TOOL: it publishes what you give it. To create, publish or audit a task, run `task-architect` first \u2014 this tool is only the final upsert it performs. NOTE: if the user's intent is to publish/upload/import local skills to Ametyst, call getTask FIRST to fetch the `task-architect` task \u2014 it contains the publish procedure to follow before using this tool. MEMORY: `stateDocs` is the task's memory manifest \u2014 which memory docs / record kinds it owns and whether each is `shared` by the workspace or per-`member`; the runner creates the declared docs at boot and ships each back to its declared namespace. DASHBOARD: createTask does NOT inject a default monitoring page on create \u2014 pass `dashboardHtml` if the task wants one.",
+    description: "Create OR modify a workspace TASK (upsert). A task is the unified card \u2014 what used to be published as either a 'compound skill' or a 'loop' is ONE row now, so this ONE tool authors both: a task with only a `markdownBody` is what a compound was, a task that also carries visionMd/constraintsMd/readmeMd is what a loop was. Pass `id` to MODIFY, omit it to CREATE. MODIFY IS A NO-CLOBBER PATCH: send `id` plus ONLY the field(s) you want to change \u2014 any of markdownBody/visionMd/constraintsMd/readmeMd/dashboardHtml/dashboardManifest/stateDocs/descriptionShort/category/draft/graphJson \u2014 fields you don't send are preserved, so a constraints-only ship-back never has to resend the body. VERBATIM BODIES: for any LONG markdown field, WRITE it to a local file first and pass the matching *FilePath (`filePath` for the body, `visionFilePath`/`constraintsFilePath`/`readmeFilePath`/`dashboardHtmlFilePath`/`dashboardManifestFilePath`) INSTEAD of inlining it \u2014 the local MCP server reads the bytes from disk and pushes them verbatim (no arg-size limit, no drift). RESPONSE: a closing `summary` derived strictly from the published content (never invented) plus a compact `receipt` of per-field byte counts and source paths; the full bodies are NOT echoed back. NOT AN AUTHORING TOOL: it publishes what you give it. To create, publish or audit a task, run `task-architect` first \u2014 this tool is only the final upsert it performs. NOTE: if the user's intent is to publish/upload/import local skills to Ametyst, call getTask FIRST to fetch the `task-architect` task \u2014 it contains the publish procedure to follow before using this tool. MEMORY: `stateDocs` is the task's memory manifest \u2014 which memory docs / record kinds it owns and whether each is `shared` by the workspace or per-`member`; the runner creates the declared docs at boot and ships each back to its declared namespace. \u26D4 THE SCOPE CHOICE IS THE USER'S, NOT YOURS: BEFORE you create or modify a task that carries a memory manifest, EXPLAIN THE CHOICE TO THEM in your own words \u2014 never as `stateDocs` or `scope` \u2014 covering all of the following, and ASK them when their intent is ambiguous instead of deciding for them. Quote it verbatim if that is clearer; never contradict it: \"" + MEMORY_SCOPE_EXPLANATION + '" The response says which one the task ended up with, as a `memory` line on the receipt (`Memory: global` / `Memory: per member` / `Memory: mixed \u2014 N global \xB7 M per member` / `Memory: none`); getTask carries the same line. \u26D4 DECLARING THE MANIFEST IS EXPECTED ON EVERY TASK: a CREATE that declares none \u2014 or a declared-empty one \u2014 is given a floor rather than being born with no memory (the run diary, per member: `{"docs":[],"records":[{"kind":"run","scope":"member"}]}`), and the receipt says so with `(defaulted \u2014 no manifest declared)`, but that floor is a backstop and NOT a substitute for deriving the manifest this task actually needs and explaining the scope choice to the user first. DASHBOARD: createTask does NOT inject a default monitoring page on create \u2014 pass `dashboardHtml` if the task wants one.',
     inputs: [
       { name: "slug", type: "string", required: false, description: "URL-safe unique slug for the task within the workspace. Required on CREATE." },
       { name: "descriptionShort", type: "string", required: false, description: "One-line description of what the task does. Required on CREATE." },
@@ -124451,7 +124836,7 @@ server.tool(
       { name: "dashboardHtmlFilePath", type: "string", required: false, description: "Path to a local file read verbatim as the dashboard HTML. Takes precedence over `dashboardHtml`." },
       { name: "dashboardManifest", type: "string", required: false, description: `JSON (as text) naming which materialized files the dashboard's /data endpoint surfaces (e.g. {"files":["STATUS.md"]}).` },
       { name: "dashboardManifestFilePath", type: "string", required: false, description: "Path to a local file read verbatim as the dashboard manifest. Takes precedence over `dashboardManifest`." },
-      { name: "stateDocs", type: "string", required: false, description: 'THE MEMORY MANIFEST \u2014 JSON TEXT: `{"docs":[{"key":"board","scope":"shared"}],"records":[{"kind":"run","scope":"member"}]}`. It declares WHICH memory documents and record kinds this task owns and WHERE each one lives: `scope` is `shared` (ONE row for the whole workspace \u2014 every member reads and writes the same document) or `member` (one row PER SEAT \u2014 each member has their own). `records[].kind` is a RESERVED diary kind (run | decision | error | import \u2014 always accepted by the server, declared or not; declaring one only fixes its scope) or a FREE item kind the task invents (a token [a-z0-9-]{1,64}, e.g. `pbi`, `test`, `needs-patrick` \u2014 keyed, versioned, closed with taskMemoryArchive; see the TASK MEMORY MODEL in your instructions). Both arrays are REQUIRED and may be empty (`{"docs":[],"records":[]}` = this task keeps no memory). \u26D4 A STRING, ALWAYS: send the JSON object as text, `"null"` to clear an existing manifest, and omit the field to leave it untouched; a bare object or a bare null is REJECTED by this tool\'s input schema before the call runs, and an EMPTY STRING is treated exactly like omitting the field. WHAT THE RUNNER DOES WITH IT: at boot every declared doc is read from its declared namespace and CREATED there (empty) if it does not exist yet \u2014 a `member` doc is seeded from the `shared` row of the same key when one exists \u2014 and materialized as `<key>.md`; at exit each changed doc is shipped back to the SAME namespace. A write through taskMemoryAppend to a declared key/kind needs no scope (the server resolves it and refuses a disagreeing one). RULES, enforced here AND by the server (the call fails and the task is neither created nor modified): `key` is a safe basename of 1..128 chars (no `/`, `\\`, no leading dot), unique case-insensitively, and NOT one of the seven files the runner writes itself (SKILL.md, VISION.md, CONSTRAINTS.md, README.md, STATUS.md, dashboard.html, dashboard.manifest.json \u2014 with or without `.md`); at most 64 docs and 16 records, one entry per kind. The manifest has NO archive section \u2014 an archived item is the same kind in the same namespace with archived: true. The retired array shape (`[{key, filename, \u2026}]`, including `"[]"`) is INVALID. \u26D4 DERIVE the manifest from what the task actually needs to remember between runs and who needs to see it \u2014 a board the whole team works is `shared`, a personal cursor is `member` \u2014 and explain it to the author IN THEIR WORDS ("everyone on the team sees the same to-do list"), never as `stateDocs` or `scope`.' },
+      { name: "stateDocs", type: "string", required: false, description: 'THE MEMORY MANIFEST \u2014 JSON TEXT: `{"docs":[{"key":"board","scope":"shared"}],"records":[{"kind":"run","scope":"member"}]}`. It declares WHICH memory documents and record kinds this task owns and WHERE each one lives: `scope` is `shared` (ONE row for the whole workspace \u2014 every member reads and writes the same document) or `member` (one row PER SEAT \u2014 each member has their own). `records[].kind` is a RESERVED diary kind (run | decision | error | import \u2014 always accepted by the server, declared or not; declaring one only fixes its scope) or a FREE item kind the task invents (a token [a-z0-9-]{1,64}, e.g. `pbi`, `test`, `needs-patrick` \u2014 keyed, versioned, closed with taskMemoryArchive; see the TASK MEMORY MODEL in your instructions). Both arrays are REQUIRED and may be empty (`{"docs":[],"records":[]}` = this task keeps no memory). \u26D4 A STRING, ALWAYS: send the JSON object as text, `"null"` to clear an existing manifest, and omit the field to leave it untouched; a bare object or a bare null is REJECTED by this tool\'s input schema before the call runs, and an EMPTY STRING is treated exactly like omitting the field. WHAT THE RUNNER DOES WITH IT: at boot every declared doc is read from its declared namespace and CREATED there (empty) if it does not exist yet \u2014 a `member` doc is seeded from the `shared` row of the same key when one exists \u2014 and materialized as `<key>.md`; at exit each changed doc is shipped back to the SAME namespace. A write through taskMemoryAppend to a declared key/kind needs no scope (the server resolves it and refuses a disagreeing one). RULES, enforced here AND by the server (the call fails and the task is neither created nor modified): `key` is a safe basename of 1..128 chars (no `/`, `\\`, no leading dot), unique case-insensitively, and NOT one of the seven files the runner writes itself (SKILL.md, VISION.md, CONSTRAINTS.md, README.md, STATUS.md, dashboard.html, dashboard.manifest.json \u2014 with or without `.md`); at most 64 docs and 16 records, one entry per kind. The manifest has NO archive section \u2014 an archived item is the same kind in the same namespace with archived: true. The retired array shape (`[{key, filename, \u2026}]`, including `"[]"`) is INVALID. \u26D4 DERIVE the manifest from what the task actually needs to remember between runs and who needs to see it \u2014 a board the whole team works is `shared`, a personal cursor is `member` \u2014 and explain it to the author IN THEIR WORDS ("everyone on the team sees the same to-do list"), never as `stateDocs` or `scope`. \u26D4 AND YOU DO THAT BEFORE THIS CALL, NOT AFTER \u2014 the choice is the user\'s: cover all of this with them, and ASK when their intent is ambiguous instead of deciding for them. "' + MEMORY_SCOPE_EXPLANATION + '"' },
       { name: "graphJson", type: "string", required: false, description: "JSON string of the canvas node graph (for re-edit). Defaults to {} on create." },
       { name: "draft", type: "boolean", required: false, description: "Whether the task is a draft (excluded from discovery). Defaults to true on create." },
       { name: "category", type: "string", required: false, description: "Free-text category for browsing/filtering (e.g. 'research'). Must be explicit \u2014 the tool asks rather than guessing." },
@@ -125469,9 +125854,7 @@ async function reconcileApprovalStateOnConnect() {
   }
   try {
     const wallets = await fetchVirtualWalletsFromBackend(currentCredentials.apiKey, true);
-    const approved = wallets.find(
-      (w) => w.address?.toLowerCase() === currentCredentials.eoaAddress?.toLowerCase() && w.status === "approved"
-    );
+    const approved = selectNewestApprovedWallet(wallets, currentCredentials.eoaAddress);
     if (!approved) return;
     if (typeof approved.id === "number" && hasProcessedApprovalEventId(approved.id)) return;
     console.error(
@@ -125809,14 +126192,14 @@ function killPreviousServeInstances(deps) {
 
 // src/commands/autosync-skills.ts
 init_esm_shims();
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join18 } from "path";
 
 // src/compounds/sync-skills.ts
 init_esm_shims();
 init_paths();
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync12, rmSync, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync13, rmSync, writeFileSync as writeFileSync10 } from "fs";
 import { join as join17 } from "path";
 var MANAGED_MARKER = "<!-- ametyst-managed: sync-skills -->";
 var GITIGNORE_HEADER = "# ametyst-managed: sync-skills \u2014 pointer skills generated for this account; never commit them.";
@@ -125861,7 +126244,7 @@ ${taskRunSection(slug, kind)}`;
 }
 function isManaged(file) {
   try {
-    return readFileSync12(file, "utf8").includes(MANAGED_MARKER);
+    return readFileSync13(file, "utf8").includes(MANAGED_MARKER);
   } catch {
     return false;
   }
@@ -125875,8 +126258,8 @@ function buildGitignoreContent(managedSlugs) {
 function maintainGitignore(root2) {
   const file = join17(root2, ".gitignore");
   const managed = listManagedDirs(root2);
-  if (existsSync11(file)) {
-    const current = readFileSync12(file, "utf8");
+  if (existsSync13(file)) {
+    const current = readFileSync13(file, "utf8");
     const firstLine = current.split(/\r?\n/, 1)[0];
     if (firstLine !== GITIGNORE_HEADER) {
       console.error(
@@ -125939,7 +126322,7 @@ async function syncSkills(opts = {}) {
   const skipped = [];
   for (const [dir, item] of desired) {
     const file = join17(dir, "SKILL.md");
-    if (existsSync11(file) && !isManaged(file)) {
+    if (existsSync13(file) && !isManaged(file)) {
       skipped.push(item.slug);
       console.warn(`\u26A0\uFE0F  sync-skills: skipping "${item.slug}" \u2014 an unmanaged skill already exists at ${file}`);
       continue;
@@ -125967,7 +126350,7 @@ function isSkillsAutosyncEnabled(env = process.env) {
   return !(raw === "0" || raw === "false" || raw === "off" || raw === "no");
 }
 function detectPresentTargets(deps = {}) {
-  const exists = deps.existsSync ?? existsSync12;
+  const exists = deps.existsSync ?? existsSync14;
   const cwd = deps.cwd ?? (() => process.cwd());
   const home = deps.homedir ?? homedir12;
   const targets = [];
@@ -126047,7 +126430,7 @@ async function serveCommand() {
   console.error(
     persisted ? isPlaintextVault(persisted) ? "Starting MCP server... (persisted UNENCRYPTED wallet found \u2014 always unlocked, no start_session needed)" : "Starting MCP server... (persisted wallet found \u2014 unlock with start_session)" : "Starting MCP server... (no saved wallet \u2014 one will be created on start_session)"
   );
-  await startMCPServer(keystore, eoa, { ...config, apiKey }, versionNotice, {
+  await startMCPServer(keystore, eoa, { ...config, apiKey, apiKeySource: resolved.source ?? void 0 }, versionNotice, {
     // Best-effort: materialize local `/`-command pointer skills for every published
     // compound + loop so they're available without a manual `compound sync-skills`.
     // Deferred from boot to the MCP initialize handshake so the sync is CLIENT-AWARE:
@@ -126986,7 +127369,7 @@ function recordFailedLaunch(args) {
 init_esm_shims();
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname8, join as join23 } from "path";
 
 // src/loops/claude-binary.ts
@@ -127178,7 +127561,7 @@ async function runLoop(loopId, opts = {}) {
     `Loop ${loop2.slug}: ${est.steps} steps (${est.paidSteps} paid), est \u20AC${est.estCostEur ?? "?"} \u2014 ${capLabel}`
   );
   const statusPath = join23(dir, "STATUS.md");
-  const statusBefore = existsSync13(statusPath) ? readFileSync13(statusPath, "utf-8") : "";
+  const statusBefore = existsSync15(statusPath) ? readFileSync14(statusPath, "utf-8") : "";
   writeFileSync12(
     statusPath,
     statusBefore.replace(
@@ -127238,7 +127621,7 @@ blast_radius: steps=${est.steps} paid=${est.paidSteps} estEur=${est.estCostEur ?
   async function shipConstraints() {
     try {
       const constraintsPath = join23(dir, "CONSTRAINTS.md");
-      const materializedConstraints = existsSync13(constraintsPath) ? readFileSync13(constraintsPath, "utf-8") : void 0;
+      const materializedConstraints = existsSync15(constraintsPath) ? readFileSync14(constraintsPath, "utf-8") : void 0;
       if (materializedConstraints === void 0) return;
       const boot = loop2.constraintsMd ?? "";
       for (let attempt = 1; attempt <= 2; attempt++) {
@@ -127349,7 +127732,7 @@ blast_radius: steps=${est.steps} paid=${est.paidSteps} estEur=${est.estCostEur ?
       startedAtEpochMs
     });
   }
-  const statusAfter = existsSync13(statusPath) ? readFileSync13(statusPath, "utf-8") : "";
+  const statusAfter = existsSync15(statusPath) ? readFileSync14(statusPath, "utf-8") : "";
   const clean2 = exitCode === 0 && /(vision\s*done|queue\s*drained|status:\s*done)/i.test(statusAfter) && !/(brake|crash|crashed|errored)/i.test(statusAfter);
   await shipBackConstraints();
   process.off("SIGINT", onSignal);
@@ -127387,7 +127770,7 @@ async function showLoop(loopId) {
 // src/loops/schedule.ts
 init_esm_shims();
 init_paths();
-import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync11, rmSync as rmSync3, existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync14, accessSync as accessSync2, constants as constants2 } from "fs";
+import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync11, rmSync as rmSync3, existsSync as existsSync16, readdirSync as readdirSync5, readFileSync as readFileSync15, accessSync as accessSync2, constants as constants2 } from "fs";
 import { execFileSync as execFileSync4 } from "child_process";
 import { join as join24, dirname as dirname9 } from "path";
 import { homedir as homedir14 } from "os";
@@ -127467,7 +127850,7 @@ function isLoaded(lbl) {
 }
 function readInteractiveDefaultModel(home) {
   try {
-    const raw = readFileSync14(join24(home, ".claude", "settings.json"), "utf-8");
+    const raw = readFileSync15(join24(home, ".claude", "settings.json"), "utf-8");
     const model = JSON.parse(String(raw)).model;
     return typeof model === "string" && model.trim() ? model.trim() : void 0;
   } catch {
@@ -127695,7 +128078,7 @@ function list(kind, opts = {}) {
   const prefix = kind.labelPrefix;
   if (platform === "darwin") {
     const dir = join24(home, "Library", "LaunchAgents");
-    if (!existsSync14(dir)) return [];
+    if (!existsSync16(dir)) return [];
     return readdirSync5(dir).filter((f) => f.startsWith(prefix) && f.endsWith(".plist")).map((f) => f.slice(prefix.length, -".plist".length));
   }
   return readCrontab().split("\n").filter((l) => l.includes(`# ${prefix}`)).map((l) => l.trimEnd().slice(l.trimEnd().lastIndexOf(prefix) + prefix.length));
@@ -127757,12 +128140,12 @@ function listEntries(kind, opts = {}) {
   const prefix = kind.labelPrefix;
   if (platform === "darwin") {
     const dir = join24(home, "Library", "LaunchAgents");
-    if (!existsSync14(dir)) return [];
+    if (!existsSync16(dir)) return [];
     return readdirSync5(dir).filter((f) => f.startsWith(prefix) && f.endsWith(".plist")).map((f) => {
       const slug = f.slice(prefix.length, -".plist".length);
       let envKeys = [];
       try {
-        envKeys = plistEnvKeys(String(readFileSync14(join24(dir, f), "utf-8")));
+        envKeys = plistEnvKeys(String(readFileSync15(join24(dir, f), "utf-8")));
       } catch {
         envKeys = [];
       }