@bendyline/gezel-service 1.0.0 → 1.0.2

package/dist/handboek-content/README.md

@@ -50,7 +50,7 @@ Body prose…
 
   `whats-new/` inverts this to get newest-first: a release article's order is
 
-  the negated calendar line, so `1.26223` carries `order: -26223`, and the
+  the negated calendar line, so `1.26224` carries `order: -26224`, and the
 
   section index sits at `-999999`. Nothing else needs touching when a release
 

package/dist/handboek-content/whats-new/{1.26223.md → 1.26224.md}

@@ -1,13 +1,13 @@
 ---
-id: whats-new/1.26223
-title: 1.26223 — 11 August 2026
-order: -26223
+id: whats-new/1.26224
+title: 1.26224 — 12 August 2026
+order: -26224
 summary: Measured model scores, per-model memory controls, editable Office documents, and much stricter rules about what a gezel may install.
 ---
 
-# 1.26223 — 11 August 2026
+# 1.26224 — 12 August 2026
 
-This is the first release with written release notes, so it covers everything since **1.26219** on 7 August. It is a big one: four days of work, and most of it is visible the moment you open the app.
+This is the first release with written release notes, so it covers everything since **1.26219** on 7 August. 
 
 If you read only one thing: gezel now publishes **measured scores** for the models it ships, your gezellen are much more tightly fenced in about what they may install on your machine, and Word, PowerPoint, Excel and PDF files in a project can now be edited as ordinary text.
 
@@ -21,7 +21,7 @@ The first published set covers four models measured on an M4 Max: gemma4-e4b, ge
 
 Two rules keep the board honest. A model that was only partly measured is **withheld** rather than shown with a flattering gap, and earlier rounds of testing are kept visible separately instead of being quietly overwritten.
 
-## Your gezellen are on a shorter leash
+## Your gezellen are better managed
 
 A gezel that can install software is useful. A gezel that can install *anything, anywhere* is not something you should have to think about. This release closes that gap.
 

package/dist/handboek-content/whats-new/whats-new-index.md

@@ -13,14 +13,6 @@ Gezel changes often. This section is the running record of those changes, one ar
 
 ::handboek-whats-new-list
 
-Each article is written for the person using gezel, not for the person who wrote the code. It says what is different now, what you can do that you could not do before, and what — if anything — you need to do about it. Where a change is only interesting to developers, it is marked as such so you can skip it.
-
-## How to read a version number
-
-A gezel version looks like **1.26223.47**. The middle part is the date: `26` is the year 2026, and `223` is the day of that year — so `26223` is 11 August 2026. The last part is the build number for that day. You can always tell how old your copy of gezel is by reading the middle number.
-
-Your installed version is shown in **Settings → About**.
-
 ## Updating
 
 Packaged installs check for new releases on their own and offer the update when one is ready. Nothing in your work is touched by an update: your gezellen, projects, threads, memories and files all live in ordinary files on your disk, and a new version simply reads the same files.

package/dist/handboek.d.ts

@@ -76,7 +76,7 @@ interface CuratedArticle {
 declare function findHandboekContent(): string | null;
 /**
  * Release-note articles, newest first. Release `order` is the negated
- * calendar line (`1.26223` → `-26223`), so the area's own ascending sort
+ * calendar line (`1.26224` → `-26224`), so the area's own ascending sort
  * already puts the newest release on top; this only drops the section
  * index out of the list it introduces.
  */

package/dist/handboek.js

@@ -356,6 +356,7 @@ var VOORMAN_STRIPPED_MEESTER_TOOLS = /* @__PURE__ */ new Set([
   "list_gilde",
   "list_projects",
   "start_project",
+  "start_project_from_type",
   "start_job",
   "fetch_repo",
   "fetch_diff"
@@ -516,7 +517,11 @@ var EXTERNAL_SERVICE_TOOLS = /* @__PURE__ */ new Set([
   // can neither sync-driven-send nor draft outbound while locked down.
   "draft_email",
   "queue_email",
-  "send_email"
+  "send_email",
+  // Social post draft/publish are the same class of outbound agency.
+  "draft_post",
+  "queue_post",
+  "publish_post"
 ]);
 function applySecurityPolicyGates(allow, policy, stripWorkspaceWrite) {
   const policyClear = !policy || policy.allowExternalServices && policy.allowScriptExecution && policy.allowModelGit;

package/dist/index-store/static-index-worker.js

@@ -1012,7 +1012,7 @@ import { mkdtemp, realpath as realpath3, rm as rm2, writeFile as writeFile2 } fr
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute2, join as join3 } from "path";
 import { pathToFileURL } from "url";
-import { windowsDetachedSpawnOptions } from "@bendyline/gezel/native";
+import { windowsHeadlessSpawnOptions } from "@bendyline/gezel/native";
 
 // src/sandbox/macos.ts
 function runUnderMacSandbox(command, args, ctx, opts = {}) {
@@ -1161,11 +1161,9 @@ async function readNodeHelp(nodeBin) {
     const child = spawn2(nodeBin, ["--help"], {
       stdio: ["ignore", "pipe", "pipe"],
       env: sandboxEnv(process.env),
-      // Bundled Node is a console-subsystem executable and the Session 0
-      // machine service can allocate no console — so even this capability
-      // probe starts with DETACHED_PROCESS. `windowsHide`
-      // (CREATE_NO_WINDOW) does not do that; it still allocates.
-      ...windowsDetachedSpawnOptions()
+      // The capability probe is owned and awaited. Hide its Windows console
+      // rather than giving the short-lived process a detached one.
+      ...windowsHeadlessSpawnOptions()
     });
     let stdout = "";
     let stderr = "";
@@ -1187,16 +1185,11 @@ async function runSandboxChild(command, args, opts) {
     const child = spawn2(command, args, {
       cwd: opts.cwd,
       stdio: opts.rpcChannel ? ["pipe", "pipe", "pipe", "pipe"] : ["pipe", "pipe", "pipe"],
-      // Keep sandbox children out of the Vitest/service process
-      // group. Workspace commands already do this; doing the same
-      // here prevents an unrelated process-group kill from closing a
-      // short-lived derive/script child with a null exit code.
-      // On Windows the same option is DETACHED_PROCESS, which also keeps a
-      // console-subsystem child from asking the Session 0 service for a
-      // console it cannot allocate — `windowsHide` (CREATE_NO_WINDOW) does
-      // not, because it still allocates one. `taskkill /T` is unaffected:
-      // detaching changes console and process group, not the recorded parent.
-      detached: true,
+      // A separate process group is useful on POSIX for group termination.
+      // Windows tree cleanup follows parent PIDs instead, so detaching there
+      // only creates a new console window; keep it owned and hidden.
+      detached: process.platform !== "win32",
+      ...windowsHeadlessSpawnOptions(),
       // Allowlist-scrub the env — inheriting everything leaked tokens
       // (GEZEL_TOKEN, OPENAI_API_KEY, GITHUB_PERSONAL_ACCESS_TOKEN,
       // etc.) into the sandboxed script, letting it `fetch` them
@@ -2933,6 +2926,21 @@ var IndexStore = class _IndexStore {
            state='failed', attempts=COALESCE(shadow_state.attempts, 0) + 1,
            updated_at=excluded.updated_at`
     ).run(contentHash, this.collectionId, filePath, nowIso());
+    return Number(
+      this.db.prepare("SELECT attempts FROM shadow_state WHERE content_hash = ?").get(contentHash)?.attempts ?? 1
+    );
+  }
+  /**
+   * Terminally skip a media hash the AI-shadow tier can never process — a
+   * format with no raster decoder in the vision stack (SVG is vector, ICO is
+   * multi-frame). Jumps straight to the attempt cap under a distinct state so
+   * the row reads as "wrong tool", not "engine flaked three times".
+   */
+  markAiShadowUnsupported(contentHash, filePath) {
+    this.db.prepare(
+      `INSERT OR REPLACE INTO shadow_state (content_hash, collection_id, file_path, state, attempts, updated_at)
+         VALUES (?, ?, ?, 'unsupported', ${MAX_ENRICH_ATTEMPTS}, ?)`
+    ).run(contentHash, this.collectionId, filePath, nowIso());
   }
   /**
    * Enrichment coverage counts. `summarized` counts real summaries (join on
@@ -3346,6 +3354,24 @@ var IndexStore = class _IndexStore {
       reviewedAt: row.reviewed_at
     };
   }
+  /**
+   * Current file-hash review observations, including clean reviews. The
+   * durable Boekwachter registry consumes these so a later file edit cannot
+   * erase identity/lifecycle merely by invalidating `file_reviews`.
+   */
+  currentFileReviewIssues() {
+    return this.db.prepare(
+      `SELECT f.path, f.hash AS content_hash, r.issues
+         FROM files f
+         JOIN file_reviews r ON r.content_hash = f.hash
+         WHERE f.collection_id = ? AND f.hash IS NOT NULL AND r.notes_md IS NOT NULL
+         ORDER BY f.path`
+    ).all(this.collectionId).map((row) => ({
+      path: row.path,
+      contentHash: row.content_hash,
+      issues: parseIssuesJson(row.issues)
+    }));
+  }
   /**
    * Files of one kind whose current hash needs a review under the given
    * rubric: no row yet, or covered by a DIFFERENT rubric and still holding

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _bendyline_gezel from '@bendyline/gezel';
-import { HistoryEvent, HistoryFilter, HistoryEntry, GezelGender, Poppetje, ProjectFileEntry, GezelDetail, GezelConfig, GezelSummary, ProviderName, ChatModelTuning, GezelTrait, ProjectLocalConfig, ImportProvenance, PendingImports, GezelFrontmatter, Project, ProjectDetail, ProjectNudgeConfig, ProjectTabVisibility, ProjectActivity, MeesterStatusReport, MeesterStatusState, ProjectGitHub, ChatSession, ChatSessionSummary, TimelineMessage, TerminalTimelineEntry, TerminalThread, TerminalThreadSummary, TerminalMessage, GezelGrowthState, Task, Question, TaskNote, ToolsetsScope, InstalledToolset, ToolsetConfig, CraftbookSummary, Craftbook, ProjectCraftbookProvenance, ChannelStatus, ChannelName, ChatEvent, ChatEventEnvelope, HookSpec, HookPhase, HookResult, ModelTier, ModelStyle, BehaviorId, ModelFamily, ChatMessageToolCall, SamplingBlock, CodexPermissionModeCompat, ModelFitnessTrigger, ModelFitnessRecord, OutlineFileResponse, FileContextResponse, FindSymbolResponse, ReadSymbolResponse, MapRepoResponse, SecurityScanResponse, ScanFindingsRequest, ScanFindingsResponse, SecurityFindingWire, MapAttackSurfaceResponse, ListDependenciesResponse, SecurityOverviewResponse, TraceTaintResponse, FileMapRequest, FileMapResponse, SearchCodeResponse, FileReviewResponse, ListFileIssuesRequest, ListFileIssuesResponse, SearchDocsResponse, ReadDocAsMarkdownResponse, SearchImagesResponse, FindSimilarImagesResponse, DescribeFolderResponse, FindEntityResponse, ListEntityMentionsResponse, KeurmeesterCaseRecord, TaskStatus, KeurmeesterTriggerKind, KeurmeesterAction, KeurmeesterCaseOutcome, GateCheck, TaskCraftbookStep, TaskCraftbookSource, CraftbookConnectorNeed, CreateTaskRequest, UpdateTaskRequest, TaskAssignee, NewCraftbookStep, StepPosition, UpdateTaskStepRequest, TaskNoteAuthor, TaskVariation, ScriptCapability, ScriptScope, ScriptRunTrigger, ScriptRun, NativeEngineResolveEvent, NativeEngineName, ImageRecognition, RecognitionMode, RecognitionHealth, PreviewLogEntry, SessionGpuTask, SessionTelemetry, AIEngagementMode, ChatMessage, SessionDebugSnapshot, ExpectedDeliverable, CodexSetupStatusResponse, ConfigureCodexRequest, ProjectConnectorBinding, GildeUpdateStatusResponse, GitWorkingChange, GitFileDiffResponse, CodeReviewKind, GitLogEntry, GitCommitDetailResponse, GitSyncResponse, GitConflictFile, GitConflictVersionsResponse, WorkspaceIndexStatus, WorkspaceCommandIndex, WorkspaceSkillIndex, WorkspaceInstructionIndex, CodeReviewRecord, CodeReview, GitHubPullSummary, GitHubPullDetail, GitHubPullFile, GitHubPullComment, ImageModelPullEvent as ImageModelPullEvent$1, VideoAccelerator, RenderImageRequest, ReportActionsResponse, FireReportActionResponse, ReportActionRecord, UnifiedSearchResult, SystemToolsetInstallEvent, SystemToolsetInstallSnapshot, NightShiftWindow, TerminalEventEnvelope, DiscoveredCommand, ServiceRole, ScriptMeta } from '@bendyline/gezel';
+import { HistoryEvent, HistoryFilter, HistoryEntry, GezelGender, Poppetje, ProjectFileEntry, GezelDetail, GezelConfig, GezelSummary, ProviderName, ChatModelTuning, GezelTrait, ProjectLocalConfig, ImportProvenance, PendingImports, GezelFrontmatter, Project, ProjectDetail, FileReviewIssue, BoekwachterIssueStatus, BoekwachterIssueDismissalReason, ProjectManagedWorkspaceWritePolicy, ProjectNudgeConfig, ProjectTabVisibility, ProjectActivity, MeesterStatusReport, MeesterStatusState, ProjectGitHub, ChatSession, ChatSessionSummary, TimelineMessage, TerminalTimelineEntry, TerminalThread, TerminalThreadSummary, TerminalMessage, GezelGrowthState, Task, Question, TaskNote, ToolsetsScope, InstalledToolset, ToolsetConfig, CraftbookSummary, Craftbook, ProjectCraftbookProvenance, ChannelStatus, ChannelName, ChatEvent, ChatEventEnvelope, HookSpec, HookPhase, HookResult, ModelTier, ModelStyle, BehaviorId, ModelFamily, ChatMessageToolCall, SamplingBlock, CodexPermissionModeCompat, ModelFitnessTrigger, ModelFitnessRecord, OutlineFileResponse, FileContextResponse, FindSymbolResponse, ReadSymbolResponse, MapRepoResponse, SecurityScanResponse, ScanFindingsRequest, ScanFindingsResponse, SecurityFindingWire, MapAttackSurfaceResponse, ListDependenciesResponse, SecurityOverviewResponse, TraceTaintResponse, FileMapRequest, FileMapResponse, SearchCodeResponse, FileReviewResponse, ListFileIssuesRequest, ListFileIssuesResponse, BoekwachterIssue, SearchDocsResponse, ReadDocAsMarkdownResponse, SearchImagesResponse, FindSimilarImagesResponse, DescribeFolderResponse, FindEntityResponse, ListEntityMentionsResponse, KeurmeesterCaseRecord, TaskStatus, KeurmeesterTriggerKind, KeurmeesterAction, KeurmeesterCaseOutcome, GateCheck, TaskCraftbookStep, TaskCraftbookSource, CraftbookConnectorNeed, CreateTaskRequest, UpdateTaskRequest, TaskAssignee, NewCraftbookStep, StepPosition, UpdateTaskStepRequest, TaskNoteAuthor, TaskVariation, ScriptCapability, ScriptScope, ScriptRunTrigger, ScriptRun, NativeEngineResolveEvent, NativeEngineName, ImageRecognition, RecognitionMode, RecognitionHealth, PreviewLogEntry, SessionGpuTask, SessionTelemetry, AIEngagementMode, ChatMessage, SessionDebugSnapshot, ExpectedDeliverable, CodexSetupStatusResponse, ConfigureCodexRequest, ProjectConnectorBinding, GildeUpdateStatusResponse, GitWorkingChange, GitFileDiffResponse, CodeReviewKind, GitLogEntry, GitCommitDetailResponse, GitSyncResponse, GitConflictFile, GitConflictVersionsResponse, WorkspaceIndexStatus, WorkspaceCommandIndex, WorkspaceSkillIndex, WorkspaceInstructionIndex, CodeReviewRecord, CodeReview, GitHubPullSummary, GitHubPullDetail, GitHubPullFile, GitHubPullComment, ImageModelPullEvent as ImageModelPullEvent$1, VideoAccelerator, RenderImageRequest, ReportActionsResponse, FireReportActionResponse, ReportActionRecord, UnifiedSearchResult, SystemToolsetInstallEvent, SystemToolsetInstallSnapshot, NightShiftWindow, TerminalEventEnvelope, DiscoveredCommand, ServiceRole, ScriptMeta } from '@bendyline/gezel';
 import { ServerType } from '@hono/node-server';
 import { CatalogService } from '@bendyline/gezel-catalog';
 import { ExternalFolders } from '@bendyline/gezel/paths';
@@ -287,6 +287,28 @@ interface ProjectFindingLifecycleEntry {
     resolvedAt?: string;
 }
 type ProjectFindingLifecycle = Record<string, ProjectFindingLifecycleEntry>;
+interface ProjectBoekwachterIssueRecord extends FileReviewIssue {
+    id: string;
+    ref: string;
+    fingerprint: string;
+    path: string;
+    status: BoekwachterIssueStatus;
+    taskRef?: string;
+    dismissalReason?: BoekwachterIssueDismissalReason;
+    createdAt: string;
+    lastSeenAt: string;
+    lastSeenContentHash: string;
+    lastCheckedAt?: string;
+    lastCheckedContentHash?: string;
+    seenAt?: string;
+    resolvedAt?: string;
+    dismissedAt?: string;
+}
+interface BoekwachterReviewObservation {
+    path: string;
+    contentHash: string;
+    issues: FileReviewIssue[];
+}
 interface StoreOptions {
     home: string;
     /**
@@ -366,6 +388,7 @@ declare class Store {
     private readonly taskFiles;
     private projectCreationTail;
     private readonly findingLifecycleLocks;
+    private readonly boekwachterIssueLocks;
     /**
      * Notified after every session persist/delete — the single choke point all
      * ChatManager write paths funnel through, so a subscriber sees every
@@ -846,7 +869,31 @@ declare class Store {
     settleProjectFindingsForTask(id: string, taskRef: string, outcome: 'complete' | 'canceled'): Promise<number>;
     /** Remove lifecycle rows after a completed scan proves a finding is gone. */
     reconcileProjectFindingLifecycle(id: string, liveFingerprints: Set<string>): Promise<void>;
+    /**
+     * Materialize current review output into durable BW records. Review rows are
+     * disposable and content-hash keyed; these records intentionally are not.
+     */
+    observeProjectBoekwachterReviews(id: string, observations: readonly BoekwachterReviewObservation[]): Promise<void>;
+    listProjectBoekwachterIssues(id: string): Promise<ProjectBoekwachterIssueRecord[]>;
+    getProjectBoekwachterIssue(id: string, ref: string): Promise<ProjectBoekwachterIssueRecord | null>;
+    updateProjectBoekwachterIssue(id: string, ref: string, patch: {
+        status?: BoekwachterIssueStatus;
+        seen?: boolean;
+        taskRef?: string;
+        dismissalReason?: BoekwachterIssueDismissalReason;
+    }): Promise<ProjectBoekwachterIssueRecord | null>;
+    settleProjectBoekwachterIssuesForTask(id: string, taskRef: string, outcome: 'complete' | 'canceled'): Promise<number>;
+    private readProjectBoekwachterIssuesFile;
+    private writeProjectBoekwachterIssuesFile;
+    private withBoekwachterIssueLock;
     private withFindingLifecycleLock;
+    /**
+     * Persist project metadata through one compatibility boundary. Any write to
+     * a legacy project transparently replaces `allowGezelWrites` with the named
+     * managed-write policy, so old input remains readable without letting the
+     * deprecated field spread through newly written project files.
+     */
+    private writeProjectMeta;
     touchProject(id: string): Promise<void>;
     /**
      * A project `workingDir` is settable by the model (via `update_project`)
@@ -880,8 +927,11 @@ declare class Store {
         } | null;
         /** External-data connector bindings — `null` clears them. */
         connectors?: _bendyline_gezel.ProjectConnectorBinding[] | null;
+        managedWorkspaceWritePolicy?: ProjectManagedWorkspaceWritePolicy;
+        /** @deprecated Compatibility input; translated into the named policy. */
         allowGezelWrites?: boolean;
         codexPermissionMode?: _bendyline_gezel.CodexPermissionMode;
+        claudePermissionMode?: _bendyline_gezel.ClaudePermissionMode;
         /** Replaces the stored per-project ambient nudge override. */
         nudgeConfig?: ProjectNudgeConfig;
         /** Replaces the optional project-tab visibility overrides. */
@@ -1190,13 +1240,13 @@ declare class Store {
     /**
      * Gate mutations. Uses the same {@link resolveWorkspaceDir} as the
      * read path, then applies the per-project writability contract
-     * (`projectWorkspaceWritable` in core):
+     * (`projectManagedWorkspaceWritable` in core):
      *
      *   - `internal` / `githubCheckout`: writable unless the project
-     *     explicitly set `allowGezelWrites: false` (the per-project
+     *     explicitly set the managed-write policy to `deny` (the per-project
      *     "edits off" switch — gezel-initiated writes only; app-internal
      *     `.gezel` bookkeeping and user-initiated writes stay exempt).
-     *   - `workingDir`: writable iff `allowGezelWrites === true`. The
+     *   - `workingDir`: writable iff the managed-write policy is `allow`. The
      *     user has to explicitly opt gezels into mutating their own folder.
      *
      * The global security policy deliberately does not factor in — the
@@ -1219,7 +1269,7 @@ declare class Store {
         external: boolean;
     } | {
         ok: false;
-        reason: 'missing-flag-external' | 'disabled-by-project';
+        reason: 'external-consent-required' | 'disabled-by-project';
         workingDir: string;
     }>;
     statProjectWorkspacePath(id: string, filePath: string): Promise<{
@@ -4884,19 +4934,6 @@ interface IndexProvenance {
     appVersion?: string;
 }
 
-/**
- * AI-shadow producers: the second shadow-tree producer class. Office docs get
- * deterministic squisq conversions in the STATIC pass; images and audio need
- * a model — a vision description (+OCR) or an STT transcript — so they run in
- * the idle-gated AI tier instead, writing the same
- * `artifacts/shadow/<parent>/<basename>_files/<stem>.md` layout with a YAML
- * frontmatter header carrying source hash + provenance.
- *
- * The sidecar is the artifact; `shadow_state` is only the work gate. The
- * frontmatter's `source_hash` makes the file self-describing: a rebuilt DB
- * (home-fallback flip, deleted index) re-adopts a fresh sidecar without
- * re-paying the model call.
- */
 interface AiShadowProducers {
     /** Absolute image path → markdown body (description + OCR), null when unavailable. */
     describeImage?: (absPath: string) => Promise<{
@@ -4914,7 +4951,7 @@ interface AiShadowDeps extends AiShadowProducers {
 }
 
 interface EnrichDeps {
-    summarize: (prompt: string) => Promise<string>;
+    summarize: (prompt: string) => Promise<EnrichCompletionResult>;
     embed: (texts: string[]) => Promise<number[][]>;
     model?: string;
     /**
@@ -4923,12 +4960,12 @@ interface EnrichDeps {
      * output tokens than a 2-3 sentence summary. Absent when no local model is
      * configured; the review pass skips entirely then.
      */
-    review?: (prompt: string) => Promise<string>;
+    review?: (prompt: string) => Promise<EnrichCompletionResult>;
     /**
-     * Stamped onto every row this deps object writes. Built once in
-     * `buildEnrichDeps` from the SAME resolved target that builds the
-     * completions, so it reflects reality (env overrides, Night Shift) —
-     * output-only, never a routing input.
+     * Default/primary attribution for legacy bare-string completions and
+     * non-completion work. Runtime completions carry their own actual target so
+     * a fallback can override this per result. Output-only, never a routing
+     * input.
      */
     provenance?: IndexProvenance;
     /**
@@ -4939,12 +4976,34 @@ interface EnrichDeps {
      */
     oneShotWidth?: () => number;
 }
+/**
+ * One LLM completion plus the identity that actually produced it. Hand-built
+ * deps may still return a bare string; consumers resolve those through the
+ * deps-level defaults for backwards compatibility. Runtime deps always return
+ * this richer shape so a policy fallback cannot inherit the primary target's
+ * provenance.
+ */
+interface EnrichCompletion {
+    text: string;
+    model: string;
+    provenance?: IndexProvenance;
+}
+type EnrichCompletionResult = string | EnrichCompletion;
 
 interface AreaPassResult {
     areasUpdated: number;
     architectureUpdated: boolean;
 }
 
+interface ArtifactsIndexStats {
+    /** Markdown records the walk saw (post-skip rules). */
+    files: number;
+    /** Records whose content was (re)ingested this pass. */
+    indexed: number;
+    /** Rows pruned because their record vanished. */
+    removed: number;
+}
+
 interface ContentIndexStats {
     scanned: number;
     changed: number;
@@ -4985,7 +5044,15 @@ declare class ContentIndex {
     /** Per-project village-file stores (they cache last-written content so
      *  no-change builds skip touching the user's repo). */
     private readonly cityStores;
-    constructor(store: Store, home: string);
+    /** Debounce window for {@link refreshArtifacts}; tests shrink it. */
+    private readonly artifactsDebounceMs;
+    /** Per-project pending artifacts pass — calls within the window join it. */
+    private readonly artifactsRefreshPending;
+    /** Per-project settle of the last dispatched pass, so passes never overlap. */
+    private readonly artifactsRefreshLast;
+    constructor(store: Store, home: string, opts?: {
+        artifactsDebounceMs?: number;
+    });
     private cityStoreFor;
     /** Bring the project's content index up to date. Called by the indexer tick. */
     refresh(projectId: string): Promise<ContentIndexStats | null>;
@@ -5118,8 +5185,41 @@ declare class ContentIndex {
     fileReview(projectId: string, relPath: string): Promise<FileReviewResponse>;
     /** Flat issue query across current-hash reviews (`list_file_issues` tool). */
     listFileIssues(projectId: string, req: ListFileIssuesRequest): Promise<ListFileIssuesResponse>;
+    getBoekwachterIssue(projectId: string, ref: string): Promise<BoekwachterIssue | null>;
+    updateBoekwachterIssue(projectId: string, ref: string, patch: {
+        status?: BoekwachterIssueStatus;
+        seen?: boolean;
+        taskRef?: string;
+        dismissalReason?: BoekwachterIssueDismissalReason;
+    }): Promise<BoekwachterIssue | null>;
+    settleBoekwachterIssuesForTask(projectId: string, taskRef: string, outcome: 'complete' | 'canceled'): Promise<number>;
+    private boekwachterIssuesForPath;
     searchDocs(projectId: string, query: string, maxResults?: number): Promise<SearchDocsResponse>;
     readDocAsMarkdown(projectId: string, relPath: string): Promise<ReadDocAsMarkdownResponse>;
+    /**
+     * Schedule a rebuild of the project's artifacts-corpus index. Debounced per
+     * project: calls landing within the window join the same pass, so a burst
+     * of connector syncs costs one walk; passes for a project never overlap.
+     * This is the only artifacts-index method that CREATES the database.
+     */
+    refreshArtifacts(projectId: string): Promise<ArtifactsIndexStats | null>;
+    /** Docs-FTS over the project's artifacts corpora. Empty until a refresh has built the index. */
+    searchArtifacts(projectId: string, query: string, maxResults?: number): Promise<{
+        results: Array<{
+            path: string;
+            lineStart: number;
+            snippet: string;
+        }>;
+        truncated: boolean;
+    }>;
+    /** Indexed artifact record paths (artifacts-relative), for the search catalog. */
+    listArtifactIndexFiles(projectId: string, cap?: number): Promise<string[]>;
+    /**
+     * Open the artifacts-corpus collection for a READ. Stat-first — opening a
+     * missing db would create it (same discipline as {@link hasIndex}), so pure
+     * reads return null until {@link refreshArtifacts} has built one.
+     */
+    private openArtifacts;
     searchImages(projectId: string, query: string, maxResults?: number): Promise<SearchImagesResponse>;
     findSimilarImages(projectId: string, relPath: string, maxResults?: number): Promise<FindSimilarImagesResponse>;
     describeFolder(projectId: string, prefix?: string): Promise<DescribeFolderResponse>;
@@ -7473,6 +7573,17 @@ interface IncompleteModelDownload {
      *  stray files left without one). */
     hasPartial: boolean;
 }
+/** Inventory row for a model directory whose manifest exists but is not
+ * loadable by the current engine manager. */
+interface UnrecognizedModelInfo {
+    id: string;
+    name?: string;
+    bytes: number;
+    updatedAt: string;
+    reason: string;
+    canUpdate: boolean;
+    readOnly?: boolean;
+}
 /**
  * An incomplete download enriched with per-engine catalog context. Managers
  * return this from `listIncomplete()`; the route serializes it as-is.
@@ -7680,6 +7791,9 @@ declare class MlxModelManager {
      * In-flight installs are excluded. See {@link LlamaCppModelManager.listIncomplete}.
      */
     listIncomplete(): Promise<IncompleteModelDownloadInfo[]>;
+    /** Management-only inventory for MLX directories whose manifest exists
+     * but no longer matches the current installed-manifest contract. */
+    listUnrecognized(): Promise<UnrecognizedModelInfo[]>;
     resolveDefaultModel(): Promise<InstalledMlxModel | null>;
     resolveDefaultModelPath(): Promise<string | null>;
     resolveModel(id: string): Promise<InstalledMlxModel | null>;
@@ -8105,6 +8219,15 @@ declare class LlamaCppModelManager {
      * delete-only for stale ids. In-flight installs are excluded.
      */
     listIncomplete(): Promise<IncompleteModelDownloadInfo[]>;
+    /**
+     * Model directories that do have a manifest, but whose metadata cannot be
+     * loaded by this build. These used to disappear from every inventory
+     * surface: `listInstalled()` correctly refused to run them, while the
+     * incomplete-download scan correctly ignored anything with a manifest.
+     * Keep that safety boundary, but return a management-only row so Settings
+     * can update a known catalog id or explicitly remove the held bytes.
+     */
+    listUnrecognized(): Promise<UnrecognizedModelInfo[]>;
     /**
      * Path of the first installed model, or null when none exist. Phase 2
      * uses this to pick a default `--model` arg for the supervised
@@ -9384,6 +9507,12 @@ declare class ChatManager {
         projectId?: string;
         expectedDeliverable?: ExpectedDeliverable;
     }): Promise<ChatSession>;
+    /**
+     * Resolve the active session for one exact task step. Scheduler re-drives
+     * use this path so task tools inherit GEZEL_TASK_REF / GEZEL_STEP_ID and
+     * continue the original work thread instead of landing in lobby chat.
+     */
+    private ensureOrCreateTaskSession;
     /** Late-bind the fitness manager (see the field's docblock). */
     setModelFitness(manager: ModelFitnessManager): void;
     /**
@@ -9483,7 +9612,8 @@ declare class ChatManager {
      * (which is anchored to a task + phase and always opens a fresh session),
      * `messageGezel` drops a message into the target gezel's *active* project
      * session via `ensureOrCreateSession`, so the continuity of their thread
-     * is preserved.
+     * is preserved. Internal task re-drives may also pass `taskRef` + `stepId`
+     * to resume that exact task-step session with its MCP context intact.
      *
      * When the target's turn completes, its reply is injected back into the
      * sender's session as its own handoff-styled message (role=user, `from`
@@ -9503,6 +9633,10 @@ declare class ChatManager {
         toGezelIdOrName: string;
         projectId?: string;
         text: string;
+        /** Internal task context for scheduler re-drives. */
+        taskRef?: string;
+        /** Exact step paired with taskRef when re-driving task work. */
+        stepId?: string;
         /**
          * Provider-queue lane for the target's reply turn. Defaults to
          * `interactive`. The scheduler passes `background` for ambient
@@ -10265,6 +10399,15 @@ declare class ChatManager {
          * "memory extraction".
          */
         jobLabel?: string;
+        /**
+         * Per-call catalog tuning profile. Used by tightly-scoped utility work
+         * whose inference shape differs from the owning gezel's conversational
+         * default (for example, index summaries should use an `instruct`
+         * profile rather than spend their deadline on hidden reasoning).
+         * The profile keeps its catalog-authored sampling/output allowance;
+         * this option does not impose an extra token cap.
+         */
+        tuningProfileId?: string;
         /**
          * Truly-deferrable housekeeping (memory extraction, icon/about
          * generation, index enrichment, digests). On local engine queues
@@ -10726,6 +10869,14 @@ declare class ChatManager {
      */
     opts?: {
         allowUninstalled?: boolean;
+        /**
+         * Price the model as the only resident engine. Inventory/catalog rows
+         * answer "can this model run on this device?", so their estimate must
+         * not change merely because another model happens to be warm. Actual
+         * launch admission keeps the default live-reservation behavior and may
+         * evict an idle model (or report that a busy one is blocking the swap).
+         */
+        standalone?: boolean;
     }): Promise<{
         contextWindow?: number;
         plannedResidentBytes?: number;
@@ -10821,6 +10972,8 @@ declare class ChatManager {
     private immediateFileWriteConstraintActive;
     /** Resolve the mode that a Codex CLI session will actually receive. */
     private resolveCodexPermissionMode;
+    /** Resolve the mode that a Claude CLI session will actually receive. */
+    private resolveClaudePermissionMode;
     /**
      * D4 clamp-lifetime derivation for the rebuild check: read the
      * session's active step (step-scoped sessions only) and combine with
@@ -11229,7 +11382,7 @@ declare class ConnectorManager {
         code: string;
     }): Promise<ProjectConnectorBinding>;
     private gcPendingOAuth;
-    /** Remove a binding + its stored credential. */
+    /** Remove a binding + its stored credential (and its origin allowlist entry). */
     unbind(project: ProjectDetail, bindingId: string): Promise<void>;
     status(project: ProjectDetail): Promise<ConnectorStatus>;
     /**
@@ -11243,6 +11396,13 @@ declare class ConnectorManager {
     }): Promise<BindingSyncResult>;
     /** Sync every enabled binding on a project (drives the sync manager). */
     syncProject(project: ProjectDetail): Promise<BindingSyncResult[]>;
+    /**
+     * Idempotent sync-time heal for the origin allowlist: bindings created
+     * before their type declared `allowedOrigins` (or before this write path
+     * existed) get the entry on their next sync, with no migration step.
+     * Called under the project lock.
+     */
+    private ensureDeclaredOrigins;
     /** The per-binding sync body — always called under the project lock. */
     private syncBindingInner;
     /**