@byok-sdk/client 0.14.0 → 0.15.0

package/dist/bin/byok-agent.js

@@ -11,7 +11,7 @@ import { execFile, spawn, spawnSync } from 'child_process';
 import net, { createServer, createConnection } from 'net';
 import { isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import * as fs5 from 'fs/promises';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, isTaskOfferType, partitionAgentEvents, TASK_TRANSITIONS, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, isTaskOfferType, partitionAgentEvents, TASK_TRANSITIONS, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, RuntimeIdSchema, HarnessIdSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MAILBOX_READ_AHEAD_MAX_SEQS, MAILBOX_READ_AHEAD_CAPABILITY, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import { promisify } from 'util';
 import { createRequire } from 'module';
 import { createInterface as createInterface$1 } from 'readline/promises';
@@ -1418,7 +1418,8 @@ var DIST_SCRIPT_BY_KIND = Object.freeze({
   "agent-message-mcp": "byok-agent-message-mcp.js",
   "agent-memory-mcp": "byok-agent-memory-mcp.js",
   "approval-mcp": "byok-approval-mcp.js",
-  "agent-team-mcp": "byok-agent-team-mcp.js"
+  "agent-team-mcp": "byok-agent-team-mcp.js",
+  "mcp-env": "byok-mcp-env.js"
 });
 function assertExecutable(executable) {
   if (!path14__default.isAbsolute(executable) || /[\u0000\r\n]/u.test(executable)) {
@@ -1436,8 +1437,11 @@ function resolveSdkReservedHelperBin(kind, host) {
       source: "self-executable"
     });
   }
+  const entryDir = path14__default.dirname(fileURLToPath(import.meta.url));
+  const entryKind = path14__default.basename(entryDir);
+  const distDir = entryKind === "adapters" || entryKind === "bin" ? path14__default.dirname(entryDir) : entryDir;
   const script = path14__default.join(
-    path14__default.dirname(fileURLToPath(import.meta.url)),
+    distDir,
     "bin",
     DIST_SCRIPT_BY_KIND[kind]
   );
@@ -1915,6 +1919,20 @@ var DeviceStore = class _DeviceStore {
       await opened.handle.close();
     }
   }
+  /** Rebuild only the non-secret projection, while the caller owns the store lease. */
+  async reconcileMetadata(authority) {
+    const projection = {
+      deviceId: authority.deviceId,
+      tenantId: authority.tenantId,
+      devicePublicKey: authority.devicePublicKey
+    };
+    const current = await this.load();
+    if (current !== void 0 && current.deviceId === projection.deviceId && current.tenantId === projection.tenantId && current.devicePublicKey === projection.devicePublicKey) {
+      return false;
+    }
+    await this.save(projection);
+    return true;
+  }
   async save(record4) {
     assertDeviceMetadata(record4);
     const storeDir = path14__default.dirname(this.filePath);
@@ -2361,7 +2379,7 @@ function resolveLocalAgentReleaseIdentity(input) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.14.0"
+  version: "0.15.0"
 });
 
 // src/bin/config.ts
@@ -2762,6 +2780,19 @@ function projectRuntimeBoundaryFailure(value, expectedPhase) {
     contractViolation: true
   };
 }
+var RuntimeStartupDisposalFailure = class extends Error {
+  retryDisposal;
+  constructor(retryDisposal, options) {
+    super("runtime startup failed and process ownership remains quarantined", options);
+    this.name = "RuntimeStartupDisposalFailure";
+    this.retryDisposal = retryDisposal;
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeStartupDisposalFailure/v1"), { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeStartupDisposalFailure(value) {
+  return typeof value === "object" && value !== null && value[/* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeStartupDisposalFailure/v1")] === true && typeof value.retryDisposal === "function";
+}
 
 // src/adapters/taskkill-pid-set.ts
 var INTEGER_PATTERN = /\d+/g;
@@ -5519,6 +5550,7 @@ async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */
 }
 
 // src/types.ts
+var RUNTIME_DETECTION_FAILURE_KINDS = ["not-found", "not-executable", "timeout", "probe-failed"];
 function frozenStrings(values) {
   return values === void 0 ? void 0 : Object.freeze([...values]);
 }
@@ -5743,6 +5775,132 @@ var GitWorkspaceStore = class {
     await atomicWriteFile(this.filePath, JSON.stringify(ledger, null, 2), { mode: 384 });
   }
 };
+function terminalIdentity(runtimeId, agentRef) {
+  return {
+    ...runtimeId === void 0 || RuntimeIdSchema.safeParse(runtimeId).success ? {} : { harnessId: HarnessIdSchema.parse(runtimeId) },
+    ...agentRef === void 0 ? {} : { agentRef }
+  };
+}
+
+// src/daemon/terminal-commit-queue.ts
+var TerminalCommitQueue = class {
+  constructor(committed) {
+    this.committed = committed;
+  }
+  committed;
+  pending = /* @__PURE__ */ new Map();
+  tail = Promise.resolve();
+  timer;
+  stopped = false;
+  get pendingCount() {
+    return this.pending.size;
+  }
+  hasPending(taskId) {
+    return this.pending.has(taskId);
+  }
+  enqueue(taskId, commit) {
+    if (!this.pending.has(taskId)) this.pending.set(taskId, { commit, receipt: Promise.resolve(), running: false });
+    void this.attempt(taskId).catch(() => void 0);
+  }
+  receipt(taskId) {
+    return this.pending.get(taskId)?.receipt ?? Promise.resolve();
+  }
+  retry(taskId) {
+    return this.attempt(taskId);
+  }
+  resume() {
+    this.stopped = false;
+    if (this.pending.size > 0) this.armRetry();
+  }
+  async stop() {
+    this.stopped = true;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = void 0;
+    await Promise.all([...this.pending.keys()].map((taskId) => this.attempt(taskId)));
+  }
+  attempt(taskId) {
+    const entry = this.pending.get(taskId);
+    if (!entry) return Promise.resolve();
+    if (entry.running) return entry.receipt;
+    entry.running = true;
+    const receipt = this.tail.catch(() => void 0).then(entry.commit);
+    entry.receipt = receipt.then(() => {
+      if (this.pending.get(taskId) === entry) this.pending.delete(taskId);
+      this.committed(taskId);
+    }, (error) => {
+      entry.running = false;
+      this.armRetry();
+      throw error;
+    });
+    this.tail = entry.receipt;
+    void entry.receipt.catch(() => void 0);
+    return entry.receipt;
+  }
+  armRetry() {
+    if (this.timer || this.stopped) return;
+    this.timer = setTimeout(() => {
+      this.timer = void 0;
+      for (const taskId of this.pending.keys()) void this.attempt(taskId).catch(() => void 0);
+    }, 1e3);
+    this.timer.unref?.();
+  }
+};
+
+// src/runtime-detection.ts
+function validateRuntimeDetectResult(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("invalid runtime detection result");
+  }
+  const result = value;
+  if (!Object.hasOwn(result, "kind")) throw new TypeError("invalid runtime detection result");
+  const { kind, version, authPresent } = result;
+  if (kind === "available") {
+    if (Object.keys(result).some((key) => !["kind", "version", "authPresent"].includes(key)) || version !== void 0 && typeof version !== "string" || authPresent !== void 0 && typeof authPresent !== "boolean") {
+      throw new TypeError("invalid runtime detection result");
+    }
+    return Object.freeze({
+      kind,
+      ...version === void 0 ? {} : { version },
+      ...authPresent === void 0 ? {} : { authPresent }
+    });
+  }
+  if (RUNTIME_DETECTION_FAILURE_KINDS.some((candidate) => candidate === kind) && Object.keys(result).every((key) => key === "kind")) {
+    return Object.freeze({ kind });
+  }
+  throw new TypeError("invalid runtime detection result");
+}
+function classifyDetectError(error) {
+  const code = error !== null && typeof error === "object" ? error.code : void 0;
+  if (code === "ENOENT") return { kind: "not-found" };
+  if (code === "EACCES" || code === "EPERM" || code === "ENOEXEC") return { kind: "not-executable" };
+  return { kind: "probe-failed" };
+}
+async function probeRuntimeVersion(command, timeoutMs) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new TypeError("invalid runtime probe timeout");
+  return new Promise((resolve) => {
+    let timer;
+    let timedOut = false;
+    try {
+      const child = execFile(command, ["--version"], { encoding: "utf8" }, (error, stdout, stderr) => {
+        if (timer) clearTimeout(timer);
+        if (error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") resolve({ kind: "probe-failed" });
+        else if (timedOut) resolve({ kind: "timeout" });
+        else if (error) resolve(classifyDetectError(error));
+        else resolve({ kind: "available", stdout, stderr });
+      });
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        child.kill("SIGKILL");
+      }, timeoutMs);
+      timer.unref?.();
+    } catch (error) {
+      if (timer) clearTimeout(timer);
+      resolve(classifyDetectError(error));
+    }
+  });
+}
 
 // src/adapters/pi/mcp-config.ts
 var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
@@ -6076,12 +6234,13 @@ var PiAdapter = class {
   async detect() {
     try {
       const bin = this.resolveBin();
-      const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
-      const version = stdout.trim() || stderr.trim();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -7211,14 +7370,15 @@ var ClaudeAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const { stdout } = await execFileAsync2(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS2 });
-      const version = stdout.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS2);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim();
       const authPresent = await this.probeAuthPresent(bin.command);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -7837,10 +7997,18 @@ function unmappedFrameKey(evt) {
   return evt.type;
 }
 var STDERR_RING_CAPACITY3 = 20;
+var CODEX_MAX_FRAME_BYTES = 1024 * 1024;
+var CODEX_MAX_DEFERRED_BYTES = 4 * 1024 * 1024;
+var CODEX_MAX_STDERR_BYTES = 64 * 1024;
 var CodexProcessRunner = class {
   child;
   onEvent;
-  buffer = "";
+  frameChunks = [];
+  frameBytes = 0;
+  deferredBytes = 0;
+  stderrBytes = 0;
+  transportFailure;
+  onFailure;
   stderrRing = [];
   closed = false;
   exitCode = null;
@@ -7863,11 +8031,12 @@ var CodexProcessRunner = class {
   deferredEvents = [];
   constructor(options) {
     this.onEvent = options.onEvent;
+    this.onFailure = options.onFailure;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: [options.instruction === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
     }));
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
@@ -7875,7 +8044,6 @@ var CodexProcessRunner = class {
     this.adopted = this.adoptOwnedTree(options);
     this.adopted.catch(() => {
     });
-    this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
     this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
@@ -7884,6 +8052,12 @@ var CodexProcessRunner = class {
       this.exitSignal = signal;
       this.finishClosing();
     });
+    if (options.instruction !== void 0) {
+      this.child.stdin.on("error", () => {
+        this.failTransport("codex prompt stdin failed before delivery");
+      });
+      this.child.stdin.end(options.instruction, "utf8");
+    }
     this.child.on("error", () => {
       this.finishClosing();
     });
@@ -7969,12 +8143,19 @@ var CodexProcessRunner = class {
       throw failure;
     }
     this.adoption = "adopted";
+    this.deferredBytes = 0;
     for (const evt of this.deferredEvents.splice(0)) this.onEvent(evt);
   }
   /** Arrival-order delivery, held back until the tree is backstopped (see `deferredEvents`). */
-  deliver(evt) {
+  deliver(evt, bytes) {
+    if (this.transportFailure) return;
     if (this.adoption === "failed") return;
     if (this.adoption === "pending") {
+      if (this.deferredBytes + bytes > CODEX_MAX_DEFERRED_BYTES) {
+        this.failTransport("codex pre-adoption event buffer exceeded its byte budget");
+        return;
+      }
+      this.deferredBytes += bytes;
       this.deferredEvents.push(evt);
       return;
     }
@@ -7991,6 +8172,7 @@ var CodexProcessRunner = class {
    * plus an empty stderr tail would bury the only reason anyone can act on.
    */
   buildExitError(context) {
+    if (this.transportFailure) return this.transportFailure;
     if (this.adoptionFailure !== void 0) return this.adoptionFailure;
     const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
     if (this.stderrRing.length > 0) {
@@ -7998,18 +8180,45 @@ var CodexProcessRunner = class {
     }
     return new Error(parts.join("; "));
   }
+  failTransport(reason) {
+    if (this.transportFailure) return;
+    this.transportFailure = new RuntimeExecutionFailure({
+      phase: "run",
+      category: "infrastructure",
+      retry: "non-retryable",
+      reason
+    });
+    this.frameChunks.length = 0;
+    this.frameBytes = 0;
+    this.deferredEvents.length = 0;
+    this.deferredBytes = 0;
+    this.onFailure?.(this.transportFailure);
+    this.kill();
+  }
   onData(chunk) {
-    this.buffer += chunk;
-    let newlineIndex = this.buffer.indexOf("\n");
-    while (newlineIndex !== -1) {
-      let line = this.buffer.slice(0, newlineIndex);
-      this.buffer = this.buffer.slice(newlineIndex + 1);
-      if (line.endsWith("\r")) line = line.slice(0, -1);
-      if (line.length > 0) this.parseLine(line);
-      newlineIndex = this.buffer.indexOf("\n");
+    if (this.transportFailure) return;
+    let offset = 0;
+    while (offset < chunk.length) {
+      const newline = chunk.indexOf(10, offset);
+      const end = newline === -1 ? chunk.length : newline;
+      const bytes = end - offset;
+      if (this.frameBytes + bytes > CODEX_MAX_FRAME_BYTES) {
+        this.failTransport("codex raw JSONL frame exceeded its byte budget");
+        return;
+      }
+      if (bytes > 0) this.frameChunks.push(Buffer.from(chunk.subarray(offset, end)));
+      this.frameBytes += bytes;
+      if (newline === -1) return;
+      const frame = Buffer.concat(this.frameChunks, this.frameBytes);
+      this.frameChunks.length = 0;
+      this.frameBytes = 0;
+      const line = frame.toString("utf8").replace(/\r$/, "");
+      if (line.length > 0) this.parseLine(line, frame.length);
+      if (this.transportFailure) return;
+      offset = newline + 1;
     }
   }
-  parseLine(line) {
+  parseLine(line, bytes) {
     let parsed;
     try {
       parsed = JSON.parse(line);
@@ -8019,14 +8228,18 @@ var CodexProcessRunner = class {
     if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
       return;
     }
-    this.deliver(parsed);
+    this.deliver(parsed, bytes);
   }
   onStderr(chunk) {
-    for (const rawLine of chunk.split("\n")) {
+    const bounded2 = Buffer.from(chunk).subarray(-CODEX_MAX_STDERR_BYTES).toString("utf8");
+    for (const rawLine of bounded2.split("\n")) {
       const line = rawLine.trim();
       if (line.length === 0) continue;
       this.stderrRing.push(line);
-      if (this.stderrRing.length > STDERR_RING_CAPACITY3) this.stderrRing.shift();
+      this.stderrBytes += Buffer.byteLength(line);
+      while (this.stderrRing.length > STDERR_RING_CAPACITY3 || this.stderrBytes > CODEX_MAX_STDERR_BYTES) {
+        this.stderrBytes -= Buffer.byteLength(this.stderrRing.shift());
+      }
     }
   }
 };
@@ -8059,14 +8272,15 @@ var CodexAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const versionResult = await execFileAsync3(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS3 });
-      const version = versionResult.stdout.trim() || versionResult.stderr.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS3);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = await this.probeAuthPresent(bin);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   /**
@@ -8209,7 +8423,7 @@ ${withStreams.stderr ?? ""}`);
         reason: "prepared codex operation received a manifest with different runtime selection"
       });
     }
-    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, preparedMcpGrants);
+    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, runtimeEnv, this.options.sdkHelperHost, preparedMcpGrants);
     const { sessionRef, runner } = await runCodexTurn({
       command,
       resumeRef: startInput.manifest.sessionRef,
@@ -8225,6 +8439,7 @@ ${withStreams.stderr ?? ""}`);
       expectedSessionRef: startInput.manifest.sessionRef,
       preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
       failurePhase: "start",
+      signal: startInput.signal,
       terminal
     });
     return new CodexSession({
@@ -8232,6 +8447,7 @@ ${withStreams.stderr ?? ""}`);
       command,
       workspaceDir,
       env: startInput.env,
+      mcpEnvironment: Object.fromEntries(Object.entries(runtimeEnv).filter(([key]) => key.startsWith("BYOK_MCP_PAYLOAD_"))),
       spawnFn: this.options.spawnFn,
       queue,
       recordUnmapped,
@@ -8284,16 +8500,18 @@ function codexMcpToolApprovalArgs(name, tools) {
   }
   return args;
 }
-function codexMcpConfigArgs(servers, grants = []) {
+function codexMcpConfigArgs(servers, env, helperHost, grants = []) {
   if (servers === void 0 || Object.keys(servers).length === 0) return [];
   const grantedTools = new Map(grants.map((grant) => [grant.server, grant.tools]));
   const args = ["--ignore-user-config"];
   for (const [name, server] of Object.entries(servers).sort(([left], [right]) => left.localeCompare(right))) {
-    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(server.command)}`);
-    if (server.args !== void 0) args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...server.args])}`);
-    for (const [key, value] of Object.entries(server.env ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
-      args.push("-c", `mcp_servers.${name}.env.${key}=${JSON.stringify(value)}`);
-    }
+    const key = `BYOK_MCP_PAYLOAD_${randomBytes(16).toString("hex").toUpperCase()}`;
+    env[key] = JSON.stringify(server);
+    const helper = resolveSdkReservedHelperBin("mcp-env", helperHost);
+    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(helper.command)}`);
+    args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...helper.args])}`);
+    args.push("-c", `mcp_servers.${name}.env.BYOK_MCP_ENV_KEY=${JSON.stringify(key)}`);
+    args.push("-c", `mcp_servers.${name}.env_vars=${JSON.stringify([key])}`);
     const granted = grantedTools.get(name);
     if (granted !== void 0) args.push(...codexMcpToolApprovalArgs(name, granted));
   }
@@ -8321,7 +8539,7 @@ function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = fa
     ...modelId ? ["--model", modelId] : [],
     ...preparedGit ? [] : ["--skip-git-repo-check"],
     ...policyArgs,
-    instruction
+    "-"
   ];
 }
 async function runCodexTurn(params) {
@@ -8345,9 +8563,18 @@ async function runCodexTurn(params) {
     runner = new CodexProcessRunner({
       command: params.command,
       args: argv,
+      instruction: params.instruction,
       cwd: params.cwd,
       env: params.env,
       spawnFn: params.spawnFn,
+      onFailure: (failure) => {
+        if (!firstLineSettled) {
+          firstLineSettled = true;
+          rejectFirstLine(failure);
+        }
+        params.terminal.failure = failure;
+        params.queue.end();
+      },
       onEvent: (evt) => {
         if (!firstLineSettled) {
           firstLineSettled = true;
@@ -8414,6 +8641,16 @@ async function runCodexTurn(params) {
     params.queue.end();
   });
   let sessionRef;
+  const abortStartup = () => rejectFirstLine(new RuntimeExecutionFailure({
+    phase: params.failurePhase,
+    category: "infrastructure",
+    retry: "non-retryable",
+    reason: "codex startup cancelled or exceeded its deadline"
+  }));
+  const startupTimer = setTimeout(abortStartup, 3e4);
+  startupTimer.unref?.();
+  params.signal?.addEventListener("abort", abortStartup, { once: true });
+  if (params.signal?.aborted) abortStartup();
   try {
     sessionRef = await new Promise((resolve, reject) => {
       let settled = false;
@@ -8445,20 +8682,31 @@ async function runCodexTurn(params) {
       });
     });
   } catch (err) {
-    runner.kill();
+    await disposeFailedStartup(runner, err);
     throw err;
+  } finally {
+    clearTimeout(startupTimer);
+    params.signal?.removeEventListener("abort", abortStartup);
   }
   if (params.expectedSessionRef !== void 0 && sessionRef !== params.expectedSessionRef) {
-    runner.kill();
-    throw new RuntimeExecutionFailure({
+    const failure = new RuntimeExecutionFailure({
       phase: params.failurePhase,
       category: "authority",
       retry: "non-retryable",
       reason: `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef})`
     });
+    await disposeFailedStartup(runner, failure);
+    throw failure;
   }
   return { sessionRef, runner };
 }
+async function disposeFailedStartup(runner, cause) {
+  try {
+    await runner.dispose();
+  } catch (disposalFailure) {
+    throw new RuntimeStartupDisposalFailure(() => runner.dispose(), { cause: new AggregateError([cause, disposalFailure]) });
+  }
+}
 var CodexSession = class {
   /**
    * NOT `readonly` (cross-model review finding): `followUp()` below
@@ -8494,6 +8742,7 @@ var CodexSession = class {
    * recomputed from anything a later turn supplies, so a follow-up can never
    * widen this session's MCP authority.
    */
+  mcpEnvironment;
   mcpConfigArgs;
   terminal;
   currentRunner;
@@ -8513,6 +8762,7 @@ var CodexSession = class {
     this.modelId = options.modelId;
     this.terminal = options.terminal;
     this.mcpConfigArgs = options.mcpConfigArgs;
+    this.mcpEnvironment = Object.freeze({ ...options.mcpEnvironment });
     this.currentRunner = options.initialRunner;
     this.ownedRunners.add(options.initialRunner);
     void this.forgetRunnerOnceClosed(options.initialRunner);
@@ -8625,7 +8875,7 @@ var CodexSession = class {
         // frozen MCP config replayed verbatim — see `mcpConfigArgs`.
         policyArgs: [...mapping.args, ...this.mcpConfigArgs],
         cwd: this.workspaceDir,
-        env: withoutProviderCredentials(this.env),
+        env: { ...withoutProviderCredentials(this.env), ...this.mcpEnvironment },
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -9141,15 +9391,7 @@ var AuthManager = class {
       if (await this.opts.store.load() === void 0) return void 0;
       throw new DeviceRecordRePairRequiredError();
     }
-    const projection = {
-      deviceId: authority.deviceId,
-      tenantId: authority.tenantId,
-      devicePublicKey: authority.devicePublicKey
-    };
-    const current = await this.opts.store.load();
-    if (current === void 0 || current.deviceId !== projection.deviceId || current.tenantId !== projection.tenantId || current.devicePublicKey !== projection.devicePublicKey) {
-      await this.opts.store.save(projection);
-    }
+    await this.opts.store.reconcileMetadata(authority);
     return Object.freeze({ ...authority });
   }
 };
@@ -9446,9 +9688,9 @@ async function probeDarwin(run) {
   return DARWIN_UUID_RE.exec(result.stdout)?.[1];
 }
 async function probeLinux(readFile3) {
-  for (const path46 of LINUX_MACHINE_ID_PATHS) {
+  for (const path47 of LINUX_MACHINE_ID_PATHS) {
     try {
-      const contents = (await readFile3(path46)).trim();
+      const contents = (await readFile3(path47)).trim();
       if (contents.length > 0) return contents;
     } catch {
     }
@@ -9480,7 +9722,7 @@ async function withTimeout2(probe, timeoutMs) {
 async function resolveMachineId(options) {
   const platform = options.platform ?? process.platform;
   const run = options.run ?? runDeviceCommand;
-  const readFile3 = options.readFile ?? ((path46) => fs5.readFile(path46, "utf8"));
+  const readFile3 = options.readFile ?? ((path47) => fs5.readFile(path47, "utf8"));
   let probe;
   if (platform === "darwin") probe = probeDarwin(run);
   else if (platform === "linux") probe = probeLinux(readFile3);
@@ -10504,13 +10746,35 @@ var LongPollClient = class {
   }
   async loop(signal) {
     let retryAttempt = 0;
+    let readCursor;
+    let readAheadSupported = false;
+    let warnedWindowAt;
     while (this.running && !signal.aborted) {
       try {
         await this.opts.auth.getValidAccessToken();
         const base = toHttpBase(this.opts.serverUrl);
         const url = new URL(BYOK_EVENTS_PATH, base);
         const cursor = this.opts.getCursor();
+        const ack = cursor ?? 0;
+        if (readCursor !== void 0 && readCursor - ack >= MAILBOX_READ_AHEAD_MAX_SEQS) {
+          if (warnedWindowAt !== ack) {
+            warnedWindowAt = ack;
+            console.warn("[byok/client] mailbox read-ahead window full; acknowledgement is stalled");
+          }
+          readCursor = ack;
+          await sleep(this.opts.retryDelayMs ?? 2e3, signal);
+          continue;
+        }
+        const afterSeq = Math.max(ack, readCursor ?? ack);
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
+        if (afterSeq > ack) {
+          if (!readAheadSupported) {
+            const error = new Error("server does not advertise mailbox-read-ahead; cannot read past unacknowledged work");
+            this.warnRouteFailure(this.eventsEndpoint, void 0, error);
+            throw error;
+          }
+          url.searchParams.set("afterSeq", String(afterSeq));
+        }
         let res;
         try {
           res = await authedFetch(url, { method: "GET", signal }, this.opts.auth);
@@ -10529,6 +10793,8 @@ var LongPollClient = class {
             return;
           }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
+          readCursor = void 0;
+          readAheadSupported = false;
           this.opts.onServerCapabilitiesInvalidated?.();
           this.opts.onPollFailure?.();
           this.opts.onOperationalOutcome?.("failure");
@@ -10538,12 +10804,16 @@ var LongPollClient = class {
         }
         let parsed;
         try {
-          parsed = parseLooseEventsPollResponse(await res.json(), cursor ?? 0);
-          validateTrustedEventsPage(parsed.events, cursor ?? 0, parsed.cursor);
+          parsed = parseLooseEventsPollResponse(await res.json(), afterSeq);
+          validateTrustedEventsPage(parsed.events, afterSeq, parsed.cursor);
+          if (afterSeq > ack && !parsed.capabilities.includes(MAILBOX_READ_AHEAD_CAPABILITY)) throw new Error("mailbox read-ahead capability was withdrawn");
         } catch (err) {
           this.warnRouteFailure(this.eventsEndpoint, res.status, err);
           throw err;
         }
+        readAheadSupported = parsed.capabilities.includes(MAILBOX_READ_AHEAD_CAPABILITY);
+        const madeReadProgress = parsed.cursor > afterSeq;
+        readCursor = parsed.cursor;
         this.opts.onServerCapabilities?.(parsed.capabilities);
         let hadValidationFailureThisBatch = false;
         let acceptedAnyEntry = false;
@@ -10567,10 +10837,11 @@ var LongPollClient = class {
           if (this.opts.onEnvelope(envelope) !== false) acceptedAnyEntry = true;
         }
         if (parsed.events.length === 0) {
+          readCursor = this.opts.getCursor() ?? 0;
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
           await sleep(this.opts.idleDelayMs ?? 250, signal);
-        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor) {
+        } else if (!madeReadProgress && (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor)) {
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
           await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
@@ -10579,6 +10850,8 @@ var LongPollClient = class {
           this.opts.onOperationalOutcome?.("success");
         }
       } catch (err) {
+        readCursor = void 0;
+        readAheadSupported = false;
         this.opts.onServerCapabilitiesInvalidated?.();
         if (this.noteRevoked(err)) return;
         if (!this.running || signal.aborted) return;
@@ -10631,6 +10904,7 @@ function createConnectionHelloEnvelope(opts, getCursor) {
     productId: opts.productId,
     clientVersion: opts.clientVersion,
     runtimes: opts.runtimes,
+    harnesses: opts.harnesses,
     configuredToolsets: configuredToolsets === void 0 ? void 0 : [...configuredToolsets],
     cursor: getCursor()
   });
@@ -10644,8 +10918,8 @@ var ConnectionManager = class {
       serverUrl: opts.serverUrl,
       auth: opts.auth,
       // The long-poll query cursor is also the kernel's irreversible ack.
-      // Only report the successfully processed cursor here. `deliveredSeq`
-      // remains a local dedup watermark; using it on the wire would ack an
+      // Only report the successfully persisted cursor; using received work
+      // on the wire would ack an
       // in-flight envelope before its handler settles and make a later
       // failure impossible to redeliver.
       getCursor: () => this.cursor,
@@ -10694,25 +10968,11 @@ var ConnectionManager = class {
    * guarantees in docs/protocol.md §9.
    */
   stalledAtSeq;
-  /**
-   * Design A (Wave 2, F3-on-long-poll): the second, in-memory watermark
-   * alongside the durable `cursor`. `cursor` only ever advances AFTER a
-   * `task.*` handler's side effects resolve successfully, and is persisted
-   * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
-   * advances eagerly, the instant a `task.*` envelope is admitted past
-   * dedup (see `deliver`/`noteDelivered`), independent of whether its
-   * handler has even started, let alone succeeded. It exists so a repeated
-   * read at the durable cursor does not re-dispatch an envelope already in
-   * flight — `handleOffer` must not start a second adapter session while a
-   * first attempt is still running. On WS this same field is written the
-   * same way, but since a live WS connection only ever pushes a given `seq`
-   * once, it never has an observable effect there beyond mirroring
-   * `cursor` (see `dedupWatermark`'s doc comment for why redelivery
-   * correctness doesn't depend on resetting it anywhere).
-   */
-  deliveredSeq;
-  /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
+  /** Drain barrier for independently running handlers; not an admission lock. */
   processingChain = Promise.resolve();
+  cursorInitialization;
+  completionTail = Promise.resolve();
+  controlTails = /* @__PURE__ */ new Map();
   /**
    * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
    * never re-encoded/rebuilt strings, so a
@@ -10738,38 +10998,13 @@ var ConnectionManager = class {
   terminalError;
   settledWaiters = [];
   pendingCursorSave = Promise.resolve();
-  /**
-   * Finding P2 (Fix 2b): seqs currently admitted into `processingChain` but
-   * not yet settled — added in `deliver()` the moment a `task.*` envelope is
-   * accepted past the ordinary watermark check, removed in `process()`'s
-   * `finally` once that specific attempt resolves (success OR failure).
-   * While stalled, `dedupWatermark()` deliberately stays frozen below
-   * already-delivered seqs (see its own doc comment) so the failed seq's own
-   * redelivery can get through — but that same frozen watermark also means
-   * every OTHER seq above it rides along on every re-poll too. Without this,
-   * a seq already mid-flight (e.g. a `task.offer` whose prepared operation start()
-   * hasn't resolved yet) would be re-enqueued into `processingChain` on
-   * every such re-poll, piling up duplicate copies that — once the first
-   * finally resolves and the chain unwinds through them — run its handler
-   * again; for `task.offer` specifically, a second adapter session
-   * orphaning the first (`TaskRunner`'s own `this.tasks.has` guard, finding
-   * P2c, is the second, independent layer against exactly that).
-   */
+  /** Admission dedup while an individual handler is running. */
   inFlightSeqs = /* @__PURE__ */ new Set();
-  /**
-   * Finding P2 (Fix 2b): seqs whose handler has already resolved
-   * successfully at least once this session, tracked only while a stall is
-   * in effect — cleared the moment `stalledAtSeq` itself clears (see
-   * `process()`), since once unstalled the ordinary watermark check via
-   * `deliveredSeq` already covers everything delivered so far, making this
-   * redundant. Needed because the stall-gap-prevention rule in `process()`
-   * deliberately does NOT advance `cursor` past a seq above the
-   * still-unresolved `stalledAtSeq`, even once that seq's own handler
-   * succeeds — so `dedupWatermark()` alone can't distinguish "already
-   * succeeded, don't re-run" from "never yet attempted" for anything in
-   * that gap.
-   */
+  /** Successful side effects retained until their durable acknowledgement. */
   processedSeqs = /* @__PURE__ */ new Set();
+  failedEnvelopes = /* @__PURE__ */ new Map();
+  /** Received work lacking a successful handler receipt, including malformed frames. */
+  unresolvedSeqs = /* @__PURE__ */ new Set();
   /**
    * Finding P3: the pending `drainOutbox` long-poll retry backoff, if any —
    * cancellable so `enterRevoked()` can unblock it immediately instead of
@@ -11062,8 +11297,8 @@ var ConnectionManager = class {
    * - F3 (at-most-once): the old code persisted the cursor advance BEFORE
    *   `onEnvelope` even ran (fire-and-forget) — a handler that then failed
    *   left a redelivery-proof envelope permanently marked processed. Inbound
-   *   envelopes are now serialized through `processingChain` (one handler
-   *   fully settles before the next starts) and the cursor only advances
+   *   handlers may run independently; their receipt commits are serialized.
+   *   The cursor only advances
    *   AFTER the handler resolves successfully; a rejection leaves the
    *   cursor where it was (see `stalledAtSeq`), so a future reconnect's
    *   redelivery re-attempts it — safe because every server->daemon type is
@@ -11079,62 +11314,72 @@ var ConnectionManager = class {
     if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
     if (tracked) {
       const seq3 = envelope.seq;
-      if (this.inFlightSeqs.has(seq3) || this.processedSeqs.has(seq3)) return false;
+      if (this.inFlightSeqs.has(seq3)) return false;
+      if (!this.processedSeqs.has(seq3)) this.unresolvedSeqs.add(seq3);
       this.inFlightSeqs.add(seq3);
-      this.noteDelivered(seq3);
     }
-    this.processingChain = this.processingChain.then(() => this.process(envelope, tracked));
+    const controlKey = envelope.task_id !== void 0 && !envelope.type.startsWith("task.offer") ? envelope.task_id : void 0;
+    const prior = controlKey === void 0 ? Promise.resolve() : this.controlTails.get(controlKey) ?? Promise.resolve();
+    const operation = prior.then(() => this.process(envelope, tracked));
+    if (controlKey !== void 0) {
+      this.controlTails.set(controlKey, operation);
+      void operation.finally(() => {
+        if (this.controlTails.get(controlKey) === operation) this.controlTails.delete(controlKey);
+      });
+    }
+    this.processingChain = Promise.all([this.processingChain, operation]).then(() => void 0);
     return true;
   }
-  /**
-   * The local watermark `deliver()` dedupes inbound `task.*` envelopes
-   * against. It is deliberately NOT the long-poll query cursor: that query
-   * is the kernel acknowledgement and uses only the successfully processed
-   * `cursor` (see the constructor). Normally this local watermark is
-   * `deliveredSeq` — which is always >= `cursor` (every envelope that
-   * reaches `advanceCursor` already passed through `noteDelivered` first,
-   * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
-   * design calls for, just expressed via that invariant rather than an
-   * explicit `Math.max`.
-   *
-   * While `stalledAtSeq` is set, this collapses to the durable `cursor`
-   * alone, deliberately ignoring however far `deliveredSeq` had already run
-   * ahead before the failure was known: that's what lets the stalled
-   * envelope's own redelivery (and everything after it, right up to a
-   * fresh success) get past this same dedup check instead of being
-   * self-deduped by the client's own earlier eager tracking of envelopes
-   * whose outcome wasn't known yet. No separate "reset deliveredSeq on
-   * reconnect" step is needed for this to be correct — collapsing to
-   * `cursor` exactly while stalled already produces the right answer on
-   * every long-poll retry path. NOT resetting it unconditionally on every
-   * retry lets `deliveredSeq` keep doing its job of not re-dispatching
-   * something already in flight while a handler is still running.
-   */
-  dedupWatermark() {
-    return this.stalledAtSeq !== void 0 ? this.cursor : this.deliveredSeq ?? this.cursor;
+  /** A committed terminal can settle a failed offer receipt even if cloud
+   * cancellation has since filtered that offer from mailbox replay. */
+  retryTaskReceipts(taskId) {
+    for (const envelope of this.failedEnvelopes.values()) {
+      if (envelope.task_id === taskId) this.deliver(envelope);
+    }
   }
-  /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
-  noteDelivered(seq3) {
-    if (this.deliveredSeq === void 0 || seq3 > this.deliveredSeq) this.deliveredSeq = seq3;
+  /** Only a durable acknowledgement can deduplicate a whole prefix. */
+  dedupWatermark() {
+    return this.cursor;
   }
   async process(envelope, tracked) {
     const seq3 = tracked ? envelope.seq : void 0;
     try {
+      if (tracked && seq3 <= (this.cursor ?? 0)) return;
       if (tracked && this.cursor === void 0) {
-        await this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0);
-        this.cursor = 0;
+        this.cursorInitialization ??= this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0).then(() => {
+          this.cursor = 0;
+        }).catch((error) => {
+          this.cursorInitialization = void 0;
+          throw error;
+        });
+        await this.cursorInitialization;
       }
-      await this.opts.onEnvelope(envelope);
+      if (!tracked || !this.processedSeqs.has(seq3)) await this.opts.onEnvelope(envelope);
       if (!tracked) return;
-      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) {
-        this.processedSeqs.add(seq3);
-        return;
-      }
-      this.stalledAtSeq = void 0;
-      await this.advanceCursor(envelope.seq);
-      this.processedSeqs.clear();
+      this.failedEnvelopes.delete(seq3);
+      this.processedSeqs.add(seq3);
+      this.unresolvedSeqs.delete(seq3);
+      const completion = this.completionTail.catch(() => void 0).then(async () => {
+        let firstUnresolved = Infinity;
+        for (const value of this.unresolvedSeqs) firstUnresolved = Math.min(firstUnresolved, value);
+        let prefix = this.cursor ?? 0;
+        for (const value of this.processedSeqs) if (value < firstUnresolved) prefix = Math.max(prefix, value);
+        if (prefix > (this.cursor ?? 0)) await this.advanceCursor(prefix);
+        for (const value of this.processedSeqs) {
+          if (value <= (this.cursor ?? 0)) {
+            this.processedSeqs.delete(value);
+            this.failedEnvelopes.delete(value);
+          }
+        }
+        this.stalledAtSeq = this.unresolvedSeqs.size > 0 ? firstUnresolved : void 0;
+      });
+      this.completionTail = completion;
+      await completion;
     } catch (err) {
-      if (tracked && this.stalledAtSeq === void 0) this.stalledAtSeq = envelope.seq;
+      if (tracked) {
+        this.failedEnvelopes.set(seq3, envelope);
+        this.stalledAtSeq = Math.min(envelope.seq, this.stalledAtSeq ?? Infinity);
+      }
       console.error(
         `[byok/client] envelope handler failed for ${envelope.type}${typeof envelope.seq === "number" ? ` (seq=${envelope.seq})` : ""}; cursor left unadvanced so a reconnect redelivers it:`,
         err
@@ -11143,11 +11388,10 @@ var ConnectionManager = class {
       if (tracked) this.inFlightSeqs.delete(seq3);
     }
   }
-  /** Serialized with handler completion, so invalid work cannot be acked by later success. */
+  /** Recorded synchronously at receive, before a later successful receipt can commit. */
   noteValidationFailure(seq3) {
-    this.processingChain = this.processingChain.then(() => {
-      if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq3;
-    });
+    this.unresolvedSeqs.add(seq3);
+    this.stalledAtSeq = Math.min(seq3, this.stalledAtSeq ?? seq3);
   }
   async advanceCursor(seq3) {
     if (this.cursor !== void 0 && seq3 <= this.cursor) return;
@@ -11517,7 +11761,7 @@ var CursorStore = class {
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
     await promises.mkdir(path14__default.dirname(file), { recursive: true, mode: 448 });
-    await atomicWriteFile(file, JSON.stringify({ cursor }));
+    await atomicWriteFile(file, JSON.stringify({ cursor }), { fsync: true });
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
   async clear(serverUrl, deviceId) {
@@ -12010,9 +12254,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path46, busyTimeoutMs, faults) {
+function openJournalDatabase(path47, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path46, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path47, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -12156,9 +12400,9 @@ var RECEIVED_STATE = "received";
 function byteLength2(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path46) {
+function fileBytes(path47) {
   try {
-    return statSync(path46).size;
+    return statSync(path47).size;
   } catch {
     return 0;
   }
@@ -13498,6 +13742,109 @@ async function spillOversizedEvent(event, deps) {
   return bounded2.result;
 }
 
+// src/daemon/admission-wait.ts
+async function awaitAdmission(operation, signal) {
+  signal.throwIfAborted();
+  let onAbort;
+  const aborted = new Promise((_, reject) => {
+    onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return operation();
+    }), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+
+// src/daemon/runtime-start.ts
+async function startOwnedRuntime(start, input, signal, timeoutMs) {
+  const controller = new AbortController();
+  let session;
+  let failure;
+  let settled = false;
+  const retryDisposal = async () => {
+    if (session) {
+      let timer2;
+      try {
+        await Promise.race([
+          Promise.resolve().then(() => session.interrupt()).catch(() => void 0),
+          new Promise((resolve) => {
+            timer2 = setTimeout(resolve, 1e3);
+            timer2.unref?.();
+          })
+        ]);
+      } finally {
+        if (timer2) clearTimeout(timer2);
+      }
+      return session.close();
+    }
+    if (isRuntimeStartupDisposalFailure(failure)) return failure.retryDisposal();
+    if (settled && isRuntimeExecutionFailure(failure)) return;
+    throw new RuntimeDisposalFailure({ stage: "quiescence", reason: "runtime startup has not returned a cleanup receipt" });
+  };
+  let rejectAbort;
+  const aborted = new Promise((_, reject) => {
+    rejectAbort = reject;
+  });
+  const abort = () => {
+    controller.abort();
+    rejectAbort(new RuntimeStartupDisposalFailure(retryDisposal));
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  const timer = setTimeout(abort, timeoutMs);
+  timer.unref?.();
+  try {
+    if (signal.aborted) {
+      throw new RuntimeDisposalFailure({ stage: "quiescence", reason: "runtime startup was cancelled before invocation" });
+    }
+    const startup = Promise.resolve().then(() => start({ ...input, signal: controller.signal })).then((value) => {
+      session = value;
+      settled = true;
+      return value;
+    }, (error) => {
+      failure = error;
+      settled = true;
+      throw error;
+    });
+    return await Promise.race([startup, aborted]);
+  } finally {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", abort);
+  }
+}
+
+// src/daemon/artifact-read.ts
+var DEFAULT_ARTIFACT_LIMITS = Object.freeze({
+  maxFileBytes: 16 * 1024 * 1024,
+  maxTaskBytes: 64 * 1024 * 1024
+});
+async function readArtifactBytes(handle, maxBytes, signal, account) {
+  signal.throwIfAborted();
+  const stat = await handle.stat();
+  if (stat.size > maxBytes) throw new Error("artifact local byte budget exceeded");
+  const chunks = [];
+  let total = 0;
+  const stream = handle.createReadStream({ autoClose: false, start: 0, signal, highWaterMark: 64 * 1024 });
+  try {
+    for await (const data of stream) {
+      signal.throwIfAborted();
+      const chunk = data;
+      account(chunk.length);
+      total += chunk.length;
+      if (total > maxBytes) throw new Error("artifact local byte budget exceeded");
+      chunks.push(chunk);
+    }
+    signal.throwIfAborted();
+    return Buffer.concat(chunks, total);
+  } finally {
+    stream.destroy();
+  }
+}
+
 // src/daemon/environment.ts
 var BASE_PLATFORM_ALLOWLIST = [
   "PATH",
@@ -13697,6 +14044,78 @@ var ProgressBatcher = class {
     }
   }
 };
+var DurableJsonlFile = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  failure;
+  assertWritable() {
+    if (this.failure !== void 0) {
+      throw new Error("durable JSONL writer is quarantined after uncertain I/O; reopen and validate the log before retrying", { cause: this.failure });
+    }
+  }
+  /** Replay is not a durability receipt: confirm the recovered bytes before use. */
+  async confirmRecovered() {
+    let handle;
+    try {
+      handle = await promises.open(this.filePath, "r+");
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await this.syncDirectory();
+  }
+  async append(json) {
+    this.assertWritable();
+    try {
+      const handle = await promises.open(this.filePath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
+      try {
+        const bytes = Buffer.from(`${json}
+`, "utf8");
+        let offset = 0;
+        while (offset < bytes.length) {
+          const { bytesWritten } = await handle.write(bytes, offset, bytes.length - offset);
+          if (bytesWritten <= 0) throw new Error("durable JSONL append made no progress");
+          offset += bytesWritten;
+        }
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await this.syncDirectory();
+    } catch (error) {
+      this.failure = error;
+      throw error;
+    }
+  }
+  async replace(lines) {
+    this.assertWritable();
+    try {
+      await atomicWriteFile(this.filePath, lines.map((line) => `${line}
+`).join(""), { mode: 384, fsync: true });
+    } catch (error) {
+      this.failure = error;
+      throw error;
+    }
+  }
+  async syncDirectory() {
+    if (process.platform === "win32") return;
+    const directory = await promises.open(path14__default.dirname(this.filePath), "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  }
+};
+
+// src/daemon/agent-message-outbox.ts
 var AGENT_MESSAGE_DIRECTORY = path14__default.join(".byok", "messages");
 var AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
 var AgentMessageOutboxError = class extends Error {
@@ -13723,11 +14142,14 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
   constructor(homeDir, outboxPath) {
     this.homeDir = homeDir;
     this.outboxPath = outboxPath;
+    this.file = new DurableJsonlFile(outboxPath);
   }
   homeDir;
   outboxPath;
   pendingByTask = /* @__PURE__ */ new Map();
+  revokedTasks = /* @__PURE__ */ new Set();
   dispositionByTask = /* @__PURE__ */ new Map();
+  file;
   nextCursor = 1;
   logEntries = 0;
   writeTail = Promise.resolve();
@@ -13736,6 +14158,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
     await ensureSecureDir(directory);
     const outbox = new _AgentMessageOutbox(homeDir, path14__default.join(directory, AGENT_MESSAGE_OUTBOX_FILENAME));
     await outbox.load();
+    await outbox.file.confirmRecovered();
     return outbox;
   }
   /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
@@ -13776,9 +14199,9 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
   records() {
     return Object.freeze([...this.pendingByTask.values()].sort((a, b) => a.cursor - b.cursor));
   }
-  /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+  /** Records without disposition or local revoke; transport replay additionally requires session binding. */
   retryableRecords() {
-    return Object.freeze(this.records().filter((record4) => !this.dispositionByTask.has(record4.taskId)));
+    return Object.freeze(this.records().filter((record4) => !this.dispositionByTask.has(record4.taskId) && !this.revokedTasks.has(record4.taskId)));
   }
   get(taskId) {
     return this.pendingByTask.get(taskId);
@@ -13790,13 +14213,14 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       if (byteCount < 1 || byteCount > input.requirement.maxBytes) throw new AgentMessageOutboxError("message body exceeds the offer byte contract");
       const existing = this.pendingByTask.get(input.taskId);
       if (existing !== void 0) {
-        if (existing.tenantId !== input.tenantId || existing.contentType !== input.contentType || existing.body !== input.body || existing.contract !== input.requirement.contract || !sameAgentRef(existing.agentRef, input.agentRef)) {
+        if (existing.tenantId !== input.tenantId || existing.contentType !== input.contentType || existing.body !== input.body || existing.contract !== input.requirement.contract || input.sessionRef !== void 0 && existing.sessionRef !== input.sessionRef || !sameAgentRef(existing.agentRef, input.agentRef)) {
           throw new AgentMessageOutboxError("required-message task already has a different immutable draft");
         }
         return existing;
       }
-      if (this.pendingByTask.size >= input.maxPendingEvents) throw new AgentMessageOutboxError("message outbox event quota is exhausted");
-      const pendingBytes = this.records().reduce((sum, record5) => sum + record5.byteCount, 0);
+      const sending = this.records().filter((record5) => !this.isTerminalEvidence(record5.taskId));
+      if (sending.length >= input.maxPendingEvents) throw new AgentMessageOutboxError("message outbox event quota is exhausted");
+      const pendingBytes = sending.reduce((sum, record5) => sum + record5.byteCount, 0);
       if (pendingBytes + byteCount > input.maxPendingBytes) throw new AgentMessageOutboxError("message outbox byte quota is exhausted");
       const record4 = Object.freeze({
         schema: 1,
@@ -13818,8 +14242,9 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       return record4;
     });
   }
-  async activate(taskId, sessionRef) {
+  async activate(taskId, sessionRef, isCurrent = () => true) {
     return this.exclusive(async () => {
+      if (!isCurrent() || this.revokedTasks.has(taskId)) return void 0;
       const record4 = this.pendingByTask.get(taskId);
       if (record4 === void 0) return void 0;
       if (record4.sessionRef !== void 0) {
@@ -13832,6 +14257,18 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       return activated;
     });
   }
+  /** Local lifecycle cancellation, never a synthesized consumer disposition. */
+  async revoke(taskId) {
+    return this.exclusive(async () => {
+      const record4 = this.pendingByTask.get(taskId);
+      if (record4 === void 0 || this.revokedTasks.has(taskId)) return;
+      await this.appendEntry({ schema: 1, kind: "revoke", taskId, messageId: record4.messageId });
+      this.revokedTasks.add(taskId);
+    });
+  }
+  isTerminalEvidence(taskId) {
+    return this.revokedTasks.has(taskId) || this.dispositionByTask.get(taskId)?.outcome === "refused";
+  }
   publishPayload(record4) {
     if (record4.sessionRef === void 0) throw new AgentMessageOutboxError("message draft is not bound to a durable session");
     return AgentMessagePublishPayloadSchema.parse({
@@ -13855,6 +14292,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       await this.appendEntry({ schema: 1, kind: "disposition", taskId, disposition });
       if (disposition.outcome === "accepted") {
         this.pendingByTask.delete(taskId);
+        this.revokedTasks.delete(taskId);
         this.dispositionByTask.delete(taskId);
       } else {
         this.dispositionByTask.set(taskId, disposition);
@@ -13873,6 +14311,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       if (error.code === "ENOENT") return;
       throw error;
     }
+    if (raw.length > 0 && !raw.endsWith("\n")) throw new AgentMessageOutboxError("durable JSONL log has an incomplete trailing frame; preserve the file for explicit repair");
     for (const line of raw.split("\n")) {
       if (line.length === 0) continue;
       const entry = JSON.parse(line);
@@ -13887,11 +14326,16 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
         if (record4 === void 0 || record4.messageId !== entry.messageId) throw new AgentMessageOutboxError("message activation has no exact draft");
         if (record4.sessionRef !== void 0 && record4.sessionRef !== entry.sessionRef) throw new AgentMessageOutboxError("message activation session conflicts");
         this.pendingByTask.set(entry.taskId, Object.freeze({ ...record4, sessionRef: entry.sessionRef }));
+      } else if (entry.kind === "revoke") {
+        const record4 = this.pendingByTask.get(entry.taskId);
+        if (record4 === void 0 || record4.messageId !== entry.messageId) throw new AgentMessageOutboxError("message revocation has no exact draft");
+        this.revokedTasks.add(entry.taskId);
       } else if (entry.kind === "disposition") {
         const record4 = this.pendingByTask.get(entry.taskId);
         if (record4 === void 0 || !exactDisposition(record4, entry.disposition)) throw new AgentMessageOutboxError("message outbox contains a mismatched disposition");
         if (entry.disposition.outcome === "accepted") {
           this.pendingByTask.delete(entry.taskId);
+          this.revokedTasks.delete(entry.taskId);
           this.dispositionByTask.delete(entry.taskId);
         } else {
           this.dispositionByTask.set(entry.taskId, entry.disposition);
@@ -13902,23 +14346,47 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
     }
   }
   async appendEntry(entry) {
-    const handle = await promises.open(this.outboxPath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
-    try {
-      await handle.write(`${stableJson(entry)}
-`, void 0, "utf8");
-      await handle.sync();
-      this.logEntries += 1;
-    } finally {
-      await handle.close();
-    }
+    await this.file.append(stableJson(entry));
+    this.logEntries += 1;
   }
-  async compact() {
-    const entries = this.records().flatMap((record4) => {
+  /**
+   * Explicit operator maintenance under the Agent-home single-writer lease.
+   * Copy complete terminal evidence durably before removing it from the live log.
+   * Archives are audit artifacts, never another replay input. held remains live.
+   */
+  async archiveTerminalRecords(archiveDirectory) {
+    return this.exclusive(async () => {
+      if (!path14__default.isAbsolute(archiveDirectory)) throw new AgentMessageOutboxError("message archive directory must be absolute");
+      const terminal = this.records().filter((record4) => this.isTerminalEvidence(record4.taskId));
+      if (terminal.length === 0) return void 0;
+      await ensureSecureDir(archiveDirectory);
+      const archivePath = path14__default.join(archiveDirectory, `message-terminal-${randomUUID()}.jsonl`);
+      await atomicWriteFile(archivePath, this.snapshotEntries(terminal).map((entry) => `${stableJson(entry)}
+`).join(""), { mode: 384, fsync: true });
+      const retained = this.records().filter((record4) => !this.isTerminalEvidence(record4.taskId));
+      const entries = this.snapshotEntries(retained);
+      await this.file.replace(entries.map((entry) => stableJson(entry)));
+      for (const record4 of terminal) {
+        this.pendingByTask.delete(record4.taskId);
+        this.dispositionByTask.delete(record4.taskId);
+        this.revokedTasks.delete(record4.taskId);
+      }
+      this.logEntries = entries.length;
+      return archivePath;
+    });
+  }
+  snapshotEntries(records) {
+    return records.flatMap((record4) => {
       const append = { schema: 1, kind: "append", record: record4 };
       const disposition = this.dispositionByTask.get(record4.taskId);
-      return disposition === void 0 ? [append] : [append, { schema: 1, kind: "disposition", taskId: record4.taskId, disposition }];
+      const entries = disposition === void 0 ? [append] : [append, { schema: 1, kind: "disposition", taskId: record4.taskId, disposition }];
+      if (this.revokedTasks.has(record4.taskId)) entries.push({ schema: 1, kind: "revoke", taskId: record4.taskId, messageId: record4.messageId });
+      return entries;
     });
-    await atomicWriteFile(this.outboxPath, entries.map(stableJson).join(entries.length === 0 ? "" : "\n"), { mode: 384 });
+  }
+  async compact() {
+    const entries = this.snapshotEntries(this.records());
+    await this.file.replace(entries.map((entry) => stableJson(entry)));
     this.logEntries = entries.length;
   }
   async exclusive(fn) {
@@ -13929,6 +14397,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
     });
     await prior;
     try {
+      this.file.assertWritable();
       return await fn();
     } finally {
       release();
@@ -15109,7 +15578,7 @@ var TaskRunner = class {
    */
   stoppingOffers = false;
   get activeTaskCount() {
-    return this.tasks.size;
+    return this.tasks.size + this.startupOwners.size;
   }
   /**
    * Transport-boundary classification for the currently active task. Legacy
@@ -15155,6 +15624,12 @@ var TaskRunner = class {
     const active = this.tasks.get(taskId);
     const context = pending ?? (active?.messageRequirement && active.agentRef && active.messageOutbox ? { agentRef: active.agentRef, requirement: active.messageRequirement, outbox: active.messageOutbox } : void 0);
     if (context === void 0) throw new Error("task has no active required Agent message contract");
+    const isCurrent = () => {
+      if (this.messageContextByToken.get(input.contextToken) !== taskId || this.messageContextByTask.get(taskId) !== input.contextToken || this.pendingCancelled.has(taskId)) return false;
+      const current2 = this.tasks.get(taskId);
+      return current2 === void 0 ? active === void 0 && this.pendingMessageTasks.get(taskId) === pending : (active === void 0 || current2 === active) && current2.messageOutbox === context.outbox && this.canPublishAgentMessage(current2);
+    };
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
     const record4 = await context.outbox.appendDraft({
       taskId,
       tenantId: this.deps.tenantId,
@@ -15165,8 +15640,17 @@ var TaskRunner = class {
       maxPendingEvents: 64,
       maxPendingBytes: 4 * 1024 * 1024
     });
-    if (active === void 0) return { messageId: record4.messageId, state: "staged" };
-    const activated = await context.outbox.activate(taskId, active.session.sessionRef);
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
+    const current = this.tasks.get(taskId);
+    if (current === void 0) return { messageId: record4.messageId, state: "staged" };
+    const activated = await this.activateAgentMessage(
+      context.outbox,
+      taskId,
+      current.session.sessionRef,
+      isCurrent,
+      () => current.messageSendAttempted === true
+    );
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
     if (activated === void 0) throw new Error("Agent message draft disappeared before activation");
     this.sendAgentMessageRecord(context.outbox, activated);
     return { messageId: activated.messageId, state: "pending" };
@@ -15202,19 +15686,39 @@ var TaskRunner = class {
     });
     return opened;
   }
+  /** A recovery terminal must not close first-message admission before this durable draft has a disposition. */
+  hasPendingRecoveredAgentMessage(taskId) {
+    return this.recoveredMessageOutboxes.get(taskId)?.retryableRecords().some((record4) => record4.taskId === taskId && record4.sessionRef !== void 0) === true;
+  }
   /** Retry stable recovered records after a transport handshake/re-handshake. */
   retryRecoveredAgentMessages() {
     for (const [taskId, outbox] of this.recoveredMessageOutboxes) {
       const record4 = outbox.get(taskId);
-      if (record4?.sessionRef !== void 0) this.sendAgentMessageRecord(outbox, record4);
+      if (record4?.sessionRef !== void 0 && this.hasPendingRecoveredAgentMessage(taskId)) this.sendAgentMessageRecord(outbox, record4);
+    }
+  }
+  canPublishAgentMessage(active) {
+    return this.tasks.get(active.taskId) === active && !active.beingTornDown;
+  }
+  /** All authors and startup use the same queue-time and post-I/O authority check. */
+  async activateAgentMessage(outbox, taskId, sessionRef, isCurrent, wasSendAttempted = () => false) {
+    if (!isCurrent()) return void 0;
+    const record4 = await outbox.activate(taskId, sessionRef, isCurrent);
+    if (!isCurrent()) {
+      if (!wasSendAttempted()) await outbox.revoke(taskId);
+      return void 0;
     }
+    return record4;
   }
   sendAgentMessageRecord(outbox, record4) {
+    const active = this.tasks.get(record4.taskId);
+    const authorized = active === void 0 ? this.recoveredMessageOutboxes.get(record4.taskId) === outbox : active.messageOutbox === outbox && this.canPublishAgentMessage(active);
+    if (!authorized || record4.sessionRef === void 0 || !outbox.retryableRecords().some((pending) => pending.messageId === record4.messageId)) return;
+    if (active !== void 0) active.messageSendAttempted = true;
     this.deps.send(createEnvelope("agent.message.publish", outbox.publishPayload(record4), {
       taskId: record4.taskId,
       sessionRef: record4.sessionRef
     }));
-    const active = this.tasks.get(record4.taskId);
     if (active?.messageOutbox === outbox) {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = setTimeout(() => {
@@ -15254,6 +15758,7 @@ var TaskRunner = class {
       if (outcome === "accepted") this.recoveredMessageOutboxes.delete(taskId);
       return;
     }
+    if (this.tasks.get(taskId) !== active) return;
     if (outcome === "held") {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = void 0;
@@ -15263,6 +15768,8 @@ var TaskRunner = class {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = void 0;
       this.revokeAgentMessageContext(taskId);
+      active.pendingMessageCompletion = void 0;
+      await this.fail(taskId, "required Agent message was refused", false);
       return;
     }
     if (outcome !== "accepted") return;
@@ -15281,6 +15788,9 @@ var TaskRunner = class {
   /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
   stopAcceptingOffers() {
     this.stoppingOffers = true;
+    if (this.startupRetryTimer) clearTimeout(this.startupRetryTimer);
+    this.startupRetryTimer = void 0;
+    for (const abort of this.inFlightBlobAborts.values()) abort.abort();
   }
   /**
    * Shutdown of every currently ACTIVE task for the control socket's
@@ -15319,9 +15829,65 @@ var TaskRunner = class {
    * ahead of this method — see `daemon-control-socket.test.ts`'s dedicated
    * regression test for the exact scenario.
    */
-  async shutdownActiveTasks(reason) {
-    const active = [...this.tasks.values()];
+  /** Startup resources have an owner even before a Session can become active. */
+  startupRetryTimer;
+  claimedHarnesses = /* @__PURE__ */ new Map();
+  homeReservations = /* @__PURE__ */ new Map();
+  startupOwners = /* @__PURE__ */ new Map();
+  startupDisposals = /* @__PURE__ */ new Map();
+  disposeStartupOwner(taskId) {
+    const existing = this.startupDisposals.get(taskId);
+    if (existing) return existing;
+    const attempt = this.disposeStartupOwnerOnce(taskId).finally(() => this.startupDisposals.delete(taskId));
+    this.startupDisposals.set(taskId, attempt);
+    return attempt;
+  }
+  async disposeStartupOwnerOnce(taskId) {
+    const owner = this.startupOwners.get(taskId);
+    if (!owner) return true;
+    try {
+      await owner.settle?.();
+      await owner.dispose();
+      await this.deps.awaitTerminalCommit?.(taskId);
+      await owner.release();
+    } catch (caught) {
+      const failure = isRuntimeDisposalFailure(caught) ? caught : new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: "startup runtime disposal has not been confirmed"
+      }, { cause: caught });
+      this.deps.onRuntimeDisposalFailure?.({
+        taskId,
+        runtimeId: owner.runtimeId,
+        stage: failure.stage,
+        reason: failure.message
+      });
+      console.error(`[byok/client] startup ownership retained for ${taskId}: ${failure.message}`);
+      if (!this.startupRetryTimer && !this.stoppingOffers) {
+        this.startupRetryTimer = setTimeout(() => {
+          this.startupRetryTimer = void 0;
+          for (const id of this.startupOwners.keys()) {
+            if (!this.inFlightOffers.has(id)) void this.disposeStartupOwner(id);
+          }
+        }, 1e3);
+        this.startupRetryTimer.unref?.();
+      }
+      return false;
+    }
+    if (this.startupOwners.get(taskId) === owner) this.startupOwners.delete(taskId);
+    this.pendingMessageTasks.delete(taskId);
+    this.revokeAgentMessageContext(taskId);
+    this.revokeAgentMemoryContext(taskId);
+    return true;
+  }
+  async shutdownActiveTasks(reason) {
+    const active = [...this.tasks.values()];
     await Promise.all(active.map((task) => this.shutdownTask(task, reason)));
+    for (const taskId of this.startupOwners.keys()) {
+      if (!await this.disposeStartupOwner(taskId)) throw new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: "startup runtime ownership remains quarantined"
+      });
+    }
   }
   /**
    * M5 batch-3 (workstream 2): the ONE shared per-task teardown sequence —
@@ -15353,14 +15919,19 @@ var TaskRunner = class {
    * a genuine protocol bug, not a benign race — mirrors `pump()`'s own
    * identity-check guard for the same class of race.
    */
+  async interruptBounded(session) {
+    await raceSettleFirst(
+      () => session.interrupt(),
+      this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS
+    );
+  }
   async teardownActiveTask(active, reason, retryable) {
     if (active.finalizationStarted) return this.finish(active.taskId);
     if (!this.reserveSemanticTerminal(active)) return active.semanticTerminalSettled ?? false;
     active.beingTornDown = true;
     active.blobAbort.abort();
     await this.observeGit(active, "salvage");
-    const timeoutMs = this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS;
-    await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
+    await this.interruptBounded(active.session);
     if (this.tasks.get(active.taskId) !== active) return true;
     await this.persistAgentTerminalEvidence(active, "failed", reason);
     this.deps.send(
@@ -15462,7 +16033,7 @@ var TaskRunner = class {
     }
   }
   async handleOffer(taskId, payload, strictAgentOffer) {
-    if (this.tasks.has(taskId) || this.finishedTaskIds.has(taskId) || this.strictDeclinedTaskIds.has(taskId)) {
+    if (this.tasks.has(taskId) || this.startupOwners.has(taskId) || this.inFlightOffers.has(taskId) || this.finishedTaskIds.has(taskId) || this.strictDeclinedTaskIds.has(taskId)) {
       return;
     }
     let agentRef;
@@ -15505,9 +16076,29 @@ var TaskRunner = class {
     }
     this.inFlightOffers.add(taskId);
     const blobAbort = new AbortController();
+    const startupDeadline = Date.now() + (this.deps.startupTimeoutMs ?? 3e4);
+    const startupTimer = setTimeout(
+      () => blobAbort.abort(new Error("runtime startup deadline exceeded during admission/start")),
+      this.deps.startupTimeoutMs ?? 3e4
+    );
+    startupTimer.unref?.();
+    const admissionWithdrawn = () => {
+      if (!blobAbort.signal.aborted) return false;
+      const cancelled = this.pendingCancelled.has(taskId);
+      decline(cancelled ? "cancelled before claim" : this.stoppingOffers ? "daemon is shutting down" : "runtime startup deadline exceeded", !cancelled);
+      return true;
+    };
     this.inFlightBlobAborts.set(taskId, blobAbort);
     let agentBinding;
     let agentLeaseTransferred = false;
+    let reservedHome;
+    const releaseReservation = () => {
+      if (reservedHome === void 0) return;
+      const remaining = this.homeReservations.get(reservedHome) - 1;
+      if (remaining === 0) this.homeReservations.delete(reservedHome);
+      else this.homeReservations.set(reservedHome, remaining);
+      reservedHome = void 0;
+    };
     try {
       if (this.pendingCancelled.has(taskId)) {
         const reason = this.pendingCancelled.get(taskId);
@@ -15532,11 +16123,14 @@ var TaskRunner = class {
           );
           return;
         }
-        const active2 = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome);
-        if (active2 >= limit) {
-          decline(`agent home busy: ${active2} active attempt(s)`, true);
+        if (admissionWithdrawn()) return;
+        const active = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome) + (this.homeReservations.get(canonicalHome) ?? 0);
+        if (active >= limit) {
+          decline(`agent home busy: ${active} active attempt(s)`, true);
           return;
         }
+        this.homeReservations.set(canonicalHome, (this.homeReservations.get(canonicalHome) ?? 0) + 1);
+        reservedHome = canonicalHome;
       }
       const guarded = this.deps.admissionGuard?.({ taskId, payload });
       if (guarded !== void 0 && !guarded.admit) {
@@ -15568,6 +16162,14 @@ var TaskRunner = class {
         );
         return;
       }
+      if (payload.harnessId !== void 0 && (payload.runtime !== void 0 || payload.dispatchSelection !== void 0)) {
+        decline("harnessId cannot be combined with a built-in runtime selection", false);
+        return;
+      }
+      if (payload.harnessId !== void 0 && !(this.deps.getServerCapabilities?.() ?? []).includes("custom-harness")) {
+        decline("server does not support custom-harness identity", false);
+        return;
+      }
       const requiredToolsets = "requiredToolsets" in payload ? payload.requiredToolsets : void 0;
       const resolvedMcp = requiredToolsets ? this.resolveMcpServers(requiredToolsets) : void 0;
       if (resolvedMcp && !resolvedMcp.ok) {
@@ -15580,17 +16182,29 @@ var TaskRunner = class {
         return;
       }
       const offered = withoutRequiredToolsets(payload);
-      const requestedRuntime = payload.dispatchSelection?.runtimeId ?? payload.runtime;
+      const requestedRuntime = payload.harnessId ?? payload.dispatchSelection?.runtimeId ?? payload.runtime;
       const requiresAgentMemoryMcp = agentRef !== void 0 && this.deps.agentMemoryMcpBin !== void 0 && isAgentMemorySecureFilesystemAvailable(this.deps.agentMemoryFilesystemHelperBin !== void 0);
-      const pick = await this.pickAdapter(
-        requestedRuntime,
-        payload.policy.mode,
-        requiredToolsets !== void 0 || messageRequirement !== void 0 || requiresAgentMemoryMcp
-      );
+      let pick;
+      try {
+        pick = await this.pickAdapter(
+          requestedRuntime,
+          payload.policy.mode,
+          requiredToolsets !== void 0 || messageRequirement !== void 0 || requiresAgentMemoryMcp,
+          blobAbort.signal
+        );
+      } catch (error) {
+        if (!admissionWithdrawn()) decline(`runtime detection failed: ${errorMessage5(error)}`, true);
+        return;
+      }
+      if (admissionWithdrawn()) return;
       if (!pick.ok) {
         decline(pick.reason, pick.retryable);
         return;
       }
+      if (!isKnownRuntimeId(pick.descriptor.id) && !(this.deps.getServerCapabilities?.() ?? []).includes("custom-harness")) {
+        decline("server does not support the selected custom harness identity", false);
+        return;
+      }
       const env = buildRuntimeEnv({
         ambient: process.env,
         requirements: pick.descriptor.environmentRequirements,
@@ -15664,18 +16278,20 @@ var TaskRunner = class {
       }
       let prepared;
       try {
-        prepared = await pick.adapter.prepare({
+        prepared = await awaitAdmission(() => pick.adapter.prepare({
+          signal: blobAbort.signal,
           offer: offered,
           policy: decision.policy,
           descriptor: pick.descriptor,
           requiredToolsetIds: requiredToolsets ?? [],
           ...taskMcpServers === void 0 ? {} : { mcpServers: taskMcpServers },
           ...mcpToolsetTools === void 0 ? {} : { mcpToolsetTools }
-        });
+        }), blobAbort.signal);
       } catch (error) {
-        decline(`runtime preparation failed: ${errorMessage5(error)}`, true);
+        if (!admissionWithdrawn()) decline(`runtime preparation failed: ${errorMessage5(error)}`, true);
         return;
       }
+      if (admissionWithdrawn()) return;
       if (prepared.kind === "reject") {
         decline(prepared.reason, prepared.retryable);
         return;
@@ -15683,6 +16299,7 @@ var TaskRunner = class {
       if (agentRef !== void 0) {
         try {
           agentBinding = await this.deps.agentHome.acquireExecution(agentRef, { taskId, sessionRef });
+          releaseReservation();
         } catch (error) {
           decline(
             `Agent home admission failed: ${errorMessage5(error)}`,
@@ -15807,7 +16424,16 @@ var TaskRunner = class {
         },
         forwardedEnvironmentNames: Object.freeze(Object.keys(env).sort())
       });
+      if (admissionWithdrawn()) {
+        gitLease?.release();
+        return;
+      }
       await this.deps.beforeClaim?.(taskId, manifest.descriptor.id);
+      if (admissionWithdrawn()) {
+        gitLease?.release();
+        return;
+      }
+      if (!isKnownRuntimeId(manifest.descriptor.id)) this.claimedHarnesses.set(taskId, manifest.descriptor.id);
       this.deps.send(
         createEnvelope(
           "task.claim",
@@ -15825,6 +16451,7 @@ var TaskRunner = class {
             // where an auto-selected task left the server never learning
             // which runtime actually ran.
             runtime: isKnownRuntimeId(manifest.descriptor.id) ? manifest.descriptor.id : void 0,
+            ...!isKnownRuntimeId(manifest.descriptor.id) ? { harnessId: manifest.descriptor.id } : {},
             // S0/D-4 (`task.claim.capabilities`, docs/protocol.md §2.4): the
             // selected adapter's own capability self-report, carried on the
             // same message that establishes the task↔runtime binding. The
@@ -15942,8 +16569,57 @@ var TaskRunner = class {
       };
       let session;
       try {
-        session = await prepared.operation.start(startInput);
+        session = await startOwnedRuntime(
+          (input) => prepared.operation.start(input),
+          startInput,
+          blobAbort.signal,
+          Math.max(0, startupDeadline - Date.now())
+        );
       } catch (err) {
+        const disposalFailure = isRuntimeStartupDisposalFailure(err);
+        const cancelled = this.pendingCancelled.has(taskId);
+        if (disposalFailure || cancelled) {
+          if (cancelled) this.revokeAgentMessageContext(taskId);
+          const ownedBinding2 = agentBinding;
+          const cancellation = createEnvelope("task.cancelled", {
+            reason: this.pendingCancelled.get(taskId),
+            ...terminalIdentity(this.claimedHarnesses.get(taskId)),
+            ...agentBinding === void 0 ? {} : { agentRef: agentBinding.resolution.agentRef }
+          }, { taskId });
+          let cancellationSettled = false;
+          this.startupOwners.set(taskId, {
+            runtimeId: pick.descriptor.id,
+            dispose: disposalFailure ? err.retryDisposal : async () => {
+            },
+            ...cancelled ? { settle: async () => {
+              if (cancellationSettled) return;
+              await this.pendingMessageTasks.get(taskId)?.outbox.revoke(taskId);
+              this.deps.send(cancellation);
+              cancellationSettled = true;
+              this.pendingCancelled.delete(taskId);
+              this.addFinishedTaskId(taskId);
+            } } : {},
+            release: async () => {
+              await ownedBinding2?.lease.release();
+              gitLease?.release();
+            }
+          });
+          agentLeaseTransferred = true;
+          if (disposalFailure) this.deps.onRuntimeDisposalFailure?.({
+            taskId,
+            runtimeId: pick.descriptor.id,
+            stage: "quiescence",
+            reason: err.message
+          });
+          if (!cancelled) {
+            if (agentBinding === void 0) await this.fail(taskId, errorMessage5(err), false);
+            else await this.failClaimedAgent(taskId, errorMessage5(err), false, {
+              binding: agentBinding,
+              runtimeId: pick.descriptor.id
+            });
+          }
+          return;
+        }
         const failure = projectRuntimeBoundaryFailure(err, "start");
         if (failure.contractViolation) {
           console.error("[byok/client] runtime adapter start() returned an untyped failure", err);
@@ -15960,143 +16636,169 @@ var TaskRunner = class {
         }
         return;
       }
-      if (agentBinding !== void 0) {
-        try {
-          await agentBinding.lease.bindSession(session.sessionRef);
-        } catch (error) {
-          await session.close().catch(() => {
-          });
-          await this.failClaimedAgent(
-            taskId,
-            `Agent session execution lease could not bind the runtime session: ${errorMessage5(error)}`,
-            false,
-            {
-              binding: agentBinding,
-              runtimeId: pick.descriptor.id,
-              sessionRef: session.sessionRef
-            }
-          );
-          return;
+      const ownedBinding = agentBinding;
+      this.startupOwners.set(taskId, {
+        runtimeId: pick.descriptor.id,
+        dispose: () => session.close(),
+        release: async () => {
+          await ownedBinding?.lease.release();
+          gitLease?.release();
         }
-      }
-      let active;
-      active = {
-        taskId,
-        blobAbort,
-        egressEnabled: "egressPolicy" in payload,
-        adapter: pick.adapter,
-        session,
-        workspaceDir,
-        ...agentBinding === void 0 ? {} : {
-          agentBinding,
-          agentRef: agentBinding.resolution.agentRef,
-          agentHandoff: {
-            sessionRef: session.sessionRef,
-            runtimeId: pick.descriptor.id,
-            cwd: workspaceDir
-          }
-        },
-        gitWorkspaceId,
-        gitLease,
-        gitBaseline,
-        summaryParts: [],
-        finalTextParts: [],
-        batcher: new ProgressBatcher(
-          (seq3, events) => {
-            const projected = active.egressEnabled ? this.deps.agentEgress?.projectLatestValue({
-              agentRef: active.agentRef,
+      });
+      try {
+        if (agentBinding !== void 0) {
+          try {
+            await agentBinding.lease.bindSession(session.sessionRef);
+          } catch (error) {
+            await this.failClaimedAgent(
               taskId,
-              events,
-              serverCapabilities: this.deps.getServerCapabilities?.() ?? []
-            }) ?? [] : events;
-            if (projected.length > 0) this.deps.send(createEnvelope("task.progress", { seq: seq3, events: [...projected] }, { taskId, seq: seq3 }));
-          },
-          this.deps.batcherOptions
-        ),
-        approvalQueue: [],
-        outputBytesSoFar: 0,
-        startedAtMs: Date.now(),
-        ...messageRequirement === void 0 ? {} : {
-          messageRequirement,
-          messageOutbox: this.pendingMessageTasks.get(taskId).outbox
-        },
-        ...terminalProjection === void 0 ? {} : { terminalProjection }
-      };
-      if (agentBinding !== void 0) {
-        const binding = agentBinding;
-        try {
-          await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
-            agentRef: binding.resolution.agentRef,
-            taskId,
-            sessionRef: session.sessionRef,
-            runtimeId: pick.descriptor.id,
-            cwd: workspaceDir,
-            leaseId: binding.lease.leaseId
-          }));
-        } catch (error) {
-          await session.close().catch(() => {
-          });
-          await this.failClaimedAgent(
-            taskId,
-            `Agent session handoff could not be durably written before start: ${errorMessage5(error)}`,
-            false,
-            {
-              binding: agentBinding,
+              `Agent session execution lease could not bind the runtime session: ${errorMessage5(error)}`,
+              false,
+              {
+                binding: agentBinding,
+                runtimeId: pick.descriptor.id,
+                sessionRef: session.sessionRef
+              }
+            );
+            return;
+          }
+        }
+        let active;
+        active = {
+          taskId,
+          blobAbort,
+          egressEnabled: "egressPolicy" in payload,
+          adapter: pick.adapter,
+          session,
+          workspaceDir,
+          ...agentBinding === void 0 ? {} : {
+            agentBinding,
+            agentRef: agentBinding.resolution.agentRef,
+            agentHandoff: {
+              sessionRef: session.sessionRef,
               runtimeId: pick.descriptor.id,
-              sessionRef: session.sessionRef
+              cwd: workspaceDir
             }
+          },
+          gitWorkspaceId,
+          gitLease,
+          gitBaseline,
+          summaryParts: [],
+          finalTextParts: [],
+          batcher: new ProgressBatcher(
+            (seq3, events) => {
+              const projected = active.egressEnabled ? this.deps.agentEgress?.projectLatestValue({
+                agentRef: active.agentRef,
+                taskId,
+                events,
+                serverCapabilities: this.deps.getServerCapabilities?.() ?? []
+              }) ?? [] : events;
+              if (projected.length > 0) this.deps.send(createEnvelope("task.progress", { seq: seq3, events: [...projected] }, { taskId, seq: seq3 }));
+            },
+            this.deps.batcherOptions
+          ),
+          approvalQueue: [],
+          outputBytesSoFar: 0,
+          startedAtMs: Date.now(),
+          ...messageRequirement === void 0 ? {} : {
+            messageRequirement,
+            messageOutbox: this.pendingMessageTasks.get(taskId).outbox
+          },
+          ...terminalProjection === void 0 ? {} : { terminalProjection }
+        };
+        if (agentBinding !== void 0) {
+          const binding = agentBinding;
+          try {
+            await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
+              agentRef: binding.resolution.agentRef,
+              taskId,
+              sessionRef: session.sessionRef,
+              runtimeId: pick.descriptor.id,
+              cwd: workspaceDir,
+              leaseId: binding.lease.leaseId
+            }));
+          } catch (error) {
+            await this.failClaimedAgent(
+              taskId,
+              `Agent session handoff could not be durably written before start: ${errorMessage5(error)}`,
+              false,
+              {
+                binding: agentBinding,
+                runtimeId: pick.descriptor.id,
+                sessionRef: session.sessionRef
+              }
+            );
+            return;
+          }
+        }
+        const activatedMessageRecord = active.messageOutbox === void 0 ? void 0 : await this.activateAgentMessage(
+          active.messageOutbox,
+          taskId,
+          session.sessionRef,
+          () => !this.pendingCancelled.has(taskId) && !blobAbort.signal.aborted
+        );
+        if (this.pendingCancelled.has(taskId)) {
+          const reason = this.pendingCancelled.get(taskId);
+          this.pendingCancelled.delete(taskId);
+          agentLeaseTransferred = agentBinding !== void 0;
+          this.startupOwners.delete(taskId);
+          this.tasks.set(taskId, active);
+          this.reserveSemanticTerminal(active);
+          await this.interruptBounded(session);
+          await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
+          await this.persistAgentTerminalEvidence(active, "cancelled", reason);
+          this.deps.send(
+            createEnvelope(
+              "task.cancelled",
+              { reason, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
+              { taskId }
+            )
           );
+          await this.finish(taskId);
           return;
         }
-      }
-      const activatedMessageRecord = active.messageOutbox === void 0 ? void 0 : await active.messageOutbox.activate(taskId, session.sessionRef);
-      if (this.pendingCancelled.has(taskId)) {
-        const reason = this.pendingCancelled.get(taskId);
-        this.pendingCancelled.delete(taskId);
+        this.deps.send(createEnvelope("task.started", {}, { taskId }));
         agentLeaseTransferred = agentBinding !== void 0;
+        this.inFlightBlobAborts.delete(taskId);
+        this.startupOwners.delete(taskId);
         this.tasks.set(taskId, active);
-        this.reserveSemanticTerminal(active);
-        try {
-          await session.interrupt();
-        } catch {
+        this.pendingMessageTasks.delete(taskId);
+        if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
+          this.sendAgentMessageRecord(active.messageOutbox, activatedMessageRecord);
         }
-        await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
-        await this.persistAgentTerminalEvidence(active, "cancelled", reason);
-        this.deps.send(
-          createEnvelope(
-            "task.cancelled",
-            { reason, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
-            { taskId }
-          )
-        );
-        await this.finish(taskId);
-        return;
-      }
-      this.deps.send(createEnvelope("task.started", {}, { taskId }));
-      agentLeaseTransferred = agentBinding !== void 0;
-      this.inFlightBlobAborts.delete(taskId);
-      this.tasks.set(taskId, active);
-      this.pendingMessageTasks.delete(taskId);
-      if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
-        this.sendAgentMessageRecord(active.messageOutbox, activatedMessageRecord);
-      }
-      if (payload.limits?.maxDurationMs !== void 0) {
-        this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
-      }
-      void this.pump(active);
-      if (agentBinding === void 0) {
-        void this.deps.sessionWorkspaces.record(session.sessionRef, {
-          workspaceDir,
-          runtimeSessionId: session.sessionRef,
-          ...gitWorkspaceId ? { workspaceKind: "git", gitWorkspaceId } : {}
-        }).catch(() => {
-        });
-      }
-      if (gitWorkspaceId && this.deps.gitWorkspaceStore) {
-        void this.deps.gitWorkspaceStore.attachSession(gitWorkspaceId, session.sessionRef).catch(() => {
+        if (payload.limits?.maxDurationMs !== void 0) {
+          this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
+        }
+        void this.pump(active);
+        if (agentBinding === void 0) {
+          void this.deps.sessionWorkspaces.record(session.sessionRef, {
+            workspaceDir,
+            runtimeSessionId: session.sessionRef,
+            ...gitWorkspaceId ? { workspaceKind: "git", gitWorkspaceId } : {}
+          }).catch(() => {
+          });
+        }
+        if (gitWorkspaceId && this.deps.gitWorkspaceStore) {
+          void this.deps.gitWorkspaceStore.attachSession(gitWorkspaceId, session.sessionRef).catch(() => {
+          });
+        }
+      } catch (error) {
+        if (this.tasks.has(taskId)) throw error;
+        const reason = `runtime activation failed: ${errorMessage5(error)}`;
+        if (agentBinding === void 0) await this.fail(taskId, reason, false);
+        else await this.failClaimedAgent(taskId, reason, false, {
+          binding: agentBinding,
+          runtimeId: pick.descriptor.id,
+          sessionRef: session.sessionRef
         });
       }
     } finally {
+      clearTimeout(startupTimer);
+      releaseReservation();
+      if (this.startupOwners.has(taskId)) {
+        agentLeaseTransferred = true;
+        await this.disposeStartupOwner(taskId);
+      }
       if (!agentLeaseTransferred) {
         this.pendingMessageTasks.delete(taskId);
         this.revokeAgentMessageContext(taskId);
@@ -16108,6 +16810,7 @@ var TaskRunner = class {
       }
       this.inFlightBlobAborts.delete(taskId);
       this.inFlightOffers.delete(taskId);
+      this.claimedHarnesses.delete(taskId);
     }
   }
   withAgentMessageMcp(existing, taskId, requirement) {
@@ -16377,7 +17080,13 @@ var TaskRunner = class {
                 maxPendingBytes: 4 * 1024 * 1024
               });
               if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
-              const activated = await outbox.activate(active.taskId, active.session.sessionRef);
+              const activated = await this.activateAgentMessage(
+                outbox,
+                active.taskId,
+                active.session.sessionRef,
+                () => this.canPublishAgentMessage(active),
+                () => active.messageSendAttempted === true
+              );
               if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
               if (activated === void 0) throw new Error("Agent message draft disappeared before activation");
               this.sendAgentMessageRecord(outbox, activated);
@@ -16484,7 +17193,16 @@ var TaskRunner = class {
     }
     let bytes;
     try {
-      bytes = await opened.handle.readFile();
+      const limits = this.deps.artifactLimits ?? DEFAULT_ARTIFACT_LIMITS;
+      const remaining = limits.maxTaskBytes - (active.artifactBytesSoFar ?? 0);
+      bytes = await readArtifactBytes(
+        opened.handle,
+        Math.min(limits.maxFileBytes, remaining),
+        active.blobAbort.signal,
+        (count) => {
+          active.artifactBytesSoFar = (active.artifactBytesSoFar ?? 0) + count;
+        }
+      );
     } catch (err) {
       this.reportArtifactError(active, name, `failed to read artifact "${name}": ${errorMessage5(err)}`);
       return;
@@ -16492,6 +17210,7 @@ var TaskRunner = class {
       await opened.handle.close().catch(() => {
       });
     }
+    if (this.tasks.get(active.taskId) !== active || active.blobAbort.signal.aborted || active.beingTornDown) return;
     if (bytes.length <= MAX_INLINE_ARTIFACT_BYTES) {
       const inline = bytes.toString("base64");
       if (new TextEncoder().encode(inline).length <= MAX_INLINE_ARTIFACT_BYTES) {
@@ -16503,6 +17222,7 @@ var TaskRunner = class {
       const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType, {
         signal: active.blobAbort.signal
       });
+      if (this.tasks.get(active.taskId) !== active || active.blobAbort.signal.aborted || active.beingTornDown) return;
       this.deps.send(createEnvelope("task.artifact", { name, contentType, blobRef }, { taskId: active.taskId }));
     } catch (err) {
       this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage5(err)}`);
@@ -16510,12 +17230,17 @@ var TaskRunner = class {
   }
   /** Loud, non-silent artifact failure (finding F7): logged, and folded into this task's own progress stream as an `error` AgentEvent rather than swallowed — the task itself can still complete normally, but the omission is now visible. */
   reportArtifactError(active, name, reason) {
+    if (active.blobAbort.signal.aborted || active.beingTornDown) return;
     console.error(`[byok/client] artifact "${name}" for task ${active.taskId} dropped: ${reason}`);
     active.batcher.push({ type: "error", message: reason });
   }
   async handleCancel(taskId, reason) {
     const active = this.tasks.get(taskId);
     if (!active) {
+      if (this.startupOwners.has(taskId) && !this.inFlightOffers.has(taskId)) {
+        await this.disposeStartupOwner(taskId);
+        return;
+      }
       this.setPendingCancelled(taskId, reason);
       this.inFlightBlobAborts.get(taskId)?.abort();
       return;
@@ -16529,10 +17254,7 @@ var TaskRunner = class {
       return;
     }
     active.blobAbort.abort();
-    try {
-      await active.session.interrupt();
-    } catch {
-    }
+    await this.interruptBounded(active.session);
     await this.observeGit(active, "salvage");
     await this.persistAgentTerminalEvidence(active, "cancelled", reason);
     this.deps.send(
@@ -16974,10 +17696,7 @@ var TaskRunner = class {
       await active.semanticTerminalSettled;
       return;
     }
-    try {
-      await active.session.interrupt();
-    } catch {
-    }
+    await this.interruptBounded(active.session);
     await this.observeGit(active, "salvage");
     await this.persistAgentTerminalEvidence(active, "failed", reason ?? "rejected");
     this.deps.send(
@@ -17012,7 +17731,7 @@ var TaskRunner = class {
     this.deps.send(
       createEnvelope(
         "task.fail",
-        active === void 0 ? { reason, retryable } : { reason, retryable, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
+        active === void 0 ? { reason, retryable, ...terminalIdentity(this.claimedHarnesses.get(taskId)) } : { reason, retryable, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
         { taskId }
       )
     );
@@ -17026,6 +17745,7 @@ var TaskRunner = class {
    * the wire and handleOffer's finally block releases the lease.
    */
   async failClaimedAgent(taskId, reason, retryable, context) {
+    await this.pendingMessageTasks.get(taskId)?.outbox.revoke(taskId);
     const agentRef = context.binding.resolution.agentRef;
     const result = await this.retryAgentTerminalEvidence(
       () => this.deps.agentHome.mutateExecution(context.binding, () => this.deps.agentSessionHandoffs.recordTaskTerminal({
@@ -17051,7 +17771,7 @@ var TaskRunner = class {
     }
     this.deps.send(createEnvelope(
       "task.fail",
-      { reason, retryable, agentRef },
+      { reason, retryable, ...terminalIdentity(context.runtimeId, agentRef) },
       { taskId }
     ));
     return result.ok;
@@ -17069,7 +17789,8 @@ var TaskRunner = class {
   terminalInferenceUsagePayload(active) {
     const release = this.deps.localAgentRelease;
     const runtimeId = active.adapter.descriptor.id;
-    if (release === void 0 || active.lastUsage === void 0 || !isKnownRuntimeId(runtimeId)) return {};
+    if (!isKnownRuntimeId(runtimeId)) return {};
+    if (release === void 0 || active.lastUsage === void 0) return {};
     const nowMs = Date.now();
     const durationMs = terminalUsageNumber(nowMs - active.startedAtMs, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS);
     const promptTokens = terminalUsageNumber(active.lastUsage?.inputTokens, TERMINAL_INFERENCE_USAGE_MAX_TOKENS);
@@ -17087,7 +17808,7 @@ var TaskRunner = class {
   }
   /** Exact Agent identity projection for claim/terminal wire payloads. */
   agentTerminalPayload(active) {
-    return active.agentRef === void 0 ? {} : { agentRef: active.agentRef };
+    return terminalIdentity(active.adapter.descriptor.id, active.agentRef);
   }
   /**
    * additive-minor (`task.complete.document`): the whole daemon-side gate
@@ -17244,6 +17965,14 @@ var TaskRunner = class {
   }
   /** Persist Agent terminal truth before wire when local storage is available. */
   async persistAgentTerminalEvidence(active, cause, reason) {
+    if (cause === "cancelled" || cause === "failed" && !active.messageSendAttempted) {
+      try {
+        await active.messageOutbox?.revoke(active.taskId);
+      } catch (error) {
+        active.resolveSemanticTerminalSettled?.(false);
+        throw error;
+      }
+    }
     active.terminalCause = cause;
     active.terminalReason = reason;
     if (active.agentBinding === void 0 || active.agentRef === void 0 || active.agentHandoff === void 0) {
@@ -17306,7 +18035,19 @@ var TaskRunner = class {
       error
     });
   }
-  async finish(taskId) {
+  async retryTerminalFinalization(taskId) {
+    const active = this.tasks.get(taskId);
+    if (active?.finalizationStarted) await this.finish(taskId);
+  }
+  finalizationAttempts = /* @__PURE__ */ new Map();
+  finish(taskId) {
+    const existing = this.finalizationAttempts.get(taskId);
+    if (existing) return existing;
+    const attempt = this.finishOnce(taskId).finally(() => this.finalizationAttempts.delete(taskId));
+    this.finalizationAttempts.set(taskId, attempt);
+    return attempt;
+  }
+  async finishOnce(taskId) {
     const active = this.tasks.get(taskId);
     if (!active) return true;
     if (!active.finalizationStarted) {
@@ -17357,6 +18098,13 @@ var TaskRunner = class {
       return false;
     }
     if (this.tasks.get(taskId) !== active) return true;
+    try {
+      await this.deps.awaitTerminalCommit?.(taskId);
+    } catch {
+      active.resolveSemanticTerminalSettled?.(false);
+      return false;
+    }
+    if (this.tasks.get(taskId) !== active) return true;
     if (active.agentBinding !== void 0 && active.agentRef !== void 0 && active.agentHandoff !== void 0) {
       const agentRef = active.agentRef;
       const handoff = active.agentHandoff;
@@ -17468,7 +18216,7 @@ var TaskRunner = class {
    * is device-specific (which runtimes happen to be installed here), so a
    * different device's installed runtime set might satisfy it.
    */
-  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets) {
+  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets, signal) {
     const allowlist = this.deps.runtimeAllowlist;
     if (requestedRuntime) {
       if (allowlist && !allowlist.includes(requestedRuntime)) {
@@ -17497,8 +18245,8 @@ var TaskRunner = class {
           retryable: false
         };
       }
-      const detected = await adapter.detect();
-      if (!detected.present) {
+      const detected = validateRuntimeDetectResult(await awaitAdmission(() => adapter.detect(signal), signal));
+      if (detected.kind !== "available") {
         return {
           ok: false,
           reason: `runtime "${requestedRuntime}" is not installed/available on this device`,
@@ -17513,8 +18261,8 @@ var TaskRunner = class {
       const descriptor = freezeRuntimeAdapterDescriptor(adapter.descriptor);
       if (!adapterSupportsMode(descriptor, policyMode)) continue;
       if (requiresMcpToolsets && !adapterSupportsMcpToolsets(descriptor)) continue;
-      const detected = await adapter.detect();
-      if (detected.present) return { ok: true, adapter, descriptor };
+      const detected = validateRuntimeDetectResult(await awaitAdmission(() => adapter.detect(signal), signal));
+      if (detected.kind === "available") return { ok: true, adapter, descriptor };
     }
     return {
       ok: false,
@@ -17678,10 +18426,12 @@ var AgentReliableSpool = class _AgentReliableSpool {
   constructor(homeDir, spoolPath) {
     this.homeDir = homeDir;
     this.spoolPath = spoolPath;
+    this.file = new DurableJsonlFile(spoolPath);
   }
   homeDir;
   spoolPath;
   pending = /* @__PURE__ */ new Map();
+  file;
   nextCursor = 1;
   logEntries = 0;
   writeTail = Promise.resolve();
@@ -17690,6 +18440,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
     await ensureSecureDir(directory);
     const spool = new _AgentReliableSpool(homeDir, path14__default.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
     await spool.load();
+    await spool.file.confirmRecovered();
     return spool;
   }
   get pendingEvents() {
@@ -17709,6 +18460,25 @@ var AgentReliableSpool = class _AgentReliableSpool {
       const payloadJson = stableRecordJson(input.payload);
       const byteCount = Buffer.byteLength(payloadJson, "utf8");
       if (byteCount <= 0) throw new AgentReliableSpoolError("reliable payload must have positive serialized bytes");
+      const eventId = input.eventId ?? randomUUID();
+      const existing = this.pending.get(eventId);
+      if (existing !== void 0) {
+        if (!sameRecord(existing, {
+          wireType: "agent.egress.reliable",
+          agentRef: input.agentRef,
+          tenantId: input.tenantId,
+          policyRevision: input.policyRevision,
+          eventId,
+          cursor: existing.cursor,
+          payloadHash: contentHash(payloadJson),
+          byteCount,
+          sessionRef: input.sessionRef,
+          taskId: input.taskId
+        }) || stableRecordJson(existing.payload) !== payloadJson || input.createdAt !== void 0 && input.createdAt !== existing.createdAt) {
+          throw new AgentReliableSpoolError(`reliable eventId ${eventId} differs from its existing record`);
+        }
+        return existing;
+      }
       if (this.pending.size >= policy.reliable.maxPendingEventsPerAgent) {
         throw new AgentReliableQuotaError("quota_exceeded", "reliable per-Agent event quota is exhausted");
       }
@@ -17718,8 +18488,6 @@ var AgentReliableSpool = class _AgentReliableSpool {
       if (tenantPendingBytes + byteCount > policy.reliable.maxPendingBytesPerTenant) {
         throw new AgentReliableQuotaError("quota_exceeded", "reliable tenant byte quota is exhausted");
       }
-      const eventId = input.eventId ?? randomUUID();
-      if (this.pending.has(eventId)) throw new AgentReliableSpoolError(`reliable eventId ${eventId} already exists`);
       const record4 = Object.freeze({
         schema: 1,
         wireType: "agent.egress.reliable",
@@ -17828,6 +18596,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
       if (error.code === "ENOENT") return;
       throw error;
     }
+    if (raw.length > 0 && !raw.endsWith("\n")) throw new AgentReliableSpoolError("durable JSONL log has an incomplete trailing frame; preserve the file for explicit repair");
     for (const line of raw.split("\n")) {
       if (line.length === 0) continue;
       let entry;
@@ -17850,19 +18619,12 @@ var AgentReliableSpool = class _AgentReliableSpool {
     }
   }
   async appendEntry(entry) {
-    const handle = await promises.open(this.spoolPath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
-    try {
-      await handle.write(`${stableRecordJson(entry)}
-`, void 0, "utf8");
-      await handle.sync();
-      this.logEntries += 1;
-    } finally {
-      await handle.close();
-    }
+    await this.file.append(stableRecordJson(entry));
+    this.logEntries += 1;
   }
   async compact() {
     const entries = this.records().map((record4) => ({ schema: 1, kind: "append", record: record4 }));
-    await atomicWriteFile(this.spoolPath, entries.map((entry) => stableRecordJson(entry)).join(entries.length > 0 ? "\n" : ""), { mode: 384 });
+    await this.file.replace(entries.map((entry) => stableRecordJson(entry)));
     this.logEntries = entries.length;
   }
   async exclusive(fn) {
@@ -17873,6 +18635,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
     });
     await prior;
     try {
+      this.file.assertWritable();
       return await fn();
     } finally {
       release();
@@ -19247,17 +20010,26 @@ function isRuntimeId(id) {
   return id === "pi" || id === "claude" || id === "codex";
 }
 async function detectRuntimes(adapters) {
-  const detections = await Promise.all(adapters.map(async (adapter) => ({ adapter, detected: await adapter.detect() })));
+  const detections = await Promise.all(adapters.map(async (adapter) => ({ adapter, detected: validateRuntimeDetectResult(await adapter.detect()) })));
   const runtimes = [];
+  const harnesses = [];
   for (const { adapter, detected } of detections) {
-    if (!detected.present || !isRuntimeId(adapter.descriptor.id)) continue;
+    if (detected.kind !== "available") continue;
+    if (!isRuntimeId(adapter.descriptor.id)) {
+      harnesses.push({
+        id: HarnessIdSchema.parse(adapter.descriptor.id),
+        ...detected.version === void 0 ? {} : { version: detected.version },
+        capabilities: toRuntimeInfoCapabilities(adapter.descriptor.capabilities)
+      });
+      continue;
+    }
     const info = { id: adapter.descriptor.id };
     if (detected.version !== void 0) info.version = detected.version;
     if (detected.authPresent !== void 0) info.authPresent = detected.authPresent;
     info.capabilities = toRuntimeInfoCapabilities(adapter.descriptor.capabilities);
     runtimes.push(info);
   }
-  return runtimes;
+  return { runtimes, harnesses };
 }
 function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies, providerProfileBindingConfigured = false) {
   const flags = [];
@@ -19347,7 +20119,7 @@ function buildAdapter(id, config) {
         resolveApprovalMcpBin: () => resolveApprovalMcpBin(config.sdkHelperHost)
       });
     case "codex":
-      return new CodexAdapter();
+      return new CodexAdapter({ sdkHelperHost: config.sdkHelperHost });
   }
 }
 function buildDefaultAdapters(config) {
@@ -19424,6 +20196,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const localAgentRelease = resolveLocalAgentReleaseIdentity(config.localAgentRelease);
   const toolsetRegistry = new McpToolsetRegistry(config.mcpToolsets);
   validatePiByokLauncherConfig(config.piByokLauncher);
+  if (config.startupTimeoutMs !== void 0 && (!Number.isSafeInteger(config.startupTimeoutMs) || config.startupTimeoutMs <= 0)) throw new Error("startupTimeoutMs must be a positive safe integer");
+  if (config.artifactLimits !== void 0) {
+    for (const value of [config.artifactLimits.maxFileBytes, config.artifactLimits.maxTaskBytes]) {
+      if (!Number.isSafeInteger(value) || value <= 0) throw new Error("artifactLimits must contain positive safe integer byte budgets");
+    }
+  }
   if (config.maxTaskOutputBytes !== void 0 && !(config.maxTaskOutputBytes > 0)) {
     throw new Error(
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
@@ -19553,7 +20331,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       pressureEngine = ownedPressureEngine;
     }
   }
-  let journalTerminalTail = Promise.resolve();
+  const terminalCommits = new TerminalCommitQueue((taskId) => {
+    connection?.retryTaskReceipts(taskId);
+    void runner?.retryTerminalFinalization(taskId).catch((error) => {
+      console.error("[byok/client] terminal finalization still requires recovery", error);
+    });
+  });
   const observer = new DaemonObserver();
   const approvalRegistry = new ApprovalRegistry();
   let connection;
@@ -19688,6 +20471,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     await runLifecycleMutation(startUnderLease);
   }
   async function startUnderLease() {
+    terminalCommits.resume();
     if (!daemonOwnerLease) daemonOwnerLease = await acquireDaemonOwner(storeDir, "daemon");
     try {
       let record4;
@@ -19739,7 +20523,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           const terminal = createEnvelope("task.fail", {
             reason: "daemon_interrupted",
             retryable: false,
-            ...payload.agentRef === void 0 ? {} : { agentRef: payload.agentRef }
+            ...terminalIdentity(task.claimedRuntime, payload.agentRef),
+            recovery: { kind: "daemon_interrupted", offerId: offer.id }
           }, { taskId: task.taskId });
           const bytes = encodeEnvelope(terminal);
           await activeJournal.recordTerminal({
@@ -19767,7 +20552,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         await gitWorkspaceStore?.reconcile();
       }
       blobLifecycleAbort = new AbortController();
-      const [runtimes, blobClient] = await Promise.all([
+      const [{ runtimes, harnesses }, blobClient] = await Promise.all([
         detectRuntimes(adapters),
         Promise.resolve(new BlobClient(config.serverUrl, auth, { signal: blobLifecycleAbort.signal }))
       ]);
@@ -19788,6 +20573,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         tenantId: record4.tenantId,
         deviceId: record4.deviceId
       }) : void 0;
+      capabilities.push("custom-harness");
       const sendSanitizedEnvelope = (envelope) => {
         const terminalKind = terminalKindOf(envelope.type);
         if (!activeJournal || !journalIdentity || terminalKind === void 0 || envelope.task_id === void 0) {
@@ -19797,7 +20583,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         }
         const taskId = envelope.task_id;
         const bytes = encodeEnvelope(envelope);
-        journalTerminalTail = journalTerminalTail.catch(() => void 0).then(async () => {
+        terminalCommits.enqueue(taskId, async () => {
           try {
             await activeJournal.recordTerminal({
               taskId,
@@ -19825,7 +20611,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             const failure = createEnvelope("task.fail", {
               reason: "terminal_result_too_large",
               retryable: false,
-              ...offerPayload.agentRef === void 0 ? {} : { agentRef: offerPayload.agentRef }
+              ...terminalIdentity(task.claimedRuntime, offerPayload.agentRef)
             }, { taskId });
             const failureBytes = encodeEnvelope(failure);
             await activeJournal.recordTerminal({
@@ -19843,8 +20629,6 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             observer.handleOutboundEnvelope(decoded);
             connection?.send(decoded);
           }
-        }).catch((error) => {
-          console.error("[byok/client] terminal durability failed; execution remains unsettled", error);
         });
       };
       const sendEnvelope = (candidate) => {
@@ -19926,7 +20710,10 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // Finding F5(a): see TaskRunnerDeps.shutdownInterruptTimeoutMs's own doc comment.
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
+        awaitTerminalCommit: (taskId) => terminalCommits.receipt(taskId),
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        artifactLimits: config.artifactLimits,
+        startupTimeoutMs: config.startupTimeoutMs,
         // See DaemonConfig.maxInlineEventBytes's own doc comment — already validated above.
         maxInlineEventBytes: config.maxInlineEventBytes,
         // additive-minor (`task.complete.document`): passed through verbatim,
@@ -19974,6 +20761,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       if (config.agentHome !== void 0 && config.agentEgress !== void 0) {
         await runner.recoverAgentMessageOutboxes(path14__default.join(config.agentHome.hostStorageRoot, "agents"));
       }
+      const replayRecoveryTerminals = async (taskId) => {
+        if (!activeJournal || !journalIdentity) return;
+        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
+          if (terminal.truthState !== "pending" || taskId !== void 0 && terminal.taskId !== taskId) continue;
+          if (runner?.hasPendingRecoveredAgentMessage(terminal.taskId)) continue;
+          const envelope = decodeEnvelope(terminal.bytes);
+          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
+            throw new Error("durable terminal execution binding mismatch");
+          }
+          overrides.executionRecoveryFault?.("terminal:before-send");
+          observer.handleOutboundEnvelope(envelope);
+          connection?.send(envelope);
+        }
+      };
       const handleAgentHomeProjectionEnvelope = async (envelope) => {
         if (envelope.type !== "agent.home.projection") return false;
         if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
@@ -20108,6 +20909,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         capabilities,
         clientVersion: localAgentRelease.version,
         runtimes,
+        harnesses,
         getConfiguredToolsets: () => toolsetRegistry.snapshot().configuredToolsets,
         auth,
         cursorStore,
@@ -20149,12 +20951,22 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           activePressureEngine?.assertAckCriticalAllowed();
           await activeJournal.appendEnvelope(toJournalEnvelopeRecord(envelope, journalIdentity));
           if (isTaskOfferType(envelope.type) && envelope.task_id !== void 0) {
+            if (terminalCommits.hasPending(envelope.task_id)) {
+              await terminalCommits.retry(envelope.task_id);
+              return;
+            }
             const task = await activeJournal.readTask(envelope.task_id, journalIdentity);
             if (!task) throw new Error("durable offer has no execution record");
-            if (task.localState !== "received") return;
+            if (task.localState !== "received") {
+              await terminalCommits.retry(envelope.task_id);
+              return;
+            }
           }
           await runner?.handleEnvelope(envelope);
-          await journalTerminalTail;
+          if (envelope.type === "agent.message.disposition") {
+            await replayRecoveryTerminals(envelope.task_id);
+          }
+          if (envelope.task_id !== void 0) await terminalCommits.receipt(envelope.task_id);
         } : (envelope) => {
           if (tenantRebinding) {
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
@@ -20202,18 +21014,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           });
         }
       });
-      if (activeJournal && journalIdentity) {
-        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
-          if (terminal.truthState !== "pending") continue;
-          const envelope = decodeEnvelope(terminal.bytes);
-          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
-            throw new Error("durable terminal execution binding mismatch");
-          }
-          overrides.executionRecoveryFault?.("terminal:before-send");
-          observer.handleOutboundEnvelope(envelope);
-          connection.send(envelope);
-        }
-      }
+      await replayRecoveryTerminals();
       await connection.start();
       await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
@@ -20328,7 +21129,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       pendingLateMutationBarriers.add(observedActiveTeardown);
       void observedActiveTeardown.finally(() => pendingLateMutationBarriers.delete(observedActiveTeardown)).catch(() => void 0);
     }
-    const journalTailSettled = journal ? await attempt(() => journalTerminalTail, true) : true;
+    const journalTailSettled = journal ? await attempt(() => terminalCommits.stop(), true) : true;
     const maintenanceSettled = await attempt(() => maintenanceStopped, true);
     const drainTimeoutMs = opts.drainTimeoutMs ?? overrides.shutdown?.outboxDrainTimeoutMs ?? DEFAULT_SHUTDOWN_OUTBOX_DRAIN_TIMEOUT_MS;
     const connectionStopped = await attempt(() => connection?.stop(drainTimeoutMs), true);
@@ -20848,6 +21649,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       revoked: connection?.isRevoked() ?? auth.isRevoked(),
       deviceId: auth.deviceId,
       activeTaskCount: runner?.activeTaskCount ?? 0,
+      pendingTerminalCommits: terminalCommits.pendingCount,
       branding: config.branding,
       operationalHealth: operationalHealth.snapshot(),
       toolsets: toolsetRegistry.status(),
@@ -20980,7 +21782,7 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs36 = deps.fs ?? promises;
+  const fs37 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os__default.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
@@ -20994,7 +21796,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs36.stat(p);
+      await fs37.stat(p);
       return true;
     } catch {
       return false;
@@ -21002,9 +21804,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs36.mkdir(path14__default.dirname(plistPath()), { recursive: true });
-    await fs36.mkdir(def.logDir, { recursive: true });
-    await fs36.writeFile(plistPath(), xml, "utf8");
+    await fs37.mkdir(path14__default.dirname(plistPath()), { recursive: true });
+    await fs37.mkdir(def.logDir, { recursive: true });
+    await fs37.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -21015,7 +21817,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs36.rm(plistPath(), { force: true });
+    await fs37.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -21099,14 +21901,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs36 = deps.fs ?? promises;
+  const fs37 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os__default.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
   const unitPath = () => path14__default.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs36.stat(p);
+      await fs37.stat(p);
       return true;
     } catch {
       return false;
@@ -21114,9 +21916,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs36.mkdir(path14__default.dirname(unitPath()), { recursive: true });
-    await fs36.mkdir(def.logDir, { recursive: true });
-    await fs36.writeFile(unitPath(), unit, "utf8");
+    await fs37.mkdir(path14__default.dirname(unitPath()), { recursive: true });
+    await fs37.mkdir(def.logDir, { recursive: true });
+    await fs37.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -21125,7 +21927,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs36.rm(unitPath(), { force: true });
+    await fs37.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -21188,7 +21990,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs36 = deps.fs ?? promises;
+  const fs37 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -21200,7 +22002,7 @@ function createWinswLifecycle(def, deps = {}) {
   const xmlPath = path14__default.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs36.stat(p);
+      await fs37.stat(p);
       return true;
     } catch {
       return false;
@@ -21208,10 +22010,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs36.mkdir(installDir, { recursive: true });
-    await fs36.mkdir(def.logDir, { recursive: true });
-    await fs36.copyFile(winswBin, exePath);
-    await fs36.writeFile(xmlPath, xml, "utf8");
+    await fs37.mkdir(installDir, { recursive: true });
+    await fs37.mkdir(def.logDir, { recursive: true });
+    await fs37.copyFile(winswBin, exePath);
+    await fs37.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -21221,8 +22023,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs36.rm(exePath, { force: true });
-    await fs36.rm(xmlPath, { force: true });
+    await fs37.rm(exePath, { force: true });
+    await fs37.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {
@@ -21265,376 +22067,31 @@ function createServiceLifecycle(def, opts = {}) {
   }
 }
 
-// src/bin/format.ts
-function quote(text) {
-  return JSON.stringify(text);
-}
-function redactedByteCountPlaceholder(text) {
-  return `[redacted: ${Buffer.byteLength(text, "utf8")} bytes]`;
+// src/bin/runtime-probe.ts
+var ALL_RUNTIME_IDS2 = ["pi", "claude", "codex"];
+var RUNTIME_PROBE_TIMEOUT_MS = 5e3;
+var MAX_RUNTIME_ID_CHARS = 128;
+var MAX_RUNTIME_VERSION_CHARS = 256;
+var MAX_PERMISSION_MODES = 32;
+var MAX_PERMISSION_MODE_CHARS = 64;
+function boundedSingleLine(value, maxChars) {
+  return value.replace(/[\r\n\t]/g, " ").slice(0, maxChars);
 }
-var STABLE_GIT_ERROR_CATEGORIES = new Set(GIT_ERROR_CATEGORIES);
-function stableGitErrorCategory(value) {
-  return value !== void 0 && STABLE_GIT_ERROR_CATEGORIES.has(value) ? value : void 0;
-}
-function formatAgentEvent(event) {
-  switch (event.type) {
-    case "progress":
-      return `progress: ${quote(event.text)}`;
-    case "tool_use":
-      return `tool_use: ${event.tool}`;
-    case "tool_result":
-      return `tool_result: ${event.tool}`;
-    case "artifact":
-      return `artifact: ${event.name} (${event.contentType})`;
-    case "needs_approval":
-      return `needs_approval: ${quote(event.summary)}`;
-    case "turn_end":
-      return "turn_end";
-    case "error":
-      return `error: ${quote(event.message)}`;
-    case "usage": {
-      const parts = [];
-      if (event.inputTokens !== void 0) parts.push(`in=${event.inputTokens}`);
-      if (event.outputTokens !== void 0) parts.push(`out=${event.outputTokens}`);
-      if (event.totalTokens !== void 0) parts.push(`total=${event.totalTokens}`);
-      return `usage: ${parts.length ? parts.join(" ") : "(no fields reported)"}`;
-    }
-  }
-}
-function formatDaemonEventLine(event, options = {}) {
-  const prefix = `[${event.ts}]`;
-  switch (event.kind) {
-    case "offered":
-      return `${prefix} offered taskId=${event.taskId}${event.runtime ? ` runtime=${event.runtime}` : ""}`;
-    case "claimed":
-      return `${prefix} claimed taskId=${event.taskId}${event.claimedRuntime !== void 0 ? ` claimedRuntime=${event.claimedRuntime}` : ""}`;
-    case "started":
-      return `${prefix} started taskId=${event.taskId}`;
-    case "progress":
-      return `${prefix} progress taskId=${event.taskId} ${formatAgentEvent(event.event)}`;
-    case "artifact":
-      return `${prefix} artifact taskId=${event.taskId} name=${event.name} contentType=${event.contentType}`;
-    case "awaiting-approval": {
-      const summary = options.redactApprovalSummary ? redactedByteCountPlaceholder(event.summary) : event.summary;
-      return `${prefix} awaiting-approval taskId=${event.taskId}${event.approvalId ? ` approvalId=${event.approvalId}` : ""} summary=${quote(summary)}`;
-    }
-    case "completed":
-      return `${prefix} completed taskId=${event.taskId} sessionRef=${event.sessionRef} summary=${quote(event.summary)}`;
-    case "failed":
-      return `${prefix} failed taskId=${event.taskId} retryable=${event.retryable}${event.preClaim ? " preClaim=true" : ""} reason=${quote(event.reason)}`;
-    case "cancelled":
-      return `${prefix} cancelled taskId=${event.taskId}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
-    case "connection":
-      return `${prefix} connection state=${event.state}`;
-    case "paired":
-      return `${prefix} paired deviceId=${event.deviceId}`;
-    case "unpaired":
-      return `${prefix} unpaired`;
-    case "runtimes-detected":
-      return `${prefix} runtimes-detected ids=${event.runtimes.map((r) => r.id).join(",") || "(none)"}`;
-    case "shutdown-requested":
-      return `${prefix} shutdown-requested reason=${quote(event.reason)}`;
-    case "shutdown-complete":
-      return `${prefix} shutdown-complete reason=${quote(event.reason)}${event.undeliveredOutboxCount !== void 0 ? ` undeliveredOutboxCount=${event.undeliveredOutboxCount}` : ""}`;
-    case "stale-approval-decision":
-      return `${prefix} stale-approval-decision taskId=${event.taskId} decision=${event.decision}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
-    case "runtime-disposal-failed":
-      return `${prefix} runtime-disposal-failed taskId=${event.taskId} runtime=${event.runtimeId} stage=${event.stage} reason=${quote(event.reason)}`;
-    case "git-workspace": {
-      const parts = [
-        `${prefix} git-workspace taskId=${event.taskId}`,
-        `workspaceId=${event.workspaceId}`,
-        `phase=${event.phase}`,
-        event.headChanged !== void 0 ? `headChanged=${event.headChanged}` : void 0,
-        event.commitsSinceBaseline !== void 0 ? `commits=${event.commitsSinceBaseline}` : void 0,
-        event.dirty ? `dirty=${event.dirty.staged}/${event.dirty.unstaged}/${event.dirty.untracked}/${event.dirty.conflicted}` : void 0,
-        stableGitErrorCategory(event.errorCategory) ? `errorCategory=${stableGitErrorCategory(event.errorCategory)}` : void 0
-      ].filter((part) => part !== void 0);
-      return parts.join(" ");
-    }
-    case "device-assertion": {
-      const parts = event.result === "issued" ? [
-        `${prefix} device-assertion result=issued`,
-        `audience=${quote(event.audience)}`,
-        `jti=${event.jti}`,
-        `expiresAt=${event.expiresAt}`
-      ] : [
-        `${prefix} device-assertion result=denied`,
-        `reason=${event.reason}`,
-        event.audienceSize !== void 0 ? `audienceSize=${event.audienceSize}` : void 0
-      ].filter((part) => part !== void 0);
-      return parts.join(" ");
-    }
-  }
-}
-function formatTaskLine(task) {
-  const git = "git" in task ? task.git : void 0;
-  const gitStatus = git ? [
-    `git=${git.phase}`,
-    git.commitsSinceBaseline !== void 0 ? `commits=${git.commitsSinceBaseline}` : void 0,
-    git.dirty ? `dirty=${git.dirty.staged}/${git.dirty.unstaged}/${git.dirty.untracked}/${git.dirty.conflicted}` : void 0
-  ].filter((part) => part !== void 0).join(" ") : void 0;
-  const parts = [
-    task.taskId,
-    task.state,
-    task.runtime ? `runtime=${task.runtime}` : void 0,
-    gitStatus,
-    task.claimedRuntime !== void 0 ? `claimedRuntime=${task.claimedRuntime}` : void 0,
-    `updatedAt=${task.updatedAt}`,
-    task.sessionRef ? `sessionRef=${task.sessionRef}` : void 0,
-    task.declined ? "declined=true" : void 0,
-    task.summary ? `summary=${quote(task.summary)}` : void 0
-  ].filter((part) => Boolean(part));
-  return parts.join(" ");
-}
-function formatTaskListLines(tasks) {
-  if (tasks.length === 0) return ["(no tasks observed yet)"];
-  return tasks.map(formatTaskLine);
-}
-function formatRuntimeLines(runtimes) {
-  if (runtimes.length === 0) return ["(no runtimes configured \u2014 check runtimeAllowlist)"];
-  return runtimes.map((r) => {
-    if (!r.present) return `${r.id}: absent`;
-    const caps = [];
-    if (r.steer) caps.push("steer");
-    if (r.resume) caps.push("resume");
-    const parts = [
-      "present",
-      r.version ? `version=${r.version}` : void 0,
-      r.authPresent !== void 0 ? `authPresent=${r.authPresent}` : void 0,
-      `capabilities=${caps.length ? caps.join(",") : "(none)"}`,
-      `modes=${r.permissionModes.length ? r.permissionModes.join(",") : "(none)"}`
-    ].filter((part) => Boolean(part));
-    return `${r.id}: ${parts.join(" ")}`;
-  });
-}
-function formatStatusLines(view) {
-  const lines = [];
-  const label = view.branding?.displayName ?? view.productName;
-  lines.push(`product: ${label} (${view.productId})`);
-  lines.push(
-    `local-agent-release: ${view.localAgentRelease.version}${view.localAgentRelease.buildId ? ` buildId=${view.localAgentRelease.buildId}` : ""}`
-  );
-  if (view.branding?.supportUrl) lines.push(`support: ${view.branding.supportUrl}`);
-  lines.push(`paired: ${view.paired ? "yes" : "no"}${view.deviceId ? ` deviceId=${view.deviceId}` : ""}`);
-  lines.push(
-    view.connection ? `connection: last-known=${view.connection.state} at=${view.connection.ts}` : "connection: unknown (no audit log yet \u2014 run `byok-agent start` at least once to begin observing)"
-  );
-  const runtimeSummary = view.runtimes.map((r) => `${r.id}=${r.present ? "present" : "absent"}`).join(" ");
-  lines.push(`runtimes: ${runtimeSummary || "(none configured)"}`);
-  const c = view.taskCounts;
-  lines.push(
-    `tasks: total=${c.total} offered=${c.Offered} claimed=${c.Claimed} running=${c.Running} awaitApproval=${c.AwaitApproval} complete=${c.Complete} failed=${c.Failed} cancelled=${c.Cancelled}`
-  );
-  lines.push(`audit-log: ${view.auditLogPath} (${view.auditLogLineCount} event${view.auditLogLineCount === 1 ? "" : "s"})`);
-  return lines;
-}
-function formatLiveStatusLines(live) {
-  const liveRelease = live.localAgentRelease;
-  const lines = [
-    `live: pid=${live.pid} uptimeMs=${live.uptimeMs} transport=${live.transport}`,
-    liveRelease ? `live-local-agent-release: ${liveRelease.version}${liveRelease.buildId ? ` buildId=${liveRelease.buildId}` : ""}` : "live-local-agent-release: unknown",
-    `live-paired: ${live.paired ? "yes" : "no"}${live.deviceId ? ` deviceId=${live.deviceId}` : ""}`,
-    `live-runtimes: ${live.runtimeIds.length ? live.runtimeIds.join(",") : "(none)"}`,
-    `live-toolsets: revision=${live.toolsets.revision} count=${live.toolsets.toolsets.length}`
-  ];
-  for (const toolset of live.toolsets.toolsets) lines.push(formatToolsetStatusLine("live-toolset", toolset));
-  const health = live.operationalHealth;
-  if (health.availability === "unavailable") {
-    lines.push(`live-operational-health: unavailable reason=${quote(health.reason)}`);
-  } else {
-    lines.push(
-      `live-operational-health: state=${health.state} failures=${health.failureCount}/${health.failureThreshold} windowMs=${health.windowMs} crashes=${health.crashCount}${health.lastCrashAt ? ` lastCrashAt=${health.lastCrashAt}` : ""}`
-    );
-  }
-  if (live.activeTasks.length === 0) {
-    lines.push("live-active-tasks: (none)");
-  } else {
-    for (const task of live.activeTasks) {
-      lines.push(`live-active-task: ${task.taskId} ${task.state}`);
-    }
-  }
-  lines.push(`live-approvals-pending: ${live.approvalsPending}`);
-  if (live.approvals.length === 0) {
-    lines.push("live-approvals: (none)");
-  } else {
-    for (const approval of live.approvals) {
-      lines.push(`live-approval: ${approval.approvalId} taskId=${approval.taskId} summary=${quote(summaryExcerpt(approval.summary))}`);
-    }
-  }
-  if (live.queueWatermarks.length === 0) {
-    lines.push("live-queue-watermarks: (none)");
-  } else {
-    for (const watermark of live.queueWatermarks) {
-      lines.push(
-        `live-queue-watermark: ${watermark.taskId} progressBatcherPending=${watermark.progressBatcherPending} pendingApprovals=${watermark.pendingApprovals}`
-      );
-    }
-  }
-  const storage = live.storage;
-  if (storage !== void 0) {
-    lines.push(
-      `live-storage: state=${storage.pressureState} used=${storage.usedBytes} budget=${storage.budgetBytes} free=${storage.freeBytes} measuredAt=${storage.measuredAt}`
-    );
-    for (const category of storage.categories) {
-      lines.push(`live-storage-category: ${category.category} bytes=${category.bytes}${category.approximate ? " (approximate)" : ""}`);
-    }
-    if (storage.lastCompaction) {
-      lines.push(
-        `live-storage-compaction: checkpointed=${storage.lastCompaction.checkpointed} walFramesRemaining=${storage.lastCompaction.walFramesRemaining} pagesVacuumed=${storage.lastCompaction.pagesVacuumed} durationMs=${storage.lastCompaction.durationMs} at=${storage.lastCompaction.at}`
-      );
-    }
-  }
-  return lines;
-}
-function formatToolsetStatusLine(prefix, toolset) {
-  const observation = toolset.observation;
-  return [
-    `${prefix}: ${toolset.id}`,
-    `servers=${toolset.serverCount}`,
-    `definitionRevision=${toolset.definitionRevision}`,
-    `state=${observation?.state ?? "unobserved"}`,
-    observation?.version === void 0 ? void 0 : `version=${quote(observation.version)}`,
-    observation?.observedAt === void 0 ? void 0 : `observedAt=${observation.observedAt}`,
-    observation?.reasonCode === void 0 ? void 0 : `reasonCode=${observation.reasonCode}`
-  ].filter((part) => part !== void 0).join(" ");
-}
-function formatToolsetsReloadReceiptLines(receipt) {
-  return [
-    `toolsets-reload: changed=${receipt.changed ? "yes" : "no"} previousRevision=${receipt.previousRevision} revision=${receipt.revision}`,
-    ...receipt.toolsets.map((toolset) => formatToolsetStatusLine("toolset", toolset))
-  ];
-}
-var SUMMARY_EXCERPT_MAX_LEN = 60;
-function summaryExcerpt(summary) {
-  if (!summary) return "(no summary)";
-  return summary.length > SUMMARY_EXCERPT_MAX_LEN ? `${summary.slice(0, SUMMARY_EXCERPT_MAX_LEN)}\u2026` : summary;
-}
-function formatAge(ms) {
-  const totalSeconds = Math.floor(Math.max(0, ms) / 1e3);
-  if (totalSeconds < 60) return `${totalSeconds}s`;
-  const totalMinutes = Math.floor(totalSeconds / 60);
-  if (totalMinutes < 60) return `${totalMinutes}m`;
-  const totalHours = Math.floor(totalMinutes / 60);
-  if (totalHours < 24) return `${totalHours}h`;
-  const totalDays = Math.floor(totalHours / 24);
-  return `${totalDays}d`;
-}
-function formatApprovalsListLines(approvals, nowMs) {
-  if (approvals.length === 0) return ["(no pending approvals)"];
-  return approvals.map((approval) => {
-    const ageMs = nowMs - Date.parse(approval.createdAt);
-    return `${approval.approvalId} taskId=${approval.taskId} age=${formatAge(ageMs)} summary=${quote(summaryExcerpt(approval.summary))}`;
-  });
-}
-
-// src/bin/commands/approvals.ts
-async function runApprovalsCommand(storeDir, productId, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const error = deps.error ?? ((line) => console.error(line));
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const now = deps.now ?? (() => Date.now());
-  const conn = await connectControl({ storeDir, productId });
-  if (!conn.ok) {
-    const message = `cannot list approvals: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
-    error(message);
-    throw new Error(message);
-  }
-  try {
-    const result = await conn.client.request("approvals.list");
-    for (const line of formatApprovalsListLines(result.approvals, now())) log(line);
-  } catch (err) {
-    if (err instanceof ControlError) {
-      error(`approvals list failed: ${err.message}`);
-    } else {
-      error(`approvals list failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    throw err;
-  } finally {
-    conn.client.close();
-  }
-}
-
-// src/bin/commands/approve-reject.ts
-async function runApproveCommand(storeDir, productId, approvalId, deps = {}) {
-  return resolveApproval(storeDir, productId, approvalId, "approve", void 0, deps);
-}
-async function runRejectCommand(storeDir, productId, approvalId, reason, deps = {}) {
-  return resolveApproval(storeDir, productId, approvalId, "reject", reason, deps);
-}
-async function resolveApproval(storeDir, productId, approvalId, decision, reason, deps) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const error = deps.error ?? ((line) => console.error(line));
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const verb = decision === "approve" ? "approved" : "rejected";
-  const conn = await connectControl({ storeDir, productId });
-  if (!conn.ok) {
-    const message = `cannot ${decision} approvalId=${approvalId}: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
-    error(message);
-    throw new Error(message);
-  }
-  try {
-    await conn.client.request("approvals.resolve", { approvalId, decision, reason });
-    log(`${verb}: approvalId=${approvalId}${reason ? ` reason=${JSON.stringify(reason)}` : ""}`);
-  } catch (err) {
-    if (err instanceof ControlError && err.code === "not_found") {
-      error(`${err.message} \u2014 run \`byok-agent approvals\` to see pending approvalIds`);
-    } else {
-      error(`${decision} failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    throw err;
-  } finally {
-    conn.client.close();
-  }
-}
-
-// src/bin/commands/pair.ts
-async function runPairCommand(config, code, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  if (deps.daemon) {
-    const result2 = await deps.daemon.pair(code);
-    log(`paired: deviceId=${result2.deviceId}`);
-    return;
-  }
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const conn = await connectControl({ storeDir: resolveStoreDir(config), productId: config.productId });
-  if (conn.ok) {
-    try {
-      const result2 = await conn.client.request("enrollment.pair", { pairingCode: code });
-      log(`paired: deviceId=${result2.deviceId}`);
-      return;
-    } finally {
-      conn.client.close();
-    }
-  }
-  const daemon = createDaemon(config);
-  const result = await daemon.pair(code);
-  log(`paired: deviceId=${result.deviceId}`);
-}
-
-// src/bin/runtime-probe.ts
-var ALL_RUNTIME_IDS2 = ["pi", "claude", "codex"];
-var RUNTIME_PROBE_TIMEOUT_MS = 5e3;
-var MAX_RUNTIME_ID_CHARS = 128;
-var MAX_RUNTIME_VERSION_CHARS = 256;
-var MAX_PERMISSION_MODES = 32;
-var MAX_PERMISSION_MODE_CHARS = 64;
-function boundedSingleLine(value, maxChars) {
-  return value.replace(/[\r\n\t]/g, " ").slice(0, maxChars);
-}
-async function detectWithTimeout(adapter, timeoutMs) {
-  let timer;
-  try {
-    return await Promise.race([
-      adapter.detect(),
-      new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new Error("runtime detection timed out")), timeoutMs);
-        timer.unref?.();
-      })
-    ]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
+var RuntimeProbeTimeout = class extends Error {
+};
+async function detectWithTimeout(adapter, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      adapter.detect(),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new RuntimeProbeTimeout()), timeoutMs);
+        timer.unref?.();
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 function defaultRuntimeAdapters(runtimeAllowlist) {
   const ids = runtimeAllowlist ? ALL_RUNTIME_IDS2.filter((id) => runtimeAllowlist.includes(id)) : ALL_RUNTIME_IDS2;
@@ -21664,18 +22121,19 @@ async function probeRuntimes(adapters, options = {}) {
         steer = caps.steer === true;
         resume = caps.resume === true;
         permissionModes = caps.permissionModes.slice(0, MAX_PERMISSION_MODES).map((mode) => boundedSingleLine(mode, MAX_PERMISSION_MODE_CHARS));
-        const detected = await detectWithTimeout(adapter, timeoutMs);
+        const detected = validateRuntimeDetectResult(await detectWithTimeout(adapter, timeoutMs));
         return {
           id,
-          present: detected.present === true,
-          ...detected.version === void 0 ? {} : { version: boundedSingleLine(detected.version, MAX_RUNTIME_VERSION_CHARS) },
-          ...typeof detected.authPresent === "boolean" ? { authPresent: detected.authPresent } : {},
+          present: detected.kind === "available",
+          outcome: detected.kind,
+          ...detected.kind !== "available" || detected.version === void 0 ? {} : { version: boundedSingleLine(detected.version, MAX_RUNTIME_VERSION_CHARS) },
+          ...detected.kind === "available" && typeof detected.authPresent === "boolean" ? { authPresent: detected.authPresent } : {},
           steer,
           resume,
           permissionModes
         };
-      } catch {
-        return { id, present: false, steer, resume, permissionModes };
+      } catch (error) {
+        return { id, present: false, outcome: error instanceof RuntimeProbeTimeout ? "timeout" : "probe-failed", steer, resume, permissionModes };
       }
     })
   );
@@ -22083,7 +22541,7 @@ function checksFor(snapshot) {
     {
       id: "runtimes",
       status: snapshot.runtimes.some((runtime) => runtime.present) ? "pass" : "warn",
-      summary: `${snapshot.runtimes.filter((runtime) => runtime.present).length}/${snapshot.runtimes.length} present`
+      summary: `${snapshot.runtimes.filter((runtime) => runtime.present).length}/${snapshot.runtimes.length} present; ` + RUNTIME_DETECTION_FAILURE_KINDS.map((kind) => `${kind}=${snapshot.runtimes.filter((runtime) => runtime.outcome === kind).length}`).join(" ")
     },
     {
       id: "control",
@@ -22128,6 +22586,7 @@ async function collectDiagnostics(config, storeDir, options = {}) {
   const runtimes = probedRuntimes.map((runtime) => ({
     idHash: stableIdentifierHash(runtime.id),
     present: runtime.present,
+    outcome: runtime.outcome,
     versionPresent: runtime.version !== void 0,
     ...runtime.authPresent === void 0 ? {} : { authPresent: runtime.authPresent },
     steer: runtime.steer,
@@ -22217,172 +22676,586 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
       if (bytesRead === 0) throw new Error("operational health state ended during bounded copy");
       position += bytesRead;
     }
-    const afterRead = fstatSync(sourceFd, { bigint: true });
-    if (!sameFileState5(afterRead, sourceStat)) {
-      throw new Error("operational health state changed during bounded copy");
+    const afterRead = fstatSync(sourceFd, { bigint: true });
+    if (!sameFileState5(afterRead, sourceStat)) {
+      throw new Error("operational health state changed during bounded copy");
+    }
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    evidenceTemp = `.${evidenceName}.${randomUUID()}.tmp`;
+    const evidenceFd = openSync(evidenceTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      writeFileSync(evidenceFd, bytes);
+      fchmodSync(evidenceFd, 384);
+      fsyncSync(evidenceFd);
+    } finally {
+      closeSync(evidenceFd);
+    }
+    linkSync(evidenceTemp, evidenceName);
+    evidenceCreated = true;
+    const evidence = lstatSync(evidenceName, { bigint: true });
+    const tempEvidence = lstatSync(evidenceTemp, { bigint: true });
+    if (!evidence.isFile() || !sameInode2(evidence, tempEvidence) || evidence.size !== sourceStat.size) {
+      throw new Error("quarantined operational health evidence does not match the bounded copy");
+    }
+    unlinkSync(evidenceTemp);
+    evidenceTemp = void 0;
+    const finalOpenSource = fstatSync(sourceFd, { bigint: true });
+    const finalNamedSource = lstatSync(sourcePath, { bigint: true });
+    if (!sameFileState5(finalOpenSource, sourceStat) || !sameFileState5(finalNamedSource, sourceStat)) {
+      throw new Error("operational health source changed before removal");
+    }
+    const manifestBody = `${JSON.stringify(
+      {
+        version: 1,
+        quarantinedAt,
+        reason,
+        sourcePath,
+        evidenceFile: evidenceName,
+        sha256,
+        sizeBytes
+      },
+      null,
+      2
+    )}
+`;
+    manifestTemp = `.${manifestName}.${randomUUID()}.tmp`;
+    const manifestFd = openSync(manifestTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      writeFileSync(manifestFd, manifestBody, "utf8");
+      fchmodSync(manifestFd, 384);
+      fsyncSync(manifestFd);
+    } finally {
+      closeSync(manifestFd);
+    }
+    linkSync(manifestTemp, manifestName);
+    manifestCreated = true;
+    unlinkSync(manifestTemp);
+    manifestTemp = void 0;
+    if (process.platform !== "win32") {
+      const quarantineDirectoryFd = openSync(".", constants.O_RDONLY);
+      try {
+        fsyncSync(quarantineDirectoryFd);
+      } finally {
+        closeSync(quarantineDirectoryFd);
+      }
+    }
+    const removalOpenSource = fstatSync(sourceFd, { bigint: true });
+    const removalNamedSource = lstatSync(sourcePath, { bigint: true });
+    if (!sameFileState5(removalOpenSource, sourceStat) || !sameFileState5(removalNamedSource, sourceStat)) {
+      throw new Error("operational health source changed before removal");
+    }
+    unlinkSync(sourcePath);
+    sourceRemoved = true;
+    if (process.platform !== "win32") {
+      const directoryFd = openSync(path14__default.dirname(sourcePath), constants.O_RDONLY);
+      try {
+        fsyncSync(directoryFd);
+      } finally {
+        closeSync(directoryFd);
+      }
+    }
+    return { sha256, sizeBytes };
+  } catch (err) {
+    if (evidenceTemp) {
+      try {
+        unlinkSync(evidenceTemp);
+      } catch {
+      }
+    }
+    if (manifestTemp) {
+      try {
+        unlinkSync(manifestTemp);
+      } catch {
+      }
+    }
+    if (manifestCreated && !sourceRemoved) {
+      try {
+        unlinkSync(manifestName);
+      } catch {
+      }
+    }
+    if (evidenceCreated && !sourceRemoved) {
+      try {
+        unlinkSync(evidenceName);
+      } catch {
+      }
+    }
+    throw err;
+  } finally {
+    if (entered) process.chdir(previousCwd);
+  }
+}
+async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
+  const resolvedStoreDir = path14__default.resolve(storeDir);
+  const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
+  try {
+    const sourcePath = path14__default.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
+    let opened;
+    try {
+      opened = await openOperationalHealthFile(resolvedStoreDir);
+    } catch (err) {
+      throw new Error("operational health state could not be opened safely; refusing quarantine", { cause: err });
+    }
+    if (!opened) return { status: "not-needed", reason: "missing" };
+    const source = opened.handle;
+    try {
+      const inspection = await inspectOperationalHealthHandle(source, opened.stat);
+      if (inspection.status === "valid") return { status: "not-needed", reason: "valid" };
+      if (inspection.status === "unavailable") {
+        throw new Error(`${inspection.reason}; refusing to quarantine unconfirmed corruption`);
+      }
+      const sourceStat = await source.stat({ bigint: true });
+      if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
+      const quarantineDir = path14__default.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
+      try {
+        const existing = await promises.lstat(quarantineDir);
+        if (!existing.isDirectory() || existing.isSymbolicLink()) {
+          throw new Error("quarantine path is not a real directory; refusing quarantine");
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+        await promises.mkdir(quarantineDir, { mode: 448 });
+      }
+      await ensureSecureDir(quarantineDir);
+      const securedQuarantine = await promises.lstat(quarantineDir, { bigint: true });
+      if (!securedQuarantine.isDirectory() || securedQuarantine.isSymbolicLink()) {
+        throw new Error("quarantine path changed during validation; refusing quarantine");
+      }
+      const stamp = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString().replace(/[:.]/g, "-");
+      const evidenceName = `${stamp}-${randomUUID()}-${OPERATIONAL_HEALTH_FILENAME}`;
+      const manifestName = `${evidenceName}.manifest.json`;
+      const hashed = publishQuarantineEvidencePinned(
+        quarantineDir,
+        securedQuarantine,
+        sourcePath,
+        source.fd,
+        sourceStat,
+        evidenceName,
+        manifestName,
+        (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+        inspection.reason
+      );
+      return { status: "quarantined", evidenceName, manifestName, sha256: hashed.sha256, sizeBytes: hashed.sizeBytes };
+    } finally {
+      await source.close();
+    }
+  } finally {
+    await owner.release();
+  }
+}
+
+// src/diagnostics/device-doctor.ts
+var MESSAGES = {
+  "confirmation-required": "Explicit confirmation is required for enrollment metadata repair.",
+  "invalid-target": "An explicit expected tenant and device are required.",
+  "daemon-running": "Stop the daemon before enrollment metadata repair.",
+  "store-busy": "The store is owned by another operation; enrollment metadata repair refused.",
+  "authority-unavailable": "The OS enrollment authority could not be read.",
+  "authority-missing": "No complete OS enrollment exists; use explicit authenticated pairing.",
+  "target-mismatch": "The OS enrollment does not match the expected tenant and device.",
+  "projection-unavailable": "The enrollment metadata could not be read safely; repair refused.",
+  "repair-failed": "Enrollment metadata repair did not complete; inspect the state before retrying."
+};
+var DeviceMetadataRepairError = class extends Error {
+  constructor(code) {
+    super(MESSAGES[code]);
+    this.code = code;
+    this.name = "DeviceMetadataRepairError";
+  }
+  code;
+};
+async function repairDeviceEnrollmentMetadata(config, input) {
+  if (input?.confirmed !== true) throw new DeviceMetadataRepairError("confirmation-required");
+  if (typeof input.expectedDeviceId !== "string" || input.expectedDeviceId.trim().length === 0 || !isTenantId(input.expectedTenantId)) {
+    throw new DeviceMetadataRepairError("invalid-target");
+  }
+  const { expectedDeviceId, expectedTenantId } = input;
+  const productId = config.productId;
+  let failureCode = "repair-failed";
+  try {
+    const storeDir = DeviceStore.resolveDir(productId, config.storeDir);
+    const control = await connectControlClient({ storeDir, productId });
+    if (control.ok) {
+      control.client.close();
+      throw new DeviceMetadataRepairError("daemon-running");
     }
-    const sha256 = createHash("sha256").update(bytes).digest("hex");
-    evidenceTemp = `.${evidenceName}.${randomUUID()}.tmp`;
-    const evidenceFd = openSync(evidenceTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    const owner = await acquireDaemonOwner(storeDir, "doctor");
     try {
-      writeFileSync(evidenceFd, bytes);
-      fchmodSync(evidenceFd, 384);
-      fsyncSync(evidenceFd);
+      const store = new DeviceStore(storeDir, void 0, productId);
+      failureCode = "projection-unavailable";
+      await store.load();
+      failureCode = "authority-unavailable";
+      const authority = await store.credentials.read();
+      if (authority === void 0) throw new DeviceMetadataRepairError("authority-missing");
+      if (authority.deviceId !== expectedDeviceId || authority.tenantId !== expectedTenantId) {
+        throw new DeviceMetadataRepairError("target-mismatch");
+      }
+      failureCode = "repair-failed";
+      const changed = await store.reconcileMetadata(authority);
+      const readback = await store.load();
+      if (readback === void 0 || readback.deviceId !== authority.deviceId || readback.tenantId !== authority.tenantId || readback.devicePublicKey !== authority.devicePublicKey) {
+        throw new DeviceMetadataRepairError("repair-failed");
+      }
+      return { action: "restore-enrollment-metadata", scope: "device", status: changed ? "repaired" : "not-needed" };
+    } catch (error) {
+      if (error instanceof DeviceMetadataRepairError) throw error;
+      throw new DeviceMetadataRepairError(failureCode);
     } finally {
-      closeSync(evidenceFd);
+      failureCode = "repair-failed";
+      await owner.release();
     }
-    linkSync(evidenceTemp, evidenceName);
-    evidenceCreated = true;
-    const evidence = lstatSync(evidenceName, { bigint: true });
-    const tempEvidence = lstatSync(evidenceTemp, { bigint: true });
-    if (!evidence.isFile() || !sameInode2(evidence, tempEvidence) || evidence.size !== sourceStat.size) {
-      throw new Error("quarantined operational health evidence does not match the bounded copy");
+  } catch (error) {
+    if (error instanceof DeviceMetadataRepairError) throw error;
+    if (error instanceof DaemonOwnerActiveError) throw new DeviceMetadataRepairError("store-busy");
+    throw new DeviceMetadataRepairError(failureCode);
+  }
+}
+
+// src/bin/format.ts
+function quote(text) {
+  return JSON.stringify(text);
+}
+function redactedByteCountPlaceholder(text) {
+  return `[redacted: ${Buffer.byteLength(text, "utf8")} bytes]`;
+}
+var STABLE_GIT_ERROR_CATEGORIES = new Set(GIT_ERROR_CATEGORIES);
+function stableGitErrorCategory(value) {
+  return value !== void 0 && STABLE_GIT_ERROR_CATEGORIES.has(value) ? value : void 0;
+}
+function formatAgentEvent(event) {
+  switch (event.type) {
+    case "progress":
+      return `progress: ${quote(event.text)}`;
+    case "tool_use":
+      return `tool_use: ${event.tool}`;
+    case "tool_result":
+      return `tool_result: ${event.tool}`;
+    case "artifact":
+      return `artifact: ${event.name} (${event.contentType})`;
+    case "needs_approval":
+      return `needs_approval: ${quote(event.summary)}`;
+    case "turn_end":
+      return "turn_end";
+    case "error":
+      return `error: ${quote(event.message)}`;
+    case "usage": {
+      const parts = [];
+      if (event.inputTokens !== void 0) parts.push(`in=${event.inputTokens}`);
+      if (event.outputTokens !== void 0) parts.push(`out=${event.outputTokens}`);
+      if (event.totalTokens !== void 0) parts.push(`total=${event.totalTokens}`);
+      return `usage: ${parts.length ? parts.join(" ") : "(no fields reported)"}`;
     }
-    unlinkSync(evidenceTemp);
-    evidenceTemp = void 0;
-    const finalOpenSource = fstatSync(sourceFd, { bigint: true });
-    const finalNamedSource = lstatSync(sourcePath, { bigint: true });
-    if (!sameFileState5(finalOpenSource, sourceStat) || !sameFileState5(finalNamedSource, sourceStat)) {
-      throw new Error("operational health source changed before removal");
+  }
+}
+function formatDaemonEventLine(event, options = {}) {
+  const prefix = `[${event.ts}]`;
+  switch (event.kind) {
+    case "offered":
+      return `${prefix} offered taskId=${event.taskId}${event.runtime ? ` runtime=${event.runtime}` : ""}`;
+    case "claimed":
+      return `${prefix} claimed taskId=${event.taskId}${event.claimedRuntime !== void 0 ? ` claimedRuntime=${event.claimedRuntime}` : ""}`;
+    case "started":
+      return `${prefix} started taskId=${event.taskId}`;
+    case "progress":
+      return `${prefix} progress taskId=${event.taskId} ${formatAgentEvent(event.event)}`;
+    case "artifact":
+      return `${prefix} artifact taskId=${event.taskId} name=${event.name} contentType=${event.contentType}`;
+    case "awaiting-approval": {
+      const summary = options.redactApprovalSummary ? redactedByteCountPlaceholder(event.summary) : event.summary;
+      return `${prefix} awaiting-approval taskId=${event.taskId}${event.approvalId ? ` approvalId=${event.approvalId}` : ""} summary=${quote(summary)}`;
     }
-    const manifestBody = `${JSON.stringify(
-      {
-        version: 1,
-        quarantinedAt,
-        reason,
-        sourcePath,
-        evidenceFile: evidenceName,
-        sha256,
-        sizeBytes
-      },
-      null,
-      2
-    )}
-`;
-    manifestTemp = `.${manifestName}.${randomUUID()}.tmp`;
-    const manifestFd = openSync(manifestTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    try {
-      writeFileSync(manifestFd, manifestBody, "utf8");
-      fchmodSync(manifestFd, 384);
-      fsyncSync(manifestFd);
-    } finally {
-      closeSync(manifestFd);
+    case "completed":
+      return `${prefix} completed taskId=${event.taskId} sessionRef=${event.sessionRef} summary=${quote(event.summary)}`;
+    case "failed":
+      return `${prefix} failed taskId=${event.taskId} retryable=${event.retryable}${event.preClaim ? " preClaim=true" : ""} reason=${quote(event.reason)}`;
+    case "cancelled":
+      return `${prefix} cancelled taskId=${event.taskId}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+    case "connection":
+      return `${prefix} connection state=${event.state}`;
+    case "paired":
+      return `${prefix} paired deviceId=${event.deviceId}`;
+    case "unpaired":
+      return `${prefix} unpaired`;
+    case "runtimes-detected":
+      return `${prefix} runtimes-detected ids=${event.runtimes.map((r) => r.id).join(",") || "(none)"}`;
+    case "shutdown-requested":
+      return `${prefix} shutdown-requested reason=${quote(event.reason)}`;
+    case "shutdown-complete":
+      return `${prefix} shutdown-complete reason=${quote(event.reason)}${event.undeliveredOutboxCount !== void 0 ? ` undeliveredOutboxCount=${event.undeliveredOutboxCount}` : ""}`;
+    case "stale-approval-decision":
+      return `${prefix} stale-approval-decision taskId=${event.taskId} decision=${event.decision}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+    case "runtime-disposal-failed":
+      return `${prefix} runtime-disposal-failed taskId=${event.taskId} runtime=${event.runtimeId} stage=${event.stage} reason=${quote(event.reason)}`;
+    case "git-workspace": {
+      const parts = [
+        `${prefix} git-workspace taskId=${event.taskId}`,
+        `workspaceId=${event.workspaceId}`,
+        `phase=${event.phase}`,
+        event.headChanged !== void 0 ? `headChanged=${event.headChanged}` : void 0,
+        event.commitsSinceBaseline !== void 0 ? `commits=${event.commitsSinceBaseline}` : void 0,
+        event.dirty ? `dirty=${event.dirty.staged}/${event.dirty.unstaged}/${event.dirty.untracked}/${event.dirty.conflicted}` : void 0,
+        stableGitErrorCategory(event.errorCategory) ? `errorCategory=${stableGitErrorCategory(event.errorCategory)}` : void 0
+      ].filter((part) => part !== void 0);
+      return parts.join(" ");
     }
-    linkSync(manifestTemp, manifestName);
-    manifestCreated = true;
-    unlinkSync(manifestTemp);
-    manifestTemp = void 0;
-    if (process.platform !== "win32") {
-      const quarantineDirectoryFd = openSync(".", constants.O_RDONLY);
-      try {
-        fsyncSync(quarantineDirectoryFd);
-      } finally {
-        closeSync(quarantineDirectoryFd);
-      }
+    case "device-assertion": {
+      const parts = event.result === "issued" ? [
+        `${prefix} device-assertion result=issued`,
+        `audience=${quote(event.audience)}`,
+        `jti=${event.jti}`,
+        `expiresAt=${event.expiresAt}`
+      ] : [
+        `${prefix} device-assertion result=denied`,
+        `reason=${event.reason}`,
+        event.audienceSize !== void 0 ? `audienceSize=${event.audienceSize}` : void 0
+      ].filter((part) => part !== void 0);
+      return parts.join(" ");
     }
-    const removalOpenSource = fstatSync(sourceFd, { bigint: true });
-    const removalNamedSource = lstatSync(sourcePath, { bigint: true });
-    if (!sameFileState5(removalOpenSource, sourceStat) || !sameFileState5(removalNamedSource, sourceStat)) {
-      throw new Error("operational health source changed before removal");
+  }
+}
+function formatTaskLine(task) {
+  const git = "git" in task ? task.git : void 0;
+  const gitStatus = git ? [
+    `git=${git.phase}`,
+    git.commitsSinceBaseline !== void 0 ? `commits=${git.commitsSinceBaseline}` : void 0,
+    git.dirty ? `dirty=${git.dirty.staged}/${git.dirty.unstaged}/${git.dirty.untracked}/${git.dirty.conflicted}` : void 0
+  ].filter((part) => part !== void 0).join(" ") : void 0;
+  const parts = [
+    task.taskId,
+    task.state,
+    task.runtime ? `runtime=${task.runtime}` : void 0,
+    gitStatus,
+    task.claimedRuntime !== void 0 ? `claimedRuntime=${task.claimedRuntime}` : void 0,
+    `updatedAt=${task.updatedAt}`,
+    task.sessionRef ? `sessionRef=${task.sessionRef}` : void 0,
+    task.declined ? "declined=true" : void 0,
+    task.summary ? `summary=${quote(task.summary)}` : void 0
+  ].filter((part) => Boolean(part));
+  return parts.join(" ");
+}
+function formatTaskListLines(tasks) {
+  if (tasks.length === 0) return ["(no tasks observed yet)"];
+  return tasks.map(formatTaskLine);
+}
+function formatRuntimeLines(runtimes) {
+  if (runtimes.length === 0) return ["(no runtimes configured \u2014 check runtimeAllowlist)"];
+  return runtimes.map((r) => {
+    if (!r.present) return `${r.id}: ${r.outcome}`;
+    const caps = [];
+    if (r.steer) caps.push("steer");
+    if (r.resume) caps.push("resume");
+    const parts = [
+      "present",
+      r.version ? `version=${r.version}` : void 0,
+      r.authPresent !== void 0 ? `authPresent=${r.authPresent}` : void 0,
+      `capabilities=${caps.length ? caps.join(",") : "(none)"}`,
+      `modes=${r.permissionModes.length ? r.permissionModes.join(",") : "(none)"}`
+    ].filter((part) => Boolean(part));
+    return `${r.id}: ${parts.join(" ")}`;
+  });
+}
+function formatStatusLines(view) {
+  const lines = [];
+  const label = view.branding?.displayName ?? view.productName;
+  lines.push(`product: ${label} (${view.productId})`);
+  lines.push(
+    `local-agent-release: ${view.localAgentRelease.version}${view.localAgentRelease.buildId ? ` buildId=${view.localAgentRelease.buildId}` : ""}`
+  );
+  if (view.branding?.supportUrl) lines.push(`support: ${view.branding.supportUrl}`);
+  lines.push(`paired: ${view.paired ? "yes" : "no"}${view.deviceId ? ` deviceId=${view.deviceId}` : ""}`);
+  lines.push(
+    view.connection ? `connection: last-known=${view.connection.state} at=${view.connection.ts}` : "connection: unknown (no audit log yet \u2014 run `byok-agent start` at least once to begin observing)"
+  );
+  const runtimeSummary = view.runtimes.map((r) => `${r.id}=${r.present ? "present" : r.outcome}`).join(" ");
+  lines.push(`runtimes: ${runtimeSummary || "(none configured)"}`);
+  const c = view.taskCounts;
+  lines.push(
+    `tasks: total=${c.total} offered=${c.Offered} claimed=${c.Claimed} running=${c.Running} awaitApproval=${c.AwaitApproval} complete=${c.Complete} failed=${c.Failed} cancelled=${c.Cancelled}`
+  );
+  lines.push(`audit-log: ${view.auditLogPath} (${view.auditLogLineCount} event${view.auditLogLineCount === 1 ? "" : "s"})`);
+  return lines;
+}
+function formatLiveStatusLines(live) {
+  const liveRelease = live.localAgentRelease;
+  const lines = [
+    `live: pid=${live.pid} uptimeMs=${live.uptimeMs} transport=${live.transport}`,
+    liveRelease ? `live-local-agent-release: ${liveRelease.version}${liveRelease.buildId ? ` buildId=${liveRelease.buildId}` : ""}` : "live-local-agent-release: unknown",
+    `live-paired: ${live.paired ? "yes" : "no"}${live.deviceId ? ` deviceId=${live.deviceId}` : ""}`,
+    `live-runtimes: ${live.runtimeIds.length ? live.runtimeIds.join(",") : "(none)"}`,
+    `live-toolsets: revision=${live.toolsets.revision} count=${live.toolsets.toolsets.length}`
+  ];
+  for (const toolset of live.toolsets.toolsets) lines.push(formatToolsetStatusLine("live-toolset", toolset));
+  const health = live.operationalHealth;
+  if (health.availability === "unavailable") {
+    lines.push(`live-operational-health: unavailable reason=${quote(health.reason)}`);
+  } else {
+    lines.push(
+      `live-operational-health: state=${health.state} failures=${health.failureCount}/${health.failureThreshold} windowMs=${health.windowMs} crashes=${health.crashCount}${health.lastCrashAt ? ` lastCrashAt=${health.lastCrashAt}` : ""}`
+    );
+  }
+  if (live.activeTasks.length === 0) {
+    lines.push("live-active-tasks: (none)");
+  } else {
+    for (const task of live.activeTasks) {
+      lines.push(`live-active-task: ${task.taskId} ${task.state}`);
     }
-    unlinkSync(sourcePath);
-    sourceRemoved = true;
-    if (process.platform !== "win32") {
-      const directoryFd = openSync(path14__default.dirname(sourcePath), constants.O_RDONLY);
-      try {
-        fsyncSync(directoryFd);
-      } finally {
-        closeSync(directoryFd);
-      }
+  }
+  lines.push(`live-approvals-pending: ${live.approvalsPending}`);
+  if (live.approvals.length === 0) {
+    lines.push("live-approvals: (none)");
+  } else {
+    for (const approval of live.approvals) {
+      lines.push(`live-approval: ${approval.approvalId} taskId=${approval.taskId} summary=${quote(summaryExcerpt(approval.summary))}`);
     }
-    return { sha256, sizeBytes };
-  } catch (err) {
-    if (evidenceTemp) {
-      try {
-        unlinkSync(evidenceTemp);
-      } catch {
-      }
+  }
+  if (live.queueWatermarks.length === 0) {
+    lines.push("live-queue-watermarks: (none)");
+  } else {
+    for (const watermark of live.queueWatermarks) {
+      lines.push(
+        `live-queue-watermark: ${watermark.taskId} progressBatcherPending=${watermark.progressBatcherPending} pendingApprovals=${watermark.pendingApprovals}`
+      );
     }
-    if (manifestTemp) {
-      try {
-        unlinkSync(manifestTemp);
-      } catch {
-      }
+  }
+  const storage = live.storage;
+  if (storage !== void 0) {
+    lines.push(
+      `live-storage: state=${storage.pressureState} used=${storage.usedBytes} budget=${storage.budgetBytes} free=${storage.freeBytes} measuredAt=${storage.measuredAt}`
+    );
+    for (const category of storage.categories) {
+      lines.push(`live-storage-category: ${category.category} bytes=${category.bytes}${category.approximate ? " (approximate)" : ""}`);
     }
-    if (manifestCreated && !sourceRemoved) {
-      try {
-        unlinkSync(manifestName);
-      } catch {
-      }
+    if (storage.lastCompaction) {
+      lines.push(
+        `live-storage-compaction: checkpointed=${storage.lastCompaction.checkpointed} walFramesRemaining=${storage.lastCompaction.walFramesRemaining} pagesVacuumed=${storage.lastCompaction.pagesVacuumed} durationMs=${storage.lastCompaction.durationMs} at=${storage.lastCompaction.at}`
+      );
     }
-    if (evidenceCreated && !sourceRemoved) {
-      try {
-        unlinkSync(evidenceName);
-      } catch {
-      }
+  }
+  return lines;
+}
+function formatToolsetStatusLine(prefix, toolset) {
+  const observation = toolset.observation;
+  return [
+    `${prefix}: ${toolset.id}`,
+    `servers=${toolset.serverCount}`,
+    `definitionRevision=${toolset.definitionRevision}`,
+    `state=${observation?.state ?? "unobserved"}`,
+    observation?.version === void 0 ? void 0 : `version=${quote(observation.version)}`,
+    observation?.observedAt === void 0 ? void 0 : `observedAt=${observation.observedAt}`,
+    observation?.reasonCode === void 0 ? void 0 : `reasonCode=${observation.reasonCode}`
+  ].filter((part) => part !== void 0).join(" ");
+}
+function formatToolsetsReloadReceiptLines(receipt) {
+  return [
+    `toolsets-reload: changed=${receipt.changed ? "yes" : "no"} previousRevision=${receipt.previousRevision} revision=${receipt.revision}`,
+    ...receipt.toolsets.map((toolset) => formatToolsetStatusLine("toolset", toolset))
+  ];
+}
+var SUMMARY_EXCERPT_MAX_LEN = 60;
+function summaryExcerpt(summary) {
+  if (!summary) return "(no summary)";
+  return summary.length > SUMMARY_EXCERPT_MAX_LEN ? `${summary.slice(0, SUMMARY_EXCERPT_MAX_LEN)}\u2026` : summary;
+}
+function formatAge(ms) {
+  const totalSeconds = Math.floor(Math.max(0, ms) / 1e3);
+  if (totalSeconds < 60) return `${totalSeconds}s`;
+  const totalMinutes = Math.floor(totalSeconds / 60);
+  if (totalMinutes < 60) return `${totalMinutes}m`;
+  const totalHours = Math.floor(totalMinutes / 60);
+  if (totalHours < 24) return `${totalHours}h`;
+  const totalDays = Math.floor(totalHours / 24);
+  return `${totalDays}d`;
+}
+function formatApprovalsListLines(approvals, nowMs) {
+  if (approvals.length === 0) return ["(no pending approvals)"];
+  return approvals.map((approval) => {
+    const ageMs = nowMs - Date.parse(approval.createdAt);
+    return `${approval.approvalId} taskId=${approval.taskId} age=${formatAge(ageMs)} summary=${quote(summaryExcerpt(approval.summary))}`;
+  });
+}
+
+// src/bin/commands/approvals.ts
+async function runApprovalsCommand(storeDir, productId, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const error = deps.error ?? ((line) => console.error(line));
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const now = deps.now ?? (() => Date.now());
+  const conn = await connectControl({ storeDir, productId });
+  if (!conn.ok) {
+    const message = `cannot list approvals: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
+    error(message);
+    throw new Error(message);
+  }
+  try {
+    const result = await conn.client.request("approvals.list");
+    for (const line of formatApprovalsListLines(result.approvals, now())) log(line);
+  } catch (err) {
+    if (err instanceof ControlError) {
+      error(`approvals list failed: ${err.message}`);
+    } else {
+      error(`approvals list failed: ${err instanceof Error ? err.message : String(err)}`);
     }
     throw err;
   } finally {
-    if (entered) process.chdir(previousCwd);
+    conn.client.close();
   }
 }
-async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
-  const resolvedStoreDir = path14__default.resolve(storeDir);
-  const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
+
+// src/bin/commands/approve-reject.ts
+async function runApproveCommand(storeDir, productId, approvalId, deps = {}) {
+  return resolveApproval(storeDir, productId, approvalId, "approve", void 0, deps);
+}
+async function runRejectCommand(storeDir, productId, approvalId, reason, deps = {}) {
+  return resolveApproval(storeDir, productId, approvalId, "reject", reason, deps);
+}
+async function resolveApproval(storeDir, productId, approvalId, decision, reason, deps) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const error = deps.error ?? ((line) => console.error(line));
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const verb = decision === "approve" ? "approved" : "rejected";
+  const conn = await connectControl({ storeDir, productId });
+  if (!conn.ok) {
+    const message = `cannot ${decision} approvalId=${approvalId}: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
+    error(message);
+    throw new Error(message);
+  }
   try {
-    const sourcePath = path14__default.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
-    let opened;
-    try {
-      opened = await openOperationalHealthFile(resolvedStoreDir);
-    } catch (err) {
-      throw new Error("operational health state could not be opened safely; refusing quarantine", { cause: err });
+    await conn.client.request("approvals.resolve", { approvalId, decision, reason });
+    log(`${verb}: approvalId=${approvalId}${reason ? ` reason=${JSON.stringify(reason)}` : ""}`);
+  } catch (err) {
+    if (err instanceof ControlError && err.code === "not_found") {
+      error(`${err.message} \u2014 run \`byok-agent approvals\` to see pending approvalIds`);
+    } else {
+      error(`${decision} failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    if (!opened) return { status: "not-needed", reason: "missing" };
-    const source = opened.handle;
+    throw err;
+  } finally {
+    conn.client.close();
+  }
+}
+
+// src/bin/commands/pair.ts
+async function runPairCommand(config, code, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  if (deps.daemon) {
+    const result2 = await deps.daemon.pair(code);
+    log(`paired: deviceId=${result2.deviceId}`);
+    return;
+  }
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const conn = await connectControl({ storeDir: resolveStoreDir(config), productId: config.productId });
+  if (conn.ok) {
     try {
-      const inspection = await inspectOperationalHealthHandle(source, opened.stat);
-      if (inspection.status === "valid") return { status: "not-needed", reason: "valid" };
-      if (inspection.status === "unavailable") {
-        throw new Error(`${inspection.reason}; refusing to quarantine unconfirmed corruption`);
-      }
-      const sourceStat = await source.stat({ bigint: true });
-      if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
-      const quarantineDir = path14__default.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
-      try {
-        const existing = await promises.lstat(quarantineDir);
-        if (!existing.isDirectory() || existing.isSymbolicLink()) {
-          throw new Error("quarantine path is not a real directory; refusing quarantine");
-        }
-      } catch (err) {
-        if (err.code !== "ENOENT") throw err;
-        await promises.mkdir(quarantineDir, { mode: 448 });
-      }
-      await ensureSecureDir(quarantineDir);
-      const securedQuarantine = await promises.lstat(quarantineDir, { bigint: true });
-      if (!securedQuarantine.isDirectory() || securedQuarantine.isSymbolicLink()) {
-        throw new Error("quarantine path changed during validation; refusing quarantine");
-      }
-      const stamp = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString().replace(/[:.]/g, "-");
-      const evidenceName = `${stamp}-${randomUUID()}-${OPERATIONAL_HEALTH_FILENAME}`;
-      const manifestName = `${evidenceName}.manifest.json`;
-      const hashed = publishQuarantineEvidencePinned(
-        quarantineDir,
-        securedQuarantine,
-        sourcePath,
-        source.fd,
-        sourceStat,
-        evidenceName,
-        manifestName,
-        (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
-        inspection.reason
-      );
-      return { status: "quarantined", evidenceName, manifestName, sha256: hashed.sha256, sizeBytes: hashed.sizeBytes };
+      const result2 = await conn.client.request("enrollment.pair", { pairingCode: code });
+      log(`paired: deviceId=${result2.deviceId}`);
+      return;
     } finally {
-      await source.close();
+      conn.client.close();
     }
-  } finally {
-    await owner.release();
   }
+  const daemon = createDaemon(config);
+  const result = await daemon.pair(code);
+  log(`paired: deviceId=${result.deviceId}`);
 }
 
 // src/bin/commands/doctor.ts
@@ -22420,6 +23293,29 @@ function formatDoctorLines(snapshot, fixResult) {
   return lines;
 }
 async function runDoctorCommand(config, options = {}) {
+  if (options.repair !== void 0) {
+    if (options.fix || options.repair !== "restore-enrollment-metadata") {
+      throw new Error("doctor requires one supported repair action; --fix cannot be combined with --repair");
+    }
+    const log2 = options.log ?? ((line) => console.log(line));
+    try {
+      const repair = await repairDeviceEnrollmentMetadata(config, {
+        confirmed: options.confirmed,
+        expectedDeviceId: options.expectedDeviceId,
+        expectedTenantId: options.expectedTenantId
+      });
+      log2(options.json ? JSON.stringify({ repair }, null, 2) : `repair ${repair.action}: ${repair.status} (${repair.scope})`);
+      return;
+    } catch (error) {
+      if (options.json && error instanceof DeviceMetadataRepairError) {
+        log2(JSON.stringify({ repair: { action: "restore-enrollment-metadata", scope: "device", status: "failed", code: error.code } }, null, 2));
+      }
+      throw error;
+    }
+  }
+  if (options.expectedDeviceId !== void 0 || options.expectedTenantId !== void 0) {
+    throw new Error("expected identity flags require --repair restore-enrollment-metadata");
+  }
   if (options.fix && !options.confirmed) throw new DoctorConfirmationRequiredError();
   const storeDir = resolveStoreDir(config);
   let snapshot = await collectDiagnostics(config, storeDir, options);
@@ -23412,8 +24308,8 @@ async function runTasksFollowCommand(config, deps) {
     });
     return;
   }
-  const path46 = auditLogPath(storeDir);
-  await followAuditLog(path46, (event) => log(formatDaemonEventLine(event)), {
+  const path47 = auditLogPath(storeDir);
+  await followAuditLog(path47, (event) => log(formatDaemonEventLine(event)), {
     signal: deps.signal,
     pollIntervalMs: deps.pollIntervalMs,
     fromEnd: true
@@ -23696,6 +24592,7 @@ function usage() {
       "  byok-agent start [--config <path>]                        (or BYOK_CONFIG env var)",
       "  byok-agent status [--config <path>]",
       "  byok-agent doctor [--json] [--fix --yes] [--config <path>]",
+      "  byok-agent doctor --repair restore-enrollment-metadata --expected-device-id <id> --expected-tenant-id <id> --yes [--json] [--config <path>]",
       "  byok-agent support-bundle --output <path> [--config <path>]",
       "  byok-agent runtimes [--config <path>]",
       "  byok-agent tasks [--follow] [--config <path>]",
@@ -23765,6 +24662,9 @@ async function main() {
     return runDoctorCommand(config, {
       json: hasFlag(rest, "--json"),
       fix: hasFlag(rest, "--fix"),
+      repair: hasFlag(rest, "--repair") ? argValue(rest, "--repair") ?? "" : void 0,
+      expectedDeviceId: hasFlag(rest, "--expected-device-id") ? argValue(rest, "--expected-device-id") ?? "" : void 0,
+      expectedTenantId: hasFlag(rest, "--expected-tenant-id") ? argValue(rest, "--expected-tenant-id") ?? "" : void 0,
       confirmed: hasFlag(rest, "--yes")
     });
   }