@byok-sdk/client 0.14.0 → 0.16.0

package/dist/index.js

@@ -1,15 +1,15 @@
 import { randomUUID, createHash, randomBytes, createPrivateKey, generateKeyPairSync, sign, timingSafeEqual, createHmac } from 'crypto';
-import { promises, mkdirSync, constants, existsSync, linkSync, fstatSync, lstatSync, unlinkSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, readFileSync, realpathSync } from 'fs';
+import { promises, mkdirSync, constants, existsSync, linkSync, fstatSync, lstatSync, unlinkSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, readFileSync, readSync, openSync, fchmodSync, fsyncSync, closeSync, opendirSync, realpathSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, isTaskOfferType, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, isTaskOfferType, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, decodeEnvelope, createEnvelope, encodeEnvelope, PROTOCOL_VERSION, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, RuntimeIdSchema, HarnessIdSchema, TERMINAL_PROJECTION_SELECTION_CAPABILITY, PROVIDER_PROFILE_BINDING_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, isServerToDaemonType, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, MAILBOX_READ_AHEAD_MAX_SEQS, MAILBOX_READ_AHEAD_CAPABILITY, MESSAGE_TYPES, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net2, { createServer, createConnection } from 'net';
-import * as os4 from 'os';
-import os4__default from 'os';
+import * as os from 'os';
+import os__default from 'os';
 import { execFile, spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { createInterface } from 'readline';
-import { parseDeviceAssertionEnvelope, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, isTenantId, nonceSigningBytes, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
+import { parseDeviceAssertionEnvelope, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, nonceSigningBytes, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import * as fs14 from 'fs/promises';
 import { createRequire } from 'module';
@@ -246,6 +246,18 @@ var ADMINISTRATORS_SID = "*S-1-5-32-544";
 function buildIcaclsArgs(dir, username) {
   return [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`, "/grant", `${SYSTEM_SID}:(OI)(CI)F`, "/grant", `${ADMINISTRATORS_SID}:(OI)(CI)F`];
 }
+function buildIcaclsFileArgs(filePath, username) {
+  return [
+    filePath,
+    "/inheritance:r",
+    "/grant:r",
+    `${username}:F`,
+    "/grant",
+    `${SYSTEM_SID}:F`,
+    "/grant",
+    `${ADMINISTRATORS_SID}:F`
+  ];
+}
 var SecureDirHardeningError = class extends Error {
   constructor(dir, reason) {
     super(
@@ -256,6 +268,14 @@ var SecureDirHardeningError = class extends Error {
   }
   dir;
 };
+var SecureFileHardeningError = class extends Error {
+  constructor(filePath, reason) {
+    super(`failed to apply a restrictive Windows ACL to "${filePath}": ${reason}`);
+    this.filePath = filePath;
+    this.name = "SecureFileHardeningError";
+  }
+  filePath;
+};
 async function ensureSecureDir(dir, opts = {}) {
   const platform = opts.platform ?? process.platform;
   const run = opts.run ?? defaultRunner;
@@ -263,7 +283,7 @@ async function ensureSecureDir(dir, opts = {}) {
   await promises.chmod(dir, 448).catch(() => {
   });
   if (platform !== "win32") return;
-  const { username } = os4__default.userInfo();
+  const { username } = os__default.userInfo();
   let result;
   try {
     result = await run("icacls", buildIcaclsArgs(dir, username));
@@ -274,6 +294,22 @@ async function ensureSecureDir(dir, opts = {}) {
     throw new SecureDirHardeningError(dir, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
   }
 }
+async function ensureSecureFile(filePath, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const run = opts.run ?? defaultRunner;
+  await promises.chmod(filePath, 384);
+  if (platform !== "win32") return;
+  const { username } = os__default.userInfo();
+  let result;
+  try {
+    result = await run("icacls", buildIcaclsFileArgs(filePath, username));
+  } catch (err) {
+    throw new SecureFileHardeningError(filePath, `could not run icacls: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (result.code !== 0) {
+    throw new SecureFileHardeningError(filePath, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
+  }
+}
 
 // src/daemon/path-mutation-gate.ts
 var PathMutationGateBusyError = class extends Error {
@@ -2211,6 +2247,7 @@ async function acquire(input) {
 var localStateRelocation = Object.freeze({ acquire });
 
 // src/types.ts
+var RUNTIME_DETECTION_FAILURE_KINDS = ["not-found", "not-executable", "timeout", "probe-failed"];
 function frozenStrings(values) {
   return values === void 0 ? void 0 : Object.freeze([...values]);
 }
@@ -2307,6 +2344,31 @@ function resolveLocalAgentReleaseIdentity(input) {
     ...input.buildId === void 0 ? {} : { buildId: input.buildId }
   });
 }
+async function runMcpEnvLauncher() {
+  const key = process.env.BYOK_MCP_ENV_KEY;
+  if (!key || !/^BYOK_MCP_PAYLOAD_[A-F0-9]{32}$/.test(key)) throw new Error("invalid MCP environment binding");
+  const encoded = process.env[key];
+  if (!encoded) throw new Error("missing sealed MCP environment");
+  let config;
+  try {
+    config = JSON.parse(encoded);
+    if (!config || typeof config.command !== "string" || !config.command || config.args !== void 0 && (!Array.isArray(config.args) || config.args.some((value) => typeof value !== "string")) || config.env !== void 0 && (typeof config.env !== "object" || config.env === null || Array.isArray(config.env) || Object.values(config.env).some((value) => typeof value !== "string"))) throw new Error();
+  } catch {
+    throw new Error("invalid sealed MCP environment");
+  }
+  const env = { ...process.env };
+  delete env.BYOK_MCP_ENV_KEY;
+  for (const name of Object.keys(env)) if (name.startsWith("BYOK_MCP_PAYLOAD_")) delete env[name];
+  Object.assign(env, config.env);
+  await new Promise((resolve, reject) => {
+    const child = spawn(config.command, config.args ?? [], { env, stdio: "inherit", windowsHide: true });
+    child.once("error", () => reject(new Error("MCP child could not be spawned")));
+    child.once("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error("MCP child exited unsuccessfully"));
+    });
+  });
+}
 var CONTROL_PROTOCOL_VERSION = 1;
 var HANDSHAKE_TIMEOUT_MS = 3e3;
 var UNIX_SOCKET_PATH_SOFT_LIMIT2 = 100;
@@ -3174,6 +3236,9 @@ async function runAgentTeamMcp() {
 }
 async function runSdkReservedHelper(kind) {
   switch (kind) {
+    case "mcp-env":
+      await runMcpEnvLauncher();
+      return;
     case "agent-message-mcp":
       await runAgentMessageMcp();
       return;
@@ -3195,7 +3260,8 @@ var DIST_SCRIPT_BY_KIND = Object.freeze({
   "agent-message-mcp": "byok-agent-message-mcp.js",
   "agent-memory-mcp": "byok-agent-memory-mcp.js",
   "approval-mcp": "byok-approval-mcp.js",
-  "agent-team-mcp": "byok-agent-team-mcp.js"
+  "agent-team-mcp": "byok-agent-team-mcp.js",
+  "mcp-env": "byok-mcp-env.js"
 });
 function assertExecutable(executable) {
   if (!path3__default.isAbsolute(executable) || /[\u0000\r\n]/u.test(executable)) {
@@ -3213,8 +3279,11 @@ function resolveSdkReservedHelperBin(kind, host) {
       source: "self-executable"
     });
   }
+  const entryDir = path3__default.dirname(fileURLToPath(import.meta.url));
+  const entryKind = path3__default.basename(entryDir);
+  const distDir = entryKind === "adapters" || entryKind === "bin" ? path3__default.dirname(entryDir) : entryDir;
   const script = path3__default.join(
-    path3__default.dirname(fileURLToPath(import.meta.url)),
+    distDir,
     "bin",
     DIST_SCRIPT_BY_KIND[kind]
   );
@@ -3225,7 +3294,7 @@ function resolveSdkReservedHelperBin(kind, host) {
   });
 }
 function isHelperKind(value) {
-  return value === "agent-message-mcp" || value === "agent-memory-mcp" || value === "approval-mcp" || value === "agent-team-mcp";
+  return value === "agent-message-mcp" || value === "agent-memory-mcp" || value === "approval-mcp" || value === "agent-team-mcp" || value === "mcp-env";
 }
 async function runSdkReservedHelperCommand(argv = process.argv.slice(2)) {
   if (argv[0] !== BYOK_SDK_HELPER_SUBCOMMAND) return false;
@@ -3319,6 +3388,32 @@ function projectRuntimeBoundaryFailure(value, expectedPhase) {
     contractViolation: true
   };
 }
+var RuntimeStartupDisposalFailure = class extends Error {
+  retryDisposal;
+  constructor(retryDisposal, options) {
+    super("runtime startup failed and process ownership remains quarantined", options);
+    this.name = "RuntimeStartupDisposalFailure";
+    this.retryDisposal = retryDisposal;
+    Object.defineProperty(this, /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeStartupDisposalFailure/v1"), { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeStartupDisposalFailure(value) {
+  return typeof value === "object" && value !== null && value[/* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeStartupDisposalFailure/v1")] === true && typeof value.retryDisposal === "function";
+}
+var GIT_ERROR_CATEGORIES = [
+  "git-unavailable",
+  "git-timeout",
+  "git-output-limit",
+  "git-command-failed",
+  "workspace-root-invalid",
+  "workspace-root-conflict",
+  "workspace-not-owned",
+  "repository-root-mismatch",
+  "repository-invalid",
+  "lease-busy",
+  "ledger-invalid"
+];
 var GitWorkspaceError = class extends Error {
   constructor(category, message = category) {
     super(message);
@@ -3824,6 +3919,132 @@ var GitWorkspaceStore = class {
     await atomicWriteFile(this.filePath, JSON.stringify(ledger, null, 2), { mode: 384 });
   }
 };
+function terminalIdentity(runtimeId, agentRef) {
+  return {
+    ...runtimeId === void 0 || RuntimeIdSchema.safeParse(runtimeId).success ? {} : { harnessId: HarnessIdSchema.parse(runtimeId) },
+    ...agentRef === void 0 ? {} : { agentRef }
+  };
+}
+
+// src/daemon/terminal-commit-queue.ts
+var TerminalCommitQueue = class {
+  constructor(committed) {
+    this.committed = committed;
+  }
+  committed;
+  pending = /* @__PURE__ */ new Map();
+  tail = Promise.resolve();
+  timer;
+  stopped = false;
+  get pendingCount() {
+    return this.pending.size;
+  }
+  hasPending(taskId) {
+    return this.pending.has(taskId);
+  }
+  enqueue(taskId, commit) {
+    if (!this.pending.has(taskId)) this.pending.set(taskId, { commit, receipt: Promise.resolve(), running: false });
+    void this.attempt(taskId).catch(() => void 0);
+  }
+  receipt(taskId) {
+    return this.pending.get(taskId)?.receipt ?? Promise.resolve();
+  }
+  retry(taskId) {
+    return this.attempt(taskId);
+  }
+  resume() {
+    this.stopped = false;
+    if (this.pending.size > 0) this.armRetry();
+  }
+  async stop() {
+    this.stopped = true;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = void 0;
+    await Promise.all([...this.pending.keys()].map((taskId) => this.attempt(taskId)));
+  }
+  attempt(taskId) {
+    const entry = this.pending.get(taskId);
+    if (!entry) return Promise.resolve();
+    if (entry.running) return entry.receipt;
+    entry.running = true;
+    const receipt = this.tail.catch(() => void 0).then(entry.commit);
+    entry.receipt = receipt.then(() => {
+      if (this.pending.get(taskId) === entry) this.pending.delete(taskId);
+      this.committed(taskId);
+    }, (error) => {
+      entry.running = false;
+      this.armRetry();
+      throw error;
+    });
+    this.tail = entry.receipt;
+    void entry.receipt.catch(() => void 0);
+    return entry.receipt;
+  }
+  armRetry() {
+    if (this.timer || this.stopped) return;
+    this.timer = setTimeout(() => {
+      this.timer = void 0;
+      for (const taskId of this.pending.keys()) void this.attempt(taskId).catch(() => void 0);
+    }, 1e3);
+    this.timer.unref?.();
+  }
+};
+
+// src/runtime-detection.ts
+function validateRuntimeDetectResult(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("invalid runtime detection result");
+  }
+  const result = value;
+  if (!Object.hasOwn(result, "kind")) throw new TypeError("invalid runtime detection result");
+  const { kind, version, authPresent } = result;
+  if (kind === "available") {
+    if (Object.keys(result).some((key) => !["kind", "version", "authPresent"].includes(key)) || version !== void 0 && typeof version !== "string" || authPresent !== void 0 && typeof authPresent !== "boolean") {
+      throw new TypeError("invalid runtime detection result");
+    }
+    return Object.freeze({
+      kind,
+      ...version === void 0 ? {} : { version },
+      ...authPresent === void 0 ? {} : { authPresent }
+    });
+  }
+  if (RUNTIME_DETECTION_FAILURE_KINDS.some((candidate) => candidate === kind) && Object.keys(result).every((key) => key === "kind")) {
+    return Object.freeze({ kind });
+  }
+  throw new TypeError("invalid runtime detection result");
+}
+function classifyDetectError(error) {
+  const code = error !== null && typeof error === "object" ? error.code : void 0;
+  if (code === "ENOENT") return { kind: "not-found" };
+  if (code === "EACCES" || code === "EPERM" || code === "ENOEXEC") return { kind: "not-executable" };
+  return { kind: "probe-failed" };
+}
+async function probeRuntimeVersion(command, timeoutMs) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new TypeError("invalid runtime probe timeout");
+  return new Promise((resolve) => {
+    let timer;
+    let timedOut = false;
+    try {
+      const child = execFile(command, ["--version"], { encoding: "utf8" }, (error, stdout, stderr) => {
+        if (timer) clearTimeout(timer);
+        if (error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") resolve({ kind: "probe-failed" });
+        else if (timedOut) resolve({ kind: "timeout" });
+        else if (error) resolve(classifyDetectError(error));
+        else resolve({ kind: "available", stdout, stderr });
+      });
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        child.kill("SIGKILL");
+      }, timeoutMs);
+      timer.unref?.();
+    } catch (error) {
+      if (timer) clearTimeout(timer);
+      resolve(classifyDetectError(error));
+    }
+  });
+}
 
 // src/adapters/pi/mcp-config.ts
 var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
@@ -4834,12 +5055,13 @@ var PiAdapter = class {
   async detect() {
     try {
       const bin = this.resolveBin();
-      const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
-      const version = stdout.trim() || stderr.trim();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -4952,7 +5174,7 @@ var PiAdapter = class {
           const taskMcpServers = startInput.mcpServers ?? {};
           let mcpConfigPath;
           try {
-            mcpConfigDir = await promises.mkdtemp(path3__default.join(os4__default.tmpdir(), "byok-pi-mcp-"));
+            mcpConfigDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-pi-mcp-"));
             await promises.chmod(mcpConfigDir, 448).catch(() => {
             });
             mcpConfigPath = path3__default.join(mcpConfigDir, "mcp-config.json");
@@ -5969,14 +6191,15 @@ var ClaudeAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const { stdout } = await execFileAsync2(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS2 });
-      const version = stdout.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS2);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim();
       const authPresent = await this.probeAuthPresent(bin.command);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   async prepare(input) {
@@ -6063,7 +6286,7 @@ var ClaudeAdapter = class {
       });
     }
     if (needsMcpConfig) {
-      mcpConfigDir = await promises.mkdtemp(path3__default.join(os4__default.tmpdir(), "byok-mcp-"));
+      mcpConfigDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-mcp-"));
       await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
       const mcpConfigPath = path3__default.join(mcpConfigDir, "mcp-config.json");
@@ -6595,10 +6818,18 @@ function unmappedFrameKey(evt) {
   return evt.type;
 }
 var STDERR_RING_CAPACITY3 = 20;
+var CODEX_MAX_FRAME_BYTES = 1024 * 1024;
+var CODEX_MAX_DEFERRED_BYTES = 4 * 1024 * 1024;
+var CODEX_MAX_STDERR_BYTES = 64 * 1024;
 var CodexProcessRunner = class {
   child;
   onEvent;
-  buffer = "";
+  frameChunks = [];
+  frameBytes = 0;
+  deferredBytes = 0;
+  stderrBytes = 0;
+  transportFailure;
+  onFailure;
   stderrRing = [];
   closed = false;
   exitCode = null;
@@ -6621,11 +6852,12 @@ var CodexProcessRunner = class {
   deferredEvents = [];
   constructor(options) {
     this.onEvent = options.onEvent;
+    this.onFailure = options.onFailure;
     const spawnFn = options.spawnFn ?? spawn;
     this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: [options.instruction === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
     }));
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
@@ -6633,7 +6865,6 @@ var CodexProcessRunner = class {
     this.adopted = this.adoptOwnedTree(options);
     this.adopted.catch(() => {
     });
-    this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.stderr.setEncoding("utf8");
     this.child.stderr.on("data", (chunk) => this.onStderr(chunk));
@@ -6642,6 +6873,12 @@ var CodexProcessRunner = class {
       this.exitSignal = signal;
       this.finishClosing();
     });
+    if (options.instruction !== void 0) {
+      this.child.stdin.on("error", () => {
+        this.failTransport("codex prompt stdin failed before delivery");
+      });
+      this.child.stdin.end(options.instruction, "utf8");
+    }
     this.child.on("error", () => {
       this.finishClosing();
     });
@@ -6727,12 +6964,19 @@ var CodexProcessRunner = class {
       throw failure;
     }
     this.adoption = "adopted";
+    this.deferredBytes = 0;
     for (const evt of this.deferredEvents.splice(0)) this.onEvent(evt);
   }
   /** Arrival-order delivery, held back until the tree is backstopped (see `deferredEvents`). */
-  deliver(evt) {
+  deliver(evt, bytes) {
+    if (this.transportFailure) return;
     if (this.adoption === "failed") return;
     if (this.adoption === "pending") {
+      if (this.deferredBytes + bytes > CODEX_MAX_DEFERRED_BYTES) {
+        this.failTransport("codex pre-adoption event buffer exceeded its byte budget");
+        return;
+      }
+      this.deferredBytes += bytes;
       this.deferredEvents.push(evt);
       return;
     }
@@ -6749,6 +6993,7 @@ var CodexProcessRunner = class {
    * plus an empty stderr tail would bury the only reason anyone can act on.
    */
   buildExitError(context) {
+    if (this.transportFailure) return this.transportFailure;
     if (this.adoptionFailure !== void 0) return this.adoptionFailure;
     const parts = [`${context} (exit code=${this.exitCode}, signal=${this.exitSignal})`];
     if (this.stderrRing.length > 0) {
@@ -6756,18 +7001,45 @@ var CodexProcessRunner = class {
     }
     return new Error(parts.join("; "));
   }
+  failTransport(reason) {
+    if (this.transportFailure) return;
+    this.transportFailure = new RuntimeExecutionFailure({
+      phase: "run",
+      category: "infrastructure",
+      retry: "non-retryable",
+      reason
+    });
+    this.frameChunks.length = 0;
+    this.frameBytes = 0;
+    this.deferredEvents.length = 0;
+    this.deferredBytes = 0;
+    this.onFailure?.(this.transportFailure);
+    this.kill();
+  }
   onData(chunk) {
-    this.buffer += chunk;
-    let newlineIndex = this.buffer.indexOf("\n");
-    while (newlineIndex !== -1) {
-      let line = this.buffer.slice(0, newlineIndex);
-      this.buffer = this.buffer.slice(newlineIndex + 1);
-      if (line.endsWith("\r")) line = line.slice(0, -1);
-      if (line.length > 0) this.parseLine(line);
-      newlineIndex = this.buffer.indexOf("\n");
+    if (this.transportFailure) return;
+    let offset = 0;
+    while (offset < chunk.length) {
+      const newline = chunk.indexOf(10, offset);
+      const end = newline === -1 ? chunk.length : newline;
+      const bytes = end - offset;
+      if (this.frameBytes + bytes > CODEX_MAX_FRAME_BYTES) {
+        this.failTransport("codex raw JSONL frame exceeded its byte budget");
+        return;
+      }
+      if (bytes > 0) this.frameChunks.push(Buffer.from(chunk.subarray(offset, end)));
+      this.frameBytes += bytes;
+      if (newline === -1) return;
+      const frame = Buffer.concat(this.frameChunks, this.frameBytes);
+      this.frameChunks.length = 0;
+      this.frameBytes = 0;
+      const line = frame.toString("utf8").replace(/\r$/, "");
+      if (line.length > 0) this.parseLine(line, frame.length);
+      if (this.transportFailure) return;
+      offset = newline + 1;
     }
   }
-  parseLine(line) {
+  parseLine(line, bytes) {
     let parsed;
     try {
       parsed = JSON.parse(line);
@@ -6777,14 +7049,18 @@ var CodexProcessRunner = class {
     if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
       return;
     }
-    this.deliver(parsed);
+    this.deliver(parsed, bytes);
   }
   onStderr(chunk) {
-    for (const rawLine of chunk.split("\n")) {
+    const bounded2 = Buffer.from(chunk).subarray(-CODEX_MAX_STDERR_BYTES).toString("utf8");
+    for (const rawLine of bounded2.split("\n")) {
       const line = rawLine.trim();
       if (line.length === 0) continue;
       this.stderrRing.push(line);
-      if (this.stderrRing.length > STDERR_RING_CAPACITY3) this.stderrRing.shift();
+      this.stderrBytes += Buffer.byteLength(line);
+      while (this.stderrRing.length > STDERR_RING_CAPACITY3 || this.stderrBytes > CODEX_MAX_STDERR_BYTES) {
+        this.stderrBytes -= Buffer.byteLength(this.stderrRing.shift());
+      }
     }
   }
 };
@@ -6817,14 +7093,15 @@ var CodexAdapter = class {
     environmentRequirements: { credentialNames: [] }
   });
   async detect() {
-    const bin = this.resolveBin();
     try {
-      const versionResult = await execFileAsync3(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS3 });
-      const version = versionResult.stdout.trim() || versionResult.stderr.trim();
+      const bin = this.resolveBin();
+      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS3);
+      if (probe.kind !== "available") return probe;
+      const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = await this.probeAuthPresent(bin);
-      return { present: true, version, authPresent };
-    } catch {
-      return { present: false };
+      return { kind: "available", version, authPresent };
+    } catch (error) {
+      return classifyDetectError(error);
     }
   }
   /**
@@ -6967,7 +7244,7 @@ ${withStreams.stderr ?? ""}`);
         reason: "prepared codex operation received a manifest with different runtime selection"
       });
     }
-    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, preparedMcpGrants);
+    const mcpConfigArgs = codexMcpConfigArgs(startInput.mcpServers, runtimeEnv, this.options.sdkHelperHost, preparedMcpGrants);
     const { sessionRef, runner } = await runCodexTurn({
       command,
       resumeRef: startInput.manifest.sessionRef,
@@ -6983,6 +7260,7 @@ ${withStreams.stderr ?? ""}`);
       expectedSessionRef: startInput.manifest.sessionRef,
       preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
       failurePhase: "start",
+      signal: startInput.signal,
       terminal
     });
     return new CodexSession({
@@ -6990,6 +7268,7 @@ ${withStreams.stderr ?? ""}`);
       command,
       workspaceDir,
       env: startInput.env,
+      mcpEnvironment: Object.fromEntries(Object.entries(runtimeEnv).filter(([key]) => key.startsWith("BYOK_MCP_PAYLOAD_"))),
       spawnFn: this.options.spawnFn,
       queue,
       recordUnmapped,
@@ -7042,16 +7321,18 @@ function codexMcpToolApprovalArgs(name, tools) {
   }
   return args;
 }
-function codexMcpConfigArgs(servers, grants = []) {
+function codexMcpConfigArgs(servers, env, helperHost, grants = []) {
   if (servers === void 0 || Object.keys(servers).length === 0) return [];
   const grantedTools = new Map(grants.map((grant) => [grant.server, grant.tools]));
   const args = ["--ignore-user-config"];
   for (const [name, server] of Object.entries(servers).sort(([left], [right]) => left.localeCompare(right))) {
-    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(server.command)}`);
-    if (server.args !== void 0) args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...server.args])}`);
-    for (const [key, value] of Object.entries(server.env ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
-      args.push("-c", `mcp_servers.${name}.env.${key}=${JSON.stringify(value)}`);
-    }
+    const key = `BYOK_MCP_PAYLOAD_${randomBytes(16).toString("hex").toUpperCase()}`;
+    env[key] = JSON.stringify(server);
+    const helper = resolveSdkReservedHelperBin("mcp-env", helperHost);
+    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(helper.command)}`);
+    args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...helper.args])}`);
+    args.push("-c", `mcp_servers.${name}.env.BYOK_MCP_ENV_KEY=${JSON.stringify(key)}`);
+    args.push("-c", `mcp_servers.${name}.env_vars=${JSON.stringify([key])}`);
     const granted = grantedTools.get(name);
     if (granted !== void 0) args.push(...codexMcpToolApprovalArgs(name, granted));
   }
@@ -7079,7 +7360,7 @@ function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = fa
     ...modelId ? ["--model", modelId] : [],
     ...preparedGit ? [] : ["--skip-git-repo-check"],
     ...policyArgs,
-    instruction
+    "-"
   ];
 }
 async function runCodexTurn(params) {
@@ -7103,9 +7384,18 @@ async function runCodexTurn(params) {
     runner = new CodexProcessRunner({
       command: params.command,
       args: argv,
+      instruction: params.instruction,
       cwd: params.cwd,
       env: params.env,
       spawnFn: params.spawnFn,
+      onFailure: (failure) => {
+        if (!firstLineSettled) {
+          firstLineSettled = true;
+          rejectFirstLine(failure);
+        }
+        params.terminal.failure = failure;
+        params.queue.end();
+      },
       onEvent: (evt) => {
         if (!firstLineSettled) {
           firstLineSettled = true;
@@ -7172,6 +7462,16 @@ async function runCodexTurn(params) {
     params.queue.end();
   });
   let sessionRef;
+  const abortStartup = () => rejectFirstLine(new RuntimeExecutionFailure({
+    phase: params.failurePhase,
+    category: "infrastructure",
+    retry: "non-retryable",
+    reason: "codex startup cancelled or exceeded its deadline"
+  }));
+  const startupTimer = setTimeout(abortStartup, 3e4);
+  startupTimer.unref?.();
+  params.signal?.addEventListener("abort", abortStartup, { once: true });
+  if (params.signal?.aborted) abortStartup();
   try {
     sessionRef = await new Promise((resolve, reject) => {
       let settled = false;
@@ -7203,20 +7503,31 @@ async function runCodexTurn(params) {
       });
     });
   } catch (err) {
-    runner.kill();
+    await disposeFailedStartup(runner, err);
     throw err;
+  } finally {
+    clearTimeout(startupTimer);
+    params.signal?.removeEventListener("abort", abortStartup);
   }
   if (params.expectedSessionRef !== void 0 && sessionRef !== params.expectedSessionRef) {
-    runner.kill();
-    throw new RuntimeExecutionFailure({
+    const failure = new RuntimeExecutionFailure({
       phase: params.failurePhase,
       category: "authority",
       retry: "non-retryable",
       reason: `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef})`
     });
+    await disposeFailedStartup(runner, failure);
+    throw failure;
   }
   return { sessionRef, runner };
 }
+async function disposeFailedStartup(runner, cause) {
+  try {
+    await runner.dispose();
+  } catch (disposalFailure) {
+    throw new RuntimeStartupDisposalFailure(() => runner.dispose(), { cause: new AggregateError([cause, disposalFailure]) });
+  }
+}
 var CodexSession = class {
   /**
    * NOT `readonly` (cross-model review finding): `followUp()` below
@@ -7252,6 +7563,7 @@ var CodexSession = class {
    * recomputed from anything a later turn supplies, so a follow-up can never
    * widen this session's MCP authority.
    */
+  mcpEnvironment;
   mcpConfigArgs;
   terminal;
   currentRunner;
@@ -7271,6 +7583,7 @@ var CodexSession = class {
     this.modelId = options.modelId;
     this.terminal = options.terminal;
     this.mcpConfigArgs = options.mcpConfigArgs;
+    this.mcpEnvironment = Object.freeze({ ...options.mcpEnvironment });
     this.currentRunner = options.initialRunner;
     this.ownedRunners.add(options.initialRunner);
     void this.forgetRunnerOnceClosed(options.initialRunner);
@@ -7383,7 +7696,7 @@ var CodexSession = class {
         // frozen MCP config replayed verbatim — see `mcpConfigArgs`.
         policyArgs: [...mapping.args, ...this.mcpConfigArgs],
         cwd: this.workspaceDir,
-        env: withoutProviderCredentials(this.env),
+        env: { ...withoutProviderCredentials(this.env), ...this.mcpEnvironment },
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -7560,7 +7873,7 @@ function isNodeError(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
 }
 async function scavengeStaleWindowsBridges() {
-  const temporaryRoot = os4.tmpdir();
+  const temporaryRoot = os.tmpdir();
   let entries;
   try {
     entries = await fs14.readdir(temporaryRoot, { withFileTypes: true });
@@ -7779,7 +8092,7 @@ var DeviceCredentialStore = class {
   }
   async #windows(operation, encoded) {
     await scavengeStaleWindowsBridges();
-    const directory = await fs14.mkdtemp(path3.join(os4.tmpdir(), WINDOWS_BRIDGE_DIRECTORY_PREFIX));
+    const directory = await fs14.mkdtemp(path3.join(os.tmpdir(), WINDOWS_BRIDGE_DIRECTORY_PREFIX));
     const executable = path3.join(directory, "credential-bridge.exe");
     const request = [
       operation,
@@ -7966,7 +8279,7 @@ var DeviceStore = class _DeviceStore {
   /** Internal test seam. Product construction always supplies productId and gets an OS store. */
   credentials;
   static defaultDir(productId) {
-    return path3__default.join(os4__default.homedir(), ".byok", productId);
+    return path3__default.join(os__default.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -8015,6 +8328,20 @@ var DeviceStore = class _DeviceStore {
       await opened.handle.close();
     }
   }
+  /** Rebuild only the non-secret projection, while the caller owns the store lease. */
+  async reconcileMetadata(authority) {
+    const projection = {
+      deviceId: authority.deviceId,
+      tenantId: authority.tenantId,
+      devicePublicKey: authority.devicePublicKey
+    };
+    const current = await this.load();
+    if (current !== void 0 && current.deviceId === projection.deviceId && current.tenantId === projection.tenantId && current.devicePublicKey === projection.devicePublicKey) {
+      return false;
+    }
+    await this.save(projection);
+    return true;
+  }
   async save(record3) {
     assertDeviceMetadata(record3);
     const storeDir = path3__default.dirname(this.filePath);
@@ -8224,7 +8551,7 @@ var AuthManager = class {
             if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
           }
         }
-        const observedDeviceName = this.opts.deviceName ?? os4__default.hostname();
+        const observedDeviceName = this.opts.deviceName ?? os__default.hostname();
         const observedMachineId = await this.opts.machineId?.();
         let keyPair;
         let pairingDeviceName = observedDeviceName;
@@ -8433,15 +8760,7 @@ var AuthManager = class {
       if (await this.opts.store.load() === void 0) return void 0;
       throw new DeviceRecordRePairRequiredError();
     }
-    const projection = {
-      deviceId: authority.deviceId,
-      tenantId: authority.tenantId,
-      devicePublicKey: authority.devicePublicKey
-    };
-    const current = await this.opts.store.load();
-    if (current === void 0 || current.deviceId !== projection.deviceId || current.tenantId !== projection.tenantId || current.devicePublicKey !== projection.devicePublicKey) {
-      await this.opts.store.save(projection);
-    }
+    await this.opts.store.reconcileMetadata(authority);
     return Object.freeze({ ...authority });
   }
 };
@@ -8738,9 +9057,9 @@ async function probeDarwin(run) {
   return DARWIN_UUID_RE.exec(result.stdout)?.[1];
 }
 async function probeLinux(readFile3) {
-  for (const path38 of LINUX_MACHINE_ID_PATHS) {
+  for (const path43 of LINUX_MACHINE_ID_PATHS) {
     try {
-      const contents = (await readFile3(path38)).trim();
+      const contents = (await readFile3(path43)).trim();
       if (contents.length > 0) return contents;
     } catch {
     }
@@ -8772,7 +9091,7 @@ async function withTimeout2(probe, timeoutMs) {
 async function resolveMachineId(options) {
   const platform = options.platform ?? process.platform;
   const run = options.run ?? runDeviceCommand;
-  const readFile3 = options.readFile ?? ((path38) => fs14.readFile(path38, "utf8"));
+  const readFile3 = options.readFile ?? ((path43) => fs14.readFile(path43, "utf8"));
   let probe;
   if (platform === "darwin") probe = probeDarwin(run);
   else if (platform === "linux") probe = probeLinux(readFile3);
@@ -10410,13 +10729,35 @@ var LongPollClient = class {
   }
   async loop(signal) {
     let retryAttempt = 0;
+    let readCursor;
+    let readAheadSupported = false;
+    let warnedWindowAt;
     while (this.running && !signal.aborted) {
       try {
         await this.opts.auth.getValidAccessToken();
         const base = toHttpBase(this.opts.serverUrl);
         const url = new URL(BYOK_EVENTS_PATH, base);
         const cursor = this.opts.getCursor();
+        const ack = cursor ?? 0;
+        if (readCursor !== void 0 && readCursor - ack >= MAILBOX_READ_AHEAD_MAX_SEQS) {
+          if (warnedWindowAt !== ack) {
+            warnedWindowAt = ack;
+            console.warn("[byok/client] mailbox read-ahead window full; acknowledgement is stalled");
+          }
+          readCursor = ack;
+          await sleep(this.opts.retryDelayMs ?? 2e3, signal);
+          continue;
+        }
+        const afterSeq = Math.max(ack, readCursor ?? ack);
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
+        if (afterSeq > ack) {
+          if (!readAheadSupported) {
+            const error = new Error("server does not advertise mailbox-read-ahead; cannot read past unacknowledged work");
+            this.warnRouteFailure(this.eventsEndpoint, void 0, error);
+            throw error;
+          }
+          url.searchParams.set("afterSeq", String(afterSeq));
+        }
         let res;
         try {
           res = await authedFetch(url, { method: "GET", signal }, this.opts.auth);
@@ -10435,6 +10776,8 @@ var LongPollClient = class {
             return;
           }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
+          readCursor = void 0;
+          readAheadSupported = false;
           this.opts.onServerCapabilitiesInvalidated?.();
           this.opts.onPollFailure?.();
           this.opts.onOperationalOutcome?.("failure");
@@ -10444,12 +10787,16 @@ var LongPollClient = class {
         }
         let parsed;
         try {
-          parsed = parseLooseEventsPollResponse(await res.json(), cursor ?? 0);
-          validateTrustedEventsPage(parsed.events, cursor ?? 0, parsed.cursor);
+          parsed = parseLooseEventsPollResponse(await res.json(), afterSeq);
+          validateTrustedEventsPage(parsed.events, afterSeq, parsed.cursor);
+          if (afterSeq > ack && !parsed.capabilities.includes(MAILBOX_READ_AHEAD_CAPABILITY)) throw new Error("mailbox read-ahead capability was withdrawn");
         } catch (err) {
           this.warnRouteFailure(this.eventsEndpoint, res.status, err);
           throw err;
         }
+        readAheadSupported = parsed.capabilities.includes(MAILBOX_READ_AHEAD_CAPABILITY);
+        const madeReadProgress = parsed.cursor > afterSeq;
+        readCursor = parsed.cursor;
         this.opts.onServerCapabilities?.(parsed.capabilities);
         let hadValidationFailureThisBatch = false;
         let acceptedAnyEntry = false;
@@ -10473,10 +10820,11 @@ var LongPollClient = class {
           if (this.opts.onEnvelope(envelope) !== false) acceptedAnyEntry = true;
         }
         if (parsed.events.length === 0) {
+          readCursor = this.opts.getCursor() ?? 0;
           retryAttempt = 0;
           this.opts.onOperationalOutcome?.("success");
           await sleep(this.opts.idleDelayMs ?? 250, signal);
-        } else if (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor) {
+        } else if (!madeReadProgress && (this.opts.isStalled?.() || hadValidationFailureThisBatch || !acceptedAnyEntry && this.opts.getCursor() === cursor)) {
           this.opts.onOperationalOutcome?.("failure");
           const baseMs = this.opts.retryDelayMs ?? 2e3;
           await sleep(this.opts.retryDelayForAttempt?.(retryAttempt++, baseMs) ?? baseMs, signal);
@@ -10485,6 +10833,8 @@ var LongPollClient = class {
           this.opts.onOperationalOutcome?.("success");
         }
       } catch (err) {
+        readCursor = void 0;
+        readAheadSupported = false;
         this.opts.onServerCapabilitiesInvalidated?.();
         if (this.noteRevoked(err)) return;
         if (!this.running || signal.aborted) return;
@@ -10537,6 +10887,7 @@ function createConnectionHelloEnvelope(opts, getCursor) {
     productId: opts.productId,
     clientVersion: opts.clientVersion,
     runtimes: opts.runtimes,
+    harnesses: opts.harnesses,
     configuredToolsets: configuredToolsets === void 0 ? void 0 : [...configuredToolsets],
     cursor: getCursor()
   });
@@ -10550,8 +10901,8 @@ var ConnectionManager = class {
       serverUrl: opts.serverUrl,
       auth: opts.auth,
       // The long-poll query cursor is also the kernel's irreversible ack.
-      // Only report the successfully processed cursor here. `deliveredSeq`
-      // remains a local dedup watermark; using it on the wire would ack an
+      // Only report the successfully persisted cursor; using received work
+      // on the wire would ack an
       // in-flight envelope before its handler settles and make a later
       // failure impossible to redeliver.
       getCursor: () => this.cursor,
@@ -10600,25 +10951,11 @@ var ConnectionManager = class {
    * guarantees in docs/protocol.md §9.
    */
   stalledAtSeq;
-  /**
-   * Design A (Wave 2, F3-on-long-poll): the second, in-memory watermark
-   * alongside the durable `cursor`. `cursor` only ever advances AFTER a
-   * `task.*` handler's side effects resolve successfully, and is persisted
-   * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
-   * advances eagerly, the instant a `task.*` envelope is admitted past
-   * dedup (see `deliver`/`noteDelivered`), independent of whether its
-   * handler has even started, let alone succeeded. It exists so a repeated
-   * read at the durable cursor does not re-dispatch an envelope already in
-   * flight — `handleOffer` must not start a second adapter session while a
-   * first attempt is still running. On WS this same field is written the
-   * same way, but since a live WS connection only ever pushes a given `seq`
-   * once, it never has an observable effect there beyond mirroring
-   * `cursor` (see `dedupWatermark`'s doc comment for why redelivery
-   * correctness doesn't depend on resetting it anywhere).
-   */
-  deliveredSeq;
-  /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
+  /** Drain barrier for independently running handlers; not an admission lock. */
   processingChain = Promise.resolve();
+  cursorInitialization;
+  completionTail = Promise.resolve();
+  controlTails = /* @__PURE__ */ new Map();
   /**
    * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
    * never re-encoded/rebuilt strings, so a
@@ -10644,38 +10981,13 @@ var ConnectionManager = class {
   terminalError;
   settledWaiters = [];
   pendingCursorSave = Promise.resolve();
-  /**
-   * Finding P2 (Fix 2b): seqs currently admitted into `processingChain` but
-   * not yet settled — added in `deliver()` the moment a `task.*` envelope is
-   * accepted past the ordinary watermark check, removed in `process()`'s
-   * `finally` once that specific attempt resolves (success OR failure).
-   * While stalled, `dedupWatermark()` deliberately stays frozen below
-   * already-delivered seqs (see its own doc comment) so the failed seq's own
-   * redelivery can get through — but that same frozen watermark also means
-   * every OTHER seq above it rides along on every re-poll too. Without this,
-   * a seq already mid-flight (e.g. a `task.offer` whose prepared operation start()
-   * hasn't resolved yet) would be re-enqueued into `processingChain` on
-   * every such re-poll, piling up duplicate copies that — once the first
-   * finally resolves and the chain unwinds through them — run its handler
-   * again; for `task.offer` specifically, a second adapter session
-   * orphaning the first (`TaskRunner`'s own `this.tasks.has` guard, finding
-   * P2c, is the second, independent layer against exactly that).
-   */
+  /** Admission dedup while an individual handler is running. */
   inFlightSeqs = /* @__PURE__ */ new Set();
-  /**
-   * Finding P2 (Fix 2b): seqs whose handler has already resolved
-   * successfully at least once this session, tracked only while a stall is
-   * in effect — cleared the moment `stalledAtSeq` itself clears (see
-   * `process()`), since once unstalled the ordinary watermark check via
-   * `deliveredSeq` already covers everything delivered so far, making this
-   * redundant. Needed because the stall-gap-prevention rule in `process()`
-   * deliberately does NOT advance `cursor` past a seq above the
-   * still-unresolved `stalledAtSeq`, even once that seq's own handler
-   * succeeds — so `dedupWatermark()` alone can't distinguish "already
-   * succeeded, don't re-run" from "never yet attempted" for anything in
-   * that gap.
-   */
+  /** Successful side effects retained until their durable acknowledgement. */
   processedSeqs = /* @__PURE__ */ new Set();
+  failedEnvelopes = /* @__PURE__ */ new Map();
+  /** Received work lacking a successful handler receipt, including malformed frames. */
+  unresolvedSeqs = /* @__PURE__ */ new Set();
   /**
    * Finding P3: the pending `drainOutbox` long-poll retry backoff, if any —
    * cancellable so `enterRevoked()` can unblock it immediately instead of
@@ -10968,8 +11280,8 @@ var ConnectionManager = class {
    * - F3 (at-most-once): the old code persisted the cursor advance BEFORE
    *   `onEnvelope` even ran (fire-and-forget) — a handler that then failed
    *   left a redelivery-proof envelope permanently marked processed. Inbound
-   *   envelopes are now serialized through `processingChain` (one handler
-   *   fully settles before the next starts) and the cursor only advances
+   *   handlers may run independently; their receipt commits are serialized.
+   *   The cursor only advances
    *   AFTER the handler resolves successfully; a rejection leaves the
    *   cursor where it was (see `stalledAtSeq`), so a future reconnect's
    *   redelivery re-attempts it — safe because every server->daemon type is
@@ -10985,62 +11297,72 @@ var ConnectionManager = class {
     if (tracked && watermark !== void 0 && envelope.seq <= watermark) return false;
     if (tracked) {
       const seq = envelope.seq;
-      if (this.inFlightSeqs.has(seq) || this.processedSeqs.has(seq)) return false;
+      if (this.inFlightSeqs.has(seq)) return false;
+      if (!this.processedSeqs.has(seq)) this.unresolvedSeqs.add(seq);
       this.inFlightSeqs.add(seq);
-      this.noteDelivered(seq);
     }
-    this.processingChain = this.processingChain.then(() => this.process(envelope, tracked));
+    const controlKey = envelope.task_id !== void 0 && !envelope.type.startsWith("task.offer") ? envelope.task_id : void 0;
+    const prior = controlKey === void 0 ? Promise.resolve() : this.controlTails.get(controlKey) ?? Promise.resolve();
+    const operation = prior.then(() => this.process(envelope, tracked));
+    if (controlKey !== void 0) {
+      this.controlTails.set(controlKey, operation);
+      void operation.finally(() => {
+        if (this.controlTails.get(controlKey) === operation) this.controlTails.delete(controlKey);
+      });
+    }
+    this.processingChain = Promise.all([this.processingChain, operation]).then(() => void 0);
     return true;
   }
-  /**
-   * The local watermark `deliver()` dedupes inbound `task.*` envelopes
-   * against. It is deliberately NOT the long-poll query cursor: that query
-   * is the kernel acknowledgement and uses only the successfully processed
-   * `cursor` (see the constructor). Normally this local watermark is
-   * `deliveredSeq` — which is always >= `cursor` (every envelope that
-   * reaches `advanceCursor` already passed through `noteDelivered` first,
-   * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
-   * design calls for, just expressed via that invariant rather than an
-   * explicit `Math.max`.
-   *
-   * While `stalledAtSeq` is set, this collapses to the durable `cursor`
-   * alone, deliberately ignoring however far `deliveredSeq` had already run
-   * ahead before the failure was known: that's what lets the stalled
-   * envelope's own redelivery (and everything after it, right up to a
-   * fresh success) get past this same dedup check instead of being
-   * self-deduped by the client's own earlier eager tracking of envelopes
-   * whose outcome wasn't known yet. No separate "reset deliveredSeq on
-   * reconnect" step is needed for this to be correct — collapsing to
-   * `cursor` exactly while stalled already produces the right answer on
-   * every long-poll retry path. NOT resetting it unconditionally on every
-   * retry lets `deliveredSeq` keep doing its job of not re-dispatching
-   * something already in flight while a handler is still running.
-   */
-  dedupWatermark() {
-    return this.stalledAtSeq !== void 0 ? this.cursor : this.deliveredSeq ?? this.cursor;
+  /** A committed terminal can settle a failed offer receipt even if cloud
+   * cancellation has since filtered that offer from mailbox replay. */
+  retryTaskReceipts(taskId) {
+    for (const envelope of this.failedEnvelopes.values()) {
+      if (envelope.task_id === taskId) this.deliver(envelope);
+    }
   }
-  /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
-  noteDelivered(seq) {
-    if (this.deliveredSeq === void 0 || seq > this.deliveredSeq) this.deliveredSeq = seq;
+  /** Only a durable acknowledgement can deduplicate a whole prefix. */
+  dedupWatermark() {
+    return this.cursor;
   }
   async process(envelope, tracked) {
     const seq = tracked ? envelope.seq : void 0;
     try {
+      if (tracked && seq <= (this.cursor ?? 0)) return;
       if (tracked && this.cursor === void 0) {
-        await this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0);
-        this.cursor = 0;
+        this.cursorInitialization ??= this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0).then(() => {
+          this.cursor = 0;
+        }).catch((error) => {
+          this.cursorInitialization = void 0;
+          throw error;
+        });
+        await this.cursorInitialization;
       }
-      await this.opts.onEnvelope(envelope);
+      if (!tracked || !this.processedSeqs.has(seq)) await this.opts.onEnvelope(envelope);
       if (!tracked) return;
-      if (this.stalledAtSeq !== void 0 && envelope.seq !== this.stalledAtSeq) {
-        this.processedSeqs.add(seq);
-        return;
-      }
-      this.stalledAtSeq = void 0;
-      await this.advanceCursor(envelope.seq);
-      this.processedSeqs.clear();
+      this.failedEnvelopes.delete(seq);
+      this.processedSeqs.add(seq);
+      this.unresolvedSeqs.delete(seq);
+      const completion = this.completionTail.catch(() => void 0).then(async () => {
+        let firstUnresolved = Infinity;
+        for (const value of this.unresolvedSeqs) firstUnresolved = Math.min(firstUnresolved, value);
+        let prefix = this.cursor ?? 0;
+        for (const value of this.processedSeqs) if (value < firstUnresolved) prefix = Math.max(prefix, value);
+        if (prefix > (this.cursor ?? 0)) await this.advanceCursor(prefix);
+        for (const value of this.processedSeqs) {
+          if (value <= (this.cursor ?? 0)) {
+            this.processedSeqs.delete(value);
+            this.failedEnvelopes.delete(value);
+          }
+        }
+        this.stalledAtSeq = this.unresolvedSeqs.size > 0 ? firstUnresolved : void 0;
+      });
+      this.completionTail = completion;
+      await completion;
     } catch (err) {
-      if (tracked && this.stalledAtSeq === void 0) this.stalledAtSeq = envelope.seq;
+      if (tracked) {
+        this.failedEnvelopes.set(seq, envelope);
+        this.stalledAtSeq = Math.min(envelope.seq, this.stalledAtSeq ?? Infinity);
+      }
       console.error(
         `[byok/client] envelope handler failed for ${envelope.type}${typeof envelope.seq === "number" ? ` (seq=${envelope.seq})` : ""}; cursor left unadvanced so a reconnect redelivers it:`,
         err
@@ -11049,11 +11371,10 @@ var ConnectionManager = class {
       if (tracked) this.inFlightSeqs.delete(seq);
     }
   }
-  /** Serialized with handler completion, so invalid work cannot be acked by later success. */
+  /** Recorded synchronously at receive, before a later successful receipt can commit. */
   noteValidationFailure(seq) {
-    this.processingChain = this.processingChain.then(() => {
-      if (this.stalledAtSeq === void 0) this.stalledAtSeq = seq;
-    });
+    this.unresolvedSeqs.add(seq);
+    this.stalledAtSeq = Math.min(seq, this.stalledAtSeq ?? seq);
   }
   async advanceCursor(seq) {
     if (this.cursor !== void 0 && seq <= this.cursor) return;
@@ -11288,6 +11609,29 @@ var OperationalHealthTracker = class {
     }
   }
 };
+async function inspectOperationalHealthHandle(handle, expected) {
+  const read = await readOperationalHealthHandle(handle, expected);
+  if (read.status !== "read") return read;
+  const { raw, sizeBytes } = read;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "corrupt", sizeBytes, reason: "operational health state is corrupt JSON" };
+  }
+  if (!isHealthFile(parsed)) {
+    return { status: "corrupt", sizeBytes, reason: "operational health state has an invalid shape" };
+  }
+  return {
+    status: "valid",
+    sizeBytes,
+    state: parsed.state,
+    failureCount: parsed.failures.length,
+    crashCount: parsed.crashes.length,
+    ...parsed.currentRun ? { currentRunStartedAt: new Date(Date.parse(parsed.currentRun.startedAt)).toISOString() } : {},
+    ...parsed.crashes.at(-1) ? { lastCrashAt: new Date(Date.parse(parsed.crashes.at(-1).detectedAt)).toISOString() } : {}
+  };
+}
 async function readOperationalHealthHandle(handle, expected) {
   let before;
   try {
@@ -11321,6 +11665,20 @@ async function readOperationalHealthHandle(handle, expected) {
     return { status: "unavailable", sizeBytes, reason: "operational health state could not be read" };
   }
 }
+async function inspectOperationalHealthFile(storeDir) {
+  let opened;
+  try {
+    opened = await openOperationalHealthFile(storeDir);
+  } catch {
+    return { status: "unavailable", reason: "operational health state could not be opened safely" };
+  }
+  if (!opened) return { status: "missing" };
+  try {
+    return await inspectOperationalHealthHandle(opened.handle, opened.stat);
+  } finally {
+    await opened.handle.close();
+  }
+}
 function isHealthFile(value) {
   if (typeof value !== "object" || value === null) return false;
   const candidate = value;
@@ -11386,7 +11744,7 @@ var CursorStore = class {
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
     await promises.mkdir(path3__default.dirname(file), { recursive: true, mode: 448 });
-    await atomicWriteFile(file, JSON.stringify({ cursor }));
+    await atomicWriteFile(file, JSON.stringify({ cursor }), { fsync: true });
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
   async clear(serverUrl, deviceId) {
@@ -11879,9 +12237,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path38, busyTimeoutMs, faults) {
+function openJournalDatabase(path43, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path38, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path43, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -12025,9 +12383,9 @@ var RECEIVED_STATE = "received";
 function byteLength2(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path38) {
+function fileBytes(path43) {
   try {
-    return statSync(path38).size;
+    return statSync(path43).size;
   } catch {
     return 0;
   }
@@ -13370,6 +13728,109 @@ async function spillOversizedEvent(event, deps) {
   return bounded2.result;
 }
 
+// src/daemon/admission-wait.ts
+async function awaitAdmission(operation, signal) {
+  signal.throwIfAborted();
+  let onAbort;
+  const aborted = new Promise((_, reject) => {
+    onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return operation();
+    }), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+
+// src/daemon/runtime-start.ts
+async function startOwnedRuntime(start, input, signal, timeoutMs) {
+  const controller = new AbortController();
+  let session;
+  let failure;
+  let settled = false;
+  const retryDisposal = async () => {
+    if (session) {
+      let timer2;
+      try {
+        await Promise.race([
+          Promise.resolve().then(() => session.interrupt()).catch(() => void 0),
+          new Promise((resolve) => {
+            timer2 = setTimeout(resolve, 1e3);
+            timer2.unref?.();
+          })
+        ]);
+      } finally {
+        if (timer2) clearTimeout(timer2);
+      }
+      return session.close();
+    }
+    if (isRuntimeStartupDisposalFailure(failure)) return failure.retryDisposal();
+    if (settled && isRuntimeExecutionFailure(failure)) return;
+    throw new RuntimeDisposalFailure({ stage: "quiescence", reason: "runtime startup has not returned a cleanup receipt" });
+  };
+  let rejectAbort;
+  const aborted = new Promise((_, reject) => {
+    rejectAbort = reject;
+  });
+  const abort = () => {
+    controller.abort();
+    rejectAbort(new RuntimeStartupDisposalFailure(retryDisposal));
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  const timer = setTimeout(abort, timeoutMs);
+  timer.unref?.();
+  try {
+    if (signal.aborted) {
+      throw new RuntimeDisposalFailure({ stage: "quiescence", reason: "runtime startup was cancelled before invocation" });
+    }
+    const startup = Promise.resolve().then(() => start({ ...input, signal: controller.signal })).then((value) => {
+      session = value;
+      settled = true;
+      return value;
+    }, (error) => {
+      failure = error;
+      settled = true;
+      throw error;
+    });
+    return await Promise.race([startup, aborted]);
+  } finally {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", abort);
+  }
+}
+
+// src/daemon/artifact-read.ts
+var DEFAULT_ARTIFACT_LIMITS = Object.freeze({
+  maxFileBytes: 16 * 1024 * 1024,
+  maxTaskBytes: 64 * 1024 * 1024
+});
+async function readArtifactBytes(handle, maxBytes, signal, account) {
+  signal.throwIfAborted();
+  const stat = await handle.stat();
+  if (stat.size > maxBytes) throw new Error("artifact local byte budget exceeded");
+  const chunks = [];
+  let total = 0;
+  const stream = handle.createReadStream({ autoClose: false, start: 0, signal, highWaterMark: 64 * 1024 });
+  try {
+    for await (const data of stream) {
+      signal.throwIfAborted();
+      const chunk = data;
+      account(chunk.length);
+      total += chunk.length;
+      if (total > maxBytes) throw new Error("artifact local byte budget exceeded");
+      chunks.push(chunk);
+    }
+    signal.throwIfAborted();
+    return Buffer.concat(chunks, total);
+  } finally {
+    stream.destroy();
+  }
+}
+
 // src/daemon/environment.ts
 var BASE_PLATFORM_ALLOWLIST = [
   "PATH",
@@ -13569,45 +14030,121 @@ var ProgressBatcher = class {
     }
   }
 };
-var AGENT_MESSAGE_DIRECTORY = path3__default.join(".byok", "messages");
-var AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
-var AgentMessageOutboxError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AgentMessageOutboxError";
+var DurableJsonlFile = class {
+  constructor(filePath) {
+    this.filePath = filePath;
   }
-};
-function stableJson(value) {
-  const encoded = JSON.stringify(value);
-  if (encoded === void 0) throw new AgentMessageOutboxError("message outbox value is not serializable");
-  return encoded;
-}
-function hashBody(body) {
-  return `sha256:${createHash("sha256").update(body, "utf8").digest("hex")}`;
-}
-function sameAgentRef(left, right) {
-  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
-}
-function exactDisposition(record3, value) {
-  return value.messageId === record3.messageId && value.cursor === record3.cursor && value.contract === record3.contract && value.contentHash === record3.contentHash && value.sessionRef === record3.sessionRef && sameAgentRef(value.agentRef, record3.agentRef);
-}
-var AgentMessageOutbox = class _AgentMessageOutbox {
-  constructor(homeDir, outboxPath) {
-    this.homeDir = homeDir;
-    this.outboxPath = outboxPath;
+  filePath;
+  failure;
+  assertWritable() {
+    if (this.failure !== void 0) {
+      throw new Error("durable JSONL writer is quarantined after uncertain I/O; reopen and validate the log before retrying", { cause: this.failure });
+    }
   }
-  homeDir;
-  outboxPath;
-  pendingByTask = /* @__PURE__ */ new Map();
-  dispositionByTask = /* @__PURE__ */ new Map();
-  nextCursor = 1;
-  logEntries = 0;
-  writeTail = Promise.resolve();
-  static async open(homeDir) {
+  /** Replay is not a durability receipt: confirm the recovered bytes before use. */
+  async confirmRecovered() {
+    let handle;
+    try {
+      handle = await promises.open(this.filePath, "r+");
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await this.syncDirectory();
+  }
+  async append(json) {
+    this.assertWritable();
+    try {
+      const handle = await promises.open(this.filePath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
+      try {
+        const bytes = Buffer.from(`${json}
+`, "utf8");
+        let offset = 0;
+        while (offset < bytes.length) {
+          const { bytesWritten } = await handle.write(bytes, offset, bytes.length - offset);
+          if (bytesWritten <= 0) throw new Error("durable JSONL append made no progress");
+          offset += bytesWritten;
+        }
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await this.syncDirectory();
+    } catch (error) {
+      this.failure = error;
+      throw error;
+    }
+  }
+  async replace(lines) {
+    this.assertWritable();
+    try {
+      await atomicWriteFile(this.filePath, lines.map((line) => `${line}
+`).join(""), { mode: 384, fsync: true });
+    } catch (error) {
+      this.failure = error;
+      throw error;
+    }
+  }
+  async syncDirectory() {
+    if (process.platform === "win32") return;
+    const directory = await promises.open(path3__default.dirname(this.filePath), "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  }
+};
+
+// src/daemon/agent-message-outbox.ts
+var AGENT_MESSAGE_DIRECTORY = path3__default.join(".byok", "messages");
+var AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
+var AgentMessageOutboxError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentMessageOutboxError";
+  }
+};
+function stableJson(value) {
+  const encoded = JSON.stringify(value);
+  if (encoded === void 0) throw new AgentMessageOutboxError("message outbox value is not serializable");
+  return encoded;
+}
+function hashBody(body) {
+  return `sha256:${createHash("sha256").update(body, "utf8").digest("hex")}`;
+}
+function sameAgentRef(left, right) {
+  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
+}
+function exactDisposition(record3, value) {
+  return value.messageId === record3.messageId && value.cursor === record3.cursor && value.contract === record3.contract && value.contentHash === record3.contentHash && value.sessionRef === record3.sessionRef && sameAgentRef(value.agentRef, record3.agentRef);
+}
+var AgentMessageOutbox = class _AgentMessageOutbox {
+  constructor(homeDir, outboxPath) {
+    this.homeDir = homeDir;
+    this.outboxPath = outboxPath;
+    this.file = new DurableJsonlFile(outboxPath);
+  }
+  homeDir;
+  outboxPath;
+  pendingByTask = /* @__PURE__ */ new Map();
+  revokedTasks = /* @__PURE__ */ new Set();
+  dispositionByTask = /* @__PURE__ */ new Map();
+  file;
+  nextCursor = 1;
+  logEntries = 0;
+  writeTail = Promise.resolve();
+  static async open(homeDir) {
     const directory = path3__default.join(homeDir, AGENT_MESSAGE_DIRECTORY);
     await ensureSecureDir(directory);
     const outbox = new _AgentMessageOutbox(homeDir, path3__default.join(directory, AGENT_MESSAGE_OUTBOX_FILENAME));
     await outbox.load();
+    await outbox.file.confirmRecovered();
     return outbox;
   }
   /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
@@ -13648,9 +14185,9 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
   records() {
     return Object.freeze([...this.pendingByTask.values()].sort((a, b) => a.cursor - b.cursor));
   }
-  /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+  /** Records without disposition or local revoke; transport replay additionally requires session binding. */
   retryableRecords() {
-    return Object.freeze(this.records().filter((record3) => !this.dispositionByTask.has(record3.taskId)));
+    return Object.freeze(this.records().filter((record3) => !this.dispositionByTask.has(record3.taskId) && !this.revokedTasks.has(record3.taskId)));
   }
   get(taskId) {
     return this.pendingByTask.get(taskId);
@@ -13662,13 +14199,14 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       if (byteCount < 1 || byteCount > input.requirement.maxBytes) throw new AgentMessageOutboxError("message body exceeds the offer byte contract");
       const existing = this.pendingByTask.get(input.taskId);
       if (existing !== void 0) {
-        if (existing.tenantId !== input.tenantId || existing.contentType !== input.contentType || existing.body !== input.body || existing.contract !== input.requirement.contract || !sameAgentRef(existing.agentRef, input.agentRef)) {
+        if (existing.tenantId !== input.tenantId || existing.contentType !== input.contentType || existing.body !== input.body || existing.contract !== input.requirement.contract || input.sessionRef !== void 0 && existing.sessionRef !== input.sessionRef || !sameAgentRef(existing.agentRef, input.agentRef)) {
           throw new AgentMessageOutboxError("required-message task already has a different immutable draft");
         }
         return existing;
       }
-      if (this.pendingByTask.size >= input.maxPendingEvents) throw new AgentMessageOutboxError("message outbox event quota is exhausted");
-      const pendingBytes = this.records().reduce((sum, record4) => sum + record4.byteCount, 0);
+      const sending = this.records().filter((record4) => !this.isTerminalEvidence(record4.taskId));
+      if (sending.length >= input.maxPendingEvents) throw new AgentMessageOutboxError("message outbox event quota is exhausted");
+      const pendingBytes = sending.reduce((sum, record4) => sum + record4.byteCount, 0);
       if (pendingBytes + byteCount > input.maxPendingBytes) throw new AgentMessageOutboxError("message outbox byte quota is exhausted");
       const record3 = Object.freeze({
         schema: 1,
@@ -13690,8 +14228,9 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       return record3;
     });
   }
-  async activate(taskId, sessionRef) {
+  async activate(taskId, sessionRef, isCurrent = () => true) {
     return this.exclusive(async () => {
+      if (!isCurrent() || this.revokedTasks.has(taskId)) return void 0;
       const record3 = this.pendingByTask.get(taskId);
       if (record3 === void 0) return void 0;
       if (record3.sessionRef !== void 0) {
@@ -13704,6 +14243,22 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       return activated;
     });
   }
+  /** Local lifecycle cancellation, never a synthesized consumer disposition. */
+  async revoke(taskId) {
+    return this.exclusive(async () => {
+      const record3 = this.pendingByTask.get(taskId);
+      if (record3 === void 0 || this.revokedTasks.has(taskId)) return;
+      await this.appendEntry({ schema: 1, kind: "revoke", taskId, messageId: record3.messageId });
+      this.revokedTasks.add(taskId);
+    });
+  }
+  /** The same terminal classification used by operator receipts and archival. */
+  terminalRecords() {
+    return Object.freeze(this.records().filter((record3) => this.isTerminalEvidence(record3.taskId)));
+  }
+  isTerminalEvidence(taskId) {
+    return this.revokedTasks.has(taskId) || this.dispositionByTask.get(taskId)?.outcome === "refused";
+  }
   publishPayload(record3) {
     if (record3.sessionRef === void 0) throw new AgentMessageOutboxError("message draft is not bound to a durable session");
     return AgentMessagePublishPayloadSchema.parse({
@@ -13727,6 +14282,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       await this.appendEntry({ schema: 1, kind: "disposition", taskId, disposition });
       if (disposition.outcome === "accepted") {
         this.pendingByTask.delete(taskId);
+        this.revokedTasks.delete(taskId);
         this.dispositionByTask.delete(taskId);
       } else {
         this.dispositionByTask.set(taskId, disposition);
@@ -13745,6 +14301,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       if (error.code === "ENOENT") return;
       throw error;
     }
+    if (raw.length > 0 && !raw.endsWith("\n")) throw new AgentMessageOutboxError("durable JSONL log has an incomplete trailing frame; preserve the file for explicit repair");
     for (const line of raw.split("\n")) {
       if (line.length === 0) continue;
       const entry = JSON.parse(line);
@@ -13759,11 +14316,16 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
         if (record3 === void 0 || record3.messageId !== entry.messageId) throw new AgentMessageOutboxError("message activation has no exact draft");
         if (record3.sessionRef !== void 0 && record3.sessionRef !== entry.sessionRef) throw new AgentMessageOutboxError("message activation session conflicts");
         this.pendingByTask.set(entry.taskId, Object.freeze({ ...record3, sessionRef: entry.sessionRef }));
+      } else if (entry.kind === "revoke") {
+        const record3 = this.pendingByTask.get(entry.taskId);
+        if (record3 === void 0 || record3.messageId !== entry.messageId) throw new AgentMessageOutboxError("message revocation has no exact draft");
+        this.revokedTasks.add(entry.taskId);
       } else if (entry.kind === "disposition") {
         const record3 = this.pendingByTask.get(entry.taskId);
         if (record3 === void 0 || !exactDisposition(record3, entry.disposition)) throw new AgentMessageOutboxError("message outbox contains a mismatched disposition");
         if (entry.disposition.outcome === "accepted") {
           this.pendingByTask.delete(entry.taskId);
+          this.revokedTasks.delete(entry.taskId);
           this.dispositionByTask.delete(entry.taskId);
         } else {
           this.dispositionByTask.set(entry.taskId, entry.disposition);
@@ -13774,23 +14336,47 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
     }
   }
   async appendEntry(entry) {
-    const handle = await promises.open(this.outboxPath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
-    try {
-      await handle.write(`${stableJson(entry)}
-`, void 0, "utf8");
-      await handle.sync();
-      this.logEntries += 1;
-    } finally {
-      await handle.close();
-    }
+    await this.file.append(stableJson(entry));
+    this.logEntries += 1;
   }
-  async compact() {
-    const entries = this.records().flatMap((record3) => {
+  /**
+   * Explicit operator maintenance under the Agent-home single-writer lease.
+   * Copy complete terminal evidence durably before removing it from the live log.
+   * Archives are audit artifacts, never another replay input. held remains live.
+   */
+  async archiveTerminalRecords(archiveDirectory) {
+    return this.exclusive(async () => {
+      if (!path3__default.isAbsolute(archiveDirectory)) throw new AgentMessageOutboxError("message archive directory must be absolute");
+      const terminal = this.terminalRecords();
+      if (terminal.length === 0) return void 0;
+      await ensureSecureDir(archiveDirectory);
+      const archivePath = path3__default.join(archiveDirectory, `message-terminal-${randomUUID()}.jsonl`);
+      await atomicWriteFile(archivePath, this.snapshotEntries(terminal).map((entry) => `${stableJson(entry)}
+`).join(""), { mode: 384, fsync: true });
+      const retained = this.records().filter((record3) => !this.isTerminalEvidence(record3.taskId));
+      const entries = this.snapshotEntries(retained);
+      await this.file.replace(entries.map((entry) => stableJson(entry)));
+      for (const record3 of terminal) {
+        this.pendingByTask.delete(record3.taskId);
+        this.dispositionByTask.delete(record3.taskId);
+        this.revokedTasks.delete(record3.taskId);
+      }
+      this.logEntries = entries.length;
+      return archivePath;
+    });
+  }
+  snapshotEntries(records) {
+    return records.flatMap((record3) => {
       const append = { schema: 1, kind: "append", record: record3 };
       const disposition = this.dispositionByTask.get(record3.taskId);
-      return disposition === void 0 ? [append] : [append, { schema: 1, kind: "disposition", taskId: record3.taskId, disposition }];
+      const entries = disposition === void 0 ? [append] : [append, { schema: 1, kind: "disposition", taskId: record3.taskId, disposition }];
+      if (this.revokedTasks.has(record3.taskId)) entries.push({ schema: 1, kind: "revoke", taskId: record3.taskId, messageId: record3.messageId });
+      return entries;
     });
-    await atomicWriteFile(this.outboxPath, entries.map(stableJson).join(entries.length === 0 ? "" : "\n"), { mode: 384 });
+  }
+  async compact() {
+    const entries = this.snapshotEntries(this.records());
+    await this.file.replace(entries.map((entry) => stableJson(entry)));
     this.logEntries = entries.length;
   }
   async exclusive(fn) {
@@ -13801,6 +14387,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
     });
     await prior;
     try {
+      this.file.assertWritable();
       return await fn();
     } finally {
       release();
@@ -14981,7 +15568,7 @@ var TaskRunner = class {
    */
   stoppingOffers = false;
   get activeTaskCount() {
-    return this.tasks.size;
+    return this.tasks.size + this.startupOwners.size;
   }
   /**
    * Transport-boundary classification for the currently active task. Legacy
@@ -15027,6 +15614,12 @@ var TaskRunner = class {
     const active = this.tasks.get(taskId);
     const context = pending ?? (active?.messageRequirement && active.agentRef && active.messageOutbox ? { agentRef: active.agentRef, requirement: active.messageRequirement, outbox: active.messageOutbox } : void 0);
     if (context === void 0) throw new Error("task has no active required Agent message contract");
+    const isCurrent = () => {
+      if (this.messageContextByToken.get(input.contextToken) !== taskId || this.messageContextByTask.get(taskId) !== input.contextToken || this.pendingCancelled.has(taskId)) return false;
+      const current2 = this.tasks.get(taskId);
+      return current2 === void 0 ? active === void 0 && this.pendingMessageTasks.get(taskId) === pending : (active === void 0 || current2 === active) && current2.messageOutbox === context.outbox && this.canPublishAgentMessage(current2);
+    };
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
     const record3 = await context.outbox.appendDraft({
       taskId,
       tenantId: this.deps.tenantId,
@@ -15037,8 +15630,17 @@ var TaskRunner = class {
       maxPendingEvents: 64,
       maxPendingBytes: 4 * 1024 * 1024
     });
-    if (active === void 0) return { messageId: record3.messageId, state: "staged" };
-    const activated = await context.outbox.activate(taskId, active.session.sessionRef);
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
+    const current = this.tasks.get(taskId);
+    if (current === void 0) return { messageId: record3.messageId, state: "staged" };
+    const activated = await this.activateAgentMessage(
+      context.outbox,
+      taskId,
+      current.session.sessionRef,
+      isCurrent,
+      () => current.messageSendAttempted === true
+    );
+    if (!isCurrent()) throw new Error("invalid or expired Agent message task context");
     if (activated === void 0) throw new Error("Agent message draft disappeared before activation");
     this.sendAgentMessageRecord(context.outbox, activated);
     return { messageId: activated.messageId, state: "pending" };
@@ -15074,19 +15676,39 @@ var TaskRunner = class {
     });
     return opened;
   }
+  /** A recovery terminal must not close first-message admission before this durable draft has a disposition. */
+  hasPendingRecoveredAgentMessage(taskId) {
+    return this.recoveredMessageOutboxes.get(taskId)?.retryableRecords().some((record3) => record3.taskId === taskId && record3.sessionRef !== void 0) === true;
+  }
   /** Retry stable recovered records after a transport handshake/re-handshake. */
   retryRecoveredAgentMessages() {
     for (const [taskId, outbox] of this.recoveredMessageOutboxes) {
       const record3 = outbox.get(taskId);
-      if (record3?.sessionRef !== void 0) this.sendAgentMessageRecord(outbox, record3);
+      if (record3?.sessionRef !== void 0 && this.hasPendingRecoveredAgentMessage(taskId)) this.sendAgentMessageRecord(outbox, record3);
     }
   }
+  canPublishAgentMessage(active) {
+    return this.tasks.get(active.taskId) === active && !active.beingTornDown;
+  }
+  /** All authors and startup use the same queue-time and post-I/O authority check. */
+  async activateAgentMessage(outbox, taskId, sessionRef, isCurrent, wasSendAttempted = () => false) {
+    if (!isCurrent()) return void 0;
+    const record3 = await outbox.activate(taskId, sessionRef, isCurrent);
+    if (!isCurrent()) {
+      if (!wasSendAttempted()) await outbox.revoke(taskId);
+      return void 0;
+    }
+    return record3;
+  }
   sendAgentMessageRecord(outbox, record3) {
+    const active = this.tasks.get(record3.taskId);
+    const authorized = active === void 0 ? this.recoveredMessageOutboxes.get(record3.taskId) === outbox : active.messageOutbox === outbox && this.canPublishAgentMessage(active);
+    if (!authorized || record3.sessionRef === void 0 || !outbox.retryableRecords().some((pending) => pending.messageId === record3.messageId)) return;
+    if (active !== void 0) active.messageSendAttempted = true;
     this.deps.send(createEnvelope("agent.message.publish", outbox.publishPayload(record3), {
       taskId: record3.taskId,
       sessionRef: record3.sessionRef
     }));
-    const active = this.tasks.get(record3.taskId);
     if (active?.messageOutbox === outbox) {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = setTimeout(() => {
@@ -15126,6 +15748,7 @@ var TaskRunner = class {
       if (outcome === "accepted") this.recoveredMessageOutboxes.delete(taskId);
       return;
     }
+    if (this.tasks.get(taskId) !== active) return;
     if (outcome === "held") {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = void 0;
@@ -15135,6 +15758,8 @@ var TaskRunner = class {
       if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
       active.messageRetryTimer = void 0;
       this.revokeAgentMessageContext(taskId);
+      active.pendingMessageCompletion = void 0;
+      await this.fail(taskId, "required Agent message was refused", false);
       return;
     }
     if (outcome !== "accepted") return;
@@ -15153,6 +15778,9 @@ var TaskRunner = class {
   /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
   stopAcceptingOffers() {
     this.stoppingOffers = true;
+    if (this.startupRetryTimer) clearTimeout(this.startupRetryTimer);
+    this.startupRetryTimer = void 0;
+    for (const abort of this.inFlightBlobAborts.values()) abort.abort();
   }
   /**
    * Shutdown of every currently ACTIVE task for the control socket's
@@ -15191,9 +15819,65 @@ var TaskRunner = class {
    * ahead of this method — see `daemon-control-socket.test.ts`'s dedicated
    * regression test for the exact scenario.
    */
+  /** Startup resources have an owner even before a Session can become active. */
+  startupRetryTimer;
+  claimedHarnesses = /* @__PURE__ */ new Map();
+  homeReservations = /* @__PURE__ */ new Map();
+  startupOwners = /* @__PURE__ */ new Map();
+  startupDisposals = /* @__PURE__ */ new Map();
+  disposeStartupOwner(taskId) {
+    const existing = this.startupDisposals.get(taskId);
+    if (existing) return existing;
+    const attempt = this.disposeStartupOwnerOnce(taskId).finally(() => this.startupDisposals.delete(taskId));
+    this.startupDisposals.set(taskId, attempt);
+    return attempt;
+  }
+  async disposeStartupOwnerOnce(taskId) {
+    const owner = this.startupOwners.get(taskId);
+    if (!owner) return true;
+    try {
+      await owner.settle?.();
+      await owner.dispose();
+      await this.deps.awaitTerminalCommit?.(taskId);
+      await owner.release();
+    } catch (caught) {
+      const failure = isRuntimeDisposalFailure(caught) ? caught : new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: "startup runtime disposal has not been confirmed"
+      }, { cause: caught });
+      this.deps.onRuntimeDisposalFailure?.({
+        taskId,
+        runtimeId: owner.runtimeId,
+        stage: failure.stage,
+        reason: failure.message
+      });
+      console.error(`[byok/client] startup ownership retained for ${taskId}: ${failure.message}`);
+      if (!this.startupRetryTimer && !this.stoppingOffers) {
+        this.startupRetryTimer = setTimeout(() => {
+          this.startupRetryTimer = void 0;
+          for (const id of this.startupOwners.keys()) {
+            if (!this.inFlightOffers.has(id)) void this.disposeStartupOwner(id);
+          }
+        }, 1e3);
+        this.startupRetryTimer.unref?.();
+      }
+      return false;
+    }
+    if (this.startupOwners.get(taskId) === owner) this.startupOwners.delete(taskId);
+    this.pendingMessageTasks.delete(taskId);
+    this.revokeAgentMessageContext(taskId);
+    this.revokeAgentMemoryContext(taskId);
+    return true;
+  }
   async shutdownActiveTasks(reason) {
     const active = [...this.tasks.values()];
     await Promise.all(active.map((task) => this.shutdownTask(task, reason)));
+    for (const taskId of this.startupOwners.keys()) {
+      if (!await this.disposeStartupOwner(taskId)) throw new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: "startup runtime ownership remains quarantined"
+      });
+    }
   }
   /**
    * M5 batch-3 (workstream 2): the ONE shared per-task teardown sequence —
@@ -15225,14 +15909,19 @@ var TaskRunner = class {
    * a genuine protocol bug, not a benign race — mirrors `pump()`'s own
    * identity-check guard for the same class of race.
    */
+  async interruptBounded(session) {
+    await raceSettleFirst(
+      () => session.interrupt(),
+      this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS
+    );
+  }
   async teardownActiveTask(active, reason, retryable) {
     if (active.finalizationStarted) return this.finish(active.taskId);
     if (!this.reserveSemanticTerminal(active)) return active.semanticTerminalSettled ?? false;
     active.beingTornDown = true;
     active.blobAbort.abort();
     await this.observeGit(active, "salvage");
-    const timeoutMs = this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS;
-    await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
+    await this.interruptBounded(active.session);
     if (this.tasks.get(active.taskId) !== active) return true;
     await this.persistAgentTerminalEvidence(active, "failed", reason);
     this.deps.send(
@@ -15334,7 +16023,7 @@ var TaskRunner = class {
     }
   }
   async handleOffer(taskId, payload, strictAgentOffer) {
-    if (this.tasks.has(taskId) || this.finishedTaskIds.has(taskId) || this.strictDeclinedTaskIds.has(taskId)) {
+    if (this.tasks.has(taskId) || this.startupOwners.has(taskId) || this.inFlightOffers.has(taskId) || this.finishedTaskIds.has(taskId) || this.strictDeclinedTaskIds.has(taskId)) {
       return;
     }
     let agentRef;
@@ -15377,9 +16066,29 @@ var TaskRunner = class {
     }
     this.inFlightOffers.add(taskId);
     const blobAbort = new AbortController();
+    const startupDeadline = Date.now() + (this.deps.startupTimeoutMs ?? 3e4);
+    const startupTimer = setTimeout(
+      () => blobAbort.abort(new Error("runtime startup deadline exceeded during admission/start")),
+      this.deps.startupTimeoutMs ?? 3e4
+    );
+    startupTimer.unref?.();
+    const admissionWithdrawn = () => {
+      if (!blobAbort.signal.aborted) return false;
+      const cancelled = this.pendingCancelled.has(taskId);
+      decline(cancelled ? "cancelled before claim" : this.stoppingOffers ? "daemon is shutting down" : "runtime startup deadline exceeded", !cancelled);
+      return true;
+    };
     this.inFlightBlobAborts.set(taskId, blobAbort);
     let agentBinding;
     let agentLeaseTransferred = false;
+    let reservedHome;
+    const releaseReservation = () => {
+      if (reservedHome === void 0) return;
+      const remaining = this.homeReservations.get(reservedHome) - 1;
+      if (remaining === 0) this.homeReservations.delete(reservedHome);
+      else this.homeReservations.set(reservedHome, remaining);
+      reservedHome = void 0;
+    };
     try {
       if (this.pendingCancelled.has(taskId)) {
         const reason = this.pendingCancelled.get(taskId);
@@ -15404,11 +16113,14 @@ var TaskRunner = class {
           );
           return;
         }
-        const active2 = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome);
-        if (active2 >= limit) {
-          decline(`agent home busy: ${active2} active attempt(s)`, true);
+        if (admissionWithdrawn()) return;
+        const active = this.deps.agentHome.executionLeaseManager.activeAttemptCount(canonicalHome) + (this.homeReservations.get(canonicalHome) ?? 0);
+        if (active >= limit) {
+          decline(`agent home busy: ${active} active attempt(s)`, true);
           return;
         }
+        this.homeReservations.set(canonicalHome, (this.homeReservations.get(canonicalHome) ?? 0) + 1);
+        reservedHome = canonicalHome;
       }
       const guarded = this.deps.admissionGuard?.({ taskId, payload });
       if (guarded !== void 0 && !guarded.admit) {
@@ -15440,6 +16152,14 @@ var TaskRunner = class {
         );
         return;
       }
+      if (payload.harnessId !== void 0 && (payload.runtime !== void 0 || payload.dispatchSelection !== void 0)) {
+        decline("harnessId cannot be combined with a built-in runtime selection", false);
+        return;
+      }
+      if (payload.harnessId !== void 0 && !(this.deps.getServerCapabilities?.() ?? []).includes("custom-harness")) {
+        decline("server does not support custom-harness identity", false);
+        return;
+      }
       const requiredToolsets = "requiredToolsets" in payload ? payload.requiredToolsets : void 0;
       const resolvedMcp = requiredToolsets ? this.resolveMcpServers(requiredToolsets) : void 0;
       if (resolvedMcp && !resolvedMcp.ok) {
@@ -15452,17 +16172,29 @@ var TaskRunner = class {
         return;
       }
       const offered = withoutRequiredToolsets(payload);
-      const requestedRuntime = payload.dispatchSelection?.runtimeId ?? payload.runtime;
+      const requestedRuntime = payload.harnessId ?? payload.dispatchSelection?.runtimeId ?? payload.runtime;
       const requiresAgentMemoryMcp = agentRef !== void 0 && this.deps.agentMemoryMcpBin !== void 0 && isAgentMemorySecureFilesystemAvailable(this.deps.agentMemoryFilesystemHelperBin !== void 0);
-      const pick = await this.pickAdapter(
-        requestedRuntime,
-        payload.policy.mode,
-        requiredToolsets !== void 0 || messageRequirement !== void 0 || requiresAgentMemoryMcp
-      );
+      let pick;
+      try {
+        pick = await this.pickAdapter(
+          requestedRuntime,
+          payload.policy.mode,
+          requiredToolsets !== void 0 || messageRequirement !== void 0 || requiresAgentMemoryMcp,
+          blobAbort.signal
+        );
+      } catch (error) {
+        if (!admissionWithdrawn()) decline(`runtime detection failed: ${errorMessage6(error)}`, true);
+        return;
+      }
+      if (admissionWithdrawn()) return;
       if (!pick.ok) {
         decline(pick.reason, pick.retryable);
         return;
       }
+      if (!isKnownRuntimeId(pick.descriptor.id) && !(this.deps.getServerCapabilities?.() ?? []).includes("custom-harness")) {
+        decline("server does not support the selected custom harness identity", false);
+        return;
+      }
       const env = buildRuntimeEnv({
         ambient: process.env,
         requirements: pick.descriptor.environmentRequirements,
@@ -15536,18 +16268,20 @@ var TaskRunner = class {
       }
       let prepared;
       try {
-        prepared = await pick.adapter.prepare({
+        prepared = await awaitAdmission(() => pick.adapter.prepare({
+          signal: blobAbort.signal,
           offer: offered,
           policy: decision.policy,
           descriptor: pick.descriptor,
           requiredToolsetIds: requiredToolsets ?? [],
           ...taskMcpServers === void 0 ? {} : { mcpServers: taskMcpServers },
           ...mcpToolsetTools === void 0 ? {} : { mcpToolsetTools }
-        });
+        }), blobAbort.signal);
       } catch (error) {
-        decline(`runtime preparation failed: ${errorMessage6(error)}`, true);
+        if (!admissionWithdrawn()) decline(`runtime preparation failed: ${errorMessage6(error)}`, true);
         return;
       }
+      if (admissionWithdrawn()) return;
       if (prepared.kind === "reject") {
         decline(prepared.reason, prepared.retryable);
         return;
@@ -15555,6 +16289,7 @@ var TaskRunner = class {
       if (agentRef !== void 0) {
         try {
           agentBinding = await this.deps.agentHome.acquireExecution(agentRef, { taskId, sessionRef });
+          releaseReservation();
         } catch (error) {
           decline(
             `Agent home admission failed: ${errorMessage6(error)}`,
@@ -15679,7 +16414,16 @@ var TaskRunner = class {
         },
         forwardedEnvironmentNames: Object.freeze(Object.keys(env).sort())
       });
+      if (admissionWithdrawn()) {
+        gitLease?.release();
+        return;
+      }
       await this.deps.beforeClaim?.(taskId, manifest.descriptor.id);
+      if (admissionWithdrawn()) {
+        gitLease?.release();
+        return;
+      }
+      if (!isKnownRuntimeId(manifest.descriptor.id)) this.claimedHarnesses.set(taskId, manifest.descriptor.id);
       this.deps.send(
         createEnvelope(
           "task.claim",
@@ -15697,6 +16441,7 @@ var TaskRunner = class {
             // where an auto-selected task left the server never learning
             // which runtime actually ran.
             runtime: isKnownRuntimeId(manifest.descriptor.id) ? manifest.descriptor.id : void 0,
+            ...!isKnownRuntimeId(manifest.descriptor.id) ? { harnessId: manifest.descriptor.id } : {},
             // S0/D-4 (`task.claim.capabilities`, docs/protocol.md §2.4): the
             // selected adapter's own capability self-report, carried on the
             // same message that establishes the task↔runtime binding. The
@@ -15814,8 +16559,57 @@ var TaskRunner = class {
       };
       let session;
       try {
-        session = await prepared.operation.start(startInput);
+        session = await startOwnedRuntime(
+          (input) => prepared.operation.start(input),
+          startInput,
+          blobAbort.signal,
+          Math.max(0, startupDeadline - Date.now())
+        );
       } catch (err) {
+        const disposalFailure = isRuntimeStartupDisposalFailure(err);
+        const cancelled = this.pendingCancelled.has(taskId);
+        if (disposalFailure || cancelled) {
+          if (cancelled) this.revokeAgentMessageContext(taskId);
+          const ownedBinding2 = agentBinding;
+          const cancellation = createEnvelope("task.cancelled", {
+            reason: this.pendingCancelled.get(taskId),
+            ...terminalIdentity(this.claimedHarnesses.get(taskId)),
+            ...agentBinding === void 0 ? {} : { agentRef: agentBinding.resolution.agentRef }
+          }, { taskId });
+          let cancellationSettled = false;
+          this.startupOwners.set(taskId, {
+            runtimeId: pick.descriptor.id,
+            dispose: disposalFailure ? err.retryDisposal : async () => {
+            },
+            ...cancelled ? { settle: async () => {
+              if (cancellationSettled) return;
+              await this.pendingMessageTasks.get(taskId)?.outbox.revoke(taskId);
+              this.deps.send(cancellation);
+              cancellationSettled = true;
+              this.pendingCancelled.delete(taskId);
+              this.addFinishedTaskId(taskId);
+            } } : {},
+            release: async () => {
+              await ownedBinding2?.lease.release();
+              gitLease?.release();
+            }
+          });
+          agentLeaseTransferred = true;
+          if (disposalFailure) this.deps.onRuntimeDisposalFailure?.({
+            taskId,
+            runtimeId: pick.descriptor.id,
+            stage: "quiescence",
+            reason: err.message
+          });
+          if (!cancelled) {
+            if (agentBinding === void 0) await this.fail(taskId, errorMessage6(err), false);
+            else await this.failClaimedAgent(taskId, errorMessage6(err), false, {
+              binding: agentBinding,
+              runtimeId: pick.descriptor.id
+            });
+          }
+          return;
+        }
         const failure = projectRuntimeBoundaryFailure(err, "start");
         if (failure.contractViolation) {
           console.error("[byok/client] runtime adapter start() returned an untyped failure", err);
@@ -15832,143 +16626,169 @@ var TaskRunner = class {
         }
         return;
       }
-      if (agentBinding !== void 0) {
-        try {
-          await agentBinding.lease.bindSession(session.sessionRef);
-        } catch (error) {
-          await session.close().catch(() => {
-          });
-          await this.failClaimedAgent(
-            taskId,
-            `Agent session execution lease could not bind the runtime session: ${errorMessage6(error)}`,
-            false,
-            {
-              binding: agentBinding,
-              runtimeId: pick.descriptor.id,
-              sessionRef: session.sessionRef
-            }
-          );
-          return;
+      const ownedBinding = agentBinding;
+      this.startupOwners.set(taskId, {
+        runtimeId: pick.descriptor.id,
+        dispose: () => session.close(),
+        release: async () => {
+          await ownedBinding?.lease.release();
+          gitLease?.release();
         }
-      }
-      let active;
-      active = {
-        taskId,
-        blobAbort,
-        egressEnabled: "egressPolicy" in payload,
-        adapter: pick.adapter,
-        session,
-        workspaceDir,
-        ...agentBinding === void 0 ? {} : {
-          agentBinding,
-          agentRef: agentBinding.resolution.agentRef,
-          agentHandoff: {
-            sessionRef: session.sessionRef,
-            runtimeId: pick.descriptor.id,
-            cwd: workspaceDir
-          }
-        },
-        gitWorkspaceId,
-        gitLease,
-        gitBaseline,
-        summaryParts: [],
-        finalTextParts: [],
-        batcher: new ProgressBatcher(
-          (seq, events) => {
-            const projected = active.egressEnabled ? this.deps.agentEgress?.projectLatestValue({
-              agentRef: active.agentRef,
+      });
+      try {
+        if (agentBinding !== void 0) {
+          try {
+            await agentBinding.lease.bindSession(session.sessionRef);
+          } catch (error) {
+            await this.failClaimedAgent(
               taskId,
-              events,
-              serverCapabilities: this.deps.getServerCapabilities?.() ?? []
-            }) ?? [] : events;
-            if (projected.length > 0) this.deps.send(createEnvelope("task.progress", { seq, events: [...projected] }, { taskId, seq }));
-          },
-          this.deps.batcherOptions
-        ),
-        approvalQueue: [],
-        outputBytesSoFar: 0,
-        startedAtMs: Date.now(),
-        ...messageRequirement === void 0 ? {} : {
-          messageRequirement,
-          messageOutbox: this.pendingMessageTasks.get(taskId).outbox
-        },
-        ...terminalProjection === void 0 ? {} : { terminalProjection }
-      };
-      if (agentBinding !== void 0) {
-        const binding = agentBinding;
-        try {
-          await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
-            agentRef: binding.resolution.agentRef,
-            taskId,
-            sessionRef: session.sessionRef,
-            runtimeId: pick.descriptor.id,
-            cwd: workspaceDir,
-            leaseId: binding.lease.leaseId
-          }));
-        } catch (error) {
-          await session.close().catch(() => {
-          });
-          await this.failClaimedAgent(
-            taskId,
-            `Agent session handoff could not be durably written before start: ${errorMessage6(error)}`,
-            false,
-            {
-              binding: agentBinding,
+              `Agent session execution lease could not bind the runtime session: ${errorMessage6(error)}`,
+              false,
+              {
+                binding: agentBinding,
+                runtimeId: pick.descriptor.id,
+                sessionRef: session.sessionRef
+              }
+            );
+            return;
+          }
+        }
+        let active;
+        active = {
+          taskId,
+          blobAbort,
+          egressEnabled: "egressPolicy" in payload,
+          adapter: pick.adapter,
+          session,
+          workspaceDir,
+          ...agentBinding === void 0 ? {} : {
+            agentBinding,
+            agentRef: agentBinding.resolution.agentRef,
+            agentHandoff: {
+              sessionRef: session.sessionRef,
               runtimeId: pick.descriptor.id,
-              sessionRef: session.sessionRef
+              cwd: workspaceDir
             }
+          },
+          gitWorkspaceId,
+          gitLease,
+          gitBaseline,
+          summaryParts: [],
+          finalTextParts: [],
+          batcher: new ProgressBatcher(
+            (seq, events) => {
+              const projected = active.egressEnabled ? this.deps.agentEgress?.projectLatestValue({
+                agentRef: active.agentRef,
+                taskId,
+                events,
+                serverCapabilities: this.deps.getServerCapabilities?.() ?? []
+              }) ?? [] : events;
+              if (projected.length > 0) this.deps.send(createEnvelope("task.progress", { seq, events: [...projected] }, { taskId, seq }));
+            },
+            this.deps.batcherOptions
+          ),
+          approvalQueue: [],
+          outputBytesSoFar: 0,
+          startedAtMs: Date.now(),
+          ...messageRequirement === void 0 ? {} : {
+            messageRequirement,
+            messageOutbox: this.pendingMessageTasks.get(taskId).outbox
+          },
+          ...terminalProjection === void 0 ? {} : { terminalProjection }
+        };
+        if (agentBinding !== void 0) {
+          const binding = agentBinding;
+          try {
+            await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
+              agentRef: binding.resolution.agentRef,
+              taskId,
+              sessionRef: session.sessionRef,
+              runtimeId: pick.descriptor.id,
+              cwd: workspaceDir,
+              leaseId: binding.lease.leaseId
+            }));
+          } catch (error) {
+            await this.failClaimedAgent(
+              taskId,
+              `Agent session handoff could not be durably written before start: ${errorMessage6(error)}`,
+              false,
+              {
+                binding: agentBinding,
+                runtimeId: pick.descriptor.id,
+                sessionRef: session.sessionRef
+              }
+            );
+            return;
+          }
+        }
+        const activatedMessageRecord = active.messageOutbox === void 0 ? void 0 : await this.activateAgentMessage(
+          active.messageOutbox,
+          taskId,
+          session.sessionRef,
+          () => !this.pendingCancelled.has(taskId) && !blobAbort.signal.aborted
+        );
+        if (this.pendingCancelled.has(taskId)) {
+          const reason = this.pendingCancelled.get(taskId);
+          this.pendingCancelled.delete(taskId);
+          agentLeaseTransferred = agentBinding !== void 0;
+          this.startupOwners.delete(taskId);
+          this.tasks.set(taskId, active);
+          this.reserveSemanticTerminal(active);
+          await this.interruptBounded(session);
+          await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
+          await this.persistAgentTerminalEvidence(active, "cancelled", reason);
+          this.deps.send(
+            createEnvelope(
+              "task.cancelled",
+              { reason, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
+              { taskId }
+            )
           );
+          await this.finish(taskId);
           return;
         }
-      }
-      const activatedMessageRecord = active.messageOutbox === void 0 ? void 0 : await active.messageOutbox.activate(taskId, session.sessionRef);
-      if (this.pendingCancelled.has(taskId)) {
-        const reason = this.pendingCancelled.get(taskId);
-        this.pendingCancelled.delete(taskId);
+        this.deps.send(createEnvelope("task.started", {}, { taskId }));
         agentLeaseTransferred = agentBinding !== void 0;
+        this.inFlightBlobAborts.delete(taskId);
+        this.startupOwners.delete(taskId);
         this.tasks.set(taskId, active);
-        this.reserveSemanticTerminal(active);
-        try {
-          await session.interrupt();
-        } catch {
+        this.pendingMessageTasks.delete(taskId);
+        if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
+          this.sendAgentMessageRecord(active.messageOutbox, activatedMessageRecord);
         }
-        await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
-        await this.persistAgentTerminalEvidence(active, "cancelled", reason);
-        this.deps.send(
-          createEnvelope(
-            "task.cancelled",
-            { reason, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
-            { taskId }
-          )
-        );
-        await this.finish(taskId);
-        return;
-      }
-      this.deps.send(createEnvelope("task.started", {}, { taskId }));
-      agentLeaseTransferred = agentBinding !== void 0;
-      this.inFlightBlobAborts.delete(taskId);
-      this.tasks.set(taskId, active);
-      this.pendingMessageTasks.delete(taskId);
-      if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
-        this.sendAgentMessageRecord(active.messageOutbox, activatedMessageRecord);
-      }
-      if (payload.limits?.maxDurationMs !== void 0) {
-        this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
-      }
-      void this.pump(active);
-      if (agentBinding === void 0) {
-        void this.deps.sessionWorkspaces.record(session.sessionRef, {
-          workspaceDir,
-          runtimeSessionId: session.sessionRef,
-          ...gitWorkspaceId ? { workspaceKind: "git", gitWorkspaceId } : {}
-        }).catch(() => {
-        });
-      }
-      if (gitWorkspaceId && this.deps.gitWorkspaceStore) {
-        void this.deps.gitWorkspaceStore.attachSession(gitWorkspaceId, session.sessionRef).catch(() => {
+        if (payload.limits?.maxDurationMs !== void 0) {
+          this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
+        }
+        void this.pump(active);
+        if (agentBinding === void 0) {
+          void this.deps.sessionWorkspaces.record(session.sessionRef, {
+            workspaceDir,
+            runtimeSessionId: session.sessionRef,
+            ...gitWorkspaceId ? { workspaceKind: "git", gitWorkspaceId } : {}
+          }).catch(() => {
+          });
+        }
+        if (gitWorkspaceId && this.deps.gitWorkspaceStore) {
+          void this.deps.gitWorkspaceStore.attachSession(gitWorkspaceId, session.sessionRef).catch(() => {
+          });
+        }
+      } catch (error) {
+        if (this.tasks.has(taskId)) throw error;
+        const reason = `runtime activation failed: ${errorMessage6(error)}`;
+        if (agentBinding === void 0) await this.fail(taskId, reason, false);
+        else await this.failClaimedAgent(taskId, reason, false, {
+          binding: agentBinding,
+          runtimeId: pick.descriptor.id,
+          sessionRef: session.sessionRef
         });
       }
     } finally {
+      clearTimeout(startupTimer);
+      releaseReservation();
+      if (this.startupOwners.has(taskId)) {
+        agentLeaseTransferred = true;
+        await this.disposeStartupOwner(taskId);
+      }
       if (!agentLeaseTransferred) {
         this.pendingMessageTasks.delete(taskId);
         this.revokeAgentMessageContext(taskId);
@@ -15980,6 +16800,7 @@ var TaskRunner = class {
       }
       this.inFlightBlobAborts.delete(taskId);
       this.inFlightOffers.delete(taskId);
+      this.claimedHarnesses.delete(taskId);
     }
   }
   withAgentMessageMcp(existing, taskId, requirement) {
@@ -16249,7 +17070,13 @@ var TaskRunner = class {
                 maxPendingBytes: 4 * 1024 * 1024
               });
               if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
-              const activated = await outbox.activate(active.taskId, active.session.sessionRef);
+              const activated = await this.activateAgentMessage(
+                outbox,
+                active.taskId,
+                active.session.sessionRef,
+                () => this.canPublishAgentMessage(active),
+                () => active.messageSendAttempted === true
+              );
               if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
               if (activated === void 0) throw new Error("Agent message draft disappeared before activation");
               this.sendAgentMessageRecord(outbox, activated);
@@ -16356,14 +17183,24 @@ var TaskRunner = class {
     }
     let bytes;
     try {
-      bytes = await opened.handle.readFile();
-    } catch (err) {
+      const limits = this.deps.artifactLimits ?? DEFAULT_ARTIFACT_LIMITS;
+      const remaining = limits.maxTaskBytes - (active.artifactBytesSoFar ?? 0);
+      bytes = await readArtifactBytes(
+        opened.handle,
+        Math.min(limits.maxFileBytes, remaining),
+        active.blobAbort.signal,
+        (count) => {
+          active.artifactBytesSoFar = (active.artifactBytesSoFar ?? 0) + count;
+        }
+      );
+    } catch (err) {
       this.reportArtifactError(active, name, `failed to read artifact "${name}": ${errorMessage6(err)}`);
       return;
     } finally {
       await opened.handle.close().catch(() => {
       });
     }
+    if (this.tasks.get(active.taskId) !== active || active.blobAbort.signal.aborted || active.beingTornDown) return;
     if (bytes.length <= MAX_INLINE_ARTIFACT_BYTES) {
       const inline = bytes.toString("base64");
       if (new TextEncoder().encode(inline).length <= MAX_INLINE_ARTIFACT_BYTES) {
@@ -16375,6 +17212,7 @@ var TaskRunner = class {
       const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType, {
         signal: active.blobAbort.signal
       });
+      if (this.tasks.get(active.taskId) !== active || active.blobAbort.signal.aborted || active.beingTornDown) return;
       this.deps.send(createEnvelope("task.artifact", { name, contentType, blobRef }, { taskId: active.taskId }));
     } catch (err) {
       this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage6(err)}`);
@@ -16382,12 +17220,17 @@ var TaskRunner = class {
   }
   /** Loud, non-silent artifact failure (finding F7): logged, and folded into this task's own progress stream as an `error` AgentEvent rather than swallowed — the task itself can still complete normally, but the omission is now visible. */
   reportArtifactError(active, name, reason) {
+    if (active.blobAbort.signal.aborted || active.beingTornDown) return;
     console.error(`[byok/client] artifact "${name}" for task ${active.taskId} dropped: ${reason}`);
     active.batcher.push({ type: "error", message: reason });
   }
   async handleCancel(taskId, reason) {
     const active = this.tasks.get(taskId);
     if (!active) {
+      if (this.startupOwners.has(taskId) && !this.inFlightOffers.has(taskId)) {
+        await this.disposeStartupOwner(taskId);
+        return;
+      }
       this.setPendingCancelled(taskId, reason);
       this.inFlightBlobAborts.get(taskId)?.abort();
       return;
@@ -16401,10 +17244,7 @@ var TaskRunner = class {
       return;
     }
     active.blobAbort.abort();
-    try {
-      await active.session.interrupt();
-    } catch {
-    }
+    await this.interruptBounded(active.session);
     await this.observeGit(active, "salvage");
     await this.persistAgentTerminalEvidence(active, "cancelled", reason);
     this.deps.send(
@@ -16846,10 +17686,7 @@ var TaskRunner = class {
       await active.semanticTerminalSettled;
       return;
     }
-    try {
-      await active.session.interrupt();
-    } catch {
-    }
+    await this.interruptBounded(active.session);
     await this.observeGit(active, "salvage");
     await this.persistAgentTerminalEvidence(active, "failed", reason ?? "rejected");
     this.deps.send(
@@ -16884,7 +17721,7 @@ var TaskRunner = class {
     this.deps.send(
       createEnvelope(
         "task.fail",
-        active === void 0 ? { reason, retryable } : { reason, retryable, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
+        active === void 0 ? { reason, retryable, ...terminalIdentity(this.claimedHarnesses.get(taskId)) } : { reason, retryable, ...this.terminalInferenceUsagePayload(active), ...this.agentTerminalPayload(active) },
         { taskId }
       )
     );
@@ -16898,6 +17735,7 @@ var TaskRunner = class {
    * the wire and handleOffer's finally block releases the lease.
    */
   async failClaimedAgent(taskId, reason, retryable, context) {
+    await this.pendingMessageTasks.get(taskId)?.outbox.revoke(taskId);
     const agentRef = context.binding.resolution.agentRef;
     const result = await this.retryAgentTerminalEvidence(
       () => this.deps.agentHome.mutateExecution(context.binding, () => this.deps.agentSessionHandoffs.recordTaskTerminal({
@@ -16923,7 +17761,7 @@ var TaskRunner = class {
     }
     this.deps.send(createEnvelope(
       "task.fail",
-      { reason, retryable, agentRef },
+      { reason, retryable, ...terminalIdentity(context.runtimeId, agentRef) },
       { taskId }
     ));
     return result.ok;
@@ -16941,7 +17779,8 @@ var TaskRunner = class {
   terminalInferenceUsagePayload(active) {
     const release = this.deps.localAgentRelease;
     const runtimeId = active.adapter.descriptor.id;
-    if (release === void 0 || active.lastUsage === void 0 || !isKnownRuntimeId(runtimeId)) return {};
+    if (!isKnownRuntimeId(runtimeId)) return {};
+    if (release === void 0 || active.lastUsage === void 0) return {};
     const nowMs = Date.now();
     const durationMs = terminalUsageNumber(nowMs - active.startedAtMs, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS);
     const promptTokens = terminalUsageNumber(active.lastUsage?.inputTokens, TERMINAL_INFERENCE_USAGE_MAX_TOKENS);
@@ -16959,7 +17798,7 @@ var TaskRunner = class {
   }
   /** Exact Agent identity projection for claim/terminal wire payloads. */
   agentTerminalPayload(active) {
-    return active.agentRef === void 0 ? {} : { agentRef: active.agentRef };
+    return terminalIdentity(active.adapter.descriptor.id, active.agentRef);
   }
   /**
    * additive-minor (`task.complete.document`): the whole daemon-side gate
@@ -17116,6 +17955,14 @@ var TaskRunner = class {
   }
   /** Persist Agent terminal truth before wire when local storage is available. */
   async persistAgentTerminalEvidence(active, cause, reason) {
+    if (cause === "cancelled" || cause === "failed" && !active.messageSendAttempted) {
+      try {
+        await active.messageOutbox?.revoke(active.taskId);
+      } catch (error) {
+        active.resolveSemanticTerminalSettled?.(false);
+        throw error;
+      }
+    }
     active.terminalCause = cause;
     active.terminalReason = reason;
     if (active.agentBinding === void 0 || active.agentRef === void 0 || active.agentHandoff === void 0) {
@@ -17178,7 +18025,19 @@ var TaskRunner = class {
       error
     });
   }
-  async finish(taskId) {
+  async retryTerminalFinalization(taskId) {
+    const active = this.tasks.get(taskId);
+    if (active?.finalizationStarted) await this.finish(taskId);
+  }
+  finalizationAttempts = /* @__PURE__ */ new Map();
+  finish(taskId) {
+    const existing = this.finalizationAttempts.get(taskId);
+    if (existing) return existing;
+    const attempt = this.finishOnce(taskId).finally(() => this.finalizationAttempts.delete(taskId));
+    this.finalizationAttempts.set(taskId, attempt);
+    return attempt;
+  }
+  async finishOnce(taskId) {
     const active = this.tasks.get(taskId);
     if (!active) return true;
     if (!active.finalizationStarted) {
@@ -17229,6 +18088,13 @@ var TaskRunner = class {
       return false;
     }
     if (this.tasks.get(taskId) !== active) return true;
+    try {
+      await this.deps.awaitTerminalCommit?.(taskId);
+    } catch {
+      active.resolveSemanticTerminalSettled?.(false);
+      return false;
+    }
+    if (this.tasks.get(taskId) !== active) return true;
     if (active.agentBinding !== void 0 && active.agentRef !== void 0 && active.agentHandoff !== void 0) {
       const agentRef = active.agentRef;
       const handoff = active.agentHandoff;
@@ -17340,7 +18206,7 @@ var TaskRunner = class {
    * is device-specific (which runtimes happen to be installed here), so a
    * different device's installed runtime set might satisfy it.
    */
-  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets) {
+  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets, signal) {
     const allowlist = this.deps.runtimeAllowlist;
     if (requestedRuntime) {
       if (allowlist && !allowlist.includes(requestedRuntime)) {
@@ -17369,8 +18235,8 @@ var TaskRunner = class {
           retryable: false
         };
       }
-      const detected = await adapter.detect();
-      if (!detected.present) {
+      const detected = validateRuntimeDetectResult(await awaitAdmission(() => adapter.detect(signal), signal));
+      if (detected.kind !== "available") {
         return {
           ok: false,
           reason: `runtime "${requestedRuntime}" is not installed/available on this device`,
@@ -17385,8 +18251,8 @@ var TaskRunner = class {
       const descriptor = freezeRuntimeAdapterDescriptor(adapter.descriptor);
       if (!adapterSupportsMode(descriptor, policyMode)) continue;
       if (requiresMcpToolsets && !adapterSupportsMcpToolsets(descriptor)) continue;
-      const detected = await adapter.detect();
-      if (detected.present) return { ok: true, adapter, descriptor };
+      const detected = validateRuntimeDetectResult(await awaitAdmission(() => adapter.detect(signal), signal));
+      if (detected.kind === "available") return { ok: true, adapter, descriptor };
     }
     return {
       ok: false,
@@ -17550,10 +18416,12 @@ var AgentReliableSpool = class _AgentReliableSpool {
   constructor(homeDir, spoolPath) {
     this.homeDir = homeDir;
     this.spoolPath = spoolPath;
+    this.file = new DurableJsonlFile(spoolPath);
   }
   homeDir;
   spoolPath;
   pending = /* @__PURE__ */ new Map();
+  file;
   nextCursor = 1;
   logEntries = 0;
   writeTail = Promise.resolve();
@@ -17562,6 +18430,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
     await ensureSecureDir(directory);
     const spool = new _AgentReliableSpool(homeDir, path3__default.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
     await spool.load();
+    await spool.file.confirmRecovered();
     return spool;
   }
   get pendingEvents() {
@@ -17581,6 +18450,25 @@ var AgentReliableSpool = class _AgentReliableSpool {
       const payloadJson = stableRecordJson(input.payload);
       const byteCount = Buffer.byteLength(payloadJson, "utf8");
       if (byteCount <= 0) throw new AgentReliableSpoolError("reliable payload must have positive serialized bytes");
+      const eventId = input.eventId ?? randomUUID();
+      const existing = this.pending.get(eventId);
+      if (existing !== void 0) {
+        if (!sameRecord(existing, {
+          wireType: "agent.egress.reliable",
+          agentRef: input.agentRef,
+          tenantId: input.tenantId,
+          policyRevision: input.policyRevision,
+          eventId,
+          cursor: existing.cursor,
+          payloadHash: contentHash(payloadJson),
+          byteCount,
+          sessionRef: input.sessionRef,
+          taskId: input.taskId
+        }) || stableRecordJson(existing.payload) !== payloadJson || input.createdAt !== void 0 && input.createdAt !== existing.createdAt) {
+          throw new AgentReliableSpoolError(`reliable eventId ${eventId} differs from its existing record`);
+        }
+        return existing;
+      }
       if (this.pending.size >= policy.reliable.maxPendingEventsPerAgent) {
         throw new AgentReliableQuotaError("quota_exceeded", "reliable per-Agent event quota is exhausted");
       }
@@ -17590,8 +18478,6 @@ var AgentReliableSpool = class _AgentReliableSpool {
       if (tenantPendingBytes + byteCount > policy.reliable.maxPendingBytesPerTenant) {
         throw new AgentReliableQuotaError("quota_exceeded", "reliable tenant byte quota is exhausted");
       }
-      const eventId = input.eventId ?? randomUUID();
-      if (this.pending.has(eventId)) throw new AgentReliableSpoolError(`reliable eventId ${eventId} already exists`);
       const record3 = Object.freeze({
         schema: 1,
         wireType: "agent.egress.reliable",
@@ -17700,6 +18586,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
       if (error.code === "ENOENT") return;
       throw error;
     }
+    if (raw.length > 0 && !raw.endsWith("\n")) throw new AgentReliableSpoolError("durable JSONL log has an incomplete trailing frame; preserve the file for explicit repair");
     for (const line of raw.split("\n")) {
       if (line.length === 0) continue;
       let entry;
@@ -17722,19 +18609,12 @@ var AgentReliableSpool = class _AgentReliableSpool {
     }
   }
   async appendEntry(entry) {
-    const handle = await promises.open(this.spoolPath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
-    try {
-      await handle.write(`${stableRecordJson(entry)}
-`, void 0, "utf8");
-      await handle.sync();
-      this.logEntries += 1;
-    } finally {
-      await handle.close();
-    }
+    await this.file.append(stableRecordJson(entry));
+    this.logEntries += 1;
   }
   async compact() {
     const entries = this.records().map((record3) => ({ schema: 1, kind: "append", record: record3 }));
-    await atomicWriteFile(this.spoolPath, entries.map((entry) => stableRecordJson(entry)).join(entries.length > 0 ? "\n" : ""), { mode: 384 });
+    await this.file.replace(entries.map((entry) => stableRecordJson(entry)));
     this.logEntries = entries.length;
   }
   async exclusive(fn) {
@@ -17745,6 +18625,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
     });
     await prior;
     try {
+      this.file.assertWritable();
       return await fn();
     } finally {
       release();
@@ -19119,17 +20000,26 @@ function isRuntimeId(id) {
   return id === "pi" || id === "claude" || id === "codex";
 }
 async function detectRuntimes(adapters) {
-  const detections = await Promise.all(adapters.map(async (adapter) => ({ adapter, detected: await adapter.detect() })));
+  const detections = await Promise.all(adapters.map(async (adapter) => ({ adapter, detected: validateRuntimeDetectResult(await adapter.detect()) })));
   const runtimes = [];
+  const harnesses = [];
   for (const { adapter, detected } of detections) {
-    if (!detected.present || !isRuntimeId(adapter.descriptor.id)) continue;
+    if (detected.kind !== "available") continue;
+    if (!isRuntimeId(adapter.descriptor.id)) {
+      harnesses.push({
+        id: HarnessIdSchema.parse(adapter.descriptor.id),
+        ...detected.version === void 0 ? {} : { version: detected.version },
+        capabilities: toRuntimeInfoCapabilities(adapter.descriptor.capabilities)
+      });
+      continue;
+    }
     const info = { id: adapter.descriptor.id };
     if (detected.version !== void 0) info.version = detected.version;
     if (detected.authPresent !== void 0) info.authPresent = detected.authPresent;
     info.capabilities = toRuntimeInfoCapabilities(adapter.descriptor.capabilities);
     runtimes.push(info);
   }
-  return runtimes;
+  return { runtimes, harnesses };
 }
 function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies, providerProfileBindingConfigured = false) {
   const flags = [];
@@ -19219,7 +20109,7 @@ function buildAdapter(id, config) {
         resolveApprovalMcpBin: () => resolveApprovalMcpBin(config.sdkHelperHost)
       });
     case "codex":
-      return new CodexAdapter();
+      return new CodexAdapter({ sdkHelperHost: config.sdkHelperHost });
   }
 }
 function buildDefaultAdapters(config) {
@@ -19296,6 +20186,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const localAgentRelease = resolveLocalAgentReleaseIdentity(config.localAgentRelease);
   const toolsetRegistry = new McpToolsetRegistry(config.mcpToolsets);
   validatePiByokLauncherConfig(config.piByokLauncher);
+  if (config.startupTimeoutMs !== void 0 && (!Number.isSafeInteger(config.startupTimeoutMs) || config.startupTimeoutMs <= 0)) throw new Error("startupTimeoutMs must be a positive safe integer");
+  if (config.artifactLimits !== void 0) {
+    for (const value of [config.artifactLimits.maxFileBytes, config.artifactLimits.maxTaskBytes]) {
+      if (!Number.isSafeInteger(value) || value <= 0) throw new Error("artifactLimits must contain positive safe integer byte budgets");
+    }
+  }
   if (config.maxTaskOutputBytes !== void 0 && !(config.maxTaskOutputBytes > 0)) {
     throw new Error(
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
@@ -19425,7 +20321,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       pressureEngine = ownedPressureEngine;
     }
   }
-  let journalTerminalTail = Promise.resolve();
+  const terminalCommits = new TerminalCommitQueue((taskId) => {
+    connection?.retryTaskReceipts(taskId);
+    void runner?.retryTerminalFinalization(taskId).catch((error) => {
+      console.error("[byok/client] terminal finalization still requires recovery", error);
+    });
+  });
   const observer = new DaemonObserver();
   const approvalRegistry = new ApprovalRegistry();
   let connection;
@@ -19560,6 +20461,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     await runLifecycleMutation(startUnderLease);
   }
   async function startUnderLease() {
+    terminalCommits.resume();
     if (!daemonOwnerLease) daemonOwnerLease = await acquireDaemonOwner(storeDir, "daemon");
     try {
       let record3;
@@ -19611,7 +20513,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           const terminal = createEnvelope("task.fail", {
             reason: "daemon_interrupted",
             retryable: false,
-            ...payload.agentRef === void 0 ? {} : { agentRef: payload.agentRef }
+            ...terminalIdentity(task.claimedRuntime, payload.agentRef),
+            recovery: { kind: "daemon_interrupted", offerId: offer.id }
           }, { taskId: task.taskId });
           const bytes = encodeEnvelope(terminal);
           await activeJournal.recordTerminal({
@@ -19639,7 +20542,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         await gitWorkspaceStore?.reconcile();
       }
       blobLifecycleAbort = new AbortController();
-      const [runtimes, blobClient] = await Promise.all([
+      const [{ runtimes, harnesses }, blobClient] = await Promise.all([
         detectRuntimes(adapters),
         Promise.resolve(new BlobClient(config.serverUrl, auth, { signal: blobLifecycleAbort.signal }))
       ]);
@@ -19660,6 +20563,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         tenantId: record3.tenantId,
         deviceId: record3.deviceId
       }) : void 0;
+      capabilities.push("custom-harness");
       const sendSanitizedEnvelope = (envelope) => {
         const terminalKind = terminalKindOf(envelope.type);
         if (!activeJournal || !journalIdentity || terminalKind === void 0 || envelope.task_id === void 0) {
@@ -19669,7 +20573,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         }
         const taskId = envelope.task_id;
         const bytes = encodeEnvelope(envelope);
-        journalTerminalTail = journalTerminalTail.catch(() => void 0).then(async () => {
+        terminalCommits.enqueue(taskId, async () => {
           try {
             await activeJournal.recordTerminal({
               taskId,
@@ -19697,7 +20601,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             const failure = createEnvelope("task.fail", {
               reason: "terminal_result_too_large",
               retryable: false,
-              ...offerPayload.agentRef === void 0 ? {} : { agentRef: offerPayload.agentRef }
+              ...terminalIdentity(task.claimedRuntime, offerPayload.agentRef)
             }, { taskId });
             const failureBytes = encodeEnvelope(failure);
             await activeJournal.recordTerminal({
@@ -19715,8 +20619,6 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             observer.handleOutboundEnvelope(decoded);
             connection?.send(decoded);
           }
-        }).catch((error) => {
-          console.error("[byok/client] terminal durability failed; execution remains unsettled", error);
         });
       };
       const sendEnvelope = (candidate) => {
@@ -19798,7 +20700,10 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // Finding F5(a): see TaskRunnerDeps.shutdownInterruptTimeoutMs's own doc comment.
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
+        awaitTerminalCommit: (taskId) => terminalCommits.receipt(taskId),
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        artifactLimits: config.artifactLimits,
+        startupTimeoutMs: config.startupTimeoutMs,
         // See DaemonConfig.maxInlineEventBytes's own doc comment — already validated above.
         maxInlineEventBytes: config.maxInlineEventBytes,
         // additive-minor (`task.complete.document`): passed through verbatim,
@@ -19846,6 +20751,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       if (config.agentHome !== void 0 && config.agentEgress !== void 0) {
         await runner.recoverAgentMessageOutboxes(path3__default.join(config.agentHome.hostStorageRoot, "agents"));
       }
+      const replayRecoveryTerminals = async (taskId) => {
+        if (!activeJournal || !journalIdentity) return;
+        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
+          if (terminal.truthState !== "pending" || taskId !== void 0 && terminal.taskId !== taskId) continue;
+          if (runner?.hasPendingRecoveredAgentMessage(terminal.taskId)) continue;
+          const envelope = decodeEnvelope(terminal.bytes);
+          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
+            throw new Error("durable terminal execution binding mismatch");
+          }
+          overrides.executionRecoveryFault?.("terminal:before-send");
+          observer.handleOutboundEnvelope(envelope);
+          connection?.send(envelope);
+        }
+      };
       const handleAgentHomeProjectionEnvelope = async (envelope) => {
         if (envelope.type !== "agent.home.projection") return false;
         if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
@@ -19980,6 +20899,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         capabilities,
         clientVersion: localAgentRelease.version,
         runtimes,
+        harnesses,
         getConfiguredToolsets: () => toolsetRegistry.snapshot().configuredToolsets,
         auth,
         cursorStore,
@@ -20021,12 +20941,22 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           activePressureEngine?.assertAckCriticalAllowed();
           await activeJournal.appendEnvelope(toJournalEnvelopeRecord(envelope, journalIdentity));
           if (isTaskOfferType(envelope.type) && envelope.task_id !== void 0) {
+            if (terminalCommits.hasPending(envelope.task_id)) {
+              await terminalCommits.retry(envelope.task_id);
+              return;
+            }
             const task = await activeJournal.readTask(envelope.task_id, journalIdentity);
             if (!task) throw new Error("durable offer has no execution record");
-            if (task.localState !== "received") return;
+            if (task.localState !== "received") {
+              await terminalCommits.retry(envelope.task_id);
+              return;
+            }
           }
           await runner?.handleEnvelope(envelope);
-          await journalTerminalTail;
+          if (envelope.type === "agent.message.disposition") {
+            await replayRecoveryTerminals(envelope.task_id);
+          }
+          if (envelope.task_id !== void 0) await terminalCommits.receipt(envelope.task_id);
         } : (envelope) => {
           if (tenantRebinding) {
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
@@ -20074,18 +21004,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           });
         }
       });
-      if (activeJournal && journalIdentity) {
-        for (const terminal of await activeJournal.listPendingTerminals(journalIdentity)) {
-          if (terminal.truthState !== "pending") continue;
-          const envelope = decodeEnvelope(terminal.bytes);
-          if (envelope.task_id !== terminal.taskId || terminalKindOf(envelope.type) !== terminal.terminalType) {
-            throw new Error("durable terminal execution binding mismatch");
-          }
-          overrides.executionRecoveryFault?.("terminal:before-send");
-          observer.handleOutboundEnvelope(envelope);
-          connection.send(envelope);
-        }
-      }
+      await replayRecoveryTerminals();
       await connection.start();
       await connection.waitForConnection();
       runner.retryRecoveredAgentMessages();
@@ -20200,7 +21119,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       pendingLateMutationBarriers.add(observedActiveTeardown);
       void observedActiveTeardown.finally(() => pendingLateMutationBarriers.delete(observedActiveTeardown)).catch(() => void 0);
     }
-    const journalTailSettled = journal ? await attempt(() => journalTerminalTail, true) : true;
+    const journalTailSettled = journal ? await attempt(() => terminalCommits.stop(), true) : true;
     const maintenanceSettled = await attempt(() => maintenanceStopped, true);
     const drainTimeoutMs = opts.drainTimeoutMs ?? overrides.shutdown?.outboxDrainTimeoutMs ?? DEFAULT_SHUTDOWN_OUTBOX_DRAIN_TIMEOUT_MS;
     const connectionStopped = await attempt(() => connection?.stop(drainTimeoutMs), true);
@@ -20720,6 +21639,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       revoked: connection?.isRevoked() ?? auth.isRevoked(),
       deviceId: auth.deviceId,
       activeTaskCount: runner?.activeTaskCount ?? 0,
+      pendingTerminalCommits: terminalCommits.pendingCount,
       branding: config.branding,
       operationalHealth: operationalHealth.snapshot(),
       toolsets: toolsetRegistry.status(),
@@ -21185,8 +22105,8 @@ var TruthMemoryClient = class {
   #requestId;
   #allowedObjectDownloadOrigins;
   async listManifest(query = {}) {
-    const path38 = manifestPath(query);
-    const response = await this.#proofFetch(path38, {
+    const path43 = manifestPath(query);
+    const response = await this.#proofFetch(path43, {
       method: "GET",
       operation: "truth.list",
       resource: "records",
@@ -21293,9 +22213,9 @@ var TruthMemoryClient = class {
   }
   async #write(kind, recordKey, requestId, payload, expectedPrimary, expectedSnapshots) {
     assertDistinctExpectedWrites([expectedPrimary, ...expectedSnapshots]);
-    const path38 = recordPath(kind, recordKey);
+    const path43 = recordPath(kind, recordKey);
     const body = new TextEncoder().encode(JSON.stringify(payload));
-    const response = await this.#proofFetch(path38, {
+    const response = await this.#proofFetch(path43, {
       method: "PUT",
       operation: "truth.write",
       resource: `${kind}/${recordKey}`,
@@ -21321,8 +22241,8 @@ var TruthMemoryClient = class {
     };
   }
   async #readVerified(listed) {
-    const path38 = recordPath(listed.kind, listed.recordKey);
-    const response = await this.#proofFetch(path38, {
+    const path43 = recordPath(listed.kind, listed.recordKey);
+    const response = await this.#proofFetch(path43, {
       method: "GET",
       operation: "truth.read",
       resource: `${listed.kind}/${listed.recordKey}`,
@@ -21383,16 +22303,16 @@ var TruthMemoryClient = class {
     }
     return { ...listed, bytes };
   }
-  async #proofFetch(path38, request) {
+  async #proofFetch(path43, request) {
     const proof = await this.options.signer.sign({
       method: request.method,
-      path: path38,
+      path: path43,
       operation: request.operation,
       resource: request.resource,
       requestId: request.requestId,
       body: request.body
     });
-    const response = await this.#fetch(new URL(path38, this.#base), {
+    const response = await this.#fetch(new URL(path43, this.#base), {
       method: request.method,
       headers: {
         ...request.headers,
@@ -21403,7 +22323,7 @@ var TruthMemoryClient = class {
     if (!response.ok) {
       throw new TruthMemoryClientError(
         "truth_http_failed",
-        `truth request ${request.method} ${path38} failed with HTTP ${response.status}`,
+        `truth request ${request.method} ${path43} failed with HTTP ${response.status}`,
         response.status
       );
     }
@@ -21661,7 +22581,7 @@ function plistString(value) {
 function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
-  const cwd = program.cwd ?? os4__default.homedir();
+  const cwd = program.cwd ?? os__default.homedir();
   const outLog = path3__default.join(logDir, `${label}.out.log`);
   const errLog = path3__default.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
@@ -21695,8 +22615,8 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs31 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os4__default.homedir());
+  const fs36 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os__default.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
       throw new Error("launchd lifecycle requires a POSIX uid (process.getuid unavailable) \u2014 this module only runs on macOS");
@@ -21709,7 +22629,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs31.stat(p);
+      await fs36.stat(p);
       return true;
     } catch {
       return false;
@@ -21717,9 +22637,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs31.mkdir(path3__default.dirname(plistPath()), { recursive: true });
-    await fs31.mkdir(def.logDir, { recursive: true });
-    await fs31.writeFile(plistPath(), xml, "utf8");
+    await fs36.mkdir(path3__default.dirname(plistPath()), { recursive: true });
+    await fs36.mkdir(def.logDir, { recursive: true });
+    await fs36.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -21730,7 +22650,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs31.rm(plistPath(), { force: true });
+    await fs36.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -21789,7 +22709,7 @@ function generateSystemdUnit(def) {
   const { name, displayName, program, logDir } = def;
   assertNoControlChars(name, "name");
   assertNoControlChars(displayName, "displayName");
-  const cwd = program.cwd ?? os4__default.homedir();
+  const cwd = program.cwd ?? os__default.homedir();
   assertNoControlChars(cwd, "program.cwd");
   const outLog = path3__default.join(logDir, `${name}.out.log`);
   const errLog = path3__default.join(logDir, `${name}.err.log`);
@@ -21814,14 +22734,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs31 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os4__default.homedir());
+  const fs36 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os__default.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
   const unitPath = () => path3__default.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs31.stat(p);
+      await fs36.stat(p);
       return true;
     } catch {
       return false;
@@ -21829,9 +22749,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs31.mkdir(path3__default.dirname(unitPath()), { recursive: true });
-    await fs31.mkdir(def.logDir, { recursive: true });
-    await fs31.writeFile(unitPath(), unit, "utf8");
+    await fs36.mkdir(path3__default.dirname(unitPath()), { recursive: true });
+    await fs36.mkdir(def.logDir, { recursive: true });
+    await fs36.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -21840,7 +22760,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs31.rm(unitPath(), { force: true });
+    await fs36.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -21903,7 +22823,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs31 = deps.fs ?? promises;
+  const fs36 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -21915,7 +22835,7 @@ function createWinswLifecycle(def, deps = {}) {
   const xmlPath = path3__default.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs31.stat(p);
+      await fs36.stat(p);
       return true;
     } catch {
       return false;
@@ -21923,10 +22843,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs31.mkdir(installDir, { recursive: true });
-    await fs31.mkdir(def.logDir, { recursive: true });
-    await fs31.copyFile(winswBin, exePath);
-    await fs31.writeFile(xmlPath, xml, "utf8");
+    await fs36.mkdir(installDir, { recursive: true });
+    await fs36.mkdir(def.logDir, { recursive: true });
+    await fs36.copyFile(winswBin, exePath);
+    await fs36.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -21936,8 +22856,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs31.rm(exePath, { force: true });
-    await fs31.rm(xmlPath, { force: true });
+    await fs36.rm(exePath, { force: true });
+    await fs36.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {
@@ -21980,6 +22900,1191 @@ function createServiceLifecycle(def, opts = {}) {
   }
 }
 
-export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_HOME_PROJECTION_STATE_FILE, AGENT_MEMORY_AUDIT_FILENAME, AGENT_MEMORY_OUTBOX_FILENAME, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentMemoryError, AgentMemoryRevisionConflictError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, BYOK_SDK_HELPER_SUBCOMMAND, BlobClient, BlobRequestAbortedError, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStateRelocationBusyError, LocalStateRelocationError, LocalStateRelocationIntegrityError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, LocalTeamWorkspace, LocalTeamWorkspace as LocalTeamWorkspaceService, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, ReplayCursorTooOldError, RuntimeDisposalFailure, RuntimeExecutionFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, TeamTmuxViewError, TeamWorkspaceConflictError, TeamWorkspaceCorruptError, TeamWorkspaceError, TeamWorkspaceLeaseError, TeamWorkspaceNotFoundError, TeamWorkspaceQuotaError, TeamWorkspaceReceiptError, TeamWorkspaceValidationError, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createAgentHomeProjectionConsumer, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, decodeTeamMemberContext, encodeTeamMemberContext, ensureSecureDir, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isAgentMemorySecureFilesystemAvailable, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, journalHash, listInstalledSkillPacks, localStateRelocation, nodeAgentProgram, openTeamTmuxView, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, readDeviceEnrollmentStatus, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, resolveSdkReservedHelperBin, runSdkReservedHelperCommand, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
+// src/bin/runtime-probe.ts
+var ALL_RUNTIME_IDS2 = ["pi", "claude", "codex"];
+var RUNTIME_PROBE_TIMEOUT_MS = 5e3;
+var MAX_RUNTIME_ID_CHARS = 128;
+var MAX_RUNTIME_VERSION_CHARS = 256;
+var MAX_PERMISSION_MODES = 32;
+var MAX_PERMISSION_MODE_CHARS = 64;
+function boundedSingleLine(value, maxChars) {
+  return value.replace(/[\r\n\t]/g, " ").slice(0, maxChars);
+}
+var RuntimeProbeTimeout = class extends Error {
+};
+async function detectWithTimeout(adapter, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      adapter.detect(),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new RuntimeProbeTimeout()), timeoutMs);
+        timer.unref?.();
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function defaultRuntimeAdapters(runtimeAllowlist) {
+  const ids = runtimeAllowlist ? ALL_RUNTIME_IDS2.filter((id) => runtimeAllowlist.includes(id)) : ALL_RUNTIME_IDS2;
+  return ids.map((id) => {
+    switch (id) {
+      case "pi":
+        return new PiAdapter();
+      case "claude":
+        return new ClaudeAdapter();
+      case "codex":
+        return new CodexAdapter();
+    }
+  });
+}
+async function probeRuntimes(adapters, options = {}) {
+  const timeoutMs = options.timeoutMs ?? RUNTIME_PROBE_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("runtime probe timeout must be a positive integer");
+  return Promise.all(
+    adapters.map(async (adapter) => {
+      let id = "unavailable";
+      let steer = false;
+      let resume = false;
+      let permissionModes = [];
+      try {
+        id = boundedSingleLine(adapter.descriptor.id, MAX_RUNTIME_ID_CHARS);
+        const caps = adapter.descriptor.capabilities;
+        steer = caps.steer === true;
+        resume = caps.resume === true;
+        permissionModes = caps.permissionModes.slice(0, MAX_PERMISSION_MODES).map((mode) => boundedSingleLine(mode, MAX_PERMISSION_MODE_CHARS));
+        const detected = validateRuntimeDetectResult(await detectWithTimeout(adapter, timeoutMs));
+        return {
+          id,
+          present: detected.kind === "available",
+          outcome: detected.kind,
+          ...detected.kind !== "available" || detected.version === void 0 ? {} : { version: boundedSingleLine(detected.version, MAX_RUNTIME_VERSION_CHARS) },
+          ...detected.kind === "available" && typeof detected.authPresent === "boolean" ? { authPresent: detected.authPresent } : {},
+          steer,
+          resume,
+          permissionModes
+        };
+      } catch (error) {
+        return { id, present: false, outcome: error instanceof RuntimeProbeTimeout ? "timeout" : "probe-failed", steer, resume, permissionModes };
+      }
+    })
+  );
+}
+
+// src/diagnostics/diagnostics.ts
+var MAX_QUARANTINE_ENTRIES = 100;
+var MAX_QUARANTINE_SCAN_ENTRIES = MAX_QUARANTINE_ENTRIES * 2;
+var MAX_QUARANTINE_READ_BYTES = 128 * 1024 * 1024;
+var MAX_DEVICE_RECORD_BYTES2 = 64 * 1024;
+var MAX_JOURNAL_COPY_BYTES = 512 * 1024 * 1024;
+var MAX_QUARANTINE_MANIFEST_BYTES = 64 * 1024;
+function safeProtocol(serverUrl) {
+  try {
+    const protocol = new URL(serverUrl).protocol.replace(/:$/, "");
+    return protocol === "http" || protocol === "https" || protocol === "ws" || protocol === "wss" ? protocol : "unsupported";
+  } catch {
+    return "invalid";
+  }
+}
+async function inspectDevice(storeDir) {
+  const filePath = path3__default.join(storeDir, "device.json");
+  let pathStat;
+  try {
+    pathStat = await promises.lstat(filePath);
+    if (!pathStat.isFile()) return { status: "unavailable" };
+  } catch (err) {
+    if (err.code === "ENOENT") return { status: "unpaired" };
+    return { status: "unavailable" };
+  }
+  let handle;
+  try {
+    handle = await promises.open(
+      filePath,
+      constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
+    );
+  } catch (err) {
+    if (err.code === "ENOENT") return { status: "unpaired" };
+    return { status: "unavailable" };
+  }
+  try {
+    const stat = await handle.stat();
+    const namedAfterOpen = await promises.lstat(filePath);
+    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || stat.dev !== pathStat.dev || stat.ino !== pathStat.ino || stat.size !== pathStat.size || stat.mtimeMs !== pathStat.mtimeMs || stat.ctimeMs !== pathStat.ctimeMs || stat.dev !== namedAfterOpen.dev || stat.ino !== namedAfterOpen.ino || stat.size !== namedAfterOpen.size || stat.mtimeMs !== namedAfterOpen.mtimeMs || stat.ctimeMs !== namedAfterOpen.ctimeMs || stat.size <= 0 || stat.size > MAX_DEVICE_RECORD_BYTES2) return { status: "unavailable" };
+    const bytes = Buffer.alloc(stat.size);
+    const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+    const after = await handle.stat();
+    const namedAfterRead = await promises.lstat(filePath);
+    if (bytesRead !== bytes.length || after.dev !== stat.dev || after.ino !== stat.ino || after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs || namedAfterRead.dev !== stat.dev || namedAfterRead.ino !== stat.ino || namedAfterRead.size !== stat.size || namedAfterRead.mtimeMs !== stat.mtimeMs || namedAfterRead.ctimeMs !== stat.ctimeMs) {
+      return { status: "unavailable" };
+    }
+    const parsed = JSON.parse(bytes.toString("utf8"));
+    return typeof parsed.deviceId === "string" && parsed.deviceId.length > 0 ? { status: "paired", deviceIdHash: stableIdentifierHash(parsed.deviceId) } : { status: "unavailable" };
+  } catch {
+    return { status: "unavailable" };
+  } finally {
+    await handle.close();
+  }
+}
+async function regularFileIdentity(filePath) {
+  try {
+    const stat = await promises.lstat(filePath, { bigint: true });
+    if (!stat.isFile()) throw new Error("journal component is not a regular file");
+    return { dev: stat.dev, ino: stat.ino, size: stat.size, mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs };
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+}
+function sameIdentity(left, right) {
+  if (!left || !right) return left === right;
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+function identityFromBigIntStat(stat) {
+  return { dev: stat.dev, ino: stat.ino, size: stat.size, mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs };
+}
+async function copyOpenFileBounded(source, expected, destinationPath) {
+  const destination = await promises.open(destinationPath, "wx", 384);
+  try {
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const expectedBytes = Number(expected.size);
+    let position = 0;
+    while (position < expectedBytes) {
+      const length = Math.min(buffer.length, expectedBytes - position);
+      const { bytesRead } = await source.read(buffer, 0, length, position);
+      if (bytesRead === 0) return false;
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await destination.write(buffer, written, bytesRead - written, position + written);
+        if (result.bytesWritten === 0) throw new Error("diagnostics snapshot destination stopped accepting bytes");
+        written += result.bytesWritten;
+      }
+      position += bytesRead;
+    }
+    await destination.sync();
+    return sameIdentity(expected, identityFromBigIntStat(await source.stat({ bigint: true })));
+  } finally {
+    await destination.close();
+  }
+}
+async function inspectJournal(storeDir) {
+  const journalPath = path3__default.join(storeDir, JOURNAL_DB_FILENAME);
+  try {
+    const mainIdentity = await regularFileIdentity(journalPath);
+    if (mainIdentity === void 0) return { status: "missing" };
+    const walIdentity = await regularFileIdentity(path3__default.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
+    let sizeBytes = Number(mainIdentity.size);
+    let walBytes = walIdentity === void 0 ? void 0 : Number(walIdentity.size);
+    if (!isSqliteAvailable()) {
+      return { status: "present", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, integrity: "not-checked" };
+    }
+    const componentNames = [JOURNAL_DB_FILENAME, `${JOURNAL_DB_FILENAME}-wal`, `${JOURNAL_DB_FILENAME}-shm`];
+    const initial = /* @__PURE__ */ new Map();
+    for (const name of componentNames) initial.set(name, await regularFileIdentity(path3__default.join(storeDir, name)));
+    const snapshotMain = initial.get(JOURNAL_DB_FILENAME);
+    if (!snapshotMain) return { status: "unavailable", reason: "journal changed during diagnostics snapshot" };
+    sizeBytes = Number(snapshotMain.size);
+    walBytes = initial.get(`${JOURNAL_DB_FILENAME}-wal`) === void 0 ? void 0 : Number(initial.get(`${JOURNAL_DB_FILENAME}-wal`).size);
+    const opened = /* @__PURE__ */ new Map();
+    let totalBytes = 0n;
+    try {
+      for (const name of componentNames) {
+        let handle;
+        try {
+          handle = await promises.open(
+            path3__default.join(storeDir, name),
+            constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
+          );
+        } catch (err) {
+          if (err.code === "ENOENT" && name !== JOURNAL_DB_FILENAME) continue;
+          throw err;
+        }
+        const stat = await handle.stat({ bigint: true });
+        if (!stat.isFile()) {
+          await handle.close();
+          throw new Error("journal component is not a regular file");
+        }
+        const identity = identityFromBigIntStat(stat);
+        if (!sameIdentity(initial.get(name), identity)) {
+          await handle.close();
+          return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
+        }
+        totalBytes += identity.size;
+        opened.set(name, { handle, identity });
+      }
+      if (totalBytes > BigInt(MAX_JOURNAL_COPY_BYTES)) {
+        return {
+          status: "present",
+          sizeBytes,
+          ...walBytes === void 0 ? {} : { walBytes },
+          integrity: "not-checked",
+          reason: "journal exceeds the bounded diagnostics copy limit"
+        };
+      }
+      const tempDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-journal-inspect-"));
+      const { DatabaseSync } = loadSqliteModule();
+      let db;
+      try {
+        for (const name of componentNames) {
+          const component = opened.get(name);
+          if (component && !await copyOpenFileBounded(component.handle, component.identity, path3__default.join(tempDir, name))) {
+            return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
+          }
+        }
+        for (const [name, component] of opened) {
+          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path3__default.join(storeDir, name)))) {
+            return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
+          }
+        }
+        for (const name of componentNames) {
+          if (!opened.has(name) && await regularFileIdentity(path3__default.join(storeDir, name)) !== void 0) {
+            return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
+          }
+        }
+        const header = Buffer.alloc(16);
+        const copiedHandle = await promises.open(path3__default.join(tempDir, JOURNAL_DB_FILENAME), "r");
+        try {
+          const { bytesRead } = await copiedHandle.read(header, 0, header.length, 0);
+          if (bytesRead !== 16 || header.toString("binary") !== "SQLite format 3\0") {
+            return { status: "corrupt", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal has an invalid SQLite header" };
+          }
+        } finally {
+          await copiedHandle.close();
+        }
+        db = new DatabaseSync(path3__default.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
+        const result = db.prepare("PRAGMA quick_check(1)").get();
+        if (result?.quick_check !== "ok") {
+          return { status: "corrupt", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal quick_check failed" };
+        }
+        return { status: "present", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, integrity: "ok" };
+      } catch {
+        return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal snapshot could not be checked" };
+      } finally {
+        db?.close();
+        await promises.rm(tempDir, { recursive: true, force: true });
+      }
+    } finally {
+      await Promise.all([...opened.values()].map(({ handle }) => handle.close().catch(() => void 0)));
+    }
+  } catch {
+    return { status: "unavailable", reason: "journal files could not be inspected" };
+  }
+}
+async function inspectWorkspace(workspaceRoot) {
+  try {
+    const stat = await promises.stat(workspaceRoot);
+    if (!stat.isDirectory()) return { status: "unavailable", reason: "workspace root is not a directory" };
+    try {
+      await promises.access(workspaceRoot, constants.R_OK | constants.W_OK);
+      return { status: "available", writable: true };
+    } catch {
+      return { status: "available", writable: false };
+    }
+  } catch (err) {
+    if (err.code === "ENOENT") return { status: "missing" };
+    return { status: "unavailable", reason: "workspace root could not be inspected" };
+  }
+}
+function readPinnedQuarantineFile(name, maxBytes, includeBytes, budget) {
+  if (path3__default.basename(name) !== name || name === "." || name === "..") {
+    throw new Error("quarantine manifest contains an invalid evidence name");
+  }
+  const namedBefore = lstatSync(name, { bigint: true });
+  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
+    throw new Error("quarantine entry is not a real regular file");
+  }
+  const fd = openSync(name, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || !sameInode2(opened, namedBefore) || opened.size < 0 || opened.size > BigInt(maxBytes)) {
+      throw new Error("quarantine entry could not be opened as a bounded regular file");
+    }
+    let bytes;
+    if (includeBytes) {
+      const sizeBytes = Number(opened.size);
+      if (sizeBytes > budget.remainingBytes) {
+        throw new Error("quarantine validation exceeds the 128 MiB cumulative read limit");
+      }
+      budget.remainingBytes -= sizeBytes;
+      bytes = Buffer.alloc(sizeBytes);
+      let position = 0;
+      while (position < bytes.length) {
+        const bytesRead = readSync(fd, bytes, position, bytes.length - position, position);
+        if (bytesRead === 0) throw new Error("quarantine entry ended during bounded read");
+        position += bytesRead;
+      }
+    }
+    const openedAfter = fstatSync(fd, { bigint: true });
+    const namedAfter = lstatSync(name, { bigint: true });
+    if (!sameFileState5(openedAfter, opened) || !sameFileState5(namedAfter, opened)) {
+      throw new Error("quarantine entry changed during inspection");
+    }
+    return {
+      sizeBytes: Number(opened.size),
+      modifiedAt: new Date(Number(opened.mtimeMs)).toISOString(),
+      ...bytes === void 0 ? {} : { bytes }
+    };
+  } finally {
+    closeSync(fd);
+  }
+}
+function isHealthQuarantineManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.version === 1 && typeof candidate.quarantinedAt === "string" && Number.isFinite(Date.parse(candidate.quarantinedAt)) && typeof candidate.reason === "string" && typeof candidate.sourcePath === "string" && typeof candidate.evidenceFile === "string" && typeof candidate.sha256 === "string" && /^[0-9a-f]{64}$/.test(candidate.sha256) && Number.isSafeInteger(candidate.sizeBytes) && candidate.sizeBytes >= 0 && candidate.sizeBytes <= MAX_OPERATIONAL_HEALTH_FILE_BYTES;
+}
+function isJournalQuarantineManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return typeof candidate.quarantinedAt === "string" && Number.isFinite(Date.parse(candidate.quarantinedAt)) && typeof candidate.reason === "string" && typeof candidate.originalPath === "string" && Array.isArray(candidate.files) && candidate.files.length > 0 && candidate.files.length <= 3 && candidate.files.every((file) => typeof file === "string");
+}
+function inspectQuarantinePinned(dir, expectedDirectory) {
+  const previousCwd = process.cwd();
+  try {
+    process.chdir(dir);
+    const pinned = lstatSync(".", { bigint: true });
+    if (!pinned.isDirectory() || !sameInode2(pinned, expectedDirectory)) {
+      throw new Error("quarantine directory changed during inspection");
+    }
+    const selected = [];
+    let scanTruncated = false;
+    const directory = opendirSync(".");
+    try {
+      for (; ; ) {
+        const entry = directory.readSync();
+        if (!entry) break;
+        if (selected.length === MAX_QUARANTINE_SCAN_ENTRIES) {
+          scanTruncated = true;
+          break;
+        }
+        selected.push(entry);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    const evidence = /* @__PURE__ */ new Map();
+    const processedManifests = /* @__PURE__ */ new Set();
+    const readBudget = { remainingBytes: MAX_QUARANTINE_READ_BYTES };
+    const processManifest = (manifestName) => {
+      if (processedManifests.has(manifestName)) return;
+      processedManifests.add(manifestName);
+      const manifestFile = readPinnedQuarantineFile(manifestName, MAX_QUARANTINE_MANIFEST_BYTES, true, readBudget);
+      let parsed;
+      try {
+        parsed = JSON.parse(manifestFile.bytes?.toString("utf8") ?? "");
+      } catch {
+        throw new Error("quarantine manifest is invalid JSON");
+      }
+      if (isHealthQuarantineManifest(parsed)) {
+        if (`${parsed.evidenceFile}.manifest.json` !== manifestName) {
+          throw new Error("health quarantine manifest is not bound to its evidence name");
+        }
+        const file = readPinnedQuarantineFile(parsed.evidenceFile, MAX_OPERATIONAL_HEALTH_FILE_BYTES, true, readBudget);
+        if (file.sizeBytes !== parsed.sizeBytes || createHash("sha256").update(file.bytes ?? Buffer.alloc(0)).digest("hex") !== parsed.sha256) {
+          throw new Error("health quarantine evidence does not match its manifest");
+        }
+        if (evidence.has(parsed.evidenceFile)) throw new Error("quarantine evidence is referenced more than once");
+        evidence.set(parsed.evidenceFile, file);
+        return;
+      }
+      if (isJournalQuarantineManifest(parsed)) {
+        const manifestBase = manifestName.slice(0, -".manifest.json".length);
+        const boundNames = parsed.files.map((file) => {
+          if (path3__default.dirname(path3__default.resolve(file)) !== path3__default.resolve(".")) {
+            throw new Error("journal quarantine manifest points outside quarantine");
+          }
+          return path3__default.basename(file);
+        });
+        if (!boundNames.includes(manifestBase)) {
+          throw new Error("journal quarantine manifest is not bound to its primary database evidence");
+        }
+        for (const name of boundNames) {
+          if (evidence.has(name)) throw new Error("quarantine evidence is referenced more than once");
+          evidence.set(name, readPinnedQuarantineFile(name, MAX_JOURNAL_COPY_BYTES, false, readBudget));
+        }
+        return;
+      }
+      throw new Error("quarantine manifest shape is invalid");
+    };
+    for (const entry of selected) {
+      if (entry.name.endsWith(".manifest.json")) processManifest(entry.name);
+    }
+    for (const entry of selected) {
+      if (!entry.name.endsWith(".manifest.json") && !evidence.has(entry.name)) {
+        const primaryName = entry.name.endsWith("-wal") || entry.name.endsWith("-shm") ? entry.name.slice(0, -4) : entry.name;
+        try {
+          processManifest(`${primaryName}.manifest.json`);
+        } catch {
+          throw new Error("quarantine evidence has no valid manifest binding");
+        }
+        if (!evidence.has(entry.name)) throw new Error("quarantine evidence has no valid manifest binding");
+      }
+    }
+    const entries = [...evidence.entries()].slice(0, MAX_QUARANTINE_ENTRIES).map(([name, file]) => ({ nameHash: stableIdentifierHash(name), sizeBytes: file.sizeBytes, modifiedAt: file.modifiedAt })).sort((a, b) => a.nameHash.localeCompare(b.nameHash));
+    return {
+      status: "available",
+      count: evidence.size,
+      scannedCount: selected.length,
+      truncated: scanTruncated || evidence.size > entries.length,
+      entries
+    };
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+async function inspectQuarantine(storeDir) {
+  const dir = path3__default.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
+  let directory;
+  try {
+    directory = await promises.lstat(dir, { bigint: true });
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "missing", count: 0, scannedCount: 0, truncated: false, entries: [] };
+    }
+    return {
+      status: "unavailable",
+      count: 0,
+      scannedCount: 0,
+      truncated: false,
+      entries: [],
+      reason: "quarantine directory could not be inspected"
+    };
+  }
+  if (!directory.isDirectory() || directory.isSymbolicLink()) {
+    return { status: "unavailable", count: 0, scannedCount: 0, truncated: false, entries: [], reason: "quarantine path is not a real directory" };
+  }
+  try {
+    return inspectQuarantinePinned(dir, directory);
+  } catch {
+    return { status: "unavailable", count: 0, scannedCount: 0, truncated: false, entries: [], reason: "quarantine manifest or evidence binding is invalid" };
+  }
+}
+function checksFor(snapshot) {
+  return [
+    {
+      id: "config",
+      status: snapshot.config.serverProtocol === "invalid" ? "fail" : "pass",
+      summary: `server protocol=${snapshot.config.serverProtocol}; hostedJournal=${snapshot.config.hostedJournal}`
+    },
+    {
+      id: "device",
+      status: snapshot.device.status === "unavailable" ? "fail" : snapshot.device.status === "unpaired" ? "warn" : "pass",
+      summary: snapshot.device.status
+    },
+    {
+      id: "runtimes",
+      status: snapshot.runtimes.some((runtime) => runtime.present) ? "pass" : "warn",
+      summary: `${snapshot.runtimes.filter((runtime) => runtime.present).length}/${snapshot.runtimes.length} present; ` + RUNTIME_DETECTION_FAILURE_KINDS.map((kind) => `${kind}=${snapshot.runtimes.filter((runtime) => runtime.outcome === kind).length}`).join(" ")
+    },
+    {
+      id: "control",
+      status: snapshot.control.status === "online" ? "pass" : "warn",
+      summary: snapshot.control.status === "online" ? `online transport=${snapshot.control.transport}` : "daemon offline"
+    },
+    {
+      id: "health",
+      status: snapshot.health.status === "corrupt" || snapshot.health.status === "unavailable" ? "fail" : snapshot.health.status === "missing" ? "warn" : "pass",
+      summary: snapshot.health.status
+    },
+    {
+      id: "journal",
+      status: snapshot.journal.status === "unavailable" || snapshot.journal.status === "corrupt" ? "fail" : snapshot.journal.status === "missing" ? "warn" : "pass",
+      summary: snapshot.journal.status
+    },
+    {
+      id: "workspace",
+      status: snapshot.workspace.status === "unavailable" ? "fail" : snapshot.workspace.status === "missing" || snapshot.workspace.writable === false ? "warn" : "pass",
+      summary: `${snapshot.workspace.status}${snapshot.workspace.writable === false ? "; read-only" : ""}`
+    },
+    {
+      id: "quarantine",
+      status: snapshot.quarantine.status === "unavailable" ? "fail" : snapshot.quarantine.count > 0 ? "warn" : "pass",
+      summary: `${snapshot.quarantine.count} evidence file(s)`
+    }
+  ];
+}
+async function collectDiagnostics(config, storeDir, options = {}) {
+  const resolvedStoreDir = path3__default.resolve(storeDir);
+  const adapters = options.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
+  const connectControl = options.connectControl ?? connectControlClient;
+  const [device, probedRuntimes, health, journal, workspace, quarantine, controlConnection] = await Promise.all([
+    inspectDevice(resolvedStoreDir),
+    probeRuntimes(adapters, { timeoutMs: options.runtimeProbeTimeoutMs }),
+    inspectOperationalHealthFile(resolvedStoreDir),
+    inspectJournal(resolvedStoreDir),
+    inspectWorkspace(config.workspaceRoot),
+    inspectQuarantine(resolvedStoreDir),
+    connectControl({ storeDir: resolvedStoreDir, productId: config.productId })
+  ]);
+  const runtimes = probedRuntimes.map((runtime) => ({
+    idHash: stableIdentifierHash(runtime.id),
+    present: runtime.present,
+    outcome: runtime.outcome,
+    versionPresent: runtime.version !== void 0,
+    ...runtime.authPresent === void 0 ? {} : { authPresent: runtime.authPresent },
+    steer: runtime.steer,
+    resume: runtime.resume,
+    permissionModeCount: runtime.permissionModes.length
+  }));
+  let control;
+  if (!controlConnection.ok) {
+    control = { status: "offline", reason: "daemon control socket unavailable" };
+  } else {
+    try {
+      const live = await controlConnection.client.request("status");
+      control = {
+        status: "online",
+        pid: live.pid,
+        uptimeMs: live.uptimeMs,
+        transport: live.transport,
+        activeTaskCount: live.activeTasks.length,
+        pendingApprovalCount: live.approvalsPending,
+        operationalHealth: live.operationalHealth,
+        ...live.storage ? { storage: live.storage } : {}
+      };
+    } catch {
+      control = { status: "offline", reason: "daemon status request failed" };
+    } finally {
+      controlConnection.client.close();
+    }
+  }
+  const withoutChecks = {
+    version: 1,
+    generatedAt: (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    product: { nameHash: stableIdentifierHash(config.productName), idHash: stableIdentifierHash(config.productId) },
+    system: { node: process.versions.node, platform: process.platform, arch: process.arch, sqliteAvailable: isSqliteAvailable() },
+    config: {
+      serverProtocol: safeProtocol(config.serverUrl),
+      customStoreDir: config.storeDir !== void 0,
+      hostedJournal: config.hostedJournal !== void 0,
+      ...config.runtimeAllowlist ? { runtimeAllowlistCount: config.runtimeAllowlist.length } : {}
+    },
+    device,
+    runtimes,
+    control,
+    health,
+    journal,
+    workspace,
+    quarantine
+  };
+  return { ...withoutChecks, checks: checksFor(withoutChecks) };
+}
+function stableIdentifierHash(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function sameInode2(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function sameFileState5(left, right) {
+  return sameInode2(left, right) && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourcePath, sourceFd, sourceStat, evidenceName, manifestName, quarantinedAt, reason) {
+  const previousCwd = process.cwd();
+  let entered = false;
+  let evidenceCreated = false;
+  let manifestCreated = false;
+  let sourceRemoved = false;
+  let evidenceTemp;
+  let manifestTemp;
+  try {
+    process.chdir(quarantineDir);
+    entered = true;
+    const pinned = lstatSync(".", { bigint: true });
+    if (!pinned.isDirectory() || !sameInode2(pinned, expectedDirectory)) {
+      throw new Error("quarantine path changed before publication; refusing quarantine");
+    }
+    const openSource = fstatSync(sourceFd, { bigint: true });
+    const namedSource = lstatSync(sourcePath, { bigint: true });
+    if (!sameFileState5(openSource, sourceStat) || !sameFileState5(namedSource, sourceStat)) {
+      throw new Error("operational health source identity changed before quarantine");
+    }
+    const sizeBytes = Number(sourceStat.size);
+    if (sizeBytes > MAX_OPERATIONAL_HEALTH_FILE_BYTES) {
+      throw new Error("operational health state exceeds the bounded quarantine read limit");
+    }
+    const bytes = Buffer.alloc(sizeBytes);
+    let position = 0;
+    while (position < sizeBytes) {
+      const bytesRead = readSync(sourceFd, bytes, position, sizeBytes - position, position);
+      if (bytesRead === 0) throw new Error("operational health state ended during bounded copy");
+      position += bytesRead;
+    }
+    const afterRead = fstatSync(sourceFd, { bigint: true });
+    if (!sameFileState5(afterRead, sourceStat)) {
+      throw new Error("operational health state changed during bounded copy");
+    }
+    const sha2562 = createHash("sha256").update(bytes).digest("hex");
+    evidenceTemp = `.${evidenceName}.${randomUUID()}.tmp`;
+    const evidenceFd = openSync(evidenceTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      writeFileSync(evidenceFd, bytes);
+      fchmodSync(evidenceFd, 384);
+      fsyncSync(evidenceFd);
+    } finally {
+      closeSync(evidenceFd);
+    }
+    linkSync(evidenceTemp, evidenceName);
+    evidenceCreated = true;
+    const evidence = lstatSync(evidenceName, { bigint: true });
+    const tempEvidence = lstatSync(evidenceTemp, { bigint: true });
+    if (!evidence.isFile() || !sameInode2(evidence, tempEvidence) || evidence.size !== sourceStat.size) {
+      throw new Error("quarantined operational health evidence does not match the bounded copy");
+    }
+    unlinkSync(evidenceTemp);
+    evidenceTemp = void 0;
+    const finalOpenSource = fstatSync(sourceFd, { bigint: true });
+    const finalNamedSource = lstatSync(sourcePath, { bigint: true });
+    if (!sameFileState5(finalOpenSource, sourceStat) || !sameFileState5(finalNamedSource, sourceStat)) {
+      throw new Error("operational health source changed before removal");
+    }
+    const manifestBody = `${JSON.stringify(
+      {
+        version: 1,
+        quarantinedAt,
+        reason,
+        sourcePath,
+        evidenceFile: evidenceName,
+        sha256: sha2562,
+        sizeBytes
+      },
+      null,
+      2
+    )}
+`;
+    manifestTemp = `.${manifestName}.${randomUUID()}.tmp`;
+    const manifestFd = openSync(manifestTemp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      writeFileSync(manifestFd, manifestBody, "utf8");
+      fchmodSync(manifestFd, 384);
+      fsyncSync(manifestFd);
+    } finally {
+      closeSync(manifestFd);
+    }
+    linkSync(manifestTemp, manifestName);
+    manifestCreated = true;
+    unlinkSync(manifestTemp);
+    manifestTemp = void 0;
+    if (process.platform !== "win32") {
+      const quarantineDirectoryFd = openSync(".", constants.O_RDONLY);
+      try {
+        fsyncSync(quarantineDirectoryFd);
+      } finally {
+        closeSync(quarantineDirectoryFd);
+      }
+    }
+    const removalOpenSource = fstatSync(sourceFd, { bigint: true });
+    const removalNamedSource = lstatSync(sourcePath, { bigint: true });
+    if (!sameFileState5(removalOpenSource, sourceStat) || !sameFileState5(removalNamedSource, sourceStat)) {
+      throw new Error("operational health source changed before removal");
+    }
+    unlinkSync(sourcePath);
+    sourceRemoved = true;
+    if (process.platform !== "win32") {
+      const directoryFd = openSync(path3__default.dirname(sourcePath), constants.O_RDONLY);
+      try {
+        fsyncSync(directoryFd);
+      } finally {
+        closeSync(directoryFd);
+      }
+    }
+    return { sha256: sha2562, sizeBytes };
+  } catch (err) {
+    if (evidenceTemp) {
+      try {
+        unlinkSync(evidenceTemp);
+      } catch {
+      }
+    }
+    if (manifestTemp) {
+      try {
+        unlinkSync(manifestTemp);
+      } catch {
+      }
+    }
+    if (manifestCreated && !sourceRemoved) {
+      try {
+        unlinkSync(manifestName);
+      } catch {
+      }
+    }
+    if (evidenceCreated && !sourceRemoved) {
+      try {
+        unlinkSync(evidenceName);
+      } catch {
+      }
+    }
+    throw err;
+  } finally {
+    if (entered) process.chdir(previousCwd);
+  }
+}
+async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
+  const resolvedStoreDir = path3__default.resolve(storeDir);
+  const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
+  try {
+    const sourcePath = path3__default.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
+    let opened;
+    try {
+      opened = await openOperationalHealthFile(resolvedStoreDir);
+    } catch (err) {
+      throw new Error("operational health state could not be opened safely; refusing quarantine", { cause: err });
+    }
+    if (!opened) return { status: "not-needed", reason: "missing" };
+    const source = opened.handle;
+    try {
+      const inspection = await inspectOperationalHealthHandle(source, opened.stat);
+      if (inspection.status === "valid") return { status: "not-needed", reason: "valid" };
+      if (inspection.status === "unavailable") {
+        throw new Error(`${inspection.reason}; refusing to quarantine unconfirmed corruption`);
+      }
+      const sourceStat = await source.stat({ bigint: true });
+      if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
+      const quarantineDir = path3__default.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
+      try {
+        const existing = await promises.lstat(quarantineDir);
+        if (!existing.isDirectory() || existing.isSymbolicLink()) {
+          throw new Error("quarantine path is not a real directory; refusing quarantine");
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+        await promises.mkdir(quarantineDir, { mode: 448 });
+      }
+      await ensureSecureDir(quarantineDir);
+      const securedQuarantine = await promises.lstat(quarantineDir, { bigint: true });
+      if (!securedQuarantine.isDirectory() || securedQuarantine.isSymbolicLink()) {
+        throw new Error("quarantine path changed during validation; refusing quarantine");
+      }
+      const stamp = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString().replace(/[:.]/g, "-");
+      const evidenceName = `${stamp}-${randomUUID()}-${OPERATIONAL_HEALTH_FILENAME}`;
+      const manifestName = `${evidenceName}.manifest.json`;
+      const hashed = publishQuarantineEvidencePinned(
+        quarantineDir,
+        securedQuarantine,
+        sourcePath,
+        source.fd,
+        sourceStat,
+        evidenceName,
+        manifestName,
+        (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+        inspection.reason
+      );
+      return { status: "quarantined", evidenceName, manifestName, sha256: hashed.sha256, sizeBytes: hashed.sizeBytes };
+    } finally {
+      await source.close();
+    }
+  } finally {
+    await owner.release();
+  }
+}
+
+// src/diagnostics/device-doctor.ts
+function diagnoseDevice(config, options = {}) {
+  return collectDiagnostics(config, DeviceStore.resolveDir(config.productId, config.storeDir), {
+    adapters: options.adapters,
+    runtimeProbeTimeoutMs: options.runtimeProbeTimeoutMs
+  });
+}
+var MESSAGES = {
+  "confirmation-required": "Explicit confirmation is required for enrollment metadata repair.",
+  "invalid-target": "An explicit expected tenant and device are required.",
+  "daemon-running": "Stop the daemon before enrollment metadata repair.",
+  "store-busy": "The store is owned by another operation; enrollment metadata repair refused.",
+  "authority-unavailable": "The OS enrollment authority could not be read.",
+  "authority-missing": "No complete OS enrollment exists; use explicit authenticated pairing.",
+  "target-mismatch": "The OS enrollment does not match the expected tenant and device.",
+  "projection-unavailable": "The enrollment metadata could not be read safely; repair refused.",
+  "repair-failed": "Enrollment metadata repair did not complete; inspect the state before retrying."
+};
+var DeviceMetadataRepairError = class extends Error {
+  constructor(code) {
+    super(MESSAGES[code]);
+    this.code = code;
+    this.name = "DeviceMetadataRepairError";
+  }
+  code;
+};
+async function repairDeviceEnrollmentMetadata(config, input) {
+  if (input?.confirmed !== true) throw new DeviceMetadataRepairError("confirmation-required");
+  if (typeof input.expectedDeviceId !== "string" || input.expectedDeviceId.trim().length === 0 || !isTenantId(input.expectedTenantId)) {
+    throw new DeviceMetadataRepairError("invalid-target");
+  }
+  const { expectedDeviceId, expectedTenantId } = input;
+  const productId = config.productId;
+  let failureCode = "repair-failed";
+  try {
+    const storeDir = DeviceStore.resolveDir(productId, config.storeDir);
+    const control = await connectControlClient({ storeDir, productId });
+    if (control.ok) {
+      control.client.close();
+      throw new DeviceMetadataRepairError("daemon-running");
+    }
+    const owner = await acquireDaemonOwner(storeDir, "doctor");
+    try {
+      const store = new DeviceStore(storeDir, void 0, productId);
+      failureCode = "projection-unavailable";
+      await store.load();
+      failureCode = "authority-unavailable";
+      const authority = await store.credentials.read();
+      if (authority === void 0) throw new DeviceMetadataRepairError("authority-missing");
+      if (authority.deviceId !== expectedDeviceId || authority.tenantId !== expectedTenantId) {
+        throw new DeviceMetadataRepairError("target-mismatch");
+      }
+      failureCode = "repair-failed";
+      const changed = await store.reconcileMetadata(authority);
+      const readback = await store.load();
+      if (readback === void 0 || readback.deviceId !== authority.deviceId || readback.tenantId !== authority.tenantId || readback.devicePublicKey !== authority.devicePublicKey) {
+        throw new DeviceMetadataRepairError("repair-failed");
+      }
+      return { action: "restore-enrollment-metadata", scope: "device", status: changed ? "repaired" : "not-needed" };
+    } catch (error) {
+      if (error instanceof DeviceMetadataRepairError) throw error;
+      throw new DeviceMetadataRepairError(failureCode);
+    } finally {
+      failureCode = "repair-failed";
+      await owner.release();
+    }
+  } catch (error) {
+    if (error instanceof DeviceMetadataRepairError) throw error;
+    if (error instanceof DaemonOwnerActiveError) throw new DeviceMetadataRepairError("store-busy");
+    throw new DeviceMetadataRepairError(failureCode);
+  }
+}
+function auditLogPath(storeDir) {
+  return path3__default.join(storeDir, "audit.jsonl");
+}
+new Set(GIT_ERROR_CATEGORIES);
+
+// src/diagnostics/support-bundle.ts
+var MAX_SUPPORT_AUDIT_TAIL_BYTES = 256 * 1024;
+var MAX_SUPPORT_AUDIT_FACTS = 200;
+var AUDIT_KINDS = /* @__PURE__ */ new Set([
+  "artifact",
+  "awaiting-approval",
+  "cancelled",
+  "claimed",
+  "completed",
+  "connection",
+  "failed",
+  "git-workspace",
+  "offered",
+  "paired",
+  "progress",
+  "runtimes-detected",
+  "shutdown-complete",
+  "shutdown-requested",
+  "stale-approval-decision",
+  "started",
+  "unpaired"
+]);
+function isAuditKind(value) {
+  return typeof value === "string" && AUDIT_KINDS.has(value);
+}
+function sameFileState6(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+async function recentAuditFacts(storeDir) {
+  const filePath = auditLogPath(storeDir);
+  let pathStat;
+  try {
+    pathStat = await promises.lstat(filePath, { bigint: true });
+    if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+  }
+  let handle;
+  try {
+    handle = await promises.open(
+      filePath,
+      constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
+    );
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+  }
+  try {
+    const stat = await handle.stat({ bigint: true });
+    const namedAfterOpen = await promises.lstat(filePath, { bigint: true });
+    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState6(pathStat, stat) || !sameFileState6(stat, namedAfterOpen)) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    const sourceSize = Number(stat.size);
+    const length = Math.min(sourceSize, MAX_SUPPORT_AUDIT_TAIL_BYTES);
+    const start = Math.max(0, sourceSize - length);
+    const buffer = Buffer.alloc(length);
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    const afterRead = await handle.stat({ bigint: true });
+    const namedAfterRead = await promises.lstat(filePath, { bigint: true });
+    if (bytesRead !== length || namedAfterRead.isSymbolicLink() || !sameFileState6(stat, afterRead) || !sameFileState6(afterRead, namedAfterRead)) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    let text = buffer.subarray(0, bytesRead).toString("utf8");
+    if (start > 0) text = text.slice(Math.max(0, text.indexOf("\n") + 1));
+    const lines = text.split("\n").filter(Boolean).slice(-MAX_SUPPORT_AUDIT_FACTS);
+    const facts = [];
+    for (const line of lines) {
+      try {
+        const value = JSON.parse(line);
+        if (isAuditKind(value.kind) && typeof value.ts === "string" && Number.isFinite(Date.parse(value.ts))) {
+          facts.push({ kind: value.kind, ts: new Date(Date.parse(value.ts)).toISOString() });
+        }
+      } catch {
+      }
+    }
+    return { status: "available", included: facts.length, sourceBytesRead: bytesRead, sourceTruncated: sourceSize > bytesRead, facts };
+  } catch {
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+  } finally {
+    await handle.close();
+  }
+}
+function projectControl(control) {
+  if (control.status === "offline") return { status: "offline" };
+  const transport = ["connecting", "open", "closed", "revoked"].includes(control.transport) ? control.transport : "unavailable";
+  const operationalHealth = control.operationalHealth.availability === "available" ? {
+    availability: "available",
+    state: control.operationalHealth.state,
+    failureCount: control.operationalHealth.failureCount,
+    windowMs: control.operationalHealth.windowMs,
+    failureThreshold: control.operationalHealth.failureThreshold,
+    crashCount: control.operationalHealth.crashCount
+  } : { availability: "unavailable" };
+  return {
+    status: "online",
+    pid: control.pid,
+    uptimeMs: control.uptimeMs,
+    transport,
+    activeTaskCount: control.activeTaskCount,
+    pendingApprovalCount: control.pendingApprovalCount,
+    operationalHealth,
+    storagePresent: control.storage !== void 0
+  };
+}
+async function createSupportBundle(config, storeDir, options = {}) {
+  const [snapshot, recentEvents] = await Promise.all([collectDiagnostics(config, storeDir, options), recentAuditFacts(storeDir)]);
+  return {
+    version: 1,
+    generatedAt: snapshot.generatedAt,
+    product: snapshot.product,
+    system: snapshot.system,
+    config: {
+      serverProtocol: snapshot.config.serverProtocol,
+      customStoreDir: snapshot.config.customStoreDir,
+      hostedJournal: snapshot.config.hostedJournal,
+      ...snapshot.config.runtimeAllowlistCount === void 0 ? {} : { runtimeAllowlistCount: snapshot.config.runtimeAllowlistCount }
+    },
+    device: {
+      status: snapshot.device.status,
+      ...snapshot.device.deviceIdHash ? { deviceIdHash: snapshot.device.deviceIdHash } : {}
+    },
+    runtimes: snapshot.runtimes,
+    control: projectControl(snapshot.control),
+    health: snapshot.health,
+    journal: snapshot.journal,
+    workspace: snapshot.workspace,
+    quarantine: {
+      status: snapshot.quarantine.status,
+      count: snapshot.quarantine.count,
+      scannedCount: snapshot.quarantine.scannedCount,
+      truncated: snapshot.quarantine.truncated,
+      entries: snapshot.quarantine.entries
+    },
+    checks: snapshot.checks.map(({ id, status }) => ({ id, status })),
+    recentEvents,
+    redaction: {
+      policy: "allowlist-v1",
+      omitted: [
+        "server URL host/path/query",
+        "store/workspace/config paths",
+        "control token and provider credentials",
+        "task, prompt, tool input/output and approval text",
+        "raw audit and quarantine contents"
+      ],
+      transformed: ["productName/productId/deviceId/runtimeId/quarantine filenames -> SHA-256", "audit events -> closed kind/timestamp only"]
+    }
+  };
+}
+async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
+  const dir = path3__default.dirname(outputPath);
+  const parentStat = await promises.stat(dir);
+  if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
+  const privateDir = path3__default.join(dir, `.${path3__default.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
+  const tempPath = path3__default.join(privateDir, "bundle.tmp");
+  try {
+    await promises.mkdir(privateDir, { mode: 448 });
+    await ensureSecureDir(privateDir, secureFileOptions);
+    await atomicWriteFile(tempPath, `${JSON.stringify(bundle, null, 2)}
+`, { mode: 384, fsync: true });
+    await ensureSecureFile(tempPath, secureFileOptions);
+    await promises.link(tempPath, outputPath);
+    const published = await promises.open(outputPath, "r+");
+    try {
+      await published.sync();
+    } finally {
+      await published.close();
+    }
+    if (process.platform !== "win32") {
+      const parent = await promises.open(dir, "r");
+      try {
+        await parent.sync();
+      } finally {
+        await parent.close();
+      }
+    }
+  } finally {
+    await promises.rm(privateDir, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+
+// src/diagnostics/operator-actions.ts
+var MESSAGES2 = {
+  "confirmation-required": "Explicit confirmation is required for this local maintenance action.",
+  "invalid-input": "The maintenance action requires valid explicit inputs.",
+  "daemon-running": "Stop the host daemon before local maintenance.",
+  "store-busy": "Another operation owns the device store.",
+  "agent-busy": "Another operation owns the Agent home.",
+  "target-mismatch": "The stored device or Agent records do not match the authorized target.",
+  "source-unavailable": "The local source cannot be accessed safely; preserve it for inspection.",
+  "output-exists": "The selected output already exists; it will not be overwritten.",
+  "operation-failed": "The maintenance operation did not complete; preserve evidence before retrying."
+};
+var DeviceOperatorError = class extends Error {
+  constructor(code) {
+    super(MESSAGES2[code]);
+    this.code = code;
+    this.name = "DeviceOperatorError";
+  }
+  code;
+};
+function requireConfirmation(input) {
+  if (input?.confirmed !== true) throw new DeviceOperatorError("confirmation-required");
+}
+function closedError(error) {
+  if (error instanceof DeviceOperatorError) return error;
+  if (error instanceof DaemonOwnerActiveError) return new DeviceOperatorError("store-busy");
+  if (error instanceof AgentHomeBusyError) return new DeviceOperatorError("agent-busy");
+  return new DeviceOperatorError("operation-failed");
+}
+async function requireOffline(config, storeDir) {
+  const control = await connectControlClient({ productId: config.productId, storeDir });
+  if (control.ok) {
+    control.client.close();
+    throw new DeviceOperatorError("daemon-running");
+  }
+}
+async function quarantineDeviceOperationalHealth(config, input) {
+  requireConfirmation(input);
+  try {
+    const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
+    await requireOffline(config, storeDir);
+    const result = await quarantineCorruptOperationalHealth(storeDir);
+    return { action: "quarantine-operational-health", scope: "device", ...result };
+  } catch (error) {
+    throw closedError(error);
+  }
+}
+async function exportDeviceSupportBundle(config, input) {
+  if (typeof input?.outputPath !== "string" || !path3__default.isAbsolute(input.outputPath)) {
+    throw new DeviceOperatorError("invalid-input");
+  }
+  try {
+    const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
+    const bundle = await createSupportBundle(config, storeDir, {
+      adapters: input.adapters,
+      runtimeProbeTimeoutMs: input.runtimeProbeTimeoutMs
+    });
+    await writeSupportBundle(input.outputPath, bundle);
+    return { action: "export-support-bundle", scope: "device", status: "written", bundleVersion: bundle.version };
+  } catch (error) {
+    if (error?.code === "EEXIST") throw new DeviceOperatorError("output-exists");
+    throw closedError(error);
+  }
+}
+async function existingOutbox(home) {
+  const components = [
+    home,
+    path3__default.join(home, AGENT_HOME_INTERNAL_DIRECTORY),
+    path3__default.join(home, AGENT_MESSAGE_DIRECTORY),
+    path3__default.join(home, AGENT_MESSAGE_DIRECTORY, AGENT_MESSAGE_OUTBOX_FILENAME)
+  ];
+  for (let index = 0; index < components.length; index += 1) {
+    let stat;
+    try {
+      stat = await promises.lstat(components[index]);
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw new DeviceOperatorError("source-unavailable");
+    }
+    if (stat.isSymbolicLink() || (index === components.length - 1 ? !stat.isFile() : !stat.isDirectory())) {
+      throw new DeviceOperatorError("source-unavailable");
+    }
+  }
+  return true;
+}
+async function archiveAgentTerminalMessages(config, input) {
+  requireConfirmation(input);
+  const parsedRef = AgentRefSchema.safeParse(input.agentRef);
+  if (!parsedRef.success || !isTenantId(input.expectedTenantId) || typeof input.expectedDeviceId !== "string" || !input.expectedDeviceId.trim() || typeof input.archiveDirectory !== "string" || !path3__default.isAbsolute(input.archiveDirectory) || !config.agentHome) {
+    throw new DeviceOperatorError("invalid-input");
+  }
+  const notNeeded = { action: "archive-terminal-messages", scope: "agent", status: "not-needed" };
+  try {
+    const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
+    await requireOffline(config, storeDir);
+    const owner = await acquireDaemonOwner(storeDir, "doctor");
+    try {
+      const metadata = await new DeviceStore(storeDir, void 0, config.productId).load();
+      if (!metadata || metadata.deviceId !== input.expectedDeviceId || metadata.tenantId !== input.expectedTenantId) {
+        throw new DeviceOperatorError("target-mismatch");
+      }
+      const manager = new AgentHomeManager({
+        hostStorageRoot: config.agentHome.hostStorageRoot,
+        leaseManager: new AgentHomeLeaseManager({ ownerId: stableAgentHomeOwnerId(storeDir, config.productId) })
+      });
+      const home = await manager.layout.canonicalHomePath(parsedRef.data);
+      if (!await existingOutbox(home)) return notNeeded;
+      const binding = await manager.acquire(parsedRef.data);
+      try {
+        if (!await existingOutbox(binding.lease.cwd)) throw new DeviceOperatorError("source-unavailable");
+        const outbox = await AgentMessageOutbox.open(binding.lease.cwd);
+        const records = outbox.records();
+        if (records.some((record3) => record3.tenantId !== input.expectedTenantId || record3.agentRef.agentId !== parsedRef.data.agentId)) {
+          throw new DeviceOperatorError("target-mismatch");
+        }
+        const archivedRecords = outbox.terminalRecords().length;
+        if (archivedRecords === 0) return notNeeded;
+        try {
+          await promises.mkdir(input.archiveDirectory, { mode: 448 });
+        } catch (error) {
+          if (error.code === "EEXIST") throw new DeviceOperatorError("output-exists");
+          throw error;
+        }
+        const archivePath = await outbox.archiveTerminalRecords(input.archiveDirectory);
+        if (!archivePath) throw new DeviceOperatorError("operation-failed");
+        return {
+          action: "archive-terminal-messages",
+          scope: "agent",
+          status: "archived",
+          archivedRecords,
+          archiveFileName: path3__default.basename(archivePath)
+        };
+      } finally {
+        await binding.lease.release();
+      }
+    } finally {
+      await owner.release();
+    }
+  } catch (error) {
+    throw closedError(error);
+  }
+}
+
+export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_HOME_PROJECTION_STATE_FILE, AGENT_MEMORY_AUDIT_FILENAME, AGENT_MEMORY_OUTBOX_FILENAME, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentMemoryError, AgentMemoryRevisionConflictError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, BYOK_SDK_HELPER_SUBCOMMAND, BlobClient, BlobRequestAbortedError, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, DeviceMetadataRepairError, DeviceOperatorError, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStateRelocationBusyError, LocalStateRelocationError, LocalStateRelocationIntegrityError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, LocalTeamWorkspace, LocalTeamWorkspace as LocalTeamWorkspaceService, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, ReplayCursorTooOldError, RuntimeDisposalFailure, RuntimeExecutionFailure, RuntimeStartupDisposalFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, TeamTmuxViewError, TeamWorkspaceConflictError, TeamWorkspaceCorruptError, TeamWorkspaceError, TeamWorkspaceLeaseError, TeamWorkspaceNotFoundError, TeamWorkspaceQuotaError, TeamWorkspaceReceiptError, TeamWorkspaceValidationError, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, archiveAgentTerminalMessages, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createAgentHomeProjectionConsumer, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, decodeTeamMemberContext, diagnoseDevice, encodeTeamMemberContext, ensureSecureDir, exportDeviceSupportBundle, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isAgentMemorySecureFilesystemAvailable, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, isRuntimeStartupDisposalFailure, journalHash, listInstalledSkillPacks, localStateRelocation, nodeAgentProgram, openTeamTmuxView, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, quarantineDeviceOperationalHealth, readDeviceEnrollmentStatus, repairDeviceEnrollmentMetadata, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, resolveSdkReservedHelperBin, runSdkReservedHelperCommand, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map