@byok-sdk/client 0.2.0 → 0.4.0

package/dist/bin/byok-agent.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { execFile, spawn, spawnSync } from 'child_process';
-import { randomUUID, createHash, randomBytes, timingSafeEqual, createPrivateKey, generateKeyPairSync, sign, createHmac } from 'crypto';
+import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, createPrivateKey, generateKeyPairSync, sign } from 'crypto';
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
-import path20, { join, isAbsolute } from 'path';
+import path20, { isAbsolute, join } from 'path';
 import os from 'os';
-import { TASK_STATES, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, createEnvelope, MAX_MESSAGES_PER_BATCH, RuntimeIdSchema, PROTOCOL_VERSION, decodeEnvelope, MessagesSendResponseSchema, parseMessage, UnknownMessageTypeError } from '@byok-sdk/protocol';
+import { DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
+import { TASK_STATES, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, createEnvelope, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, RESULT_DOCUMENT_MAX_BYTES, PROTOCOL_VERSION, decodeEnvelope, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, BYOK_EVENTS_PATH, parseMessage, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import 'readline';
@@ -14,6 +15,52 @@ import { createRequire } from 'module';
 import { createInterface } from 'readline/promises';
 
 // src/types.ts
+function frozenStrings(values) {
+  return values === void 0 ? void 0 : Object.freeze([...values]);
+}
+function frozenPolicy(policy) {
+  const allowTools = policy.allowTools === void 0 ? void 0 : Object.freeze([...policy.allowTools]);
+  const denyTools = policy.denyTools === void 0 ? void 0 : Object.freeze([...policy.denyTools]);
+  return Object.freeze({
+    mode: policy.mode,
+    ...allowTools === void 0 ? {} : { allowTools },
+    ...denyTools === void 0 ? {} : { denyTools },
+    ...policy.workspaceRoot === void 0 ? {} : { workspaceRoot: policy.workspaceRoot },
+    ...policy.network === void 0 ? {} : { network: policy.network }
+  });
+}
+function freezeRuntimeAdapterDescriptor(descriptor) {
+  const baseNames = frozenStrings(descriptor.environmentRequirements.baseNames);
+  const credentialNames = frozenStrings(descriptor.environmentRequirements.credentialNames);
+  return Object.freeze({
+    id: descriptor.id,
+    supportsDispatchSelection: descriptor.supportsDispatchSelection === true,
+    capabilities: Object.freeze({
+      steer: descriptor.capabilities.steer === true,
+      resume: descriptor.capabilities.resume === true,
+      approvalInteractive: descriptor.capabilities.approvalInteractive === true,
+      ...descriptor.capabilities.mcpToolsets === void 0 ? {} : { mcpToolsets: descriptor.capabilities.mcpToolsets === true },
+      permissionModes: Object.freeze([...descriptor.capabilities.permissionModes])
+    }),
+    environmentRequirements: Object.freeze({
+      ...baseNames === void 0 ? {} : { baseNames },
+      ...credentialNames === void 0 ? {} : { credentialNames }
+    })
+  });
+}
+function sealRuntimeOperationManifest(manifest) {
+  return Object.freeze({
+    taskId: manifest.taskId,
+    runtimeId: manifest.runtimeId,
+    descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
+    policy: frozenPolicy(manifest.policy),
+    requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
+    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
+    ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
+    workspace: Object.freeze({ ...manifest.workspace }),
+    forwardedEnvironmentNames: Object.freeze([...manifest.forwardedEnvironmentNames])
+  });
+}
 var PolicyUnsupportedError = class extends Error {
   constructor(message) {
     super(message);
@@ -21,7 +68,7 @@ var PolicyUnsupportedError = class extends Error {
   }
 };
 var SteerUnsupportedError = class extends Error {
-  /** The `RuntimeAdapter.id` that cannot steer (e.g. `claude`, `codex`). */
+  /** The `RuntimeAdapter.descriptor.id` that cannot steer (e.g. `claude`, `codex`). */
   runtimeId;
   constructor(runtimeId, message) {
     super(message);
@@ -29,6 +76,112 @@ var SteerUnsupportedError = class extends Error {
     this.runtimeId = runtimeId;
   }
 };
+
+// src/runtime-failure.ts
+var RUNTIME_EXECUTION_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeExecutionFailure/v1");
+var RUNTIME_DISPOSAL_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeDisposalFailure/v1");
+var RuntimeDisposalFailure = class extends Error {
+  stage;
+  constructor(input, options) {
+    if (!isRuntimeDisposalStage(input.stage) || typeof input.reason !== "string" || input.reason.length === 0) {
+      throw new TypeError("invalid RuntimeDisposalFailure input");
+    }
+    super(input.reason, options);
+    this.name = "RuntimeDisposalFailure";
+    this.stage = input.stage;
+    Object.defineProperty(this, RUNTIME_DISPOSAL_FAILURE_BRAND, { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeDisposalStage(value) {
+  return value === "signal" || value === "quiescence" || value === "cleanup";
+}
+function isRuntimeDisposalFailure(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate[RUNTIME_DISPOSAL_FAILURE_BRAND] === true && isRuntimeDisposalStage(candidate.stage) && typeof candidate.message === "string" && candidate.message.length > 0;
+}
+var RuntimeExecutionFailure = class extends Error {
+  phase;
+  category;
+  retry;
+  constructor(input, options) {
+    if (!isRuntimeFailurePhase(input.phase) || !isRuntimeFailureCategory(input.category) || !isRuntimeRetryDisposition(input.retry) || typeof input.reason !== "string" || input.reason.length === 0) {
+      throw new TypeError("invalid RuntimeExecutionFailure input");
+    }
+    super(input.reason, options);
+    this.name = "RuntimeExecutionFailure";
+    this.phase = input.phase;
+    this.category = input.category;
+    this.retry = input.retry;
+    Object.defineProperty(this, RUNTIME_EXECUTION_FAILURE_BRAND, { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeFailurePhase(value) {
+  return value === "start" || value === "run";
+}
+function isRuntimeFailureCategory(value) {
+  return value === "semantic" || value === "infrastructure" || value === "authority";
+}
+function isRuntimeRetryDisposition(value) {
+  return value === "retryable" || value === "non-retryable";
+}
+function isRuntimeExecutionFailure(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate[RUNTIME_EXECUTION_FAILURE_BRAND] === true && isRuntimeFailurePhase(candidate.phase) && isRuntimeFailureCategory(candidate.category) && isRuntimeRetryDisposition(candidate.retry) && typeof candidate.message === "string" && candidate.message.length > 0;
+}
+function retryableFromDisposition(disposition) {
+  switch (disposition) {
+    case "retryable":
+      return true;
+    case "non-retryable":
+      return false;
+  }
+}
+function projectRuntimeExecutionFailure(failure) {
+  return {
+    reason: failure.message,
+    retryable: retryableFromDisposition(failure.retry)
+  };
+}
+var RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON = Object.freeze({
+  start: "runtime adapter contract violation during start",
+  run: "runtime adapter contract violation during run"
+});
+function projectRuntimeBoundaryFailure(value, expectedPhase) {
+  if (isRuntimeExecutionFailure(value) && value.phase === expectedPhase) {
+    return { ...projectRuntimeExecutionFailure(value), contractViolation: false };
+  }
+  return {
+    reason: RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON[expectedPhase],
+    retryable: false,
+    contractViolation: true
+  };
+}
+var GIT_ERROR_CATEGORIES = [
+  "git-unavailable",
+  "git-timeout",
+  "git-output-limit",
+  "git-command-failed",
+  "workspace-root-invalid",
+  "workspace-root-conflict",
+  "workspace-not-owned",
+  "repository-root-mismatch",
+  "repository-invalid",
+  "lease-busy",
+  "ledger-invalid"
+];
+var GIT_WORKSPACE_PHASES = [
+  "preparing",
+  "active",
+  "completed",
+  "failed",
+  "cancelled",
+  "interrupted",
+  "salvage"
+];
 var GitWorkspaceError = class extends Error {
   constructor(category, message = category) {
     super(message);
@@ -944,6 +1097,155 @@ var AsyncQueue = class {
     };
   }
 };
+var DEFAULT_TERM_GRACE_MS = 750;
+var DEFAULT_KILL_GRACE_MS = 2e3;
+var POLL_MS = 20;
+var terminationRequested = /* @__PURE__ */ new WeakSet();
+var terminationRequestFailed = /* @__PURE__ */ new WeakSet();
+function withOwnedProcessTree(options) {
+  return {
+    ...options,
+    ...process.platform === "win32" ? { windowsHide: true } : { detached: true }
+  };
+}
+function positivePid(child, label) {
+  const pid = child.pid;
+  if (pid === void 0) return void 0;
+  if (!Number.isSafeInteger(pid) || pid <= 0 || pid === process.pid) {
+    throw new RuntimeDisposalFailure({
+      stage: "signal",
+      reason: `${label} runtime process has an unsafe owned pid`
+    });
+  }
+  return pid;
+}
+function groupExists(pid, label) {
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch (cause) {
+    const code = cause.code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    throw new RuntimeDisposalFailure({
+      stage: "quiescence",
+      reason: `${label} runtime process-group state could not be verified`
+    }, { cause });
+  }
+}
+function signalGroup(pid, signal, label) {
+  try {
+    process.kill(-pid, signal);
+  } catch (cause) {
+    const code = cause.code;
+    if (code === "ESRCH" || code === "EPERM") return;
+    throw new RuntimeDisposalFailure({
+      stage: "signal",
+      reason: `${label} runtime process group ${pid} could not receive ${signal} (${code ?? "unknown"})`
+    }, { cause });
+  }
+}
+async function waitUntil(predicate, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (predicate()) {
+    if (Date.now() >= deadline) return false;
+    await new Promise((resolve) => {
+      setTimeout(resolve, POLL_MS);
+    });
+  }
+  return true;
+}
+async function waitWithDeadline(promise, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        resolve(false);
+      }
+    }, timeoutMs);
+    void promise.then(
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolve(true);
+        }
+      },
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolve(false);
+        }
+      }
+    );
+  });
+}
+function requestOwnedProcessTreeTermination(options) {
+  if (options.isClosed()) return;
+  const pid = positivePid(options.child, options.label);
+  if (pid === void 0) return;
+  if (process.platform === "win32") {
+    const result = spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true });
+    if (result.error) {
+      throw new RuntimeDisposalFailure({
+        stage: "signal",
+        reason: `${options.label} runtime process tree could not be terminated`
+      }, { cause: result.error });
+    }
+    terminationRequested.add(options.child);
+    if (result.status !== 0) terminationRequestFailed.add(options.child);
+    return;
+  }
+  signalGroup(pid, "SIGTERM", options.label);
+  terminationRequested.add(options.child);
+}
+async function disposeOwnedProcessTree(options) {
+  const pid = positivePid(options.child, options.label);
+  const termGraceMs = options.termGraceMs ?? DEFAULT_TERM_GRACE_MS;
+  const killGraceMs = options.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+  if (pid === void 0) {
+    if (await waitWithDeadline(options.waitClosed(), killGraceMs)) return;
+    throw new RuntimeDisposalFailure({
+      stage: "quiescence",
+      reason: `${options.label} runtime process did not settle after spawn failure`
+    });
+  }
+  if (process.platform === "win32") {
+    if (!options.isClosed() && !terminationRequested.has(options.child)) requestOwnedProcessTreeTermination(options);
+    if (await waitWithDeadline(options.waitClosed(), killGraceMs)) return;
+    if (terminationRequestFailed.has(options.child)) {
+      throw new RuntimeDisposalFailure({
+        stage: "signal",
+        reason: `${options.label} runtime process tree could not be terminated`
+      });
+    }
+    throw new RuntimeDisposalFailure({
+      stage: "quiescence",
+      reason: `${options.label} runtime process tree did not close before the disposal deadline`
+    });
+  }
+  if (groupExists(pid, options.label) && !terminationRequested.has(options.child)) {
+    signalGroup(pid, "SIGTERM", options.label);
+    terminationRequested.add(options.child);
+  }
+  if (!await waitUntil(() => groupExists(pid, options.label), termGraceMs)) {
+    signalGroup(pid, "SIGKILL", options.label);
+    if (!await waitUntil(() => groupExists(pid, options.label), killGraceMs)) {
+      throw new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: `${options.label} runtime process group remained live after SIGKILL`
+      });
+    }
+  }
+  if (!await waitWithDeadline(options.waitClosed(), killGraceMs)) {
+    throw new RuntimeDisposalFailure({
+      stage: "quiescence",
+      reason: `${options.label} runtime root did not emit close after its process group exited`
+    });
+  }
+}
 
 // src/adapters/pi/rpc-client.ts
 var STDERR_RING_CAPACITY = 20;
@@ -956,16 +1258,22 @@ var PiRpcClient = class {
   eventQueue = new AsyncQueue();
   closed = false;
   exitError;
+  closedPromise;
+  resolveClosed;
+  disposalAttempt;
   /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
   stderrRing = [];
   /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
   unmappedFrameCounts = /* @__PURE__ */ new Map();
   constructor(options) {
     const spawnFn = options.spawnFn ?? spawn;
-    this.child = spawnFn(options.command, options.args, {
+    this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"]
+    }));
+    this.closedPromise = new Promise((resolve) => {
+      this.resolveClosed = resolve;
     });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
@@ -1000,6 +1308,10 @@ var PiRpcClient = class {
   get events() {
     return this.eventQueue;
   }
+  /** Local transport diagnostic retained when the process closes; consumers must classify it explicitly. */
+  get terminalError() {
+    return this.exitError;
+  }
   /**
    * Record a pi RPC message `type` that `PiSession` (pi-adapter.ts) decided
    * has no `AgentEvent` mapping and isn't routine bookkeeping (see
@@ -1018,15 +1330,30 @@ var PiRpcClient = class {
       );
     }
   }
-  /** Best-effort teardown. SIGTERM on POSIX; `taskkill /T /F` on Windows to also reap child processes pi itself spawned (e.g. bash). */
+  /** Immediate process-tree termination request. `dispose()` is the settlement receipt. */
   kill() {
-    if (this.closed) return;
-    const pid = this.child.pid;
-    if (process.platform === "win32" && pid !== void 0) {
-      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
-    } else {
-      this.child.kill("SIGTERM");
+    requestOwnedProcessTreeTermination(this.processTreeOptions());
+  }
+  waitClosed() {
+    return this.closedPromise;
+  }
+  dispose() {
+    if (!this.disposalAttempt) {
+      const attempt = disposeOwnedProcessTree(this.processTreeOptions());
+      this.disposalAttempt = attempt.catch((error) => {
+        this.disposalAttempt = void 0;
+        throw error;
+      });
     }
+    return this.disposalAttempt;
+  }
+  processTreeOptions() {
+    return {
+      child: this.child,
+      waitClosed: () => this.closedPromise,
+      isClosed: () => this.closed,
+      label: "pi"
+    };
   }
   onData(chunk) {
     this.buffer += chunk;
@@ -1112,19 +1439,15 @@ var PiRpcClient = class {
     if (this.closed) return;
     this.closed = true;
     this.exitError = err;
+    this.resolveClosed();
     for (const [, waiter] of this.pending) waiter.reject(err);
     this.pending.clear();
     this.eventQueue.end();
   }
 };
 
-// src/adapters/pi/pi-adapter.ts
-var execFileAsync = promisify(execFile);
-var DETECT_TIMEOUT_MS = 5e3;
-function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var KNOWN_PROVIDER_ENV_VARS = [
+// src/adapters/provider-credential-environment.ts
+var PROVIDER_CREDENTIAL_ENV_NAMES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_OAUTH_TOKEN",
   "OPENAI_API_KEY",
@@ -1135,123 +1458,288 @@ var KNOWN_PROVIDER_ENV_VARS = [
   "MISTRAL_API_KEY",
   "OPENROUTER_API_KEY",
   "XAI_API_KEY",
-  // Confirmed against the installed pi's own docs/providers.md ("ZAI |
-  // `ZAI_API_KEY` | `zai`") and exercised live against real GLM traffic
-  // during this task's acceptance run — omitting it made `authPresent`
-  // silently false for a perfectly valid, working z.ai/GLM setup.
   "ZAI_API_KEY"
 ];
+var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
+  ...PROVIDER_CREDENTIAL_ENV_NAMES,
+  "ANT_LING_API_KEY",
+  "NVIDIA_API_KEY",
+  "CEREBRAS_API_KEY",
+  "CLOUDFLARE_API_KEY",
+  "AI_GATEWAY_API_KEY",
+  "ZAI_CODING_CN_API_KEY",
+  "OPENCODE_API_KEY",
+  "RADIUS_API_KEY",
+  "FIREWORKS_API_KEY",
+  "TOGETHER_API_KEY",
+  "BASETEN_API_KEY",
+  "KIMI_API_KEY",
+  "MINIMAX_API_KEY",
+  "MINIMAX_CN_API_KEY",
+  "QWEN_TOKEN_PLAN_API_KEY",
+  "QWEN_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_API_KEY",
+  "XIAOMI_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_TOKEN_PLAN_AMS_API_KEY",
+  "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  // Reserved by the keys-owned Pi projection. It must never be inherited
+  // from the daemon; the launcher deletes any ambient copy and injects only
+  // the exact credential it just resolved from OS custody.
+  "PI_PROVIDER_API_KEY"
+];
+function withoutProviderCredentials(env) {
+  const sanitized = { ...env };
+  for (const name of PROVIDER_CREDENTIAL_ENV_DENY_NAMES) {
+    delete sanitized[name];
+  }
+  return sanitized;
+}
+
+// src/adapters/pi/pi-adapter.ts
+var execFileAsync = promisify(execFile);
+var DETECT_TIMEOUT_MS = 5e3;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 var PiAdapter = class {
   constructor(options = {}) {
     this.options = options;
   }
   options;
-  id = "pi";
+  descriptor = freezeRuntimeAdapterDescriptor({
+    id: "pi",
+    supportsDispatchSelection: true,
+    capabilities: {
+      steer: true,
+      resume: true,
+      approvalInteractive: false,
+      permissionModes: ["auto", "readonly"]
+    },
+    environmentRequirements: { credentialNames: PROVIDER_CREDENTIAL_ENV_NAMES }
+  });
   async detect() {
     try {
       const bin = this.resolveBin();
       const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
       const version = stdout.trim() || stderr.trim();
-      const authPresent = KNOWN_PROVIDER_ENV_VARS.some((name) => process.env[name] !== void 0);
+      const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
       return { present: true, version, authPresent };
     } catch {
       return { present: false };
     }
   }
-  capabilities() {
-    return { steer: true, resume: true, approvalInteractive: false, permissionModes: ["auto", "readonly"] };
-  }
-  /**
-   * M5: pi authenticates to its ~30 supported providers via env-var API
-   * keys — `detect()`'s own `authPresent` probe above checks this identical
-   * list — so these MUST keep flowing into pi's spawned process or pi auth
-   * breaks entirely. `KNOWN_PROVIDER_ENV_VARS` above is the single source
-   * of truth, reused here rather than duplicated. No `baseNames`: nothing
-   * in this adapter or `rpc-client.ts` reads a pi-specific config-discovery
-   * variable beyond the platform baseline (`daemon/environment.ts`).
-   */
-  environmentRequirements() {
-    return { credentialNames: KNOWN_PROVIDER_ENV_VARS };
-  }
-  async start(task, ctx) {
-    if (typeof task.instruction !== "string") {
-      throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
-    }
-    const mapping = mapPermissionPolicyToPiArgs(ctx.policy);
+  async prepare(input) {
+    const mapping = mapPermissionPolicyToPiArgs(input.policy);
     if (!mapping.ok) {
-      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by pi adapter");
+      return { kind: "reject", reason: mapping.reason ?? "policy rejected by pi adapter", retryable: false };
     }
     const bin = this.resolveBin();
-    const resumeSessionId = task.sessionRef;
-    const args = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
-    const rpc = new PiRpcClient({
-      command: bin.command,
-      args,
-      cwd: ctx.workspaceDir,
-      env: ctx.env,
-      spawnFn: this.options.spawnFn
-    });
-    const response = await rpc.send({ type: "prompt", message: task.instruction });
-    if (response.success === false) {
-      rpc.kill();
-      throw new Error(typeof response.error === "string" ? response.error : "pi rejected the initial prompt");
+    const selection = input.offer.dispatchSelection;
+    const pinnedSelection = selection === void 0 ? void 0 : Object.freeze({ ...selection });
+    let command = bin.command;
+    let launcherArgs;
+    if (pinnedSelection !== void 0) {
+      if (pinnedSelection.lane !== "byok" || pinnedSelection.runtimeId !== "pi") {
+        return { kind: "reject", reason: `pi adapter cannot execute ${pinnedSelection.lane} selection for runtime ${pinnedSelection.runtimeId}`, retryable: false };
+      }
+      const launcher = this.options.byokLauncher;
+      if (launcher === void 0) {
+        return { kind: "reject", reason: "pi BYOK selection requires a configured credential-custody launcher", retryable: false };
+      }
+      command = launcher.command;
+      launcherArgs = [
+        ...launcher.args ?? [],
+        "--pi-bin",
+        bin.command,
+        "--profile-db",
+        launcher.profileDbPath,
+        "--session-dir",
+        launcher.sessionDir,
+        ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
+        "--provider",
+        pinnedSelection.providerId,
+        "--model",
+        pinnedSelection.modelId
+      ];
     }
-    let sessionRef;
-    if (resumeSessionId) {
-      sessionRef = resumeSessionId;
-    } else {
-      try {
-        sessionRef = await resolveFreshSessionId(rpc);
-      } catch (err) {
-        rpc.kill();
-        throw err;
+    return {
+      kind: "prepared",
+      operation: {
+        start: async (startInput) => {
+          const manifestSelection = startInput.manifest.dispatchSelection;
+          if (!sameDispatchSelection(manifestSelection, pinnedSelection)) {
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "authority",
+              retry: "non-retryable",
+              reason: "prepared pi operation received a manifest with different runtime selection"
+            });
+          }
+          if (typeof startInput.instruction !== "string") {
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "authority",
+              retry: "non-retryable",
+              reason: "prepared pi operation requires a resolved string instruction"
+            });
+          }
+          const resumeSessionId = startInput.manifest.sessionRef;
+          const piArgs = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+          const args = launcherArgs === void 0 ? piArgs : [...launcherArgs, "--", ...piArgs];
+          let rpc;
+          try {
+            rpc = new PiRpcClient({
+              command,
+              args,
+              cwd: startInput.manifest.workspace.workspaceDir,
+              env: manifestSelection === void 0 ? startInput.env : withoutProviderCredentials(startInput.env),
+              spawnFn: this.options.spawnFn
+            });
+          } catch (cause) {
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "infrastructure",
+              retry: "retryable",
+              reason: "pi runtime process could not be spawned"
+            }, { cause });
+          }
+          let response;
+          try {
+            response = await rpc.send({ type: "prompt", message: startInput.instruction });
+          } catch (cause) {
+            rpc.kill();
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "infrastructure",
+              retry: "retryable",
+              reason: `pi initial prompt transport failed: ${errorMessage(cause)}`
+            }, { cause });
+          }
+          if (response.success === false) {
+            rpc.kill();
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "semantic",
+              retry: "non-retryable",
+              reason: typeof response.error === "string" ? response.error : "pi rejected the initial prompt"
+            });
+          }
+          let sessionRef;
+          try {
+            sessionRef = await resolveAuthoritativeSessionId(rpc);
+          } catch (err) {
+            rpc.kill();
+            throw err;
+          }
+          if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
+            rpc.kill();
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "authority",
+              retry: "non-retryable",
+              reason: "pi resumed a different authoritative session than requested"
+            });
+          }
+          return new PiSession(sessionRef, rpc, manifestSelection);
+        }
       }
-    }
-    return new PiSession(sessionRef, rpc);
+    };
   }
   resolveBin() {
     return (this.options.resolveBin ?? resolvePiBin)();
   }
 };
-async function resolveFreshSessionId(rpc) {
+function sameDispatchSelection(left, right) {
+  if (left === void 0 || right === void 0) return left === right;
+  return left.lane === right.lane && left.runtimeId === right.runtimeId && left.providerId === right.providerId && left.modelId === right.modelId;
+}
+async function resolveAuthoritativeSessionId(rpc) {
   let state;
   try {
     state = await rpc.send({ type: "get_state" });
   } catch (err) {
-    throw new Error(`pi did not yield an authoritative session id (get_state failed): ${errorMessage(err)}`, {
+    if (isRuntimeExecutionFailure(err)) throw err;
+    throw new RuntimeExecutionFailure({
+      phase: "start",
+      category: "infrastructure",
+      retry: "retryable",
+      reason: `pi transport ended before yielding an authoritative session id: ${errorMessage(err)}`
+    }, {
       cause: err
     });
   }
   if (state.success === false) {
     const reason = typeof state.error === "string" ? state.error : "get_state reported failure";
-    throw new Error(`pi did not yield an authoritative session id (get_state failed): ${reason}`);
+    throw new RuntimeExecutionFailure({
+      phase: "start",
+      category: "authority",
+      retry: "non-retryable",
+      reason: `pi did not yield an authoritative session id: ${reason}`
+    });
   }
   const data = state.data;
   if (typeof data?.sessionId === "string" && data.sessionId.length > 0) {
     return data.sessionId;
   }
-  throw new Error(
-    "pi did not yield an authoritative session id (get_state succeeded but reported no sessionId) \u2014 cannot mint a resumable session"
-  );
+  throw new RuntimeExecutionFailure({
+    phase: "start",
+    category: "authority",
+    retry: "non-retryable",
+    reason: "pi get_state reported no authoritative session id"
+  });
 }
 var PiSession = class {
-  constructor(sessionRef, rpc) {
+  constructor(sessionRef, rpc, selection) {
     this.sessionRef = sessionRef;
     this.rpc = rpc;
+    this.selection = selection;
   }
   sessionRef;
   rpc;
+  selection;
   get events() {
     const rpc = this.rpc;
     return {
       [Symbol.asyncIterator]() {
         const inner = rpc.events[Symbol.asyncIterator]();
+        let terminalFailure;
         return {
           async next() {
             for (; ; ) {
-              const { value, done } = await inner.next();
-              if (done) return { value: void 0, done: true };
+              if (terminalFailure) throw terminalFailure;
+              let result;
+              try {
+                result = await inner.next();
+              } catch (cause) {
+                throw new RuntimeExecutionFailure({
+                  phase: "run",
+                  category: "infrastructure",
+                  retry: "retryable",
+                  reason: "pi runtime event transport failed"
+                }, { cause });
+              }
+              const { value, done } = result;
+              if (done) {
+                throw new RuntimeExecutionFailure({
+                  phase: "run",
+                  category: "infrastructure",
+                  retry: "retryable",
+                  reason: "pi runtime process ended before agent_settled"
+                }, { cause: rpc.terminalError });
+              }
               const mapped = mapPiMessageToAgentEvent(value);
+              if (value.type === "auto_retry_end" && value.success === false) {
+                terminalFailure = new RuntimeExecutionFailure({
+                  phase: "run",
+                  category: "semantic",
+                  retry: "non-retryable",
+                  reason: "pi exhausted its native retry policy"
+                });
+              }
               if (mapped) return { value: mapped, done: false };
               if (!ROUTINE_PI_EVENT_TYPES.has(value.type)) {
                 rpc.recordUnmappedFrame(value.type);
@@ -1269,13 +1757,19 @@ var PiSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
     }
+    const requestedSelection = task.dispatchSelection;
+    if (requestedSelection !== void 0 && (this.selection?.lane !== "byok" || requestedSelection.lane !== "byok" || requestedSelection.runtimeId !== "pi" || requestedSelection.providerId !== this.selection.providerId || requestedSelection.modelId !== this.selection.modelId)) {
+      throw new PolicyUnsupportedError(
+        "pi persistent session cannot change its authoritative BYOK provider/model selection"
+      );
+    }
     await this.rpc.send({ type: "prompt", message: task.instruction, streamingBehavior: "followUp" });
   }
   async interrupt() {
     await this.rpc.send({ type: "abort" });
   }
   async close() {
-    this.rpc.kill();
+    await this.rpc.dispose();
   }
   async resolveApproval() {
     throw new Error("pi adapter does not support approval resume: pi never emits needs_approval in M0/M1");
@@ -1487,7 +1981,15 @@ function mapResult(msg) {
     diagnostic ? `claude result frame had a missing/invalid is_error flag (got ${JSON.stringify(msg.is_error)}) \u2014 treating as failure, fail-closed; diagnostic content on the frame: ${truncateResultDiagnostic(diagnostic)}` : `claude result frame had a missing/invalid is_error flag (got ${JSON.stringify(msg.is_error)}) \u2014 treating as failure, fail-closed`
   );
   const events = usageEvent ? [usageEvent, { type: "error", message }] : [{ type: "error", message }];
-  return { events };
+  return {
+    events,
+    terminalFailure: new RuntimeExecutionFailure({
+      phase: "run",
+      category: msg.is_error === true ? "semantic" : "authority",
+      retry: "non-retryable",
+      reason: msg.is_error === true ? "claude reported terminal task failure" : "claude emitted a malformed terminal result frame"
+    })
+  };
 }
 var RESULT_DIAGNOSTIC_MAX_CHARS = 2e3;
 function truncateResultDiagnostic(text) {
@@ -1539,16 +2041,22 @@ var ClaudeProcessClient = class {
   eventQueue = new AsyncQueue();
   closed = false;
   exitError;
+  closedPromise;
+  resolveClosed;
+  disposalAttempt;
   stderrRing = [];
   unmappedFrameCounts = /* @__PURE__ */ new Map();
   sessionId;
   initWaiter;
   constructor(options) {
     const spawnFn = options.spawnFn ?? spawn;
-    this.child = spawnFn(options.command, options.args, {
+    this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"]
+    }));
+    this.closedPromise = new Promise((resolve) => {
+      this.resolveClosed = resolve;
     });
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
@@ -1604,6 +2112,10 @@ var ClaudeProcessClient = class {
   get events() {
     return this.eventQueue;
   }
+  /** Local transport diagnostic retained when the process closes; consumers classify it at the session boundary. */
+  get terminalError() {
+    return this.exitError;
+  }
   /**
    * Record a claude stream-json frame/subtype/content-block label that
    * `ClaudeSession`'s event iterator (`../claude-adapter.ts`) decided has
@@ -1623,15 +2135,30 @@ var ClaudeProcessClient = class {
       );
     }
   }
-  /** Best-effort teardown. SIGTERM on POSIX; `taskkill /T /F` on Windows to also reap child processes claude itself spawned (e.g. Bash) — mirrors pi's cross-platform `kill()` exactly. Empirically confirmed on this (POSIX) machine: a running claude process exits cleanly within ~1s of SIGTERM (observed exit code 143 = 128+SIGTERM, i.e. claude catches and handles the signal itself rather than needing a harder kill). */
+  /** Immediate process-tree termination request. `dispose()` is the settlement receipt. */
   kill() {
-    if (this.closed) return;
-    const pid = this.child.pid;
-    if (process.platform === "win32" && pid !== void 0) {
-      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
-    } else {
-      this.child.kill("SIGTERM");
+    requestOwnedProcessTreeTermination(this.processTreeOptions());
+  }
+  waitClosed() {
+    return this.closedPromise;
+  }
+  dispose() {
+    if (!this.disposalAttempt) {
+      const attempt = disposeOwnedProcessTree(this.processTreeOptions());
+      this.disposalAttempt = attempt.catch((error) => {
+        this.disposalAttempt = void 0;
+        throw error;
+      });
     }
+    return this.disposalAttempt;
+  }
+  processTreeOptions() {
+    return {
+      child: this.child,
+      waitClosed: () => this.closedPromise,
+      isClosed: () => this.closed,
+      label: "claude"
+    };
   }
   onData(chunk) {
     this.buffer += chunk;
@@ -1682,6 +2209,7 @@ var ClaudeProcessClient = class {
     if (this.closed) return;
     this.closed = true;
     this.exitError = err;
+    this.resolveClosed();
     this.initWaiter?.reject(err);
     this.initWaiter = void 0;
     this.eventQueue.end();
@@ -1693,17 +2221,37 @@ var APPROVAL_TOOL_NAME = "approval_prompt";
 var APPROVAL_MCP_SERVER_NAME = "byokapproval";
 var execFileAsync2 = promisify(execFile);
 var DETECT_TIMEOUT_MS2 = 5e3;
-async function cleanupApprovalMcpConfigDir(dir) {
+function errorMessage2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function cleanupMcpConfigDir(dir) {
   if (!dir) return;
-  await promises.rm(dir, { recursive: true, force: true }).catch(() => {
-  });
+  try {
+    await promises.rm(dir, { recursive: true, force: true });
+  } catch (cause) {
+    throw new RuntimeDisposalFailure({
+      stage: "cleanup",
+      reason: "claude task-scoped MCP configuration could not be removed"
+    }, { cause });
+  }
 }
 var ClaudeAdapter = class {
   constructor(options = {}) {
     this.options = options;
   }
   options;
-  id = "claude";
+  descriptor = freezeRuntimeAdapterDescriptor({
+    id: "claude",
+    supportsDispatchSelection: true,
+    capabilities: {
+      steer: false,
+      resume: true,
+      approvalInteractive: true,
+      mcpToolsets: true,
+      permissionModes: ["auto", "readonly", "plan", "confirm"]
+    },
+    environmentRequirements: { credentialNames: [] }
+  });
   async detect() {
     const bin = this.resolveBin();
     try {
@@ -1715,75 +2263,138 @@ var ClaudeAdapter = class {
       return { present: false };
     }
   }
-  capabilities() {
-    return { steer: false, resume: true, approvalInteractive: true, permissionModes: ["auto", "readonly", "plan", "confirm"] };
-  }
-  /**
-   * M5: deliberate product-boundary decision, not an oversight — byok's
-   * current ToS posture for claude is login-state-only (`claude auth
-   * login`'s own OAuth session — see `probeAuthPresent` below), so this
-   * adapter declares NO credential env vars at all; env-based API-key
-   * passthrough for claude is a separate, still-pending product decision.
-   * A product that genuinely needs it can opt in locally per-device via
-   * `DaemonConfig.runtimeEnvironment.claude.allow` (`create-daemon.ts`).
-   * `baseNames` is empty too: nothing in this adapter reads a
-   * claude-specific config-discovery variable (e.g. `CLAUDE_CONFIG_DIR`)
-   * today — if a future version of this adapter starts reading one, it
-   * belongs here, not left to rely on the platform baseline alone.
-   */
-  environmentRequirements() {
-    return { credentialNames: [] };
-  }
-  async start(task, ctx) {
-    if (typeof task.instruction !== "string") {
-      throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+  async prepare(input) {
+    const mapping = mapPermissionPolicyToClaudeArgs(input.policy);
+    if (!mapping.ok) return { kind: "reject", reason: mapping.reason ?? "policy rejected by claude adapter", retryable: false };
+    let modelId;
+    try {
+      modelId = subscriptionModel(input.offer.dispatchSelection, "claude");
+    } catch (error) {
+      return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: false };
     }
-    const mapping = mapPermissionPolicyToClaudeArgs(ctx.policy);
-    if (!mapping.ok) {
-      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by claude adapter");
+    if (mapping.needsApprovalMcp && Object.prototype.hasOwnProperty.call(input.mcpServers ?? {}, APPROVAL_MCP_SERVER_NAME)) {
+      return { kind: "reject", reason: `MCP server name "${APPROVAL_MCP_SERVER_NAME}" is reserved by the claude approval channel`, retryable: false };
     }
-    let approvalMcpConfigDir;
+    let bin;
+    try {
+      bin = this.resolveBin();
+    } catch (error) {
+      return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: true };
+    }
+    let approvalMcpBin;
     if (mapping.needsApprovalMcp) {
-      if (!ctx.approvalChannel) {
-        throw new PolicyUnsupportedError(
-          'claude adapter requires policy.mode "confirm" to be started with an approval channel (TaskContext.approvalChannel) \u2014 none was provided'
-        );
+      try {
+        approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
+      } catch (error) {
+        return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: true };
+      }
+    }
+    return {
+      kind: "prepared",
+      operation: {
+        start: (startInput) => this.startPrepared(startInput, mapping, modelId, bin, approvalMcpBin)
+      }
+    };
+  }
+  async startPrepared(startInput, initialMapping, modelId, bin, approvalMcpBin) {
+    if (!initialMapping.ok) throw new RuntimeExecutionFailure({
+      phase: "start",
+      category: "authority",
+      retry: "non-retryable",
+      reason: "prepared claude permission mapping was invalid"
+    });
+    if (typeof startInput.instruction !== "string") {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude operation requires a resolved string instruction"
+      });
+    }
+    const mapping = { ...initialMapping, args: [...initialMapping.args] };
+    let mcpConfigDir;
+    const taskMcpServers = startInput.mcpServers ?? {};
+    const needsMcpConfig = mapping.needsApprovalMcp || Object.keys(taskMcpServers).length > 0;
+    if (mapping.needsApprovalMcp) {
+      if (!startInput.approvalChannel) {
+        throw new RuntimeExecutionFailure({
+          phase: "start",
+          category: "authority",
+          retry: "non-retryable",
+          reason: 'claude adapter requires policy.mode "confirm" to be started with an approval channel'
+        });
       }
-      const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
-      approvalMcpConfigDir = await promises.mkdtemp(path20.join(os.tmpdir(), "byok-approval-mcp-"));
-      await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
+      if (!approvalMcpBin) throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude approval MCP binary was not resolved"
       });
-      const mcpConfigPath = path20.join(approvalMcpConfigDir, "mcp-config.json");
-      const mcpConfig = {
-        mcpServers: {
-          [APPROVAL_MCP_SERVER_NAME]: {
-            command: approvalMcpBin.command,
-            args: approvalMcpBin.args,
-            env: {
-              BYOK_STORE_DIR: ctx.approvalChannel.storeDir,
-              BYOK_PRODUCT_ID: ctx.approvalChannel.productId,
-              BYOK_TASK_ID: ctx.approvalChannel.taskId,
-              BYOK_APPROVAL_TIMEOUT_MS: String(ctx.approvalChannel.timeoutMs)
-            }
+    }
+    if (needsMcpConfig) {
+      mcpConfigDir = await promises.mkdtemp(path20.join(os.tmpdir(), "byok-mcp-"));
+      await promises.chmod(mcpConfigDir, 448).catch(() => {
+      });
+      const mcpConfigPath = path20.join(mcpConfigDir, "mcp-config.json");
+      const mcpServers = { ...taskMcpServers };
+      if (mapping.needsApprovalMcp) {
+        const approvalChannel = startInput.approvalChannel;
+        if (!approvalChannel) throw new RuntimeExecutionFailure({
+          phase: "start",
+          category: "authority",
+          retry: "non-retryable",
+          reason: "prepared claude approval channel was not available"
+        });
+        const preparedApprovalMcpBin = approvalMcpBin;
+        if (!preparedApprovalMcpBin) throw new RuntimeExecutionFailure({
+          phase: "start",
+          category: "authority",
+          retry: "non-retryable",
+          reason: "prepared claude approval MCP binary was not resolved"
+        });
+        mcpServers[APPROVAL_MCP_SERVER_NAME] = {
+          command: preparedApprovalMcpBin.command,
+          args: preparedApprovalMcpBin.args,
+          env: {
+            BYOK_STORE_DIR: approvalChannel.storeDir,
+            BYOK_PRODUCT_ID: approvalChannel.productId,
+            BYOK_TASK_ID: approvalChannel.taskId,
+            BYOK_APPROVAL_TIMEOUT_MS: String(approvalChannel.timeoutMs)
           }
-        }
-      };
-      await promises.writeFile(mcpConfigPath, JSON.stringify(mcpConfig), { mode: 384 });
+        };
+      }
+      await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 384 });
       mapping.args = [
         ...mapping.args,
-        "--permission-prompt-tool",
-        `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`,
+        ...mapping.needsApprovalMcp ? ["--permission-prompt-tool", `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`] : [],
         "--mcp-config",
         mcpConfigPath,
-        // Never let this task's confirm-mode run pick up some OTHER MCP
-        // server from ambient project/user config — the approval channel is
-        // the only MCP server this invocation should ever see.
+        // The generated file is the complete task-scoped MCP authority.
+        // Never merge ambient user/project MCP configuration into it.
         "--strict-mcp-config"
       ];
     }
-    const bin = this.resolveBin();
-    const resumeSessionId = task.sessionRef;
-    const args = [
+    const resumeSessionId = startInput.manifest.sessionRef;
+    let manifestModelId;
+    try {
+      manifestModelId = subscriptionModel(startInput.manifest.dispatchSelection, "claude");
+    } catch (cause) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude operation received an invalid runtime selection manifest"
+      }, { cause });
+    }
+    if (manifestModelId !== modelId) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude operation received a manifest with different runtime selection"
+      });
+    }
+    const args = [
       "-p",
       "--input-format",
       "stream-json",
@@ -1794,33 +2405,72 @@ var ClaudeAdapter = class {
       // "Error: When using --print, --output-format=stream-json requires
       // --verbose", before spawning any model call.
       "--verbose",
+      ...manifestModelId ? ["--model", manifestModelId] : [],
       ...resumeSessionId ? ["--resume", resumeSessionId] : [],
       ...mapping.args
     ];
-    const client = new ClaudeProcessClient({
-      command: bin.command,
-      args,
-      cwd: ctx.workspaceDir,
-      env: ctx.env,
-      spawnFn: this.options.spawnFn
-    });
-    client.writeUserMessage(task.instruction);
+    let client;
+    try {
+      client = new ClaudeProcessClient({
+        command: bin.command,
+        args,
+        cwd: startInput.manifest.workspace.workspaceDir,
+        env: withoutProviderCredentials(startInput.env),
+        spawnFn: this.options.spawnFn
+      });
+    } catch (cause) {
+      await cleanupMcpConfigDir(mcpConfigDir);
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "infrastructure",
+        retry: "retryable",
+        reason: "claude runtime process could not be spawned"
+      }, { cause });
+    }
+    try {
+      client.writeUserMessage(startInput.instruction);
+    } catch (cause) {
+      client.kill();
+      await cleanupMcpConfigDir(mcpConfigDir);
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "infrastructure",
+        retry: "retryable",
+        reason: "claude initial instruction transport failed"
+      }, { cause });
+    }
     let sessionRef;
     try {
       sessionRef = await client.waitForInit();
     } catch (err) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
-      throw err;
+      await cleanupMcpConfigDir(mcpConfigDir);
+      if (isRuntimeExecutionFailure(err)) throw err;
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "infrastructure",
+        retry: "retryable",
+        reason: `claude exited before yielding an authoritative session id: ${errorMessage2(err)}`
+      }, { cause: err });
     }
     if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
-      throw new Error(
-        `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
-      );
+      await cleanupMcpConfigDir(mcpConfigDir);
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef})`
+      });
     }
-    return new ClaudeSession(sessionRef, client, ctx.workspaceDir, ctx.approvalChannel, approvalMcpConfigDir);
+    return new ClaudeSession(
+      sessionRef,
+      client,
+      startInput.manifest.workspace.workspaceDir,
+      startInput.approvalChannel,
+      mcpConfigDir,
+      manifestModelId
+    );
   }
   /**
    * `claude auth status --json` is claude's OWN non-secret login-state
@@ -1854,20 +2504,32 @@ var ClaudeAdapter = class {
     return (this.options.resolveBin ?? resolveClaudeBin)();
   }
 };
+function subscriptionModel(selection, runtimeId) {
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== runtimeId) {
+    throw new PolicyUnsupportedError(
+      `claude adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 var ClaudeSession = class {
-  constructor(sessionRef, client, workspaceDir, approvalChannel, approvalMcpConfigDir) {
+  constructor(sessionRef, client, workspaceDir, approvalChannel, mcpConfigDir, modelId) {
     this.sessionRef = sessionRef;
     this.client = client;
     this.workspaceDir = workspaceDir;
     this.approvalChannel = approvalChannel;
-    this.approvalMcpConfigDir = approvalMcpConfigDir;
+    this.mcpConfigDir = mcpConfigDir;
+    this.modelId = modelId;
   }
   sessionRef;
   client;
   workspaceDir;
   approvalChannel;
-  approvalMcpConfigDir;
+  mcpConfigDir;
+  modelId;
   correlation = createToolUseCorrelation();
+  closeAttempt;
   get events() {
     const client = this.client;
     const correlation = this.correlation;
@@ -1876,17 +2538,40 @@ var ClaudeSession = class {
       [Symbol.asyncIterator]() {
         const inner = client.events[Symbol.asyncIterator]();
         let pending = [];
+        let terminalFailure;
         let turnSettled = false;
         return {
           async next() {
             for (; ; ) {
               const buffered = pending.shift();
               if (buffered) return { value: buffered, done: false };
-              if (turnSettled) return { value: void 0, done: true };
-              const { value, done } = await inner.next();
-              if (done) return { value: void 0, done: true };
+              if (turnSettled) {
+                if (terminalFailure) throw terminalFailure;
+                return { value: void 0, done: true };
+              }
+              let raw;
+              try {
+                raw = await inner.next();
+              } catch (cause) {
+                throw new RuntimeExecutionFailure({
+                  phase: "run",
+                  category: "infrastructure",
+                  retry: "retryable",
+                  reason: "claude runtime event transport failed"
+                }, { cause });
+              }
+              const { value, done } = raw;
+              if (done) {
+                throw new RuntimeExecutionFailure({
+                  phase: "run",
+                  category: "infrastructure",
+                  retry: "retryable",
+                  reason: "claude runtime process ended before a terminal result frame"
+                }, { cause: client.terminalError });
+              }
               if (value.type === "result") turnSettled = true;
               const mapped = mapClaudeMessageToAgentEvents(value, correlation, { workspaceDir });
+              terminalFailure = mapped.terminalFailure ?? terminalFailure;
               if (mapped.unmappedLabel) {
                 client.recordUnmappedFrame(mapped.unmappedLabel);
               }
@@ -1917,6 +2602,12 @@ var ClaudeSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
     }
+    const requestedModel = subscriptionModel(task.dispatchSelection, "claude");
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `claude persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
     this.client.writeUserMessage(task.instruction);
   }
   /**
@@ -1935,8 +2626,17 @@ var ClaudeSession = class {
     this.client.kill();
   }
   async close() {
-    this.client.kill();
-    await cleanupApprovalMcpConfigDir(this.approvalMcpConfigDir);
+    if (!this.closeAttempt) {
+      const attempt = (async () => {
+        await this.client.dispose();
+        await cleanupMcpConfigDir(this.mcpConfigDir);
+      })();
+      this.closeAttempt = attempt.catch((error) => {
+        this.closeAttempt = void 0;
+        throw error;
+      });
+    }
+    await this.closeAttempt;
   }
   /**
    * M4 Phase 3: routes into the out-of-band approval channel `start()`
@@ -2153,14 +2853,15 @@ var CodexProcessRunner = class {
   exitSignal = null;
   closedPromise;
   resolveClosed;
+  disposalAttempt;
   constructor(options) {
     this.onEvent = options.onEvent;
     const spawnFn = options.spawnFn ?? spawn;
-    this.child = spawnFn(options.command, options.args, {
+    this.child = spawnFn(options.command, options.args, withOwnedProcessTree({
       cwd: options.cwd,
       env: options.env,
       stdio: ["ignore", "pipe", "pipe"]
-    });
+    }));
     this.closedPromise = new Promise((resolve) => {
       this.resolveClosed = resolve;
     });
@@ -2190,7 +2891,7 @@ var CodexProcessRunner = class {
     return this.closed;
   }
   /**
-   * Best-effort teardown. SIGTERM on POSIX: SIGINT was empirically confirmed
+   * Immediate tree termination request. SIGTERM on POSIX: SIGINT was empirically confirmed
    * to be silently ignored by `codex exec` (a real, direct test — a 60s
    * shell `sleep` ran to full, unaffected completion despite SIGINT sent at
    * t=4s) — a genuine, evidence-based correction to this task's own initial
@@ -2203,13 +2904,25 @@ var CodexProcessRunner = class {
    * `../pi/rpc-client.ts`'s own cross-platform convention.
    */
   kill() {
-    if (this.closed) return;
-    const pid = this.child.pid;
-    if (process.platform === "win32" && pid !== void 0) {
-      spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"]);
-    } else {
-      this.child.kill("SIGTERM");
+    requestOwnedProcessTreeTermination(this.processTreeOptions());
+  }
+  dispose() {
+    if (!this.disposalAttempt) {
+      const attempt = disposeOwnedProcessTree(this.processTreeOptions());
+      this.disposalAttempt = attempt.catch((error) => {
+        this.disposalAttempt = void 0;
+        throw error;
+      });
     }
+    return this.disposalAttempt;
+  }
+  processTreeOptions() {
+    return {
+      child: this.child,
+      waitClosed: () => this.closedPromise,
+      isClosed: () => this.closed,
+      label: "codex"
+    };
   }
   /** Builds a descriptive error folding in the exit code/signal and the stderr tail — mirrors `PiRpcClient.buildExitError`'s reasoning: a post-mortem on a failed start/resume should never need separately re-running codex by hand with a raw JSONL logger to learn why. */
   buildExitError(context) {
@@ -2260,7 +2973,17 @@ var CodexAdapter = class {
     this.options = options;
   }
   options;
-  id = "codex";
+  descriptor = freezeRuntimeAdapterDescriptor({
+    id: "codex",
+    supportsDispatchSelection: true,
+    capabilities: {
+      steer: false,
+      resume: true,
+      approvalInteractive: false,
+      permissionModes: ["auto", "readonly"]
+    },
+    environmentRequirements: { credentialNames: [] }
+  });
   async detect() {
     const bin = this.resolveBin();
     try {
@@ -2309,57 +3032,100 @@ ${result.stderr}`);
 ${withStreams.stderr ?? ""}`);
     }
   }
-  capabilities() {
-    return { steer: false, resume: true, approvalInteractive: false, permissionModes: ["auto", "readonly"] };
-  }
-  /**
-   * M5: same deliberate posture as the claude adapter (see its own doc
-   * comment) — codex authenticates via its own `codex login`-managed
-   * ChatGPT OAuth session (`probeAuthPresent` above), not an env var, so
-   * there is no credential env var this adapter needs forwarded; env-based
-   * API-key passthrough remains a separate, pending product decision. No
-   * `baseNames` either: nothing in this adapter reads a codex-specific
-   * config-discovery variable (e.g. `CODEX_HOME`) today.
-   */
-  environmentRequirements() {
-    return { credentialNames: [] };
-  }
-  async start(task, ctx) {
-    if (typeof task.instruction !== "string") {
-      throw new PolicyUnsupportedError("codex adapter only supports string instructions in M2 (no blob-ref fetch yet)");
+  async prepare(input) {
+    const mapping = mapPermissionPolicyToCodexArgs(input.policy);
+    if (!mapping.ok) return { kind: "reject", reason: mapping.reason ?? "policy rejected by codex adapter", retryable: false };
+    let modelId;
+    try {
+      modelId = subscriptionModel2(input.offer.dispatchSelection);
+    } catch (error) {
+      return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: false };
     }
-    const mapping = mapPermissionPolicyToCodexArgs(ctx.policy);
-    if (!mapping.ok) {
-      throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
+    let command;
+    try {
+      command = this.resolveBin().command;
+    } catch (error) {
+      return { kind: "reject", reason: error instanceof Error ? error.message : String(error), retryable: true };
+    }
+    return {
+      kind: "prepared",
+      operation: {
+        start: (startInput) => this.startPrepared(startInput, mapping.args, modelId, command)
+      }
+    };
+  }
+  async startPrepared(startInput, policyArgs, modelId, command) {
+    if (typeof startInput.instruction !== "string") {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared codex operation requires a resolved string instruction"
+      });
     }
-    const bin = this.resolveBin();
     const queue = new AsyncQueue();
+    const terminal = {};
     const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
-    const workspaceDir = await resolveRealWorkspaceDir(ctx.workspaceDir);
+    let workspaceDir;
+    try {
+      workspaceDir = await resolveRealWorkspaceDir(startInput.manifest.workspace.workspaceDir);
+    } catch (cause) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "infrastructure",
+        retry: "retryable",
+        reason: "codex runtime workspace could not be resolved"
+      }, { cause });
+    }
+    const runtimeEnv = withoutProviderCredentials(startInput.env);
+    let manifestModelId;
+    try {
+      manifestModelId = subscriptionModel2(startInput.manifest.dispatchSelection);
+    } catch (cause) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared codex operation received an invalid runtime selection manifest"
+      }, { cause });
+    }
+    if (manifestModelId !== modelId) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared codex operation received a manifest with different runtime selection"
+      });
+    }
     const { sessionRef, runner } = await runCodexTurn({
-      command: bin.command,
-      resumeRef: task.sessionRef,
-      instruction: task.instruction,
-      policyArgs: mapping.args,
-      cwd: ctx.workspaceDir,
-      env: ctx.env,
+      command,
+      resumeRef: startInput.manifest.sessionRef,
+      instruction: startInput.instruction,
+      modelId: manifestModelId,
+      policyArgs: [...policyArgs],
+      cwd: startInput.manifest.workspace.workspaceDir,
+      env: runtimeEnv,
       spawnFn: this.options.spawnFn,
       workspaceDir,
       queue,
       recordUnmapped,
-      expectedSessionRef: task.sessionRef,
-      preparedGit: ctx.gitWorkspace !== void 0
+      expectedSessionRef: startInput.manifest.sessionRef,
+      preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
+      failurePhase: "start",
+      terminal
     });
     return new CodexSession({
       sessionRef,
-      command: bin.command,
+      command,
       workspaceDir,
-      env: ctx.env,
+      env: startInput.env,
       spawnFn: this.options.spawnFn,
       queue,
       recordUnmapped,
       initialRunner: runner,
-      preparedGit: ctx.gitWorkspace !== void 0
+      preparedGit: startInput.manifest.workspace.workspaceId !== void 0,
+      modelId: manifestModelId,
+      terminal
     });
   }
   resolveBin() {
@@ -2380,12 +3146,25 @@ function makeUnmappedFrameRecorder(counts) {
     }
   };
 }
-function buildArgv(resumeRef, policyArgs, instruction, preparedGit = false) {
+function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = false) {
   const base = resumeRef !== void 0 ? ["exec", "resume", resumeRef] : ["exec"];
-  return [...base, "--json", ...preparedGit ? [] : ["--skip-git-repo-check"], ...policyArgs, instruction];
+  return [
+    ...base,
+    "--json",
+    ...modelId ? ["--model", modelId] : [],
+    ...preparedGit ? [] : ["--skip-git-repo-check"],
+    ...policyArgs,
+    instruction
+  ];
 }
 async function runCodexTurn(params) {
-  const argv = buildArgv(params.resumeRef, params.policyArgs, params.instruction, params.preparedGit);
+  const argv = buildArgv(
+    params.resumeRef,
+    params.policyArgs,
+    params.instruction,
+    params.modelId,
+    params.preparedGit
+  );
   let firstLineSettled = false;
   let resolveFirstLine;
   let rejectFirstLine;
@@ -2394,37 +3173,69 @@ async function runCodexTurn(params) {
     rejectFirstLine = reject;
   });
   let turnEnded = false;
-  const runner = new CodexProcessRunner({
-    command: params.command,
-    args: argv,
-    cwd: params.cwd,
-    env: params.env,
-    spawnFn: params.spawnFn,
-    onEvent: (evt) => {
-      if (!firstLineSettled) {
-        firstLineSettled = true;
-        if (evt.type === "thread.started" && typeof evt.thread_id === "string" && evt.thread_id.length > 0) {
-          resolveFirstLine(evt.thread_id);
-        } else {
-          rejectFirstLine(
-            new Error(`codex did not yield thread.started as its first event (got ${JSON.stringify(evt).slice(0, 200)})`)
-          );
+  let runner;
+  try {
+    runner = new CodexProcessRunner({
+      command: params.command,
+      args: argv,
+      cwd: params.cwd,
+      env: params.env,
+      spawnFn: params.spawnFn,
+      onEvent: (evt) => {
+        if (!firstLineSettled) {
+          firstLineSettled = true;
+          if (evt.type === "thread.started" && typeof evt.thread_id === "string" && evt.thread_id.length > 0) {
+            resolveFirstLine(evt.thread_id);
+          } else {
+            rejectFirstLine(
+              new RuntimeExecutionFailure({
+                phase: params.failurePhase,
+                category: "authority",
+                retry: "non-retryable",
+                reason: `codex did not yield thread.started as its first event (got ${JSON.stringify(evt).slice(0, 200)})`
+              })
+            );
+          }
+          return;
+        }
+        const mapped = mapCodexEventToAgentEvents(evt, params.workspaceDir);
+        for (const agentEvent of mapped) {
+          if (agentEvent.type === "turn_end") turnEnded = true;
+          params.queue.push(agentEvent);
+        }
+        if (evt.type === "turn.failed") {
+          params.terminal.failure = new RuntimeExecutionFailure({
+            phase: "run",
+            category: "semantic",
+            retry: "non-retryable",
+            reason: "codex reported terminal task failure"
+          });
+          params.queue.end();
+        }
+        if (mapped.length === 0 && !isRoutineCodexEvent(evt)) {
+          params.recordUnmapped(unmappedFrameKey(evt));
         }
-        return;
-      }
-      const mapped = mapCodexEventToAgentEvents(evt, params.workspaceDir);
-      for (const agentEvent of mapped) {
-        if (agentEvent.type === "turn_end") turnEnded = true;
-        params.queue.push(agentEvent);
-      }
-      if (mapped.length === 0 && !isRoutineCodexEvent(evt)) {
-        params.recordUnmapped(unmappedFrameKey(evt));
       }
-    }
-  });
+    });
+  } catch (cause) {
+    throw new RuntimeExecutionFailure({
+      phase: params.failurePhase,
+      category: "infrastructure",
+      retry: "retryable",
+      reason: "codex runtime process could not be spawned"
+    }, { cause });
+  }
+  params.onRunnerCreated?.(runner);
   void runner.waitClosed().then(() => {
-    if (turnEnded) return;
-    params.queue.push({ type: "error", message: runner.buildExitError("codex exited without completing the turn").message });
+    if (turnEnded || params.terminal.failure) return;
+    const cause = runner.buildExitError("codex exited without completing the turn");
+    params.terminal.failure = new RuntimeExecutionFailure({
+      phase: "run",
+      category: "infrastructure",
+      retry: "retryable",
+      reason: cause.message
+    }, { cause });
+    params.queue.push({ type: "error", message: cause.message });
     params.queue.end();
   });
   let sessionRef;
@@ -2448,7 +3259,13 @@ async function runCodexTurn(params) {
       void runner.waitClosed().then(() => {
         if (!settled) {
           settled = true;
-          reject(runner.buildExitError("codex exited before yielding an authoritative thread id"));
+          const cause = runner.buildExitError("codex exited before yielding an authoritative thread id");
+          reject(new RuntimeExecutionFailure({
+            phase: params.failurePhase,
+            category: "infrastructure",
+            retry: "retryable",
+            reason: cause.message
+          }, { cause }));
         }
       });
     });
@@ -2458,9 +3275,12 @@ async function runCodexTurn(params) {
   }
   if (params.expectedSessionRef !== void 0 && sessionRef !== params.expectedSessionRef) {
     runner.kill();
-    throw new Error(
-      `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
-    );
+    throw new RuntimeExecutionFailure({
+      phase: params.failurePhase,
+      category: "authority",
+      retry: "non-retryable",
+      reason: `codex exec resume echoed a different thread id than requested (requested ${params.expectedSessionRef}, got ${sessionRef})`
+    });
   }
   return { sessionRef, runner };
 }
@@ -2486,8 +3306,13 @@ var CodexSession = class {
   queue;
   recordUnmapped;
   preparedGit;
+  modelId;
+  terminal;
   currentRunner;
+  ownedRunners = /* @__PURE__ */ new Set();
+  followUpAttempts = /* @__PURE__ */ new Set();
   closed = false;
+  closeAttempt;
   constructor(options) {
     this.sessionRef = options.sessionRef;
     this.command = options.command;
@@ -2497,11 +3322,37 @@ var CodexSession = class {
     this.queue = options.queue;
     this.recordUnmapped = options.recordUnmapped;
     this.preparedGit = options.preparedGit;
+    this.modelId = options.modelId;
+    this.terminal = options.terminal;
     this.currentRunner = options.initialRunner;
+    this.ownedRunners.add(options.initialRunner);
     void this.forgetRunnerOnceClosed(options.initialRunner);
   }
   get events() {
-    return this.queue;
+    const queue = this.queue;
+    const session = this;
+    return {
+      [Symbol.asyncIterator]() {
+        const inner = queue[Symbol.asyncIterator]();
+        return {
+          async next() {
+            let result;
+            try {
+              result = await inner.next();
+            } catch (cause) {
+              throw new RuntimeExecutionFailure({
+                phase: "run",
+                category: "infrastructure",
+                retry: "retryable",
+                reason: "codex runtime event transport failed"
+              }, { cause });
+            }
+            if (result.done && session.terminal.failure) throw session.terminal.failure;
+            return result;
+          }
+        };
+      }
+    };
   }
   async forgetRunnerOnceClosed(runner) {
     await runner.waitClosed();
@@ -2546,7 +3397,14 @@ var CodexSession = class {
    * stale id even after codex had moved on) — it just can now only ever be
    * the SAME id this call asked to resume, never a silently-different one.
    */
-  async followUp(task) {
+  followUp(task) {
+    const attempt = this.runFollowUp(task);
+    this.followUpAttempts.add(attempt);
+    void attempt.finally(() => this.followUpAttempts.delete(attempt)).catch(() => {
+    });
+    return attempt;
+  }
+  async runFollowUp(task) {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("codex adapter only supports string instructions in M2 (no blob-ref fetch yet)");
     }
@@ -2557,41 +3415,79 @@ var CodexSession = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const requestedModel = subscriptionModel2(task.dispatchSelection);
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `codex persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
+    const modelId = this.modelId;
     const resumeRef = this.sessionRef;
     let sessionRef;
     let runner;
+    const terminal = {};
     try {
       ({ sessionRef, runner } = await runCodexTurn({
         command: this.command,
         resumeRef,
         instruction: task.instruction,
+        modelId,
         policyArgs: mapping.args,
         cwd: this.workspaceDir,
-        env: this.env,
+        env: withoutProviderCredentials(this.env),
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
         recordUnmapped: this.recordUnmapped,
         expectedSessionRef: resumeRef,
-        preparedGit: this.preparedGit
+        preparedGit: this.preparedGit,
+        failurePhase: "run",
+        terminal,
+        onRunnerCreated: (created) => {
+          this.ownedRunners.add(created);
+          void this.forgetRunnerOnceClosed(created);
+        }
       }));
     } catch (err) {
       this.queue.end();
+      this.terminal = {
+        failure: isRuntimeExecutionFailure(err) ? err : new RuntimeExecutionFailure({
+          phase: "run",
+          category: "authority",
+          retry: "non-retryable",
+          reason: "codex follow-up violated the runtime adapter contract"
+        }, { cause: err })
+      };
       throw err;
     }
+    if (this.closed) {
+      await runner.dispose();
+      throw new Error("codex session closed while follow-up was starting");
+    }
+    this.terminal = terminal;
     this.sessionRef = sessionRef;
     this.currentRunner = runner;
-    void this.forgetRunnerOnceClosed(runner);
   }
   /** Best-effort abort of the current turn. SIGTERM's the currently-running child, if any — see `process-runner.ts`'s `kill()` doc comment for why SIGTERM (not SIGINT) and why this is safe: the underlying codex thread survives and stays resumable, confirmed empirically. A no-op when no turn is currently in flight. */
   async interrupt() {
     this.currentRunner?.kill();
   }
   async close() {
-    if (this.closed) return;
-    this.closed = true;
-    this.currentRunner?.kill();
-    this.queue.end();
+    if (!this.closeAttempt) {
+      this.closed = true;
+      this.queue.end();
+      const attempt = (async () => {
+        const runners = [...this.ownedRunners];
+        await Promise.all(runners.map((runner) => runner.dispose()));
+        for (const runner of runners) this.ownedRunners.delete(runner);
+        await Promise.allSettled([...this.followUpAttempts]);
+      })();
+      this.closeAttempt = attempt.catch((error) => {
+        this.closeAttempt = void 0;
+        throw error;
+      });
+    }
+    await this.closeAttempt;
   }
   /**
    * `codex exec` has no in-band channel to inject text into an already-
@@ -2627,6 +3523,15 @@ var CodexSession = class {
     );
   }
 };
+function subscriptionModel2(selection) {
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== "codex") {
+    throw new PolicyUnsupportedError(
+      `codex adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 
 // src/daemon/approvals.ts
 var ApprovalNotFoundError = class extends Error {
@@ -2683,7 +3588,7 @@ var ApprovalRegistry = class {
    * `requestApproval` timeout and `finish()` fail-closed cleanup
    * (`task-runner.ts`) — resolves a decision this device made on its own.
    * The one exception, a server-sent wire `task.approve`/`task.reject`
-   * relayed through `TaskContext.approvalChannel.resolve`
+   * relayed through `RuntimeOperationStartInput.approvalChannel.resolve`
    * (`task-runner.ts`'s `handleOffer`), passes `'wire'` explicitly.
    */
   resolve(approvalId, decision, reason, origin = "local") {
@@ -2851,13 +3756,10 @@ function exportPrivateKeyPem(privateKey) {
 function importPrivateKeyPem(pem) {
   return createPrivateKey(pem);
 }
-var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
 function signNonce(privateKey, nonce) {
-  const signature = sign(null, Buffer.from(NONCE_SIGNING_DOMAIN + nonce, "utf8"), privateKey);
+  const signature = sign(null, nonceSigningBytes(nonce), privateKey);
   return signature.toString("base64url");
 }
-
-// src/daemon/url.ts
 function toHttpBase(serverUrl) {
   const url = new URL(serverUrl);
   if (url.protocol === "ws:") url.protocol = "http:";
@@ -2867,7 +3769,7 @@ function toHttpBase(serverUrl) {
   return url.toString();
 }
 function toWsUrl(serverUrl) {
-  const url = new URL("/byok/ws", toHttpBase(serverUrl));
+  const url = new URL(BYOK_WS_PATH, toHttpBase(serverUrl));
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
   return url.toString();
 }
@@ -2955,7 +3857,7 @@ var AuthManager = class {
       return await this.runCredentialMutation(async () => {
         const existing = this.record ?? await this.opts.store.load();
         const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
-        const url = new URL("/byok/pair", toHttpBase(this.opts.serverUrl));
+        const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
         const res = await fetch(url, {
           method: "POST",
           headers: { "content-type": "application/json" },
@@ -2989,6 +3891,7 @@ var AuthManager = class {
   async getValidAccessToken() {
     if (!this.record) throw new Error("device is not paired yet; call pair(pairingCode) first");
     if (this.revoked) throw new DeviceRevokedError();
+    if (this.renewing) return this.renewing;
     if (msUntilExpiry(this.record.expiresAt) > RENEW_MARGIN_MS) return this.record.accessToken;
     return this.renew();
   }
@@ -3017,7 +3920,7 @@ var AuthManager = class {
     const record = this.record;
     const base = toHttpBase(this.opts.serverUrl);
     const privateKey = importPrivateKeyPem(record.devicePrivateKeyPem);
-    const challengeRes = await fetch(new URL("/byok/challenge", base), {
+    const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ deviceId: record.deviceId })
@@ -3030,7 +3933,7 @@ var AuthManager = class {
     }
     const { nonce } = await challengeRes.json();
     const signature = signNonce(privateKey, nonce);
-    const tokenRes = await fetch(new URL("/byok/token", base), {
+    const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ deviceId: record.deviceId, nonce, signature })
@@ -3128,7 +4031,7 @@ var BlobClient = class {
   async resolveInstruction(blobRef) {
     const base = toHttpBase(this.serverUrl);
     const urlRes = await authedFetch(
-      new URL(`/byok/blobs/${encodeURIComponent(blobRef.blobId)}/url`, base),
+      new URL(byokBlobUrlPath(blobRef.blobId), base),
       { method: "GET" },
       this.auth
     );
@@ -3156,7 +4059,7 @@ var BlobClient = class {
     const base = toHttpBase(this.serverUrl);
     const reservationId = `blob_${randomUUID()}`;
     const createRes = await authedFetch(
-      new URL("/byok/blobs", base),
+      new URL(BYOK_BLOBS_PATH, base),
       {
         method: "POST",
         headers: {
@@ -3188,7 +4091,7 @@ var BlobClient = class {
       let response;
       try {
         response = await authedFetch(
-          new URL(`/byok/blobs/${encodeURIComponent(blobId)}/finalize`, base),
+          new URL(byokBlobFinalizePath(blobId), base),
           {
             method: "POST",
             headers: { "idempotency-key": reservationId }
@@ -3211,16 +4114,180 @@ var BlobClient = class {
     throw lastFailure;
   }
 };
+var PRESENCE_HINTS_CAPABILITY = "presence.hints";
+var CapabilityDiscoveryError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "CapabilityDiscoveryError";
+  }
+};
+async function fetchCapabilityDeclaration(serverUrl, options = {}) {
+  const url = new URL(BYOK_CAPABILITIES_PATH, toHttpBase(serverUrl));
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      ...options.signal === void 0 ? {} : { signal: options.signal }
+    });
+  } catch (err) {
+    throw new CapabilityDiscoveryError(
+      `failed to read the capability declaration from ${url.toString()}: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  if (!response.ok) {
+    throw new CapabilityDiscoveryError(
+      `failed to read the capability declaration from ${url.toString()}: HTTP ${response.status}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    throw new CapabilityDiscoveryError(
+      `the capability declaration at ${url.toString()} is not JSON: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  const parsed = CapabilityDeclarationSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CapabilityDiscoveryError(
+      `the capability declaration at ${url.toString()} is not a valid ADR-010 declaration: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: parsed.error }
+    );
+  }
+  return parsed.data;
+}
+function declares(declaration, capability) {
+  return hasCapability(declaration, capability);
+}
+var DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS = 3e4;
+var DEFAULT_PRESENCE_TTL_MS = 9e4;
+var DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5e3;
+function assertPresenceHeartbeatCadence(cadence) {
+  const { intervalMs, ttlMs, minimumIntervalMs } = cadence;
+  if (!(minimumIntervalMs < intervalMs && intervalMs < ttlMs)) {
+    throw new Error(
+      `presence heartbeat interval must satisfy minimumIntervalMs < intervalMs < ttlMs \u2014 got ${minimumIntervalMs} < ${intervalMs} < ${ttlMs}`
+    );
+  }
+}
+var PresencePublisher = class {
+  constructor(opts) {
+    this.opts = opts;
+    const intervalMs = opts.intervalMs ?? DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS;
+    const ttlMs = opts.ttlMs ?? DEFAULT_PRESENCE_TTL_MS;
+    const minimumIntervalMs = opts.minimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS;
+    assertPresenceHeartbeatCadence({ intervalMs, ttlMs, minimumIntervalMs });
+    this.intervalMs = intervalMs;
+    this.url = new URL(BYOK_PRESENCE_PATH, toHttpBase(opts.serverUrl));
+  }
+  opts;
+  url;
+  intervalMs;
+  timer;
+  running = false;
+  /** Set once a revoked device is observed. Terminal: `start()` will not restart this instance. */
+  stoppedPermanently = false;
+  /** Publishes immediately, then every `intervalMs`. Idempotent; a no-op after a permanent stop. */
+  start() {
+    if (this.running || this.stoppedPermanently) return;
+    this.running = true;
+    void this.beat();
+  }
+  /** Stops the cadence. Idempotent, and the only "offline" signal this producer emits — the hint's TTL does the rest. */
+  stop() {
+    this.running = false;
+    if (this.timer !== void 0) {
+      clearTimeout(this.timer);
+      this.timer = void 0;
+    }
+  }
+  schedule() {
+    if (!this.running) return;
+    this.timer = setTimeout(() => {
+      this.timer = void 0;
+      void this.beat();
+    }, this.intervalMs);
+    this.timer.unref?.();
+  }
+  async beat() {
+    if (!this.running) return;
+    try {
+      const response = await authedFetch(
+        this.url,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            level: "online",
+            ...this.opts.configuredToolsets === void 0 ? {} : { configuredToolsets: this.opts.configuredToolsets }
+          })
+        },
+        this.opts.auth
+      );
+      if (!response.ok) {
+        if (response.status === 401) {
+          this.stopPermanently(`presence heartbeat unauthorized after token renewal (HTTP 401)`);
+          return;
+        }
+        this.opts.onDegraded?.(`presence heartbeat failed: HTTP ${response.status}`);
+      }
+    } catch (err) {
+      if (err instanceof DeviceRevokedError) {
+        this.stopPermanently("presence heartbeat stopped: device has been revoked; re-pair required");
+        return;
+      }
+      this.opts.onDegraded?.(`presence heartbeat failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    this.schedule();
+  }
+  stopPermanently(reason) {
+    this.stoppedPermanently = true;
+    this.stop();
+    this.opts.onDegraded?.(reason);
+  }
+};
+function freshJti() {
+  return randomBytes(16).toString("base64url");
+}
+function mintDeviceAssertion(input) {
+  const issuedAtMs = input.now.getTime();
+  const expiresAt = new Date(issuedAtMs + input.ttlMs).toISOString();
+  const claims = DeviceAssertionClaimsSchema.parse({
+    version: 1,
+    issuer: input.issuer,
+    productId: input.productId,
+    deviceId: input.record.deviceId,
+    audience: input.audience,
+    jti: freshJti(),
+    issuedAt: new Date(issuedAtMs).toISOString(),
+    expiresAt
+  });
+  const privateKey = importPrivateKeyPem(input.record.devicePrivateKeyPem);
+  const signature = sign(null, deviceAssertionSigningInput(claims), privateKey).toString("base64url");
+  return {
+    envelope: {
+      schema: DEVICE_ASSERTION_SCHEMA_ID,
+      algorithm: "ed25519",
+      protected: claims,
+      signature
+    },
+    claims,
+    expiresAt
+  };
+}
 var CONTROL_PROTOCOL_VERSION = 1;
 var HANDSHAKE_TIMEOUT_MS = 3e3;
 var UNIX_SOCKET_PATH_SOFT_LIMIT = 100;
+var CONTROL_SOCKET_FALLBACK_ROOT = "/tmp";
 function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
   const candidate = path20.join(storeDir, "control.sock");
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path20.join(os.tmpdir(), `byok-${shortHash(storeDir)}`, "sock");
+  return path20.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
   const id = shortHash(`${productId}|${path20.resolve(storeDir)}`);
@@ -3326,6 +4393,16 @@ function parseApprovalsRequestParams(value) {
   if (typeof value.summary !== "string") return void 0;
   return { taskId: value.taskId, summary: value.summary };
 }
+var ASSERTION_AUDIENCE_MAX_BYTES = 256;
+function parseAssertionIssueParams(value) {
+  if (!isRecord2(value)) return void 0;
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || keys[0] !== "audience") return void 0;
+  const { audience } = value;
+  if (typeof audience !== "string" || audience.length === 0) return void 0;
+  if (Buffer.byteLength(audience, "utf8") > ASSERTION_AUDIENCE_MAX_BYTES) return void 0;
+  return { audience };
+}
 function parseShutdownParams(value) {
   if (!isRecord2(value)) return {};
   return value.reason === "unpair" || value.reason === "operator" ? { reason: value.reason } : {};
@@ -3339,12 +4416,12 @@ var AnotherControlServerRunningError = class extends Error {
   }
 };
 var MAX_HALF_OPEN_CONNECTIONS = 8;
-function errorMessage2(err) {
+function errorMessage3(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function toControlErrorShape(err) {
   if (err instanceof ControlError) return { code: err.code, message: err.message };
-  return { code: "internal_error", message: errorMessage2(err) };
+  return { code: "internal_error", message: errorMessage3(err) };
 }
 function probeUnixSocketAlive(socketPath) {
   return new Promise((resolve) => {
@@ -3551,12 +4628,19 @@ async function startControlServer(opts) {
     }
     throw err;
   }
+  let stopServingPromise;
+  async function stopServing() {
+    stopServingPromise ??= (async () => {
+      for (const socket of sockets) socket.destroy();
+      await new Promise((resolve) => server.close(() => resolve()));
+    })();
+    await stopServingPromise;
+  }
   let closed = false;
   async function close() {
     if (closed) return;
     closed = true;
-    for (const socket of sockets) socket.destroy();
-    await new Promise((resolve) => server.close(() => resolve()));
+    await stopServing();
     if (process.platform !== "win32") {
       await promises.rm(endpoint, { force: true }).catch(() => {
       });
@@ -3564,7 +4648,7 @@ async function startControlServer(opts) {
     await promises.rm(tokenPath, { force: true }).catch(() => {
     });
   }
-  return { endpoint, close };
+  return { endpoint, stopServing, close };
 }
 function deterministicJitterMs(input) {
   const ratio = input.ratio ?? 0.2;
@@ -3658,7 +4742,7 @@ var LongPollClient = class {
     try {
       const base = toHttpBase(this.opts.serverUrl);
       const res = await authedFetch(
-        new URL("/byok/messages", base),
+        new URL(BYOK_MESSAGES_PATH, base),
         {
           method: "POST",
           headers: { "content-type": "application/json" },
@@ -3682,7 +4766,7 @@ var LongPollClient = class {
     while (this.running) {
       try {
         const base = toHttpBase(this.opts.serverUrl);
-        const url = new URL("/byok/events", base);
+        const url = new URL(BYOK_EVENTS_PATH, base);
         const cursor = this.opts.getCursor();
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
         const res = await authedFetch(url, { method: "GET" }, this.opts.auth);
@@ -3858,6 +4942,7 @@ var WsTransport = class {
         deviceId: this.opts.deviceId,
         productId: this.opts.productId,
         runtimes: this.opts.runtimes,
+        configuredToolsets: this.opts.configuredToolsets === void 0 ? void 0 : [...this.opts.configuredToolsets],
         cursor: this.opts.getCursor?.()
       });
       socket.send(encodeEnvelope(hello));
@@ -3947,6 +5032,7 @@ var ConnectionManager = class {
       productId: opts.productId,
       capabilities: opts.capabilities,
       runtimes: opts.runtimes,
+      configuredToolsets: opts.configuredToolsets,
       getCursor: () => this.cursor,
       onEnvelope: (envelope) => this.deliver(envelope),
       onStateChange: (state) => {
@@ -4069,7 +5155,7 @@ var ConnectionManager = class {
    * already-delivered seqs (see its own doc comment) so the failed seq's own
    * redelivery can get through — but that same frozen watermark also means
    * every OTHER seq above it rides along on every re-poll too. Without this,
-   * a seq already mid-flight (e.g. a `task.offer` whose `adapter.start()`
+   * a seq already mid-flight (e.g. a `task.offer` whose prepared operation start()
    * hasn't resolved yet) would be re-enqueued into `processingChain` on
    * every such re-poll, piling up duplicate copies that — once the first
    * finally resolves and the chain unwinds through them — run its handler
@@ -4945,19 +6031,25 @@ var RECLAIM_FILENAME = `${DAEMON_OWNER_FILENAME}.reclaim`;
 var MAX_OWNER_BYTES = 4096;
 var RECLAIM_MALFORMED_GRACE_MS = 3e4;
 var SELF_PROCESS_STARTED_AT = new Date(Date.now() - process.uptime() * 1e3).toISOString();
-var STORE_MUTEX_PORT_BASE = 1e4;
-var STORE_MUTEX_PORT_COUNT = 2e4;
-var STORE_MUTEX_PORT_CANDIDATES = 32;
+function endOwnershipProbe(socket, response) {
+  socket.on("error", () => {
+  });
+  if (response === void 0) socket.end();
+  else socket.end(response);
+}
 var STORE_MUTEX_ID_PREFIX = "byok-store-mutex-v1:";
 var STORE_MUTEX_PROBE_TIMEOUT_MS = 1e3;
+var STORE_MUTEX_SOCKET_FILENAME = "mutex.sock";
+var UNIX_SOCKET_PATH_SOFT_LIMIT2 = 100;
+var STORE_MUTEX_FALLBACK_ROOT = "/tmp";
 function storeMutexIdentity(canonicalStoreDir) {
   return createHash("sha256").update(canonicalStoreDir).digest("hex");
 }
-function storeMutexPort(identity, attempt) {
-  const digest = Buffer.from(identity, "hex");
-  const start = digest.readUInt32BE(0) % STORE_MUTEX_PORT_COUNT;
-  const step = 1 + digest.readUInt32BE(4) % (STORE_MUTEX_PORT_COUNT - 1);
-  return STORE_MUTEX_PORT_BASE + (start + attempt * step) % STORE_MUTEX_PORT_COUNT;
+function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
+  if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
+  const candidate = path20.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
+  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
+  return path20.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
 }
 var DaemonOwnerActiveError = class extends Error {
   constructor(role) {
@@ -5051,7 +6143,7 @@ async function portIsBound(port) {
   });
 }
 async function createLivenessListener() {
-  const server = createServer((socket) => socket.end());
+  const server = createServer((socket) => endOwnershipProbe(socket));
   const port = await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
@@ -5078,70 +6170,90 @@ async function createLivenessListener() {
     })
   };
 }
-async function probeStoreMutex(port) {
+async function probeStoreMutex(endpoint, identity) {
   return new Promise((resolve) => {
-    const socket = createConnection({ host: "127.0.0.1", port });
+    const socket = createConnection(endpoint);
     let settled = false;
     let raw = "";
     const finish = (result) => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
       socket.destroy();
       resolve(result);
     };
+    const timer = setTimeout(() => finish({ kind: "occupied" }), STORE_MUTEX_PROBE_TIMEOUT_MS);
     socket.setEncoding("utf8");
-    socket.setTimeout(STORE_MUTEX_PROBE_TIMEOUT_MS, () => finish({ kind: "uncertain" }));
     socket.on("data", (chunk) => {
       raw += chunk;
-      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "foreign-or-gone" });
-    });
-    socket.once("end", () => {
-      const line = raw.trimEnd();
-      const identity = line.startsWith(STORE_MUTEX_ID_PREFIX) ? line.slice(STORE_MUTEX_ID_PREFIX.length) : void 0;
-      finish(
-        identity && /^[a-f0-9]{64}$/.test(identity) ? { kind: "identity", identity } : { kind: "foreign-or-gone" }
-      );
+      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "occupied" });
     });
-    socket.once("error", () => finish({ kind: "foreign-or-gone" }));
+    socket.once("end", () => finish(raw.trimEnd() === `${STORE_MUTEX_ID_PREFIX}${identity}` ? { kind: "holder" } : { kind: "occupied" }));
+    socket.once(
+      "error",
+      (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT" ? { kind: "unbound" } : { kind: "occupied" })
+    );
   });
 }
+async function clearStaleStoreMutexSocket(endpoint, identity) {
+  let stat;
+  try {
+    stat = await promises.lstat(endpoint);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  if (!stat.isSocket()) throw new Error("store mutation lock path exists but is not a socket");
+  if ((await probeStoreMutex(endpoint, identity)).kind !== "unbound") throw new DaemonOwnerActiveError("unknown");
+  await promises.rm(endpoint, { force: true });
+}
+async function assertOwnedPrivateDir2(dir) {
+  const uid = process.getuid?.();
+  if (uid === void 0) return;
+  const stat = await promises.lstat(dir);
+  if (stat.isSymbolicLink() || stat.uid !== uid) {
+    throw new Error(`refusing to bind the store mutation lock under "${dir}": not a real directory owned by this process's own uid`);
+  }
+}
 async function acquireStoreMutex(canonicalStoreDir) {
   const identity = storeMutexIdentity(canonicalStoreDir);
-  for (let attempt = 0; attempt < STORE_MUTEX_PORT_CANDIDATES; attempt += 1) {
-    const server = createServer((socket) => socket.end(`${STORE_MUTEX_ID_PREFIX}${identity}
+  const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
+  const isPipe = process.platform === "win32";
+  if (!isPipe) {
+    const endpointDir = path20.dirname(endpoint);
+    if (endpointDir !== canonicalStoreDir) {
+      await ensureSecureDir(endpointDir);
+      await assertOwnedPrivateDir2(endpointDir);
+    }
+    await clearStaleStoreMutexSocket(endpoint, identity);
+  }
+  const server = createServer((socket) => endOwnershipProbe(socket, `${STORE_MUTEX_ID_PREFIX}${identity}
 `));
-    const port = storeMutexPort(identity, attempt);
-    try {
-      await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
-          server.removeListener("error", reject);
-          resolve();
-        });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(endpoint, () => {
+        server.removeListener("error", reject);
+        resolve();
       });
-    } catch (err) {
-      if (err.code !== "EADDRINUSE") throw err;
-      const probe = await probeStoreMutex(port);
-      if (probe.kind === "uncertain" || probe.kind === "identity" && probe.identity === identity) {
-        throw new DaemonOwnerActiveError("unknown");
-      }
-      continue;
-    }
-    server.unref();
-    let closed = false;
-    return {
-      port,
-      close: () => new Promise((resolve, reject) => {
-        if (closed) {
-          resolve();
-          return;
-        }
-        closed = true;
-        server.close((err) => err ? reject(err) : resolve());
-      })
-    };
+    });
+  } catch (err) {
+    if (err.code === "EADDRINUSE") throw new DaemonOwnerActiveError("unknown");
+    throw err;
   }
-  throw new DaemonOwnerActiveError("unknown");
+  if (!isPipe) await promises.chmod(endpoint, 384).catch(() => void 0);
+  server.unref();
+  let closed = false;
+  return {
+    endpoint,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      await new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));
+      if (!isPipe) await promises.rm(endpoint, { force: true }).catch(() => void 0);
+    }
+  };
 }
 async function reclaimExistsAndIsActive(reclaimPath) {
   let stat;
@@ -5257,7 +6369,8 @@ function toRuntimeInfoCapabilities(caps) {
     steer: caps.steer,
     resume: caps.resume,
     approvalInteractive: caps.approvalInteractive,
-    permissionModes: caps.permissionModes
+    ...caps.mcpToolsets === void 0 ? {} : { mcpToolsets: caps.mcpToolsets },
+    permissionModes: [...caps.permissionModes]
   };
 }
 var CursorStore = class {
@@ -5330,7 +6443,7 @@ var DaemonObserver = class {
   }
   /**
    * Feed a raw INBOUND (server -> daemon) envelope. Deliberately narrow: only
-   * `task.offer` produces a local event here — every other inbound type
+   * either offer variant produces a local event here — every other inbound type
    * (`task.cancel`/`task.steer`/`task.approve`/`task.reject`) is a
    * best-effort notification whose OWN observable effect already surfaces
    * through the daemon's outbound envelopes (`task.cancelled`, `task.progress`
@@ -5338,7 +6451,7 @@ var DaemonObserver = class {
    * where those are actually reported from.
    */
   handleInboundEnvelope(envelope) {
-    if (envelope.type !== "task.offer") return;
+    if (envelope.type !== "task.offer" && envelope.type !== "task.offer_with_toolsets") return;
     const taskId = envelope.task_id;
     if (this.taskInfo.has(taskId)) return;
     this.upsertTask(taskId, { state: "Offered", runtime: envelope.payload.runtime });
@@ -5459,6 +6572,37 @@ var DaemonObserver = class {
   noteShutdownComplete(reason, undeliveredOutboxCount) {
     this.emit({ kind: "shutdown-complete", ts: nowIso(), reason, undeliveredOutboxCount });
   }
+  /**
+   * Plan `device-assertion-broker`: see the `device-assertion` `DaemonEvent`
+   * variant's own doc comment. The parameter type is what keeps the signature
+   * out — there is no field to pass one through.
+   *
+   * codex round-2 F4: the DENIED caller can pass its raw `audience` here, but
+   * it is converted to a byte SIZE the instant the event is constructed and the
+   * raw string is dropped — it is never placed on the emitted `DaemonEvent`, so
+   * it cannot reach a subscriber, `format.ts`, stdout, or the audit file. The
+   * ISSUED `audience` came from the allowlist and is kept verbatim.
+   */
+  noteDeviceAssertion(event) {
+    if (event.result === "issued") {
+      this.emit({
+        kind: "device-assertion",
+        ts: nowIso(),
+        result: "issued",
+        audience: event.audience,
+        jti: event.jti,
+        expiresAt: event.expiresAt
+      });
+      return;
+    }
+    this.emit({
+      kind: "device-assertion",
+      ts: nowIso(),
+      result: "denied",
+      reason: event.reason,
+      audienceSize: event.audience === void 0 ? void 0 : Buffer.byteLength(event.audience, "utf8")
+    });
+  }
   /** M4 Phase 3 hardening: see the `stale-approval-decision` `DaemonEvent` variant's own doc comment. */
   noteStaleApprovalDecision(taskId, decision, reason) {
     this.emit({ kind: "stale-approval-decision", ts: nowIso(), taskId, decision, reason });
@@ -5466,6 +6610,9 @@ var DaemonObserver = class {
   noteGitWorkspace(event) {
     this.emit({ kind: "git-workspace", ts: nowIso(), ...event });
   }
+  noteRuntimeDisposalFailure(event) {
+    this.emit({ kind: "runtime-disposal-failed", ts: nowIso(), ...event });
+  }
   /**
    * Finding F4: wired from `TaskRunnerDeps.onApprovalDispatched`, called
    * synchronously by `TaskRunner.dispatchApproval` BEFORE its own
@@ -7097,6 +8244,21 @@ var MAX_INLINE_ARTIFACT_BYTES = 64 * 1024;
 var MAX_TRACKED_TASK_IDS = 2e3;
 var MAX_DURATION_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxDurationMs";
 var MAX_OUTPUT_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxTaskOutputBytes";
+var RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result document undeliverable";
+function resultDocumentRejectionDetail(check) {
+  switch (check.reason) {
+    case "over-cap":
+      return `${check.bytes} bytes as canonical JSON, over the ${RESULT_DOCUMENT_MAX_BYTES}-byte limit (it is never truncated \u2014 a truncated JSON document is not valid JSON; use artifactRefs for a result this size)`;
+    case "not-serializable":
+      return "not JSON-serializable (JSON.stringify threw, or produced no output at all)";
+    case "not-plain-json":
+      return "not plain JSON data: it does not equal its own JSON round trip, so serializing it would silently change it (an undefined-valued key, NaN, a function or symbol value, a Date, a toJSON that rewrites the value, or a getter that answers differently on a second read)";
+    default: {
+      const exhaustive = check;
+      throw new Error(`unhandled result document rejection: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
 var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
 function isKnownRuntimeId(id) {
   return RuntimeIdSchema.safeParse(id).success;
@@ -7104,12 +8266,20 @@ function isKnownRuntimeId(id) {
 var DEFAULT_RUNTIME_PREFERENCE = ["claude", "codex", "pi"];
 function orderByPreference(candidates, preference) {
   const rank = new Map(preference.map((id, index) => [id, index]));
-  return [...candidates].sort((a, b) => (rank.get(a.id) ?? preference.length) - (rank.get(b.id) ?? preference.length));
+  return [...candidates].sort((a, b) => (rank.get(a.descriptor.id) ?? preference.length) - (rank.get(b.descriptor.id) ?? preference.length));
 }
-function adapterSupportsMode(adapter, mode) {
-  return adapter.capabilities().permissionModes.includes(mode);
+function adapterSupportsMode(descriptor, mode) {
+  return descriptor.capabilities.permissionModes.includes(mode);
 }
-function errorMessage3(err) {
+function adapterSupportsMcpToolsets(descriptor) {
+  return descriptor.capabilities.mcpToolsets === true;
+}
+function withoutRequiredToolsets(payload) {
+  if (!("requiredToolsets" in payload)) return payload;
+  const { requiredToolsets, ...offer } = payload;
+  return offer;
+}
+function errorMessage4(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function raceSettleFirst(fn, timeoutMs) {
@@ -7162,7 +8332,7 @@ async function openArtifact(workspaceDir, name) {
   try {
     handle = await promises.open(candidate, constants.O_RDONLY | O_NOFOLLOW);
   } catch (err) {
-    return { ok: false, reason: `artifact "${name}" could not be opened: ${errorMessage3(err)}` };
+    return { ok: false, reason: `artifact "${name}" could not be opened: ${errorMessage4(err)}` };
   }
   try {
     const st = await handle.stat();
@@ -7174,7 +8344,7 @@ async function openArtifact(workspaceDir, name) {
   } catch (err) {
     await handle.close().catch(() => {
     });
-    return { ok: false, reason: `artifact "${name}" could not be verified: ${errorMessage3(err)}` };
+    return { ok: false, reason: `artifact "${name}" could not be verified: ${errorMessage4(err)}` };
   }
   return { ok: true, handle };
 }
@@ -7188,13 +8358,13 @@ var TaskRunner = class {
    * Finding F4 (cancel lost during the offer-processing window): a
    * `task.cancel` for a taskId that hasn't finished `handleOffer` yet (still
    * awaiting adapter detection / instruction resolution / workspace setup /
-   * `adapter.start()`) has no `this.tasks` entry to land on — it used to be
+   * prepared operation `start()`) has no `this.tasks` entry to land on — it used to be
    * silently dropped, and the runtime session `handleOffer` was about to
    * register would then run an unsupervised ("zombie") turn nobody asked
    * for anymore. Recording the taskId here lets `handleOffer` consult it at
    * the two points where it can still safely react (see its body): before
    * claiming at all (decline instead of ever starting a session), and right
-   * after `adapter.start()` resolves but before this task is registered as
+   * after the prepared operation resolves but before this task is registered as
    * active (tear the just-started session down immediately, before its
    * event loop ever pumps a single event). Consumed (deleted) at whichever
    * checkpoint handles it; a cancel for a taskId that's already active,
@@ -7220,12 +8390,12 @@ var TaskRunner = class {
    * checkpoint-2 cancel-teardown, or successful registration into
    * `this.tasks`). Bounded eviction on `pendingCancelled` (below) must never
    * remove an entry for a taskId in this set: doing so is exactly the bug —
-   * block task A in `adapter.start()`, deliver A's own `task.cancel` (so
+   * block task A in prepared-operation `start()`, deliver A's own `task.cancel` (so
    * `pendingCancelled` gets an entry for A while A is still in-flight),
    * then deliver `MAX_TRACKED_TASK_IDS` more cancels for unrelated taskIds
    * nobody ever offered — under naive oldest-wins eviction, A's entry (the
    * single oldest) gets evicted purely because of unrelated churn, so when
-   * `adapter.start()` finally resolves, checkpoint 2 finds no cancel marker
+   * the prepared operation finally resolves, checkpoint 2 finds no cancel marker
    * and the already-cancelled task starts a real session. See
    * `evictPendingCancelled` below for the fix, and
    * `task-runner-bounded-collections.test.ts` for a test mirroring this
@@ -7245,7 +8415,7 @@ var TaskRunner = class {
    * explicitly relies on redelivered handlers being idempotent for exactly
    * this reason). `handleOffer` must treat a redelivered offer for a taskId
    * that's already active (`this.tasks`) or already finished (this set) as
-   * a no-op — never a second `adapter.start()` call, which would orphan the
+   * a no-op — never a second prepared-operation `start()` call, which would orphan the
    * first session.
    *
    * M3-B: unbounded otherwise — a long-lived daemon that's finished many
@@ -7314,10 +8484,9 @@ var TaskRunner = class {
     this.stoppingOffers = true;
   }
   /**
-   * M4 Phase 2: best-effort shutdown of every currently ACTIVE task, for the
-   * control socket's `shutdown` RPC. Mirrors `handleCancel`'s best-effort
-   * `session.interrupt()` style (an interrupt failure is swallowed; the
-   * terminal message is sent either way) but reports `task.fail` rather than
+   * Shutdown of every currently ACTIVE task for the control socket's
+   * `shutdown` RPC. Soft interrupt remains bounded, but each task's
+   * authoritative close receipt must settle successfully. Reports `task.fail` rather than
    * `task.cancelled` — these tasks aren't ending because the SERVER
    * cancelled them, they're ending because this device is shutting down.
    * `retryable: true` throughout: nothing about the task/policy itself was
@@ -7371,28 +8540,13 @@ var TaskRunner = class {
    * unconditionally, so a hung `interrupt()` (a misbehaving adapter) can
    * never block `task.fail` from being sent at all.
    *
-   * New in this batch — hard-kill escalation: when `interrupt()` does NOT
-   * settle within that same grace window, `session.close()` is tried next
-   * (ALSO raced against `timeoutMs`, for the identical reason: a hung
-   * `close()` must not be able to block this forever either — which matters
-   * far more here than it used to for the pre-existing graceful-shutdown-only
-   * caller, since THAT path is additionally bounded by an outer deadline
-   * (`SHUTDOWN_TASK_TEARDOWN_DEADLINE_MS`/`DaemonConfig.shutdownGraceMs`,
-   * `create-daemon.ts`), while resource-limit enforcement fires during
-   * ordinary operation with no such outer bound watching it). `close()` is
-   * every adapter's harder teardown primitive — an actual process-level kill
-   * (SIGTERM, or `taskkill /F` on Windows — see e.g.
-   * `ClaudeProcessClient.kill()`/`PiRpcClient.kill()`) as opposed to pi's own
-   * soft in-band `interrupt()` (an RPC `abort` message that leaves the
-   * process alive and resumable) — so escalating to it is the closest thing
-   * to a "hard kill" the `Session` interface exposes. `finish()` below calls
-   * `session.close()` again regardless (documented idempotent) — this isn't
-   * a substitute for that, only an earlier, bounded attempt at actually
-   * stopping a stuck runtime before this method gives up and reports failure
-   * anyway.
+   * After the bounded soft interrupt, `finish()` always awaits the authoritative
+   * `Session.close()` receipt. A failed receipt retains active/Git ownership;
+   * shutdown surfaces the rejection while resource enforcement leaves local
+   * evidence for a later retry.
    *
    * Re-checks task identity (`this.tasks.get(...) === active`) immediately
-   * before sending `task.fail`: the interrupt/hard-kill race above has await
+   * before sending `task.fail`: the interrupt race above has await
    * points during which a DIFFERENT path (a racing `task.cancel`/
    * `task.reject`, or the session completing normally on its own) may have
    * already finished this exact task and sent its own terminal message.
@@ -7401,20 +8555,25 @@ var TaskRunner = class {
    * identity-check guard for the same class of race.
    */
   async teardownActiveTask(active, reason, retryable) {
+    if (active.finalizationStarted) return this.finish(active.taskId);
+    if (!this.reserveSemanticTerminal(active)) return active.semanticTerminalSettled ?? false;
     active.beingTornDown = true;
     await this.observeGit(active, "salvage");
     const timeoutMs = this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS;
-    const interrupted = await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
-    if (!interrupted) {
-      await raceSettleFirst(() => active.session.close(), timeoutMs);
-    }
-    if (this.tasks.get(active.taskId) !== active) return;
+    await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
+    if (this.tasks.get(active.taskId) !== active) return true;
     this.deps.send(createEnvelope("task.fail", { reason, retryable }, { taskId: active.taskId }));
-    await this.finish(active.taskId);
+    return this.finish(active.taskId);
   }
   /** Graceful-shutdown caller of {@link teardownActiveTask} — see `shutdownActiveTasks`'s own doc comment. `retryable: true`: nothing about the task/policy itself was ever at fault, only this device's own availability right now. */
   async shutdownTask(active, reason) {
-    await this.teardownActiveTask(active, `daemon shutting down: ${reason}`, true);
+    const disposed = await this.teardownActiveTask(active, `daemon shutting down: ${reason}`, true);
+    if (!disposed) {
+      throw new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: `${active.adapter.descriptor.id} runtime ownership remains active after shutdown disposal failed`
+      });
+    }
   }
   /**
    * M5 batch-3 (workstream 2): shared entry point for both resource-limit
@@ -7464,6 +8623,9 @@ var TaskRunner = class {
       case "task.offer":
         await this.handleOffer(envelope.task_id, envelope.payload);
         return;
+      case "task.offer_with_toolsets":
+        await this.handleOffer(envelope.task_id, envelope.payload);
+        return;
       case "task.cancel":
         await this.handleCancel(envelope.task_id, envelope.payload.reason);
         return;
@@ -7517,16 +8679,49 @@ var TaskRunner = class {
         );
         return;
       }
-      const pick = await this.pickAdapter(payload.runtime, payload.policy.mode);
-      if (!pick.ok) {
-        this.decline(taskId, pick.reason, pick.retryable);
-        return;
-      }
+      if (payload.dispatchSelection !== void 0 && payload.runtime !== void 0 && payload.runtime !== payload.dispatchSelection.runtimeId) {
+        this.decline(
+          taskId,
+          `offer runtime ${payload.runtime} does not match dispatchSelection.runtimeId ${payload.dispatchSelection.runtimeId}`,
+          false
+        );
+        return;
+      }
+      const requiredToolsets = "requiredToolsets" in payload ? payload.requiredToolsets : void 0;
+      const resolvedMcp = requiredToolsets ? this.resolveMcpServers(requiredToolsets) : void 0;
+      if (resolvedMcp && !resolvedMcp.ok) {
+        this.decline(taskId, resolvedMcp.reason, true);
+        return;
+      }
       const decision = computeEffectivePolicy(payload.policy, this.deps.permissionDefaults);
       if (!decision.ok) {
         this.decline(taskId, decision.reason ?? "policy rejected", false);
         return;
       }
+      const offered = withoutRequiredToolsets(payload);
+      const requestedRuntime = payload.dispatchSelection?.runtimeId ?? payload.runtime;
+      const pick = await this.pickAdapter(requestedRuntime, payload.policy.mode, requiredToolsets !== void 0);
+      if (!pick.ok) {
+        this.decline(taskId, pick.reason, pick.retryable);
+        return;
+      }
+      let prepared;
+      try {
+        prepared = await pick.adapter.prepare({
+          offer: offered,
+          policy: decision.policy,
+          descriptor: pick.descriptor,
+          requiredToolsetIds: requiredToolsets ?? [],
+          ...resolvedMcp?.ok ? { mcpServers: resolvedMcp.servers } : {}
+        });
+      } catch (error) {
+        this.decline(taskId, `runtime preparation failed: ${errorMessage4(error)}`, true);
+        return;
+      }
+      if (prepared.kind === "reject") {
+        this.decline(taskId, prepared.reason, prepared.retryable);
+        return;
+      }
       let known = void 0;
       let workspaceDir;
       let gitLease;
@@ -7559,6 +8754,7 @@ var TaskRunner = class {
           }
         } else {
           workspaceDir = path20.join(this.deps.workspaceRoot, taskId);
+          gitWorkspaceId = randomUUID();
         }
         try {
           gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
@@ -7574,6 +8770,26 @@ var TaskRunner = class {
         this.decline(taskId, "workspace mode is unavailable", true);
         return;
       }
+      const env = buildRuntimeEnv({
+        ambient: process.env,
+        requirements: pick.descriptor.environmentRequirements,
+        locallyAllowedNames: this.deps.runtimeEnvironment?.[pick.descriptor.id]?.allow
+      });
+      const manifest = sealRuntimeOperationManifest({
+        taskId,
+        runtimeId: pick.descriptor.id,
+        descriptor: pick.descriptor,
+        policy: decision.policy,
+        requiredToolsetIds: requiredToolsets ?? [],
+        ...offered.dispatchSelection === void 0 ? {} : { dispatchSelection: offered.dispatchSelection },
+        ...known === void 0 || payload.sessionRef === void 0 ? {} : { sessionRef: payload.sessionRef },
+        workspace: {
+          workspaceDir,
+          ...gitWorkspaceId === void 0 ? {} : { workspaceId: gitWorkspaceId },
+          ...gitBaseline === void 0 ? {} : { baseline: gitBaseline }
+        },
+        forwardedEnvironmentNames: Object.freeze(Object.keys(env).sort())
+      });
       this.deps.send(
         createEnvelope(
           "task.claim",
@@ -7589,7 +8805,7 @@ var TaskRunner = class {
             // (the merely REQUESTED runtime): this is what closes the gap
             // where an auto-selected task left the server never learning
             // which runtime actually ran.
-            runtime: isKnownRuntimeId(pick.adapter.id) ? pick.adapter.id : void 0,
+            runtime: isKnownRuntimeId(manifest.descriptor.id) ? manifest.descriptor.id : void 0,
             // S0/D-4 (`task.claim.capabilities`, docs/protocol.md §2.4): the
             // selected adapter's own capability self-report, carried on the
             // same message that establishes the task↔runtime binding. The
@@ -7606,7 +8822,7 @@ var TaskRunner = class {
             // Gating them would silently strip a custom steer-capable
             // adapter's own truth and leave the server fail-closing on it
             // forever.
-            capabilities: toRuntimeInfoCapabilities(pick.adapter.capabilities())
+            capabilities: toRuntimeInfoCapabilities(manifest.descriptor.capabilities)
           },
           { taskId }
         )
@@ -7617,7 +8833,7 @@ var TaskRunner = class {
         if (plainWorkspaceNeedsResolve) workspaceDir = await this.resolveWorkspaceDir(taskId, known?.workspaceDir);
       } catch (err) {
         gitLease?.release();
-        await this.fail(taskId, `failed to resolve instruction blob: ${errorMessage3(err)}`, true);
+        await this.fail(taskId, `failed to resolve instruction blob: ${errorMessage4(err)}`, true);
         return;
       }
       if (this.deps.gitWorkspaceManager && gitLease) {
@@ -7626,7 +8842,7 @@ var TaskRunner = class {
           if (gitExisting) {
             observation = await this.deps.gitWorkspaceManager.validateExisting(workspaceDir);
           } else {
-            const workspaceId2 = randomUUID();
+            const workspaceId2 = gitWorkspaceId ?? randomUUID();
             const now2 = (/* @__PURE__ */ new Date()).toISOString();
             gitWorkspaceId = workspaceId2;
             await this.deps.gitWorkspaceStore?.upsert({
@@ -7677,29 +8893,11 @@ var TaskRunner = class {
           return;
         }
       }
-      const ctx = {
-        workspaceDir,
-        policy: decision.policy,
-        ...gitWorkspaceId ? { gitWorkspace: { workspaceId: gitWorkspaceId, baseline: gitBaseline } } : {},
-        // M5: no longer `process.env` verbatim (see `environment.ts`'s own
-        // module doc comment for the credential-leak gap that closed) —
-        // built fresh per task from the SPECIFIC adapter `pickAdapter`
-        // above already selected, so this always runs after adapter
-        // selection: `pick.adapter.environmentRequirements?.()` (undefined
-        // ⇒ platform baseline only, fail-closed) plus this device's own
-        // `runtimeEnvironment` override, keyed by that same adapter's `id`.
-        env: buildRuntimeEnv({
-          ambient: process.env,
-          requirements: pick.adapter.environmentRequirements?.(),
-          locallyAllowedNames: this.deps.runtimeEnvironment?.[pick.adapter.id]?.allow
-        }),
-        // M4 Phase 3: adapter-agnostic and cheap to always populate — only an
-        // adapter whose runtime genuinely supports an out-of-band approval
-        // pause (claude, today) ever reads this. `resolve` is a closure over
-        // `taskId` (not a pre-bound approvalId): it looks up whichever
-        // approval is CURRENTLY pending for this task at call time, since one
-        // task/session can face several approval requests, one at a time,
-        // over its life. See `types.ts`'s `ApprovalChannel` doc comment.
+      const startInput = {
+        manifest,
+        instruction: gitWorkspaceId ? prependGitWorkspaceGuidance(resolvedInstruction) : resolvedInstruction,
+        env,
+        ...resolvedMcp?.ok ? { mcpServers: resolvedMcp.servers } : {},
         approvalChannel: {
           taskId,
           storeDir: this.deps.storeDir,
@@ -7715,45 +8913,19 @@ var TaskRunner = class {
           }
         }
       };
-      const effectiveOffer = {
-        ...payload,
-        instruction: gitWorkspaceId ? prependGitWorkspaceGuidance(resolvedInstruction) : resolvedInstruction,
-        // Never forward a sessionRef this device has no recorded workspace
-        // for (stale, from another device, or simply made up) — an adapter
-        // that tries to resume an id it never minted fails outright (pi:
-        // "No session found matching '<id>'", exit 1, empirically confirmed)
-        // instead of silently starting fresh, so an unresolvable sessionRef
-        // must look identical to "none supplied" by the time it reaches the
-        // adapter, not get forwarded as a resume attempt doomed to fail.
-        sessionRef: known ? payload.sessionRef : void 0
-      };
       let session;
       try {
-        session = await pick.adapter.start(effectiveOffer, ctx);
+        session = await prepared.operation.start(startInput);
       } catch (err) {
-        const retryable = !(err instanceof PolicyUnsupportedError);
-        await this.updateGitPhaseBestEffort(gitWorkspaceId, "failed", "repository-invalid");
-        gitLease?.release();
-        await this.fail(taskId, `adapter failed to start: ${errorMessage3(err)}`, retryable);
-        return;
-      }
-      if (this.pendingCancelled.has(taskId)) {
-        const reason = this.pendingCancelled.get(taskId);
-        this.pendingCancelled.delete(taskId);
-        try {
-          await session.interrupt();
-        } catch {
-        }
-        try {
-          await session.close();
-        } catch {
+        const failure = projectRuntimeBoundaryFailure(err, "start");
+        if (failure.contractViolation) {
+          console.error("[byok/client] runtime adapter start() returned an untyped failure", err);
         }
+        await this.updateGitPhaseBestEffort(gitWorkspaceId, "failed", "repository-invalid");
         gitLease?.release();
-        await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
-        this.deps.send(createEnvelope("task.cancelled", { reason }, { taskId }));
+        await this.fail(taskId, failure.reason, failure.retryable);
         return;
       }
-      this.deps.send(createEnvelope("task.started", {}, { taskId }));
       const active = {
         taskId,
         adapter: pick.adapter,
@@ -7770,6 +8942,21 @@ var TaskRunner = class {
         approvalQueue: [],
         outputBytesSoFar: 0
       };
+      if (this.pendingCancelled.has(taskId)) {
+        const reason = this.pendingCancelled.get(taskId);
+        this.pendingCancelled.delete(taskId);
+        this.tasks.set(taskId, active);
+        this.reserveSemanticTerminal(active);
+        try {
+          await session.interrupt();
+        } catch {
+        }
+        await this.updateGitPhaseBestEffort(gitWorkspaceId, "cancelled");
+        this.deps.send(createEnvelope("task.cancelled", { reason }, { taskId }));
+        await this.finish(taskId);
+        return;
+      }
+      this.deps.send(createEnvelope("task.started", {}, { taskId }));
       this.tasks.set(taskId, active);
       if (payload.limits?.maxDurationMs !== void 0) {
         this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
@@ -7794,9 +8981,40 @@ var TaskRunner = class {
     if (typeof instruction === "string") return instruction;
     return this.deps.blobClient.resolveInstruction(instruction.blobRef);
   }
+  /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
+  resolveMcpServers(requiredToolsets) {
+    const registry = this.deps.mcpToolsets;
+    if (!registry) {
+      return { ok: false, reason: "offer requires MCP toolsets, but this device has no local mcpToolsets registry" };
+    }
+    const servers = /* @__PURE__ */ Object.create(null);
+    for (const toolsetId of requiredToolsets) {
+      const toolset = registry.get(toolsetId);
+      if (!toolset) {
+        return { ok: false, reason: `required MCP toolset "${toolsetId}" is not configured on this device` };
+      }
+      for (const [serverName, server] of Object.entries(toolset.mcpServers)) {
+        if (Object.prototype.hasOwnProperty.call(servers, serverName)) {
+          return {
+            ok: false,
+            reason: `required MCP toolsets collide on server name "${serverName}"; refusing ambiguous projection`
+          };
+        }
+        servers[serverName] = Object.freeze({
+          command: server.command,
+          ...server.args ? { args: Object.freeze([...server.args]) } : {}
+        });
+      }
+    }
+    if (Object.keys(servers).length === 0) {
+      return { ok: false, reason: "required MCP toolsets resolved to no servers; refusing to run without tools" };
+    }
+    return { ok: true, servers: Object.freeze(servers) };
+  }
   async pump(active) {
     try {
       for await (const event of active.session.events) {
+        if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
         if (this.tasks.get(active.taskId) !== active) return;
         active.outputBytesSoFar += estimateEventBytes(event);
         if (active.outputBytesSoFar > this.maxTaskOutputBytes) {
@@ -7819,7 +9037,7 @@ var TaskRunner = class {
             try {
               await active.session.resolveApproval(approved, reason);
             } catch (err) {
-              await this.fail(taskId, `failed to resume session after approval decision: ${errorMessage3(err)}`, false);
+              await this.fail(taskId, `failed to resume session after approval decision: ${errorMessage4(err)}`, false);
             }
           });
           continue;
@@ -7827,11 +9045,40 @@ var TaskRunner = class {
         if (event.type === "turn_end") {
           active.batcher.push(event);
           active.batcher.flush();
+          const finalOutput = active.summaryParts.join("");
+          const outcome = await this.resolveResultDocument(active, finalOutput);
+          if (!outcome.deliver) return;
           await this.observeGit(active, "completed");
+          if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
+          if (outcome.document !== void 0 && !this.hasResultDocumentCapability()) {
+            await this.fail(
+              active.taskId,
+              `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server stopped advertising the result-document capability before this completion could be sent (a reconnect to an older server), so it would silently discard this document`,
+              false
+            );
+            return;
+          }
+          if (!this.reserveSemanticTerminal(active)) return;
           this.deps.send(
             createEnvelope(
               "task.complete",
-              { summary: active.summaryParts.join(""), sessionRef: active.session.sessionRef },
+              {
+                summary: finalOutput,
+                sessionRef: active.session.sessionRef,
+                // Spread rather than `document: outcome.document`, so a
+                // completion with no document is the exact same payload it
+                // was before this field existed — not one carrying an
+                // explicit `document: undefined` key.
+                //
+                // `outcome.document` is the protocol's CANONICAL SNAPSHOT
+                // (`checkResultDocument`), never the object the extractor
+                // returned: pure data serializes identically at the root
+                // (where it was measured) and nested inside this payload
+                // (where the codec actually serializes it), so a contextual
+                // `toJSON(key)` or an unstable getter cannot make the wire
+                // bytes differ from what the cap gate approved.
+                ...outcome.document !== void 0 ? { document: outcome.document } : {}
+              },
               { taskId: active.taskId, sessionRef: active.session.sessionRef }
             )
           );
@@ -7847,11 +9094,17 @@ var TaskRunner = class {
         active.batcher.push(event);
       }
       if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
-      await this.fail(active.taskId, "runtime session ended without completing the task", true);
+      const failure = projectRuntimeBoundaryFailure(void 0, "run");
+      console.error("[byok/client] runtime adapter events iterable ended without terminal authority");
+      await this.fail(active.taskId, failure.reason, failure.retryable);
     } catch (err) {
       if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
       active.batcher.flush();
-      await this.fail(active.taskId, `runtime error: ${errorMessage3(err)}`, true);
+      const failure = projectRuntimeBoundaryFailure(err, "run");
+      if (failure.contractViolation) {
+        console.error("[byok/client] runtime adapter events iterable returned an untyped failure", err);
+      }
+      await this.fail(active.taskId, failure.reason, failure.retryable);
     }
   }
   /**
@@ -7890,7 +9143,7 @@ var TaskRunner = class {
     try {
       bytes = await opened.handle.readFile();
     } catch (err) {
-      this.reportArtifactError(active, name, `failed to read artifact "${name}": ${errorMessage3(err)}`);
+      this.reportArtifactError(active, name, `failed to read artifact "${name}": ${errorMessage4(err)}`);
       return;
     } finally {
       await opened.handle.close().catch(() => {
@@ -7907,7 +9160,7 @@ var TaskRunner = class {
       const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType);
       this.deps.send(createEnvelope("task.artifact", { name, contentType, blobRef }, { taskId: active.taskId }));
     } catch (err) {
-      this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage3(err)}`);
+      this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage4(err)}`);
     }
   }
   /** Loud, non-silent artifact failure (finding F7): logged, and folded into this task's own progress stream as an `error` AgentEvent rather than swallowed — the task itself can still complete normally, but the omission is now visible. */
@@ -7921,6 +9174,14 @@ var TaskRunner = class {
       this.setPendingCancelled(taskId, reason);
       return;
     }
+    if (active.finalizationStarted) {
+      await this.finish(taskId);
+      return;
+    }
+    if (!this.reserveSemanticTerminal(active)) {
+      await active.semanticTerminalSettled;
+      return;
+    }
     try {
       await active.session.interrupt();
     } catch {
@@ -7949,7 +9210,7 @@ var TaskRunner = class {
    *
    * `inFlightOffers` is naturally tiny (bounded by this device's real
    * concurrent-offer-processing count — normally single digits, driven by
-   * how many `task.offer`s are simultaneously mid-`adapter.start()` — nowhere
+   * how many `task.offer`s are simultaneously mid-prepared-operation start() — nowhere
    * near `MAX_TRACKED_TASK_IDS`), so this scan is cheap in practice: it
    * finds a safe entry at or near the front almost always. The only case
    * where NO entry is safe to evict is every single tracked cancel
@@ -8302,7 +9563,7 @@ var TaskRunner = class {
         this.deps.onStaleApprovalDecision?.(taskId, "approve");
         return;
       }
-      await this.fail(taskId, `failed to resume session after approval: ${errorMessage3(err)}`, false);
+      await this.fail(taskId, `failed to resume session after approval: ${errorMessage4(err)}`, false);
       return;
     }
     this.clearPendingApproval(resolvedId, "approve", void 0);
@@ -8333,6 +9594,10 @@ var TaskRunner = class {
   async handleReject(taskId, reason, approvalId) {
     const active = this.tasks.get(taskId);
     if (!active) return;
+    if (active.finalizationStarted) {
+      await this.finish(taskId);
+      return;
+    }
     if (approvalId !== void 0 && approvalId !== active.pendingApprovalId) {
       this.deps.onStaleApprovalDecision?.(
         taskId,
@@ -8351,6 +9616,10 @@ var TaskRunner = class {
       }
     }
     this.clearPendingApproval(resolvedId, "reject", reason);
+    if (!this.reserveSemanticTerminal(active)) {
+      await active.semanticTerminalSettled;
+      return;
+    }
     try {
       await active.session.interrupt();
     } catch {
@@ -8365,10 +9634,114 @@ var TaskRunner = class {
   }
   async fail(taskId, reason, retryable) {
     const active = this.tasks.get(taskId);
+    if (active?.finalizationStarted) {
+      await this.finish(taskId);
+      return;
+    }
+    if (active && !this.reserveSemanticTerminal(active)) {
+      await active.semanticTerminalSettled;
+      return;
+    }
     if (active) await this.observeGit(active, "salvage");
     this.deps.send(createEnvelope("task.fail", { reason, retryable }, { taskId }));
     await this.finish(taskId);
   }
+  /**
+   * additive-minor (`task.complete.document`): the whole daemon-side gate
+   * between a configured {@link ResultDocumentExtractor} and the wire —
+   * called once, from the `turn_end` completion path, immediately before
+   * `task.complete` is built.
+   *
+   * `{deliver: true}` means "go on and send `task.complete`", carrying the
+   * document when there is one. `{deliver: false}` means this method has
+   * ALREADY reported `task.fail` and finished the task; the caller must
+   * return without sending anything further.
+   *
+   * Four fail-closed branches, all `retryable: false` (see
+   * {@link RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX} for why none of them
+   * can succeed on a retry):
+   *
+   *   1. The extractor threw — its error is surfaced, never swallowed.
+   *   2. The extractor returned a thenable, violating the synchronous
+   *      contract in the one way that would otherwise ship a wrong answer.
+   *   3. The document is over the cap, not JSON-serializable, or not plain
+   *      JSON data, per `checkResultDocument` — the protocol's OWN check,
+   *      imported rather than reimplemented, so this gate and the server's
+   *      schema validation can never disagree about what is legal.
+   *   4. The connected server never advertised `result-document`. Its
+   *      tolerant `z.object()` would silently strip the field on arrival
+   *      (`version.ts`'s own flag doc comment), so "send anyway" is not a
+   *      degraded-but-working path — it is the task's primary structured
+   *      result being deleted in transit with nothing reported anywhere.
+   *
+   * The capability is checked LAST, deliberately: a document that is itself
+   * invalid is the host's own bug and is worth reporting as such even when
+   * the connected server could not have accepted any document at all. It is
+   * then re-checked once more by the caller after its own last await, since
+   * a reconnect can invalidate this answer in between (F3).
+   *
+   * **Residual window (bounded, deliberately not hacked around).** Even the
+   * caller's re-check happens before `ConnectionManager.send` hands the
+   * envelope to a transport, and a queued envelope can outlive the
+   * connection it was queued for: a reconnect between `send()` and the
+   * outbox actually draining could still deliver this `task.complete` to a
+   * rolled-back N-1 server that strips the document. Closing that would
+   * mean teaching the transport outbox to inspect payload semantics and
+   * mint a substitute `task.fail` for a task this runner already finished —
+   * a second authority over terminal outcomes living in the queue, which is
+   * worse than the window it closes. Documented instead, here and in
+   * docs/protocol.md §7.2.
+   */
+  async resolveResultDocument(active, finalOutput) {
+    const extract = this.deps.resultDocument?.extract;
+    if (!extract) return { deliver: true };
+    let document;
+    try {
+      document = extract(finalOutput, { taskId: active.taskId, sessionRef: active.session.sessionRef });
+    } catch (err) {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the configured resultDocument.extract threw: ${errorMessage4(err)}`,
+        false
+      );
+      return { deliver: false };
+    }
+    if (typeof document?.then === "function") {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the configured resultDocument.extract returned a promise; the contract is synchronous (an awaited value is never read, and a promise encodes to an empty document)`,
+        false
+      );
+      return { deliver: false };
+    }
+    if (document === void 0) return { deliver: true };
+    const check = checkResultDocument(document);
+    if (!check.ok) {
+      const detail = resultDocumentRejectionDetail(check);
+      await this.fail(active.taskId, `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: ${detail}`, false);
+      return { deliver: false };
+    }
+    if (!this.hasResultDocumentCapability()) {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server did not advertise the result-document capability, so it would silently discard this ${check.bytes}-byte document`,
+        false
+      );
+      return { deliver: false };
+    }
+    return { deliver: true, document: check.canonical };
+  }
+  /**
+   * Whether the CURRENTLY connected server advertised `result-document` —
+   * read fresh on every call, never captured, because the answer changes
+   * across a reconnect (`ConnectionManager.getServerCapabilities` returns
+   * `[]` from the moment an acked connection closes until a fresh
+   * `conn.ack` repopulates it). An absent `getServerCapabilities` seam is
+   * "no capabilities", the fail-closed reading.
+   */
+  hasResultDocumentCapability() {
+    return (this.deps.getServerCapabilities?.() ?? []).includes("result-document");
+  }
   async observeGit(active, phase) {
     if (!active.gitWorkspaceId || !this.deps.gitWorkspaceManager || !this.deps.gitWorkspaceStore) return;
     try {
@@ -8403,32 +9776,64 @@ var TaskRunner = class {
   }
   async finish(taskId) {
     const active = this.tasks.get(taskId);
-    if (!active) return;
-    if (active.maxDurationTimer) {
-      clearTimeout(active.maxDurationTimer);
-      active.maxDurationTimer = void 0;
-    }
-    active.batcher.stop();
-    this.tasks.delete(taskId);
-    this.addFinishedTaskId(taskId);
-    const queued = active.approvalQueue.splice(0);
-    for (const request of queued) {
-      request.resolve({
-        approved: false,
-        reason: `task ${taskId} finished before this queued approval request could be dispatched`
-      });
-    }
-    if (active.pendingApprovalId !== void 0) {
-      try {
-        this.deps.approvalRegistry.resolve(active.pendingApprovalId, "reject", `task ${taskId} finished`);
-      } catch {
+    if (!active) return true;
+    if (!active.finalizationStarted) {
+      active.finalizationStarted = true;
+      active.beingTornDown = true;
+      if (active.maxDurationTimer) {
+        clearTimeout(active.maxDurationTimer);
+        active.maxDurationTimer = void 0;
+      }
+      active.batcher.stop();
+      this.addFinishedTaskId(taskId);
+      const queued = active.approvalQueue.splice(0);
+      for (const request of queued) {
+        request.resolve({
+          approved: false,
+          reason: `task ${taskId} finished before this queued approval request could be dispatched`
+        });
+      }
+      if (active.pendingApprovalId !== void 0) {
+        try {
+          this.deps.approvalRegistry.resolve(active.pendingApprovalId, "reject", `task ${taskId} finished`);
+        } catch {
+        }
       }
     }
-    if (active.gitLease) active.gitLease.release();
+    const attempt = active.disposalAttempt ?? active.session.close();
+    active.disposalAttempt = attempt;
     try {
-      await active.session.close();
-    } catch {
+      await attempt;
+    } catch (caught) {
+      if (active.disposalAttempt === attempt) active.disposalAttempt = void 0;
+      const failure = isRuntimeDisposalFailure(caught) ? caught : new RuntimeDisposalFailure({
+        stage: "quiescence",
+        reason: `${active.adapter.descriptor.id} session.close() returned an untyped disposal failure`
+      }, { cause: caught });
+      console.error(`[byok/client] runtime disposal failed for task ${taskId}: ${failure.message}`);
+      this.deps.onRuntimeDisposalFailure?.({
+        taskId,
+        runtimeId: active.adapter.descriptor.id,
+        stage: failure.stage,
+        reason: failure.message
+      });
+      active.resolveSemanticTerminalSettled?.(false);
+      return false;
     }
+    if (this.tasks.get(taskId) !== active) return true;
+    active.gitLease?.release();
+    this.tasks.delete(taskId);
+    active.resolveSemanticTerminalSettled?.(true);
+    return true;
+  }
+  reserveSemanticTerminal(active) {
+    if (active.semanticTerminalReserved || active.finalizationStarted) return false;
+    active.semanticTerminalReserved = true;
+    active.beingTornDown = true;
+    active.semanticTerminalSettled = new Promise((resolve) => {
+      active.resolveSemanticTerminalSettled = resolve;
+    });
+    return true;
   }
   /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */
   addFinishedTaskId(taskId) {
@@ -8471,7 +9876,7 @@ var TaskRunner = class {
    * is device-specific (which runtimes happen to be installed here), so a
    * different device's installed runtime set might satisfy it.
    */
-  async pickAdapter(requestedRuntime, policyMode) {
+  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets) {
     const allowlist = this.deps.runtimeAllowlist;
     if (requestedRuntime) {
       if (allowlist && !allowlist.includes(requestedRuntime)) {
@@ -8481,17 +9886,25 @@ var TaskRunner = class {
           retryable: false
         };
       }
-      const adapter = this.deps.adapters.find((a) => a.id === requestedRuntime);
+      const adapter = this.deps.adapters.find((a) => a.descriptor.id === requestedRuntime);
       if (!adapter) {
         return { ok: false, reason: `unknown runtime "${requestedRuntime}"`, retryable: false };
       }
-      if (!adapterSupportsMode(adapter, policyMode)) {
+      const descriptor = freezeRuntimeAdapterDescriptor(adapter.descriptor);
+      if (!adapterSupportsMode(descriptor, policyMode)) {
         return {
           ok: false,
           reason: `runtime "${requestedRuntime}" cannot express permission mode "${policyMode}"`,
           retryable: false
         };
       }
+      if (requiresMcpToolsets && !adapterSupportsMcpToolsets(descriptor)) {
+        return {
+          ok: false,
+          reason: `runtime "${requestedRuntime}" cannot project required MCP toolsets`,
+          retryable: false
+        };
+      }
       const detected = await adapter.detect();
       if (!detected.present) {
         return {
@@ -8500,18 +9913,20 @@ var TaskRunner = class {
           retryable: true
         };
       }
-      return { ok: true, adapter };
+      return { ok: true, adapter, descriptor };
     }
-    const eligible = allowlist ? this.deps.adapters.filter((a) => allowlist.includes(a.id)) : this.deps.adapters;
+    const eligible = allowlist ? this.deps.adapters.filter((a) => allowlist.includes(a.descriptor.id)) : this.deps.adapters;
     const candidates = orderByPreference(eligible, this.deps.runtimePreference ?? DEFAULT_RUNTIME_PREFERENCE);
     for (const adapter of candidates) {
-      if (!adapterSupportsMode(adapter, policyMode)) continue;
+      const descriptor = freezeRuntimeAdapterDescriptor(adapter.descriptor);
+      if (!adapterSupportsMode(descriptor, policyMode)) continue;
+      if (requiresMcpToolsets && !adapterSupportsMcpToolsets(descriptor)) continue;
       const detected = await adapter.detect();
-      if (detected.present) return { ok: true, adapter };
+      if (detected.present) return { ok: true, adapter, descriptor };
     }
     return {
       ok: false,
-      reason: `no available runtime on this device can express permission mode "${policyMode}"`,
+      reason: requiresMcpToolsets ? `no available runtime on this device can express permission mode "${policyMode}" with required MCP toolsets` : `no available runtime on this device can express permission mode "${policyMode}"`,
       retryable: true
     };
   }
@@ -8542,7 +9957,7 @@ function toJournalEnvelopeRecord(envelope, identity) {
     bytes,
     bytesHash: journalHash(bytes),
     receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    opensTask: envelope.type === "task.offer"
+    opensTask: envelope.type === "task.offer" || envelope.type === "task.offer_with_toolsets"
   };
 }
 function isRuntimeId(id) {
@@ -8552,43 +9967,234 @@ async function detectRuntimes(adapters) {
   const detections = await Promise.all(adapters.map(async (adapter) => ({ adapter, detected: await adapter.detect() })));
   const runtimes = [];
   for (const { adapter, detected } of detections) {
-    if (!detected.present || !isRuntimeId(adapter.id)) continue;
-    const info = { id: adapter.id };
+    if (!detected.present || !isRuntimeId(adapter.descriptor.id)) continue;
+    const info = { id: adapter.descriptor.id };
     if (detected.version !== void 0) info.version = detected.version;
     if (detected.authPresent !== void 0) info.authPresent = detected.authPresent;
-    info.capabilities = toRuntimeInfoCapabilities(adapter.capabilities());
+    info.capabilities = toRuntimeInfoCapabilities(adapter.descriptor.capabilities);
     runtimes.push(info);
   }
   return runtimes;
 }
 function computeCapabilities(adapters) {
   const flags = [];
-  if (adapters.some((adapter) => adapter.capabilities().steer)) flags.push("steer");
+  if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
   flags.push("approval-targeting");
+  const selectionAdapters = adapters.filter(
+    (adapter) => ALL_RUNTIME_IDS.includes(adapter.descriptor.id)
+  );
+  if (selectionAdapters.length > 0 && selectionAdapters.every((adapter) => adapter.descriptor.supportsDispatchSelection === true)) {
+    flags.push("dispatch-selection");
+  }
+  if (adapters.some((adapter) => adapter.descriptor.capabilities.mcpToolsets === true)) {
+    flags.push("toolset-selection");
+  }
   return flags;
 }
 var ALL_RUNTIME_IDS = ["pi", "claude", "codex"];
-function buildAdapter(id) {
+function buildAdapter(id, config) {
   switch (id) {
     case "pi":
-      return new PiAdapter();
+      return new PiAdapter({ byokLauncher: config.piByokLauncher });
     case "claude":
       return new ClaudeAdapter();
     case "codex":
       return new CodexAdapter();
   }
 }
-function buildDefaultAdapters(runtimeAllowlist) {
-  const ids = runtimeAllowlist ? ALL_RUNTIME_IDS.filter((id) => runtimeAllowlist.includes(id)) : ALL_RUNTIME_IDS;
-  return ids.map(buildAdapter);
+function buildDefaultAdapters(config) {
+  const ids = config.runtimeAllowlist ? ALL_RUNTIME_IDS.filter((id) => config.runtimeAllowlist?.includes(id)) : ALL_RUNTIME_IDS;
+  return ids.map((id) => buildAdapter(id, config));
+}
+function validatePiByokLauncherConfig(launcher) {
+  for (const [field, value] of [
+    ["command", launcher.command],
+    ["profileDbPath", launcher.profileDbPath],
+    ["sessionDir", launcher.sessionDir]
+  ]) {
+    if (value.trim().length === 0 || /[\u0000\r\n]/u.test(value)) {
+      throw new Error(`DaemonConfig.piByokLauncher.${field} must be a non-empty single-line string`);
+    }
+  }
+  if (!isAbsolute(launcher.profileDbPath) || !isAbsolute(launcher.sessionDir)) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher profileDbPath and sessionDir must be absolute paths"
+    );
+  }
+  if (launcher.secretServicePrefix !== void 0 && (launcher.secretServicePrefix.trim().length === 0 || /[\u0000\r\n]/u.test(launcher.secretServicePrefix))) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher.secretServicePrefix must be a non-empty single-line string"
+    );
+  }
+  const reserved = /* @__PURE__ */ new Set([
+    "--",
+    "--pi-bin",
+    "--profile-db",
+    "--session-dir",
+    "--secret-service-prefix",
+    "--provider",
+    "--model"
+  ]);
+  const conflicting = launcher.args?.find((arg) => reserved.has(arg));
+  if (conflicting !== void 0) {
+    throw new Error(
+      `DaemonConfig.piByokLauncher.args must not override reserved launcher argument ${conflicting}`
+    );
+  }
+  const invalidArg = launcher.args?.find((arg) => arg.length === 0 || /[\u0000\r\n]/u.test(arg));
+  if (invalidArg !== void 0) {
+    throw new Error("DaemonConfig.piByokLauncher.args must contain only non-empty single-line strings");
+  }
+}
+var MAX_LOCAL_MCP_SERVERS_PER_TOOLSET = 16;
+var MAX_LOCAL_MCP_ARGS = 64;
+var MAX_LOCAL_MCP_TOKEN_CHARS = 4096;
+function isNonEmptySingleLine(value) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_LOCAL_MCP_TOKEN_CHARS && !/[\u0000\r\n]/u.test(value);
+}
+function resolveMcpToolsets(configured) {
+  if (configured === void 0) return void 0;
+  if (configured === null || typeof configured !== "object" || Array.isArray(configured)) {
+    throw new Error("DaemonConfig.mcpToolsets must be an object keyed by logical toolset id");
+  }
+  const toolsetEntries = Object.entries(configured);
+  if (toolsetEntries.length > CONFIGURED_TOOLSETS_MAX_ITEMS) {
+    throw new Error(
+      `DaemonConfig.mcpToolsets may contain at most ${CONFIGURED_TOOLSETS_MAX_ITEMS} toolsets`
+    );
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  for (const [toolsetId, rawToolset] of toolsetEntries) {
+    const parsedId = ToolsetIdSchema.safeParse(toolsetId);
+    if (!parsedId.success) {
+      throw new Error(`DaemonConfig.mcpToolsets contains invalid toolset id ${JSON.stringify(toolsetId)}`);
+    }
+    if (rawToolset === null || typeof rawToolset !== "object" || Array.isArray(rawToolset)) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId} must be an object`);
+    }
+    const toolsetKeys = Object.keys(rawToolset);
+    if (toolsetKeys.some((key) => key !== "mcpServers")) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId} accepts only the mcpServers field`);
+    }
+    const rawServers = rawToolset.mcpServers;
+    if (rawServers === null || typeof rawServers !== "object" || Array.isArray(rawServers)) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers must be an object`);
+    }
+    const serverEntries = Object.entries(rawServers);
+    if (serverEntries.length === 0 || serverEntries.length > MAX_LOCAL_MCP_SERVERS_PER_TOOLSET) {
+      throw new Error(
+        `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers must contain 1-${MAX_LOCAL_MCP_SERVERS_PER_TOOLSET} servers`
+      );
+    }
+    const servers = {};
+    for (const [serverName, rawServer] of serverEntries) {
+      if (!ToolsetIdSchema.safeParse(serverName).success) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers contains invalid server name ${JSON.stringify(serverName)}`
+        );
+      }
+      if (serverName === APPROVAL_MCP_SERVER_NAME) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} uses a server name reserved by the daemon`
+        );
+      }
+      if (rawServer === null || typeof rawServer !== "object" || Array.isArray(rawServer)) {
+        throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} must be an object`);
+      }
+      const serverKeys = Object.keys(rawServer);
+      if (serverKeys.some((key) => key !== "command" && key !== "args")) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} accepts only command and args; env, headers, and remote task data are not supported`
+        );
+      }
+      const server = rawServer;
+      if (!isNonEmptySingleLine(server.command)) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.command must be a non-empty single-line string no longer than ${MAX_LOCAL_MCP_TOKEN_CHARS} characters`
+        );
+      }
+      if (server.args !== void 0 && !Array.isArray(server.args)) {
+        throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.args must be an array`);
+      }
+      const args = server.args ?? [];
+      if (args.length > MAX_LOCAL_MCP_ARGS || args.some((arg) => !isNonEmptySingleLine(arg))) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.args must contain at most ${MAX_LOCAL_MCP_ARGS} non-empty single-line strings`
+        );
+      }
+      servers[serverName] = Object.freeze({
+        command: server.command,
+        ...args.length > 0 ? { args: Object.freeze([...args]) } : {}
+      });
+    }
+    resolved.set(toolsetId, Object.freeze({ mcpServers: Object.freeze(servers) }));
+  }
+  return resolved;
+}
+function resolveDeviceAssertionAudiences(config) {
+  if (config === void 0) return void 0;
+  if (!Array.isArray(config.audiences)) {
+    throw new Error(
+      `DaemonConfig.deviceAssertion.audiences must be an array of exact audience strings \u2014 got ${JSON.stringify(config.audiences)}. Omit the deviceAssertion section (or pass an empty array) to leave the assertion broker disabled.`
+    );
+  }
+  if (config.audiences.length === 0) return void 0;
+  const audiences = /* @__PURE__ */ new Set();
+  for (const audience of config.audiences) {
+    if (typeof audience !== "string" || audience.length === 0) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences entries must be non-empty strings \u2014 got ${JSON.stringify(audience)}`
+      );
+    }
+    if (Buffer.byteLength(audience, "utf8") > DEVICE_ASSERTION_AUDIENCE_MAX_BYTES) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences entry ${JSON.stringify(audience)} exceeds ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+      );
+    }
+    if (audiences.has(audience)) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences contains ${JSON.stringify(audience)} twice \u2014 rejected rather than de-duplicated, because a duplicate is usually a copy-paste that hid a typo in the entry that was meant to be different`
+      );
+    }
+    audiences.add(audience);
+  }
+  return audiences;
+}
+function resolveDeviceAssertionTtlMs(config) {
+  const ttlMs = config?.ttlMs ?? DEVICE_ASSERTION_DEFAULT_TTL_MS;
+  if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > DEVICE_ASSERTION_MAX_TTL_MS) {
+    throw new Error(
+      `DaemonConfig.deviceAssertion.ttlMs must be a positive integer no greater than ${DEVICE_ASSERTION_MAX_TTL_MS} ms \u2014 got ${JSON.stringify(config?.ttlMs)}`
+    );
+  }
+  return ttlMs;
 }
 function createDaemonWithAdapters(config, adapters, overrides = {}) {
+  return buildDaemonWithAdapters(config, adapters, overrides);
+}
+function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProbe) {
+  const mcpToolsets = resolveMcpToolsets(config.mcpToolsets);
+  const configuredToolsets = Object.freeze(
+    [...mcpToolsets?.keys() ?? []].sort()
+  );
+  if (config.piByokLauncher !== void 0) {
+    validatePiByokLauncherConfig(config.piByokLauncher);
+  }
   if (config.maxTaskOutputBytes !== void 0 && !(config.maxTaskOutputBytes > 0)) {
     throw new Error(
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
     );
   }
+  const presenceCadence = {
+    intervalMs: config.presence?.intervalMs ?? DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS,
+    ttlMs: config.presence?.ttlMs ?? DEFAULT_PRESENCE_TTL_MS,
+    minimumIntervalMs: config.presence?.minimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS
+  };
+  assertPresenceHeartbeatCadence(presenceCadence);
+  const deviceAssertionAudiences = resolveDeviceAssertionAudiences(config.deviceAssertion);
+  const deviceAssertionTtlMs = resolveDeviceAssertionTtlMs(config.deviceAssertion);
+  let shuttingDown = false;
   const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
   const store = new DeviceStore(storeDir);
   const operationalHealth = new OperationalHealthTracker(storeDir);
@@ -8679,6 +10285,9 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   let runner;
   let controlServerHandle;
   let daemonOwnerLease;
+  let presencePublisher;
+  let presenceDiscovery;
+  let presenceDiscoveryInFlight = false;
   let shutdownPromise;
   const pendingLateMutationBarriers = /* @__PURE__ */ new Set();
   let startedAt;
@@ -8851,6 +10460,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         deviceId: record.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
         runtimeEnvironment: config.runtimeEnvironment,
+        ...mcpToolsets ? { mcpToolsets } : {},
         // M3-2a: `send` is already this file's OWN closure (not something
         // `TaskRunner` builds) — every `task.claim`/`task.started`/
         // `task.progress`/`task.artifact`/`task.await_approval`/
@@ -8874,12 +10484,13 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
           dirty: event.observation ? { staged: event.observation.staged, unstaged: event.observation.unstaged, untracked: event.observation.untracked, conflicted: event.observation.conflicted } : void 0,
           errorCategory: event.errorCategory
         }),
+        onRuntimeDisposalFailure: (event) => observer.noteRuntimeDisposalFailure(event),
         // M4 Phase 3: the SAME `ApprovalRegistry` instance the control
         // socket's own `approvals.list`/`approvals.resolve` methods already
         // share (see that field's own construction above) — `TaskRunner
         // .requestApproval` registers into it directly, so a decision arriving
         // via either the server wire or the local CLI resolves the identical
-        // entry. `storeDir`/`productId` let `TaskContext.approvalChannel`
+        // entry. `storeDir`/`productId` let the prepared operation approval channel
         // (populated per-task by `TaskRunner`) tell an out-of-process helper
         // (`bin/byok-approval-mcp.ts`) exactly which control socket to dial.
         approvalRegistry,
@@ -8890,6 +10501,11 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        // additive-minor (`task.complete.document`): passed through verbatim,
+        // absent when unconfigured — see `DaemonConfig.resultDocument`'s own
+        // doc comment. Spread rather than assigned so an unconfigured daemon
+        // builds the exact `deps` object it did before this seam existed.
+        ...config.resultDocument ? { resultDocument: config.resultDocument } : {},
         // M4 Phase 3 hardening: bridges TaskRunner's stale-approval-race
         // finding out to the SAME local observability seam every other
         // daemon-local event already uses (see observer.ts's own module doc
@@ -8926,6 +10542,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         productId: config.productId,
         capabilities,
         runtimes,
+        configuredToolsets,
         auth,
         cursorStore,
         // Finding F3: return (not void-and-forget) so ConnectionManager can
@@ -8965,8 +10582,10 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
         onStateChange: (state) => {
+          const wasSettled = connectionState === "open" || connectionState === "degraded";
           connectionState = state;
           observer.noteConnectionState(state);
+          if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
         },
         backoff: overrides.backoff,
         liveness: overrides.liveness,
@@ -8984,6 +10603,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
       });
       await connection.start();
       await connection.waitForAck();
+      startPresenceProducer();
     } catch (err) {
       try {
         await runShutdownSequence("startup failed", { drainTimeoutMs: 0 });
@@ -8993,7 +10613,42 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
       throw err;
     }
   }
+  function startPresenceProducer() {
+    presenceDiscovery = new AbortController();
+    runPresenceDiscovery();
+  }
+  function runPresenceDiscovery() {
+    const discovery = presenceDiscovery;
+    if (!discovery || presenceDiscoveryInFlight) return;
+    presenceDiscoveryInFlight = true;
+    void (async () => {
+      try {
+        const declaration = await fetchCapabilityDeclaration(config.serverUrl, { signal: discovery.signal });
+        if (discovery.signal.aborted) return;
+        if (declares(declaration, PRESENCE_HINTS_CAPABILITY)) {
+          presencePublisher ??= new PresencePublisher({
+            serverUrl: config.serverUrl,
+            auth,
+            configuredToolsets,
+            ...presenceCadence,
+            onDegraded: (reason) => console.warn(`[byok/client] ${reason}`)
+          });
+          presencePublisher.start();
+        } else {
+          presencePublisher?.stop();
+        }
+      } catch (err) {
+        if (discovery.signal.aborted) return;
+        console.warn(
+          `[byok/client] capability discovery failed; presence publishing stays off until the next reconnect: ${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        presenceDiscoveryInFlight = false;
+      }
+    })();
+  }
   async function runShutdownSequence(reason, opts = {}) {
+    shuttingDown = true;
     const errors = [];
     let mutationBarrierComplete = hostedStorageInitializationBarrierComplete;
     if (!hostedStorageInitializationBarrierComplete) {
@@ -9022,6 +10677,11 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         errors.push(new Error("a prior active task teardown remains unsettled; ownership lease retained"));
       }
     }
+    presenceDiscovery?.abort();
+    presenceDiscovery = void 0;
+    presenceDiscoveryInFlight = false;
+    presencePublisher?.stop();
+    presencePublisher = void 0;
     const stoppingOwnedPressureEngine = ownedPressureEngine;
     const stoppingOwnedJournal = ownedJournal;
     const maintenanceStopped = stoppingOwnedPressureEngine?.stop() ?? Promise.resolve();
@@ -9063,8 +10723,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
     await attempt(() => auth.stop(), true);
     connectionState = "closed";
     await attempt(async () => {
-      await controlServerHandle?.close();
-      controlServerHandle = void 0;
+      await controlServerHandle?.stopServing();
     }, true);
     if (mutationBarrierComplete && daemonOwnerLease) {
       await attempt(() => operationalHealth.markCleanStop(), false);
@@ -9073,6 +10732,12 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         daemonOwnerLease = void 0;
       }, false);
     }
+    if (daemonOwnerLease === void 0) {
+      await attempt(async () => {
+        await controlServerHandle?.close();
+        controlServerHandle = void 0;
+      }, false);
+    }
     if (errors.length === 1) throw errors[0];
     if (errors.length > 1) {
       throw new AggregateError(errors, "daemon shutdown completed with errors");
@@ -9082,6 +10747,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
     }
   }
   async function stop(opts = {}) {
+    shuttingDown = true;
     await requestShutdown(opts.reason ?? "operator", { drainTimeoutMs: opts.drainTimeoutMs });
   }
   function requestShutdown(reason, opts = {}) {
@@ -9094,6 +10760,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
     return current;
   }
   async function unpair() {
+    shuttingDown = true;
     await runLifecycleMutation(unpairUnderLease);
   }
   async function unpairUnderLease() {
@@ -9150,7 +10817,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
       deviceId: auth.deviceId,
       transport: connectionState,
       activeTasks,
-      runtimeIds: adapters.map((adapter) => adapter.id),
+      runtimeIds: adapters.map((adapter) => adapter.descriptor.id),
       // M4 Phase 4 (part B.3): queue watermarks come from TaskRunner's own
       // active-task map (distinct from `observer.tasks()` above, which is
       // derived from the envelope feed) — see `TaskRunner.getQueueWatermarks`'s
@@ -9172,6 +10839,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   }
   async function performControlShutdown(reason) {
     const effectiveReason = reason ?? "operator";
+    shuttingDown = true;
     observer.noteShutdownRequested(effectiveReason);
     try {
       await requestShutdown(`control socket shutdown (${effectiveReason})`);
@@ -9209,7 +10877,107 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         if (!runner) throw new ControlError("not_found", "daemon is not started");
         return runner.requestApproval(parsed.taskId, parsed.summary);
       },
+      /**
+       * Plan `device-assertion-broker`: mint one short-lived, audience-scoped
+       * device assertion for a sibling local process.
+       *
+       * SIX fail-closed gates, in this exact order, none of which signs
+       * anything on the way out. The order is part of the contract, not an
+       * implementation detail:
+       *
+       * 1. `assertion_disabled` — before anything else, because a daemon that
+       *    was never configured for this must not reveal, by answering
+       *    differently for different inputs, that it even validates params.
+       * 2. `bad_request` — shape/length, checked before the allowlist so a
+       *    malformed request cannot be used to probe membership.
+       * 3. `audience_denied` — EXACT `Set.has`, never a prefix/suffix rule
+       *    (`salesko-api.evil.com` and `salesko-ap` both fail against an entry
+       *    of `salesko-api`). The message deliberately does not echo the
+       *    allowlist: a refusal must not be an enumeration oracle.
+       * 4. `shutting_down` — see `performControlShutdown`'s own comment for
+       *    the minting window this closes.
+       * 5. `revoked` — the server-side revocation this daemon already knows
+       *    about.
+       * 6. `not_paired` — the on-disk record, re-read on EVERY call (never
+       *    cached), so clearing `device.json` removes local signing authority
+       *    immediately.
+       *
+       * Only after all six does the private key get imported, used once, and
+       * dropped (`device-assertion-signer.ts`).
+       *
+       * Honest limit, and it must stay in the docs as well as here: gates 4-6
+       * are only HALF of revocation. They make this daemon stop minting
+       * promptly, but an assertion already in a caller's hands is not recalled
+       * by any of them. The other half is the host's own recheck at exchange
+       * time, which is why core's `verifyDeviceAssertion` makes the device
+       * row's `revoked` state a REQUIRED parameter. Nothing here entitles
+       * anyone to claim this daemon delivers synchronous invalidation on its
+       * own.
+       */
+      "assertion.issue": async (params) => {
+        if (deviceAssertionAudiences === void 0) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "assertion_disabled" });
+          throw new ControlError(
+            "assertion_disabled",
+            "this daemon is not configured to issue device assertions (DaemonConfig.deviceAssertion.audiences is absent or empty)"
+          );
+        }
+        const parsed = parseAssertionIssueParams(params);
+        if (!parsed) {
+          const rawAudience = typeof params === "object" && params !== null && typeof params.audience === "string" ? params.audience : void 0;
+          observer.noteDeviceAssertion({ result: "denied", reason: "bad_request", audience: rawAudience });
+          throw new ControlError(
+            "bad_request",
+            `assertion.issue requires exactly {audience} where audience is a non-empty string of at most ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+          );
+        }
+        if (!deviceAssertionAudiences.has(parsed.audience)) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "audience_denied", audience: parsed.audience });
+          throw new ControlError("audience_denied", "the requested audience is not allowed by this daemon");
+        }
+        if (shuttingDown) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "shutting_down", audience: parsed.audience });
+          throw new ControlError("shutting_down", "this daemon is shutting down and will not issue new assertions");
+        }
+        if (auth.isRevoked()) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "revoked", audience: parsed.audience });
+          throw new ControlError("revoked", "this device has been revoked by the server; re-pair required");
+        }
+        const record = await store.load();
+        if (record === void 0) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "not_paired", audience: parsed.audience });
+          throw new ControlError("not_paired", "this device is not paired; nothing can be asserted about it");
+        }
+        if (shuttingDown) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "shutting_down", audience: parsed.audience });
+          throw new ControlError("shutting_down", "this daemon is shutting down and will not issue new assertions");
+        }
+        if (auth.isRevoked()) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "revoked", audience: parsed.audience });
+          throw new ControlError("revoked", "this device has been revoked by the server; re-pair required");
+        }
+        const minted = mintDeviceAssertion({
+          record,
+          // `toHttpBase` is the one place a configured serverUrl is normalized
+          // (ws:->http:, wss:->https:, path stripped), so an operator who
+          // configured the websocket spelling and one who configured the HTTP
+          // spelling of the same deployment produce the same issuer.
+          issuer: new URL(toHttpBase(config.serverUrl)).origin,
+          productId: config.productId,
+          audience: parsed.audience,
+          ttlMs: deviceAssertionTtlMs,
+          now: /* @__PURE__ */ new Date()
+        });
+        observer.noteDeviceAssertion({
+          result: "issued",
+          audience: minted.claims.audience,
+          jti: minted.claims.jti,
+          expiresAt: minted.expiresAt
+        });
+        return { assertion: minted.envelope, expiresAt: minted.expiresAt };
+      },
       shutdown: (params) => {
+        shuttingDown = true;
         const { reason } = parseShutdownParams(params);
         setImmediate(() => {
           void performControlShutdown(reason).catch((err) => {
@@ -9254,28 +11022,285 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   return { pair, start, stop, status, subscribe, tasks, unpair, approve, reject };
 }
 function createDaemon(config) {
-  return createDaemonWithAdapters(config, buildDefaultAdapters(config.runtimeAllowlist));
+  return createDaemonWithAdapters(config, buildDefaultAdapters(config));
 }
-
-// src/lifecycle/service-types.ts
-function nodeAgentProgram(opts) {
-  const program = {
-    command: opts.nodeBin ?? process.execPath,
-    args: [opts.agentBin, "start", "--config", opts.configPath]
-  };
-  if (opts.cwd !== void 0) program.cwd = opts.cwd;
-  return program;
+var MAX_CONTROL_TOKEN_BYTES = 256;
+function errorMessage5(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function sanitizeServiceName(name) {
-  const cleaned = name.trim().replace(/[^A-Za-z0-9._-]+/g, "-");
-  const safe = cleaned.replace(/^-+/, "");
-  if (!safe) {
-    throw new Error(`service name "${name}" has no valid characters left after sanitizing (allowed: letters, digits, ".", "-", "_"; cannot consist only of leading "-")`);
-  }
-  return safe;
+function sameFileState3(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
-
-// src/lifecycle/launchd.ts
+async function readControlToken(tokenPath) {
+  let namedBefore;
+  try {
+    namedBefore = await promises.lstat(tokenPath, { bigint: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
+    throw new Error("control token is not a real regular file");
+  }
+  const handle = await promises.open(
+    tokenPath,
+    constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0)
+  );
+  try {
+    const opened = await handle.stat({ bigint: true });
+    const namedAfterOpen = await promises.lstat(tokenPath, { bigint: true });
+    if (!opened.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState3(namedBefore, opened) || !sameFileState3(opened, namedAfterOpen)) {
+      throw new Error("control token pathname changed before safe open");
+    }
+    if (opened.size < 0 || opened.size > BigInt(MAX_CONTROL_TOKEN_BYTES)) {
+      throw new Error("control token exceeds the bounded read limit");
+    }
+    const size = Number(opened.size);
+    const bytes = Buffer.alloc(size);
+    const { bytesRead } = await handle.read(bytes, 0, size, 0);
+    const afterRead = await handle.stat({ bigint: true });
+    const namedAfterRead = await promises.lstat(tokenPath, { bigint: true });
+    if (bytesRead !== size || namedAfterRead.isSymbolicLink() || !sameFileState3(opened, afterRead) || !sameFileState3(afterRead, namedAfterRead)) {
+      throw new Error("control token changed during bounded read");
+    }
+    return bytes.toString("utf8").trim();
+  } finally {
+    await handle.close();
+  }
+}
+async function connectControlClient(opts) {
+  const tokenPath = controlTokenPath(opts.storeDir);
+  let token;
+  try {
+    const read = await readControlToken(tokenPath);
+    if (read === void 0) {
+      return { ok: false, reason: "daemon is not running (no control.token found)" };
+    }
+    token = read;
+  } catch (err) {
+    return { ok: false, reason: `could not read the control token: ${errorMessage5(err)}` };
+  }
+  if (!token) {
+    return { ok: false, reason: "control token file is empty" };
+  }
+  const endpoint = controlEndpointPath(opts.productId, opts.storeDir);
+  try {
+    const client = await connectAndHandshake(endpoint, token, opts);
+    return { ok: true, client };
+  } catch (err) {
+    return { ok: false, reason: `daemon control socket not reachable: ${errorMessage5(err)}` };
+  }
+}
+function connectAndHandshake(endpoint, token, opts) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(endpoint);
+    const reader = new NdjsonLineReader();
+    let phase = "server-hello";
+    let settled = false;
+    const clientNonce = randomNonceHex();
+    const timer = setTimeout(() => {
+      fail(new Error("handshake timed out"));
+    }, opts.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    timer.unref?.();
+    function fail(err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      reject(err instanceof Error ? err : new Error(String(err)));
+    }
+    function succeed() {
+      settled = true;
+      clearTimeout(timer);
+      socket.removeListener("error", onError);
+      socket.removeListener("data", onData);
+      resolve(createControlClient(socket, reader, opts));
+    }
+    function onData(chunk) {
+      let lines;
+      try {
+        lines = reader.push(chunk);
+      } catch (err) {
+        fail(err);
+        return;
+      }
+      for (const line of lines) {
+        let parsed;
+        try {
+          parsed = JSON.parse(line);
+        } catch {
+          fail(new Error("malformed handshake frame"));
+          return;
+        }
+        if (phase === "server-hello") {
+          const hello = parseServerHello(parsed);
+          if (!hello) {
+            fail(new Error("malformed or unexpected server hello"));
+            return;
+          }
+          if (!timingSafeEqualHex(hello.proof, computeServerProof(token, clientNonce))) {
+            fail(new Error("server failed to prove it holds the control token"));
+            return;
+          }
+          socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, auth: computeClientAuth(token, hello.nonce) }));
+          phase = "ready";
+          continue;
+        }
+        if (!parseServerReady(parsed)) {
+          fail(new Error("server did not confirm readiness"));
+          return;
+        }
+        succeed();
+        return;
+      }
+    }
+    function onError(err) {
+      fail(err);
+    }
+    socket.once("error", onError);
+    socket.once("connect", () => {
+      socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, hello: "client", nonce: clientNonce }));
+      socket.on("data", onData);
+    });
+  });
+}
+function withTimeout(promise, ms, message) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+function createControlClient(socket, reader, opts) {
+  const pending = /* @__PURE__ */ new Map();
+  let idSeq = 0;
+  let closed = false;
+  function handleFrame(parsed) {
+    if (!isRecord2(parsed) || typeof parsed.id !== "string") return;
+    const entry = pending.get(parsed.id);
+    if (!entry) return;
+    if ("event" in parsed) {
+      entry.onEvent?.(parsed.event);
+      return;
+    }
+    if (parsed.ok === true) {
+      pending.delete(parsed.id);
+      entry.resolve(parsed.done === true ? void 0 : parsed.result);
+      return;
+    }
+    pending.delete(parsed.id);
+    const shape = parsed.error;
+    entry.reject(
+      new ControlError(
+        typeof shape?.code === "string" ? shape.code : "internal_error",
+        typeof shape?.message === "string" ? shape.message : "unknown control error"
+      )
+    );
+  }
+  socket.on("data", (chunk) => {
+    let lines;
+    try {
+      lines = reader.push(chunk);
+    } catch {
+      socket.destroy();
+      return;
+    }
+    for (const line of lines) {
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      handleFrame(parsed);
+    }
+  });
+  socket.on("close", () => {
+    closed = true;
+    for (const entry of pending.values()) entry.reject(new Error("control connection closed"));
+    pending.clear();
+  });
+  socket.on("error", () => {
+  });
+  function send(method, params, onEvent) {
+    const id = `c${++idSeq}`;
+    const promise = new Promise((resolve, reject) => {
+      pending.set(id, { resolve, reject, onEvent });
+    });
+    socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, id, method, params }));
+    return { id, promise };
+  }
+  return {
+    async request(method, params) {
+      if (closed) throw new Error("control connection is closed");
+      const { promise } = send(method, params);
+      const result = await withTimeout(promise, opts.requestTimeoutMs ?? 1e4, `control request "${method}" timed out`);
+      return result;
+    },
+    subscribe(method, params, onEvent) {
+      const { id, promise } = send(method, params, onEvent);
+      promise.catch(() => {
+      });
+      return {
+        close: () => {
+          pending.delete(id);
+          socket.destroy();
+        }
+      };
+    },
+    close() {
+      socket.destroy();
+    }
+  };
+}
+async function isControlDaemonGone(storeDir, productId) {
+  const tokenGone = await promises.stat(controlTokenPath(storeDir)).then(
+    () => false,
+    (err) => err.code === "ENOENT"
+  );
+  if (!tokenGone) return false;
+  const endpoint = controlEndpointPath(productId, storeDir);
+  return new Promise((resolve) => {
+    const socket = net.createConnection(endpoint);
+    const finish = (gone) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve(gone);
+    };
+    socket.once("connect", () => finish(false));
+    socket.once("error", (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT"));
+  });
+}
+
+// src/lifecycle/service-types.ts
+function nodeAgentProgram(opts) {
+  const program = {
+    command: opts.nodeBin ?? process.execPath,
+    args: [opts.agentBin, "start", "--config", opts.configPath]
+  };
+  if (opts.cwd !== void 0) program.cwd = opts.cwd;
+  return program;
+}
+function sanitizeServiceName(name) {
+  const cleaned = name.trim().replace(/[^A-Za-z0-9._-]+/g, "-");
+  const safe = cleaned.replace(/^-+/, "");
+  if (!safe) {
+    throw new Error(`service name "${name}" has no valid characters left after sanitizing (allowed: letters, digits, ".", "-", "_"; cannot consist only of leading "-")`);
+  }
+  return safe;
+}
+
+// src/lifecycle/launchd.ts
 var LAUNCHD_CONNECTIVITY_OR_PERMISSION_FAILURE = [
   /operation not permitted/i,
   /could not find domain/i,
@@ -9577,359 +11602,102 @@ function createWinswLifecycle(def, deps = {}) {
     if (!await fileExists(xmlPath)) {
       throw new Error(`service "${id}" is not installed (no config at ${xmlPath}) \u2014 call install() first`);
     }
-    await runOrThrow(run, exePath, ["start"], "winsw start");
-  }
-  async function stop() {
-    await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_ALREADY_STOPPED);
-  }
-  async function status() {
-    const installed = await fileExists(xmlPath);
-    const result = await run("sc.exe", ["query", id]);
-    const detail = (result.stdout || result.stderr).trim();
-    const running = result.code === 0 && /\bSTATE\b.*\bRUNNING\b/i.test(detail);
-    const determinate = running || !WINSW_CONNECTIVITY_OR_PERMISSION_FAILURE.some((pattern) => pattern.test(detail));
-    return { installed, running, determinate, detail };
-  }
-  return { install, uninstall, start, stop, status };
-}
-
-// src/lifecycle/create-service-lifecycle.ts
-var UnsupportedServicePlatformError = class extends Error {
-  constructor(platform) {
-    super(`no OS service lifecycle for platform "${platform}" \u2014 supported: darwin (launchd), linux (systemd --user), win32 (WinSW)`);
-    this.name = "UnsupportedServicePlatformError";
-  }
-};
-function createServiceLifecycle(def, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  switch (platform) {
-    case "darwin":
-      return createLaunchdLifecycle(def, opts.deps);
-    case "linux":
-      return createSystemdLifecycle(def, opts.deps);
-    case "win32":
-      return createWinswLifecycle(def, opts.deps);
-    default:
-      throw new UnsupportedServicePlatformError(platform);
-  }
-}
-var REQUIRED_FIELDS = ["productName", "productId", "serverUrl", "workspaceRoot"];
-var ConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ConfigError";
-  }
-};
-function loadConfig(configPath, overrides = {}) {
-  let base = {};
-  if (configPath) {
-    let raw;
-    try {
-      raw = readFileSync(configPath, "utf8");
-    } catch (err) {
-      throw new ConfigError(`could not read config at "${configPath}": ${err instanceof Error ? err.message : String(err)}`);
-    }
-    try {
-      base = JSON.parse(raw);
-    } catch (err) {
-      throw new ConfigError(`config at "${configPath}" is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  const merged = { ...base, ...overrides };
-  if (merged.gitWorkspace !== void 0) {
-    try {
-      GitWorkspaceManager.validateConfig(merged.gitWorkspace);
-    } catch (error) {
-      throw new ConfigError(error instanceof Error ? error.message : "invalid gitWorkspace configuration");
-    }
-  }
-  for (const field of REQUIRED_FIELDS) {
-    if (!merged[field]) {
-      throw new ConfigError(`config is missing required field "${field}"`);
-    }
-  }
-  return merged;
-}
-function resolveStoreDir(config) {
-  return DeviceStore.resolveDir(config.productId, config.storeDir);
-}
-function argValue(args, flag) {
-  const idx = args.indexOf(flag);
-  const value = idx >= 0 ? args[idx + 1] : void 0;
-  return value !== void 0 && !value.startsWith("--") ? value : void 0;
-}
-function hasFlag(args, flag) {
-  return args.includes(flag);
-}
-function positionalArgs(args, valueFlags = []) {
-  const result = [];
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === void 0) continue;
-    if (valueFlags.includes(arg)) {
-      i++;
-      continue;
-    }
-    result.push(arg);
-  }
-  return result;
-}
-var MAX_CONTROL_TOKEN_BYTES = 256;
-function errorMessage4(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function sameFileState3(left, right) {
-  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
-}
-async function readControlToken(tokenPath) {
-  let namedBefore;
-  try {
-    namedBefore = await promises.lstat(tokenPath, { bigint: true });
-  } catch (err) {
-    if (err.code === "ENOENT") return void 0;
-    throw err;
-  }
-  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
-    throw new Error("control token is not a real regular file");
-  }
-  const handle = await promises.open(
-    tokenPath,
-    constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0)
-  );
-  try {
-    const opened = await handle.stat({ bigint: true });
-    const namedAfterOpen = await promises.lstat(tokenPath, { bigint: true });
-    if (!opened.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState3(namedBefore, opened) || !sameFileState3(opened, namedAfterOpen)) {
-      throw new Error("control token pathname changed before safe open");
-    }
-    if (opened.size < 0 || opened.size > BigInt(MAX_CONTROL_TOKEN_BYTES)) {
-      throw new Error("control token exceeds the bounded read limit");
-    }
-    const size = Number(opened.size);
-    const bytes = Buffer.alloc(size);
-    const { bytesRead } = await handle.read(bytes, 0, size, 0);
-    const afterRead = await handle.stat({ bigint: true });
-    const namedAfterRead = await promises.lstat(tokenPath, { bigint: true });
-    if (bytesRead !== size || namedAfterRead.isSymbolicLink() || !sameFileState3(opened, afterRead) || !sameFileState3(afterRead, namedAfterRead)) {
-      throw new Error("control token changed during bounded read");
-    }
-    return bytes.toString("utf8").trim();
-  } finally {
-    await handle.close();
-  }
-}
-async function connectControlClient(opts) {
-  const tokenPath = controlTokenPath(opts.storeDir);
-  let token;
-  try {
-    const read = await readControlToken(tokenPath);
-    if (read === void 0) {
-      return { ok: false, reason: "daemon is not running (no control.token found)" };
-    }
-    token = read;
-  } catch (err) {
-    return { ok: false, reason: `could not read the control token: ${errorMessage4(err)}` };
-  }
-  if (!token) {
-    return { ok: false, reason: "control token file is empty" };
-  }
-  const endpoint = controlEndpointPath(opts.productId, opts.storeDir);
-  try {
-    const client = await connectAndHandshake(endpoint, token, opts);
-    return { ok: true, client };
-  } catch (err) {
-    return { ok: false, reason: `daemon control socket not reachable: ${errorMessage4(err)}` };
-  }
-}
-function connectAndHandshake(endpoint, token, opts) {
-  return new Promise((resolve, reject) => {
-    const socket = net.createConnection(endpoint);
-    const reader = new NdjsonLineReader();
-    let phase = "server-hello";
-    let settled = false;
-    const clientNonce = randomNonceHex();
-    const timer = setTimeout(() => {
-      fail(new Error("handshake timed out"));
-    }, opts.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
-    timer.unref?.();
-    function fail(err) {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      socket.removeAllListeners();
-      socket.destroy();
-      reject(err instanceof Error ? err : new Error(String(err)));
-    }
-    function succeed() {
-      settled = true;
-      clearTimeout(timer);
-      socket.removeListener("error", onError);
-      socket.removeListener("data", onData);
-      resolve(createControlClient(socket, reader, opts));
-    }
-    function onData(chunk) {
-      let lines;
-      try {
-        lines = reader.push(chunk);
-      } catch (err) {
-        fail(err);
-        return;
-      }
-      for (const line of lines) {
-        let parsed;
-        try {
-          parsed = JSON.parse(line);
-        } catch {
-          fail(new Error("malformed handshake frame"));
-          return;
-        }
-        if (phase === "server-hello") {
-          const hello = parseServerHello(parsed);
-          if (!hello) {
-            fail(new Error("malformed or unexpected server hello"));
-            return;
-          }
-          if (!timingSafeEqualHex(hello.proof, computeServerProof(token, clientNonce))) {
-            fail(new Error("server failed to prove it holds the control token"));
-            return;
-          }
-          socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, auth: computeClientAuth(token, hello.nonce) }));
-          phase = "ready";
-          continue;
-        }
-        if (!parseServerReady(parsed)) {
-          fail(new Error("server did not confirm readiness"));
-          return;
-        }
-        succeed();
-        return;
-      }
-    }
-    function onError(err) {
-      fail(err);
-    }
-    socket.once("error", onError);
-    socket.once("connect", () => {
-      socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, hello: "client", nonce: clientNonce }));
-      socket.on("data", onData);
-    });
-  });
+    await runOrThrow(run, exePath, ["start"], "winsw start");
+  }
+  async function stop() {
+    await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_ALREADY_STOPPED);
+  }
+  async function status() {
+    const installed = await fileExists(xmlPath);
+    const result = await run("sc.exe", ["query", id]);
+    const detail = (result.stdout || result.stderr).trim();
+    const running = result.code === 0 && /\bSTATE\b.*\bRUNNING\b/i.test(detail);
+    const determinate = running || !WINSW_CONNECTIVITY_OR_PERMISSION_FAILURE.some((pattern) => pattern.test(detail));
+    return { installed, running, determinate, detail };
+  }
+  return { install, uninstall, start, stop, status };
 }
-function withTimeout(promise, ms, message) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    timer.unref?.();
-    promise.then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (err) => {
-        clearTimeout(timer);
-        reject(err);
-      }
-    );
-  });
+
+// src/lifecycle/create-service-lifecycle.ts
+var UnsupportedServicePlatformError = class extends Error {
+  constructor(platform) {
+    super(`no OS service lifecycle for platform "${platform}" \u2014 supported: darwin (launchd), linux (systemd --user), win32 (WinSW)`);
+    this.name = "UnsupportedServicePlatformError";
+  }
+};
+function createServiceLifecycle(def, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  switch (platform) {
+    case "darwin":
+      return createLaunchdLifecycle(def, opts.deps);
+    case "linux":
+      return createSystemdLifecycle(def, opts.deps);
+    case "win32":
+      return createWinswLifecycle(def, opts.deps);
+    default:
+      throw new UnsupportedServicePlatformError(platform);
+  }
 }
-function createControlClient(socket, reader, opts) {
-  const pending = /* @__PURE__ */ new Map();
-  let idSeq = 0;
-  let closed = false;
-  function handleFrame(parsed) {
-    if (!isRecord2(parsed) || typeof parsed.id !== "string") return;
-    const entry = pending.get(parsed.id);
-    if (!entry) return;
-    if ("event" in parsed) {
-      entry.onEvent?.(parsed.event);
-      return;
+var REQUIRED_FIELDS = ["productName", "productId", "serverUrl", "workspaceRoot"];
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function loadConfig(configPath, overrides = {}) {
+  let base = {};
+  if (configPath) {
+    let raw;
+    try {
+      raw = readFileSync(configPath, "utf8");
+    } catch (err) {
+      throw new ConfigError(`could not read config at "${configPath}": ${err instanceof Error ? err.message : String(err)}`);
     }
-    if (parsed.ok === true) {
-      pending.delete(parsed.id);
-      entry.resolve(parsed.done === true ? void 0 : parsed.result);
-      return;
+    try {
+      base = JSON.parse(raw);
+    } catch (err) {
+      throw new ConfigError(`config at "${configPath}" is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
     }
-    pending.delete(parsed.id);
-    const shape = parsed.error;
-    entry.reject(
-      new ControlError(
-        typeof shape?.code === "string" ? shape.code : "internal_error",
-        typeof shape?.message === "string" ? shape.message : "unknown control error"
-      )
-    );
   }
-  socket.on("data", (chunk) => {
-    let lines;
+  const merged = { ...base, ...overrides };
+  if (merged.gitWorkspace !== void 0) {
     try {
-      lines = reader.push(chunk);
-    } catch {
-      socket.destroy();
-      return;
-    }
-    for (const line of lines) {
-      let parsed;
-      try {
-        parsed = JSON.parse(line);
-      } catch {
-        continue;
-      }
-      handleFrame(parsed);
+      GitWorkspaceManager.validateConfig(merged.gitWorkspace);
+    } catch (error) {
+      throw new ConfigError(error instanceof Error ? error.message : "invalid gitWorkspace configuration");
     }
-  });
-  socket.on("close", () => {
-    closed = true;
-    for (const entry of pending.values()) entry.reject(new Error("control connection closed"));
-    pending.clear();
-  });
-  socket.on("error", () => {
-  });
-  function send(method, params, onEvent) {
-    const id = `c${++idSeq}`;
-    const promise = new Promise((resolve, reject) => {
-      pending.set(id, { resolve, reject, onEvent });
-    });
-    socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, id, method, params }));
-    return { id, promise };
   }
-  return {
-    async request(method, params) {
-      if (closed) throw new Error("control connection is closed");
-      const { promise } = send(method, params);
-      const result = await withTimeout(promise, opts.requestTimeoutMs ?? 1e4, `control request "${method}" timed out`);
-      return result;
-    },
-    subscribe(method, params, onEvent) {
-      const { id, promise } = send(method, params, onEvent);
-      promise.catch(() => {
-      });
-      return {
-        close: () => {
-          pending.delete(id);
-          socket.destroy();
-        }
-      };
-    },
-    close() {
-      socket.destroy();
+  for (const field of REQUIRED_FIELDS) {
+    if (!merged[field]) {
+      throw new ConfigError(`config is missing required field "${field}"`);
     }
-  };
+  }
+  return merged;
 }
-async function isControlDaemonGone(storeDir, productId) {
-  const tokenGone = await promises.stat(controlTokenPath(storeDir)).then(
-    () => false,
-    (err) => err.code === "ENOENT"
-  );
-  if (!tokenGone) return false;
-  const endpoint = controlEndpointPath(productId, storeDir);
-  return new Promise((resolve) => {
-    const socket = net.createConnection(endpoint);
-    const finish = (gone) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve(gone);
-    };
-    socket.once("connect", () => finish(false));
-    socket.once("error", (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT"));
-  });
+function resolveStoreDir(config) {
+  return DeviceStore.resolveDir(config.productId, config.storeDir);
+}
+function argValue(args, flag) {
+  const idx = args.indexOf(flag);
+  const value = idx >= 0 ? args[idx + 1] : void 0;
+  return value !== void 0 && !value.startsWith("--") ? value : void 0;
+}
+function hasFlag(args, flag) {
+  return args.includes(flag);
+}
+function positionalArgs(args, valueFlags = []) {
+  const result = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === void 0) continue;
+    if (valueFlags.includes(arg)) {
+      i++;
+      continue;
+    }
+    result.push(arg);
+  }
+  return result;
 }
 
 // src/bin/format.ts
@@ -9939,19 +11707,7 @@ function quote(text) {
 function redactedByteCountPlaceholder(text) {
   return `[redacted: ${Buffer.byteLength(text, "utf8")} bytes]`;
 }
-var STABLE_GIT_ERROR_CATEGORIES = /* @__PURE__ */ new Set([
-  "git-unavailable",
-  "git-timeout",
-  "git-output-limit",
-  "git-command-failed",
-  "workspace-root-invalid",
-  "workspace-root-conflict",
-  "workspace-not-owned",
-  "repository-root-mismatch",
-  "repository-invalid",
-  "lease-busy",
-  "ledger-invalid"
-]);
+var STABLE_GIT_ERROR_CATEGORIES = new Set(GIT_ERROR_CATEGORIES);
 function stableGitErrorCategory(value) {
   return value !== void 0 && STABLE_GIT_ERROR_CATEGORIES.has(value) ? value : void 0;
 }
@@ -10017,6 +11773,8 @@ function formatDaemonEventLine(event, options = {}) {
       return `${prefix} shutdown-complete reason=${quote(event.reason)}${event.undeliveredOutboxCount !== void 0 ? ` undeliveredOutboxCount=${event.undeliveredOutboxCount}` : ""}`;
     case "stale-approval-decision":
       return `${prefix} stale-approval-decision taskId=${event.taskId} decision=${event.decision}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+    case "runtime-disposal-failed":
+      return `${prefix} runtime-disposal-failed taskId=${event.taskId} runtime=${event.runtimeId} stage=${event.stage} reason=${quote(event.reason)}`;
     case "git-workspace": {
       const parts = [
         `${prefix} git-workspace taskId=${event.taskId}`,
@@ -10029,6 +11787,19 @@ function formatDaemonEventLine(event, options = {}) {
       ].filter((part) => part !== void 0);
       return parts.join(" ");
     }
+    case "device-assertion": {
+      const parts = event.result === "issued" ? [
+        `${prefix} device-assertion result=issued`,
+        `audience=${quote(event.audience)}`,
+        `jti=${event.jti}`,
+        `expiresAt=${event.expiresAt}`
+      ] : [
+        `${prefix} device-assertion result=denied`,
+        `reason=${event.reason}`,
+        event.audienceSize !== void 0 ? `audienceSize=${event.audienceSize}` : void 0
+      ].filter((part) => part !== void 0);
+      return parts.join(" ");
+    }
   }
 }
 function formatTaskLine(task) {
@@ -10282,8 +12053,8 @@ async function probeRuntimes(adapters, options = {}) {
       let resume = false;
       let permissionModes = [];
       try {
-        id = boundedSingleLine(adapter.id, MAX_RUNTIME_ID_CHARS);
-        const caps = adapter.capabilities();
+        id = boundedSingleLine(adapter.descriptor.id, MAX_RUNTIME_ID_CHARS);
+        const caps = adapter.descriptor.capabilities;
         steer = caps.steer === true;
         resume = caps.resume === true;
         permissionModes = caps.permissionModes.slice(0, MAX_PERMISSION_MODES).map((mode) => boundedSingleLine(mode, MAX_PERMISSION_MODE_CHARS));
@@ -11148,19 +12919,7 @@ function valueByteSize(value) {
 function placeholderFor(size) {
   return size === void 0 ? "[redacted]" : `[redacted: ${size} bytes]`;
 }
-var STABLE_GIT_ERROR_CATEGORIES2 = /* @__PURE__ */ new Set([
-  "git-unavailable",
-  "git-timeout",
-  "git-output-limit",
-  "git-command-failed",
-  "workspace-root-invalid",
-  "workspace-root-conflict",
-  "workspace-not-owned",
-  "repository-root-mismatch",
-  "repository-invalid",
-  "lease-busy",
-  "ledger-invalid"
-]);
+var STABLE_GIT_ERROR_CATEGORIES2 = new Set(GIT_ERROR_CATEGORIES);
 function stableGitErrorCategory2(value) {
   return typeof value === "string" && STABLE_GIT_ERROR_CATEGORIES2.has(value) ? value : void 0;
 }
@@ -11259,6 +13018,16 @@ function redactForAudit(event) {
       return { ...base, reason: event.reason, undeliveredOutboxCount: event.undeliveredOutboxCount };
     case "stale-approval-decision":
       return { ...base, taskId: event.taskId, decision: event.decision, reasonSize: byteSize(event.reason) };
+    case "runtime-disposal-failed":
+      return { ...base, taskId: event.taskId, runtimeId: event.runtimeId, stage: event.stage, reason: event.reason };
+    case "device-assertion":
+      return event.result === "issued" ? {
+        ...base,
+        result: "issued",
+        audience: event.audience,
+        jti: event.jti,
+        expiresAt: event.expiresAt
+      } : { ...base, result: "denied", reason: event.reason, audienceSize: event.audienceSize };
     case "git-workspace":
       return {
         ...base,
@@ -11399,6 +13168,35 @@ function reconstructDaemonEvent(raw) {
         reason: reasonSize === void 0 ? void 0 : placeholderFor(reasonSize)
       };
     }
+    case "runtime-disposal-failed":
+      return {
+        kind: "runtime-disposal-failed",
+        ts,
+        taskId: str(raw.taskId),
+        runtimeId: str(raw.runtimeId),
+        stage: str(raw.stage),
+        reason: str(raw.reason)
+      };
+    case "device-assertion": {
+      if (raw.result === "issued") {
+        return {
+          kind: "device-assertion",
+          ts,
+          result: "issued",
+          audience: typeof raw.audience === "string" ? raw.audience : "",
+          jti: typeof raw.jti === "string" ? raw.jti : "",
+          expiresAt: typeof raw.expiresAt === "string" ? raw.expiresAt : ""
+        };
+      }
+      const audienceSize = num(raw.audienceSize);
+      return {
+        kind: "device-assertion",
+        ts,
+        result: "denied",
+        reason: typeof raw.reason === "string" ? raw.reason : "",
+        ...audienceSize === void 0 ? {} : { audienceSize }
+      };
+    }
     case "git-workspace": {
       const commitsSinceBaseline = gitCount(raw.commitsSinceBaseline);
       const dirty = gitDirty(raw.dirty);
@@ -11651,20 +13449,8 @@ async function runStartCommand(config, deps) {
     throw err;
   }
 }
-var STABLE_GIT_PHASES = /* @__PURE__ */ new Set(["preparing", "active", "completed", "failed", "cancelled", "interrupted", "salvage"]);
-var STABLE_GIT_ERROR_CATEGORIES3 = /* @__PURE__ */ new Set([
-  "git-unavailable",
-  "git-timeout",
-  "git-output-limit",
-  "git-command-failed",
-  "workspace-root-invalid",
-  "workspace-root-conflict",
-  "workspace-not-owned",
-  "repository-root-mismatch",
-  "repository-invalid",
-  "lease-busy",
-  "ledger-invalid"
-]);
+var STABLE_GIT_PHASES = new Set(GIT_WORKSPACE_PHASES);
+var STABLE_GIT_ERROR_CATEGORIES3 = new Set(GIT_ERROR_CATEGORIES);
 function nonNegativeSafeInteger(value) {
   return value !== void 0 && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
@@ -12163,19 +13949,7 @@ async function runUnpairCommand(daemon, deps = {}) {
 }
 
 // src/bin/commands/workspaces.ts
-var STABLE_ERROR_CATEGORIES = /* @__PURE__ */ new Set([
-  "git-unavailable",
-  "git-timeout",
-  "git-output-limit",
-  "git-command-failed",
-  "workspace-root-invalid",
-  "workspace-root-conflict",
-  "workspace-not-owned",
-  "repository-root-mismatch",
-  "repository-invalid",
-  "lease-busy",
-  "ledger-invalid"
-]);
+var STABLE_ERROR_CATEGORIES = new Set(GIT_ERROR_CATEGORIES);
 function abbreviateCommit(value) {
   if (!value) return "-";
   return value.length > 8 ? value.slice(0, 8) : value;