@cmmd-center/forge 0.13.14 → 0.13.16

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$51, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$52, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-BMBkezUO.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as runtimeGrantToken, f as setRuntimeGrantToken, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, p as createReadOnceFileTokenAccessor, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as verifyCmmdScopedRuntimePayload } from "./runtimeControlAuthority-E_kdeD_P.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as runtimeGrantToken, f as setRuntimeGrantToken, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, p as createReadOnceFileTokenAccessor, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as verifyCmmdScopedRuntimePayload } from "./runtimeControlAuthority-DpRIoWqP.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-BzdbZ0Ym.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -26921,6 +26921,44 @@ function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
 	return WORKTREE_LAUNCH_ACTIVITY_KINDS.has(kind);
 }
+/**
+* A plan update rides the `tool_call` event kind because the forge-context
+* contract has no plan event kind, the same trade the launch rows make. The
+* steps are carried verbatim under a versioned marker so a cloud client can
+* rebuild the composer plan banner from the durable replica. (#3319)
+*/
+const CMMD_RUNTIME_PLAN_ACTIVITY_KIND = "turn.plan.updated";
+function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
+	return {
+		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		forgePlanActivity: {
+			schemaVersion: 1,
+			source: "native",
+			kind
+		}
+	};
+}
+function decodeCmmdRuntimePlanActivity(payload) {
+	if (!isRecord$23(payload)) return null;
+	const metadata = payload["forgePlanActivity"];
+	if (!isRecord$23(metadata)) return null;
+	if (metadata["schemaVersion"] !== 1 || metadata["source"] !== "native" || metadata["kind"] !== "turn.plan.updated") return null;
+	const rawPlan = payload["plan"];
+	return {
+		kind: CMMD_RUNTIME_PLAN_ACTIVITY_KIND,
+		plan: Array.isArray(rawPlan) ? rawPlan.flatMap((entry) => {
+			if (!isRecord$23(entry)) return [];
+			const step = entry["step"];
+			const status = entry["status"];
+			if (typeof step !== "string" || step.trim().length === 0) return [];
+			if (status !== "pending" && status !== "inProgress" && status !== "completed") return [];
+			return [{
+				step,
+				status
+			}];
+		}) : []
+	};
+}
 //#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
@@ -66085,7 +66123,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.14";
+var version$1 = "0.13.16";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66965,6 +67003,121 @@ function verifyCmmdForgeCloudOwnerAssertion(token, publicKeyPem, expectedKeyId,
 	};
 }
 //#endregion
+//#region src/observability/Attributes.ts
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function markSeen(value, seen) {
+	if (seen.has(value)) return true;
+	seen.add(value);
+	return false;
+}
+function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
+	if (typeof value === "bigint") return value.toString();
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message,
+		...value.stack ? { stack: value.stack } : {}
+	};
+	if (Array.isArray(value)) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return value.map((entry) => normalizeJsonValue(entry, seen));
+	}
+	if (value instanceof Map) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
+	}
+	if (value instanceof Set) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
+	}
+	if (!isPlainObject$1(value)) return String(value);
+	if (markSeen(value, seen)) return "[Circular]";
+	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
+}
+function compactTraceAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
+}
+function compactMetricAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
+		if (value === void 0 || value === null) return [];
+		if (typeof value === "string") return [[key, value]];
+		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
+		return [];
+	}));
+}
+function outcomeFromExit(exit) {
+	if (isSuccess(exit)) return "success";
+	return hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
+}
+function normalizeModelMetricLabel(model) {
+	const normalized = model?.trim().toLowerCase();
+	if (!normalized) return;
+	if (normalized.includes("gpt")) return "gpt";
+	if (normalized.includes("claude")) return "claude";
+	if (normalized.includes("gemini")) return "gemini";
+	return "other";
+}
+//#endregion
+//#region src/observability/Metrics.ts
+const rpcRequestsTotal = counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
+const rpcRequestDuration = timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
+const orchestrationCommandsTotal = counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
+const orchestrationCommandDuration = timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
+const orchestrationCommandAckDuration = timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
+const orchestrationEventsProcessedTotal = counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
+const providerSessionsTotal = counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
+const providerTurnsTotal = counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
+const providerTurnDuration = timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
+const providerRuntimeEventsTotal = counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
+const gitCommandsTotal = counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
+const gitCommandDuration = timer("t3_git_command_duration", { description: "Git command execution duration." });
+const terminalSessionsTotal = counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
+const browserSessionsReapedTotal = counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
+const terminalRestartsTotal = counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
+const runtimeReplicationOutboxDepth = gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
+const runtimeReplicationOutboxOldestEventAge = gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
+const runtimeReplicationPublicationAttemptsTotal = counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
+const runtimeReplicationPublicationRetriesTotal = counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
+const runtimeReplicationPublicationLatency = timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
+const cmmdCredentialRefreshTotal = counter("t3_cmmd_credential_refresh_total", { description: "CMMD JWT refresh attempts for a Forge session, by rung (self-refresh | grant-redemption) and outcome (attempted | succeeded)." });
+const cmmdRotationFenceAppliedTotal = counter("t3_cmmd_rotation_fence_applied_total", { description: "Sessions Forge refused to rotate CMMD credentials for, because the rotation fence applied." });
+const cmmdCredentialRowDeletedTotal = counter("t3_cmmd_credential_row_deleted_total", { description: "command_access_tokens rows actually deleted by clearUnrecoverableCmmdAuthForSession, by reason." });
+const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
+const increment = (metric, attributes, amount = 1) => update$3(withAttributes(metric, metricAttributes(attributes)), amount);
+const withMetricsImpl = (effect, options) => gen(function* () {
+	const startedAt = Date.now();
+	const exit$2 = yield* exit(effect);
+	const duration = millis(Math.max(0, Date.now() - startedAt));
+	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
+	if (options.timer) yield* update$3(withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
+	if (options.counter) {
+		const outcome = outcomeFromExit(exit$2);
+		yield* update$3(withAttributes(options.counter, metricAttributes({
+			...baseAttributes,
+			outcome,
+			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
+		})), 1);
+	}
+	if (isSuccess(exit$2)) return exit$2.value;
+	return yield* failCause$1(exit$2.cause);
+});
+const withMetrics = dual(2, withMetricsImpl);
+const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
+	provider,
+	...extra
+});
+const providerTurnMetricAttributes = (input) => {
+	const modelFamily = normalizeModelMetricLabel(input.model);
+	return compactMetricAttributes({
+		provider: input.provider,
+		...modelFamily ? { modelFamily } : {},
+		...input.extra
+	});
+};
+//#endregion
 //#region src/persistence/Errors.ts
 var PersistenceSqlError = class extends TaggedErrorClass()("PersistenceSqlError", {
 	operation: String$1,
@@ -67655,8 +67808,14 @@ const scheduleExpiredForgeCloudOwnerCredentialMaintenance = sleep$4(minutes(5)).
 *
 * Clearing every active owner row unconditionally (the pre-CMMD-1871 behaviour)
 * turned a single expired tab into a sign-out on every browser and device.
+*
+* Destroys a refresh token good for months, so every call is logged with a
+* `reason` naming the caller's own decision (never the credential itself) and
+* the actual row count deleted, at info level so it shows up without raising
+* the server's log level. `reason` is optional only so a caller that has not
+* been updated yet still compiles; every current caller passes one.
 */
-const clearUnrecoverableCmmdAuthForSession = (sessionId) => gen(function* () {
+const clearUnrecoverableCmmdAuthForSession = (sessionId, reason) => gen(function* () {
 	const sql = yield* SqlClient;
 	const rows = yield* sql`
       DELETE FROM command_access_tokens
@@ -67681,6 +67840,14 @@ const clearUnrecoverableCmmdAuthForSession = (sessionId) => gen(function* () {
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.clearUnrecoverableCmmdAuth:query")));
 	forgetCommandAccessTokenCachesForSession(sessionId);
 	for (const row of rows) forgetCommandAccessTokenCachesForSession(row.sessionId);
+	if (rows.length > 0) {
+		yield* logInfo("CMMD credential row deleted.", {
+			sessionId,
+			reason: reason ?? "unspecified",
+			rowsDeleted: rows.length
+		});
+		yield* update$3(withAttributes(cmmdCredentialRowDeletedTotal, metricAttributes({ reason: reason ?? "unspecified" })), rows.length);
+	}
 });
 /**
 * Retire refresh credentials copied into historical desktop bearer sessions.
@@ -67736,6 +67903,23 @@ const isDesktopBearerAuthSession = (sessionId) => gen(function* () {
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.isDesktopBearerSession:query")));
 	return rows[0]?.method === "bearer-session-token" && rows[0].clientDeviceType === "desktop";
 });
+/**
+* The device type a session's bearer bootstrap declared, for log lines only.
+*
+* Mirrors `isDesktopBearerAuthSession`'s read but returns the raw column
+* instead of collapsing it into a rotation verdict — a log line wants to say
+* what made the request, not whether Forge may rotate for it. Never fails:
+* an unreadable or missing row logs as `"unknown"` rather than losing the
+* decision-point log line it is attached to.
+*/
+const readClientDeviceTypeForSession = (sessionId) => gen(function* () {
+	return (yield* (yield* SqlClient)`
+      SELECT client_device_type AS "clientDeviceType"
+      FROM auth_sessions
+      WHERE session_id = ${sessionId}
+      LIMIT 1
+    `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.readClientDeviceType:query"))))[0]?.clientDeviceType ?? "unknown";
+}).pipe(orElseSucceed(() => "unknown"));
 //#endregion
 //#region src/auth/http/oauthCookies.ts
 const OAUTH_STATE_COOKIE = "forge_oauth_state";
@@ -67938,9 +68122,20 @@ const authLogoutRouteLayer = add$1("POST", "/api/auth/logout", gen(function* ()
 		onSuccess: (session) => session.sessionId
 	}));
 	if (sessionId) {
+		yield* logInfo("Auth logout.", {
+			sessionId,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			outcome: "session-cleared",
+			reason: cloudShell ? "forge-cloud-shell-session" : "local-session"
+		});
 		if (!cloudShell) yield* sessions.revoke(sessionId).pipe(ignore({ log: false }));
 		yield* clearCommandAccessTokenForSession(sessionId).pipe(ignore({ log: false }));
-	}
+	} else yield* logInfo("Auth logout.", {
+		sessionId: null,
+		deviceType: "unknown",
+		outcome: "no-op",
+		reason: "no authenticated session presented"
+	});
 	const secure = shouldUseSecureCookie(forgePublicUrlForRequest(request));
 	let response = yield* jsonUnsafe({ loggedOut: true }, { status: 200 }).pipe(setCookie(sessions.cookieName, "", {
 		expires: /* @__PURE__ */ new Date(0),
@@ -68539,16 +68734,32 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
-	if (serverAuth.isForgeCloudShell?.() === true) return yield* new AuthError({
-		message: "Forge Cloud accepts owner assertions from CMMD only.",
-		status: 403
-	});
+	if (serverAuth.isForgeCloudShell?.() === true) {
+		yield* logWarning$1("CMMD bearer bootstrap failed.", {
+			deviceType: "unknown",
+			outcome: "failed",
+			reason: "forge-cloud-shell-rejects-non-cmmd-bootstrap"
+		});
+		return yield* new AuthError({
+			message: "Forge Cloud accepts owner assertions from CMMD only.",
+			status: 403
+		});
+	}
 	const payload = yield* schemaBodyJson(CommandBootstrapInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid CMMD OAuth bearer bootstrap payload.",
 		status: 400,
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType: "unknown",
+		outcome: "failed",
+		reason: "invalid-payload"
+	})));
+	const deviceType = payload.clientDeviceType ?? "desktop";
+	const validated = yield* validateCommandBootstrapPayload(payload).pipe(tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "invalid-command-bootstrap-payload"
 	})));
-	const validated = yield* validateCommandBootstrapPayload(payload);
 	const sessionSubject = resolveCommandOAuthSubject(validated.subjectUserId);
 	const issued = yield* sessions.issue({
 		method: "bearer-session-token",
@@ -68561,20 +68772,34 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	}).pipe(mapError((cause) => new AuthError({
 		message: "Failed to issue authenticated bearer session.",
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "session-issuance-failed"
 	})));
 	const cmmdIdentity = yield* persistCommandBootstrapSessionArtifacts({
 		sessionId: issued.sessionId,
 		payload,
 		cmmdIdentity: validated.cmmdIdentity
 	});
-	if ((payload.clientDeviceType ?? "desktop") === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
+	if (deviceType === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
 		subject: sessionSubject,
 		clientUserAgent: request.headers["user-agent"]
 	}).pipe(mapError((cause) => new AuthError({
 		message: "Failed to retire legacy desktop refresh credentials.",
 		status: 500,
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "failed",
+		reason: "legacy-desktop-refresh-retirement-failed"
 	})));
+	yield* logInfo("CMMD bearer bootstrap succeeded.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "succeeded"
+	});
 	return jsonUnsafe({
 		authenticated: true,
 		role: issued.role,
@@ -69865,64 +70090,6 @@ function parseAttachmentIdFromRelativePath(relativePath) {
 	return id.length > 0 && !id.includes(".") ? id : null;
 }
 //#endregion
-//#region src/observability/Attributes.ts
-function isPlainObject$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function markSeen(value, seen) {
-	if (seen.has(value)) return true;
-	seen.add(value);
-	return false;
-}
-function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
-	if (typeof value === "bigint") return value.toString();
-	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
-	if (value instanceof Error) return {
-		name: value.name,
-		message: value.message,
-		...value.stack ? { stack: value.stack } : {}
-	};
-	if (Array.isArray(value)) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return value.map((entry) => normalizeJsonValue(entry, seen));
-	}
-	if (value instanceof Map) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
-	}
-	if (value instanceof Set) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
-	}
-	if (!isPlainObject$1(value)) return String(value);
-	if (markSeen(value, seen)) return "[Circular]";
-	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
-}
-function compactTraceAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
-}
-function compactMetricAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
-		if (value === void 0 || value === null) return [];
-		if (typeof value === "string") return [[key, value]];
-		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
-		return [];
-	}));
-}
-function outcomeFromExit(exit) {
-	if (isSuccess(exit)) return "success";
-	return hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
-}
-function normalizeModelMetricLabel(model) {
-	const normalized = model?.trim().toLowerCase();
-	if (!normalized) return;
-	if (normalized.includes("gpt")) return "gpt";
-	if (normalized.includes("claude")) return "claude";
-	if (normalized.includes("gemini")) return "gemini";
-	return "other";
-}
-//#endregion
 //#region src/observability/TraceRecord.ts
 function formatTraceExit(exit) {
 	if (isSuccess(exit)) return { _tag: "Success" };
@@ -70978,6 +71145,22 @@ async function readOAuthErrorCode(response) {
 //#endregion
 //#region src/command/cmmdRotationFence.ts
 /**
+* Log and count a fence application, without changing the verdict it reports.
+*
+* The two facts named in the log line are exactly the ones the predicate
+* above the caller already computed — whether this session ever deposited a
+* refresh token of its own, and (only when that was false) whether the
+* session row reads as a desktop bearer session. Neither fact nor the log
+* line changes what the caller returns.
+*/
+function logRotationFenceApplied(input) {
+	return logInfo("CMMD rotation fence applied: session may not rotate its own credential.", {
+		sessionId: input.sessionId,
+		hasStoredRefreshToken: input.hasStoredRefreshToken,
+		isDesktopBearerSession: input.isDesktopBearerSession
+	}).pipe(andThen(() => update$3(withAttributes(cmmdRotationFenceAppliedTotal, metricAttributes({})), 1)));
+}
+/**
 * True when Forge must not rotate this session's CMMD credentials.
 *
 * Fails closed: if the session row cannot be read, assume the fence applies.
@@ -70985,8 +71168,22 @@ async function readOAuthErrorCode(response) {
 * reconnect.
 */
 function isRotationFencedSession(sessionId) {
-	if (readCommandRefreshTokenForSession(sessionId)) return succeed(false);
-	return isDesktopBearerAuthSession(sessionId).pipe(orElseSucceed(() => true));
+	const hasStoredRefreshToken = readCommandRefreshTokenForSession(sessionId) !== null;
+	if (hasStoredRefreshToken) return succeed(false);
+	return isDesktopBearerAuthSession(sessionId).pipe(match$1({
+		onFailure: () => ({
+			fenced: true,
+			isDesktopBearerSession: null
+		}),
+		onSuccess: (isDesktopBearerSession) => ({
+			fenced: isDesktopBearerSession,
+			isDesktopBearerSession
+		})
+	}), tap(({ fenced, isDesktopBearerSession }) => fenced ? logRotationFenceApplied({
+		sessionId,
+		hasStoredRefreshToken,
+		isDesktopBearerSession
+	}) : void_$1), map$3(({ fenced }) => fenced));
 }
 //#endregion
 //#region src/cmmdConnection/cmmdCredentialRejection.ts
@@ -71023,7 +71220,7 @@ function forgetCmmdCredentialRejection(sessionId) {
 */
 const clearCmmdAuthAfterCmmdRejection = (sessionId) => gen(function* () {
 	if (!hasCmmdCredentialRejection(sessionId)) return;
-	yield* clearUnrecoverableCmmdAuthForSession(sessionId);
+	yield* clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-rejected-credential");
 	forgetCmmdCredentialRejection(sessionId);
 });
 //#endregion
@@ -71034,6 +71231,23 @@ function usableCmmdUserJwt(token) {
 function storeResolvedJwt(sessionId, accessToken, refreshToken) {
 	return setCommandJwtForSession(sessionId, accessToken, refreshToken ? { refreshToken } : {}).pipe(ignore({ log: true }));
 }
+function logCmmdJwtRung(context, rung, outcome, reason) {
+	return (outcome === "failed" ? logWarning$1 : logInfo)("CMMD JWT resolver rung.", {
+		sessionId: context.sessionId,
+		subject: context.subject,
+		deviceType: context.deviceType,
+		caller: context.caller,
+		rung,
+		outcome,
+		reason
+	});
+}
+function recordCmmdCredentialRefreshMetric(rung, outcome) {
+	return update$3(withAttributes(cmmdCredentialRefreshTotal, metricAttributes({
+		rung,
+		outcome
+	})), 1);
+}
 const inFlightRefreshes = /* @__PURE__ */ new Map();
 function refreshOnceForSession(sessionId, refreshToken) {
 	return promise(() => {
@@ -71055,15 +71269,21 @@ function refreshOnceForSession(sessionId, refreshToken) {
 * sibling session's token silently invalidates that sibling's stored copy and
 * signs it out.
 */
-function trySelfRefresh(sessionId, logPrefix) {
+function trySelfRefresh(sessionId, context) {
 	const currentRefreshToken = readCommandRefreshTokenForSession(sessionId);
-	if (!currentRefreshToken) return succeed(null);
+	if (!currentRefreshToken) return logCmmdJwtRung(context, "self-refresh", "skipped", "no refresh token stored for this session").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "self-refresh", "attempted", "rotating this session's own stored refresh token");
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "attempted");
 		const refreshed = yield* refreshOnceForSession(sessionId, currentRefreshToken);
 		const accessToken = usableCmmdUserJwt(refreshed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "self-refresh", "failed", "CMMD refresh did not return a usable user access JWT");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, accessToken, refreshed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD JWT refreshed for session ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "succeeded");
+		yield* logCmmdJwtRung(context, "self-refresh", "succeeded", "CMMD rotated the stored refresh token");
 		return accessToken;
 	});
 }
@@ -71080,16 +71300,22 @@ function trySelfRefresh(sessionId, logPrefix) {
 * CMMD owns its lifetime, and a transient network failure must not throw away
 * the one credential that can still recover the session.
 */
-function tryGrantRedemption(sessionId, logPrefix) {
+function tryGrantRedemption(sessionId, context) {
 	const grantToken = readCommandSessionGrantForSession(sessionId);
-	if (!grantToken) return succeed(null);
+	if (!grantToken) return logCmmdJwtRung(context, "grant-redemption", "skipped", "no session grant stored for this session").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
 		const redeemed = yield* promise(() => redeemCmmdSessionGrant(grantToken)).pipe(orElseSucceed(() => null));
 		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
+			return null;
+		}
 		if (redeemed?.mcpToken) yield* setCommandAccessTokenForSession(sessionId, redeemed.mcpToken).pipe(ignore({ log: true }));
 		yield* storeResolvedJwt(sessionId, accessToken, redeemed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD credentials recovered via session grant for ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "succeeded");
+		yield* logCmmdJwtRung(context, "grant-redemption", "succeeded", "session grant redeemed");
 		return accessToken;
 	});
 }
@@ -71100,23 +71326,28 @@ function tryGrantRedemption(sessionId, logPrefix) {
 * fallback for when that rotation is already gone. Neither touches another
 * session's credentials, so this ladder is safe to run from any path.
 */
-function tryOwnCredentialRecovery(sessionId, logPrefix) {
+function tryOwnCredentialRecovery(sessionId, context) {
 	return gen(function* () {
-		const refreshed = yield* trySelfRefresh(sessionId, logPrefix);
+		const refreshed = yield* trySelfRefresh(sessionId, context);
 		if (refreshed) return refreshed;
-		return yield* tryGrantRedemption(sessionId, logPrefix);
+		return yield* tryGrantRedemption(sessionId, context);
 	});
 }
-function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
-	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return succeed(null);
+function tryPromoteBootstrap(sessionId, subject, forceRefresh, context) {
+	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return logCmmdJwtRung(context, "promote-bootstrap", "skipped", "subject is not a bootstrap subject").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "attempted", "promoting the most recent owner CMMD auth to this bootstrap session");
 		yield* promoteMostRecentOwnerCommandAuthToSession(sessionId).pipe(catch_((error) => logWarning$1("Failed to promote owner CMMD auth for REST JWT resolution.", {
 			cause: error,
 			sessionId,
 			subject
 		})));
 		const promotedJwt = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) return promotedJwt;
+		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "promote-bootstrap", "succeeded", "promoted owner JWT is usable");
+			return promotedJwt;
+		}
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "failed", forceRefresh ? "forced refresh: a promoted JWT is never reused as-is" : "no promoted JWT available, or it is already expired");
 		return null;
 	});
 }
@@ -71129,17 +71360,50 @@ function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
 * must stay private to the session it was issued to (see `trySelfRefresh`).
 * Copying it is what let one expired tab sign the user out everywhere.
 */
-function trySubjectFallback(sessionId, subject, logPrefix) {
+function trySubjectFallback(sessionId, subject, context) {
 	return gen(function* () {
-		const fallback = yield* readMostRecentJwtForSubject(subject).pipe(orElseSucceed(() => null));
-		const fallbackJwt = usableCmmdUserJwt(fallback?.jwt);
-		if (!fallbackJwt) return null;
+		yield* logCmmdJwtRung(context, "subject-fallback", "attempted", "looking for a sibling session's still-valid JWT for this subject");
+		const fallbackJwt = usableCmmdUserJwt((yield* readMostRecentJwtForSubject(subject).pipe(orElseSucceed(() => null)))?.jwt);
+		if (!fallbackJwt) {
+			yield* logCmmdJwtRung(context, "subject-fallback", "failed", "no sibling session holds a still-valid JWT for this subject");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, fallbackJwt, null);
-		console.log(`[${logPrefix}] JWT subject-fallback promoted for session ${sessionId} (owner: ${fallback?.sessionId})`);
+		yield* logCmmdJwtRung(context, "subject-fallback", "succeeded", "borrowed a sibling session's still-valid JWT");
 		return fallbackJwt;
 	});
 }
 /**
+* The rungs below the rotation fence: forced own-credential recovery,
+* bootstrap promotion, subject fallback, then own-credential recovery again
+* as the last resort. Split out of `resolveCmmdJwtForSession` so each half of
+* the ladder stays independently readable (and independently testable) —
+* the fence check above is the one decision the split does not touch.
+*/
+function runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context) {
+	return gen(function* () {
+		if (forceRefresh) {
+			const forced = yield* tryOwnCredentialRecovery(sessionId, context);
+			if (forced) return forced;
+		}
+		if (normalizedSubject) {
+			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh, context);
+			if (promoted) return promoted;
+		}
+		if (!normalizedSubject) {
+			yield* logCmmdJwtRung(context, "cache", "failed", "no subject to resolve and forced recovery already exhausted");
+			return null;
+		}
+		if (!forceRefresh) {
+			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, context);
+			if (fallback) return fallback;
+		}
+		const recovered = yield* tryOwnCredentialRecovery(sessionId, context);
+		if (!recovered) yield* logCmmdJwtRung(context, "cache", "failed", "recovery ladder exhausted: no rung produced a usable JWT");
+		return recovered;
+	});
+}
+/**
 * Resolve the CMMD REST JWT for a Forge session.
 *
 * Forge session auth is long-lived compared with the short-lived CMMD JWT.
@@ -71153,26 +71417,30 @@ function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth",
 	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
 	if (cached && !isJwtExpiredForSession(sessionId)) {
 		if (!forceRefresh) return succeed(cached);
-		if (staleAccessToken && cached !== staleAccessToken) return succeed(cached);
+		if (staleAccessToken && cached !== staleAccessToken) return succeed(cached).pipe(tap(() => gen(function* () {
+			const deviceType = yield* readClientDeviceTypeForSession(sessionId);
+			yield* logCmmdJwtRung({
+				sessionId,
+				subject: subject?.trim() || null,
+				deviceType,
+				caller: logPrefix
+			}, "cache", "skipped", "forced refresh skipped: cache already holds a token another caller rotated");
+		})));
 	}
 	const normalizedSubject = subject?.trim() || null;
 	if (!normalizedSubject && !forceRefresh) return succeed(null);
 	return gen(function* () {
-		if (yield* isRotationFencedSession(sessionId)) return null;
-		if (forceRefresh) {
-			const forced = yield* tryOwnCredentialRecovery(sessionId, logPrefix);
-			if (forced) return forced;
-		}
-		if (normalizedSubject) {
-			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh);
-			if (promoted) return promoted;
-		}
-		if (!normalizedSubject) return null;
-		if (!forceRefresh) {
-			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, logPrefix);
-			if (fallback) return fallback;
+		const context = {
+			sessionId,
+			subject: normalizedSubject,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			caller: logPrefix
+		};
+		if (yield* isRotationFencedSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "rotation-fence", "failed", "session is fenced from rotating CMMD credentials");
+			return null;
 		}
-		return yield* tryOwnCredentialRecovery(sessionId, logPrefix);
+		return yield* runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context);
 	});
 }
 //#endregion
@@ -71909,9 +72177,14 @@ function buildProxyErrorResponse(error) {
 * warning rather than failing the request if the clear itself errors — a
 * session that already has no usable credential must still get its 401,
 * not a 500 from a failed best-effort cleanup.
+*
+* Reached only after CMMD itself rejected the request with both the original
+* and (if retried) the refreshed JWT, so — unlike `respondCmmdConnectionRequired`
+* below — this always deletes the row. `clearUnrecoverableCmmdAuthForSession`
+* logs the row count and the reason itself; this only names the reason.
 */
 function clearCmmdAuthAfterFailure(sessionId) {
-	return clearUnrecoverableCmmdAuthForSession(sessionId).pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
+	return clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-proxy-auth-error").pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
 		cause: error,
 		sessionId
 	})));
@@ -71932,7 +72205,7 @@ function clearCmmdAuthAfterFailure(sessionId) {
 * refused the credential, which `clearCmmdAuthAfterCmmdRejection` checks.
 */
 function respondCmmdConnectionRequired(sessionId) {
-	return clearCmmdAuthAfterCmmdRejection(sessionId).pipe(catch_((error) => logWarning$1("Failed to clear CMMD auth that CMMD itself rejected.", {
+	return logInfo("CMMD proxy request answered CMMD_AUTH_REQUIRED.", { sessionId }).pipe(andThen(() => clearCmmdAuthAfterCmmdRejection(sessionId)), catch_((error) => logWarning$1("Failed to clear CMMD auth that CMMD itself rejected.", {
 		cause: error,
 		sessionId
 	})), as$3(buildProxyErrorResponse(new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue."))));
@@ -94672,60 +94945,6 @@ const dispatchBootstrapTurnStart = (input, command) => gen(function* () {
 */
 var OrchestrationEngineService = class extends Service$1()("forge/orchestration/Services/OrchestrationEngine/OrchestrationEngineService") {};
 //#endregion
-//#region src/observability/Metrics.ts
-const rpcRequestsTotal = counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
-const rpcRequestDuration = timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
-const orchestrationCommandsTotal = counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
-const orchestrationCommandDuration = timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
-const orchestrationCommandAckDuration = timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
-const orchestrationEventsProcessedTotal = counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
-const providerSessionsTotal = counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
-const providerTurnsTotal = counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
-const providerTurnDuration = timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
-const providerRuntimeEventsTotal = counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
-const gitCommandsTotal = counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
-const gitCommandDuration = timer("t3_git_command_duration", { description: "Git command execution duration." });
-const terminalSessionsTotal = counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
-const browserSessionsReapedTotal = counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
-const terminalRestartsTotal = counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
-const runtimeReplicationOutboxDepth = gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
-const runtimeReplicationOutboxOldestEventAge = gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
-const runtimeReplicationPublicationAttemptsTotal = counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
-const runtimeReplicationPublicationRetriesTotal = counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
-const runtimeReplicationPublicationLatency = timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
-const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
-const increment = (metric, attributes, amount = 1) => update$3(withAttributes(metric, metricAttributes(attributes)), amount);
-const withMetricsImpl = (effect, options) => gen(function* () {
-	const startedAt = Date.now();
-	const exit$2 = yield* exit(effect);
-	const duration = millis(Math.max(0, Date.now() - startedAt));
-	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
-	if (options.timer) yield* update$3(withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
-	if (options.counter) {
-		const outcome = outcomeFromExit(exit$2);
-		yield* update$3(withAttributes(options.counter, metricAttributes({
-			...baseAttributes,
-			outcome,
-			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
-		})), 1);
-	}
-	if (isSuccess(exit$2)) return exit$2.value;
-	return yield* failCause$1(exit$2.cause);
-});
-const withMetrics = dual(2, withMetricsImpl);
-const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
-	provider,
-	...extra
-});
-const providerTurnMetricAttributes = (input) => {
-	const modelFamily = normalizeModelMetricLabel(input.model);
-	return compactMetricAttributes({
-		provider: input.provider,
-		...modelFamily ? { modelFamily } : {},
-		...input.extra
-	});
-};
-//#endregion
 //#region src/observability/RpcInstrumentation.ts
 const annotateRpcSpan = (method, traceAttributes) => annotateCurrentSpan({
 	"rpc.method": method,
@@ -96464,6 +96683,7 @@ const registerCloudRuntimeForReplicaHydration = gen(function* () {
 			credentialEpoch,
 			activeTurnCount: 0,
 			activeSessionCount: 0,
+			acceptingTurns: false,
 			...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 			forgeServerVersion: installedForgeServerVersion
 		}),
@@ -96500,6 +96720,128 @@ const hydrateCloudRuntimeReplica = gen(function* () {
 	return yield* hydrateRuntimeReplica({ expectedRuntimeId: grant.runtimeId }, dependencies);
 });
 //#endregion
+//#region src/runtimeDrain/RuntimeDrainState.ts
+/**
+* The positive facts this process must observe before it can claim a turn.
+*
+* Every entry is required, so adding one here is the whole change: the
+* derivation below reads this list rather than naming fields, and the record
+* it indexes cannot be built with a member missing.
+*/
+const RUNTIME_EXECUTION_PRECONDITIONS = ["orchestrationEngine", "providerLayer"];
+/**
+* The single definition of the accepting-turns fact.
+*
+* Exported so test stubs of this service derive it exactly as the live state
+* does. A stub that recomputed it by hand could disagree with production and
+* still pass.
+*/
+function deriveAcceptingTurns(input) {
+	return RUNTIME_EXECUTION_PRECONDITIONS.every((precondition) => input.preconditions[precondition]) && !input.draining && !input.shutdownRequested;
+}
+const initialState = {
+	activeTurns: /* @__PURE__ */ new Set(),
+	activeTurnCount: 0,
+	activeSessionCount: 0,
+	draining: false,
+	drainReason: null,
+	drainTargetImageRef: null,
+	drainTargetImageVersion: null,
+	drainForceRequired: false,
+	preconditions: {
+		orchestrationEngine: false,
+		providerLayer: false
+	},
+	shutdownRequested: false
+};
+function snapshotFromState(state) {
+	return {
+		activeTurnCount: state.activeTurnCount,
+		activeSessionCount: state.activeSessionCount,
+		draining: state.draining,
+		drainReason: state.drainReason,
+		drainTargetImageRef: state.drainTargetImageRef,
+		drainTargetImageVersion: state.drainTargetImageVersion,
+		drainForceRequired: state.drainForceRequired,
+		acceptingTurns: deriveAcceptingTurns(state)
+	};
+}
+function turnKey(input) {
+	return `${input.threadId}:${input.turnId ?? "unknown"}`;
+}
+function normalizeCount(count) {
+	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
+}
+const makeRuntimeDrainState = gen(function* () {
+	const stateRef = yield* make$50(initialState);
+	const update = (f) => updateAndGet(stateRef, f).pipe(map$3(snapshotFromState));
+	return {
+		beginTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.add(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		completeTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.delete(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		clearActiveTurns: update((state) => ({
+			...state,
+			activeTurns: /* @__PURE__ */ new Set(),
+			activeTurnCount: 0
+		})),
+		setActiveSessionCount: (count) => update((state) => ({
+			...state,
+			activeSessionCount: normalizeCount(count)
+		})),
+		reconcileProviderSessions: (sessions) => update((state) => {
+			const activeSessions = sessions.filter((session) => session.status !== "closed");
+			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
+				threadId: session.threadId,
+				turnId: session.activeTurnId
+			})]));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size,
+				activeSessionCount: activeSessions.length
+			};
+		}),
+		applyControlPlaneState: (input) => update((state) => ({
+			...state,
+			draining: input.draining ?? state.draining,
+			drainReason: input.drainReason ?? state.drainReason,
+			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
+			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
+			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
+		})),
+		markExecutionPrecondition: (precondition) => update((state) => ({
+			...state,
+			preconditions: {
+				...state.preconditions,
+				[precondition]: true
+			}
+		})),
+		requestShutdown: update((state) => ({
+			...state,
+			shutdownRequested: true
+		})),
+		snapshot: get$6(stateRef).pipe(map$3(snapshotFromState)),
+		isDraining: get$6(stateRef).pipe(map$3((state) => state.draining))
+	};
+});
+var RuntimeDrainState = class extends Service$1()("forge/runtimeDrain/RuntimeDrainState") {};
+const RuntimeDrainStateLive = effect(RuntimeDrainState, makeRuntimeDrainState);
+//#endregion
 //#region src/persistence/Services/LocalAutomations.ts
 const LocalAutomationStatus = Literals([
 	"active",
@@ -97906,6 +98248,28 @@ function serializeWorktreeLaunchActivity(activity) {
 function decodeWorktreeLaunchActivityKind(kind) {
 	return isCmmdRuntimeWorktreeLaunchActivityKind(kind) ? kind : null;
 }
+function planStepsOf(activity) {
+	const decoded = decodeCmmdRuntimePlanActivity(encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload));
+	return decoded !== null && decoded.plan.length > 0 ? decoded.plan : null;
+}
+function serializePlanActivity(activity) {
+	if (activity.kind !== "turn.plan.updated") return null;
+	const plan = planStepsOf(activity);
+	if (plan === null) return null;
+	const completed = plan.filter((step) => step.status === "completed").length;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			...eventTurn(activity.turnId),
+			kind: "tool_call",
+			summary: `Plan: ${completed} of ${plan.length} steps done`,
+			status: "completed",
+			payload: encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload)
+		}
+	};
+}
 function isReplicatedFailureActivity(activity) {
 	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
@@ -98290,6 +98654,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializeWorktreeLaunchActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const planActivities = thread.activities.flatMap((activity) => {
+		const event = serializePlanActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	return [
@@ -98297,6 +98665,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...replicaActivities,
 		...toolActivities,
 		...worktreeLaunchActivities,
+		...planActivities,
 		...failureActivities,
 		...recordedTurns,
 		...textGenerations
@@ -100106,6 +100475,30 @@ const makeCommandGate = gen(function* () {
 		})
 	};
 });
+/**
+* Settle the command gate for a finished startup, and report whether commands
+* are now accepted.
+*
+* The success branch is the moment the orchestration engine can take work, so
+* it is where the engine half of the accepting-turns fact is marked. A failed
+* startup accepts nothing and must leave the fact untouched: absent must not
+* read as healthy.
+*/
+const settleCommandReadiness = (input) => gen(function* () {
+	if (isFailure(input.startupExit)) {
+		const error = new ServerRuntimeStartupError({
+			message: startupFailureMessage(input.startupExit.cause),
+			cause: input.startupExit.cause
+		});
+		yield* logError("server runtime startup failed", { cause: describeStartupFailure(input.startupExit.cause) });
+		yield* input.commandGate.failCommandReady(error);
+		return false;
+	}
+	yield* logDebug("Accepting commands");
+	yield* input.commandGate.signalCommandReady;
+	yield* input.drainState.markExecutionPrecondition("orchestrationEngine");
+	return true;
+});
 const launchStartupHeartbeat = gen(function* () {
 	const analytics = yield* AnalyticsService;
 	const { threadCount, projectCount } = yield* (yield* ProjectionSnapshotQuery).getCounts().pipe(catch_((cause) => logWarning$1("failed to gather startup projection counts for telemetry", { cause }).pipe(as$3({
@@ -100286,6 +100679,7 @@ const ServerRuntimeStartupLive = effect(ServerRuntimeStartup, gen(function* () {
 	const serverSettings = yield* ServerSettingsService;
 	const serverEnvironment = yield* ServerEnvironment;
 	const usage = yield* UsageService;
+	const drainState = yield* RuntimeDrainState;
 	const commandGate = yield* makeCommandGate;
 	const httpListening = yield* make$39();
 	const reactorScope = yield* make$37("sequential");
@@ -100368,18 +100762,11 @@ const ServerRuntimeStartupLive = effect(ServerRuntimeStartup, gen(function* () {
 		root: true
 	}));
 	yield* forkScoped(gen(function* () {
-		const startupExit = yield* exit(startup);
-		if (isFailure(startupExit)) {
-			const error = new ServerRuntimeStartupError({
-				message: startupFailureMessage(startupExit.cause),
-				cause: startupExit.cause
-			});
-			yield* logError("server runtime startup failed", { cause: describeStartupFailure(startupExit.cause) });
-			yield* commandGate.failCommandReady(error);
-			return;
-		}
-		yield* logDebug("Accepting commands");
-		yield* commandGate.signalCommandReady;
+		if (!(yield* settleCommandReadiness({
+			startupExit: yield* exit(startup),
+			commandGate,
+			drainState
+		}))) return;
 		yield* logDebug("startup phase: starting the usage scan warm-up");
 		yield* forkScoped(runUsageScanWarmup({ readSummary: usage.readSummary }));
 		yield* logDebug("startup phase: waiting for http listener");
@@ -152962,7 +153349,9 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 	scheduleProviderEgressTokenRefresh(context, delayMs) {
 		if (context.tokenRefreshTimer) clearTimeout(context.tokenRefreshTimer);
 		const tokenRefreshTimer = setTimeout(() => {
-			this.handleProviderEgressTokenRefresh(context.session.threadId).catch(() => void 0);
+			this.handleProviderEgressTokenRefresh(context.session.threadId).catch((error) => {
+				this.emitErrorEvent(context, "session/tokenRefreshFailed", error instanceof Error ? error.message : String(error));
+			});
 		}, delayMs);
 		tokenRefreshTimer.unref?.();
 		context.tokenRefreshTimer = tokenRefreshTimer;
@@ -290225,93 +290614,6 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	return "refreshed";
 }
 //#endregion
-//#region src/runtimeDrain/RuntimeDrainState.ts
-const initialState = {
-	activeTurns: /* @__PURE__ */ new Set(),
-	activeTurnCount: 0,
-	activeSessionCount: 0,
-	draining: false,
-	drainReason: null,
-	drainTargetImageRef: null,
-	drainTargetImageVersion: null,
-	drainForceRequired: false
-};
-function snapshotFromState(state) {
-	return {
-		activeTurnCount: state.activeTurnCount,
-		activeSessionCount: state.activeSessionCount,
-		draining: state.draining,
-		drainReason: state.drainReason,
-		drainTargetImageRef: state.drainTargetImageRef,
-		drainTargetImageVersion: state.drainTargetImageVersion,
-		drainForceRequired: state.drainForceRequired
-	};
-}
-function turnKey(input) {
-	return `${input.threadId}:${input.turnId ?? "unknown"}`;
-}
-function normalizeCount(count) {
-	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
-}
-const makeRuntimeDrainState = gen(function* () {
-	const stateRef = yield* make$50(initialState);
-	const update = (f) => updateAndGet(stateRef, f).pipe(map$3(snapshotFromState));
-	return {
-		beginTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.add(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		completeTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.delete(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		clearActiveTurns: update((state) => ({
-			...state,
-			activeTurns: /* @__PURE__ */ new Set(),
-			activeTurnCount: 0
-		})),
-		setActiveSessionCount: (count) => update((state) => ({
-			...state,
-			activeSessionCount: normalizeCount(count)
-		})),
-		reconcileProviderSessions: (sessions) => update((state) => {
-			const activeSessions = sessions.filter((session) => session.status !== "closed");
-			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
-				threadId: session.threadId,
-				turnId: session.activeTurnId
-			})]));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size,
-				activeSessionCount: activeSessions.length
-			};
-		}),
-		applyControlPlaneState: (input) => update((state) => ({
-			...state,
-			draining: input.draining ?? state.draining,
-			drainReason: input.drainReason ?? state.drainReason,
-			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
-			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
-			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
-		})),
-		snapshot: get$6(stateRef).pipe(map$3(snapshotFromState)),
-		isDraining: get$6(stateRef).pipe(map$3((state) => state.draining))
-	};
-});
-var RuntimeDrainState = class extends Service$1()("forge/runtimeDrain/RuntimeDrainState") {};
-const RuntimeDrainStateLive = effect(RuntimeDrainState, makeRuntimeDrainState);
-//#endregion
 //#region src/runtimeDrain/RuntimeDrainReporter.ts
 const HEARTBEAT_INTERVAL = seconds(30);
 const HEARTBEAT_TICK_TIMEOUT = seconds(60);
@@ -290369,6 +290671,7 @@ const postRuntimeHeartbeat = (config, snapshot) => promise(async () => {
 		...config,
 		activeTurnCount: snapshot.activeTurnCount,
 		activeSessionCount: snapshot.activeSessionCount,
+		acceptingTurns: snapshot.acceptingTurns,
 		...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 		forgeServerVersion: installedForgeServerVersion
 	});
@@ -290477,6 +290780,7 @@ const makeRuntimeDrainReporter = gen(function* () {
 				work: reportOnce,
 				interval: HEARTBEAT_INTERVAL
 			}));
+			yield* addFinalizer$2(() => drainState.requestShutdown);
 		})
 	};
 });
@@ -290687,6 +290991,7 @@ function decodeCodexRateLimitWindows(raw) {
 function publicProviderRuntimeError(message) {
 	return sanitizePublicProviderText(message, { fallback: DEFAULT_PUBLIC_PROVIDER_ERROR });
 }
+const processDomainEvent = (_event) => void_$1;
 function isAssistantTextDeltaEvent(event) {
 	return event.type === "content.delta" && event.payload.streamKind === "assistant_text";
 }
@@ -291480,7 +291785,6 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 			yield* runtimeDrainReporter.reportOnce;
 		}
 	});
-	const processDomainEvent = (_event) => void_$1;
 	const processInput = (input) => input.source === "runtime" ? processRuntimeEvent(input.event) : processDomainEvent(input.event);
 	const processInputSafely = (input) => processInput(input).pipe(catchCause((cause) => {
 		if (hasInterruptsOnly(cause)) return failCause$1(cause);
@@ -291531,6 +291835,7 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	return {
 		start: fn$1("start")(function* () {
 			yield* reconcileOrphanedRunningSessions();
+			yield* runtimeDrainState.markExecutionPrecondition("providerLayer");
 			yield* runtimeDrainReporter.start;
 			yield* forkScoped(runForEach(providerService.streamEvents, (event) => enqueueInput({
 				source: "runtime",
@@ -291769,6 +292074,8 @@ const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
+const isProviderValidationError = is$1(ProviderValidationError);
+const isProviderKind = is$1(ProviderKind);
 function isPathInsideRoot(candidatePath, rootPath) {
 	let resolvedCandidate;
 	let resolvedRoot;
@@ -291805,6 +292112,38 @@ function resolveExistingWorkspaceCwd(input) {
 function publicProviderFailureDetail(detail) {
 	return sanitizePublicProviderText(detail, { fallback: "CMMD is temporarily unavailable. Check the workspace AI connection and retry." }) ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
 }
+/**
+* The failure detail a transcript shows, judged on the text and not the envelope.
+*
+* Forge writes its own validation copy, so `ProviderValidationError.issue` is
+* not raw provider output. Every envelope around it hides it, each in its own
+* way: `Cause.pretty` prints the error tag, and the sanitizer counts
+* "ProviderValidationError" as a provider leak, so a validation failure
+* rendered through `Cause.pretty` tripped the guard on its own wrapper. The
+* `message` getter spells the same tag out in prose. On 2026-09-16 the first of
+* those replaced "Reconnect the account and try again" with "CMMD is
+* temporarily unavailable" (#3337).
+*
+* The issue still goes through the sanitizer. `ProviderService` builds some
+* issues from a schema formatter, which echoes the decoded payload, so this is a
+* narrower input to the same guard rather than a way around it.
+*/
+function publicProviderFailureDetailFromError(error) {
+	if (isProviderValidationError(error)) return publicProviderFailureDetail(error.issue);
+	return publicProviderFailureDetail(error instanceof Error ? error.message : String(error));
+}
+/**
+* The same judgement for a failure that arrives as a cause.
+*
+* Only the validation branch delegates. A cause carries what a bare error does
+* not: defects, interrupts, and more than one failure, all of which
+* `Cause.pretty` renders and `.message` would drop. Squashing every failure into
+* its message to reach one shared line would lose that.
+*/
+function publicProviderFailureDetailFromCause(cause) {
+	const error = squash(cause);
+	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(pretty(cause));
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -291960,7 +292299,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* die$1(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
 		const desiredRuntimeMode = thread.runtimeMode;
-		const currentProvider = thread.session?.status !== "stopped" && is$1(ProviderKind)(thread.session?.providerName) ? thread.session.providerName : void 0;
+		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const rawRequestedModelSelection = options?.modelSelection;
 		const threadProvider = currentProvider ?? thread.modelSelection.provider;
 		const isStaleRequestedProvider = rawRequestedModelSelection !== void 0 && rawRequestedModelSelection.provider !== threadProvider;
@@ -292287,7 +292626,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				summary: "Provider turn start failed",
 				detail: `User message '${event.payload.messageId}' was not found for turn start request.`,
 				turnId: null,
-				createdAt: event.payload.createdAt
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 			return;
 		}
@@ -292338,9 +292677,9 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start failed",
-			detail: publicProviderFailureDetail(pretty(cause)),
+			detail: publicProviderFailureDetailFromCause(cause),
 			turnId: null,
-			createdAt: event.payload.createdAt
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
 	});
 	const processTurnInterruptRequested = fn$1("processTurnInterruptRequested")(function* (event) {
@@ -292354,7 +292693,14 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			turnId: event.payload.turnId ?? null,
 			createdAt: event.payload.createdAt
 		});
-		yield* providerService.interruptTurn({ threadId: event.payload.threadId });
+		yield* providerService.interruptTurn({ threadId: event.payload.threadId }).pipe(catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.turn.interrupt.failed",
+			summary: "Provider turn interrupt failed",
+			detail: publicProviderFailureDetail(pretty(cause)),
+			turnId: event.payload.turnId ?? null,
+			createdAt: event.payload.createdAt
+		})));
 	});
 	const processApprovalResponseRequested = fn$1("processApprovalResponseRequested")(function* (event) {
 		const staged = peekThreadContinuationSession(event.commandId);
@@ -292391,7 +292737,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				threadId: event.payload.threadId,
 				kind: "provider.approval.respond.failed",
 				summary: "Provider approval response failed",
-				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetail(pretty(cause)),
+				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 				turnId: null,
 				createdAt: event.payload.createdAt,
 				requestId: event.payload.requestId
@@ -292434,7 +292780,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.user-input.respond.failed",
 			summary: "Provider user input response failed",
-			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetail(pretty(cause)),
+			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: event.payload.createdAt,
 			requestId: event.payload.requestId
@@ -292447,8 +292793,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		yield* providerService.stopSession({
 			threadId: thread.id,
 			...event.payload.preserveResumeState === true ? { preserveResumeState: true } : {}
-		});
-		yield* setThreadSession({
+		}).pipe(tap(() => setThreadSession({
 			threadId: thread.id,
 			session: {
 				threadId: thread.id,
@@ -292460,7 +292805,14 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				updatedAt: now
 			},
 			createdAt: now
-		});
+		})), catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.session.stop.failed",
+			summary: "Provider session stop failed",
+			detail: publicProviderFailureDetail(pretty(cause)),
+			turnId: null,
+			createdAt: now
+		})));
 	});
 	const processDomainEvent = fn$1("processDomainEvent")(function* (event) {
 		yield* annotateCurrentSpan({
@@ -292555,7 +292907,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start cleanup failed",
-			detail: publicProviderFailureDetail(cause instanceof Error ? cause.message : String(cause)),
+			detail: publicProviderFailureDetailFromError(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})
@@ -297975,7 +298327,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "dea91e954d3d2f23154802ae304412fabe90dbbd";
+	return "b06001f4e16f7a336e9108920f9250b366862f3d";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -309327,6 +309679,33 @@ registerProxyRoute({
 	cmmdPath: "/api/projects/campaigns/:id",
 	orgIdSource: "none"
 });
+/**
+* Apple App Store guideline 5.1.1(v): an app that supports account creation
+* or sign-in must let the user start account deletion from inside the app.
+* CMMD owns the account, so this proxies to its existing deactivation route.
+*
+* `cmmdPath` is `/api/settings/delete-account`, not a `/api/forge/context/*`
+* route: CMMD never built a forge-context-scoped deletion endpoint. It is
+* still reachable through the same owner JWT this gateway already resolves
+* per session: CMMD's `optionalJwtAuth` runs ahead of every `/api/*` route
+* (not only forge-context ones), so the same Bearer that reaches
+* `/api/cmmd/bootstrap` also authenticates here.
+*
+* CMMD's route soft-deletes: it flips the user to `active: false` and
+* `lifecycleState: 'deactivated'`, revokes CMMD's own refresh tokens, and
+* destroys its session. It does not purge data on this call. The Forge
+* client is responsible for the rest: revoking the Forge session
+* (`/api/auth/logout`) and clearing local state, the same as a manual
+* sign-out.
+*/
+registerProxyRoute({
+	forgePath: "/api/cmmd/settings/delete-account",
+	method: "DELETE",
+	cmmdPath: "/api/settings/delete-account",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	requestBody: "none"
+});
 registerProxyRoute({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
@@ -321315,7 +321694,7 @@ const PlatformServicesLive = unwrap(gen(function* () {
 }));
 const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(provideMerge(RuntimeReplicationClientLive), provideMerge(RuntimeReplicationOutboxLive), provideMerge(ActiveHourMeterLive.pipe(provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(provideMerge(RuntimeDrainStateLive));
-const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive), provide$1(ClaudeUsageTelemetryLive));
+const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive), provideMerge(RuntimeDrainStateLive), provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(provideMerge(PipelineRunClientLive));
 const AgentProtocolReactorLayerLive = AgentProtocolReactorLive.pipe(provideMerge(PipelineRunStoreLive));
 const PipelineRunCoordinatorLayerLive = PipelineRunCoordinatorLive.pipe(provideMerge(PipelineProviderAuthorityInstallerLive), provideMerge(PipelineChangeInspectorLive), provideMerge(PipelineContextArtifactStoreLive), provideMerge(PipelineModelPolicyLive), provideMerge(PipelineRunClientLive), provideMerge(PipelineRunStoreLive), provideMerge(PipelineRunWorkspaceAllocatorLive), provideMerge(PipelineStagePolicyLive), provideMerge(PipelineWorkerCoordinatorLayerLive));