@cmmd-center/forge 0.13.15 → 0.13.17

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$51, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$52, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-BMBkezUO.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as runtimeGrantToken, f as setRuntimeGrantToken, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, p as createReadOnceFileTokenAccessor, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as verifyCmmdScopedRuntimePayload } from "./runtimeControlAuthority-E_kdeD_P.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as runtimeGrantToken, f as setRuntimeGrantToken, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, p as createReadOnceFileTokenAccessor, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as verifyCmmdScopedRuntimePayload } from "./runtimeControlAuthority-DpRIoWqP.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-BzdbZ0Ym.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -25521,160 +25521,6 @@ const WorkspaceEnsureScratchResult = Struct({
 	workspaceRoot: String$1,
 	title: String$1
 });
-const CodeGraphRelation = Literals([
-	"contains",
-	"imports",
-	"calls",
-	"imports_from",
-	"method",
-	"references",
-	"re_exports",
-	"indirect_call",
-	"dynamic_import",
-	"inherits",
-	"rationale_for",
-	"implements",
-	"cites",
-	"triggers"
-]);
-const CodeGraphConfidence = Literals(["EXTRACTED", "INFERRED"]);
-const CodeGraphEdgeClass = Literals([
-	"containment",
-	"dependency",
-	"behavior"
-]);
-/**
-* Relation to drawn class. Exhaustive over CODE_GRAPH_RELATIONS by construction
-* — `codeGraph.test.ts` fails if a relation is added without a class.
-*/
-const CODE_GRAPH_RELATION_CLASS = {
-	contains: "containment",
-	method: "containment",
-	imports: "dependency",
-	imports_from: "dependency",
-	re_exports: "dependency",
-	dynamic_import: "dependency",
-	inherits: "dependency",
-	implements: "dependency",
-	calls: "behavior",
-	indirect_call: "behavior",
-	references: "behavior",
-	triggers: "behavior",
-	cites: "behavior",
-	rationale_for: "behavior"
-};
-const CodeGraphNodeKind = Literals(["file", "symbol"]);
-/**
-* One community, positioned.
-*
-* Positions are computed server-side and are stable for a given graph build, so
-* the map does not rearrange itself between openings. A map you have to re-learn
-* every time is not a map.
-*/
-const CodeGraphRegion = Struct({
-	id: NonNegativeInt,
-	label: TrimmedNonEmptyString,
-	nodeCount: PositiveInt,
-	x: Number$1,
-	y: Number$1
-});
-/** An aggregated edge between two regions, weighted by how many edges cross. */
-const CodeGraphRegionLink = Struct({
-	source: NonNegativeInt,
-	target: NonNegativeInt,
-	weight: PositiveInt
-});
-/**
-* The default view: the whole repository as ~120 named regions.
-*
-* `truncatedRegions` is not decoration. When a graph has more regions than the
-* map shows, the surface says so — a view that silently drops a third of the
-* codebase while looking complete is the failure mode this field exists to
-* prevent.
-*/
-const CodeGraphSummary = Struct({
-	repoLabel: TrimmedNonEmptyString,
-	builtAtCommit: NullOr(String$1),
-	nodeCount: NonNegativeInt,
-	edgeCount: NonNegativeInt,
-	extractedEdgeCount: NonNegativeInt,
-	inferredEdgeCount: NonNegativeInt,
-	regionCount: NonNegativeInt,
-	regions: ArraySchema(CodeGraphRegion),
-	links: ArraySchema(CodeGraphRegionLink),
-	truncatedRegions: NonNegativeInt
-});
-/** A node as it appears in a list, a search result, or a neighborhood. */
-const CodeGraphNodeSummary = Struct({
-	id: TrimmedNonEmptyString,
-	label: TrimmedNonEmptyString,
-	kind: CodeGraphNodeKind,
-	sourceFile: NullOr(String$1),
-	sourceLocation: NullOr(String$1),
-	regionId: NullOr(NonNegativeInt),
-	regionLabel: NullOr(String$1),
-	degree: NonNegativeInt
-});
-/** One edge, carrying both the exact relation and the class it is drawn as. */
-const CodeGraphEdgeView = Struct({
-	source: TrimmedNonEmptyString,
-	target: TrimmedNonEmptyString,
-	relation: CodeGraphRelation,
-	edgeClass: CodeGraphEdgeClass,
-	confidence: CodeGraphConfidence,
-	confidenceScore: Number$1
-});
-/**
-* One node and what surrounds it — the view a person actually works in.
-*
-* `truncated` fires when a hub's fan-out exceeds the cap. A god node with
-* thousands of edges must degrade to "showing 150 of 2,310", never to a frozen
-* tab or a quietly partial picture.
-*/
-const CodeGraphNeighborhood = Struct({
-	root: CodeGraphNodeSummary,
-	nodes: ArraySchema(CodeGraphNodeSummary),
-	edges: ArraySchema(CodeGraphEdgeView),
-	depth: PositiveInt,
-	truncated: Boolean$1,
-	omittedCount: NonNegativeInt
-});
-const CodeGraphSearchResult = Struct({
-	nodes: ArraySchema(CodeGraphNodeSummary),
-	truncated: Boolean$1
-});
-const CodeGraphSummaryInput = Struct({ cwd: TrimmedNonEmptyString });
-const CodeGraphNeighborhoodInput = Struct({
-	cwd: TrimmedNonEmptyString,
-	nodeId: TrimmedNonEmptyString,
-	depth: optional$4(PositiveInt)
-});
-const CodeGraphSearchInput = Struct({
-	cwd: TrimmedNonEmptyString,
-	query: TrimmedNonEmptyString,
-	limit: optional$4(PositiveInt)
-});
-/** Where the extractor writes, relative to the project root. */
-const CODE_GRAPH_ARTIFACT_PATH = "graphify-out/graph.json";
-/**
-* No graph in this checkout, or one that cannot be read.
-*
-* Distinct from a read failure on purpose: "not indexed yet" is the normal
-* first-run state and gets an action, while a malformed or unreadable artifact
-* is a fault and gets an explanation. Collapsing them would tell a user with a
-* corrupt file to run a build they have already run.
-*/
-var CodeGraphUnavailableError = class extends TaggedErrorClass()("CodeGraphUnavailableError", {
-	reason: Literals([
-		"missing",
-		"unreadable",
-		"malformed",
-		"lfs-pointer"
-	]),
-	message: String$1
-}) {};
-/** A node id that is not in this graph — usually a stale link into a rebuilt graph. */
-var CodeGraphNodeNotFoundError = class extends TaggedErrorClass()("CodeGraphNodeNotFoundError", { nodeId: String$1 }) {};
 //#endregion
 //#region ../../packages/contracts/src/relay.ts
 const RELAY_PROTOCOL_FAMILY = "forge-relay";
@@ -26055,9 +25901,6 @@ const WS_METHODS = {
 	projectsWriteFile: "projects.writeFile",
 	projectCheckoutDeletionPreview: "projectCheckoutDeletion.preview",
 	projectCheckoutDeletionExecute: "projectCheckoutDeletion.execute",
-	codeGraphSummary: "codeGraph.summary",
-	codeGraphNeighborhood: "codeGraph.neighborhood",
-	codeGraphSearch: "codeGraph.search",
 	workspaceReadFile: "workspace.readFile",
 	workspaceBeginWriteFile: "workspace.beginWriteFile",
 	workspaceWriteFileChunk: "workspace.writeFileChunk",
@@ -26343,21 +26186,6 @@ const WsProjectCheckoutDeletionExecuteRpc = make$30(WS_METHODS.projectCheckoutDe
 	payload: ProjectCheckoutDeletionExecuteInput,
 	success: ProjectCheckoutDeletionResult
 });
-const WsCodeGraphSummaryRpc = make$30(WS_METHODS.codeGraphSummary, {
-	payload: CodeGraphSummaryInput,
-	success: CodeGraphSummary,
-	error: CodeGraphUnavailableError
-});
-const WsCodeGraphNeighborhoodRpc = make$30(WS_METHODS.codeGraphNeighborhood, {
-	payload: CodeGraphNeighborhoodInput,
-	success: CodeGraphNeighborhood,
-	error: Union([CodeGraphUnavailableError, CodeGraphNodeNotFoundError])
-});
-const WsCodeGraphSearchRpc = make$30(WS_METHODS.codeGraphSearch, {
-	payload: CodeGraphSearchInput,
-	success: CodeGraphSearchResult,
-	error: CodeGraphUnavailableError
-});
 const WsWorkspaceReadFileRpc = make$30(WS_METHODS.workspaceReadFile, {
 	payload: BulkTransferReadFileInput,
 	success: BulkTransferStreamEvent,
@@ -26807,7 +26635,7 @@ const WsRpcGroup = make$29(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, Ws
 	payload: UsageSummaryInput,
 	success: UsageSummary,
 	error: UsageReadError
-}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsCodeGraphSummaryRpc, WsCodeGraphNeighborhoodRpc, WsCodeGraphSearchRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
+}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
 	payload: AssetsRpcSchemas.createUrl.input,
 	success: AssetsRpcSchemas.createUrl.output,
 	error: AssetAccessError
@@ -31496,21 +31324,6 @@ const RELAY_METHOD_POLICY_BASES = [
 		requiredScope: "runtime.read",
 		deliveryClass: "read"
 	},
-	{
-		method: WS_METHODS.codeGraphSummary,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
-	{
-		method: WS_METHODS.codeGraphNeighborhood,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
-	{
-		method: WS_METHODS.codeGraphSearch,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
 	{
 		method: WS_METHODS.projectsWriteFile,
 		requiredScope: "workspace.write",
@@ -66123,7 +65936,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.15";
+var version$1 = "0.13.17";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67161,7 +66974,7 @@ function toPersistenceDecodeDefect(operation) {
 const isPersistenceError = (u) => is$1(PersistenceSqlError)(u) || is$1(PersistenceDecodeError)(u);
 //#endregion
 //#region src/cmmdConnection/CmmdConnectionStore.ts
-const cache$1 = /* @__PURE__ */ new Map();
+const cache = /* @__PURE__ */ new Map();
 const jwtCache = /* @__PURE__ */ new Map();
 const jwtExpiryCache = /* @__PURE__ */ new Map();
 const refreshTokenCache = /* @__PURE__ */ new Map();
@@ -67302,7 +67115,7 @@ const hydrateCommandAccessTokenStore = gen(function* () {
       session_grant AS "sessionGrant"
     FROM command_access_tokens
   `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.hydrate:query")))).pipe(mapError(toPersistenceDecodeError("CommandAccessTokenStore.hydrate:decodeRows")));
-	cache$1.clear();
+	cache.clear();
 	jwtCache.clear();
 	jwtExpiryCache.clear();
 	refreshTokenCache.clear();
@@ -67312,7 +67125,7 @@ const hydrateCommandAccessTokenStore = gen(function* () {
 		try: () => {
 			for (const row of decoded) {
 				const sessionId = row.sessionId;
-				cache$1.set(sessionId, decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken));
+				cache.set(sessionId, decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken));
 				const jwtToken = decryptNullable(JWT_TOKEN_SCOPE, row.jwtToken);
 				if (jwtToken) jwtCache.set(sessionId, jwtToken);
 				if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
@@ -67332,7 +67145,7 @@ const hydrateCommandAccessTokenStore = gen(function* () {
 * Returns `null` when the session has no paired CMMD token.
 */
 function readCommandAccessTokenForSession(sessionId) {
-	return cache$1.get(sessionId) ?? null;
+	return cache.get(sessionId) ?? null;
 }
 const threadSessions = /* @__PURE__ */ new Map();
 /**
@@ -67709,7 +67522,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => gen(function*
         cmmd_user_identity = excluded.cmmd_user_identity,
         updated_at = excluded.updated_at
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.promoteLatestOwnerAuth:upsert")));
-	cache$1.set(sessionId, accessToken);
+	cache.set(sessionId, accessToken);
 	if (jwtToken) jwtCache.set(sessionId, jwtToken);
 	else jwtCache.delete(sessionId);
 	if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
@@ -67754,7 +67567,7 @@ const setCommandAccessTokenForSession = (sessionId, accessToken) => gen(function
         access_token = excluded.access_token,
         updated_at = excluded.updated_at
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.set:query")));
-	cache$1.set(sessionId, token);
+	cache.set(sessionId, token);
 });
 /**
 * Remove the PAT for a session from both durable persistence and the in-memory cache.
@@ -67767,7 +67580,7 @@ const clearCommandAccessTokenForSession = (sessionId) => gen(function* () {
 	forgetCommandAccessTokenCachesForSession(sessionId);
 });
 function forgetCommandAccessTokenCachesForSession(sessionId) {
-	cache$1.delete(sessionId);
+	cache.delete(sessionId);
 	jwtCache.delete(sessionId);
 	jwtExpiryCache.delete(sessionId);
 	refreshTokenCache.delete(sessionId);
@@ -77318,500 +77131,6 @@ const makeSocketProtocol = /* @__PURE__ */ gen(function* () {
 	};
 });
 //#endregion
-//#region src/codeGraph/aggregate.ts
-/**
-* Turning a 26 MB graph into slices small enough to draw.
-*
-* Pure functions over an already-parsed graph, deliberately free of Effect, the
-* filesystem and the RPC layer, so the interesting parts — capping, ranking,
-* hub suppression — are testable without a runtime or a fixture file on disk.
-*
-* The whole module exists because of one number: this repo's graph is 34,102
-* nodes and 86,347 edges. Nothing here ever returns more than a few hundred of
-* either. A view that tries to show everything shows nothing.
-*/
-function pushInto(map, key, link) {
-	const existing = map.get(key);
-	if (existing === void 0) {
-		map.set(key, [link]);
-		return;
-	}
-	existing.push(link);
-}
-function isKnownRelation(relation) {
-	return Object.hasOwn(CODE_GRAPH_RELATION_CLASS, relation);
-}
-/**
-* Index a parsed graph once so every later query is a map lookup.
-*
-* Edges naming a node the artifact does not define are dropped rather than
-* synthesised. Graphify does emit these — a call into a module outside the scan
-* root — and inventing a placeholder node for one would put a file in the map
-* that is not in the repository.
-*/
-function indexGraph(raw, repoLabel) {
-	const nodes = /* @__PURE__ */ new Map();
-	for (const node of raw.nodes) nodes.set(node.id, node);
-	const outbound = /* @__PURE__ */ new Map();
-	const inbound = /* @__PURE__ */ new Map();
-	const degree = /* @__PURE__ */ new Map();
-	const unknownRelations = /* @__PURE__ */ new Set();
-	let extractedEdgeCount = 0;
-	let inferredEdgeCount = 0;
-	let edgeCount = 0;
-	for (const link of raw.links) {
-		if (!nodes.has(link.source) || !nodes.has(link.target)) continue;
-		const relation = link.relation ?? "";
-		if (relation !== "" && !isKnownRelation(relation)) {
-			unknownRelations.add(relation);
-			continue;
-		}
-		edgeCount += 1;
-		if (link.confidence === "INFERRED") inferredEdgeCount += 1;
-		else extractedEdgeCount += 1;
-		pushInto(outbound, link.source, link);
-		pushInto(inbound, link.target, link);
-		degree.set(link.source, (degree.get(link.source) ?? 0) + 1);
-		degree.set(link.target, (degree.get(link.target) ?? 0) + 1);
-	}
-	return {
-		repoLabel,
-		builtAtCommit: raw.built_at_commit ?? null,
-		nodes,
-		outbound,
-		inbound,
-		degree,
-		edgeCount,
-		extractedEdgeCount,
-		inferredEdgeCount,
-		unknownRelations: [...unknownRelations].toSorted()
-	};
-}
-/**
-* Deterministic sunflower placement.
-*
-* A phyllotaxis spiral rather than a force simulation, for three reasons: it
-* needs no dependency, it is O(n), and — the one that actually matters — it is
-* *stable*. The same graph opens to the same picture every time, so the spatial
-* memory a person builds up survives closing the panel. A force layout reshuffles
-* on every mount and quietly costs them that.
-*
-* Index 0 lands nearest the centre, so ordering regions by size puts the
-* architectural core where the eye starts.
-*/
-function spiralPosition(index, total) {
-	const goldenAngle = Math.PI * (3 - Math.sqrt(5));
-	const radius = total <= 1 ? 0 : Math.sqrt(index / (total - 1));
-	const angle = index * goldenAngle;
-	return {
-		x: .5 + radius * Math.cos(angle) * .44,
-		y: .5 + radius * Math.sin(angle) * .44
-	};
-}
-/** Group nodes into their communities, and remember which community each is in. */
-function accumulateRegions(graph) {
-	const accumulators = /* @__PURE__ */ new Map();
-	const regionOfNode = /* @__PURE__ */ new Map();
-	for (const node of graph.nodes.values()) {
-		const community = node.community;
-		if (community === void 0) continue;
-		regionOfNode.set(node.id, community);
-		const existing = accumulators.get(community);
-		if (existing === void 0) {
-			accumulators.set(community, {
-				id: community,
-				label: node.community_name ?? `Region ${String(community)}`,
-				nodeCount: 1
-			});
-			continue;
-		}
-		existing.nodeCount += 1;
-	}
-	return {
-		ordered: [...accumulators.values()].toSorted((a, b) => b.nodeCount - a.nodeCount || a.id - b.id),
-		regionOfNode
-	};
-}
-/**
-* Collapse node-level edges into weighted links between drawn regions.
-*
-* Undirected: "these two areas talk" is the question at this altitude, and
-* drawing both arcs doubles the ink for no added meaning.
-*/
-function aggregateRegionLinks(graph, regionOfNode, shownIds) {
-	const linkWeights = /* @__PURE__ */ new Map();
-	for (const links of graph.outbound.values()) for (const link of links) {
-		const from = regionOfNode.get(link.source);
-		const to = regionOfNode.get(link.target);
-		if (from === void 0 || to === void 0 || from === to) continue;
-		if (!shownIds.has(from) || !shownIds.has(to)) continue;
-		const key = `${String(Math.min(from, to))}:${String(Math.max(from, to))}`;
-		linkWeights.set(key, (linkWeights.get(key) ?? 0) + 1);
-	}
-	return [...linkWeights.entries()].map(([key, weight]) => {
-		const [source, target] = key.split(":");
-		return {
-			source: Number(source),
-			target: Number(target),
-			weight
-		};
-	});
-}
-/**
-* The default view: the repository as named regions.
-*
-* Regions come from graphify's own community detection, and their names come
-* from the community's hub node — so a region is labelled `AIGateway.ts` or
-* `IStorage`, something a person recognises, rather than "Community 469".
-*/
-function buildSummary(graph) {
-	const { ordered, regionOfNode } = accumulateRegions(graph);
-	const shown = ordered.slice(0, 120);
-	const shownIds = new Set(shown.map((region) => region.id));
-	const regions = shown.map((region, index) => {
-		const position = spiralPosition(index, shown.length);
-		return {
-			id: region.id,
-			label: region.label,
-			nodeCount: region.nodeCount,
-			x: position.x,
-			y: position.y
-		};
-	});
-	return {
-		repoLabel: graph.repoLabel,
-		builtAtCommit: graph.builtAtCommit,
-		nodeCount: graph.nodes.size,
-		edgeCount: graph.edgeCount,
-		extractedEdgeCount: graph.extractedEdgeCount,
-		inferredEdgeCount: graph.inferredEdgeCount,
-		regionCount: ordered.length,
-		regions,
-		links: aggregateRegionLinks(graph, regionOfNode, shownIds),
-		truncatedRegions: Math.max(0, ordered.length - shown.length)
-	};
-}
-function summariseNode(graph, node) {
-	return {
-		id: node.id,
-		label: node.label ?? node.id,
-		kind: node._callable === true ? "symbol" : "file",
-		sourceFile: node.source_file ?? null,
-		sourceLocation: node.source_location ?? null,
-		regionId: node.community ?? null,
-		regionLabel: node.community_name ?? null,
-		degree: graph.degree.get(node.id) ?? 0
-	};
-}
-function toEdgeView(link) {
-	const relation = link.relation ?? "";
-	if (!isKnownRelation(relation)) return null;
-	const confidence = link.confidence === "INFERRED" ? "INFERRED" : "EXTRACTED";
-	return {
-		source: link.source,
-		target: link.target,
-		relation,
-		edgeClass: CODE_GRAPH_RELATION_CLASS[relation],
-		confidence,
-		confidenceScore: link.confidence_score ?? 1
-	};
-}
-/**
-* Pull one node's neighbours into the result; return how many it had to drop.
-*
-* Split out of `buildNeighborhood` because the two read differently: the caller
-* owns *how far to walk*, this owns *what one step collects*. Together they sat
-* well past the repo's cognitive-complexity gate.
-*/
-/** Links touching a node, most-connected neighbour first. */
-function rankNeighbourLinks(graph, current) {
-	return [...graph.outbound.get(current) ?? [], ...graph.inbound.get(current) ?? []].toSorted((a, b) => {
-		const aOther = a.source === current ? a.target : a.source;
-		const bOther = b.source === current ? b.target : b.source;
-		return (graph.degree.get(bOther) ?? 0) - (graph.degree.get(aOther) ?? 0);
-	});
-}
-/** Take a neighbour into the result. False means the budget is spent. */
-function admitNeighbour(state, id, node) {
-	if (state.included.has(id)) return true;
-	if (state.included.size >= 150) return false;
-	state.included.set(id, node);
-	state.next.push(id);
-	return true;
-}
-/** Record an edge once, dropping any relation this build cannot classify. */
-function recordEdge(state, link) {
-	const edgeKey = `${link.source}>${link.target}:${link.relation ?? ""}`;
-	if (state.seenEdges.has(edgeKey)) return;
-	const view = toEdgeView(link);
-	if (view === null) return;
-	state.seenEdges.add(edgeKey);
-	state.edges.push(view);
-}
-/**
-* Pull one node's neighbours into the result; return how many it had to drop.
-*
-* Split out of `buildNeighborhood` because the two read differently: the caller
-* owns *how far to walk*, this owns *what one step collects*.
-*/
-function expandNode(graph, current, state) {
-	let omitted = 0;
-	for (const link of rankNeighbourLinks(graph, current)) {
-		const other = link.source === current ? link.target : link.source;
-		const otherNode = graph.nodes.get(other);
-		if (otherNode === void 0) continue;
-		if (!admitNeighbour(state, other, otherNode)) {
-			omitted += 1;
-			continue;
-		}
-		recordEdge(state, link);
-	}
-	return omitted;
-}
-/**
-* One node and what surrounds it.
-*
-* Two caps, and they do different jobs. `CODE_GRAPH_MAX_NEIGHBORS` bounds the
-* answer so the canvas stays drawable. `CODE_GRAPH_MAX_FANOUT` bounds the
-* *traversal*: a hub is included as a neighbor but never expanded through, so
-* one `logger.ts` in the second ring cannot drag the entire repository in
-* behind it. Without the second cap the first one is reached instantly and the
-* result is 150 arbitrary nodes rather than the 150 nearest ones.
-*/
-function buildNeighborhood(graph, nodeId, requestedDepth) {
-	const root = graph.nodes.get(nodeId);
-	if (root === void 0) return null;
-	const depth = Math.min(Math.max(1, requestedDepth), 2);
-	const included = new Map([[root.id, root]]);
-	const seenEdges = /* @__PURE__ */ new Set();
-	const edges = [];
-	let omittedCount = 0;
-	let frontier = [root.id];
-	for (let level = 0; level < depth; level += 1) {
-		const next = [];
-		for (const current of frontier) {
-			const fanout = graph.degree.get(current) ?? 0;
-			if (current !== root.id && fanout > 200) continue;
-			omittedCount += expandNode(graph, current, {
-				included,
-				seenEdges,
-				edges,
-				next
-			});
-		}
-		frontier = next;
-		if (frontier.length === 0) break;
-	}
-	const nodes = [...included.values()].filter((node) => node.id !== root.id).map((node) => summariseNode(graph, node)).toSorted((a, b) => b.degree - a.degree || a.label.localeCompare(b.label));
-	return {
-		root: summariseNode(graph, root),
-		nodes,
-		edges: edges.filter((edge) => included.has(edge.source) && included.has(edge.target)),
-		depth,
-		truncated: omittedCount > 0,
-		omittedCount
-	};
-}
-/**
-* Rank one node against a query: lower is better, negative means no match.
-*
-* A file-path hit ranks last because "the query appears somewhere in this path"
-* is much weaker evidence than "this thing is called that".
-*/
-function matchScore(node, query) {
-	const label = (node.label ?? node.id).toLowerCase();
-	if (label === query) return 0;
-	if (label.startsWith(query)) return 1;
-	if (label.includes(query)) return 2;
-	return (node.source_file ?? "").toLowerCase().includes(query) ? 3 : -1;
-}
-/**
-* Find a node by name or path.
-*
-* Entry to this surface is search, not the canvas — you usually arrive already
-* knowing what you are looking for, and clicking around 34,000 nodes to find it
-* is not a workflow. Ranking is exact, then prefix, then substring, with degree
-* breaking ties so the `logger.ts` everything imports outranks a test fixture
-* that merely shares the word.
-*/
-function searchNodes(graph, rawQuery, limit = 40) {
-	const query = rawQuery.trim().toLowerCase();
-	if (query === "") return {
-		nodes: [],
-		truncated: false
-	};
-	const scored = [];
-	for (const node of graph.nodes.values()) {
-		const score = matchScore(node, query);
-		if (score < 0) continue;
-		scored.push({
-			node,
-			score
-		});
-	}
-	const ranked = scored.toSorted((a, b) => a.score - b.score || (graph.degree.get(b.node.id) ?? 0) - (graph.degree.get(a.node.id) ?? 0) || (a.node.label ?? a.node.id).localeCompare(b.node.label ?? b.node.id));
-	const capped = ranked.slice(0, limit);
-	return {
-		nodes: capped.map((entry) => summariseNode(graph, entry.node)),
-		truncated: ranked.length > capped.length
-	};
-}
-//#endregion
-//#region src/codeGraph/graphArtifact.ts
-/**
-* Reading `graphify-out/graph.json` off disk, once.
-*
-* The artifact is 26 MB here and 40 MB for CMMD's server tree, and parsing it
-* costs roughly a second. Every panel open would pay that again without a cache,
-* so one indexed graph is held per project and reused until the file changes.
-*
-* Kept free of Effect on purpose: the failure modes worth distinguishing are all
-* filesystem-shaped, and a plain promise keeps this unit-testable against real
-* fixtures without constructing a runtime. `ws.ts` wraps it at the boundary.
-*/
-const cache = /* @__PURE__ */ new Map();
-/** Git LFS writes a pointer file that is valid text and useless as a graph. */
-const LFS_POINTER_PREFIX = "version https://git-lfs.github.com/spec/v1";
-function codeGraphArtifactPath(cwd) {
-	return path.join(cwd, CODE_GRAPH_ARTIFACT_PATH);
-}
-function isRawGraph(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const candidate = value;
-	return Array.isArray(candidate.nodes) && Array.isArray(candidate.links);
-}
-/**
-* Load and index the graph for one project checkout.
-*
-* The LFS-pointer case is called out separately rather than folded into
-* "malformed" because it is the single most likely failure on a fresh clone —
-* the file is present, tracked, and 133 bytes of metadata. Telling someone their
-* graph is corrupt when they simply have not run `git lfs pull` sends them to
-* rebuild something that is fine.
-*/
-async function loadIndexedGraph(cwd) {
-	const artifactPath = codeGraphArtifactPath(cwd);
-	let stats;
-	try {
-		stats = await stat(artifactPath);
-	} catch {
-		return {
-			ok: false,
-			failure: {
-				kind: "missing",
-				artifactPath
-			}
-		};
-	}
-	if (!stats.isFile()) return {
-		ok: false,
-		failure: {
-			kind: "missing",
-			artifactPath
-		}
-	};
-	const cached = cache.get(artifactPath);
-	if (cached !== void 0 && cached.mtimeMs === stats.mtimeMs && cached.size === stats.size) return {
-		ok: true,
-		graph: cached.graph
-	};
-	let contents;
-	try {
-		contents = await readFile$1(artifactPath, "utf8");
-	} catch (error) {
-		return {
-			ok: false,
-			failure: {
-				kind: "unreadable",
-				artifactPath,
-				detail: error instanceof Error ? error.message : String(error)
-			}
-		};
-	}
-	if (contents.startsWith(LFS_POINTER_PREFIX)) return {
-		ok: false,
-		failure: {
-			kind: "lfs-pointer",
-			artifactPath
-		}
-	};
-	let parsed;
-	try {
-		parsed = JSON.parse(contents);
-	} catch (error) {
-		return {
-			ok: false,
-			failure: {
-				kind: "malformed",
-				artifactPath,
-				detail: error instanceof Error ? error.message : String(error)
-			}
-		};
-	}
-	if (!isRawGraph(parsed)) return {
-		ok: false,
-		failure: {
-			kind: "malformed",
-			artifactPath,
-			detail: "Expected an object with `nodes` and `links` arrays."
-		}
-	};
-	const graph = indexGraph(parsed, path.basename(cwd));
-	cache.set(artifactPath, {
-		mtimeMs: stats.mtimeMs,
-		size: stats.size,
-		graph
-	});
-	return {
-		ok: true,
-		graph
-	};
-}
-//#endregion
-//#region src/codeGraph/service.ts
-/**
-* The code-graph RPC surface, as Effects.
-*
-* A thin seam between `ws.ts` and the pure aggregator: load the artifact, turn
-* a filesystem failure into the tagged error the client can act on, and slice.
-*
-* The failure mapping is the substance here. Each reason produces different
-* advice — pull LFS, run the extractor, report a corrupt file — so collapsing
-* them into one "graph unavailable" would send people to fix the wrong thing.
-*/
-function toUnavailable(failure) {
-	switch (failure.kind) {
-		case "missing": return new CodeGraphUnavailableError({
-			reason: "missing",
-			message: `No code graph in this checkout. Run \`graphify update .\` to build ${failure.artifactPath}.`
-		});
-		case "lfs-pointer": return new CodeGraphUnavailableError({
-			reason: "lfs-pointer",
-			message: `The graph is a Git LFS pointer, not the graph itself. Run \`git lfs pull\` to fetch it.`
-		});
-		case "malformed": return new CodeGraphUnavailableError({
-			reason: "malformed",
-			message: `The graph file could not be parsed: ${failure.detail}`
-		});
-		case "unreadable": return new CodeGraphUnavailableError({
-			reason: "unreadable",
-			message: `The graph file could not be read: ${failure.detail}`
-		});
-	}
-}
-function withGraph(cwd, use) {
-	return flatMap(promise(() => loadIndexedGraph(cwd)), (result) => result.ok ? succeed(use(result.graph)) : fail(toUnavailable(result.failure)));
-}
-function readCodeGraphSummary(input) {
-	return withGraph(input.cwd, buildSummary);
-}
-function readCodeGraphNeighborhood(input) {
-	return flatMap(withGraph(input.cwd, (graph) => buildNeighborhood(graph, input.nodeId, input.depth ?? 1)), (neighborhood) => neighborhood === null ? fail(new CodeGraphNodeNotFoundError({ nodeId: input.nodeId })) : succeed(neighborhood));
-}
-function readCodeGraphSearch(input) {
-	return withGraph(input.cwd, (graph) => searchNodes(graph, input.query, input.limit ?? 40));
-}
-//#endregion
 //#region src/checkpointing/Services/CheckpointDiffQuery.ts
 /**
 * CheckpointDiffQuery - Service tag for checkpoint diff queries.
@@ -96683,6 +96002,7 @@ const registerCloudRuntimeForReplicaHydration = gen(function* () {
 			credentialEpoch,
 			activeTurnCount: 0,
 			activeSessionCount: 0,
+			acceptingTurns: false,
 			...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 			forgeServerVersion: installedForgeServerVersion
 		}),
@@ -96719,6 +96039,128 @@ const hydrateCloudRuntimeReplica = gen(function* () {
 	return yield* hydrateRuntimeReplica({ expectedRuntimeId: grant.runtimeId }, dependencies);
 });
 //#endregion
+//#region src/runtimeDrain/RuntimeDrainState.ts
+/**
+* The positive facts this process must observe before it can claim a turn.
+*
+* Every entry is required, so adding one here is the whole change: the
+* derivation below reads this list rather than naming fields, and the record
+* it indexes cannot be built with a member missing.
+*/
+const RUNTIME_EXECUTION_PRECONDITIONS = ["orchestrationEngine", "providerLayer"];
+/**
+* The single definition of the accepting-turns fact.
+*
+* Exported so test stubs of this service derive it exactly as the live state
+* does. A stub that recomputed it by hand could disagree with production and
+* still pass.
+*/
+function deriveAcceptingTurns(input) {
+	return RUNTIME_EXECUTION_PRECONDITIONS.every((precondition) => input.preconditions[precondition]) && !input.draining && !input.shutdownRequested;
+}
+const initialState = {
+	activeTurns: /* @__PURE__ */ new Set(),
+	activeTurnCount: 0,
+	activeSessionCount: 0,
+	draining: false,
+	drainReason: null,
+	drainTargetImageRef: null,
+	drainTargetImageVersion: null,
+	drainForceRequired: false,
+	preconditions: {
+		orchestrationEngine: false,
+		providerLayer: false
+	},
+	shutdownRequested: false
+};
+function snapshotFromState(state) {
+	return {
+		activeTurnCount: state.activeTurnCount,
+		activeSessionCount: state.activeSessionCount,
+		draining: state.draining,
+		drainReason: state.drainReason,
+		drainTargetImageRef: state.drainTargetImageRef,
+		drainTargetImageVersion: state.drainTargetImageVersion,
+		drainForceRequired: state.drainForceRequired,
+		acceptingTurns: deriveAcceptingTurns(state)
+	};
+}
+function turnKey(input) {
+	return `${input.threadId}:${input.turnId ?? "unknown"}`;
+}
+function normalizeCount(count) {
+	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
+}
+const makeRuntimeDrainState = gen(function* () {
+	const stateRef = yield* make$50(initialState);
+	const update = (f) => updateAndGet(stateRef, f).pipe(map$3(snapshotFromState));
+	return {
+		beginTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.add(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		completeTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.delete(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		clearActiveTurns: update((state) => ({
+			...state,
+			activeTurns: /* @__PURE__ */ new Set(),
+			activeTurnCount: 0
+		})),
+		setActiveSessionCount: (count) => update((state) => ({
+			...state,
+			activeSessionCount: normalizeCount(count)
+		})),
+		reconcileProviderSessions: (sessions) => update((state) => {
+			const activeSessions = sessions.filter((session) => session.status !== "closed");
+			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
+				threadId: session.threadId,
+				turnId: session.activeTurnId
+			})]));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size,
+				activeSessionCount: activeSessions.length
+			};
+		}),
+		applyControlPlaneState: (input) => update((state) => ({
+			...state,
+			draining: input.draining ?? state.draining,
+			drainReason: input.drainReason ?? state.drainReason,
+			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
+			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
+			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
+		})),
+		markExecutionPrecondition: (precondition) => update((state) => ({
+			...state,
+			preconditions: {
+				...state.preconditions,
+				[precondition]: true
+			}
+		})),
+		requestShutdown: update((state) => ({
+			...state,
+			shutdownRequested: true
+		})),
+		snapshot: get$6(stateRef).pipe(map$3(snapshotFromState)),
+		isDraining: get$6(stateRef).pipe(map$3((state) => state.draining))
+	};
+});
+var RuntimeDrainState = class extends Service$1()("forge/runtimeDrain/RuntimeDrainState") {};
+const RuntimeDrainStateLive = effect(RuntimeDrainState, makeRuntimeDrainState);
+//#endregion
 //#region src/persistence/Services/LocalAutomations.ts
 const LocalAutomationStatus = Literals([
 	"active",
@@ -100352,6 +99794,30 @@ const makeCommandGate = gen(function* () {
 		})
 	};
 });
+/**
+* Settle the command gate for a finished startup, and report whether commands
+* are now accepted.
+*
+* The success branch is the moment the orchestration engine can take work, so
+* it is where the engine half of the accepting-turns fact is marked. A failed
+* startup accepts nothing and must leave the fact untouched: absent must not
+* read as healthy.
+*/
+const settleCommandReadiness = (input) => gen(function* () {
+	if (isFailure(input.startupExit)) {
+		const error = new ServerRuntimeStartupError({
+			message: startupFailureMessage(input.startupExit.cause),
+			cause: input.startupExit.cause
+		});
+		yield* logError("server runtime startup failed", { cause: describeStartupFailure(input.startupExit.cause) });
+		yield* input.commandGate.failCommandReady(error);
+		return false;
+	}
+	yield* logDebug("Accepting commands");
+	yield* input.commandGate.signalCommandReady;
+	yield* input.drainState.markExecutionPrecondition("orchestrationEngine");
+	return true;
+});
 const launchStartupHeartbeat = gen(function* () {
 	const analytics = yield* AnalyticsService;
 	const { threadCount, projectCount } = yield* (yield* ProjectionSnapshotQuery).getCounts().pipe(catch_((cause) => logWarning$1("failed to gather startup projection counts for telemetry", { cause }).pipe(as$3({
@@ -100532,6 +99998,7 @@ const ServerRuntimeStartupLive = effect(ServerRuntimeStartup, gen(function* () {
 	const serverSettings = yield* ServerSettingsService;
 	const serverEnvironment = yield* ServerEnvironment;
 	const usage = yield* UsageService;
+	const drainState = yield* RuntimeDrainState;
 	const commandGate = yield* makeCommandGate;
 	const httpListening = yield* make$39();
 	const reactorScope = yield* make$37("sequential");
@@ -100614,18 +100081,11 @@ const ServerRuntimeStartupLive = effect(ServerRuntimeStartup, gen(function* () {
 		root: true
 	}));
 	yield* forkScoped(gen(function* () {
-		const startupExit = yield* exit(startup);
-		if (isFailure(startupExit)) {
-			const error = new ServerRuntimeStartupError({
-				message: startupFailureMessage(startupExit.cause),
-				cause: startupExit.cause
-			});
-			yield* logError("server runtime startup failed", { cause: describeStartupFailure(startupExit.cause) });
-			yield* commandGate.failCommandReady(error);
-			return;
-		}
-		yield* logDebug("Accepting commands");
-		yield* commandGate.signalCommandReady;
+		if (!(yield* settleCommandReadiness({
+			startupExit: yield* exit(startup),
+			commandGate,
+			drainState
+		}))) return;
 		yield* logDebug("startup phase: starting the usage scan warm-up");
 		yield* forkScoped(runUsageScanWarmup({ readSummary: usage.readSummary }));
 		yield* logDebug("startup phase: waiting for http listener");
@@ -107173,9 +106633,6 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 		}))), { "rpc.aggregate": "workspace" }),
 		[WS_METHODS.serverDiscoverSourceControl]: () => observeRpcEffect(WS_METHODS.serverDiscoverSourceControl, discoverSourceControl, { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverReportClientActivity]: () => observeRpcEffect(WS_METHODS.serverReportClientActivity, void_$1, { "rpc.aggregate": "server" }),
-		[WS_METHODS.codeGraphSummary]: (input) => observeRpcEffect(WS_METHODS.codeGraphSummary, readCodeGraphSummary(input), { "rpc.aggregate": "codeGraph" }),
-		[WS_METHODS.codeGraphNeighborhood]: (input) => observeRpcEffect(WS_METHODS.codeGraphNeighborhood, readCodeGraphNeighborhood(input), { "rpc.aggregate": "codeGraph" }),
-		[WS_METHODS.codeGraphSearch]: (input) => observeRpcEffect(WS_METHODS.codeGraphSearch, readCodeGraphSearch(input), { "rpc.aggregate": "codeGraph" }),
 		[WS_METHODS.projectsWriteFile]: (input) => observeRpcEffect(WS_METHODS.projectsWriteFile, workspaceFileSystem.writeFile(input).pipe(mapError((cause) => {
 			return new ProjectWriteFileError({
 				message: is$1(WorkspacePathOutsideRootError)(cause) ? "Workspace file path must stay within the project root." : "Failed to write workspace file",
@@ -153208,7 +152665,9 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 	scheduleProviderEgressTokenRefresh(context, delayMs) {
 		if (context.tokenRefreshTimer) clearTimeout(context.tokenRefreshTimer);
 		const tokenRefreshTimer = setTimeout(() => {
-			this.handleProviderEgressTokenRefresh(context.session.threadId).catch(() => void 0);
+			this.handleProviderEgressTokenRefresh(context.session.threadId).catch((error) => {
+				this.emitErrorEvent(context, "session/tokenRefreshFailed", error instanceof Error ? error.message : String(error));
+			});
 		}, delayMs);
 		tokenRefreshTimer.unref?.();
 		context.tokenRefreshTimer = tokenRefreshTimer;
@@ -290471,93 +289930,6 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	return "refreshed";
 }
 //#endregion
-//#region src/runtimeDrain/RuntimeDrainState.ts
-const initialState = {
-	activeTurns: /* @__PURE__ */ new Set(),
-	activeTurnCount: 0,
-	activeSessionCount: 0,
-	draining: false,
-	drainReason: null,
-	drainTargetImageRef: null,
-	drainTargetImageVersion: null,
-	drainForceRequired: false
-};
-function snapshotFromState(state) {
-	return {
-		activeTurnCount: state.activeTurnCount,
-		activeSessionCount: state.activeSessionCount,
-		draining: state.draining,
-		drainReason: state.drainReason,
-		drainTargetImageRef: state.drainTargetImageRef,
-		drainTargetImageVersion: state.drainTargetImageVersion,
-		drainForceRequired: state.drainForceRequired
-	};
-}
-function turnKey(input) {
-	return `${input.threadId}:${input.turnId ?? "unknown"}`;
-}
-function normalizeCount(count) {
-	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
-}
-const makeRuntimeDrainState = gen(function* () {
-	const stateRef = yield* make$50(initialState);
-	const update = (f) => updateAndGet(stateRef, f).pipe(map$3(snapshotFromState));
-	return {
-		beginTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.add(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		completeTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.delete(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		clearActiveTurns: update((state) => ({
-			...state,
-			activeTurns: /* @__PURE__ */ new Set(),
-			activeTurnCount: 0
-		})),
-		setActiveSessionCount: (count) => update((state) => ({
-			...state,
-			activeSessionCount: normalizeCount(count)
-		})),
-		reconcileProviderSessions: (sessions) => update((state) => {
-			const activeSessions = sessions.filter((session) => session.status !== "closed");
-			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
-				threadId: session.threadId,
-				turnId: session.activeTurnId
-			})]));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size,
-				activeSessionCount: activeSessions.length
-			};
-		}),
-		applyControlPlaneState: (input) => update((state) => ({
-			...state,
-			draining: input.draining ?? state.draining,
-			drainReason: input.drainReason ?? state.drainReason,
-			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
-			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
-			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
-		})),
-		snapshot: get$6(stateRef).pipe(map$3(snapshotFromState)),
-		isDraining: get$6(stateRef).pipe(map$3((state) => state.draining))
-	};
-});
-var RuntimeDrainState = class extends Service$1()("forge/runtimeDrain/RuntimeDrainState") {};
-const RuntimeDrainStateLive = effect(RuntimeDrainState, makeRuntimeDrainState);
-//#endregion
 //#region src/runtimeDrain/RuntimeDrainReporter.ts
 const HEARTBEAT_INTERVAL = seconds(30);
 const HEARTBEAT_TICK_TIMEOUT = seconds(60);
@@ -290615,6 +289987,7 @@ const postRuntimeHeartbeat = (config, snapshot) => promise(async () => {
 		...config,
 		activeTurnCount: snapshot.activeTurnCount,
 		activeSessionCount: snapshot.activeSessionCount,
+		acceptingTurns: snapshot.acceptingTurns,
 		...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 		forgeServerVersion: installedForgeServerVersion
 	});
@@ -290723,6 +290096,7 @@ const makeRuntimeDrainReporter = gen(function* () {
 				work: reportOnce,
 				interval: HEARTBEAT_INTERVAL
 			}));
+			yield* addFinalizer$2(() => drainState.requestShutdown);
 		})
 	};
 });
@@ -290933,6 +290307,7 @@ function decodeCodexRateLimitWindows(raw) {
 function publicProviderRuntimeError(message) {
 	return sanitizePublicProviderText(message, { fallback: DEFAULT_PUBLIC_PROVIDER_ERROR });
 }
+const processDomainEvent = (_event) => void_$1;
 function isAssistantTextDeltaEvent(event) {
 	return event.type === "content.delta" && event.payload.streamKind === "assistant_text";
 }
@@ -291726,7 +291101,6 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 			yield* runtimeDrainReporter.reportOnce;
 		}
 	});
-	const processDomainEvent = (_event) => void_$1;
 	const processInput = (input) => input.source === "runtime" ? processRuntimeEvent(input.event) : processDomainEvent(input.event);
 	const processInputSafely = (input) => processInput(input).pipe(catchCause((cause) => {
 		if (hasInterruptsOnly(cause)) return failCause$1(cause);
@@ -291777,6 +291151,7 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	return {
 		start: fn$1("start")(function* () {
 			yield* reconcileOrphanedRunningSessions();
+			yield* runtimeDrainState.markExecutionPrecondition("providerLayer");
 			yield* runtimeDrainReporter.start;
 			yield* forkScoped(runForEach(providerService.streamEvents, (event) => enqueueInput({
 				source: "runtime",
@@ -292015,6 +291390,8 @@ const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
+const isProviderValidationError = is$1(ProviderValidationError);
+const isProviderKind = is$1(ProviderKind);
 function isPathInsideRoot(candidatePath, rootPath) {
 	let resolvedCandidate;
 	let resolvedRoot;
@@ -292051,6 +291428,38 @@ function resolveExistingWorkspaceCwd(input) {
 function publicProviderFailureDetail(detail) {
 	return sanitizePublicProviderText(detail, { fallback: "CMMD is temporarily unavailable. Check the workspace AI connection and retry." }) ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
 }
+/**
+* The failure detail a transcript shows, judged on the text and not the envelope.
+*
+* Forge writes its own validation copy, so `ProviderValidationError.issue` is
+* not raw provider output. Every envelope around it hides it, each in its own
+* way: `Cause.pretty` prints the error tag, and the sanitizer counts
+* "ProviderValidationError" as a provider leak, so a validation failure
+* rendered through `Cause.pretty` tripped the guard on its own wrapper. The
+* `message` getter spells the same tag out in prose. On 2026-09-16 the first of
+* those replaced "Reconnect the account and try again" with "CMMD is
+* temporarily unavailable" (#3337).
+*
+* The issue still goes through the sanitizer. `ProviderService` builds some
+* issues from a schema formatter, which echoes the decoded payload, so this is a
+* narrower input to the same guard rather than a way around it.
+*/
+function publicProviderFailureDetailFromError(error) {
+	if (isProviderValidationError(error)) return publicProviderFailureDetail(error.issue);
+	return publicProviderFailureDetail(error instanceof Error ? error.message : String(error));
+}
+/**
+* The same judgement for a failure that arrives as a cause.
+*
+* Only the validation branch delegates. A cause carries what a bare error does
+* not: defects, interrupts, and more than one failure, all of which
+* `Cause.pretty` renders and `.message` would drop. Squashing every failure into
+* its message to reach one shared line would lose that.
+*/
+function publicProviderFailureDetailFromCause(cause) {
+	const error = squash(cause);
+	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(pretty(cause));
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -292206,7 +291615,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* die$1(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
 		const desiredRuntimeMode = thread.runtimeMode;
-		const currentProvider = thread.session?.status !== "stopped" && is$1(ProviderKind)(thread.session?.providerName) ? thread.session.providerName : void 0;
+		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const rawRequestedModelSelection = options?.modelSelection;
 		const threadProvider = currentProvider ?? thread.modelSelection.provider;
 		const isStaleRequestedProvider = rawRequestedModelSelection !== void 0 && rawRequestedModelSelection.provider !== threadProvider;
@@ -292584,7 +291993,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start failed",
-			detail: publicProviderFailureDetail(pretty(cause)),
+			detail: publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
@@ -292600,7 +292009,14 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			turnId: event.payload.turnId ?? null,
 			createdAt: event.payload.createdAt
 		});
-		yield* providerService.interruptTurn({ threadId: event.payload.threadId });
+		yield* providerService.interruptTurn({ threadId: event.payload.threadId }).pipe(catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.turn.interrupt.failed",
+			summary: "Provider turn interrupt failed",
+			detail: publicProviderFailureDetail(pretty(cause)),
+			turnId: event.payload.turnId ?? null,
+			createdAt: event.payload.createdAt
+		})));
 	});
 	const processApprovalResponseRequested = fn$1("processApprovalResponseRequested")(function* (event) {
 		const staged = peekThreadContinuationSession(event.commandId);
@@ -292637,7 +292053,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				threadId: event.payload.threadId,
 				kind: "provider.approval.respond.failed",
 				summary: "Provider approval response failed",
-				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetail(pretty(cause)),
+				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 				turnId: null,
 				createdAt: event.payload.createdAt,
 				requestId: event.payload.requestId
@@ -292680,7 +292096,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.user-input.respond.failed",
 			summary: "Provider user input response failed",
-			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetail(pretty(cause)),
+			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: event.payload.createdAt,
 			requestId: event.payload.requestId
@@ -292693,8 +292109,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		yield* providerService.stopSession({
 			threadId: thread.id,
 			...event.payload.preserveResumeState === true ? { preserveResumeState: true } : {}
-		});
-		yield* setThreadSession({
+		}).pipe(tap(() => setThreadSession({
 			threadId: thread.id,
 			session: {
 				threadId: thread.id,
@@ -292706,7 +292121,14 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				updatedAt: now
 			},
 			createdAt: now
-		});
+		})), catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.session.stop.failed",
+			summary: "Provider session stop failed",
+			detail: publicProviderFailureDetail(pretty(cause)),
+			turnId: null,
+			createdAt: now
+		})));
 	});
 	const processDomainEvent = fn$1("processDomainEvent")(function* (event) {
 		yield* annotateCurrentSpan({
@@ -292801,7 +292223,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start cleanup failed",
-			detail: publicProviderFailureDetail(cause instanceof Error ? cause.message : String(cause)),
+			detail: publicProviderFailureDetailFromError(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})
@@ -298221,7 +297643,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "78b0e072680ed734c4eb8337a6d38c87e7e34393";
+	return "60c000d9c894e2ef04f90b602ddc8eb49c84980a";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -321588,7 +321010,7 @@ const PlatformServicesLive = unwrap(gen(function* () {
 }));
 const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(provideMerge(RuntimeReplicationClientLive), provideMerge(RuntimeReplicationOutboxLive), provideMerge(ActiveHourMeterLive.pipe(provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(provideMerge(RuntimeDrainStateLive));
-const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive), provide$1(ClaudeUsageTelemetryLive));
+const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive), provideMerge(RuntimeDrainStateLive), provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(provideMerge(PipelineRunClientLive));
 const AgentProtocolReactorLayerLive = AgentProtocolReactorLive.pipe(provideMerge(PipelineRunStoreLive));
 const PipelineRunCoordinatorLayerLive = PipelineRunCoordinatorLive.pipe(provideMerge(PipelineProviderAuthorityInstallerLive), provideMerge(PipelineChangeInspectorLive), provideMerge(PipelineContextArtifactStoreLive), provideMerge(PipelineModelPolicyLive), provideMerge(PipelineRunClientLive), provideMerge(PipelineRunStoreLive), provideMerge(PipelineRunWorkspaceAllocatorLive), provideMerge(PipelineStagePolicyLive), provideMerge(PipelineWorkerCoordinatorLayerLive));