@cmmd-center/forge 0.13.95 → 0.13.97

package/dist/bin.cjs

@@ -6,7 +6,7 @@ const require_Schema$1 = require("./Schema-DxddW8-V.cjs");
 const require_Path = require("./Path-Dp3btyUm.cjs");
 const require_NodeTerminal = require("./NodeTerminal-DQESKR0W.cjs");
 const require_NodeServices = require("./NodeServices-BkfWZHfh.cjs");
-const require_HttpServer = require("./HttpServer-DZ6iaxyk.cjs");
+const require_HttpServer = require("./HttpServer-CRBqMWdP.cjs");
 const require_Config = require("./Config-pbf0GGHJ.cjs");
 const require_Cache = require("./Cache-D-JaJz5Q.cjs");
 const require_SqlError = require("./SqlError-BqOsoG0V.cjs");
@@ -14765,7 +14765,7 @@ const isCommand = (u) => require_Schema$1.hasProperty(u, TypeId$10);
 * @since 4.0.0
 * @category constructors
 */
-const make$34 = (name, config, handler) => {
+const make$33 = (name, config, handler) => {
 	return makeCommand({
 		name,
 		config: parseConfig(config ?? {}),
@@ -15282,7 +15282,7 @@ require_Schema$1.LogToStderr;
 * @since 2.0.0
 * @category constructors
 */
-const make$33 = require_Schema$1.loggerMake;
+const make$32 = require_Schema$1.loggerMake;
 require_Schema$1.defaultLogger;
 require_Schema$1.formatJson;
 /**
@@ -15580,7 +15580,7 @@ const makeUnsafe$2 = (value) => {
 * @since 2.0.0
 * @category constructors
 */
-const make$32 = (value) => require_Schema$1.sync(() => makeUnsafe$2(value));
+const make$31 = (value) => require_Schema$1.sync(() => makeUnsafe$2(value));
 /**
 * @since 2.0.0
 * @category getters
@@ -15650,7 +15650,7 @@ const TypeId$8 = "~effect/transactions/TxRef";
 * })
 * ```
 */
-const make$31 = (initial) => require_Schema$1.sync(() => makeUnsafe$1(initial));
+const make$30 = (initial) => require_Schema$1.sync(() => makeUnsafe$1(initial));
 /**
 * Creates a new `TxRef` with the specified initial value.
 *
@@ -15833,7 +15833,7 @@ const TxChunkProto = {
 * })
 * ```
 */
-const empty = () => require_Schema$1.map(make$31(require_Schema$1.empty()), (ref) => makeUnsafe(ref));
+const empty = () => require_Schema$1.map(make$30(require_Schema$1.empty()), (ref) => makeUnsafe(ref));
 /**
 * Creates a new `TxChunk` with the specified TxRef.
 *
@@ -16125,7 +16125,7 @@ const TxQueueProto = {
 */
 const unbounded = () => require_Schema$1.gen(function* () {
 	const items = yield* empty();
-	const stateRef = yield* make$31({ _tag: "Open" });
+	const stateRef = yield* make$30({ _tag: "Open" });
 	const txQueue = Object.create(TxQueueProto);
 	txQueue.strategy = "unbounded";
 	txQueue.capacity = Number.POSITIVE_INFINITY;
@@ -25470,7 +25470,7 @@ const makeProto$1 = (options) => {
 * @since 4.0.0
 * @category constructors
 */
-const make$30 = (tag, options) => {
+const make$29 = (tag, options) => {
 	const successSchema = options?.success ?? require_Schema$1.Void;
 	const errorSchema = options?.error ?? require_Schema$1.Never;
 	const defectSchema = options?.defect ?? require_Schema$1.Defect;
@@ -25642,7 +25642,7 @@ const makeProto = (options) => Object.assign(function() {}, RpcGroupProto, {
 * @since 4.0.0
 * @category groups
 */
-const make$29 = (...rpcs) => makeProto({
+const make$28 = (...rpcs) => makeProto({
 	requests: new Map(rpcs.map((rpc) => [rpc._tag, rpc])),
 	annotations: require_Schema$1.empty$4()
 });
@@ -26374,319 +26374,319 @@ const WS_METHODS = {
 	attachmentsDelete: "attachments.delete",
 	providerUploadFeedback: "provider.uploadFeedback"
 };
-const WsServerUpsertKeybindingRpc = make$30(WS_METHODS.serverUpsertKeybinding, {
+const WsServerUpsertKeybindingRpc = make$29(WS_METHODS.serverUpsertKeybinding, {
 	payload: ServerUpsertKeybindingInput,
 	success: ServerUpsertKeybindingResult,
 	error: KeybindingsConfigError
 });
-const WsServerRemoveKeybindingRpc = make$30(WS_METHODS.serverRemoveKeybinding, {
+const WsServerRemoveKeybindingRpc = make$29(WS_METHODS.serverRemoveKeybinding, {
 	payload: ServerRemoveKeybindingInput,
 	success: ServerRemoveKeybindingResult,
 	error: KeybindingsConfigError
 });
-const WsServerGetConfigRpc = make$30(WS_METHODS.serverGetConfig, {
+const WsServerGetConfigRpc = make$29(WS_METHODS.serverGetConfig, {
 	payload: require_Schema$1.Struct({}),
 	success: ServerConfig$1,
 	error: require_Schema$1.Union([KeybindingsConfigError, ServerSettingsError])
 });
-const WsServerRefreshProvidersRpc = make$30(WS_METHODS.serverRefreshProviders, {
+const WsServerRefreshProvidersRpc = make$29(WS_METHODS.serverRefreshProviders, {
 	payload: require_Schema$1.Struct({}),
 	success: ServerProviderUpdatedPayload
 });
-const WsServerStartProviderAuthRpc = make$30(WS_METHODS.serverStartProviderAuth, {
+const WsServerStartProviderAuthRpc = make$29(WS_METHODS.serverStartProviderAuth, {
 	payload: ProviderAuthStartInput,
 	success: ProviderAuthSession
 });
-const WsServerRepairProviderAuthRuntimeRpc = make$30(WS_METHODS.serverRepairProviderAuthRuntime, {
+const WsServerRepairProviderAuthRuntimeRpc = make$29(WS_METHODS.serverRepairProviderAuthRuntime, {
 	payload: ProviderAuthRuntimeRepairInput,
 	success: ProviderAuthRuntimeRepairResult
 });
-const WsServerDisconnectProviderAuthRpc = make$30(WS_METHODS.serverDisconnectProviderAuth, {
+const WsServerDisconnectProviderAuthRpc = make$29(WS_METHODS.serverDisconnectProviderAuth, {
 	payload: ProviderAuthDisconnectInput,
 	success: ServerProviderUpdatedPayload
 });
-const WsServerGetProviderAuthSessionRpc = make$30(WS_METHODS.serverGetProviderAuthSession, {
+const WsServerGetProviderAuthSessionRpc = make$29(WS_METHODS.serverGetProviderAuthSession, {
 	payload: ProviderAuthSessionInput,
 	success: ProviderAuthSession
 });
-const WsServerCancelProviderAuthRpc = make$30(WS_METHODS.serverCancelProviderAuth, {
+const WsServerCancelProviderAuthRpc = make$29(WS_METHODS.serverCancelProviderAuth, {
 	payload: ProviderAuthSessionInput,
 	success: ProviderAuthSession
 });
-const WsServerSubmitProviderAuthCodeRpc = make$30(WS_METHODS.serverSubmitProviderAuthCode, {
+const WsServerSubmitProviderAuthCodeRpc = make$29(WS_METHODS.serverSubmitProviderAuthCode, {
 	payload: ProviderAuthSubmitCodeInput,
 	success: ProviderAuthSession
 });
-const WsServerSyncPersonalCodexToCloudRpc = make$30(WS_METHODS.serverSyncPersonalCodexToCloud, {
+const WsServerSyncPersonalCodexToCloudRpc = make$29(WS_METHODS.serverSyncPersonalCodexToCloud, {
 	payload: ProviderCredentialCloudSyncInput,
 	success: ProviderCredentialCloudSyncResult
 });
-const WsServerSyncPersonalClaudeToCloudRpc = make$30(WS_METHODS.serverSyncPersonalClaudeToCloud, {
+const WsServerSyncPersonalClaudeToCloudRpc = make$29(WS_METHODS.serverSyncPersonalClaudeToCloud, {
 	payload: ProviderCredentialCloudSyncInput,
 	success: ProviderCredentialCloudSyncResult
 });
-const WsServerGetSettingsRpc = make$30(WS_METHODS.serverGetSettings, {
+const WsServerGetSettingsRpc = make$29(WS_METHODS.serverGetSettings, {
 	payload: require_Schema$1.Struct({}),
 	success: ServerSettings,
 	error: ServerSettingsError
 });
-const WsServerUpdateSettingsRpc = make$30(WS_METHODS.serverUpdateSettings, {
+const WsServerUpdateSettingsRpc = make$29(WS_METHODS.serverUpdateSettings, {
 	payload: require_Schema$1.Struct({ patch: ServerSettingsPatch }),
 	success: ServerSettings,
 	error: ServerSettingsError
 });
-const WsServerUpdateEnvironmentDisplayNameRpc = make$30(WS_METHODS.serverUpdateEnvironmentDisplayName, {
+const WsServerUpdateEnvironmentDisplayNameRpc = make$29(WS_METHODS.serverUpdateEnvironmentDisplayName, {
 	payload: ServerEnvironmentDisplayNameUpdateInput,
 	success: ServerEnvironmentDisplayNameUpdateResult
 });
-const WsServerTraceDiagnosticsRpc = make$30(WS_METHODS.serverGetTraceDiagnostics, {
+const WsServerTraceDiagnosticsRpc = make$29(WS_METHODS.serverGetTraceDiagnostics, {
 	payload: require_Schema$1.Struct({ slowSpanThresholdMs: require_Schema$1.optionalKey(NonNegativeInt) }),
 	success: ServerTraceDiagnosticsResult
 });
-const WsServerHeartbeatRpc = make$30(WS_METHODS.serverHeartbeat, {
+const WsServerHeartbeatRpc = make$29(WS_METHODS.serverHeartbeat, {
 	payload: require_Schema$1.Struct({}),
 	success: require_Schema$1.Struct({})
 });
 const PullRequestRpcError = require_Schema$1.Union([PullRequestUnavailableError, PullRequestOperationError]);
-const WsPullRequestsListRpc = make$30(WS_METHODS.pullRequestsList, {
+const WsPullRequestsListRpc = make$29(WS_METHODS.pullRequestsList, {
 	payload: PullRequestListInput,
 	success: PullRequestListResult,
 	error: PullRequestRpcError
 });
-const WsPullRequestsListStatsRpc = make$30(WS_METHODS.pullRequestsListStats, {
+const WsPullRequestsListStatsRpc = make$29(WS_METHODS.pullRequestsListStats, {
 	payload: PullRequestListStatsInput,
 	success: PullRequestListStatsResult,
 	error: PullRequestRpcError
 });
-const WsPullRequestsDetailRpc = make$30(WS_METHODS.pullRequestsDetail, {
+const WsPullRequestsDetailRpc = make$29(WS_METHODS.pullRequestsDetail, {
 	payload: PullRequestRef,
 	success: PullRequestDetail,
 	error: PullRequestRpcError
 });
-const WsPullRequestsActivityRpc = make$30(WS_METHODS.pullRequestsActivity, {
+const WsPullRequestsActivityRpc = make$29(WS_METHODS.pullRequestsActivity, {
 	payload: PullRequestRef,
 	success: PullRequestActivity,
 	error: PullRequestRpcError
 });
-const WsPullRequestsThreadCommentsRpc = make$30(WS_METHODS.pullRequestsThreadComments, {
+const WsPullRequestsThreadCommentsRpc = make$29(WS_METHODS.pullRequestsThreadComments, {
 	payload: PullRequestThreadCommentsInput,
 	success: PullRequestThreadCommentsResult,
 	error: PullRequestRpcError
 });
-const WsPullRequestsDiffFileContentsRpc = make$30(WS_METHODS.pullRequestsDiffFileContents, {
+const WsPullRequestsDiffFileContentsRpc = make$29(WS_METHODS.pullRequestsDiffFileContents, {
 	payload: PullRequestDiffFileContentsInput,
 	success: PullRequestDiffFileContentsResult,
 	error: PullRequestRpcError
 });
-const WsPullRequestsRunActionRpc = make$30(WS_METHODS.pullRequestsRunAction, {
+const WsPullRequestsRunActionRpc = make$29(WS_METHODS.pullRequestsRunAction, {
 	payload: PullRequestActionInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsUpdateRpc = make$30(WS_METHODS.pullRequestsUpdate, {
+const WsPullRequestsUpdateRpc = make$29(WS_METHODS.pullRequestsUpdate, {
 	payload: PullRequestUpdateInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsCommentRpc = make$30(WS_METHODS.pullRequestsComment, {
+const WsPullRequestsCommentRpc = make$29(WS_METHODS.pullRequestsComment, {
 	payload: PullRequestCommentInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsUpdateCommentRpc = make$30(WS_METHODS.pullRequestsUpdateComment, {
+const WsPullRequestsUpdateCommentRpc = make$29(WS_METHODS.pullRequestsUpdateComment, {
 	payload: PullRequestCommentUpdateInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsSubmitReviewRpc = make$30(WS_METHODS.pullRequestsSubmitReview, {
+const WsPullRequestsSubmitReviewRpc = make$29(WS_METHODS.pullRequestsSubmitReview, {
 	payload: PullRequestSubmitReviewInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsReplyToThreadRpc = make$30(WS_METHODS.pullRequestsReplyToThread, {
+const WsPullRequestsReplyToThreadRpc = make$29(WS_METHODS.pullRequestsReplyToThread, {
 	payload: PullRequestThreadReplyInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsSetThreadResolutionRpc = make$30(WS_METHODS.pullRequestsSetThreadResolution, {
+const WsPullRequestsSetThreadResolutionRpc = make$29(WS_METHODS.pullRequestsSetThreadResolution, {
 	payload: PullRequestThreadResolutionInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsSetReactionRpc = make$30(WS_METHODS.pullRequestsSetReaction, {
+const WsPullRequestsSetReactionRpc = make$29(WS_METHODS.pullRequestsSetReaction, {
 	payload: PullRequestReactionInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsInvalidateRpc = make$30(WS_METHODS.pullRequestsInvalidate, {
+const WsPullRequestsInvalidateRpc = make$29(WS_METHODS.pullRequestsInvalidate, {
 	payload: PullRequestInvalidateInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsPullRequestsReviewerCandidatesRpc = make$30(WS_METHODS.pullRequestsReviewerCandidates, {
+const WsPullRequestsReviewerCandidatesRpc = make$29(WS_METHODS.pullRequestsReviewerCandidates, {
 	payload: PullRequestRef,
 	success: PullRequestReviewerCandidateList,
 	error: PullRequestRpcError
 });
-const WsPullRequestsRequestReviewersRpc = make$30(WS_METHODS.pullRequestsRequestReviewers, {
+const WsPullRequestsRequestReviewersRpc = make$29(WS_METHODS.pullRequestsRequestReviewers, {
 	payload: PullRequestReviewerRequestInput,
 	success: require_Schema$1.Void,
 	error: PullRequestRpcError
 });
-const WsProjectsSearchContentsRpc = make$30(WS_METHODS.projectsSearchContents, {
+const WsProjectsSearchContentsRpc = make$29(WS_METHODS.projectsSearchContents, {
 	payload: ProjectSearchContentsInput,
 	success: ProjectSearchContentsResult,
 	error: ProjectSearchContentsError
 });
-const WsProjectsSearchEntriesRpc = make$30(WS_METHODS.projectsSearchEntries, {
+const WsProjectsSearchEntriesRpc = make$29(WS_METHODS.projectsSearchEntries, {
 	payload: ProjectSearchEntriesInput,
 	success: ProjectSearchEntriesResult,
 	error: ProjectSearchEntriesError
 });
-const WsProjectsWriteFileRpc = make$30(WS_METHODS.projectsWriteFile, {
+const WsProjectsWriteFileRpc = make$29(WS_METHODS.projectsWriteFile, {
 	payload: ProjectWriteFileInput,
 	success: ProjectWriteFileResult,
 	error: ProjectWriteFileError
 });
-const WsProjectCheckoutDeletionPreviewRpc = make$30(WS_METHODS.projectCheckoutDeletionPreview, {
+const WsProjectCheckoutDeletionPreviewRpc = make$29(WS_METHODS.projectCheckoutDeletionPreview, {
 	payload: ProjectCheckoutDeletionPreviewInput,
 	success: ProjectCheckoutDeletionPreview
 });
-const WsProjectCheckoutDeletionExecuteRpc = make$30(WS_METHODS.projectCheckoutDeletionExecute, {
+const WsProjectCheckoutDeletionExecuteRpc = make$29(WS_METHODS.projectCheckoutDeletionExecute, {
 	payload: ProjectCheckoutDeletionExecuteInput,
 	success: ProjectCheckoutDeletionResult
 });
-const WsWorkspaceReadFileRpc = make$30(WS_METHODS.workspaceReadFile, {
+const WsWorkspaceReadFileRpc = make$29(WS_METHODS.workspaceReadFile, {
 	payload: BulkTransferReadFileInput,
 	success: BulkTransferStreamEvent,
 	error: BulkTransferError,
 	stream: true
 });
-const WsWorkspaceBeginWriteFileRpc = make$30(WS_METHODS.workspaceBeginWriteFile, {
+const WsWorkspaceBeginWriteFileRpc = make$29(WS_METHODS.workspaceBeginWriteFile, {
 	payload: BulkTransferWriteBeginInput,
 	success: BulkTransferWriteBeginResult,
 	error: BulkTransferError
 });
-const WsWorkspaceWriteFileChunkRpc = make$30(WS_METHODS.workspaceWriteFileChunk, {
+const WsWorkspaceWriteFileChunkRpc = make$29(WS_METHODS.workspaceWriteFileChunk, {
 	payload: BulkTransferWriteChunkInput,
 	success: BulkTransferWriteChunkResult,
 	error: BulkTransferError
 });
-const WsWorkspaceCommitWriteFileRpc = make$30(WS_METHODS.workspaceCommitWriteFile, {
+const WsWorkspaceCommitWriteFileRpc = make$29(WS_METHODS.workspaceCommitWriteFile, {
 	payload: BulkTransferIdInput,
 	success: BulkTransferWriteCommitResult,
 	error: BulkTransferError
 });
-const WsWorkspaceCancelWriteFileRpc = make$30(WS_METHODS.workspaceCancelWriteFile, {
+const WsWorkspaceCancelWriteFileRpc = make$29(WS_METHODS.workspaceCancelWriteFile, {
 	payload: BulkTransferIdInput,
 	success: BulkTransferCancelResult,
 	error: BulkTransferError
 });
-const WsShellOpenInEditorRpc = make$30(WS_METHODS.shellOpenInEditor, {
+const WsShellOpenInEditorRpc = make$29(WS_METHODS.shellOpenInEditor, {
 	payload: OpenInEditorInput,
 	error: OpenError$1
 });
-const WsSubscribeGitStatusRpc = make$30(WS_METHODS.subscribeGitStatus, {
+const WsSubscribeGitStatusRpc = make$29(WS_METHODS.subscribeGitStatus, {
 	payload: GitStatusInput,
 	success: GitStatusStreamEvent,
 	error: GitManagerServiceError,
 	stream: true
 });
-const WsGitPullRpc = make$30(WS_METHODS.gitPull, {
+const WsGitPullRpc = make$29(WS_METHODS.gitPull, {
 	payload: GitPullInput,
 	success: GitPullResult,
 	error: GitCommandError
 });
-const WsGitRefreshStatusRpc = make$30(WS_METHODS.gitRefreshStatus, {
+const WsGitRefreshStatusRpc = make$29(WS_METHODS.gitRefreshStatus, {
 	payload: GitStatusInput,
 	success: GitStatusResult,
 	error: GitManagerServiceError
 });
-const WsGitRunStackedActionRpc = make$30(WS_METHODS.gitRunStackedAction, {
+const WsGitRunStackedActionRpc = make$29(WS_METHODS.gitRunStackedAction, {
 	payload: GitRunStackedActionInput,
 	success: GitActionProgressEvent,
 	error: GitManagerServiceError,
 	stream: true
 });
-const WsGitResolvePullRequestRpc = make$30(WS_METHODS.gitResolvePullRequest, {
+const WsGitResolvePullRequestRpc = make$29(WS_METHODS.gitResolvePullRequest, {
 	payload: GitPullRequestRefInput,
 	success: GitResolvePullRequestResult,
 	error: GitManagerServiceError
 });
-const WsGitPreparePullRequestThreadRpc = make$30(WS_METHODS.gitPreparePullRequestThread, {
+const WsGitPreparePullRequestThreadRpc = make$29(WS_METHODS.gitPreparePullRequestThread, {
 	payload: GitPreparePullRequestThreadInput,
 	success: GitPreparePullRequestThreadResult,
 	error: GitManagerServiceError
 });
-const WsGitListBranchesRpc = make$30(WS_METHODS.gitListBranches, {
+const WsGitListBranchesRpc = make$29(WS_METHODS.gitListBranches, {
 	payload: GitListBranchesInput,
 	success: GitListBranchesResult,
 	error: GitCommandError
 });
-const WsVcsListRefsRpc = make$30(WS_METHODS.vcsListRefs, {
+const WsVcsListRefsRpc = make$29(WS_METHODS.vcsListRefs, {
 	payload: VcsListRefsInput,
 	success: VcsListRefsResult,
 	error: GitCommandError
 });
-const WsVcsRefreshStatusRpc = make$30(WS_METHODS.vcsRefreshStatus, {
+const WsVcsRefreshStatusRpc = make$29(WS_METHODS.vcsRefreshStatus, {
 	payload: GitStatusInput,
 	success: VcsStatusResult,
 	error: GitManagerServiceError
 });
-const WsSubscribeVcsStatusRpc = make$30(WS_METHODS.subscribeVcsStatus, {
+const WsSubscribeVcsStatusRpc = make$29(WS_METHODS.subscribeVcsStatus, {
 	payload: GitStatusInput,
 	success: VcsStatusStreamEvent,
 	error: GitManagerServiceError,
 	stream: true
 });
-const WsVcsPullRpc = make$30(WS_METHODS.vcsPull, {
+const WsVcsPullRpc = make$29(WS_METHODS.vcsPull, {
 	payload: VcsPullInput,
 	success: VcsPullResult,
 	error: GitCommandError
 });
-const WsVcsCreateWorktreeRpc = make$30(WS_METHODS.vcsCreateWorktree, {
+const WsVcsCreateWorktreeRpc = make$29(WS_METHODS.vcsCreateWorktree, {
 	payload: VcsCreateWorktreeInput,
 	success: VcsCreateWorktreeResult,
 	error: require_Schema$1.Union([GitCommandError, VcsUnsupportedRequestError])
 });
-const WsVcsRemoveWorktreeRpc = make$30(WS_METHODS.vcsRemoveWorktree, {
+const WsVcsRemoveWorktreeRpc = make$29(WS_METHODS.vcsRemoveWorktree, {
 	payload: GitRemoveWorktreeInput,
 	error: GitCommandError
 });
-const WsVcsCreateRefRpc = make$30(WS_METHODS.vcsCreateRef, {
+const WsVcsCreateRefRpc = make$29(WS_METHODS.vcsCreateRef, {
 	payload: VcsCreateRefInput,
 	success: VcsCreateRefResult,
 	error: GitCommandError
 });
-const WsVcsSwitchRefRpc = make$30(WS_METHODS.vcsSwitchRef, {
+const WsVcsSwitchRefRpc = make$29(WS_METHODS.vcsSwitchRef, {
 	payload: VcsSwitchRefInput,
 	success: VcsSwitchRefResult,
 	error: GitCommandError
 });
-const WsVcsInitRpc = make$30(WS_METHODS.vcsInit, {
+const WsVcsInitRpc = make$29(WS_METHODS.vcsInit, {
 	payload: VcsInitInput,
 	error: require_Schema$1.Union([GitCommandError, VcsUnsupportedRequestError])
 });
-const WsGitCreateWorktreeRpc = make$30(WS_METHODS.gitCreateWorktree, {
+const WsGitCreateWorktreeRpc = make$29(WS_METHODS.gitCreateWorktree, {
 	payload: GitCreateWorktreeInput,
 	success: GitCreateWorktreeResult,
 	error: GitCommandError
 });
-const WsGitRemoveWorktreeRpc = make$30(WS_METHODS.gitRemoveWorktree, {
+const WsGitRemoveWorktreeRpc = make$29(WS_METHODS.gitRemoveWorktree, {
 	payload: GitRemoveWorktreeInput,
 	error: GitCommandError
 });
-const WsGitCreateBranchRpc = make$30(WS_METHODS.gitCreateBranch, {
+const WsGitCreateBranchRpc = make$29(WS_METHODS.gitCreateBranch, {
 	payload: GitCreateBranchInput,
 	success: GitCreateBranchResult,
 	error: GitCommandError
 });
-const WsGitCheckoutRpc = make$30(WS_METHODS.gitCheckout, {
+const WsGitCheckoutRpc = make$29(WS_METHODS.gitCheckout, {
 	payload: GitCheckoutInput,
 	success: GitCheckoutResult,
 	error: GitCommandError
 });
-const WsGitInitRpc = make$30(WS_METHODS.gitInit, {
+const WsGitInitRpc = make$29(WS_METHODS.gitInit, {
 	payload: GitInitInput,
 	error: GitCommandError
 });
@@ -26694,7 +26694,7 @@ const WsGitInitRpc = make$30(WS_METHODS.gitInit, {
 * The git half of a review: the branch range and the uncommitted work. The
 * per-turn diffs beside it arrive through `orchestration.getTurnDiff`.
 */
-const WsReviewGetDiffPreviewRpc = make$30(WS_METHODS.reviewGetDiffPreview, {
+const WsReviewGetDiffPreviewRpc = make$29(WS_METHODS.reviewGetDiffPreview, {
 	payload: ReviewDiffPreviewInput,
 	success: ReviewDiffPreviewResult,
 	error: require_Schema$1.Union([ReviewDiffPreviewError])
@@ -26704,12 +26704,12 @@ const WsReviewGetDiffPreviewRpc = make$30(WS_METHODS.reviewGetDiffPreview, {
 * chunked bulk-transfer stream. A viewer wants the text once; a transfer wants
 * offsets and checksums.
 */
-const WsProjectsReadFileRpc = make$30(WS_METHODS.projectsReadFile, {
+const WsProjectsReadFileRpc = make$29(WS_METHODS.projectsReadFile, {
 	payload: ProjectReadFileInput,
 	success: ProjectReadFileResult,
 	error: require_Schema$1.Union([ProjectReadFileError])
 });
-const WsFilesystemBrowseRpc = make$30(WS_METHODS.filesystemBrowse, {
+const WsFilesystemBrowseRpc = make$29(WS_METHODS.filesystemBrowse, {
 	payload: FilesystemBrowseInput,
 	success: FilesystemBrowseResult,
 	error: require_Schema$1.Union([FilesystemBrowseError])
@@ -26719,87 +26719,87 @@ const WsFilesystemBrowseRpc = make$30(WS_METHODS.filesystemBrowse, {
 * Routed through the server because the phone keeps only the Forge-minted
 * session token, never a CMMD one.
 */
-const WsCloudListRuntimesRpc = make$30(WS_METHODS.cloudListRuntimes, {
+const WsCloudListRuntimesRpc = make$29(WS_METHODS.cloudListRuntimes, {
 	payload: CloudRuntimeListInput,
 	success: CloudRuntimeListResult,
 	error: require_Schema$1.Union([CloudRuntimeListError])
 });
-const WsTerminalOpenRpc = make$30(WS_METHODS.terminalOpen, {
+const WsTerminalOpenRpc = make$29(WS_METHODS.terminalOpen, {
 	payload: TerminalOpenInput,
 	success: TerminalSessionSnapshot,
 	error: TerminalError
 });
-const WsTerminalAttachRpc = make$30(WS_METHODS.terminalAttach, {
+const WsTerminalAttachRpc = make$29(WS_METHODS.terminalAttach, {
 	payload: TerminalAttachInput,
 	success: TerminalAttachStreamEvent,
 	error: TerminalError,
 	stream: true
 });
-const WsTerminalWriteRpc = make$30(WS_METHODS.terminalWrite, {
+const WsTerminalWriteRpc = make$29(WS_METHODS.terminalWrite, {
 	payload: TerminalWriteRequest,
 	success: TerminalControlAck,
 	error: TerminalError
 });
-const WsTerminalResizeRpc = make$30(WS_METHODS.terminalResize, {
+const WsTerminalResizeRpc = make$29(WS_METHODS.terminalResize, {
 	payload: TerminalResizeRequest,
 	success: TerminalControlAck,
 	error: TerminalError
 });
-const WsTerminalSignalRpc = make$30(WS_METHODS.terminalSignal, {
+const WsTerminalSignalRpc = make$29(WS_METHODS.terminalSignal, {
 	payload: TerminalSignalRequest,
 	success: TerminalControlAck,
 	error: TerminalError
 });
-const WsTerminalClearRpc = make$30(WS_METHODS.terminalClear, {
+const WsTerminalClearRpc = make$29(WS_METHODS.terminalClear, {
 	payload: TerminalClearRequest,
 	success: TerminalControlAck,
 	error: TerminalError
 });
-const WsTerminalRestartRpc = make$30(WS_METHODS.terminalRestart, {
+const WsTerminalRestartRpc = make$29(WS_METHODS.terminalRestart, {
 	payload: TerminalRestartRequest,
 	success: TerminalRestartResult,
 	error: TerminalError
 });
-const WsTerminalCloseRpc = make$30(WS_METHODS.terminalClose, {
+const WsTerminalCloseRpc = make$29(WS_METHODS.terminalClose, {
 	payload: TerminalCloseRequest,
 	success: TerminalControlAck,
 	error: TerminalError
 });
-const WsBrowserOpenSessionRpc = make$30(WS_METHODS.browserOpenSession, {
+const WsBrowserOpenSessionRpc = make$29(WS_METHODS.browserOpenSession, {
 	payload: BrowserOpenSessionInput,
 	success: BrowserSessionSnapshot,
 	error: BrowserError
 });
-const WsBrowserListSessionsRpc = make$30(WS_METHODS.browserListSessions, {
+const WsBrowserListSessionsRpc = make$29(WS_METHODS.browserListSessions, {
 	payload: BrowserListSessionsInput,
 	success: require_Schema$1.ArraySchema(BrowserSessionSnapshot),
 	error: BrowserError
 });
-const WsBrowserCloseSessionRpc = make$30(WS_METHODS.browserCloseSession, {
+const WsBrowserCloseSessionRpc = make$29(WS_METHODS.browserCloseSession, {
 	payload: BrowserCloseSessionInput,
 	error: BrowserError
 });
-const WsBrowserGetSessionRpc = make$30(WS_METHODS.browserGetSession, {
+const WsBrowserGetSessionRpc = make$29(WS_METHODS.browserGetSession, {
 	payload: BrowserGetSessionInput,
 	success: require_Schema$1.NullOr(BrowserSessionSnapshot),
 	error: BrowserError
 });
-const WsBrowserCommandRpc = make$30(WS_METHODS.browserCommand, {
+const WsBrowserCommandRpc = make$29(WS_METHODS.browserCommand, {
 	payload: BrowserCommandInput,
 	success: BrowserCommandResult,
 	error: BrowserError
 });
-const WsBrowserClearBrowsingDataRpc = make$30(WS_METHODS.browserClearBrowsingData, {
+const WsBrowserClearBrowsingDataRpc = make$29(WS_METHODS.browserClearBrowsingData, {
 	payload: BrowserClearBrowsingDataInput,
 	success: BrowserClearBrowsingDataResult,
 	error: BrowserError
 });
-const WsBrowserAttachDisplayRpc = make$30(WS_METHODS.browserAttachDisplay, {
+const WsBrowserAttachDisplayRpc = make$29(WS_METHODS.browserAttachDisplay, {
 	payload: BrowserDisplayAttachInput,
 	success: BrowserDisplayAttachResult,
 	error: BrowserError
 });
-const WsBrowserAddDisplayIceCandidateRpc = make$30(WS_METHODS.browserAddDisplayIceCandidate, {
+const WsBrowserAddDisplayIceCandidateRpc = make$29(WS_METHODS.browserAddDisplayIceCandidate, {
 	payload: BrowserDisplayIceCandidateInput,
 	success: require_Schema$1.Struct({}),
 	error: BrowserError
@@ -26811,87 +26811,87 @@ const WsBrowserAddDisplayIceCandidateRpc = make$30(WS_METHODS.browserAddDisplayI
 * page: it can click a DOM element but cannot touch the dock, a file manager,
 * or anything else outside Chromium. This one lands on the display itself.
 */
-const WsComputerInputRpc = make$30(WS_METHODS.computerInput, {
+const WsComputerInputRpc = make$29(WS_METHODS.computerInput, {
 	payload: ComputerInputInput,
 	success: ComputerInputResult,
 	error: ComputerError
 });
-const WsDevTunnelRegisterRpc = make$30(WS_METHODS.devTunnelRegister, {
+const WsDevTunnelRegisterRpc = make$29(WS_METHODS.devTunnelRegister, {
 	payload: DevTunnelRegisterInput,
 	success: DevTunnelRecord,
 	error: DevTunnelError
 });
-const WsDevTunnelUnregisterRpc = make$30(WS_METHODS.devTunnelUnregister, {
+const WsDevTunnelUnregisterRpc = make$29(WS_METHODS.devTunnelUnregister, {
 	payload: DevTunnelUnregisterInput,
 	error: DevTunnelError
 });
-const WsDevTunnelListRpc = make$30(WS_METHODS.devTunnelList, {
+const WsDevTunnelListRpc = make$29(WS_METHODS.devTunnelList, {
 	payload: DevTunnelListInput,
 	success: require_Schema$1.ArraySchema(DevTunnelRecord),
 	error: DevTunnelError
 });
-const WsThreadDevRuntimeGetRpc = make$30(WS_METHODS.threadDevRuntimeGet, {
+const WsThreadDevRuntimeGetRpc = make$29(WS_METHODS.threadDevRuntimeGet, {
 	payload: ThreadDevRuntimeGetInput,
 	success: require_Schema$1.NullOr(ThreadDevRuntimeRecord),
 	error: ThreadDevRuntimeError
 });
-const WsThreadDevRuntimeAllocatePortRpc = make$30(WS_METHODS.threadDevRuntimeAllocatePort, {
+const WsThreadDevRuntimeAllocatePortRpc = make$29(WS_METHODS.threadDevRuntimeAllocatePort, {
 	payload: ThreadDevRuntimeAllocatePortInput,
 	success: ThreadDevRuntimeRecord,
 	error: ThreadDevRuntimeError
 });
-const WsThreadDevRuntimeReleaseRpc = make$30(WS_METHODS.threadDevRuntimeRelease, {
+const WsThreadDevRuntimeReleaseRpc = make$29(WS_METHODS.threadDevRuntimeRelease, {
 	payload: ThreadDevRuntimeReleaseInput,
 	error: ThreadDevRuntimeError
 });
-const WsWorkspaceEnvironmentPreflightRpc = make$30(WS_METHODS.workspaceEnvironmentPreflight, {
+const WsWorkspaceEnvironmentPreflightRpc = make$29(WS_METHODS.workspaceEnvironmentPreflight, {
 	payload: WorkspaceEnvironmentPreflightInput,
 	success: WorkspaceEnvironmentPreflightReport,
 	error: WorkspaceEnvironmentError
 });
-const WsWorkspaceEnsureScratchRpc = make$30(WS_METHODS.workspaceEnsureScratch, {
+const WsWorkspaceEnsureScratchRpc = make$29(WS_METHODS.workspaceEnsureScratch, {
 	payload: WorkspaceEnsureScratchInput,
 	success: WorkspaceEnsureScratchResult,
 	error: WorkspaceEnvironmentError
 });
-const WsOrchestrationDispatchCommandRpc = make$30(ORCHESTRATION_WS_METHODS.dispatchCommand, {
+const WsOrchestrationDispatchCommandRpc = make$29(ORCHESTRATION_WS_METHODS.dispatchCommand, {
 	payload: ClientOrchestrationCommand,
 	success: OrchestrationRpcSchemas.dispatchCommand.output,
 	error: OrchestrationDispatchCommandError
 });
-const WsOrchestrationGetTurnDiffRpc = make$30(ORCHESTRATION_WS_METHODS.getTurnDiff, {
+const WsOrchestrationGetTurnDiffRpc = make$29(ORCHESTRATION_WS_METHODS.getTurnDiff, {
 	payload: OrchestrationGetTurnDiffInput,
 	success: OrchestrationRpcSchemas.getTurnDiff.output,
 	error: OrchestrationGetTurnDiffError
 });
-const WsOrchestrationGetFullThreadDiffRpc = make$30(ORCHESTRATION_WS_METHODS.getFullThreadDiff, {
+const WsOrchestrationGetFullThreadDiffRpc = make$29(ORCHESTRATION_WS_METHODS.getFullThreadDiff, {
 	payload: OrchestrationGetFullThreadDiffInput,
 	success: OrchestrationRpcSchemas.getFullThreadDiff.output,
 	error: OrchestrationGetFullThreadDiffError
 });
-const WsOrchestrationStreamTurnDiffRpc = make$30(ORCHESTRATION_WS_METHODS.streamTurnDiff, {
+const WsOrchestrationStreamTurnDiffRpc = make$29(ORCHESTRATION_WS_METHODS.streamTurnDiff, {
 	payload: OrchestrationGetTurnDiffInput,
 	success: BulkTransferStreamEvent,
 	error: require_Schema$1.Union([OrchestrationGetTurnDiffError, BulkTransferError]),
 	stream: true
 });
-const WsOrchestrationStreamFullThreadDiffRpc = make$30(ORCHESTRATION_WS_METHODS.streamFullThreadDiff, {
+const WsOrchestrationStreamFullThreadDiffRpc = make$29(ORCHESTRATION_WS_METHODS.streamFullThreadDiff, {
 	payload: OrchestrationGetFullThreadDiffInput,
 	success: BulkTransferStreamEvent,
 	error: require_Schema$1.Union([OrchestrationGetFullThreadDiffError, BulkTransferError]),
 	stream: true
 });
-const WsOrchestrationReplayEventsRpc = make$30(ORCHESTRATION_WS_METHODS.replayEvents, {
+const WsOrchestrationReplayEventsRpc = make$29(ORCHESTRATION_WS_METHODS.replayEvents, {
 	payload: OrchestrationReplayEventsInput,
 	success: OrchestrationRpcSchemas.replayEvents.output,
 	error: OrchestrationReplayEventsError
 });
-const WsOrchestrationGetArchivedShellSnapshotRpc = make$30(ORCHESTRATION_WS_METHODS.getArchivedShellSnapshot, {
+const WsOrchestrationGetArchivedShellSnapshotRpc = make$29(ORCHESTRATION_WS_METHODS.getArchivedShellSnapshot, {
 	payload: OrchestrationRpcSchemas.getArchivedShellSnapshot.input,
 	success: OrchestrationRpcSchemas.getArchivedShellSnapshot.output,
 	error: OrchestrationGetSnapshotError
 });
-const WsOrchestrationSearchThreadsRpc = make$30(ORCHESTRATION_WS_METHODS.searchThreads, {
+const WsOrchestrationSearchThreadsRpc = make$29(ORCHESTRATION_WS_METHODS.searchThreads, {
 	payload: OrchestrationSearchThreadsInput,
 	success: OrchestrationRpcSchemas.searchThreads.output,
 	error: OrchestrationSearchThreadsError
@@ -26902,7 +26902,7 @@ const WsOrchestrationSearchThreadsRpc = make$30(ORCHESTRATION_WS_METHODS.searchT
 * route and `subscribeThread`'s fallback snapshot serve, over the RPC socket
 * instead.
 */
-const WsOrchestrationGetThreadDetailPageRpc = make$30(ORCHESTRATION_WS_METHODS.getThreadDetailPage, {
+const WsOrchestrationGetThreadDetailPageRpc = make$29(ORCHESTRATION_WS_METHODS.getThreadDetailPage, {
 	payload: OrchestrationRpcSchemas.getThreadDetailPage.input,
 	success: OrchestrationRpcSchemas.getThreadDetailPage.output,
 	error: OrchestrationGetSnapshotError
@@ -26915,29 +26915,29 @@ const WsOrchestrationGetThreadDetailPageRpc = make$30(ORCHESTRATION_WS_METHODS.g
 * also be authorized, and a repository the caller cannot reach is a failure
 * here rather than a clone that dies half way.
 */
-const WsSourceControlLookupRepositoryRpc = make$30(WS_METHODS.sourceControlLookupRepository, {
+const WsSourceControlLookupRepositoryRpc = make$29(WS_METHODS.sourceControlLookupRepository, {
 	payload: SourceControlRepositoryLookupInput,
 	success: SourceControlRepositoryInfo,
 	error: SourceControlRepositoryError
 });
-const WsSourceControlCloneRepositoryRpc = make$30(WS_METHODS.sourceControlCloneRepository, {
+const WsSourceControlCloneRepositoryRpc = make$29(WS_METHODS.sourceControlCloneRepository, {
 	payload: SourceControlCloneRepositoryInput,
 	success: SourceControlCloneRepositoryResult,
 	error: SourceControlRepositoryError
 });
-const WsOrchestrationSubscribeShellRpc = make$30(ORCHESTRATION_WS_METHODS.subscribeShell, {
+const WsOrchestrationSubscribeShellRpc = make$29(ORCHESTRATION_WS_METHODS.subscribeShell, {
 	payload: OrchestrationRpcSchemas.subscribeShell.input,
 	success: OrchestrationRpcSchemas.subscribeShell.output,
 	error: OrchestrationGetSnapshotError,
 	stream: true
 });
-const WsOrchestrationSubscribeThreadRpc = make$30(ORCHESTRATION_WS_METHODS.subscribeThread, {
+const WsOrchestrationSubscribeThreadRpc = make$29(ORCHESTRATION_WS_METHODS.subscribeThread, {
 	payload: OrchestrationRpcSchemas.subscribeThread.input,
 	success: OrchestrationRpcSchemas.subscribeThread.output,
 	error: OrchestrationGetSnapshotError,
 	stream: true
 });
-const WsSubscribeTerminalEventsRpc = make$30(WS_METHODS.subscribeTerminalEvents, {
+const WsSubscribeTerminalEventsRpc = make$29(WS_METHODS.subscribeTerminalEvents, {
 	payload: require_Schema$1.Struct({}),
 	success: TerminalEvent,
 	stream: true
@@ -26958,65 +26958,65 @@ const WsSubscribeTerminalEventsRpc = make$30(WS_METHODS.subscribeTerminalEvents,
 * The client's activity report, accepted and dropped. See
 * packages/contracts/src/clientActivityCompat.ts for why there is no answer.
 */
-const WsServerReportClientActivityRpc = make$30(WS_METHODS.serverReportClientActivity, { payload: ClientActivityReportInput });
-const WsServerDiscoverSourceControlRpc = make$30(WS_METHODS.serverDiscoverSourceControl, {
+const WsServerReportClientActivityRpc = make$29(WS_METHODS.serverReportClientActivity, { payload: ClientActivityReportInput });
+const WsServerDiscoverSourceControlRpc = make$29(WS_METHODS.serverDiscoverSourceControl, {
 	payload: require_Schema$1.Struct({}),
 	success: SourceControlDiscoveryResult
 });
-const WsProjectsListEntriesRpc = make$30(WS_METHODS.projectsListEntries, {
+const WsProjectsListEntriesRpc = make$29(WS_METHODS.projectsListEntries, {
 	payload: ProjectListEntriesInput,
 	success: ProjectListEntriesResult,
 	error: ProjectListEntriesError
 });
-const WsSubscribeTerminalMetadataRpc = make$30(WS_METHODS.subscribeTerminalMetadata, {
+const WsSubscribeTerminalMetadataRpc = make$29(WS_METHODS.subscribeTerminalMetadata, {
 	payload: require_Schema$1.Struct({}),
 	success: TerminalMetadataStreamEvent,
 	stream: true
 });
-const WsSubscribeBrowserEventsRpc = make$30(WS_METHODS.subscribeBrowserEvents, {
+const WsSubscribeBrowserEventsRpc = make$29(WS_METHODS.subscribeBrowserEvents, {
 	payload: BrowserSubscribeInput,
 	success: BrowserStreamEvent,
 	error: BrowserError,
 	stream: true
 });
-const WsSubscribeServerConfigRpc = make$30(WS_METHODS.subscribeServerConfig, {
+const WsSubscribeServerConfigRpc = make$29(WS_METHODS.subscribeServerConfig, {
 	payload: require_Schema$1.Struct({}),
 	success: ServerConfigStreamEvent,
 	error: require_Schema$1.Union([KeybindingsConfigError, ServerSettingsError]),
 	stream: true
 });
-const WsSubscribeServerLifecycleRpc = make$30(WS_METHODS.subscribeServerLifecycle, {
+const WsSubscribeServerLifecycleRpc = make$29(WS_METHODS.subscribeServerLifecycle, {
 	payload: require_Schema$1.Struct({}),
 	success: ServerLifecycleStreamEvent,
 	stream: true
 });
-const WsSubscribeAuthAccessRpc = make$30(WS_METHODS.subscribeAuthAccess, {
+const WsSubscribeAuthAccessRpc = make$29(WS_METHODS.subscribeAuthAccess, {
 	payload: require_Schema$1.Struct({}),
 	success: AuthAccessStreamEvent,
 	stream: true
 });
-const WsSubscribeWorkspaceReadinessRpc = make$30(WS_METHODS.subscribeWorkspaceReadiness, {
+const WsSubscribeWorkspaceReadinessRpc = make$29(WS_METHODS.subscribeWorkspaceReadiness, {
 	payload: WorkspaceReadinessSubscribeInput,
 	success: PhaseEvent,
 	error: WorkspaceReadinessError,
 	stream: true
 });
-const WsRpcGroup = make$29(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerStartProviderAuthRpc, WsServerRepairProviderAuthRuntimeRpc, WsServerDisconnectProviderAuthRpc, WsServerGetProviderAuthSessionRpc, WsServerCancelProviderAuthRpc, WsServerSubmitProviderAuthCodeRpc, WsServerSyncPersonalCodexToCloudRpc, WsServerSyncPersonalClaudeToCloudRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerUpdateEnvironmentDisplayNameRpc, WsServerTraceDiagnosticsRpc, WsServerHeartbeatRpc, make$30(WS_METHODS.usageGetSummary, {
+const WsRpcGroup = make$28(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerStartProviderAuthRpc, WsServerRepairProviderAuthRuntimeRpc, WsServerDisconnectProviderAuthRpc, WsServerGetProviderAuthSessionRpc, WsServerCancelProviderAuthRpc, WsServerSubmitProviderAuthCodeRpc, WsServerSyncPersonalCodexToCloudRpc, WsServerSyncPersonalClaudeToCloudRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerUpdateEnvironmentDisplayNameRpc, WsServerTraceDiagnosticsRpc, WsServerHeartbeatRpc, make$29(WS_METHODS.usageGetSummary, {
 	payload: UsageSummaryInput,
 	success: UsageSummary,
 	error: UsageReadError
-}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
+}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$29(WS_METHODS.assetsCreateUrl, {
 	payload: AssetsRpcSchemas.createUrl.input,
 	success: AssetsRpcSchemas.createUrl.output,
 	error: AssetAccessError
-}), make$30(WS_METHODS.attachmentsCreateUploadUrl, {
+}), make$29(WS_METHODS.attachmentsCreateUploadUrl, {
 	payload: AttachmentCreateUploadUrlInput,
 	success: AttachmentCreateUploadUrlResult,
 	error: AttachmentUploadSigningKeyError
-}), make$30(WS_METHODS.attachmentsDelete, {
+}), make$29(WS_METHODS.attachmentsDelete, {
 	payload: AttachmentDeleteInput,
 	success: require_Schema$1.Void
-}), make$30(WS_METHODS.providerUploadFeedback, {
+}), make$29(WS_METHODS.providerUploadFeedback, {
 	payload: ProviderUploadFeedbackInput,
 	success: ProviderUploadFeedbackResult,
 	error: ProviderUploadFeedbackError
@@ -34652,7 +34652,7 @@ function parse$5(input) {
 const FULL_PATH_REGEXP = /^https?:\/\/.*?\//;
 const OPTIONAL_PARAM_REGEXP = /(\/:[^/()]*?)\?(\/?)/;
 /** @internal */
-const make$28 = (options = {}) => new RouterImpl(options);
+const make$27 = (options = {}) => new RouterImpl(options);
 var RouterImpl = class {
 	constructor(options = {}) {
 		this.options = {
@@ -35171,7 +35171,7 @@ const httpMethods = [
 * @since 1.0.0
 * @category constructors
 */
-const make$27 = make$28;
+const make$26 = make$27;
 //#endregion
 //#region ../../node_modules/.bun/effect@4.0.0-beta.51/node_modules/effect/dist/unstable/http/HttpRouter.js
 /**
@@ -35187,8 +35187,8 @@ const HttpRouter = /* @__PURE__ */ require_Schema$1.Service("effect/http/HttpRou
 * @since 4.0.0
 * @category HttpRouter
 */
-const make$26 = /* @__PURE__ */ require_Schema$1.gen(function* () {
-	const router = make$27(yield* RouterConfig);
+const make$25 = /* @__PURE__ */ require_Schema$1.gen(function* () {
+	const router = make$26(yield* RouterConfig);
 	const middleware = /* @__PURE__ */ new Set();
 	const addAll = (routes) => require_Schema$1.contextWith((context) => {
 		const middleware = getMiddleware(context);
@@ -35318,7 +35318,7 @@ const add$1 = (method, path, handler, options) => use((router) => router.add(met
 * @since 4.0.0
 * @category HttpRouter
 */
-const layer$5 = /* @__PURE__ */ require_Schema$1.effect(HttpRouter)(make$26);
+const layer$5 = /* @__PURE__ */ require_Schema$1.effect(HttpRouter)(make$25);
 const RouteTypeId = "~effect/http/HttpRouter/Route";
 const makeRoute = (options) => ({
 	...options,
@@ -66332,7 +66332,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.95";
+var version$1 = "0.13.97";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -77159,7 +77159,7 @@ let clientIdCounter = 0;
 * @since 4.0.0
 * @category client
 */
-const make$25 = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (group, options) {
+const make$24 = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (group, options) {
 	const clientId = clientIdCounter++;
 	const { run, send, supportsAck, supportsTransferables } = yield* Protocol$1;
 	const entries = /* @__PURE__ */ new Map();
@@ -77535,7 +77535,7 @@ const applyMiddleware = (context, handler, options) => {
 * @since 4.0.0
 * @category server
 */
-const make$24 = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (group, options) {
+const make$23 = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (group, options) {
 	const { disconnects, end, run, send, supportsAck, supportsSpanPropagation, supportsTransferables } = yield* Protocol;
 	const services = yield* require_Schema$1.context();
 	const scope = yield* require_Schema$1.make$3();
@@ -77708,7 +77708,7 @@ const makeProtocolWithHttpEffectWebsocket = /* @__PURE__ */ require_Schema$1.gen
 */
 const toHttpEffectWebsocket = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (group, options) {
 	const { httpEffect, protocol } = yield* makeProtocolWithHttpEffectWebsocket;
-	yield* make$24(group, options).pipe(require_Schema$1.provideService(Protocol, protocol), require_Schema$1.forkScoped);
+	yield* make$23(group, options).pipe(require_Schema$1.provideService(Protocol, protocol), require_Schema$1.forkScoped);
 	return httpEffect;
 });
 const makeSocketProtocol = /* @__PURE__ */ require_Schema$1.gen(function* () {
@@ -78745,7 +78745,7 @@ function readTraceFile(fileSystem, path) {
 		cause
 	})) }));
 }
-const make$23 = require_Schema$1.gen(function* () {
+const make$22 = require_Schema$1.gen(function* () {
 	const fileSystem = yield* require_Path.FileSystem;
 	const read = require_Schema$1.fn("TraceDiagnostics.read")(function* (options) {
 		const readAtMs = options.readAtMs ?? Date.now();
@@ -78789,7 +78789,7 @@ const make$23 = require_Schema$1.gen(function* () {
 	});
 	return TraceDiagnostics.of({ read });
 });
-const layer$4 = require_Schema$1.effect(TraceDiagnostics, make$23);
+const layer$4 = require_Schema$1.effect(TraceDiagnostics, make$22);
 require_Schema$1.succeed$1(TraceDiagnostics, TraceDiagnostics.of({ read: (options) => require_Schema$1.succeed(makeEmptyDiagnostics({
 	traceFilePath: options.traceFilePath,
 	scannedFilePaths: [],
@@ -86695,7 +86695,7 @@ function toReviewThreadListing(threads, dismissalsByReviewId) {
 		viewer: threads.metadata.viewer
 	};
 }
-const make$22 = require_Schema$1.gen(function* () {
+const make$21 = require_Schema$1.gen(function* () {
 	const github = yield* GitHubCli$1;
 	/**
 	* The pull request's own node id, which is what a mutation against the pull request itself is
@@ -87400,9 +87400,9 @@ const make$22 = require_Schema$1.gen(function* () {
 		})))
 	});
 });
-require_Schema$1.effect(GitHubPullRequestCli, make$22);
+require_Schema$1.effect(GitHubPullRequestCli, make$21);
 /** Builds a PR CLI for one authenticated session without touching global git or auth state. */
-const makeFromCommandRunner = (runner) => make$22.pipe(require_Schema$1.provideService(GitHubCli$1, runner));
+const makeFromCommandRunner = (runner) => make$21.pipe(require_Schema$1.provideService(GitHubCli$1, runner));
 //#endregion
 //#region src/pullRequest/GitHubPullRequestProvider.ts
 const CAPABILITIES$3 = {
@@ -87522,7 +87522,7 @@ function loginAvatarUrl(login, host) {
 }
 /** True where markdown would render nothing: whitespace, or only HTML comments. */
 const rendersEmpty = (body) => body.replace(/<!--[\s\S]*?-->/g, "").trim().length === 0;
-const make$21 = require_Schema$1.gen(function* () {
+const make$20 = require_Schema$1.gen(function* () {
 	const cli = yield* GitHubPullRequestCli;
 	const fail = (operation) => (error) => new PullRequestProviderError({
 		provider: "github",
@@ -87731,7 +87731,7 @@ const make$21 = require_Schema$1.gen(function* () {
 	};
 });
 /** Constructs the provider from a session-bound command service supplied by the caller. */
-const makeFromCli = (cli) => make$21.pipe(require_Schema$1.provideService(GitHubPullRequestCli, cli));
+const makeFromCli = (cli) => make$20.pipe(require_Schema$1.provideService(GitHubPullRequestCli, cli));
 //#endregion
 //#region src/git/AgentAttribution.ts
 /**
@@ -93345,7 +93345,7 @@ function toResolvableLinks(links) {
 * A Forge project id is installation-local; it must never be sent to CMMD as a project id.
 */
 var CmmdProjectIdentityResolver = class extends require_Schema$1.Service()("forge/pullRequest/CmmdProjectIdentityResolver") {};
-const make$20 = require_Schema$1.gen(function* () {
+const make$19 = require_Schema$1.gen(function* () {
 	const environment = yield* ServerEnvironment;
 	const repositoryIdentity = yield* RepositoryIdentityResolver;
 	const resolve = (forgeProjectId, cmmdJwt) => require_Schema$1.gen(function* () {
@@ -93386,7 +93386,7 @@ function resolveCanonicalKey(repositoryIdentity, forgeProjectId) {
 		return (yield* repositoryIdentity.resolve(workspaceRoot))?.canonicalKey ?? null;
 	}).pipe(require_Schema$1.orElseSucceed(() => null));
 }
-const cmmdProjectIdentityResolverLive = require_Schema$1.effect(CmmdProjectIdentityResolver, make$20);
+const cmmdProjectIdentityResolverLive = require_Schema$1.effect(CmmdProjectIdentityResolver, make$19);
 //#endregion
 //#region src/pullRequest/PullRequestServiceFactory.ts
 var PullRequestServiceFactory = class extends require_Schema$1.Service()("forge/pullRequest/PullRequestServiceFactory") {};
@@ -93416,7 +93416,7 @@ function makePrincipalServiceCache(input) {
 		return entry.value;
 	};
 }
-const make$19 = require_Schema$1.gen(function* () {
+const make$18 = require_Schema$1.gen(function* () {
 	const projections = yield* ProjectionSnapshotQuery;
 	const settings = yield* ServerSettingsService;
 	const providerRuntimeSource = yield* require_Schema$1.serviceOption(PullRequestProviderRuntimeSource);
@@ -93454,7 +93454,7 @@ const make$19 = require_Schema$1.gen(function* () {
 	const forPrincipal = (principal) => require_Schema$1.promise(() => cached(principal));
 	return PullRequestServiceFactory.of({ forPrincipal });
 });
-const pullRequestServiceFactoryLayer = require_Schema$1.effect(PullRequestServiceFactory, make$19);
+const pullRequestServiceFactoryLayer = require_Schema$1.effect(PullRequestServiceFactory, make$18);
 //#endregion
 //#region ../../packages/shared/src/keybindings.ts
 /**
@@ -94319,7 +94319,7 @@ const launchDetached = (launch) => require_Schema$1.gen(function* () {
 		}))));
 	});
 });
-const make$18 = require_Schema$1.gen(function* () {
+const make$17 = require_Schema$1.gen(function* () {
 	const open = yield* require_Schema$1.tryPromise({
 		try: () => Promise.resolve().then(() => require("./open-CghsF25U.cjs")),
 		catch: (cause) => new OpenError$1({
@@ -94338,7 +94338,7 @@ const make$18 = require_Schema$1.gen(function* () {
 		openInEditor: (input) => require_Schema$1.flatMap(resolveEditorLaunch(input), launchDetached)
 	};
 });
-const OpenLive = require_Schema$1.effect(Open, make$18);
+const OpenLive = require_Schema$1.effect(Open, make$17);
 //#endregion
 //#region src/workspace/Services/WorkspacePaths.ts
 /**
@@ -98404,6 +98404,119 @@ function providerAuthFailureMessage(message, provider, env = process.env) {
 	}).message;
 }
 //#endregion
+//#region ../../packages/shared/src/publicProviderCopy.ts
+const PUBLIC_PROVIDER_LEAK_PATTERNS = [
+	/\bDeepSeek\b/i,
+	/\bKimi\b/i,
+	/\bMoonshot\b/i,
+	/\bdeepseek[-._a-z0-9]*\b/i,
+	/\bkimi[-._a-z0-9]*\b/i,
+	/\bmoonshot[-._a-z0-9]*\b/i,
+	/\bAPEX_API_KEY\b/,
+	/\bDEEPSEEK_API_KEY\b/,
+	/\bKIMI_API_KEY\b/,
+	/\bOPENAI_API_KEY\b/,
+	/\bANTHROPIC_API_KEY\b/,
+	/\bCURSOR_API_KEY\b/,
+	/\bOPENCODE_API_KEY\b/,
+	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
+	/\bProviderValidationError\b/,
+	/\/forge-server\/node_modules\//,
+	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
+	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
+];
+const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+function isProviderRateOrQuotaError(message) {
+	if (!message) return false;
+	const normalized = message.toLowerCase();
+	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
+}
+function providerLifecycleOrAccountCopy(message) {
+	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
+	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
+	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
+	return null;
+}
+/**
+* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
+*
+* Returns a canned, user-facing message — it never echoes the raw input, so it
+* is safe to use even when the source message contains provider internals.
+* Used to give actionable feedback ("model isn't available", "rate-limited",
+* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
+* Returns null when no category can be confidently inferred.
+*/
+function categorizePublicProviderError(message) {
+	if (!message) return null;
+	const m = message.toLowerCase();
+	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
+	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
+	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
+	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
+	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
+	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
+	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
+	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
+	return null;
+}
+function containsPublicProviderLeak(message) {
+	if (!message) return false;
+	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
+}
+function sanitizePublicProviderText(message, options = {}) {
+	if (message === void 0 || message === null) return null;
+	const trimmed = message.trim();
+	if (trimmed.length === 0) return null;
+	if (!containsPublicProviderLeak(trimmed)) return trimmed;
+	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+}
+//#endregion
+//#region src/orchestration/providerRetryableFailure.ts
+/**
+* Classifies a provider turn-start failure as a retryable rate-limit or
+* transient-availability failure (429/503), a terminal failure that names why
+* it will never clear on its own, or unrecognized (null).
+*
+* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
+* trace at all, because nothing in the turn-start path recognized it as a
+* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
+* whether to retry a turn start with backoff, and to name the provider,
+* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
+* watchdog reads once retries are exhausted.
+*
+* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
+* sanitizer uses to recognize a rate-limit message) rather than restating its
+* word list here.
+*/
+const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
+const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
+const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
+const EXPLICIT_429_PATTERN = /\b429\b/;
+const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
+function parseRetryAfterSeconds(detail) {
+	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
+	if (!match) return null;
+	const raw = match[1] ?? match[2];
+	const seconds = raw ? Number(raw) : NaN;
+	return Number.isFinite(seconds) ? seconds : null;
+}
+function classifyRetryableProviderFailure(detail) {
+	if (!detail || detail.trim().length === 0) return null;
+	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
+		kind: "terminal",
+		reason: "quota",
+		message: detail
+	};
+	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
+	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
+	if (!isRateLimited && !isUnavailable) return null;
+	return {
+		kind: "retryable",
+		status: isRateLimited ? 429 : 503,
+		retryAfterSeconds: parseRetryAfterSeconds(detail)
+	};
+}
+//#endregion
 //#region src/orchestration/turnFailureReason.ts
 /**
 * Machine-readable reasons for a turn that failed before it produced any
@@ -98437,6 +98550,31 @@ function classifyProviderTurnStartFailureReason(detail) {
 		message
 	};
 }
+/**
+* Classifies a turn that ended mid-flight, after it had already started
+* (CMMD-Center/forge#3562 piece A): a `runtime.error` that reached CMMD as
+* `error_summary`, now also read into a `turn_status: failed` reason.
+*
+* `provider_turn_failed` is the code CMMD's own error_summary heuristic
+* already assigns this class of failure
+* (`shared/forge-work-session-failure-reasons.ts`), so a Forge-sent
+* `turn_status` carrying it lines up with what CMMD already infers instead
+* of teaching it a new code for the common case. `provider_usage_limit`
+* reuses the same wording `classifyRetryableProviderFailure` already treats
+* as a wall that will not clear by retrying (CMMD-Center/forge#3558): a
+* usage-limit message inside a turn that already ended is worth naming
+* specifically, even without the fuller upstream port (see the piece A PR's
+* follow-up issue) that would stop Codex from retrying against that wall in
+* the first place.
+*/
+function classifyMidTurnFailureReason(detail) {
+	const message = detail && detail.trim().length > 0 ? detail : "The runtime reported an error while this run was in progress.";
+	const classified = classifyRetryableProviderFailure(detail);
+	return {
+		code: classified?.kind === "terminal" && classified.reason === "quota" ? "provider_usage_limit" : "provider_turn_failed",
+		message
+	};
+}
 function checkpointTimeoutReason(detail) {
 	return {
 		code: "checkpoint_timeout",
@@ -98571,6 +98709,108 @@ function serializeReplicaMessage(message) {
 	};
 }
 //#endregion
+//#region src/orchestration/turnTerminalStatus.ts
+/**
+* Shared vocabulary between the reactor that records how a turn ended
+* (`Layers/CheckpointReactor.ts`, on the provider's own `turn.completed`
+* event) and the serializer that turns that record into CMMD's `turn_status`
+* terminal event (`runtimeReplication/turnTerminalStatusSerializer.ts`).
+* CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822.
+*/
+/** The activity kind this durable record uses. Never sent to CMMD as-is: the
+* serializer reads it and emits the wire `turn_status` event instead. */
+const TURN_TERMINAL_STATUS_ACTIVITY_KIND = "turn.terminal-status";
+/**
+* CMMD's three-way outcome from the provider's own four-way `turn.completed`
+* state. `cancelled` and `interrupted` both read as `interrupted`: neither
+* the provider wording nor CMMD's Work Session UI distinguishes an
+* operator-cancelled turn from one the provider gave up on mid-flight.
+*/
+function turnTerminalOutcomeFromRuntimeState(state) {
+	if (state === "failed") return "failed";
+	if (state === "completed") return "completed";
+	return "interrupted";
+}
+/**
+* Deterministic activity id for a turn's terminal record: never
+* `crypto.randomUUID()`. The projector replaces an activity by id
+* (`thread.activity-appended`), so a redelivered `turn.completed` for the
+* same turn lands on the same row instead of adding a second one, and the
+* serializer's own `eventId` (`activity:<id>`) inherits the same guarantee.
+*/
+function turnTerminalStatusActivityId(turnId) {
+	return `turn-terminal:${turnId}`;
+}
+//#endregion
+//#region src/runtimeReplication/eventFormatting.ts
+/**
+* Small formatting helpers shared by every source `serializer.ts` folds into
+* a thread's replicated event list. Kept in their own module, with no
+* dependency on `serializer.ts` itself, so a narrower serializer (such as
+* `turnTerminalStatusSerializer.ts`) can reuse them without creating an
+* import cycle back into the file that assembles the full event list.
+*/
+function text(value, max) {
+	const normalized = value.trim();
+	return normalized ? normalized.slice(0, max) : null;
+}
+function canonicalRuntimeEventTimestamp(value) {
+	let timestamp = new Date(value);
+	if (Number.isNaN(timestamp.getTime())) {
+		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
+		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
+	}
+	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
+	return timestamp.toISOString();
+}
+//#endregion
+//#region src/runtimeReplication/turnTerminalStatusSerializer.ts
+function outcomeOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const outcome = payload.outcome;
+	return outcome === "completed" || outcome === "interrupted" || outcome === "failed" ? outcome : null;
+}
+function errorMessageOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const message = payload.errorMessage;
+	return typeof message === "string" && message.trim().length > 0 ? message : null;
+}
+/**
+* Turns the one durable activity `Layers/CheckpointReactor.ts` records when a
+* turn ends into CMMD's `turn_status` terminal event (CMMD-Center/forge#3562
+* piece A, CMMD-Center/CMMD#5822): `completed`, `interrupted`, or `failed`
+* with a structured `reason`. `error_summary` (`serializeFailureActivity` in
+* `serializer.ts`) keeps replicating separately for a mid-turn failure; this
+* is added next to it, never instead of it.
+*
+* The activity's own id is deterministic (`turn-terminal:<turnId>`,
+* `turnTerminalStatusActivityId`), so this event's `eventId` -- built from
+* that id the same way every other activity-sourced event on this thread is
+* (`activity:<id>`) -- can never collide with a second, different terminal
+* status for the same turn: there is exactly one activity row to read it
+* from, and the reactor that writes that row never overwrites it once set.
+*/
+function serializeTurnTerminalStatusActivity(activity) {
+	if (activity.kind !== "turn.terminal-status" || !activity.turnId) return null;
+	const outcome = outcomeOf(activity.payload);
+	if (outcome === null) return null;
+	const reason = outcome === "failed" ? classifyMidTurnFailureReason(errorMessageOf(activity.payload)) : null;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			turnId: activity.turnId,
+			kind: "turn_status",
+			status: outcome,
+			...reason ? { reason: {
+				code: reason.code,
+				message: text(reason.message, 2e3) ?? reason.message
+			} } : {}
+		}
+	};
+}
+//#endregion
 //#region src/runtimeReplication/serializer.ts
 function threadStatus(thread) {
 	if (thread.archivedAt) return "archived";
@@ -98637,19 +98877,6 @@ function serializeRuntimeInventory(snapshot, providerInventory) {
 		...providerInventory === void 0 ? {} : { providers: serializeProviderCatalog(providerInventory) }
 	};
 }
-function text(value, max) {
-	const normalized = value.trim();
-	return normalized ? normalized.slice(0, max) : null;
-}
-function canonicalRuntimeEventTimestamp(value) {
-	let timestamp = new Date(value);
-	if (Number.isNaN(timestamp.getTime())) {
-		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
-		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
-	}
-	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
-	return timestamp.toISOString();
-}
 /** Spread onto an event: present only when the projection knows the turn. */
 function eventTurn(turnId) {
 	return turnId ? { turnId } : {};
@@ -98954,10 +99181,13 @@ function foldReportedUsage(reported) {
 * model, so a mid-thread switch used to republish a finished turn as a second
 * row for spend that happened once (FOR-36388, fixed in FOR-36438).
 */
-/** Turns named on this thread's own rows; hydrated replica rows carry no local turn. */
+/** Turns named on this thread's own rows; hydrated replica rows carry no local
+* turn, and the terminal-status activity (CMMD-Center/forge#3562 piece A) is
+* a wire-protocol source in its own right, not a Usage signal, so it is
+* excluded the same way a `replica.*` activity is. */
 function localTurnIds(thread) {
 	const fromMessages = thread.messages.filter((message) => !message.streaming).map((message) => message.turnId);
-	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.")).map((activity) => activity.turnId);
+	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.") && activity.kind !== "turn.terminal-status").map((activity) => activity.turnId);
 	const turnIds = /* @__PURE__ */ new Set();
 	for (const turnId of [...fromMessages, ...fromActivities]) if (turnId) turnIds.add(turnId);
 	return turnIds;
@@ -98967,8 +99197,12 @@ function settledTurnIds(thread) {
 	if (thread.latestTurn?.state === "running") turnIds.delete(thread.latestTurn.turnId);
 	return turnIds;
 }
+/** A turn's own activities for Usage derivation, excluding the terminal-status
+* activity: that record's own `createdAt` (the turn's very end) must never
+* shift `turnLatestAt`, or an already-acknowledged usage row would rehash
+* the moment a turn that used to have no terminal activity gains one. */
 function turnActivities(thread, turnId) {
-	return thread.activities.filter((activity) => activity.turnId === turnId).toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+	return thread.activities.filter((activity) => activity.turnId === turnId && activity.kind !== "turn.terminal-status").toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
 }
 /** The last thing that happened in the turn: what the Recorded turn is stamped with. */
 function turnLatestAt(thread, turnId, activities) {
@@ -99177,6 +99411,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializePlanActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const turnTerminalStatuses = thread.activities.flatMap((activity) => {
+		const event = serializeTurnTerminalStatusActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	const priorEvents = [
@@ -99186,6 +99424,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...worktreeLaunchActivities,
 		...planActivities,
 		...failureActivities,
+		...turnTerminalStatuses,
 		...recordedTurns,
 		...textGenerations
 	];
@@ -99331,7 +99570,7 @@ function readFailed(detail) {
 		cause: require_Schema$1.squash(cause)
 	}));
 }
-const make$17 = require_Schema$1.gen(function* () {
+const make$16 = require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	const snapshots = yield* ProjectionSnapshotQuery;
 	const outbox = yield* RuntimeReplicationOutbox;
@@ -99377,7 +99616,7 @@ const make$17 = require_Schema$1.gen(function* () {
 		};
 	}) };
 });
-const UsageRecordedSourceLive = require_Schema$1.effect(UsageRecordedSource, make$17);
+const UsageRecordedSourceLive = require_Schema$1.effect(UsageRecordedSource, make$16);
 //#endregion
 //#region src/runtimeReplication/usageSessionLookup.ts
 /**
@@ -99638,7 +99877,7 @@ function askTheLedger(request) {
 		return require_Schema$1.logWarning("usage session lookup failed; local lanes keep their records").pipe(require_Schema$1.annotateLogs({ cause: outcome.error }), require_Schema$1.as(UNAVAILABLE.callFailed));
 	}));
 }
-const make$16 = (fetchImpl, resolveOwnerCredential) => require_Schema$1.gen(function* () {
+const make$15 = (fetchImpl, resolveOwnerCredential) => require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	const sql = yield* require_SqlError.SqlClient;
 	/** The cloud lane: this runtime's own scoped grant. */
@@ -99677,7 +99916,7 @@ const make$16 = (fetchImpl, resolveOwnerCredential) => require_Schema$1.gen(func
 * without a signed-in machine behind it. Both default to the real thing.
 */
 function makeUsageSessionLookupLayer(fetchImpl = fetch, resolveOwnerCredential = resolveOwnerCredentialLive) {
-	return require_Schema$1.effect(UsageSessionLookup, make$16(fetchImpl, resolveOwnerCredential));
+	return require_Schema$1.effect(UsageSessionLookup, make$15(fetchImpl, resolveOwnerCredential));
 }
 const UsageSessionLookupLive = makeUsageSessionLookupLayer();
 //#endregion
@@ -100487,7 +100726,7 @@ function failedRecordedSources(hostId, detail) {
 		message: detail
 	}));
 }
-const make$15 = (hooks) => require_Schema$1.gen(function* () {
+const make$14 = (hooks) => require_Schema$1.gen(function* () {
 	const fileSystem = yield* require_Path.FileSystem;
 	const path = yield* require_Path.Path;
 	const config = yield* ServerConfig;
@@ -100916,7 +101155,7 @@ const make$15 = (hooks) => require_Schema$1.gen(function* () {
 });
 /** The service with a seam into the scan; tests pass their own hooks. */
 function makeUsageServiceLayer(hooks = NOOP_SCAN_HOOKS) {
-	return require_Schema$1.effect(UsageService, make$15(hooks));
+	return require_Schema$1.effect(UsageService, make$14(hooks));
 }
 const UsageServiceLive = makeUsageServiceLayer();
 const DAY_MS = 1440 * 60 * 1e3;
@@ -115410,7 +115649,7 @@ const PgClient = /* @__PURE__ */ require_Schema$1.Service("@effect/sql-pg/PgClie
 * @category constructors
 * @since 1.0.0
 */
-const make$14 = (options) => fromPool({
+const make$13 = (options) => fromPool({
 	...options,
 	acquire: require_Schema$1.gen(function* () {
 		const pool = new Pool({
@@ -115689,7 +115928,7 @@ const layerFrom = (acquire) => require_Schema$1.effectContext(require_Schema$1.m
 * @category layers
 * @since 1.0.0
 */
-const layer$3 = (config) => layerFrom(make$14(config));
+const layer$3 = (config) => layerFrom(make$13(config));
 /**
 * @category constructor
 * @since 1.0.0
@@ -116243,7 +116482,7 @@ var MigrationError = class extends require_Schema$1.TaggedError("MigrationError"
 * @category constructor
 * @since 4.0.0
 */
-const make$13 = ({ dumpSchema = () => require_Schema$1.void_ }) => ({ loader, schemaDirectory, table = "effect_sql_migrations" }) => require_Schema$1.gen(function* () {
+const make$12 = ({ dumpSchema = () => require_Schema$1.void_ }) => ({ loader, schemaDirectory, table = "effect_sql_migrations" }) => require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
 	const ensureMigrationsTable = sql.onDialectOrElse({
 		mssql: () => sql`IF OBJECT_ID(N'${sql.literal(table)}', N'U') IS NULL
@@ -119322,7 +119561,7 @@ const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrati
 * Migrator run function - no schema dumping needed
 * Uses the base Migrator.make without platform dependencies
 */
-const run = make$13({});
+const run = make$12({});
 /**
 * Run all pending migrations.
 *
@@ -150718,7 +150957,7 @@ function formatLoggerMessage(message) {
 	return typeof message === "string" ? message : String(message);
 }
 function makeLineLogger(streamLabel) {
-	return make$33(({ date, message }) => `[${date.toISOString()}] ${streamLabel}: ${formatLoggerMessage(message)}\n`);
+	return make$32(({ date, message }) => `[${date.toISOString()}] ${streamLabel}: ${formatLoggerMessage(message)}\n`);
 }
 function resolveStreamLabel(stream) {
 	switch (stream) {
@@ -150834,7 +151073,7 @@ const makeEventNdjsonLogger = require_Schema$1.fn("makeEventNdjsonLogger")(funct
 		});
 		return;
 	}
-	const stateRef = yield* make$32({
+	const stateRef = yield* make$31({
 		threadWriters: /* @__PURE__ */ new Map(),
 		failedSegments: /* @__PURE__ */ new Set()
 	});
@@ -214176,73 +214415,6 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 function makeCodexAdapterLive(options) {
 	return require_Schema$1.effect(CodexAdapter, makeCodexAdapter(options));
 }
-//#endregion
-//#region ../../packages/shared/src/publicProviderCopy.ts
-const PUBLIC_PROVIDER_LEAK_PATTERNS = [
-	/\bDeepSeek\b/i,
-	/\bKimi\b/i,
-	/\bMoonshot\b/i,
-	/\bdeepseek[-._a-z0-9]*\b/i,
-	/\bkimi[-._a-z0-9]*\b/i,
-	/\bmoonshot[-._a-z0-9]*\b/i,
-	/\bAPEX_API_KEY\b/,
-	/\bDEEPSEEK_API_KEY\b/,
-	/\bKIMI_API_KEY\b/,
-	/\bOPENAI_API_KEY\b/,
-	/\bANTHROPIC_API_KEY\b/,
-	/\bCURSOR_API_KEY\b/,
-	/\bOPENCODE_API_KEY\b/,
-	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
-	/\bProviderValidationError\b/,
-	/\/forge-server\/node_modules\//,
-	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
-	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
-];
-const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-function isProviderRateOrQuotaError(message) {
-	if (!message) return false;
-	const normalized = message.toLowerCase();
-	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
-}
-function providerLifecycleOrAccountCopy(message) {
-	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
-	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
-	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
-	return null;
-}
-/**
-* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
-*
-* Returns a canned, user-facing message — it never echoes the raw input, so it
-* is safe to use even when the source message contains provider internals.
-* Used to give actionable feedback ("model isn't available", "rate-limited",
-* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
-* Returns null when no category can be confidently inferred.
-*/
-function categorizePublicProviderError(message) {
-	if (!message) return null;
-	const m = message.toLowerCase();
-	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
-	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
-	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
-	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
-	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
-	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
-	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
-	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
-	return null;
-}
-function containsPublicProviderLeak(message) {
-	if (!message) return false;
-	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
-}
-function sanitizePublicProviderText(message, options = {}) {
-	if (message === void 0 || message === null) return null;
-	const trimmed = message.trim();
-	if (trimmed.length === 0) return null;
-	if (!containsPublicProviderLeak(trimmed)) return trimmed;
-	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-}
 function resolveApexBaseUrl(settings, config) {
 	return config?.forgeApexBaseUrl || settings.baseUrl || "https://apex.cmmd.ai";
 }
@@ -223671,113 +223843,113 @@ function toRpcClientError(error) {
 }
 //#endregion
 //#region ../../packages/effect-acp/src/rpc.ts
-const InitializeRpc = make$30(AGENT_METHODS.initialize, {
+const InitializeRpc = make$29(AGENT_METHODS.initialize, {
 	payload: InitializeRequest,
 	success: InitializeResponse,
 	error: Error$1
 });
-const AuthenticateRpc = make$30(AGENT_METHODS.authenticate, {
+const AuthenticateRpc = make$29(AGENT_METHODS.authenticate, {
 	payload: AuthenticateRequest,
 	success: AuthenticateResponse,
 	error: Error$1
 });
-const LogoutRpc = make$30(AGENT_METHODS.logout, {
+const LogoutRpc = make$29(AGENT_METHODS.logout, {
 	payload: LogoutRequest,
 	success: LogoutResponse,
 	error: Error$1
 });
-const NewSessionRpc = make$30(AGENT_METHODS.session_new, {
+const NewSessionRpc = make$29(AGENT_METHODS.session_new, {
 	payload: NewSessionRequest,
 	success: NewSessionResponse,
 	error: Error$1
 });
-const LoadSessionRpc = make$30(AGENT_METHODS.session_load, {
+const LoadSessionRpc = make$29(AGENT_METHODS.session_load, {
 	payload: LoadSessionRequest,
 	success: LoadSessionResponse,
 	error: Error$1
 });
-const ListSessionsRpc = make$30(AGENT_METHODS.session_list, {
+const ListSessionsRpc = make$29(AGENT_METHODS.session_list, {
 	payload: ListSessionsRequest,
 	success: ListSessionsResponse,
 	error: Error$1
 });
-const ForkSessionRpc = make$30(AGENT_METHODS.session_fork, {
+const ForkSessionRpc = make$29(AGENT_METHODS.session_fork, {
 	payload: ForkSessionRequest,
 	success: ForkSessionResponse,
 	error: Error$1
 });
-const ResumeSessionRpc = make$30(AGENT_METHODS.session_resume, {
+const ResumeSessionRpc = make$29(AGENT_METHODS.session_resume, {
 	payload: ResumeSessionRequest,
 	success: ResumeSessionResponse,
 	error: Error$1
 });
-const CloseSessionRpc = make$30(AGENT_METHODS.session_close, {
+const CloseSessionRpc = make$29(AGENT_METHODS.session_close, {
 	payload: CloseSessionRequest,
 	success: CloseSessionResponse,
 	error: Error$1
 });
-const PromptRpc = make$30(AGENT_METHODS.session_prompt, {
+const PromptRpc = make$29(AGENT_METHODS.session_prompt, {
 	payload: PromptRequest,
 	success: PromptResponse,
 	error: Error$1
 });
-const SetSessionModelRpc = make$30(AGENT_METHODS.session_set_model, {
+const SetSessionModelRpc = make$29(AGENT_METHODS.session_set_model, {
 	payload: SetSessionModelRequest,
 	success: SetSessionModelResponse,
 	error: Error$1
 });
-const SetSessionConfigOptionRpc = make$30(AGENT_METHODS.session_set_config_option, {
+const SetSessionConfigOptionRpc = make$29(AGENT_METHODS.session_set_config_option, {
 	payload: SetSessionConfigOptionRequest,
 	success: SetSessionConfigOptionResponse,
 	error: Error$1
 });
-const ReadTextFileRpc = make$30(CLIENT_METHODS.fs_read_text_file, {
+const ReadTextFileRpc = make$29(CLIENT_METHODS.fs_read_text_file, {
 	payload: ReadTextFileRequest,
 	success: ReadTextFileResponse,
 	error: Error$1
 });
-const WriteTextFileRpc = make$30(CLIENT_METHODS.fs_write_text_file, {
+const WriteTextFileRpc = make$29(CLIENT_METHODS.fs_write_text_file, {
 	payload: WriteTextFileRequest,
 	success: WriteTextFileResponse,
 	error: Error$1
 });
-const RequestPermissionRpc = make$30(CLIENT_METHODS.session_request_permission, {
+const RequestPermissionRpc = make$29(CLIENT_METHODS.session_request_permission, {
 	payload: RequestPermissionRequest,
 	success: RequestPermissionResponse,
 	error: Error$1
 });
-const ElicitationRpc = make$30(CLIENT_METHODS.session_elicitation, {
+const ElicitationRpc = make$29(CLIENT_METHODS.session_elicitation, {
 	payload: ElicitationRequest,
 	success: ElicitationResponse,
 	error: Error$1
 });
-const CreateTerminalRpc = make$30(CLIENT_METHODS.terminal_create, {
+const CreateTerminalRpc = make$29(CLIENT_METHODS.terminal_create, {
 	payload: CreateTerminalRequest,
 	success: CreateTerminalResponse,
 	error: Error$1
 });
-const TerminalOutputRpc = make$30(CLIENT_METHODS.terminal_output, {
+const TerminalOutputRpc = make$29(CLIENT_METHODS.terminal_output, {
 	payload: TerminalOutputRequest,
 	success: TerminalOutputResponse,
 	error: Error$1
 });
-const ReleaseTerminalRpc = make$30(CLIENT_METHODS.terminal_release, {
+const ReleaseTerminalRpc = make$29(CLIENT_METHODS.terminal_release, {
 	payload: ReleaseTerminalRequest,
 	success: ReleaseTerminalResponse,
 	error: Error$1
 });
-const WaitForTerminalExitRpc = make$30(CLIENT_METHODS.terminal_wait_for_exit, {
+const WaitForTerminalExitRpc = make$29(CLIENT_METHODS.terminal_wait_for_exit, {
 	payload: WaitForTerminalExitRequest,
 	success: WaitForTerminalExitResponse,
 	error: Error$1
 });
-const KillTerminalRpc = make$30(CLIENT_METHODS.terminal_kill, {
+const KillTerminalRpc = make$29(CLIENT_METHODS.terminal_kill, {
 	payload: KillTerminalRequest,
 	success: KillTerminalResponse,
 	error: Error$1
 });
-const AgentRpcs = make$29(InitializeRpc, AuthenticateRpc, LogoutRpc, NewSessionRpc, LoadSessionRpc, ListSessionsRpc, ForkSessionRpc, ResumeSessionRpc, CloseSessionRpc, PromptRpc, SetSessionModelRpc, SetSessionConfigOptionRpc);
-const ClientRpcs = make$29(ReadTextFileRpc, WriteTextFileRpc, RequestPermissionRpc, ElicitationRpc, CreateTerminalRpc, TerminalOutputRpc, ReleaseTerminalRpc, WaitForTerminalExitRpc, KillTerminalRpc);
+const AgentRpcs = make$28(InitializeRpc, AuthenticateRpc, LogoutRpc, NewSessionRpc, LoadSessionRpc, ListSessionsRpc, ForkSessionRpc, ResumeSessionRpc, CloseSessionRpc, PromptRpc, SetSessionModelRpc, SetSessionConfigOptionRpc);
+const ClientRpcs = make$28(ReadTextFileRpc, WriteTextFileRpc, RequestPermissionRpc, ElicitationRpc, CreateTerminalRpc, TerminalOutputRpc, ReleaseTerminalRpc, WaitForTerminalExitRpc, KillTerminalRpc);
 //#endregion
 //#region ../../packages/effect-acp/src/_internal/shared.ts
 const isError = require_Schema$1.is(Error$1);
@@ -223840,7 +224012,7 @@ function runNotificationHandlers(registration, notification) {
 	return require_Schema$1.forEach(registration.handlers, (handler) => handler(notification).pipe(require_Schema$1.catch_(() => require_Schema$1.void_)), { discard: true });
 }
 var AcpClient = class extends require_Schema$1.Service()("effect-acp/AcpClient") {};
-const make$12 = require_Schema$1.fn("effect-acp/AcpClient.make")(function* (stdio, options = {}, terminationError) {
+const make$11 = require_Schema$1.fn("effect-acp/AcpClient.make")(function* (stdio, options = {}, terminationError) {
 	const coreHandlers = {};
 	const notificationHandlers = {
 		sessionUpdate: {
@@ -223908,9 +224080,9 @@ const make$12 = require_Schema$1.fn("effect-acp/AcpClient.make")(function* (stdi
 		[CLIENT_METHODS.terminal_kill]: (payload) => runHandler(coreHandlers.terminalKill, payload, CLIENT_METHODS.terminal_kill).pipe(require_Schema$1.map((result) => result ?? {})),
 		[CLIENT_METHODS.terminal_release]: (payload) => runHandler(coreHandlers.terminalRelease, payload, CLIENT_METHODS.terminal_release).pipe(require_Schema$1.map((result) => result ?? {}))
 	}));
-	yield* make$24(ClientRpcs).pipe(require_Schema$1.provideService(Protocol, transport.serverProtocol), require_Schema$1.provide(clientHandlerLayer), require_Schema$1.forkScoped);
+	yield* make$23(ClientRpcs).pipe(require_Schema$1.provideService(Protocol, transport.serverProtocol), require_Schema$1.provide(clientHandlerLayer), require_Schema$1.forkScoped);
 	let nextRpcRequestId = 1n << 32n;
-	const rpc = yield* make$25(AgentRpcs, { generateRequestId: () => nextRpcRequestId++ }).pipe(require_Schema$1.provideService(Protocol$1, transport.clientProtocol));
+	const rpc = yield* make$24(AgentRpcs, { generateRequestId: () => nextRpcRequestId++ }).pipe(require_Schema$1.provideService(Protocol$1, transport.clientProtocol));
 	return AcpClient.of({
 		raw: {
 			notifications: transport.incoming,
@@ -223997,7 +224169,7 @@ const make$12 = require_Schema$1.fn("effect-acp/AcpClient.make")(function* (stdi
 const layerChildProcess = (handle, options = {}) => {
 	const stdio = makeChildStdio(handle);
 	const terminationError = makeTerminationError(handle);
-	return require_Schema$1.effect(AcpClient, make$12(stdio, options, terminationError));
+	return require_Schema$1.effect(AcpClient, make$11(stdio, options, terminationError));
 };
 //#endregion
 //#region src/provider/acp/AcpSessionRuntime.ts
@@ -225112,7 +225284,7 @@ function makeCursorAdapter(cursorSettings, options) {
 		const nativeEventLogger = options?.nativeEventLogger ?? (options?.nativeEventLogPath !== void 0 ? yield* makeEventNdjsonLogger(options.nativeEventLogPath, { stream: "native" }) : void 0);
 		const managedNativeEventLogger = options?.nativeEventLogger === void 0 ? nativeEventLogger : void 0;
 		const sessions = /* @__PURE__ */ new Map();
-		const threadLocksRef = yield* make$32(/* @__PURE__ */ new Map());
+		const threadLocksRef = yield* make$31(/* @__PURE__ */ new Map());
 		const runtimeEventPubSub = yield* require_Path.unbounded$1();
 		const nowIso = require_Schema$1.map(require_Schema$1.now, require_Schema$1.formatIso);
 		const nextEventId = require_Schema$1.map(nextUUIDv4, (id) => EventId.make(id));
@@ -234827,7 +234999,7 @@ var CheckpointStore = class extends require_Schema$1.Service()("forge/checkpoint
 //#endregion
 //#region src/checkpointing/Layers/CheckpointDiffQuery.ts
 const isTurnDiffResult = require_Schema$1.is(OrchestrationGetTurnDiffResult);
-const make$11 = require_Schema$1.gen(function* () {
+const make$10 = require_Schema$1.gen(function* () {
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const checkpointStore = yield* CheckpointStore;
 	const getTurnDiff = require_Schema$1.fn("getTurnDiff")(function* (input) {
@@ -234919,7 +235091,7 @@ const make$11 = require_Schema$1.gen(function* () {
 		getFullThreadDiff
 	};
 });
-const CheckpointDiffQueryLive = require_Schema$1.effect(CheckpointDiffQuery, make$11);
+const CheckpointDiffQueryLive = require_Schema$1.effect(CheckpointDiffQuery, make$10);
 //#endregion
 //#region src/checkpointing/Layers/CheckpointStore.ts
 /**
@@ -237214,7 +237386,7 @@ const GitStatusBroadcasterLive = require_Schema$1.effect(GitStatusBroadcaster, r
 	const changesPubSub = yield* require_Schema$1.acquireRelease(require_Path.unbounded$1(), (pubsub) => require_Path.shutdown$1(pubsub));
 	const broadcasterScope = yield* require_Schema$1.acquireRelease(require_Schema$1.make$3(), (scope) => require_Schema$1.close(scope, require_Schema$1.void_$1));
 	const cacheRef = yield* require_HttpServer.make$3(/* @__PURE__ */ new Map());
-	const pollersRef = yield* make$32(/* @__PURE__ */ new Map());
+	const pollersRef = yield* make$31(/* @__PURE__ */ new Map());
 	const getCachedStatus = require_Schema$1.fn("getCachedStatus")(function* (cwd) {
 		return yield* require_HttpServer.get$1(cacheRef).pipe(require_Schema$1.map((cache) => cache.get(cwd) ?? null));
 	});
@@ -238786,7 +238958,7 @@ const TextGenerationUsageLive = require_Schema$1.effect(TextGenerationUsage, mak
 //#region ../../packages/shared/src/KeyedCoalescingWorker.ts
 const makeKeyedCoalescingWorker = (options) => require_Schema$1.gen(function* () {
 	const queue = yield* require_Schema$1.acquireRelease(unbounded(), shutdown);
-	const stateRef = yield* make$31({
+	const stateRef = yield* make$30({
 		latestByKey: /* @__PURE__ */ new Map(),
 		queuedKeys: /* @__PURE__ */ new Set(),
 		activeKeys: /* @__PURE__ */ new Set()
@@ -239347,11 +239519,11 @@ const makeTerminalManagerWithOptions = require_Schema$1.fn("makeTerminalManagerW
 	const processKillGraceMs = options.processKillGraceMs ?? DEFAULT_PROCESS_KILL_GRACE_MS;
 	const maxRetainedInactiveSessions = options.maxRetainedInactiveSessions ?? DEFAULT_MAX_RETAINED_INACTIVE_SESSIONS;
 	yield* fileSystem.makeDirectory(logsDir, { recursive: true }).pipe(require_Schema$1.orDie);
-	const managerStateRef = yield* make$32({
+	const managerStateRef = yield* make$31({
 		sessions: /* @__PURE__ */ new Map(),
 		killFibers: /* @__PURE__ */ new Map()
 	});
-	const threadLocksRef = yield* make$32(/* @__PURE__ */ new Map());
+	const threadLocksRef = yield* make$31(/* @__PURE__ */ new Map());
 	const terminalEventListeners = /* @__PURE__ */ new Set();
 	const transitionReceipts = /* @__PURE__ */ new Map();
 	const workerScope = yield* require_Schema$1.make$3("sequential");
@@ -242265,6 +242437,18 @@ var SpriteTaskHoldManager = class {
 		return [...this.#holds.keys()];
 	}
 	/**
+	* Every hold key currently associated with one thread: what `releaseThread`
+	* releases. Read-only and synchronous, so a caller can snapshot what is
+	* live right now and decide later, from that snapshot, what it is still
+	* safe to release -- rather than asking this manager what is live AFTER
+	* some delay of its own, by which point a fresh acquire may have replaced
+	* the very hold the caller meant to release (SpriteTaskHoldReactor's
+	* session.exited handling does exactly this, forge#3602).
+	*/
+	activeTurnIdsForThread(threadId) {
+		return [...this.#holds.entries()].filter(([, hold]) => hold.threadId === threadId).map(([turnId]) => turnId);
+	}
+	/**
 	* `maxRefreshes` bounds a hold that has no terminal event of its own, such as a launch
 	* whose turn may never start. When the budget is spent the hold releases itself.
 	*
@@ -242540,7 +242724,7 @@ var SpriteTaskHoldManager = class {
 	* from silently dropping the holds of the other turns running beside it.
 	*/
 	async releaseThread(threadId) {
-		const turnIds = [...this.#holds.entries()].filter(([, hold]) => hold.threadId === threadId).map(([turnId]) => turnId);
+		const turnIds = this.activeTurnIdsForThread(threadId);
 		await Promise.all(turnIds.map((turnId) => this.release(turnId)));
 	}
 	/**
@@ -290342,7 +290526,7 @@ async function applyWorkerRecoveryPlan(recovery, input) {
 	if (recovery.kind === "recover") await input.onRecover(recovery);
 	return recovery.commandToken;
 }
-const make$10 = require_Schema$1.gen(function* () {
+const make$9 = require_Schema$1.gen(function* () {
 	const orchestration = yield* OrchestrationEngineService;
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const projectionTurns = yield* ProjectionTurnRepository;
@@ -290639,7 +290823,7 @@ const make$10 = require_Schema$1.gen(function* () {
 		reconcile
 	});
 });
-const ApprovedWorkerPlanReactorLive = require_Schema$1.effect(ApprovedWorkerPlanReactor, make$10);
+const ApprovedWorkerPlanReactorLive = require_Schema$1.effect(ApprovedWorkerPlanReactor, make$9);
 //#endregion
 //#region src/orchestration/Services/RuntimeReceiptBus.ts
 /**
@@ -292229,7 +292413,7 @@ function shouldApplyProviderTurnCompleted(activeTurnId, eventTurnId) {
 	if (activeTurnId !== null && eventTurnId === void 0) return false;
 	return activeTurnId === null || eventTurnId === void 0 || sameId$1(activeTurnId, eventTurnId);
 }
-const make$9 = require_Schema$1.fn("make")(function* () {
+const make$8 = require_Schema$1.fn("make")(function* () {
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const claudeUsageTelemetry = yield* ClaudeUsageTelemetry;
 	const claudeUsageScope = yield* require_Schema$1.make$3("parallel");
@@ -292822,7 +293006,7 @@ const make$9 = require_Schema$1.fn("make")(function* () {
 		drain: worker.drain
 	};
 });
-const ProviderRuntimeIngestionLive = require_Schema$1.effect(ProviderRuntimeIngestionService, make$9()).pipe(require_Schema$1.provide$1(ProjectionTurnRepositoryLive));
+const ProviderRuntimeIngestionLive = require_Schema$1.effect(ProviderRuntimeIngestionService, make$8()).pipe(require_Schema$1.provide$1(ProjectionTurnRepositoryLive));
 //#endregion
 //#region src/usage/Layers/ClaudeUsageTelemetry.ts
 /**
@@ -292874,7 +293058,7 @@ const ClaudeUsageTelemetryLive = require_Schema$1.effect(ClaudeUsageTelemetry, r
 */
 const makeDrainableWorker = (process) => require_Schema$1.gen(function* () {
 	const queue = yield* require_Schema$1.acquireRelease(unbounded(), shutdown);
-	const outstanding = yield* make$31(0);
+	const outstanding = yield* make$30(0);
 	yield* take(queue).pipe(require_Schema$1.tap((a) => require_Schema$1.ensuring(process(a), update$1(outstanding, (n) => n - 1))), require_Schema$1.forever, require_Schema$1.forkScoped);
 	const drain = get$1(outstanding).pipe(require_Schema$1.tap((n) => n > 0 ? require_Schema$1.txRetry : require_Schema$1.void_), require_Schema$1.tx);
 	const enqueue = (element) => offer(queue, element).pipe(require_Schema$1.tap(() => update$1(outstanding, (n) => n + 1)), require_Schema$1.tx);
@@ -293025,52 +293209,6 @@ function applyThreadGoalPreamble(goal, input) {
 	return trimmedInput.length > 0 ? `${preamble}\n\n${trimmedInput}` : preamble;
 }
 //#endregion
-//#region src/orchestration/providerRetryableFailure.ts
-/**
-* Classifies a provider turn-start failure as a retryable rate-limit or
-* transient-availability failure (429/503), a terminal failure that names why
-* it will never clear on its own, or unrecognized (null).
-*
-* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
-* trace at all, because nothing in the turn-start path recognized it as a
-* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
-* whether to retry a turn start with backoff, and to name the provider,
-* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
-* watchdog reads once retries are exhausted.
-*
-* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
-* sanitizer uses to recognize a rate-limit message) rather than restating its
-* word list here.
-*/
-const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
-const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
-const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
-const EXPLICIT_429_PATTERN = /\b429\b/;
-const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
-function parseRetryAfterSeconds(detail) {
-	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
-	if (!match) return null;
-	const raw = match[1] ?? match[2];
-	const seconds = raw ? Number(raw) : NaN;
-	return Number.isFinite(seconds) ? seconds : null;
-}
-function classifyRetryableProviderFailure(detail) {
-	if (!detail || detail.trim().length === 0) return null;
-	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
-		kind: "terminal",
-		reason: "quota",
-		message: detail
-	};
-	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
-	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
-	if (!isRateLimited && !isUnavailable) return null;
-	return {
-		kind: "retryable",
-		status: isRateLimited ? 429 : 503,
-		retryAfterSeconds: parseRetryAfterSeconds(detail)
-	};
-}
-//#endregion
 //#region src/orchestration/Layers/ProviderCommandReactor.ts
 function toNonEmptyProviderInput(value) {
 	const normalized = value?.trim();
@@ -293444,7 +293582,7 @@ function buildGeneratedWorktreeBranchName(raw) {
 	const branchFragment = (normalized.startsWith(`forge/`) ? normalized.slice(`${WORKTREE_BRANCH_PREFIX}/`.length) : normalized).replace(/[^a-z0-9/_-]+/g, "-").replace(/\/+/g, "/").replace(/-+/g, "-").replace(/^[./_-]+|[./_-]+$/g, "").slice(0, 64).replace(/[./_-]+$/g, "");
 	return `${WORKTREE_BRANCH_PREFIX}/${branchFragment.length > 0 ? branchFragment : "update"}`;
 }
-const make$8 = require_Schema$1.gen(function* () {
+const make$7 = require_Schema$1.gen(function* () {
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const providerService = yield* ProviderService;
 	const git = yield* GitCore;
@@ -294324,7 +294462,7 @@ const make$8 = require_Schema$1.gen(function* () {
 		})
 	};
 });
-const ProviderCommandReactorLive = require_Schema$1.effect(ProviderCommandReactor, make$8);
+const ProviderCommandReactorLive = require_Schema$1.effect(ProviderCommandReactor, make$7);
 function withProviderTurnStartTimeout(operation, onTimeout, timeout = require_Schema$1.seconds(45)) {
 	return operation.pipe(require_Schema$1.timeout(timeout), require_Schema$1.catchTag("TimeoutError", () => onTimeout));
 }
@@ -295061,7 +295199,7 @@ function findSessionWithCwd(session) {
 		cwd: session.cwd
 	}) : require_Schema$1.none();
 }
-const make$7 = require_Schema$1.gen(function* () {
+const make$6 = require_Schema$1.gen(function* () {
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const providerService = yield* ProviderService;
 	const checkpointStore = yield* CheckpointStore;
@@ -295248,12 +295386,62 @@ const make$7 = require_Schema$1.gen(function* () {
 			createdAt: input.createdAt
 		});
 	});
+	/**
+	* The one durable, deterministic-id activity that records how a turn ended
+	* (CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822): `completed`,
+	* `interrupted` (an abort or a provider cancellation), or `failed` with the
+	* provider's own error message. Recorded here, ahead of every
+	* checkpoint-specific early return below, so it fires for every turn
+	* regardless of whether this workspace can capture a git checkpoint at
+	* all -- unlike a checkpoint, this never depends on `resolveCheckpointCwd`.
+	*
+	* The activity id is derived from the turn id, never `crypto.randomUUID()`,
+	* so a redelivered `turn.completed` for the same turn replaces the same
+	* row rather than adding a second one. The guard below additionally
+	* refuses to touch a turn that already has one: first write wins, so a
+	* later, different signal for the same turn can never overwrite an
+	* outcome CMMD may already have acknowledged.
+	*
+	* Deriving the wire `turn_status` event from a new activity recorded at
+	* the moment the turn actually ends -- not from `thread.latestTurn` or
+	* `thread.checkpoints`, both of which already hold outcomes for turns that
+	* settled before this shipped -- is deliberate: those would insert a brand
+	* new event into history CMMD already acknowledged for every existing
+	* thread, which `RuntimeThreadHistoryConflict` exists specifically to
+	* reject (CMMD-Center/forge#3497). A turn that settled before this shipped
+	* gets no terminal event; only a turn that ends after it does.
+	*/
+	const recordTurnTerminalStatus = require_Schema$1.fn("recordTurnTerminalStatus")(function* (event, thread, turnId) {
+		const activityId = turnTerminalStatusActivityId(turnId);
+		if (thread.activities.some((activity) => activity.id === activityId)) return;
+		const outcome = turnTerminalOutcomeFromRuntimeState(event.payload.state);
+		const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
+		yield* orchestrationEngine.dispatch({
+			type: "thread.activity.append",
+			commandId: serverCommandId$1("turn-terminal-status"),
+			threadId: event.threadId,
+			activity: {
+				id: EventId.make(activityId),
+				tone: outcome === "failed" ? "error" : "info",
+				kind: TURN_TERMINAL_STATUS_ACTIVITY_KIND,
+				summary: `Turn ${outcome}`,
+				payload: {
+					outcome,
+					...outcome === "failed" && event.payload.errorMessage ? { errorMessage: event.payload.errorMessage } : {}
+				},
+				turnId,
+				createdAt: recordedAt
+			},
+			createdAt: recordedAt
+		});
+	});
 	const captureCheckpointFromTurnCompletion = require_Schema$1.fn("captureCheckpointFromTurnCompletion")(function* (event) {
 		const turnId = toTurnId(event.turnId);
 		if (!turnId) return;
 		const readModel = yield* orchestrationEngine.getReadModel();
 		const thread = readModel.threads.find((entry) => entry.id === event.threadId);
 		if (!thread) return;
+		yield* recordTurnTerminalStatus(event, thread, turnId);
 		if (thread.session?.activeTurnId && !sameId(thread.session.activeTurnId, turnId)) return;
 		if (thread.checkpoints.some((checkpoint) => checkpoint.turnId === turnId && checkpoint.status !== "missing")) return;
 		const checkpointCwd = yield* resolveCheckpointCwd({
@@ -295552,7 +295740,10 @@ const make$7 = require_Schema$1.gen(function* () {
 		drain: worker.drain
 	};
 });
-const CheckpointReactorLive = require_Schema$1.effect(CheckpointReactor, make$7);
+const CheckpointReactorLive = require_Schema$1.effect(CheckpointReactor, make$6);
+//#endregion
+//#region src/runtimeReplication/Services/RuntimeReplicationThreadFlush.ts
+var RuntimeReplicationThreadFlush = class extends require_Schema$1.Service()("forge/runtimeReplication/Services/RuntimeReplicationThreadFlush") {};
 //#endregion
 //#region src/orchestration/Layers/SpriteTaskHoldReactor.ts
 /**
@@ -295569,6 +295760,48 @@ const CheckpointReactorLive = require_Schema$1.effect(CheckpointReactor, make$7)
 * `turn.started` / `turn.completed` through `ProviderService.streamEvents`.
 */
 /**
+* Bound for how long a terminal turn event (`turn.completed` / `turn.aborted`)
+* waits on that thread's pending replication before releasing the sprite's
+* turn hold anyway (forge#3600). The sprite freezes about a second after the
+* hold goes, so this is also roughly how much longer a finished turn's sprite
+* stays billed.
+*
+* Justified from the numbers already in this codebase, not a guess: the
+* outbox drain loop claims and posts on a 2 s tick
+* (`Schedule.spaced("2 seconds")` in RuntimeReplication.ts), each CMMD publish
+* attempt has its own 10 s deadline (`RUNTIME_REPLICATION_TIMEOUT_MS` in
+* RuntimeReplicationClient.ts), and `claim()` orders a thread's inventory row
+* ahead of its thread-events row, so one tick can mean two requests before the
+* thread's own batch goes out. 15 s covers one drain tick plus one full
+* publish attempt with headroom for that second request, while still keeping
+* a completed turn's sprite from staying billed anywhere near CMMD's own
+* stalled-turn sweep window (production: about 15 minutes, per forge#3600).
+*/
+const REPLICATION_FLUSH_TIMEOUT_MS = 15e3;
+/**
+* How often the flush re-checks the thread's outbox row while waiting. Short
+* enough that the wait tracks CMMD's actual ack latency (typically well under
+* a second) rather than the bound, long enough that a 15 s wait costs at most
+* about 60 reads against the outbox table.
+*/
+const REPLICATION_FLUSH_POLL_INTERVAL_MS = 250;
+/**
+* A single extra wait before trusting a flush's very first "nothing pending"
+* read (forge#3600 review follow-up). SpriteTaskHoldReactor and
+* RuntimeReplication's own domain-event-driven enqueue are independent
+* subscribers of the same ProviderService.streamEvents broadcast: this
+* reactor can see turn.completed and read the outbox before the OTHER
+* subscriber has finished projecting the turn's final events into a row. In
+* both production runs behind forge#3600, the final assistant_message and
+* turn_usage writes landed about a second apart from each other (00:43:15Z
+* and 00:43:16Z), so an immediate "nothing pending" read cannot be trusted:
+* that is exactly the race that stranded both turns. One settle wait,
+* re-checked once, closes it without turning every genuinely idle turn's
+* release into a long poll -- a thread that already has nothing to replicate
+* pays this once, never the full flushTimeoutMs bound.
+*/
+const REPLICATION_FLUSH_SETTLE_MS = 1e3;
+/**
 * A launch hold refreshes every 60 s, so this budget is about ten minutes. A launch whose turn
 * never starts, because the provider refused it or the process died first, has no event to
 * release it. The budget is what stops that hold from keeping the sprite billing.
@@ -295586,8 +295819,69 @@ const TURN_START_HOLD_MAX_REFRESHES = 10;
 /** The hold id for `holdTurnStart` / `releaseTurnStart`. Distinct from `launchHoldId` on purpose:
 * see the shape's doc comment on `holdTurnStart`. */
 const turnStartHoldId = (key) => `turn-start-${key}`;
-const make$6 = require_Schema$1.gen(function* () {
+const makeSpriteTaskHoldReactor = (overrides = {}) => require_Schema$1.gen(function* () {
 	const providerService = yield* ProviderService;
+	const replicationOutbox = yield* RuntimeReplicationThreadFlush;
+	const replicationRuntimeId = resolveRuntimeReplicationRuntimeId(yield* ServerConfig);
+	const flushTimeoutMs = overrides.replicationFlushTimeoutMs ?? REPLICATION_FLUSH_TIMEOUT_MS;
+	const flushPollIntervalMs = overrides.replicationFlushPollIntervalMs ?? REPLICATION_FLUSH_POLL_INTERVAL_MS;
+	const flushSettleMs = overrides.replicationFlushSettleMs ?? REPLICATION_FLUSH_SETTLE_MS;
+	/**
+	* Waits for CMMD to acknowledge this thread's outstanding replication -- or
+	* for nothing to have been pending in the first place -- before the caller
+	* releases the turn hold that keeps the sprite awake for the outbox drain
+	* loop to run (forge#3600). Bounded so a wedged publish cannot hold a
+	* finished turn's sprite open indefinitely: the bound firing releases
+	* anyway and logs a warning with however much was still outstanding.
+	*
+	* Never fails: a defect from the outbox read (a SQL error, say) is caught
+	* and treated the same as a timeout -- release the hold rather than let a
+	* replication-read bug strand the sprite awake, or worse, crash the worker
+	* that also has to release every OTHER turn's hold.
+	*/
+	const flushThreadReplication = (threadId) => {
+		if (replicationRuntimeId === void 0) return require_Schema$1.void_;
+		const runtimeId = replicationRuntimeId;
+		const streamKey = `thread:${threadId}`;
+		const startedAt = Date.now();
+		const poll = (phase) => replicationOutbox.readPendingCount({
+			runtimeId,
+			streamKey
+		}).pipe(require_Schema$1.flatMap((pending) => {
+			if (pending === 0) {
+				if (phase === "initial") return require_Schema$1.sleep(flushSettleMs).pipe(require_Schema$1.andThen(require_Schema$1.suspend$1(() => poll("settle-recheck"))));
+				return require_Schema$1.succeed({
+					outcome: phase === "settle-recheck" ? "nothing_pending" : "delivered",
+					pending,
+					settled: phase === "settle-recheck"
+				});
+			}
+			if (Date.now() - startedAt >= flushTimeoutMs) return require_Schema$1.succeed({
+				outcome: "timed_out",
+				pending,
+				settled: false
+			});
+			return require_Schema$1.sleep(flushPollIntervalMs).pipe(require_Schema$1.andThen(require_Schema$1.suspend$1(() => poll("steady"))));
+		}));
+		return poll("initial").pipe(require_Schema$1.flatMap(({ outcome, pending, settled }) => {
+			const elapsedMs = Date.now() - startedAt;
+			const logOutcome = require_Schema$1.logInfo("sprite task hold replication flush", {
+				threadId,
+				outcome,
+				pending,
+				elapsedMs,
+				...settled ? { settledMs: flushSettleMs } : {}
+			});
+			return outcome === "timed_out" ? logOutcome.pipe(require_Schema$1.andThen(require_Schema$1.logWarning("sprite task hold replication flush timed out; releasing the turn hold anyway", {
+				threadId,
+				pending,
+				elapsedMs
+			}))) : logOutcome;
+		}), require_Schema$1.catchCause((cause) => require_Schema$1.logError("sprite task hold replication flush failed; releasing the turn hold anyway", {
+			threadId,
+			cause: require_Schema$1.pretty(cause)
+		})));
+	};
 	const manager = makeSpriteTaskHoldManager(process.env, (message, cause) => {
 		require_Schema$1.runFork(require_Schema$1.logWarning(message, { cause: cause instanceof Error ? cause.message : cause }));
 	}, (event) => {
@@ -295616,61 +295910,112 @@ const make$6 = require_Schema$1.gen(function* () {
 	const launchCallers = /* @__PURE__ */ new Map();
 	const launchGeneration = /* @__PURE__ */ new Map();
 	const turnLaunchGeneration = /* @__PURE__ */ new Map();
+	const turnHoldGeneration = /* @__PURE__ */ new Map();
+	let nextTurnHoldGeneration = 0;
 	/**
-	* Belt-and-braces cleanup for a turn reaching a terminal state
-	* (turn.completed or turn.aborted): a launch hold whose hand-off never
-	* confirmed (the turn hold's PUT kept failing) is still up, refreshing on
-	* its own budget, and the turn ending either way means the launch phase is
-	* over. `manager.release(String(turnId))` above can itself wait on the
-	* guest API, so by the time this runs the NEXT stage's own dispatch may
-	* already have acquired a fresh launch hold for the same thread; only
-	* release it here when no such newer launch has started since this turn's
-	* own turn.started was processed (CodeRabbit review, forge#3592). A no-op
-	* when this turn's own generation is stale, or when the hold was already
-	* released.
+	* Release a launch hold left over from a turn hand-off that never
+	* confirmed, once the turn it was covering has reached a terminal state
+	* one way or another. `capturedGeneration` must be read from
+	* `turnLaunchGeneration` by the caller before this runs -- see that map's
+	* own doc comment for why the read cannot happen in here. A no-op when
+	* nothing was captured, when a newer launch has since superseded it, or
+	* when the hold was already released.
 	*/
-	const releaseLingeringLaunchHold = async (turnId, threadId) => {
-		const capturedGeneration = turnLaunchGeneration.get(turnId);
-		turnLaunchGeneration.delete(turnId);
+	const releaseLingeringLaunchHoldIfCurrent = async (threadId, capturedGeneration) => {
 		if (manager === null || capturedGeneration === void 0) return;
 		if (launchGeneration.get(threadId) !== capturedGeneration) return;
 		await manager.release(launchHoldId(threadId));
 	};
+	/**
+	* Release a completed or aborted turn's hold, once its thread's pending
+	* replication has flushed (forge#3600). Skips the release entirely once
+	* `turnHoldGeneration` has moved past `expectedGeneration`: see that map's
+	* own doc comment for the reused-turnId race this guards against.
+	*/
+	const processTerminalItem = (item) => flushThreadReplication(item.threadId).pipe(require_Schema$1.andThen(require_Schema$1.promise(async () => {
+		if (manager === null) return;
+		if (turnHoldGeneration.get(item.turnId) !== item.expectedGeneration) return;
+		await manager.release(item.turnId);
+		await releaseLingeringLaunchHoldIfCurrent(item.threadId, item.capturedLaunchGeneration);
+		if (turnHoldGeneration.get(item.turnId) === item.expectedGeneration) turnHoldGeneration.delete(item.turnId);
+	})));
+	/**
+	* Release every hold a dead session was covering, once its thread's
+	* pending replication has flushed (#3603 item 1: this used to call
+	* `manager.releaseThread` on the spot, with nothing stopping a provider
+	* process that died right after its own turn from stranding that turn's
+	* final events the same way forge#3600 did for a clean completion).
+	* `turns` and `capturedLaunchGeneration` are snapshotted by the caller at
+	* session.exited time, BEFORE the flush runs: a launch or a turn that
+	* starts on this thread WHILE the flush is running must survive. Reading
+	* "what is live for this thread" only AFTER the flush -- the naive
+	* flush-then-releaseThread shape -- would reopen the exact hand-off gap
+	* forge#3589 already closed once, just moved behind a longer wait.
+	*/
+	const processSessionExited = (item) => flushThreadReplication(item.threadId).pipe(require_Schema$1.andThen(require_Schema$1.promise(async () => {
+		if (manager === null) return;
+		await Promise.all(item.turns.filter((turn) => turnHoldGeneration.get(turn.turnId) === turn.expectedGeneration).map(async (turn) => {
+			await manager.release(turn.turnId);
+			if (turnHoldGeneration.get(turn.turnId) === turn.expectedGeneration) turnHoldGeneration.delete(turn.turnId);
+		}));
+		await releaseLingeringLaunchHoldIfCurrent(item.threadId, item.capturedLaunchGeneration);
+	})));
 	const start = require_Schema$1.fn("start")(function* () {
 		if (manager === null) return;
+		const terminalFibers = yield* require_HttpServer.make$4();
+		const onTurnStarted = (turnIdKey, threadId) => {
+			const generation = launchGeneration.get(threadId) ?? 0;
+			turnHoldGeneration.set(turnIdKey, ++nextTurnHoldGeneration);
+			return require_Schema$1.promise(async () => {
+				const outcome = await manager.acquire(turnIdKey, threadId);
+				launchCallers.delete(threadId);
+				turnLaunchGeneration.set(turnIdKey, generation);
+				if (outcome === "succeeded") await manager.release(launchHoldId(threadId));
+			});
+		};
+		/** Shared by turn.completed and turn.aborted: see the dispatch below for why they are distinct wire events but handled identically. */
+		const onTerminalTurnEvent = (turnIdKey, threadIdKey) => {
+			const capturedLaunchGeneration = turnLaunchGeneration.get(turnIdKey);
+			turnLaunchGeneration.delete(turnIdKey);
+			return require_HttpServer.run(terminalFibers, processTerminalItem({
+				turnId: turnIdKey,
+				threadId: threadIdKey,
+				expectedGeneration: turnHoldGeneration.get(turnIdKey) ?? 0,
+				capturedLaunchGeneration
+			})).pipe(require_Schema$1.asVoid);
+		};
+		const onSessionExited = (threadId) => {
+			launchCallers.delete(threadId);
+			const launchKey = launchHoldId(threadId);
+			const turns = manager.activeTurnIdsForThread(threadId).filter((turnId) => turnId !== launchKey).map((turnId) => ({
+				turnId,
+				expectedGeneration: turnHoldGeneration.get(turnId) ?? 0
+			}));
+			for (const turn of turns) turnLaunchGeneration.delete(turn.turnId);
+			const capturedLaunchGeneration = launchGeneration.get(threadId);
+			return require_HttpServer.run(terminalFibers, processSessionExited({
+				threadId,
+				turns,
+				capturedLaunchGeneration
+			})).pipe(require_Schema$1.asVoid);
+		};
 		yield* require_Schema$1.forkScoped(require_Path.runForEach(providerService.streamEvents, (event) => {
 			if (event.type === "turn.started") {
 				const turnId = event.turnId;
 				if (turnId === void 0) return require_Schema$1.void_;
-				const threadId = String(event.threadId);
-				const generation = launchGeneration.get(threadId) ?? 0;
-				return require_Schema$1.promise(async () => {
-					const outcome = await manager.acquire(String(turnId), threadId);
-					launchCallers.delete(threadId);
-					turnLaunchGeneration.set(String(turnId), generation);
-					if (outcome === "succeeded") await manager.release(launchHoldId(threadId));
-				});
+				return onTurnStarted(String(turnId), String(event.threadId));
 			}
 			if (event.type === "turn.completed") {
 				const turnId = event.turnId;
 				if (turnId === void 0) return require_Schema$1.void_;
-				return require_Schema$1.promise(async () => {
-					await manager.release(String(turnId));
-					await releaseLingeringLaunchHold(String(turnId), String(event.threadId));
-				});
+				return onTerminalTurnEvent(String(turnId), String(event.threadId));
 			}
 			if (event.type === "turn.aborted") {
 				const turnId = event.turnId;
 				if (turnId === void 0) return require_Schema$1.void_;
-				return require_Schema$1.promise(async () => {
-					await manager.release(String(turnId));
-					await releaseLingeringLaunchHold(String(turnId), String(event.threadId));
-				});
-			}
-			if (event.type === "session.exited") {
-				launchCallers.delete(String(event.threadId));
-				return require_Schema$1.promise(() => manager.releaseThread(String(event.threadId)));
+				return onTerminalTurnEvent(String(turnId), String(event.threadId));
 			}
+			if (event.type === "session.exited") return onSessionExited(String(event.threadId));
 			return require_Schema$1.void_;
 		}));
 	});
@@ -295708,7 +296053,7 @@ const make$6 = require_Schema$1.gen(function* () {
 		releaseAll: onManager((taskHolds) => taskHolds.releaseAll())
 	};
 });
-const SpriteTaskHoldReactorLive = require_Schema$1.effect(SpriteTaskHoldReactor, make$6);
+const SpriteTaskHoldReactorLive = require_Schema$1.effect(SpriteTaskHoldReactor, makeSpriteTaskHoldReactor());
 //#endregion
 //#region src/orchestration/Layers/PlanTaskCreationReactor.ts
 var PlanMaterializationRequestError = class extends require_Schema$1.TaggedError("PlanMaterializationRequestError") {};
@@ -298988,7 +299333,7 @@ const make$3 = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (options) {
 		excludeLogSpans: options.excludeLogSpans ?? false,
 		clock: yield* require_Schema$1.Clock
 	};
-	return make$33((options) => {
+	return make$32((options) => {
 		exporter.push(makeLogRecord(options, opts));
 	});
 });
@@ -299885,7 +300230,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "88bc45ce168df8c9acf36ad6734d8a66bcb353ec";
+	return "c825d8a74e28836b97016dbd8c2abc730841a622";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -315551,6 +315896,36 @@ const RuntimeReplicationOutboxLive = require_Schema$1.effect(RuntimeReplicationO
 		getDiagnostics
 	});
 }));
+//#endregion
+//#region src/runtimeReplication/Layers/RuntimeReplicationThreadFlush.ts
+/**
+* A thread's outbox row holds its whole unacknowledged batch as one
+* `{ events: [...] }` payload -- RuntimeReplicationOutbox upserts by
+* `(runtime_id, stream_key)`, so there is at most one row per thread -- so the
+* count is that array's length. A row whose payload does not decode that way
+* (a blocked THREAD_STREAM_LOCAL_HISTORY_CONFLICT placeholder, for instance)
+* still represents one undelivered publication, so it counts as 1 rather than
+* 0: a caller bounding a wait on this number must never read a blocked row as
+* "nothing pending".
+*/
+function pendingEventCount(payloadJson) {
+	try {
+		const parsed = JSON.parse(payloadJson);
+		if (Array.isArray(parsed.events)) return parsed.events.length;
+	} catch {}
+	return 1;
+}
+const RuntimeReplicationThreadFlushLive = require_Schema$1.effect(RuntimeReplicationThreadFlush, require_Schema$1.gen(function* () {
+	const sql = yield* require_SqlError.SqlClient;
+	const readPendingCount = (input) => sql`
+        SELECT payload_json AS "payloadJson" FROM runtime_replication_outbox
+        WHERE runtime_id = ${input.runtimeId} AND stream_key = ${input.streamKey}
+      `.pipe(require_Schema$1.map((rows) => {
+		const row = rows[0];
+		return row === void 0 ? 0 : pendingEventCount(row.payloadJson);
+	}), require_Schema$1.orDie);
+	return RuntimeReplicationThreadFlush.of({ readPendingCount });
+}));
 /**
 * Gates guest-side Active Hour measurement (FOR-32642). Shadow-only: even
 * with this on, whether a reported interval is also recorded against the
@@ -322860,7 +323235,7 @@ const makeUserSlot = require_Schema$1.gen(function* () {
 	};
 });
 const makeWorkspaceReadinessState = require_Schema$1.gen(function* () {
-	const slotsRef = yield* make$32(/* @__PURE__ */ new Map());
+	const slotsRef = yield* make$31(/* @__PURE__ */ new Map());
 	const pruneScope = yield* require_Schema$1.make$3("sequential");
 	yield* require_Schema$1.addFinalizer(() => require_Schema$1.close(pruneScope, require_Schema$1.void_$1));
 	/**
@@ -323931,8 +324306,8 @@ const PtyAdapterLive = require_Schema$1.unwrap(require_Schema$1.gen(function* ()
 }));
 const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-DTG5XWSi.cjs")))).layer(bunHttpServerOptions(config));
-	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-RV5QsVeb.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-CtFGbsWr.cjs")))).layer(bunHttpServerOptions(config));
+	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-DyI6OyMg.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -323947,7 +324322,7 @@ const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(functi
 		return layer;
 	}
 }));
-const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(require_Schema$1.provideMerge(RuntimeReplicationClientLive), require_Schema$1.provideMerge(RuntimeReplicationOutboxLive), require_Schema$1.provideMerge(ActiveHourMeterLive.pipe(require_Schema$1.provide$1(RuntimeReplicationOutboxLive))));
+const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(require_Schema$1.provideMerge(RuntimeReplicationClientLive), require_Schema$1.provideMerge(RuntimeReplicationOutboxLive), require_Schema$1.provideMerge(RuntimeReplicationThreadFlushLive), require_Schema$1.provideMerge(ActiveHourMeterLive.pipe(require_Schema$1.provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(require_Schema$1.provideMerge(RuntimeDrainStateLive));
 const RuntimeAwareProviderReactorsLive = require_Schema$1.mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(require_Schema$1.provide$1(RuntimeDrainLayerLive), require_Schema$1.provideMerge(RuntimeDrainStateLive), require_Schema$1.provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(require_Schema$1.provideMerge(PipelineRunClientLive));
@@ -324725,7 +325100,7 @@ const tokenOnlyFlag = boolean$2("token-only").pipe(withDescription$2("Print only
 * it stays least-privilege unless the operator asks otherwise.
 */
 const pairingRoleFlag = choice("role", ["owner", "client"]).pipe(withDescription$2("Role for the issued pairing token."), withDefault("client"));
-const pairingCreateCommand = make$34("create", {
+const pairingCreateCommand = make$33("create", {
 	...authLocationFlags,
 	ttl: ttlFlag,
 	role: pairingRoleFlag,
@@ -324743,24 +325118,24 @@ const pairingCreateCommand = make$34("create", {
 		...require_Schema$1.isSome(flags.baseUrl) ? { baseUrl: flags.baseUrl.value } : {}
 	}));
 }), { quietLogs: flags.json })));
-const pairingListCommand = make$34("list", {
+const pairingListCommand = make$33("list", {
 	...authLocationFlags,
 	json: jsonFlag
 }).pipe(withDescription$1("List active client pairing tokens without revealing their secrets."), withHandler((flags) => runWithAuthControlPlane(flags, (authControlPlane) => require_Schema$1.gen(function* () {
 	yield* log$3(formatPairingCredentialList(yield* authControlPlane.listPairingLinks({ role: "client" }), { json: flags.json }));
 }), { quietLogs: flags.json })));
-const pairingRevokeCommand = make$34("revoke", {
+const pairingRevokeCommand = make$33("revoke", {
 	...authLocationFlags,
 	id: string$4("id").pipe(withDescription$3("Pairing credential id to revoke."))
 }).pipe(withDescription$1("Revoke an active client pairing token."), withHandler((flags) => runWithAuthControlPlane(flags, (authControlPlane) => require_Schema$1.gen(function* () {
 	yield* log$3((yield* authControlPlane.revokePairingLink(flags.id)) ? `Revoked pairing credential ${flags.id}.\n` : `No active pairing credential found for ${flags.id}.\n`);
 }))));
-const pairingCommand = make$34("pairing").pipe(withDescription$1("Manage one-time client pairing tokens."), withSubcommands([
+const pairingCommand = make$33("pairing").pipe(withDescription$1("Manage one-time client pairing tokens."), withSubcommands([
 	pairingCreateCommand,
 	pairingListCommand,
 	pairingRevokeCommand
 ]));
-const sessionIssueCommand = make$34("issue", {
+const sessionIssueCommand = make$33("issue", {
 	...authLocationFlags,
 	ttl: ttlFlag,
 	role: sessionRoleFlag,
@@ -324779,25 +325154,25 @@ const sessionIssueCommand = make$34("issue", {
 		tokenOnly: flags.tokenOnly
 	}));
 }), { quietLogs: flags.json || flags.tokenOnly })));
-const sessionListCommand = make$34("list", {
+const sessionListCommand = make$33("list", {
 	...authLocationFlags,
 	json: jsonFlag
 }).pipe(withDescription$1("List active sessions without revealing bearer tokens."), withHandler((flags) => runWithAuthControlPlane(flags, (authControlPlane) => require_Schema$1.gen(function* () {
 	yield* log$3(formatSessionList(yield* authControlPlane.listSessions(), { json: flags.json }));
 }), { quietLogs: flags.json })));
-const sessionRevokeCommand = make$34("revoke", {
+const sessionRevokeCommand = make$33("revoke", {
 	...authLocationFlags,
 	sessionId: string$4("session-id").pipe(withDescription$3("Session id to revoke."), withSchema$1(AuthSessionId))
 }).pipe(withDescription$1("Revoke an active session."), withHandler((flags) => runWithAuthControlPlane(flags, (authControlPlane) => require_Schema$1.gen(function* () {
 	yield* log$3((yield* authControlPlane.revokeSession(flags.sessionId)) ? `Revoked session ${flags.sessionId}.\n` : `No active session found for ${flags.sessionId}.\n`);
 }))));
-const sessionCommand = make$34("session").pipe(withDescription$1("Manage bearer sessions."), withSubcommands([
+const sessionCommand = make$33("session").pipe(withDescription$1("Manage bearer sessions."), withSubcommands([
 	sessionIssueCommand,
 	sessionListCommand,
 	sessionRevokeCommand
 ]));
-const authCommand = make$34("auth").pipe(withDescription$1("Manage the local auth control plane for headless deployments."), withSubcommands([pairingCommand, sessionCommand]));
-const projectAddCommand = make$34("add", {
+const authCommand = make$33("auth").pipe(withDescription$1("Manage the local auth control plane for headless deployments."), withSubcommands([pairingCommand, sessionCommand]));
+const projectAddCommand = make$33("add", {
 	...projectLocationFlags,
 	workspaceRoot: string$4("path").pipe(withDescription$3("Workspace root to add as a project.")),
 	title: string$3("title").pipe(withDescription$2("Optional project title."), optional$1)
@@ -324817,7 +325192,7 @@ const projectAddCommand = make$34("add", {
 	});
 	return `Added project ${projectId} (${title}) at ${workspaceRoot}.`;
 }))));
-const projectRemoveCommand = make$34("remove", {
+const projectRemoveCommand = make$33("remove", {
 	...projectLocationFlags,
 	project: string$4("project").pipe(withDescription$3("Project id or workspace root to remove."))
 }).pipe(withDescription$1("Remove a project."), withHandler((flags) => runProjectMutation(flags, require_Schema$1.fn("projectRemoveMutation")(function* ({ snapshot, dispatch }) {
@@ -324832,7 +325207,7 @@ const projectRemoveCommand = make$34("remove", {
 	});
 	return `Removed project ${project.id} (${project.title}).`;
 }))));
-const projectRenameCommand = make$34("rename", {
+const projectRenameCommand = make$33("rename", {
 	...projectLocationFlags,
 	project: string$4("project").pipe(withDescription$3("Project id or workspace root to rename.")),
 	title: string$4("title").pipe(withDescription$3("New project title."))
@@ -324855,12 +325230,12 @@ const parseCmmdProjectId = (value) => {
 	const projectId = Number(value);
 	return Number.isSafeInteger(projectId) && projectId > 0 ? require_Schema$1.succeed(projectId) : require_Schema$1.fail(/* @__PURE__ */ new Error(`Invalid CMMD project id '${value}'. Expected a positive integer.`));
 };
-const projectLeadExplainCommand = make$34("explain", {
+const projectLeadExplainCommand = make$33("explain", {
 	...projectLocationFlags,
 	projectId: string$4("project-id").pipe(withDescription$3("Numeric CMMD project id.")),
 	json: jsonFlag
 }).pipe(withDescription$1("Explain canonical Project Lead controller state."), withHandler((flags) => parseCmmdProjectId(flags.projectId).pipe(require_Schema$1.flatMap((projectId) => runProjectLeadQuery(flags, projectId, (explanation) => flags.json ? JSON.stringify(explanation, null, 2) : formatProjectLeadExplanation(projectId, explanation))))));
-const projectLeadDoctorCommand = make$34("doctor", {
+const projectLeadDoctorCommand = make$33("doctor", {
 	...projectLocationFlags,
 	projectId: string$4("project-id").pipe(withDescription$3("Numeric CMMD project id.")),
 	json: jsonFlag
@@ -324868,7 +325243,7 @@ const projectLeadDoctorCommand = make$34("doctor", {
 	const report = diagnoseProjectLead(projectId, explanation);
 	return flags.json ? JSON.stringify(report, null, 2) : formatProjectLeadDoctor(report);
 })))));
-const projectLeadCommand = make$34("lead").pipe(withDescription$1("Inspect the CMMD-owned Project Lead controller."), withSubcommands([projectLeadExplainCommand, projectLeadDoctorCommand]));
+const projectLeadCommand = make$33("lead").pipe(withDescription$1("Inspect the CMMD-owned Project Lead controller."), withSubcommands([projectLeadExplainCommand, projectLeadDoctorCommand]));
 const connectStatePathFor = require_Schema$1.fn("connectStatePathFor")(function* (flags) {
 	const config = yield* resolveCliAuthConfig(flags, yield* LogLevel);
 	return (yield* require_Path.Path).join(config.stateDir, "connect.json");
@@ -324881,18 +325256,18 @@ const runConnectCommand = (flags, update) => require_Schema$1.gen(function* () {
 	const state = next ?? current;
 	yield* log$3(flags.json ? JSON.stringify(state, null, 2) : formatConnectStatus(state));
 });
-const connectStatusCommand = make$34("status", {
+const connectStatusCommand = make$33("status", {
 	...projectLocationFlags,
 	json: jsonFlag
 }).pipe(withDescription$1("Show whether this machine is offered to CMMD over the relay."), withHandler((flags) => runConnectCommand(flags, () => null)));
-const connectLinkCommand = make$34("link", {
+const connectLinkCommand = make$33("link", {
 	...projectLocationFlags,
 	json: jsonFlag
 }).pipe(withDescription$1("Offer this machine to CMMD over the relay on the next start."), withHandler((flags) => runConnectCommand(flags, (current) => ({
 	...current,
 	linked: true
 }))));
-const connectUnlinkCommand = make$34("unlink", {
+const connectUnlinkCommand = make$33("unlink", {
 	...projectLocationFlags,
 	json: jsonFlag
 }).pipe(withDescription$1("Stop offering this machine, keeping its runtime identity so relinking is the same device."), withHandler((flags) => runConnectCommand(flags, (current) => ({
@@ -324903,7 +325278,7 @@ const noBrowserLoginFlag = boolean$2("no-browser").pipe(withDescription$2("Print
 const CONNECT_CLI_CLIENT_ID = "cmmd-forge-web";
 const connectSecretsFor = (stateDir) => createFileSecretStorage({ keyPath: node_path.join(stateDir, "connect-secret.key") });
 const loginEmailFlag = string$3("email").pipe(withDescription$2("Sign in with this CMMD email and a password prompt instead of the browser flow."), optional$1);
-const connectLoginCommand = make$34("login", {
+const connectLoginCommand = make$33("login", {
 	...projectLocationFlags,
 	noBrowser: noBrowserLoginFlag,
 	email: loginEmailFlag
@@ -324970,7 +325345,7 @@ const connectLoginCommand = make$34("login", {
 	});
 	yield* log$3("Signed in to CMMD. Run `cmmd-forge connect link` to offer this machine.");
 })));
-const connectLogoutCommand = make$34("logout", { ...projectLocationFlags }).pipe(withDescription$1("Sign this machine out of CMMD and stop offering it."), withHandler((flags) => require_Schema$1.gen(function* () {
+const connectLogoutCommand = make$33("logout", { ...projectLocationFlags }).pipe(withDescription$1("Sign this machine out of CMMD and stop offering it."), withHandler((flags) => require_Schema$1.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* LogLevel);
 	const statePath = node_path.join(config.stateDir, "connect.json");
 	writeConnectState(statePath, {
@@ -324980,14 +325355,14 @@ const connectLogoutCommand = make$34("logout", { ...projectLocationFlags }).pipe
 	clearConnectCredential(node_path.join(config.stateDir, "connect-credential.json"));
 	yield* log$3("Signed out of CMMD and stopped offering this machine.");
 })));
-const connectCommand = make$34("connect").pipe(withDescription$1("Offer this machine to CMMD so other surfaces can reach it."), withSubcommands([
+const connectCommand = make$33("connect").pipe(withDescription$1("Offer this machine to CMMD so other surfaces can reach it."), withSubcommands([
 	connectStatusCommand,
 	connectLoginCommand,
 	connectLogoutCommand,
 	connectLinkCommand,
 	connectUnlinkCommand
 ]));
-const projectCommand = make$34("project").pipe(withDescription$1("Manage projects."), withSubcommands([
+const projectCommand = make$33("project").pipe(withDescription$1("Manage projects."), withSubcommands([
 	projectAddCommand,
 	projectRemoveCommand,
 	projectRenameCommand,
@@ -325002,12 +325377,12 @@ const runServerCommand = (flags, options) => require_Schema$1.gen(function* () {
 	});
 	return yield* runServer.pipe(require_Schema$1.provideService(ServerConfig, config));
 });
-const startCommand = make$34("start", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server."), withHandler((flags) => runServerCommand(flags)));
-const serveCommand = make$34("serve", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server without opening a browser and print headless pairing details."), withHandler((flags) => runServerCommand(flags, {
+const startCommand = make$33("start", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server."), withHandler((flags) => runServerCommand(flags)));
+const serveCommand = make$33("serve", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server without opening a browser and print headless pairing details."), withHandler((flags) => runServerCommand(flags, {
 	startupPresentation: "headless",
 	forceAutoBootstrapProjectFromCwd: false
 })));
-const cli = make$34("cmmd-forge", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server."), withHandler((flags) => runServerCommand(flags)), withSubcommands([
+const cli = make$33("cmmd-forge", { ...sharedServerCommandFlags }).pipe(withDescription$1("Run the Forge server."), withHandler((flags) => runServerCommand(flags)), withSubcommands([
 	startCommand,
 	serveCommand,
 	authCommand,