@evident-ai/cli 3.5.2-dev.ffa823b → 3.6.1-dev.10d71b3

package/dist/index.js

@@ -100,6 +100,26 @@ function clearCredentials() {
   credentials.set("byEndpoint", byEndpoint);
   hardenCredentialsPermissions();
 }
+function getManagedInferenceCredential(runnerId) {
+  hardenCredentialsPermissions();
+  return credentials.get("managedInferenceByEndpoint")?.[credentialsKey()]?.[runnerId];
+}
+function setManagedInferenceCredential(runnerId, credential) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  byEndpoint[credentialsKey()] ??= {};
+  byEndpoint[credentialsKey()][runnerId] = credential;
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
+function clearManagedInferenceCredential(runnerId) {
+  const byEndpoint = credentials.get("managedInferenceByEndpoint") ?? {};
+  const runners = byEndpoint[credentialsKey()];
+  if (!runners || !(runnerId in runners)) return;
+  delete runners[runnerId];
+  if (Object.keys(runners).length === 0) delete byEndpoint[credentialsKey()];
+  credentials.set("managedInferenceByEndpoint", byEndpoint);
+  hardenCredentialsPermissions();
+}
 function clearAllCredentials() {
   credentials.clear();
   hardenCredentialsPermissions();
@@ -119,13 +139,13 @@ function getCliName() {
 // src/lib/api.ts
 async function request(path, method, body, headers = {}) {
   const url = `${getApiUrlConfig()}${path}`;
-  const requestHeaders = {
+  const requestHeaders2 = {
     "Content-Type": "application/json",
     ...headers
   };
   const response = await fetch(url, {
     method,
-    headers: requestHeaders,
+    headers: requestHeaders2,
     body: body ? JSON.stringify(body) : void 0
   });
   if (!response.ok) {
@@ -703,6 +723,9 @@ async function reportResourceUsage(agentId, authHeader, usage) {
     opencode_db_bytes: usage.opencodeDbBytes
   });
 }
+async function reportSessionDeletions(agentId, authHeader, deletions) {
+  return postBestEffort(`/runners/${agentId}/session-deletions`, authHeader, { deletions });
+}
 async function getRunnerCredentialVault(agentId, authHeader) {
   const empty = { prefix: null, vaultId: null, source: null };
   try {
@@ -1156,9 +1179,9 @@ async function claudeUsage() {
 }
 
 // src/commands/run.ts
-import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { isAbsolute as isAbsolute4, join as join12, parse, resolve as resolvePath2 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { isAbsolute as isAbsolute4, join as join14, parse, resolve as resolvePath2 } from "node:path";
 import chalk7 from "chalk";
 
 // ../../packages/types/src/agents/index.ts
@@ -1287,13 +1310,113 @@ var TUNNEL_USAGE_REARM_PING_PATH = "/__evident/usage-rearm";
 var MAX_FILE_PUSH_BYTES = 64 * 1024;
 var MAX_FILE_SYNC_DIRECTORIES = 16;
 
+// ../../packages/types/src/credential-proxy-native-config.ts
+var EVIDENT_PROXY_TOKEN_REFERENCE = "{env:EVIDENT_PROXY_TOKEN}";
+var CLAUDE_PROVIDER = {
+  namespace: "evident-claude",
+  name: "Evident Claude credential proxy",
+  npm: "@ai-sdk/anthropic"
+};
+var NATIVE_PROVIDERS = {
+  claude: CLAUDE_PROVIDER,
+  anthropic: CLAUDE_PROVIDER,
+  codex: {
+    namespace: "evident-codex",
+    name: "Evident Codex credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  openai: {
+    namespace: "evident-openai",
+    name: "Evident OpenAI credential proxy",
+    npm: "@ai-sdk/openai"
+  },
+  kimi: {
+    namespace: "evident-kimi",
+    name: "Evident Kimi credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-kimi"
+  },
+  antigravity: {
+    namespace: "evident-antigravity",
+    name: "Evident Antigravity credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-antigravity"
+  },
+  xai: {
+    namespace: "evident-xai",
+    name: "Evident xAI credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-xai"
+  },
+  mistral: {
+    namespace: "evident-mistral",
+    name: "Evident Mistral credential proxy",
+    npm: "@ai-sdk/openai-compatible",
+    sdkName: "evident-mistral"
+  }
+};
+var CREDENTIAL_PROXY_NATIVE_NAMESPACES = [
+  ...new Set(Object.values(NATIVE_PROVIDERS).map(({ namespace }) => namespace))
+];
+function credentialProxyInferenceUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  return /\/v1$/i.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+function buildCredentialProxyNativeConfig({
+  inferenceBaseUrl,
+  modelDescriptors
+}) {
+  const baseURL = credentialProxyInferenceUrl(inferenceBaseUrl);
+  const providers = {};
+  const unsupportedProviders = /* @__PURE__ */ new Set();
+  for (const descriptor of modelDescriptors) {
+    const definition = NATIVE_PROVIDERS[descriptor.provider.trim().toLowerCase()];
+    if (!definition) {
+      unsupportedProviders.add(descriptor.provider.trim() || descriptor.provider);
+      continue;
+    }
+    providers[definition.namespace] ??= definition.npm === "@ai-sdk/anthropic" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, authToken: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : definition.npm === "@ai-sdk/openai" ? {
+      name: definition.name,
+      npm: definition.npm,
+      options: { baseURL, apiKey: EVIDENT_PROXY_TOKEN_REFERENCE },
+      models: {}
+    } : {
+      name: definition.name,
+      npm: definition.npm,
+      options: {
+        name: definition.sdkName,
+        baseURL,
+        apiKey: EVIDENT_PROXY_TOKEN_REFERENCE
+      },
+      models: {}
+    };
+    providers[definition.namespace].models[descriptor.id] = { name: descriptor.id };
+  }
+  return {
+    unsupportedProviders: [...unsupportedProviders],
+    config: {
+      $schema: "https://opencode.ai/config.json",
+      provider: providers
+    }
+  };
+}
+
 // ../../packages/types/src/logging/index.ts
 var CORRELATION_ID_HEADER = "x-evident-correlation-id";
 var FORWARD_FAILURE_REASON_HEADER = "X-Evident-Failure-Reason";
 function log(level, event, fields) {
   const method = level === "debug" ? "log" : level;
   try {
-    console[method]("[evident]", JSON.stringify({ level, event, ...fields }));
+    const payload = Object.fromEntries(
+      Object.entries({ level, event, ...fields }).filter(([, value]) => value !== void 0)
+    );
+    const secondArgument = globalThis.navigator?.userAgent === "Cloudflare-Workers" ? payload : JSON.stringify(payload);
+    console[method]("[evident]", secondArgument);
   } catch (err) {
     console.error(
       "[evident] log_serialize_failed",
@@ -1322,7 +1445,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.5.2-dev.ffa823b" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.10d71b3" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -1403,7 +1526,7 @@ async function flushEvents() {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), FLUSH_TIMEOUT_MS);
     try {
-      const request2 = {
+      const request3 = {
         events,
         client_type: "cli",
         client_version: CLI_VERSION
@@ -1414,7 +1537,7 @@ async function flushEvents() {
           "Content-Type": "application/json",
           Authorization: authHeader
         },
-        body: JSON.stringify(request2),
+        body: JSON.stringify(request3),
         signal: controller.signal
       });
       if (!response.ok) {
@@ -2071,7 +2194,8 @@ function createDependencyInstallDiagnosticReporter({
 var FORWARDED_LEVELS_BY_SOURCE = {
   "cli.run": /* @__PURE__ */ new Set(["warn", "error"]),
   opencode: /* @__PURE__ */ new Set(["warn", "error"]),
-  "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"])
+  "cli.session-cleanup": /* @__PURE__ */ new Set(["info", "warn", "error"]),
+  "cli.runtime-provenance": /* @__PURE__ */ new Set(["info", "warn", "error"])
 };
 var SEVERITY_BY_LEVEL = {
   info: "info",
@@ -2517,6 +2641,122 @@ function isSessionDbRecoveryRecord(value) {
   );
 }
 
+// src/lib/opencode/session-deletion-report.ts
+import { appendFileSync, mkdirSync, readFileSync as readFileSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { dirname as dirname4, join as join4 } from "node:path";
+var SESSION_DELETION_SPOOL_MAX_RECORDS = 1e3;
+var MAX_DIAGNOSTIC_LENGTH = 200;
+function sessionDeletionReportPath(homeDir, env) {
+  const override = env.EVIDENT_SESSION_DELETION_REPORT?.trim();
+  return override || join4(homeDir, ".local", "state", "evident", "session-deletions.jsonl");
+}
+function appendSessionDeletionRecords(path, records) {
+  if (records.length === 0) return 0;
+  mkdirSync(dirname4(path), { recursive: true });
+  const current = readSessionDeletionRecords(path);
+  if (current.readError !== null) {
+    throw new Error(`cannot enforce the spool limit after reading ${path}: ${current.readError}`);
+  }
+  const combined = [...current.records, ...records];
+  const kept = combined.slice(-SESSION_DELETION_SPOOL_MAX_RECORDS);
+  const dropped = combined.length - kept.length;
+  if (dropped > 0) {
+    writeFileSync(path, `${kept.map((record) => JSON.stringify(record)).join("\n")}
+`, "utf8");
+  } else {
+    appendFileSync(path, `${records.map((record) => JSON.stringify(record)).join("\n")}
+`, "utf8");
+  }
+  return dropped;
+}
+function readSessionDeletionRecords(path) {
+  let content;
+  try {
+    content = readFileSync3(path, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return { records: [], skippedLines: 0, readError: null };
+    const readError = boundedError(error2);
+    console.error(`[session-deletion-report] could not read ${path}: ${readError}`);
+    return { records: [], skippedLines: 0, readError };
+  }
+  let skippedLines = 0;
+  const records = content.split("\n").flatMap((line) => {
+    if (!line.trim()) return [];
+    const record = parseRecord(line, path);
+    if (record) return [record];
+    skippedLines++;
+    return [];
+  });
+  return { records, skippedLines, readError: null };
+}
+function removeDeliveredSessionDeletionRecords(path, delivered) {
+  let content;
+  try {
+    content = readFileSync3(path, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return;
+    console.error(
+      `[session-deletion-report] could not read ${path} before removing delivered records: ${boundedError(error2)}`
+    );
+    throw error2;
+  }
+  const toRemove = /* @__PURE__ */ new Map();
+  for (const record of delivered) {
+    toRemove.set(record.opencode_session_id, (toRemove.get(record.opencode_session_id) ?? 0) + 1);
+  }
+  const remaining = [];
+  for (const line of content.split("\n")) {
+    if (!line.trim()) continue;
+    const record = parseRecord(line, path);
+    const count = record ? toRemove.get(record.opencode_session_id) ?? 0 : 0;
+    if (record && count > 0) {
+      if (count === 1) toRemove.delete(record.opencode_session_id);
+      else toRemove.set(record.opencode_session_id, count - 1);
+    } else {
+      remaining.push(line);
+    }
+  }
+  try {
+    if (remaining.length === 0) unlinkSync2(path);
+    else writeFileSync(path, `${remaining.join("\n")}
+`, "utf8");
+  } catch (error2) {
+    if (isMissingFile(error2)) return;
+    console.error(
+      `[session-deletion-report] could not write ${path} after removing delivered records: ${boundedError(error2)}`
+    );
+    throw error2;
+  }
+}
+function parseRecord(line, path) {
+  try {
+    const value = JSON.parse(line);
+    if (isSessionDeletionRecord(value)) return value;
+    console.error(`[session-deletion-report] skipped malformed record in ${path}: invalid shape`);
+    return null;
+  } catch (error2) {
+    console.error(
+      `[session-deletion-report] skipped malformed record in ${path}: ${boundedError(error2)}`
+    );
+    return null;
+  }
+}
+function isSessionDeletionRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const policy = record.policy;
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) return false;
+  const fields = policy;
+  return typeof record.opencode_session_id === "string" && record.opencode_session_id.length > 0 && typeof record.deleted_at === "string" && record.reason === "auto_cleanup" && (fields.max_age_ms === null || typeof fields.max_age_ms === "number") && (fields.max_count === null || typeof fields.max_count === "number") && (fields.last_activity_at === null || typeof fields.last_activity_at === "string");
+}
+function isMissingFile(error2) {
+  return error2 instanceof Error && "code" in error2 && error2.code === "ENOENT";
+}
+function boundedError(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  return message.slice(0, MAX_DIAGNOSTIC_LENGTH);
+}
+
 // src/lib/opencode/auth.ts
 function buildOpenCodeBasicAuthHeader(password) {
   return `Basic ${Buffer.from(["opencode", password].join(":")).toString("base64")}`;
@@ -2867,6 +3107,58 @@ async function listAllSessions(port, client) {
   }
   return { sessions };
 }
+var INTERRUPT_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ABORT_ERR",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENETUNREACH",
+  "ENOTFOUND",
+  "ETIMEDOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function interruptFailureDiagnostic(error2) {
+  const message = error2 instanceof Error ? error2.message : "";
+  const httpStatus = /^OpenCode request failed: HTTP ([1-5]\d{2})(?::|$)/.exec(message)?.[1];
+  if (httpStatus) return `HTTP ${httpStatus}`;
+  const candidates = [error2, error2 instanceof Error ? error2.cause : void 0];
+  for (const candidate of candidates) {
+    if (typeof candidate !== "object" || candidate === null || !("code" in candidate)) continue;
+    const code = candidate.code;
+    if (typeof code === "string" && INTERRUPT_NETWORK_CODES.has(code)) {
+      return redactDiagnosticText(`network ${code}`).slice(0, 120);
+    }
+  }
+  const name = error2 instanceof Error && ["AbortError", "Error", "TimeoutError", "TypeError"].includes(error2.name) ? error2.name : "unknown error";
+  return redactDiagnosticText(`request threw ${name}`).slice(0, 120);
+}
+async function interruptSession(port, id, client) {
+  if (client?.version === "v2") {
+    try {
+      await interruptV2Session(client, id);
+      return { kind: "confirmed_stopped" };
+    } catch (error2) {
+      return { kind: "not_confirmed", diagnostic: interruptFailureDiagnostic(error2) };
+    }
+  }
+  try {
+    const res = await requestWithClient(
+      port,
+      client,
+      `/session/${id}/abort`,
+      { method: "POST" },
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
+    if (res.status >= 200 && res.status < 300) {
+      return { kind: "confirmed_stopped", status: res.status };
+    }
+    return { kind: "not_confirmed", status: res.status };
+  } catch (error2) {
+    return { kind: "threw", diagnostic: interruptFailureDiagnostic(error2) };
+  }
+}
 async function deleteSession(port, id, client) {
   if (client?.version === "v2") return deleteV2Session(client, id);
   try {
@@ -3036,6 +3328,52 @@ async function getModelAttachmentCapability(port, model, client) {
     return null;
   }
 }
+async function isPinnedProviderLoaded(port, model, client) {
+  if (client?.version === "v2") return null;
+  const { model: baseModel } = splitModelVariant(model);
+  if (!baseModel) return null;
+  const slash = baseModel.indexOf("/");
+  if (slash <= 0) return null;
+  const providerId = baseModel.slice(0, slash);
+  try {
+    const res = await requestWithClient(port, client, "/config/providers");
+    if (!res.ok) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers returned HTTP ${res.status} (port ${port})`
+      );
+      return null;
+    }
+    const body = await res.json();
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body was not a plain object (port ${port})`
+      );
+      return null;
+    }
+    const providers = body.providers;
+    if (!Array.isArray(providers)) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers body had no providers array (port ${port})`
+      );
+      return null;
+    }
+    const providerIds = providers.filter(
+      (provider) => provider !== null && typeof provider === "object" && typeof provider.id === "string"
+    ).map((provider) => provider.id);
+    if (providerIds.length === 0) {
+      console.error(
+        `[isPinnedProviderLoaded] GET /config/providers had no provider entries with string ids (port ${port})`
+      );
+      return null;
+    }
+    return providerIds.includes(providerId);
+  } catch (err) {
+    console.error(
+      `[isPinnedProviderLoaded] GET /config/providers failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
 async function buildFileParts(attachments, capable) {
   const outcomes = [];
   const parts = [];
@@ -3450,9 +3788,17 @@ function isPreamblePinnedRunning(messages, userMessageId) {
   const reply = findLastAssistantReplyFor(messages, userMessageId);
   return completedOf(reply) != null && finishOf(reply) === "tool-calls";
 }
+function isMidFlightPinnedRunning(messages, userMessageId) {
+  if (messageRunState(messages, userMessageId) !== "running") return false;
+  const reply = findLastAssistantReplyFor(messages, userMessageId);
+  return reply !== null && isAssistantInFlight(reply) && completedOf(reply) == null;
+}
 function isB2AbandonmentConfirmed(params) {
   return params.pinnedForMs >= params.minPinnedMs && params.descendantOngoing === false && params.rootOngoing === false;
 }
+function isMidFlightOrphanConfirmed(params) {
+  return params.pinnedForMs >= params.minPinnedMs && params.notOngoingStreak >= params.minNotOngoingStreak;
+}
 function isAmbiguousTerminalFinish(m) {
   if (completedOf(m) == null) return false;
   if (errorOf(m) != null) return false;
@@ -3518,19 +3864,32 @@ function isAbortedTerminalReply(messages, userMessageId) {
   }
   return false;
 }
+var CLAUDE_AUTH_EXPIRY_MESSAGES = Object.freeze([
+  "Claude Code credentials are unavailable or expired. Run `claude` to refresh them."
+]);
+function extractReplyErrorShape(reply) {
+  const error2 = errorOf(reply);
+  if (error2 == null || typeof error2 !== "object") {
+    return { name: null, statusCode: null };
+  }
+  const e = error2;
+  const name = typeof e.name === "string" ? e.name.slice(0, 100) : null;
+  const data = e.data;
+  const statusCode = typeof data?.statusCode === "number" && Number.isFinite(data.statusCode) ? data.statusCode : null;
+  return { name, statusCode };
+}
 function classifyReplyAuthError(reply) {
   const error2 = errorOf(reply);
   if (error2 == null || typeof error2 !== "object") return null;
   const e = error2;
   const replyProviderId = reply?.info?.providerID ?? null;
   const replyModelId = reply?.info?.modelID ?? null;
+  const data = e.data;
   if (e.name === "ProviderAuthError") {
-    const data = e.data;
     const providerId = typeof data?.providerID === "string" && data.providerID || replyProviderId;
     return { kind: "model_auth", providerId, modelId: replyModelId, reason: "missing" };
   }
   if (e.name === "APIError") {
-    const data = e.data;
     const statusCode = data?.statusCode;
     if (statusCode === 401 || statusCode === 403) {
       return {
@@ -3541,11 +3900,23 @@ function classifyReplyAuthError(reply) {
       };
     }
   }
+  const errorMessage3 = typeof data?.message === "string" ? data.message : typeof e.message === "string" ? e.message : null;
+  if (errorMessage3 !== null && CLAUDE_AUTH_EXPIRY_MESSAGES.some((knownMessage) => errorMessage3.includes(knownMessage))) {
+    return {
+      kind: "model_auth",
+      providerId: typeof data?.providerID === "string" && data.providerID || replyProviderId,
+      modelId: replyModelId,
+      reason: "rejected"
+    };
+  }
   return null;
 }
 function messageFailure(messages, userMessageId) {
   return classifyReplyAuthError(findLastAssistantReplyFor(messages, userMessageId));
 }
+function isProviderModelNotFoundError(reason) {
+  return reason.includes("Model not found:");
+}
 function findLatestSubagentAuthOutcome(messages, sinceMs) {
   if (!messages || messages.length === 0) return null;
   for (let i = messages.length - 1; i >= 0; i--) {
@@ -3754,23 +4125,49 @@ async function readSessionErrorStream(port, options, client) {
     if (reader) void reader.cancel().catch(() => void 0);
   }
 }
-async function reloadProviderCache(port, client) {
-  if (client?.version === "v2") return;
+async function disposeAndReloadProviderConfig(port, client) {
+  if (client?.version === "v2") return { outcome: "skipped_v2" };
   try {
-    const res = await requestWithClient(port, client, "/config", {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({})
-    });
+    const res = await requestWithClient(
+      port,
+      client,
+      "/config",
+      {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({})
+      },
+      { allowStatuses: ALL_HTTP_STATUSES }
+    );
     if (!res.ok) {
       console.error(
-        `[reloadProviderCache] PATCH /config returned HTTP ${res.status} (port ${port})`
+        `[disposeAndReloadProviderConfig] PATCH /config returned HTTP ${res.status} (port ${port})`
       );
+      return { outcome: "failed", status: res.status, detail: null };
     }
+    return { outcome: "reloaded" };
   } catch (err) {
     console.error(
-      `[reloadProviderCache] PATCH /config failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
+      `[disposeAndReloadProviderConfig] PATCH /config failed (port ${port}): ${err instanceof Error ? err.message : String(err)}`
     );
+    return {
+      outcome: "failed",
+      status: null,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function probeOpenCodeRequestReadiness(port, client) {
+  try {
+    const res = await requestWithClient(port, client, "/config", void 0, {
+      allowStatuses: ALL_HTTP_STATUSES
+    });
+    const body = await res.text();
+    return { ok: res.ok, status: res.status, bodyEmpty: body.trim().length === 0, detail: null };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    console.error(`[probeOpenCodeRequestReadiness] GET /config failed (port ${port}): ${detail}`);
+    return { ok: false, status: null, bodyEmpty: null, detail };
   }
 }
 
@@ -4166,6 +4563,11 @@ async function listV2Permissions(client, sessionId) {
     return null;
   }
 }
+async function interruptV2Session(client, sessionId) {
+  await client.request(`/api/session/${encodeURIComponent(sessionId)}/interrupt`, {
+    method: "POST"
+  });
+}
 async function getV2ActiveSessions(client) {
   try {
     const body = await readJson(await client.request("/api/session/active"));
@@ -4262,13 +4664,13 @@ async function readV2SessionErrorStream(client, options) {
 }
 
 // src/lib/opencode/credential-import-v2.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/lib/openai-usage.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var OPENCODE_AUTH_SEGMENTS = [".local", "share", "opencode", "auth.json"];
 var OpenAiUsageError = class extends Error {
@@ -4282,7 +4684,7 @@ function isLocalCredentialProblem2(err) {
 }
 function readOpenCodeChatGptCredentials() {
   try {
-    const raw = readFileSync3(join4(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
+    const raw = readFileSync4(join5(homedir3(), ...OPENCODE_AUTH_SEGMENTS), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4514,7 +4916,7 @@ function emptyResult(unsupported = [], outcome = "completed") {
 }
 function readOpenCodeCredentials(homeDir, log3) {
   try {
-    const raw = readFileSync4(join5(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
+    const raw = readFileSync5(join6(homeDir, ...OPENCODE_AUTH_SEGMENTS), "utf8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -4568,11 +4970,11 @@ function failureMessage(status2) {
 function isRetryableStatus(status2) {
   return CONNECT_KEY_RETRY_STATUSES.includes(status2);
 }
-async function importOneCredential(request2, credential, sleepForRetry, log3) {
+async function importOneCredential(request3, credential, sleepForRetry, log3) {
   const path = `/api/integration/${encodeURIComponent(credential.integrationId)}/connect/key`;
   for (let attempt = 1; attempt <= CONNECT_KEY_MAX_ATTEMPTS; attempt += 1) {
     try {
-      const response = await request2(
+      const response = await request3(
         path,
         {
           method: "POST",
@@ -4607,7 +5009,7 @@ async function importOneCredential(request2, credential, sleepForRetry, log3) {
   throw new Error("OpenCode credential import retry loop did not return");
 }
 async function importOpenCodeCredentials({
-  request: request2,
+  request: request3,
   classified,
   connectedIntegrationIds,
   sleepForRetry = sleep2,
@@ -4619,7 +5021,7 @@ async function importOpenCodeCredentials({
       result.alreadyConnected.push(credential.integrationId);
       continue;
     }
-    const outcome = await importOneCredential(request2, credential, sleepForRetry, log3);
+    const outcome = await importOneCredential(request3, credential, sleepForRetry, log3);
     if (outcome.ok) result.imported.push(credential.integrationId);
     else result.failed.push(outcome.failure);
   }
@@ -4637,7 +5039,7 @@ function parseIntegrationList(value) {
   return { integrationIds, hasData: value.data.length > 0 };
 }
 async function getConnectedOpenCodeIntegrationIds({
-  request: request2,
+  request: request3,
   directory,
   sleepForRetry = sleep2,
   log: log3
@@ -4645,7 +5047,7 @@ async function getConnectedOpenCodeIntegrationIds({
   const path = `/api/integration?location%5Bdirectory%5D=${encodeURIComponent(directory)}`;
   for (let attempt = 1; attempt <= INTEGRATION_LIST_MAX_READS; attempt += 1) {
     try {
-      const response = await request2(path);
+      const response = await request3(path);
       const parsed = parseIntegrationList(await response.json());
       if (parsed === null) {
         log3(
@@ -4674,7 +5076,7 @@ async function getConnectedOpenCodeIntegrationIds({
   return null;
 }
 async function importOpenCodeV2Credentials({
-  request: request2,
+  request: request3,
   homeDir,
   directory,
   sleepForRetry = sleep2,
@@ -4692,7 +5094,7 @@ async function importOpenCodeV2Credentials({
     const classified = classifyOpenCodeCredentials(credentials2);
     if (classified.importable.length === 0) return emptyResult(classified.unsupported);
     const connectedIntegrationIds = await getConnectedOpenCodeIntegrationIds({
-      request: request2,
+      request: request3,
       directory,
       sleepForRetry,
       log: log3
@@ -4701,7 +5103,7 @@ async function importOpenCodeV2Credentials({
       return emptyResult(classified.unsupported, "connection-list-unavailable");
     }
     return importOpenCodeCredentials({
-      request: request2,
+      request: request3,
       classified,
       connectedIntegrationIds,
       sleepForRetry,
@@ -4714,9 +5116,9 @@ async function importOpenCodeV2Credentials({
 
 // src/lib/opencode/session-db-boot.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { mkdirSync as mkdirSync2, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, resolve as resolvePath } from "node:path";
+import { dirname as dirname5, resolve as resolvePath } from "node:path";
 
 // src/lib/runner-synchroniser.ts
 import { spawn } from "node:child_process";
@@ -4832,7 +5234,7 @@ function reportRecord(stage, outcome, reason, litestreamExitCode, options) {
 function clearMarker(options) {
   if (!options.noReplicateMarker) return;
   try {
-    unlinkSync2(options.noReplicateMarker);
+    unlinkSync3(options.noReplicateMarker);
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return;
     options.log(
@@ -4844,8 +5246,8 @@ function clearMarker(options) {
 function markNoReplicate(options, message) {
   if (options.noReplicateMarker) {
     try {
-      mkdirSync(dirname4(options.noReplicateMarker), { recursive: true });
-      writeFileSync(options.noReplicateMarker, "");
+      mkdirSync2(dirname5(options.noReplicateMarker), { recursive: true });
+      writeFileSync2(options.noReplicateMarker, "");
     } catch (error2) {
       options.log(
         `Could not write session-DB no-replicate marker ${options.noReplicateMarker}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -4858,7 +5260,7 @@ function markNoReplicate(options, message) {
 function discardSessionDbDebris(options) {
   for (const path of [options.dbPath, `${options.dbPath}-wal`, `${options.dbPath}-shm`]) {
     try {
-      unlinkSync2(path);
+      unlinkSync3(path);
     } catch (error2) {
       if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") continue;
       options.log(
@@ -4999,8 +5401,8 @@ async function ensureLitestreamConfig(options, env) {
     return null;
   }
   try {
-    mkdirSync(dirname4(configPath), { recursive: true });
-    writeFileSync(configPath, rendered.stdout);
+    mkdirSync2(dirname5(configPath), { recursive: true });
+    writeFileSync2(configPath, rendered.stdout);
   } catch (error2) {
     options.log(
       `Could not write ${configPath}: ${error2 instanceof Error ? error2.message : String(error2)}`,
@@ -5265,8 +5667,8 @@ async function restoreAndVerifySessionDb(options) {
 
 // src/lib/opencode/session-db-provenance.ts
 import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname6, join as join7 } from "node:path";
 var require2 = createRequire(import.meta.url);
 function readSessionDbMigrationIds(dbPath) {
   let db;
@@ -5303,12 +5705,12 @@ function readSessionDbMigrationIds(dbPath) {
 }
 function sessionDbProvenanceStatePath(homeDir, env) {
   const override = env.EVIDENT_SESSION_DB_PROVENANCE_STATE?.trim();
-  return override || join6(homeDir, ".local", "state", "evident", "session-db-provenance.json");
+  return override || join7(homeDir, ".local", "state", "evident", "session-db-provenance.json");
 }
 function loadSessionDbProvenanceState(path) {
   let value;
   try {
-    value = JSON.parse(readFileSync5(path, "utf8"));
+    value = JSON.parse(readFileSync6(path, "utf8"));
   } catch (error2) {
     if (error2 instanceof Error && "code" in error2 && error2.code === "ENOENT") return {};
     console.error(
@@ -5332,8 +5734,8 @@ function loadSessionDbProvenanceState(path) {
 }
 function saveSessionDbProvenanceState(path, state) {
   try {
-    mkdirSync2(dirname5(path), { recursive: true });
-    writeFileSync2(path, `${JSON.stringify(state, null, 2)}
+    mkdirSync3(dirname6(path), { recursive: true });
+    writeFileSync3(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
   } catch (error2) {
     console.error(
@@ -5392,7 +5794,11 @@ function isSessionDbProvenanceRecord(value) {
 var OPENCODE2_PACKAGE_SPEC = "@opencode-ai/cli@0.0.0-beta-17823";
 
 // src/lib/opencode/opencode-version-gate.ts
-var QUEUE_VALIDATED_OPENCODE_VERSIONS = ["1.17.11", "1.18.3"];
+var QUEUE_VALIDATED_OPENCODE_VERSIONS = [
+  "1.17.11",
+  "1.18.3",
+  "1.18.35"
+];
 function isQueueValidatedVersion(version2) {
   if (!version2) return false;
   return QUEUE_VALIDATED_OPENCODE_VERSIONS.includes(version2);
@@ -5977,15 +6383,15 @@ function resolveSessionCleanupConfig(flags, env = process.env) {
 
 // src/lib/opencode/session-db-size.ts
 import { statSync as statSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var LARGE_DB_THRESHOLD_BYTES = 268435456;
 function statSessionDbBytes(homeDir) {
-  const dbPath = join7(homeDir, ".local", "share", "opencode", "opencode.db");
+  const dbPath = join8(homeDir, ".local", "share", "opencode", "opencode.db");
   try {
     return statSync4(dbPath).size;
   } catch (err) {
-    const isMissingFile = err instanceof Error && "code" in err && err.code === "ENOENT";
-    if (!isMissingFile) {
+    const isMissingFile2 = err instanceof Error && "code" in err && err.code === "ENOENT";
+    if (!isMissingFile2) {
       console.error(
         `[statSessionDbBytes] could not stat ${dbPath}: ${err instanceof Error ? err.message : String(err)}`
       );
@@ -6010,12 +6416,12 @@ function buildSessionStoreSizeWarning(input) {
 // src/lib/opencode/log-tail.ts
 import { statSync as statSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { open as open2, stat } from "node:fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 function resolveOpenCodeLogPath(homeDir = homedir5(), env = process.env) {
-  const dataDir = env.XDG_DATA_HOME || join8(homeDir, ".local", "share");
-  return join8(dataDir, "opencode", "log", "opencode.log");
+  const dataDir = env.XDG_DATA_HOME || join9(homeDir, ".local", "share");
+  return join9(dataDir, "opencode", "log", "opencode.log");
 }
 function isEnoent(error2) {
   return error2?.code === "ENOENT";
@@ -6437,6 +6843,7 @@ function connectTunnel(options) {
     }, 3e4);
     let relaySilenceTimeout;
     let relaySilenceTimedOut = false;
+    let relayConnectionId;
     const clearRelaySilenceTimeout = () => {
       if (relaySilenceTimeout === void 0) return;
       clearTimeout(relaySilenceTimeout);
@@ -6522,7 +6929,8 @@ function connectTunnel(options) {
           armRelaySilenceTimeout();
           forwarder.setBinaryFramesSupported(message.binary_frames === true);
           const connectedAgentId = message.agent_id ?? agentId;
-          onConnected?.(connectedAgentId);
+          relayConnectionId = message.connection_id;
+          onConnected?.(connectedAgentId, relayConnectionId);
           resolve5({
             ws,
             close: () => ws.close(1e3, "CLI shutdown")
@@ -6559,7 +6967,7 @@ function connectTunnel(options) {
       clearRelaySilenceTimeout();
       const reasonStr = (relaySilenceTimedOut ? "no relay heartbeat for 90s \u2014 reconnecting" : void 0) || reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
       forwarder.abortAll();
-      onDisconnected?.(code, reasonStr);
+      onDisconnected?.(code, reasonStr, relayConnectionId);
     });
   });
 }
@@ -6622,7 +7030,7 @@ var RunnerConnection = class _RunnerConnection {
           authHeader: this.opts.getAuthHeader(),
           port: this.opts.port,
           openCodePassword: this.opts.openCodePassword,
-          onConnected: (agentId) => {
+          onConnected: (agentId, relayConnectionId) => {
             const attempt = this.reconnectAttempt + 1;
             this.reconnectAttempt = 0;
             this.reconnecting = false;
@@ -6632,13 +7040,17 @@ var RunnerConnection = class _RunnerConnection {
             this.disconnectedAtMs = null;
             events.onConnected(agentId, isReconnect, {
               generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null,
               attempt,
               downtimeMs
             });
           },
-          onDisconnected: (code, reason) => {
+          onDisconnected: (code, reason, relayConnectionId) => {
             this.disconnectedAtMs = this.now();
-            events.onDisconnected(code, reason, { generation: this.generation });
+            events.onDisconnected(code, reason, {
+              generation: this.generation,
+              relayConnectionId: relayConnectionId ?? null
+            });
             const relayRequestedReconnect = code === 1e3 && _RunnerConnection.RELAY_RECONNECT_CLOSE_REASONS.has(reason);
             if (this.opts.isRunning() && (code !== 1e3 || relayRequestedReconnect) && !this.reconnecting) {
               this.reconnectPromise = this.connectWithRetry(true).catch((err) => {
@@ -6676,10 +7088,10 @@ var RunnerConnection = class _RunnerConnection {
 };
 
 // src/lib/tunnel/ready-marker.ts
-import { writeFileSync as writeFileSync3 } from "node:fs";
+import { writeFileSync as writeFileSync4 } from "node:fs";
 function writeTunnelReadyMarker(path, agentId) {
   try {
-    writeFileSync3(path, `${agentId}
+    writeFileSync4(path, `${agentId}
 `);
     return { ok: true };
   } catch (error2) {
@@ -6704,7 +7116,7 @@ async function stopSessionDbReplication(child, timeoutMs) {
 }
 
 // src/lib/process-liveness.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -6719,7 +7131,7 @@ function isProcessAlive(pid) {
   }
   if (process.platform !== "linux") return true;
   try {
-    const status2 = readFileSync6(`/proc/${pid}/status`, "utf8");
+    const status2 = readFileSync7(`/proc/${pid}/status`, "utf8");
     return !/^State:\s+Z(?:\s|$)/m.test(status2);
   } catch (error2) {
     console.error(
@@ -7078,18 +7490,18 @@ function createSessionStoreHealth(options = {}) {
 import { homedir as homedir6 } from "node:os";
 
 // src/lib/runner-file-sync.ts
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // src/lib/file-push.ts
 import { randomUUID } from "node:crypto";
 import { chmod, mkdir, open as open3, realpath, rename, unlink } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join10, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var FILE_MODE = 384;
 var DIRECTORY_MODE = 448;
-async function writePushedFile(request2) {
-  const { requestedPath, content, allowedDirectories, homeDir } = request2;
+async function writePushedFile(request3) {
+  const { requestedPath, content, allowedDirectories, allowedFiles, homeDir } = request3;
   const bytes = content.byteLength;
-  if (allowedDirectories.length === 0) {
+  if (allowedDirectories.length === 0 && allowedFiles.length === 0) {
     return refuse("file_sync_disabled", "File sync is not enabled on this runner.", {
       path: requestedPath,
       bytes
@@ -7114,10 +7526,10 @@ async function writePushedFile(request2) {
   }
   try {
     const { existingAncestor, missingSegments } = await resolveNearestExistingAncestor(
-      dirname6(candidate)
+      dirname7(candidate)
     );
-    const realTarget = join9(existingAncestor, ...missingSegments, basename2(candidate));
-    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget);
+    const realTarget = join10(existingAncestor, ...missingSegments, basename2(candidate));
+    const allowedDirectory = await findContainingAllowedDirectory(allowedDirectories, realTarget) ?? await findMatchingAllowedFile(allowedFiles, realTarget);
     if (allowedDirectory === null) {
       return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
         path: realTarget,
@@ -7126,8 +7538,8 @@ async function writePushedFile(request2) {
     }
     if (missingSegments.length > 0) {
       await createMissingDirectories(existingAncestor, missingSegments);
-      const realParent = await realpath(dirname6(realTarget));
-      if (realParent !== dirname6(realTarget) || !contains(allowedDirectory, realTarget)) {
+      const realParent = await realpath(dirname7(realTarget));
+      if (realParent !== dirname7(realTarget) || !contains(allowedDirectory, realTarget)) {
         return refuse("path_not_allowed", "The runner does not allow writing to that location.", {
           path: realTarget,
           bytes,
@@ -7152,7 +7564,7 @@ function expandAndValidate(requestedPath, homeDir) {
   if (requestedPath.trim() === "" || requestedPath.includes("\0")) {
     return null;
   }
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join9(homeDir, requestedPath.slice(2)) : requestedPath;
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
   if (expanded.split(/[/\\]/).includes("..")) {
     return null;
   }
@@ -7170,7 +7582,7 @@ async function resolveNearestExistingAncestor(directory) {
     try {
       return { existingAncestor: await realpath(current), missingSegments };
     } catch (err) {
-      const parent = dirname6(current);
+      const parent = dirname7(current);
       if (err.code !== "ENOENT" || parent === current) {
         throw err;
       }
@@ -7192,6 +7604,22 @@ async function findContainingAllowedDirectory(allowedDirectories, realTarget) {
   }
   return null;
 }
+async function findMatchingAllowedFile(allowedFiles, realTarget) {
+  for (const entry of allowedFiles) {
+    if (!isAbsolute2(entry)) {
+      log("warn", "file_push_allowed_directory_skipped", {
+        directory: entry,
+        reason: "not_absolute_file"
+      });
+      continue;
+    }
+    const realParent = await realpathCreatingIfMissing(dirname7(entry));
+    if (realParent !== null && join10(realParent, basename2(entry)) === realTarget) {
+      return realParent;
+    }
+  }
+  return null;
+}
 async function realpathCreatingIfMissing(directory) {
   try {
     return await realpath(directory);
@@ -7225,13 +7653,13 @@ function contains(realDirectory, realTarget) {
 async function createMissingDirectories(existingAncestor, missingSegments) {
   let current = existingAncestor;
   for (const segment of missingSegments) {
-    current = join9(current, segment);
+    current = join10(current, segment);
     await mkdir(current, { recursive: true, mode: DIRECTORY_MODE });
     await chmod(current, DIRECTORY_MODE);
   }
 }
 async function writeAtomically(realTarget, content) {
-  const temporaryPath = join9(dirname6(realTarget), `.evident-push-${randomUUID()}.tmp`);
+  const temporaryPath = join10(dirname7(realTarget), `.evident-push-${randomUUID()}.tmp`);
   let handle;
   try {
     handle = await open3(temporaryPath, "wx", FILE_MODE);
@@ -7361,16 +7789,16 @@ var NOT_APPLIED = {
   opencodeAuthApplied: false
 };
 function isClaudeCredentialPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join10(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join11(homeDir, ...CLAUDE_CREDENTIALS_SEGMENTS);
 }
 function isOpenCodeAuthPath(requestedPath, homeDir) {
-  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join10(homeDir, requestedPath.slice(2)) : requestedPath;
-  return expanded === join10(homeDir, ...OPENCODE_AUTH_SEGMENTS);
+  const expanded = requestedPath === "~" ? homeDir : requestedPath.startsWith("~/") ? join11(homeDir, requestedPath.slice(2)) : requestedPath;
+  return expanded === join11(homeDir, ...OPENCODE_AUTH_SEGMENTS);
 }
 async function applyOne(options, file) {
   const label = `${file.id.slice(0, 8)} (${file.path})`;
-  if (options.allowedDirectories.length === 0) {
+  if (options.allowedDirectories.length === 0 && options.allowedFiles.length === 0) {
     options.log({
       level: "warn",
       message: `Runner file ${label} rejected: file sync is not enabled on this runner (start it with --enable-file-sync-to)`
@@ -7397,6 +7825,7 @@ async function applyOne(options, file) {
       requestedPath: file.path,
       content: download.content,
       allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
       homeDir: options.homeDir
     });
   } catch (err) {
@@ -7503,32 +7932,238 @@ function describe(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
-// src/lib/channels/driver.ts
-function messageIdOf(m) {
-  if (!m || typeof m !== "object") return void 0;
-  if (typeof m.id === "string") return m.id;
-  const infoId = m.info?.id;
-  return typeof infoId === "string" ? infoId : void 0;
+// src/lib/vault-file-sync.ts
+import { createHash } from "node:crypto";
+async function syncVaultFiles(options) {
+  const files = await listVaultFiles(options);
+  if (files === null) return { applied: 0 };
+  const listedIds = new Set(files.map((file) => file.id));
+  for (const fileId of options.outcomes.keys()) {
+    if (!listedIds.has(fileId)) options.outcomes.delete(fileId);
+  }
+  let applied = 0;
+  for (const file of files) {
+    try {
+      if (await reconcileVaultFile(options, file)) applied += 1;
+    } catch (err) {
+      options.log({
+        level: "error",
+        message: `Vault file ${file.id} reconciliation failed unexpectedly (message processing is unaffected): ${describe2(err)}`
+      });
+    }
+  }
+  return { applied };
 }
-function composeAbandonmentNote(finish, replyShape, outcome) {
-  const base = `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
-  if (replyShape === null) return base;
-  return `${base} ${replyShape.lastToolName === null ? "No tool call was recorded" : `The last tool call was "${replyShape.lastToolName}" with status "${replyShape.lastToolStatus ?? "(unknown)"}"`}; the reply's final part types were [${replyShape.partTypes.join(", ")}]${replyShape.droppedPartCount > 0 ? ` (${replyShape.droppedPartCount} earlier part types omitted)` : ""}.`;
+async function listVaultFiles(options) {
+  let response;
+  try {
+    response = await options.fetchImpl(`${options.apiUrl}/runners/${options.agentId}/vault-files`, {
+      headers: { Authorization: options.getAuthHeader() }
+    });
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Could not list vault files \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (!response.ok) {
+    options.log({
+      level: response.status === 404 ? "debug" : "warn",
+      message: `Listing vault files returned HTTP ${response.status} \u2014 retrying on the next drain`
+    });
+    return null;
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Vault file list was not readable JSON \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+  if (body === null || typeof body !== "object" || !Array.isArray(body.files)) {
+    options.log({
+      level: "warn",
+      message: "Vault file list was not an object with a files array \u2014 ignoring it for this drain"
+    });
+    return null;
+  }
+  const files = [];
+  for (const entry of body.files) {
+    const file = asVaultFile(entry);
+    if (file === null) {
+      options.log({
+        level: "warn",
+        message: "Ignoring a malformed vault file entry"
+      });
+      continue;
+    }
+    files.push(file);
+  }
+  return files;
 }
-function cleanImageMime(contentType) {
-  if (!contentType) return null;
-  const media = contentType.split(";")[0].trim().toLowerCase();
-  return /^image\/[a-z0-9.+-]+$/.test(media) ? media : null;
+function asVaultFile(entry) {
+  if (entry === null || typeof entry !== "object") return null;
+  const value = entry;
+  if (typeof value.id !== "string" || value.id === "" || typeof value.destination_path !== "string" || value.destination_path === "" || typeof value.size_bytes !== "number" || !Number.isFinite(value.size_bytes) || value.size_bytes < 0 || typeof value.content_sha256 !== "string" || value.content_sha256 === "" || typeof value.created_at !== "string" || typeof value.updated_at !== "string") {
+    return null;
+  }
+  return {
+    id: value.id,
+    destination_path: value.destination_path,
+    size_bytes: value.size_bytes,
+    content_sha256: value.content_sha256,
+    created_at: value.created_at,
+    updated_at: value.updated_at
+  };
 }
-var LOG_LEVELS = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
-};
-var DEFAULT_RETRY_POLICY = {
-  maxAttempts: 6,
-  baseDelayMs: 500,
+async function reconcileVaultFile(options, file) {
+  const existing = options.outcomes.get(file.id);
+  if (existing?.sha256 === file.content_sha256) {
+    if (existing.reported || existing.reportAttempts >= MAX_ACK_ATTEMPTS) return false;
+    await reportOutcome(options, file, existing);
+    return false;
+  }
+  const content = await downloadVaultFile(options, file);
+  if (content === null) return false;
+  const actualSha256 = createHash("sha256").update(content).digest("hex");
+  if (actualSha256 !== file.content_sha256) {
+    options.log({
+      level: "warn",
+      message: `Vault file ${file.id} content hash mismatch: expected ${file.content_sha256}, received ${actualSha256} \u2014 retrying on the next drain`
+    });
+    return false;
+  }
+  const outcome = await applyVaultFile(options, file, content);
+  const entry = {
+    sha256: file.content_sha256,
+    outcome: outcome.ok ? "applied" : "refused",
+    reason: outcome.ok ? null : outcome.code,
+    reported: false,
+    reportAttempts: 0
+  };
+  options.outcomes.set(file.id, entry);
+  await reportOutcome(options, file, entry);
+  return outcome.ok;
+}
+async function downloadVaultFile(options, file) {
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/content`,
+      { headers: { Authorization: options.getAuthHeader() } }
+    );
+    if (!response.ok) {
+      options.log({
+        level: "warn",
+        message: `Downloading vault file ${file.id} returned HTTP ${response.status} \u2014 retrying on the next drain`
+      });
+      return null;
+    }
+    return Buffer.from(await response.arrayBuffer());
+  } catch (err) {
+    options.log({
+      level: "warn",
+      message: `Downloading vault file ${file.id} failed \u2014 retrying on the next drain: ${describe2(err)}`
+    });
+    return null;
+  }
+}
+async function applyVaultFile(options, file, content) {
+  try {
+    const outcome = await writePushedFile({
+      requestedPath: file.destination_path,
+      content,
+      allowedDirectories: options.allowedDirectories,
+      allowedFiles: options.allowedFiles,
+      homeDir: options.homeDir
+    });
+    if (!outcome.ok) {
+      options.log({
+        level: "warn",
+        message: `Vault file ${file.id} refused (${outcome.code}): ${outcome.message}`
+      });
+    } else {
+      options.log({
+        level: "info",
+        message: `Vault file ${file.id} applied (${content.byteLength} bytes)`
+      });
+    }
+    return outcome;
+  } catch (err) {
+    options.log({
+      level: "error",
+      message: `Vault file ${file.id} could not be written: ${describe2(err)}`
+    });
+    return { ok: false, code: "write_failed", message: "The runner could not write the file." };
+  }
+}
+async function reportOutcome(options, file, entry) {
+  const body = {
+    status: entry.outcome === "applied" ? "applied" : "rejected",
+    reported_sha256: entry.sha256
+  };
+  if (entry.outcome === "refused" && entry.reason !== null) body.reason = entry.reason;
+  try {
+    const response = await options.fetchImpl(
+      `${options.apiUrl}/runners/${options.agentId}/vault-files/${file.id}/status`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: options.getAuthHeader(),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      }
+    );
+    if (response.ok) {
+      entry.reported = true;
+      return;
+    }
+    recordReportFailure(options, file, entry, `HTTP ${response.status}`);
+  } catch (err) {
+    recordReportFailure(options, file, entry, describe2(err));
+  }
+}
+function recordReportFailure(options, file, entry, reason) {
+  entry.reportAttempts += 1;
+  options.log({
+    level: "error",
+    message: entry.reportAttempts >= MAX_ACK_ATTEMPTS ? `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 giving up after ${entry.reportAttempts} attempts` : `Reporting vault file ${file.id} as ${entry.outcome} failed (${reason}) \u2014 retrying on the next drain (attempt ${entry.reportAttempts} of ${MAX_ACK_ATTEMPTS})`
+  });
+}
+function describe2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/lib/channels/driver.ts
+function messageIdOf(m) {
+  if (!m || typeof m !== "object") return void 0;
+  if (typeof m.id === "string") return m.id;
+  const infoId = m.info?.id;
+  return typeof infoId === "string" ? infoId : void 0;
+}
+function composeAbandonmentNote(finish, replyShape, outcome) {
+  const base = outcome === "midflight-without-answer" || outcome === "midflight-with-answer" ? "OpenCode stopped this turn without ever finishing, and confirmed the session is no longer running. " + (outcome === "midflight-without-answer" ? "Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "Evident delivered what was written and is reporting the run as finished.") : `OpenCode ended this turn after a tool call (finish="${finish ?? "(unknown)"}") ` + (outcome === "without-answer" ? "without writing an answer, and confirmed it is no longer working on this conversation. Evident is reporting the run as failed so the failure and its reason are visible in failed runs." : "after writing only part of an answer, and confirmed it is no longer working on this conversation. Evident delivered what was written and is reporting the run as finished.");
+  if (replyShape === null) return base;
+  return `${base} ${replyShape.lastToolName === null ? "No tool call was recorded" : `The last tool call was "${replyShape.lastToolName}" with status "${replyShape.lastToolStatus ?? "(unknown)"}"`}; the reply's final part types were [${replyShape.partTypes.join(", ")}]${replyShape.droppedPartCount > 0 ? ` (${replyShape.droppedPartCount} earlier part types omitted)` : ""}.`;
+}
+function cleanImageMime(contentType) {
+  if (!contentType) return null;
+  const media = contentType.split(";")[0].trim().toLowerCase();
+  return /^image\/[a-z0-9.+-]+$/.test(media) ? media : null;
+}
+var LOG_LEVELS = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var DEFAULT_RETRY_POLICY = {
+  maxAttempts: 6,
+  baseDelayMs: 500,
   maxDelayMs: 3e4
 };
 var SUBAGENT_TELEMETRY_FETCH_TIMEOUT_MS = 2e3;
@@ -7537,7 +8172,7 @@ var SESSION_ERROR_BUFFER_TTL_MS = SESSION_ERROR_STREAM_HEALTHY_MS;
 var MAX_BUFFERED_SESSION_ERRORS = 256;
 var SESSION_ERROR_RETENTION_TTL_MS = 6e4;
 var SESSION_STORE_UNWRITABLE_ERROR = "The runner session database could not be written, so this turn did not finish. Nothing was lost from the queue. Clear disk space and retry.";
-var SESSION_ERROR_RETAINED_DETAIL = "The runner's session database could not be written, so this turn stopped part-way. Runner-observed session error: ";
+var SESSION_ERROR_RETAINED_DETAIL = "Runner-observed OpenCode session error: ";
 var SESSION_ERROR_OBSERVED_CAUSE = "Runner-observed OpenCode session-store cause: ";
 var DEFAULT_PAUSED_POLL_INTERVAL_MS = 2e3;
 var DEFAULT_PAUSED_MAX_WAIT_MS = 10 * 60 * 1e3;
@@ -7548,6 +8183,9 @@ var ALIVE_WITHHELD_THRESHOLD_MS = 3 * HEARTBEAT_MS;
 var ABSOLUTE_MAX_PROCESSING_MS = 6 * 60 * 60 * 1e3;
 var B2_ABANDONMENT_MIN_PINNED_MS = 3 * 6e4;
 var AMBIGUOUS_FINISH_MAX_PINNED_MS = 3 * 6e4;
+var MIDFLIGHT_ORPHAN_MIN_PINNED_MS = 3 * 6e4;
+var MIDFLIGHT_ORPHAN_RECHECK_MS = 6e4;
+var MIDFLIGHT_ORPHAN_MIN_NOT_ONGOING_STREAK = 2;
 var B2_ABANDONMENT_RECHECK_MS = HEARTBEAT_MS;
 var POLL_MISS_GRACE_MS = HEARTBEAT_MS;
 var WATCHER_STALL_MS = 3 * POLL_MISS_GRACE_MS;
@@ -7599,6 +8237,7 @@ var ChannelDriver = class _ChannelDriver {
   stuckQueuedMs;
   now;
   fileSyncDirectories;
+  fileSyncExactFiles;
   homeDir;
   maxActiveSessions;
   watcherStallMs;
@@ -7661,12 +8300,15 @@ var ChannelDriver = class _ChannelDriver {
   /**
    * Per-conversation throttle state for the #183 recurrence warning (#1618
    * WI-4) — see `reportWedgedConversation`'s doc comment for why this exists.
-   * `firstWedgedAt` anchors `stuck_for_ms`; `lastWarnedAt` throttles both the
-   * log line and the `dispatch_wedged` signal to at most once per
-   * `wedgeWarningIntervalMs`; `consecutiveTicks` is reported in the log text
-   * so the operator sees magnitude, not repetition. Cleared the moment the
-   * conversation dispatches anything (a fresh wedge, if it recurs, is a new
-   * incident). Bounded FIFO, mirroring `supersededSessions`
+   * `firstWedgedAt` anchors `stuck_for_ms`; `warnAnchorAt` is the throttle
+   * anchor from first detection through the first warning, then from each
+   * warning onward; `consecutiveTicks` is reported in the log text so the
+   * operator sees magnitude, not repetition. Cleared the moment the
+   * conversation dispatches anything, or when it drops off the pending list
+   * (`runDrain`'s prune, the dominant real-world path — a wedge normally ends
+   * with its message completing, not a fresh dispatch on the same
+   * conversation) — either way a fresh wedge, if it recurs, is a new
+   * incident. Bounded FIFO, mirroring `supersededSessions`
    * (`MAX_WEDGED_CONVERSATIONS`).
    */
   wedgeWarnings = /* @__PURE__ */ new Map();
@@ -7896,6 +8538,7 @@ var ChannelDriver = class _ChannelDriver {
   subagentInvocationPrefetches = /* @__PURE__ */ new Map();
   /** Serialises drains so a reconnect during a drain doesn't double-process. */
   draining = false;
+  pendingProviderRegistryRepair = null;
   /**
    * Serialises runner-file syncs (#559) so the ~2s poll tick and a concurrent
    * drain ping don't download, write and ack the same file twice.
@@ -7907,6 +8550,7 @@ var ChannelDriver = class _ChannelDriver {
    * re-downloaded and re-written every ~2s until the server expires it.
    */
   fileAckFailures = /* @__PURE__ */ new Map();
+  vaultFileOutcomes = /* @__PURE__ */ new Map();
   /**
    * Monotonic count of files this runner has pulled and written (#559). Only
    * ever increases, so `run.ts` detects work by comparing it against the value
@@ -7963,6 +8607,7 @@ var ChannelDriver = class _ChannelDriver {
     this.stuckQueuedMs = config.stuckQueuedMs ?? DEFAULT_STUCK_QUEUED_MS;
     this.now = config.now ?? (() => Date.now());
     this.fileSyncDirectories = config.fileSyncDirectories ?? [];
+    this.fileSyncExactFiles = config.fileSyncExactFiles ?? [];
     this.homeDir = config.homeDir ?? homedir6();
     this.maxActiveSessions = config.maxActiveSessions;
     this.watcherStallMs = config.watcherStallMs ?? WATCHER_STALL_MS;
@@ -8060,14 +8705,27 @@ var ChannelDriver = class _ChannelDriver {
         getAuthHeader: this.getAuthHeader,
         fetchImpl: this.fetchImpl,
         allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
         homeDir: this.homeDir,
         ackFailures: this.fileAckFailures,
         log: this.log
       });
-      this.appliedFileCount += result.applied;
+      const vaultResult = await syncVaultFiles({
+        agentId: this.agentId,
+        apiUrl: this.apiUrl,
+        getAuthHeader: this.getAuthHeader,
+        fetchImpl: this.fetchImpl,
+        allowedDirectories: this.fileSyncDirectories,
+        allowedFiles: this.fileSyncExactFiles,
+        homeDir: this.homeDir,
+        outcomes: this.vaultFileOutcomes,
+        log: this.log
+      });
+      const applied = result.applied + vaultResult.applied;
+      this.appliedFileCount += applied;
       if (result.claudeCredentialApplied) this.claudeCredentialApplyCount += 1;
       if (result.opencodeAuthApplied) this.opencodeAuthApplyCount += 1;
-      return result.applied;
+      return applied;
     } catch (err) {
       this.log({
         level: "error",
@@ -8081,8 +8739,33 @@ var ChannelDriver = class _ChannelDriver {
   async runDrain() {
     let dispatched = 0;
     try {
+      const pendingRepair = this.pendingProviderRegistryRepair;
+      if (pendingRepair && this.protectedSessionIds().size === 0) {
+        try {
+          await this.issueProviderRegistryReload(
+            pendingRepair.conversationId,
+            pendingRepair.messageId
+          );
+        } catch (err) {
+          this.log({
+            level: "error",
+            message: `Provider registry repair adoption failed for message ${pendingRepair.messageId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: pendingRepair.conversationId,
+            message_id: pendingRepair.messageId
+          });
+        }
+        return 0;
+      }
       this.pendingMessageIds.clear();
       const conversations = await this.getPendingConversations();
+      if (this.wedgeWarnings.size > 0) {
+        const pendingConversationIds = new Set(conversations.map(({ id }) => id));
+        for (const conversationId of this.wedgeWarnings.keys()) {
+          if (!pendingConversationIds.has(conversationId)) {
+            this.wedgeWarnings.delete(conversationId);
+          }
+        }
+      }
       if (this.recycleRequestedFlag) {
         this.stop();
       }
@@ -8454,6 +9137,47 @@ var ChannelDriver = class _ChannelDriver {
         agent: message.opencode_agent ?? void 0,
         model: message.opencode_model ?? void 0
       };
+      const pinnedProviderLoaded = await isPinnedProviderLoaded(
+        this.port,
+        options.model,
+        this.openCodeClient
+      );
+      if (pinnedProviderLoaded === false) {
+        const dispatchedModel = message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        const providerId = hasProviderAndModel ? dispatchedModel.slice(0, separator) : null;
+        const modelId = hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null;
+        const errorMessage3 = `Provider namespace not loaded on this runner: ${message.opencode_model}. Refused before dispatch; no turn was started.`;
+        this.log({
+          level: "error",
+          message: `Refusing message ${message.id.slice(0, 8)} in conversation ${conv.id.slice(0, 8)}: provider namespace ${providerId ?? "(unknown)"} is not loaded; no turn was started`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        try {
+          await this.markFailed(conv.id, message.id, sessionId, errorMessage3, void 0, {
+            classification: {
+              kind: "model_auth",
+              providerId,
+              modelId,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          });
+          this.signalDispatchNotStarted(conv, message, "model_provider_absent");
+        } catch (markErr) {
+          this.log({
+            level: "warn",
+            message: `markFailed PATCH for refused message ${message.id.slice(0, 8)} (conversation ${conv.id.slice(0, 8)}) failed: ${markErr instanceof Error ? markErr.message : String(markErr)}`,
+            conversation_id: conv.id,
+            message_id: message.id
+          });
+          this.signalDispatchNotStarted(conv, message, "failure_unreported");
+        }
+        await this.repairProviderRegistry(conv.id, message.id);
+        break;
+      }
       let opencodeMessageId;
       let preDispatchUserIds = null;
       try {
@@ -8619,14 +9343,13 @@ var ChannelDriver = class _ChannelDriver {
    * skip-because-already-`dispatched`, the exact signature of a message stuck
    * acknowledged-but-never-worked.
    *
-   * Unthrottled, this fired every ~6s drain tick for as long as a wedge lasted
-   * (52,843 occurrences observed in one incident) — burning the GLOBAL
-   * 30-events/60s `runner-activity-telemetry.ts` budget that was itself
-   * suppressing the diagnostics needed to debug the wedge. The `warn` log (and
-   * the `dispatch_wedged` signal once the wedge has persisted past the same
-   * interval) fire at most once per `wedgeWarningIntervalMs` per conversation,
-   * naming the consecutive-tick count so the operator sees magnitude rather
-   * than repetition.
+   * The first detection starts the clock and emits a local `debug` entry. The
+   * `warn` log and paired `dispatch_wedged` signal fire once the wedge has
+   * lasted `wedgeWarningIntervalMs`, then at most once per interval, naming the
+   * consecutive-tick count so the operator sees magnitude rather than repetition.
+   * A watcher stall that the loop-liveness watchdog recovers is expected and is
+   * already reported by its `watcher_recovered` signal, so it does not reach an
+   * operator through this warning.
    *
    * Deliberately does NOT trigger a release: WI-1's `reconcileWatchers` runs
    * unconditionally on this same tick and is already recovering anything it
@@ -8638,36 +9361,41 @@ var ChannelDriver = class _ChannelDriver {
     const existing = this.wedgeWarnings.get(conv.id);
     const firstWedgedAt = existing?.firstWedgedAt ?? now;
     const consecutiveTicks = (existing?.consecutiveTicks ?? 0) + 1;
-    const dueForWarn = !existing || now - existing.lastWarnedAt >= this.wedgeWarningIntervalMs;
-    if (!dueForWarn) {
-      this.wedgeWarnings.delete(conv.id);
-      this.wedgeWarnings.set(conv.id, {
-        firstWedgedAt,
-        lastWarnedAt: existing.lastWarnedAt,
-        consecutiveTicks
+    const warnAnchorAt = existing?.warnAnchorAt ?? now;
+    const dueForWarn = now - warnAnchorAt >= this.wedgeWarningIntervalMs;
+    if (!existing) {
+      this.log({
+        level: "debug",
+        message: `Detected a possible wedge for conversation ${conv.id.slice(0, 8)} with ${messages.length} pending message(s); it will be reported only if it outlasts the watchdog's recovery.`,
+        conversation_id: conv.id
+      });
+    }
+    let untracked = 0;
+    if (dueForWarn) {
+      const stuckForMs = now - firstWedgedAt;
+      untracked = this.countUntrackedIds(messages);
+      this.log({
+        level: "warn",
+        message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${Math.round(stuckForMs / 1e3)}s stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
+        conversation_id: conv.id
       });
-      return;
     }
-    const stuckForMs = now - firstWedgedAt;
-    const untracked = this.countUntrackedIds(messages);
-    this.log({
-      level: "warn",
-      message: `Conversation ${conv.id.slice(0, 8)} has ${messages.length} pending message(s) but ALL are already marked dispatched locally (in-flight set: ${this.dispatched.size}) \u2014 none sent to OpenCode for ${consecutiveTicks} consecutive tick(s) now (${stuckForMs}ms stuck). ` + (untracked > 0 ? `${untracked} of these id(s) are tracked by NO watcher \u2014 the dispatched/in-flight pairing invariant is violated for this conversation, which will NOT self-heal and needs a runner restart.` : `A watcher is tracking this work; the loop-liveness watchdog is already recovering it.`),
-      conversation_id: conv.id
-    });
     this.wedgeWarnings.delete(conv.id);
-    this.wedgeWarnings.set(conv.id, { firstWedgedAt, lastWarnedAt: now, consecutiveTicks });
+    this.wedgeWarnings.set(conv.id, {
+      firstWedgedAt,
+      warnAnchorAt: dueForWarn ? now : warnAnchorAt,
+      consecutiveTicks
+    });
     while (this.wedgeWarnings.size > MAX_WEDGED_CONVERSATIONS) {
       const oldest = this.wedgeWarnings.keys().next().value;
       if (oldest === void 0) break;
       this.wedgeWarnings.delete(oldest);
     }
-    if (stuckForMs >= this.wedgeWarningIntervalMs) {
-      void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
-        stuck_for_ms: stuckForMs,
-        untracked
-      });
-    }
+    if (!dueForWarn) return;
+    void this.postSignal(conv.id, messages[0].id, "dispatch_wedged", {
+      stuck_for_ms: now - firstWedgedAt,
+      untracked
+    });
   }
   /**
    * How many of `messages`' ids are tracked by NO watcher's `inFlight` (#1618
@@ -8803,6 +9531,34 @@ var ChannelDriver = class _ChannelDriver {
     if (state === "failed" && isAbortedTerminalReply(messages, ocId ?? "")) {
       const ongoing = await this.isSessionOngoing(sessionId);
       if (ongoing === false) {
+        const age = this.absoluteAgeForRow(message.processing_started_at);
+        if (age.tripped && age.anchorMs !== null) {
+          try {
+            await this.markFailed(
+              conv.id,
+              message.id,
+              sessionId,
+              this.absoluteCeilingError(message.id, sessionId, age.anchorMs),
+              void 0,
+              {
+                classification: null,
+                errorShape: extractReplyErrorShape(findLastAssistantReplyFor(messages, ocId ?? ""))
+              }
+            );
+          } catch (err) {
+            if (err instanceof ChannelAuthError) throw err;
+            this.log({
+              level: "warn",
+              message: `Re-drive: failed to report past-ceiling restart orphan ${message.id.slice(0, 8)} terminal; refusing to re-dispatch: ${err instanceof Error ? err.message : String(err)}`,
+              conversation_id: conv.id,
+              message_id: message.id
+            });
+            return "unresolved";
+          }
+          this.clearRedriveUnresolved(message.id);
+          void this.postSignal(conv.id, message.id, "redrive_ceiling_refused");
+          return "settled";
+        }
         this.log({
           level: "info",
           message: `Re-drive: message ${message.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per the active-session status check \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
@@ -8873,6 +9629,29 @@ var ChannelDriver = class _ChannelDriver {
         message_id: message.id
       });
     }
+    if (this.absoluteAgeForRow(message.processing_started_at).tripped) {
+      try {
+        await this.markFailed(
+          conv.id,
+          message.id,
+          sessionId,
+          this.absoluteCeilingError(message.id, sessionId, anchorMs)
+        );
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        this.log({
+          level: "warn",
+          message: `Re-drive: failed to report past-ceiling message ${message.id.slice(0, 8)} terminal; refusing to re-attach: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: conv.id,
+          message_id: message.id
+        });
+        const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+        return bound === "abandoned" ? "abandoned" : "unresolved";
+      }
+      this.clearRedriveUnresolved(message.id);
+      void this.postSignal(conv.id, message.id, "redrive_ceiling_refused");
+      return "abandoned";
+    }
     const title = await this.resolveSessionTitle(sessionId, conv.id);
     try {
       await this.markProcessing(conv.id, message.id, sessionId, ocId, title);
@@ -9139,8 +9918,7 @@ var ChannelDriver = class _ChannelDriver {
     const since = this.redriveOutcomeFailingSince.get(message.id);
     if (since === void 0) this.redriveOutcomeFailingSince.set(message.id, now);
     const durationTripped = now - (since ?? now) >= this.pausedMaxWaitMs;
-    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
-    const absoluteAgeTripped = !Number.isNaN(parsed) && now - parsed >= ABSOLUTE_MAX_PROCESSING_MS;
+    const absoluteAgeTripped = this.absoluteAgeForRow(message.processing_started_at).tripped;
     if (!durationTripped && !absoluteAgeTripped) {
       this.signalRedriveOutcomeUnreported(conv, message, outcome);
       return "retry";
@@ -9179,6 +9957,15 @@ var ChannelDriver = class _ChannelDriver {
     });
     return "abandoned";
   }
+  /** Row-level guards use the durable server stamp; in-flight guards use processingAnchorMs. */
+  absoluteAgeForRow(stamp) {
+    const anchorMs = stamp ? Date.parse(stamp) : NaN;
+    return Number.isNaN(anchorMs) ? { tripped: false, anchorMs: null } : { tripped: this.now() - anchorMs >= ABSOLUTE_MAX_PROCESSING_MS, anchorMs };
+  }
+  absoluteCeilingError(messageId, sessionId, anchorMs, retainedReason = this.readRetainedSessionError(sessionId)) {
+    const baseError = `Message ${messageId.slice(0, 8)} exceeded the absolute processing ceiling (${Math.round((this.now() - anchorMs) / 6e4)}min, session ${sessionId}) while still actively running.`;
+    return retainedReason ? `${baseError} ${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}` : baseError;
+  }
   /**
    * Record one poll outcome toward the re-drive fence's consecutive-identical-
    * failure streak (#1348) and return the resulting count. `signature === null`
@@ -9515,6 +10302,12 @@ var ChannelDriver = class _ChannelDriver {
       b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      midFlightPinnedSinceMs: 0,
+      midFlightNotOngoingStreak: 0,
+      midFlightLastStatusCheckMs: 0,
+      midFlightOrphanSignalled: false,
+      midFlightOrphanWithoutAnswer: false,
+      midFlightHeldLogged: false,
       sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
@@ -9620,10 +10413,7 @@ var ChannelDriver = class _ChannelDriver {
       opencodeMessageId,
       message,
       dispatchedAt: this.now(),
-      // Anchor the absolute-age ceiling to the SERVER-SIDE `processed_at`, NOT
-      // `dispatchedAt` — so a re-adopted zombie's age reflects the real turn duration
-      // and the ceiling fires on the ORIGINAL turn.
-      processingAnchorMs: processedAtMs,
+      processingAnchorMs: this.absoluteAgeForRow(message.processing_started_at).anchorMs ?? processedAtMs,
       deadline: watchDeadlineAnchorMs + this.pausedMaxWaitMs,
       // The server row is ALREADY `processing`; do not re-fire markProcessing.
       started: true,
@@ -9657,6 +10447,12 @@ var ChannelDriver = class _ChannelDriver {
       b2AbandonedWithoutAnswer: false,
       ambiguousPinnedSinceMs: 0,
       ambiguousResolved: false,
+      midFlightPinnedSinceMs: 0,
+      midFlightNotOngoingStreak: 0,
+      midFlightLastStatusCheckMs: 0,
+      midFlightOrphanSignalled: false,
+      midFlightOrphanWithoutAnswer: false,
+      midFlightHeldLogged: false,
       sessionStoreFailurePending: false,
       neverStartedResolved: false
     });
@@ -9933,14 +10729,40 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: watcher.conv.id,
         message_id: inFlight.evidentMessageId
       });
-      await this.markFailed(
-        watcher.conv.id,
-        inFlight.evidentMessageId,
-        event.sessionId,
-        `OpenCode could not run this turn: ${event.reason}`
-      );
+      const isMissingProvider = isProviderModelNotFoundError(event.reason);
+      if (isMissingProvider) {
+        const dispatchedModel = inFlight.message.opencode_model;
+        const separator = dispatchedModel?.indexOf("/") ?? -1;
+        const hasProviderAndModel = dispatchedModel !== null && separator > 0 && separator < dispatchedModel.length - 1;
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`,
+          void 0,
+          {
+            classification: {
+              kind: "model_auth",
+              providerId: hasProviderAndModel ? dispatchedModel.slice(0, separator) : null,
+              modelId: hasProviderAndModel ? dispatchedModel.slice(separator + 1) : null,
+              reason: "missing"
+            },
+            errorShape: { name: null, statusCode: null }
+          }
+        );
+      } else {
+        await this.markFailed(
+          watcher.conv.id,
+          inFlight.evidentMessageId,
+          event.sessionId,
+          `OpenCode could not run this turn: ${event.reason}`
+        );
+      }
       inFlight.done = true;
       this.removeInFlight(watcher, inFlight.evidentMessageId);
+      if (isMissingProvider) {
+        await this.repairProviderRegistry(watcher.conv.id, inFlight.evidentMessageId);
+      }
     } catch (err) {
       if (err instanceof ChannelAuthError) {
         this.log({
@@ -9961,6 +10783,44 @@ var ChannelDriver = class _ChannelDriver {
       this.sessionErrorHandled.delete(inFlight.evidentMessageId);
     }
   }
+  async repairProviderRegistry(conversationId, messageId) {
+    if (this.isV2) {
+      void this.postSignal(conversationId, messageId, "provider_registry_reload_unsupported");
+      return;
+    }
+    const activeSessions = this.protectedSessionIds().size;
+    if (activeSessions > 0 || this.draining) {
+      this.pendingProviderRegistryRepair = { conversationId, messageId };
+      void this.postSignal(conversationId, messageId, "provider_registry_repair_deferred", {
+        active_sessions: activeSessions
+      });
+      this.log({
+        level: "warn",
+        message: `Provider registry repair deferred until a lifecycle-safe point; ${activeSessions} active session(s) protected`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+      return;
+    }
+    await this.issueProviderRegistryReload(conversationId, messageId);
+  }
+  async issueProviderRegistryReload(conversationId, messageId) {
+    this.pendingProviderRegistryRepair = null;
+    const result = await disposeAndReloadProviderConfig(this.port, this.openCodeClient);
+    if (result.outcome === "failed") {
+      const failure = result.status === null ? `transport failure${result.detail ? `: ${result.detail}` : ""}` : `HTTP ${result.status}`;
+      this.log({
+        level: "warn",
+        message: `Provider registry reload failed (${failure})`,
+        conversation_id: conversationId,
+        message_id: messageId
+      });
+    }
+    const repairOutcome = result.outcome === "reloaded" ? "reloaded" : "reload_failed";
+    void this.postSignal(conversationId, messageId, "provider_registry_reload_issued", {
+      repair_outcome: repairOutcome
+    });
+  }
   /**
    * The per-session polling loop (WI-3). Once per tick it:
    *   1. polls `GET /session/:id/message` once and, per in-flight message,
@@ -10010,7 +10870,9 @@ var ChannelDriver = class _ChannelDriver {
         }
         const { openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk } = await this.pollInteractions(sessionId, watcher, messages);
         if (watcher.generation !== generation) return;
+        const ceilingAttemptsThisTick = /* @__PURE__ */ new Set();
         for (const inFlight of [...watcher.inFlight.values()]) {
+          if (ceilingAttemptsThisTick.has(inFlight.evidentMessageId)) continue;
           await this.serviceInFlightMessage(
             sessionId,
             watcher,
@@ -10019,7 +10881,8 @@ var ChannelDriver = class _ChannelDriver {
             openQuestions,
             openPermissions,
             questionsPolledOk,
-            permissionsPolledOk
+            permissionsPolledOk,
+            ceilingAttemptsThisTick
           );
         }
       }
@@ -10060,35 +10923,139 @@ var ChannelDriver = class _ChannelDriver {
       inFlight.deadline = this.now() + this.pausedMaxWaitMs;
     }
   }
-  /**
-   * Drive ONE in-flight message's lifecycle from the tick's message snapshot.
-   * Fires markProcessing on queued→running and markDone on done (each once),
-   * applies the idle-path re-dispatch guard, and removes the message from the
-   * in-flight set on completion or timeout.
-   */
-  async serviceInFlightMessage(sessionId, watcher, inFlight, messages, openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk) {
-    const conv = watcher.conv;
-    const state = messageRunState(messages, inFlight.opencodeMessageId);
-    const id = inFlight.evidentMessageId;
-    if (state === "running" || state === "done" || state === "failed") {
-      this.neverStartedAttempts.delete(id);
-    }
-    if (inFlight.sessionStoreFailurePending) {
-      await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
-      return;
-    }
-    if (inFlight.neverStartedResolved) {
-      if (state === "running" || state === "done" || state === "failed") {
-        inFlight.neverStartedResolved = false;
-      } else {
-        await this.settleMessageNeverStarted(
+  async settleAbsoluteCeiling(sessionId, watcher, messages, ceilingAttemptsThisTick) {
+    const entries = [...watcher.inFlight.values()];
+    const pastCeiling = entries.filter(
+      (entry) => this.now() - entry.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS
+    );
+    const healthySiblings = entries.length - pastCeiling.length;
+    const landed = [];
+    let allRecordsLanded = true;
+    const retainedReason = this.readRetainedSessionError(sessionId);
+    for (const entry of pastCeiling) {
+      if (!watcher.inFlight.has(entry.evidentMessageId)) continue;
+      ceilingAttemptsThisTick.add(entry.evidentMessageId);
+      const error2 = this.absoluteCeilingError(
+        entry.evidentMessageId,
+        sessionId,
+        entry.processingAnchorMs,
+        retainedReason
+      );
+      this.log({
+        level: "warn",
+        message: error2,
+        conversation_id: watcher.conv.id,
+        message_id: entry.evidentMessageId
+      });
+      try {
+        await this.markFailed(
+          watcher.conv.id,
+          entry.evidentMessageId,
           sessionId,
-          watcher,
-          inFlight,
-          this.neverStartedAttempts.get(id)?.count ?? MAX_NEVER_STARTED_ATTEMPTS
+          error2,
+          void 0,
+          {
+            classification: null,
+            errorShape: extractReplyErrorShape(
+              findLastAssistantReplyFor(messages, entry.opencodeMessageId)
+            )
+          }
         );
-        return;
-      }
+      } catch (err) {
+        if (err instanceof ChannelAuthError) throw err;
+        allRecordsLanded = false;
+        const watched_for_ms = this.now() - entry.processingAnchorMs;
+        if (err instanceof ChannelTerminalError) {
+          void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+            watched_for_ms,
+            interrupt_outcome: "record_terminal"
+          });
+          this.removeInFlight(watcher, entry.evidentMessageId);
+          continue;
+        }
+        if (this.now() >= entry.deadline) {
+          void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+            watched_for_ms,
+            interrupt_outcome: "record_deadline"
+          });
+          this.removeInFlight(watcher, entry.evidentMessageId);
+          continue;
+        }
+        void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+          watched_for_ms,
+          interrupt_outcome: "record_retry"
+        });
+        this.log({
+          level: "warn",
+          message: `Failed to record the absolute-ceiling failure for message ${entry.evidentMessageId.slice(0, 8)}; leaving its running turn untouched and retrying next tick: ${err instanceof Error ? err.message : String(err)}`,
+          conversation_id: watcher.conv.id,
+          message_id: entry.evidentMessageId
+        });
+        continue;
+      }
+      entry.done = true;
+      landed.push(entry);
+    }
+    if (!allRecordsLanded) {
+      for (const entry of landed) this.removeInFlight(watcher, entry.evidentMessageId);
+      return;
+    }
+    if (healthySiblings > 0) {
+      for (const entry of landed) {
+        void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+          watched_for_ms: this.now() - entry.processingAnchorMs,
+          interrupt_outcome: "deferred_for_healthy_sibling",
+          healthy_siblings: healthySiblings
+        });
+        this.removeInFlight(watcher, entry.evidentMessageId);
+      }
+      return;
+    }
+    const interrupt = await interruptSession(this.port, sessionId, this.openCodeClient);
+    for (const entry of landed) {
+      void this.postSignal(watcher.conv.id, entry.evidentMessageId, "gave_up", {
+        watched_for_ms: this.now() - entry.processingAnchorMs,
+        interrupt_outcome: interrupt.kind
+      });
+      this.removeInFlight(watcher, entry.evidentMessageId);
+    }
+    if (interrupt.kind !== "confirmed_stopped") {
+      this.log({
+        level: "warn",
+        message: `Absolute-ceiling records landed for session ${sessionId}, but OpenCode interruption was ${interrupt.kind}${interrupt.diagnostic ? ` (${interrupt.diagnostic})` : "status" in interrupt && typeof interrupt.status === "number" ? ` (HTTP ${interrupt.status})` : ""}; the rows are terminal and released, while the session may still be running`,
+        conversation_id: watcher.conv.id
+      });
+    }
+  }
+  /**
+   * Drive ONE in-flight message's lifecycle from the tick's message snapshot.
+   * Fires markProcessing on queued→running and markDone on done (each once),
+   * applies the idle-path re-dispatch guard, and removes the message from the
+   * in-flight set on completion or timeout.
+   */
+  async serviceInFlightMessage(sessionId, watcher, inFlight, messages, openQuestions, openPermissions, questionsPolledOk, permissionsPolledOk, ceilingAttemptsThisTick) {
+    const conv = watcher.conv;
+    const state = messageRunState(messages, inFlight.opencodeMessageId);
+    const id = inFlight.evidentMessageId;
+    if (state === "running" || state === "done" || state === "failed") {
+      this.neverStartedAttempts.delete(id);
+    }
+    if (inFlight.sessionStoreFailurePending) {
+      await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+      return;
+    }
+    if (inFlight.neverStartedResolved) {
+      if (state === "running" || state === "done" || state === "failed") {
+        inFlight.neverStartedResolved = false;
+      } else {
+        await this.settleMessageNeverStarted(
+          sessionId,
+          watcher,
+          inFlight,
+          this.neverStartedAttempts.get(id)?.count ?? MAX_NEVER_STARTED_ATTEMPTS
+        );
+        return;
+      }
     }
     if (messages && collectTaskCalls(messages, inFlight.opencodeMessageId).length > 0 && !this.subagentInvocationPrefetches.has(id)) {
       void this.resolveSubagentInvocations(
@@ -10152,7 +11119,7 @@ var ChannelDriver = class _ChannelDriver {
       if (!inFlight.done) {
         const messageErrorText = messageError(messages, inFlight.opencodeMessageId);
         const retainedReason = this.readRetainedSessionError(sessionId);
-        const retainedError = retainedReason === null ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
+        const retainedError = retainedReason === null || messageErrorText !== null && messageErrorText.includes(retainedReason) ? null : `${SESSION_ERROR_RETAINED_DETAIL}${retainedReason}`;
         const observedCause = this.sessionStoreHealth?.readCause(sessionId);
         const causeError = observedCause === null || observedCause === void 0 ? null : `${SESSION_ERROR_OBSERVED_CAUSE}${observedCause}`;
         const storeError = this.sessionStoreHealth?.isUnwritable() ? SESSION_STORE_UNWRITABLE_ERROR : null;
@@ -10257,7 +11224,11 @@ var ChannelDriver = class _ChannelDriver {
             watcher,
             inFlight,
             messages,
-            finish
+            composeAbandonmentNote(
+              finish,
+              describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+              "without-answer"
+            )
           );
         } else {
           await this.settleMessageDone(
@@ -10316,7 +11287,11 @@ var ChannelDriver = class _ChannelDriver {
               watcher,
               inFlight,
               messages,
-              finish
+              composeAbandonmentNote(
+                finish,
+                describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+                "without-answer"
+              )
             );
             return;
           }
@@ -10410,17 +11385,108 @@ var ChannelDriver = class _ChannelDriver {
         return;
       }
     }
-    if (activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
-      this.log({
-        level: "warn",
-        message: `Message ${inFlight.evidentMessageId.slice(0, 8)} exceeded the absolute processing ceiling (${Math.round((this.now() - inFlight.processingAnchorMs) / 6e4)}min, session ${sessionId}) while still actively running \u2014 releasing so the cron can reclaim it`,
-        conversation_id: conv.id,
-        message_id: inFlight.evidentMessageId
-      });
-      void this.postSignal(conv.id, inFlight.evidentMessageId, "gave_up", {
-        watched_for_ms: this.now() - inFlight.processingAnchorMs
-      });
-      this.removeInFlight(watcher, inFlight.evidentMessageId);
+    const midFlightPinnedNow = activelyRunning && isMidFlightPinnedRunning(messages, inFlight.opencodeMessageId);
+    if (!midFlightPinnedNow) {
+      if (snapshotReadable) {
+        inFlight.midFlightPinnedSinceMs = 0;
+        inFlight.midFlightNotOngoingStreak = 0;
+        inFlight.midFlightLastStatusCheckMs = 0;
+        inFlight.midFlightOrphanSignalled = false;
+        inFlight.midFlightOrphanWithoutAnswer = false;
+        inFlight.midFlightHeldLogged = false;
+      }
+    } else {
+      if (inFlight.midFlightOrphanSignalled) {
+        const note = composeAbandonmentNote(
+          void 0,
+          describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+          inFlight.midFlightOrphanWithoutAnswer ? "midflight-without-answer" : "midflight-with-answer"
+        );
+        if (inFlight.midFlightOrphanWithoutAnswer) {
+          await this.settleMessageAbandonedWithoutAnswer(
+            sessionId,
+            watcher,
+            inFlight,
+            messages,
+            note
+          );
+        } else {
+          await this.settleMessageDone(sessionId, watcher, inFlight, messages, note);
+        }
+        return;
+      }
+      if (inFlight.midFlightPinnedSinceMs === 0) {
+        inFlight.midFlightPinnedSinceMs = this.now();
+      }
+      const pinnedForMs = this.now() - inFlight.midFlightPinnedSinceMs;
+      if (pinnedForMs >= MIDFLIGHT_ORPHAN_MIN_PINNED_MS && this.now() - inFlight.midFlightLastStatusCheckMs >= MIDFLIGHT_ORPHAN_RECHECK_MS) {
+        inFlight.midFlightLastStatusCheckMs = this.now();
+        const rootOngoing = await this.isSessionOngoing(sessionId);
+        inFlight.midFlightNotOngoingStreak = rootOngoing === false ? inFlight.midFlightNotOngoingStreak + 1 : 0;
+        if (isMidFlightOrphanConfirmed({
+          pinnedForMs,
+          minPinnedMs: MIDFLIGHT_ORPHAN_MIN_PINNED_MS,
+          notOngoingStreak: inFlight.midFlightNotOngoingStreak,
+          minNotOngoingStreak: MIDFLIGHT_ORPHAN_MIN_NOT_ONGOING_STREAK
+        })) {
+          if (this.sessionStoreHealth?.isUnwritable()) {
+            inFlight.sessionStoreFailurePending = true;
+            void this.postSignal(conv.id, id, "midflight_orphan_resolved", {
+              watched_for_ms: pinnedForMs,
+              ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
+              opencode_message_id: inFlight.opencodeMessageId,
+              run_state: "failed"
+            });
+            await this.settleMessageSessionStoreUnwritable(sessionId, watcher, inFlight);
+            return;
+          }
+          inFlight.midFlightOrphanSignalled = true;
+          const noteOutcome = extractReplyTextForMessage(messages, inFlight.opencodeMessageId) === null ? "midflight-without-answer" : "midflight-with-answer";
+          inFlight.midFlightOrphanWithoutAnswer = noteOutcome === "midflight-without-answer";
+          void this.postSignal(conv.id, id, "midflight_orphan_resolved", {
+            watched_for_ms: pinnedForMs,
+            ...rootOngoing != null ? { root_ongoing: rootOngoing } : {},
+            opencode_message_id: inFlight.opencodeMessageId,
+            ...inFlight.midFlightOrphanWithoutAnswer ? { run_state: "failed" } : {}
+          });
+          const note = composeAbandonmentNote(
+            void 0,
+            describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
+            noteOutcome
+          );
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} was pinned mid-flight for ${Math.round(pinnedForMs / 1e3)}s with root_ongoing=${rootOngoing} \u2014 resolving the orphaned turn`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+          if (inFlight.midFlightOrphanWithoutAnswer) {
+            await this.settleMessageAbandonedWithoutAnswer(
+              sessionId,
+              watcher,
+              inFlight,
+              messages,
+              note
+            );
+          } else {
+            await this.settleMessageDone(sessionId, watcher, inFlight, messages, note);
+          }
+          return;
+        }
+        if (rootOngoing === true && !inFlight.midFlightHeldLogged) {
+          inFlight.midFlightHeldLogged = true;
+          const replyShape = describeAbandonedReplyShape(messages, inFlight.opencodeMessageId);
+          this.log({
+            level: "warn",
+            message: `Message ${id.slice(0, 8)} was pinned mid-flight for ${Math.round(pinnedForMs / 1e3)}s with root_ongoing=true \u2014 holding; last tool ${replyShape?.lastToolName ?? "(unknown)"} status ${replyShape?.lastToolStatus ?? "(unknown)"}`,
+            conversation_id: conv.id,
+            message_id: id
+          });
+        }
+      }
+    }
+    if (watcher.inFlight.has(inFlight.evidentMessageId) && activelyRunning && this.now() - inFlight.processingAnchorMs >= ABSOLUTE_MAX_PROCESSING_MS) {
+      await this.settleAbsoluteCeiling(sessionId, watcher, messages, ceilingAttemptsThisTick);
       return;
     }
     const heartbeatDue = activelyRunning && !inFlight.awaitingHumanLatched && !inFlight.aliveInFlight && this.now() - inFlight.lastAliveAt >= HEARTBEAT_MS;
@@ -10618,13 +11684,8 @@ var ChannelDriver = class _ChannelDriver {
     this.removeInFlight(watcher, inFlight.evidentMessageId);
   }
   /** Report a confirmed b2 abandonment that produced no answer text. */
-  async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, finish) {
+  async settleMessageAbandonedWithoutAnswer(sessionId, watcher, inFlight, messages, error2) {
     const conv = watcher.conv;
-    const error2 = composeAbandonmentNote(
-      finish,
-      describeAbandonedReplyShape(messages, inFlight.opencodeMessageId),
-      "without-answer"
-    );
     this.anchorDeliveryDeadline(inFlight);
     this.log({
       level: "warn",
@@ -10648,7 +11709,8 @@ var ChannelDriver = class _ChannelDriver {
         usage,
         void 0,
         usageAgentName,
-        subagentInvocations
+        subagentInvocations,
+        true
       );
     } catch (err) {
       if (err instanceof ChannelAuthError) throw err;
@@ -11042,6 +12104,33 @@ var ChannelDriver = class _ChannelDriver {
     }
     const restartAborted = state === "failed" && sessionOngoing === false && isAbortedTerminalReply(messages, ocId ?? "");
     if (restartAborted) {
+      const age = this.absoluteAgeForRow(row.processing_started_at);
+      if (age.tripped && age.anchorMs !== null) {
+        try {
+          await this.markFailed(
+            row.conversation_id,
+            row.id,
+            sessionId,
+            this.absoluteCeilingError(row.id, sessionId, age.anchorMs),
+            void 0,
+            {
+              classification: null,
+              errorShape: extractReplyErrorShape(findLastAssistantReplyFor(messages, ocId ?? ""))
+            }
+          );
+        } catch (err) {
+          if (err instanceof ChannelAuthError) throw err;
+          this.log({
+            level: "warn",
+            message: `Re-adopt: failed to report past-ceiling restart orphan ${row.id.slice(0, 8)} terminal; refusing to re-dispatch: ${err instanceof Error ? err.message : String(err)}`,
+            conversation_id: row.conversation_id,
+            message_id: row.id
+          });
+          return;
+        }
+        void this.postSignal(row.conversation_id, row.id, "redrive_ceiling_refused");
+        return;
+      }
       this.log({
         level: "info",
         message: `Re-adopt: message ${row.id.slice(0, 8)} carries an abort-shaped terminal error and session ${sessionId.slice(0, 8)} is not-ongoing per the active-session status check \u2014 restart orphan, re-dispatching instead of marking it permanently failed`,
@@ -11587,7 +12676,8 @@ var ChannelDriver = class _ChannelDriver {
       source_message_id: row.source_message_id,
       slack_user_id: row.slack_user_id,
       attachments: row.attachments ?? null,
-      opencode_message_id: row.opencode_message_id
+      opencode_message_id: row.opencode_message_id,
+      processing_started_at: row.processing_started_at
     };
   }
   /**
@@ -12494,7 +13584,7 @@ var ChannelDriver = class _ChannelDriver {
    *     exists but is wedged, so the next attempt must get a fresh one
    *     instead of reusing it — see WI-1's server-side null-clearing PATCH).
    */
-  async markFailed(conversationId, messageId, sessionId, error2, usage, failure, usageAgentName, subagentInvocations) {
+  async markFailed(conversationId, messageId, sessionId, error2, usage, failure, usageAgentName, subagentInvocations, abandonedWithoutAnswer) {
     const body = { status: "failed" };
     if (sessionId === null) {
       body.opencode_session_id = null;
@@ -12507,12 +13597,19 @@ var ChannelDriver = class _ChannelDriver {
     if (subagentInvocations && subagentInvocations.length > 0) {
       body.subagent_invocations = subagentInvocations;
     }
-    if (failure) {
-      body.failure_kind = failure.kind;
-      body.failure_provider_id = failure.providerId;
-      body.failure_model_id = failure.modelId;
-      body.failure_reason = failure.reason;
+    if (failure && failure.errorShape.name !== null) {
+      body.failure_error_name = failure.errorShape.name;
+    }
+    if (failure && failure.errorShape.statusCode !== null) {
+      body.failure_status_code = failure.errorShape.statusCode;
     }
+    if (failure?.classification) {
+      body.failure_kind = failure.classification.kind;
+      body.failure_provider_id = failure.classification.providerId;
+      body.failure_model_id = failure.classification.modelId;
+      body.failure_reason = failure.classification.reason;
+    }
+    if (abandonedWithoutAnswer) body.abandoned_without_answer = true;
     try {
       await this.callWithRetry(
         "marking message as failed",
@@ -12532,27 +13629,28 @@ var ChannelDriver = class _ChannelDriver {
     this.clearSubagentInvocationCaches(messageId);
   }
   /**
-   * Classify an errored turn as a model-auth failure (#736 P1-4), for `markFailed`.
+   * Classify an errored turn and extract its bounded error shape for `markFailed`.
    *
    * `messageFailure` alone (structured OpenCode error → `model_auth`) covers
    * most cases; when it returns `null` on this ALREADY-FAILED turn, fall back
    * to the P1-2b zero-provider check — one extra loopback call to
    * `hasAnyConfiguredProvider`, only reached when the structured classifier
    * couldn't place it. Fails open (never throws): a fallback probe failure
-   * (`null`/indeterminate) leaves the classification `null`, which produces
-   * today's byte-identical PATCH body via `markFailed`'s `if (failure)` guard.
+   * (`null`/indeterminate) leaves the classification `null`; the raw error shape
+   * is still retained for diagnostics.
    */
   async classifyModelAuthFailure(messages, userMessageId) {
-    const classified = messageFailure(messages, userMessageId);
-    if (classified != null) return classified;
     const reply = findLastAssistantReplyFor(messages, userMessageId);
-    const hasProvider = await this.hasAnyConfiguredProvider();
-    return applyZeroProviderFallback(
+    const errorShape = extractReplyErrorShape(reply);
+    const classified = messageFailure(messages, userMessageId);
+    if (classified != null) return { classification: classified, errorShape };
+    const classification = applyZeroProviderFallback(
       classified,
-      hasProvider,
+      await this.hasAnyConfiguredProvider(),
       reply?.info?.providerID ?? null,
       reply?.info?.modelID ?? null
     );
+    return { classification, errorShape };
   }
   async recordSubagentModelAuthFailure(failure, conversationId, messageId) {
     const providerId = failure.providerId ?? "(unknown)";
@@ -13099,7 +14197,7 @@ Port ${port} is already in use.`));
 }
 
 // src/lib/runner-credentials.ts
-import { chmodSync as chmodSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync as chmodSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { spawn as spawn5 } from "node:child_process";
 var RUNNER_SECRET_FETCH_TIMEOUT_MS = 6e4;
 var CREDENTIAL_RESTORE_TIMEOUT_MS = 6e4;
@@ -13342,8 +14440,8 @@ async function configureGitHubAccess({ env, log: log3 }) {
   }
   try {
     env.GIT_CONFIG_GLOBAL = GIT_CONFIG_GLOBAL;
-    writeFileSync4(GIT_CONFIG_GLOBAL, "");
-    writeFileSync4(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
+    writeFileSync5(GIT_CONFIG_GLOBAL, "");
+    writeFileSync5(GIT_CREDENTIAL_HELPER, GIT_CREDENTIAL_HELPER_CONTENT, { mode: 448 });
     chmodSync2(GIT_CREDENTIAL_HELPER, 448);
     const config = [
       ["user.name", env.GIT_USER_NAME ?? "evident-bot"],
@@ -13376,7 +14474,23 @@ async function configureGitHubAccess({ env, log: log3 }) {
 // src/lib/opencode/config-overlay.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { copyFileSync, existsSync as existsSync2, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
+function parseConfigContent(content) {
+  if (!content?.trim()) return {};
+  const parsed = JSON.parse(content);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("OPENCODE_CONFIG_CONTENT must contain a JSON object");
+  }
+  return parsed;
+}
+function mergeManagedOpenCodeConfigContent(content, managedProviders) {
+  const config = parseConfigContent(content);
+  const provider = typeof config.provider === "object" && config.provider !== null && !Array.isArray(config.provider) ? { ...config.provider } : {};
+  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
+    delete provider[namespace];
+  }
+  return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
+}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -13390,7 +14504,7 @@ function applyRunnerOpenCodeConfig({
     return;
   }
   const source = isAbsolute3(overlayPath) ? overlayPath : resolve4(cwd, overlayPath);
-  const target = isFile(join11(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
+  const target = isFile(join12(cwd, "opencode.jsonc")) ? "opencode.jsonc" : "opencode.json";
   if (!isFile(source)) {
     log3(
       `RUNNER-OPENCODE-CONFIG-MISSING: ${source} is not a file; headless turns will wedge on the first external-directory permission prompt (#563)`,
@@ -13398,7 +14512,7 @@ function applyRunnerOpenCodeConfig({
     );
     return;
   }
-  copyFileSync(source, join11(cwd, target));
+  copyFileSync(source, join12(cwd, target));
   try {
     execFileSync2("git", ["-C", cwd, "update-index", "--skip-worktree", target], {
       stdio: "ignore"
@@ -13407,11 +14521,164 @@ function applyRunnerOpenCodeConfig({
     const detail = error2 instanceof Error ? error2.message : String(error2);
     log3(`could not mark ${target} skip-worktree: ${detail}; it may show as a local change`, "warn");
   }
-  log3(`Applied runner OpenCode config ${source} to ${join11(cwd, target)}`);
+  log3(`Applied runner OpenCode config ${source} to ${join12(cwd, target)}`);
+}
+
+// src/lib/opencode/runtime-provenance.ts
+import { readFileSync as readFileSync8, readdirSync } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join13 } from "node:path";
+var PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
+var REGISTRY_SPEC = /^[a-z0-9.*+^~<>=|-]+$/i;
+function errorKind(error2) {
+  if (!(error2 instanceof Error)) return "unknown error";
+  const code = "code" in error2 && typeof error2.code === "string" ? ` (${error2.code})` : "";
+  return `${error2.name}${code}`;
+}
+function parseRegistryPluginSpec(value) {
+  const separator = value.lastIndexOf("@");
+  if (separator <= 0) return null;
+  const name = value.slice(0, separator);
+  const spec = value.slice(separator + 1);
+  if (!PACKAGE_NAME.test(name) || !REGISTRY_SPEC.test(spec)) return null;
+  return { name, spec };
+}
+function parseJsonc(value) {
+  let output = "";
+  let inString = false;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < value.length; index++) {
+    const character = value[index];
+    const next = value[index + 1];
+    if (lineComment) {
+      if (character === "\n") {
+        lineComment = false;
+        output += character;
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        blockComment = false;
+        index++;
+      } else if (character === "\n") {
+        output += character;
+      }
+      continue;
+    }
+    if (inString) {
+      output += character;
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === '"') inString = false;
+      continue;
+    }
+    if (character === '"') {
+      inString = true;
+      output += character;
+    } else if (character === "/" && next === "/") {
+      lineComment = true;
+      index++;
+    } else if (character === "/" && next === "*") {
+      blockComment = true;
+      index++;
+    } else if (character === ",") {
+      let lookahead = index + 1;
+      while (/\s/.test(value[lookahead] ?? "")) lookahead++;
+      if (value[lookahead] !== "]" && value[lookahead] !== "}") output += character;
+    } else {
+      output += character;
+    }
+  }
+  return JSON.parse(output);
+}
+function openCodeCacheRoot(env = process.env, homeDir = homedir7()) {
+  return join13(env.XDG_CACHE_HOME ?? join13(homeDir, ".cache"), "opencode");
+}
+function readConfiguredPluginSpecs({
+  cwd = process.cwd(),
+  log: log3
+}) {
+  let config;
+  try {
+    try {
+      config = parseJsonc(readFileSync8(join13(cwd, "opencode.jsonc"), "utf8"));
+    } catch (error2) {
+      if (!("code" in Object(error2)) || Object(error2).code !== "ENOENT") throw error2;
+      config = parseJsonc(readFileSync8(join13(cwd, "opencode.json"), "utf8"));
+    }
+  } catch (error2) {
+    log3(`Could not read OpenCode plugin configuration: ${errorKind(error2)}`);
+    return [];
+  }
+  if (typeof config !== "object" || config === null || !("plugin" in config)) return [];
+  const plugins = config.plugin;
+  if (!Array.isArray(plugins)) {
+    log3("Could not read OpenCode plugin configuration: plugin is not an array");
+    return [];
+  }
+  const configured = plugins.filter(
+    (plugin) => typeof plugin === "string" && parseRegistryPluginSpec(plugin) !== null
+  );
+  if (configured.length !== plugins.length) {
+    log3(
+      `Skipped ${plugins.length - configured.length} non-registry OpenCode plugin spec(s); their values were not recorded`
+    );
+  }
+  return configured;
+}
+function resolveInstalledPluginVersions({
+  cacheRoot,
+  env = process.env,
+  homeDir = homedir7(),
+  log: log3
+}) {
+  const packagesRoot = join13(cacheRoot ?? openCodeCacheRoot(env, homeDir), "packages");
+  let directories;
+  try {
+    directories = readdirSync(packagesRoot, { withFileTypes: true });
+  } catch (error2) {
+    if ("code" in Object(error2) && Object(error2).code === "ENOENT") return [];
+    log3(`Could not inspect the OpenCode plugin cache: ${errorKind(error2)}`);
+    return [];
+  }
+  const plugins = [];
+  let skipped = 0;
+  for (const directory of directories) {
+    if (!directory.isDirectory()) continue;
+    const parsed = parseRegistryPluginSpec(directory.name);
+    if (parsed === null) {
+      skipped++;
+      continue;
+    }
+    let resolvedVersion = null;
+    try {
+      const packageJson = JSON.parse(
+        readFileSync8(
+          join13(packagesRoot, directory.name, "node_modules", parsed.name, "package.json"),
+          "utf8"
+        )
+      );
+      if (typeof packageJson.version === "string" && REGISTRY_SPEC.test(packageJson.version)) {
+        resolvedVersion = packageJson.version;
+      } else {
+        log3(`Could not resolve OpenCode plugin ${parsed.name}@${parsed.spec}: invalid version`);
+      }
+    } catch (error2) {
+      log3(`Could not resolve OpenCode plugin ${parsed.name}@${parsed.spec}: ${errorKind(error2)}`);
+    }
+    plugins.push({ ...parsed, resolvedVersion });
+  }
+  if (skipped > 0) {
+    log3(`Skipped ${skipped} non-registry OpenCode package cache entry; its value was not recorded`);
+  }
+  return plugins;
 }
 
 // src/lib/credential-sync.ts
-import { renameSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { renameSync, writeFileSync as writeFileSync6 } from "node:fs";
 var CREDENTIAL_SYNC_TICK_TIMEOUT_MS = 3e4;
 var CREDENTIAL_FLUSH_DEADLINE_MS = 8e3;
 var CREDENTIAL_FLUSH_ABORT_GRACE_MS = 500;
@@ -13445,7 +14712,7 @@ function writeMarker(markerPath, outcomes, log3) {
 `;
   const temporaryPath = `${markerPath}.tmp`;
   try {
-    writeFileSync5(temporaryPath, body, { mode: 384 });
+    writeFileSync6(temporaryPath, body, { mode: 384 });
     renameSync(temporaryPath, markerPath);
   } catch (error2) {
     log3(`CREDENTIAL-FLUSH-MARKER-UNWRITABLE: ${markerPath}: ${errorMessage2(error2)}`, "warn");
@@ -13645,10 +14912,261 @@ function createCredentialSync({
   };
 }
 
+// src/lib/managed-inference-setup.ts
+var defaultStore = {
+  get: getManagedInferenceCredential,
+  set: setManagedInferenceCredential,
+  clear: clearManagedInferenceCredential
+};
+function endpoint(options, operation) {
+  return `${options.apiUrl}/runners/${options.agentId}/managed-credentials/${operation}`;
+}
+function requestHeaders(options) {
+  return { Authorization: options.getAuthHeader(), "Content-Type": "application/json" };
+}
+function request2(options) {
+  return withRequestTimeout(options.fetchImpl ?? fetch, REQUEST_TIMEOUT_MS);
+}
+function safeFailure(operation, status2) {
+  return status2 === void 0 ? `${operation} could not reach the managed credential service` : `${operation} returned HTTP ${status2}`;
+}
+function logTransportFailure(options, operation, error2, authorization) {
+  let detail = error2 instanceof Error ? error2.message : String(error2);
+  const credential = authorization.split(/\s+/, 2)[1];
+  for (const secret of [authorization, credential]) {
+    if (secret) detail = detail.replaceAll(secret, "[redacted]");
+  }
+  options.log(
+    `MANAGED-INFERENCE-TRANSPORT-FAILED: operation=${operation} detail=${redactDiagnosticText(detail)}`,
+    "debug"
+  );
+}
+async function responseJson(response) {
+  try {
+    const value = await response.json();
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch (error2) {
+    return null;
+  }
+}
+function readSetup(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const setup = value;
+  if (typeof setup.runner_id !== "string" || typeof setup.generation !== "string" || typeof setup.status !== "string" || setup.token_id !== null && typeof setup.token_id !== "string" || typeof setup.acknowledged_at !== "string" && setup.acknowledged_at !== null) {
+    return null;
+  }
+  return setup;
+}
+function clearLocalSetup(options) {
+  const env = options.env ?? process.env;
+  const store = options.store ?? defaultStore;
+  const stored = store.get(options.agentId);
+  store.clear(options.agentId);
+  const token = env.EVIDENT_PROXY_TOKEN;
+  if (token !== void 0 && token === stored?.token) {
+    delete env.EVIDENT_PROXY_TOKEN;
+  } else if (token !== void 0) {
+    options.log(
+      `MANAGED-INFERENCE-CLEANUP-PRESERVED-EXTERNAL-TOKEN: runner=${options.agentId}`,
+      "debug"
+    );
+  }
+}
+async function discoverManagedInferenceSetup(options) {
+  const headers = requestHeaders(options);
+  let response;
+  try {
+    response = await request2(options)(endpoint(options, "current"), {
+      headers
+    });
+  } catch (error2) {
+    logTransportFailure(options, "discovery", error2, headers.Authorization);
+    return { kind: "failed", reason: safeFailure("Managed setup discovery") };
+  }
+  if (response.status === 404) {
+    clearLocalSetup(options);
+    return { kind: "none" };
+  }
+  if (!response.ok) {
+    return { kind: "failed", reason: safeFailure("Managed setup discovery", response.status) };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed setup discovery returned an invalid response" };
+}
+async function enrollManagedInferenceSetup(options) {
+  const response = await post(options, "enroll", {});
+  if (!response) {
+    return { kind: "failed", reason: safeFailure("Managed credential enrollment") };
+  }
+  if (response.status === 404) {
+    return { kind: "none" };
+  }
+  const body = await responseJson(response);
+  if (!response.ok) {
+    const serverError = body?.error;
+    return {
+      kind: "failed",
+      reason: typeof serverError === "string" && serverError.trim() ? redactDiagnosticText(serverError).slice(0, 500) : safeFailure("Managed credential enrollment", response.status)
+    };
+  }
+  const setup = readSetup(body?.setup);
+  return setup ? { kind: "setup", setup } : { kind: "failed", reason: "Managed credential enrollment returned an invalid response" };
+}
+async function post(options, operation, body) {
+  const headers = requestHeaders(options);
+  try {
+    return await request2(options)(endpoint(options, operation), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+  } catch (error2) {
+    logTransportFailure(options, operation, error2, headers.Authorization);
+    return null;
+  }
+}
+function applyCredential(options, credential) {
+  const env = options.env ?? process.env;
+  let merged;
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
+  }
+  try {
+    (options.store ?? defaultStore).set(options.agentId, credential);
+  } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
+    options.log(
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
+      "warn"
+    );
+    return "Managed credentials could not be written to the protected store";
+  }
+  env.EVIDENT_PROXY_TOKEN = credential.token;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
+  return null;
+}
+async function reportManagedInferenceApplyFailure(options, failure) {
+  const response = await post(options, "report-failure", {
+    generation: failure.generation,
+    token_id: failure.tokenId
+  });
+  if (!response?.ok) {
+    options.log(
+      `MANAGED-INFERENCE-REPORT-FAILED: runner=${options.agentId} generation=${failure.generation}${response ? ` status=${response.status}` : ""}`,
+      "warn"
+    );
+  }
+}
+async function reaffirmStored(options, credential) {
+  const response = await post(options, "reaffirm", {
+    generation: credential.generation,
+    token_id: credential.tokenId
+  });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response?.status === 409 ? "Stored managed credential no longer matches this setup; restart required" : response ? safeFailure("Managed credential reaffirmation", response.status) : safeFailure("Managed credential reaffirmation")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== credential.generation || setup.token_id !== credential.tokenId) {
+    return { kind: "failed", reason: "Managed credential reaffirmation returned a mismatch" };
+  }
+  const failure = applyCredential(options, credential);
+  return failure ? { kind: "failed", reason: failure } : { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function prepareManagedInferenceSetup(options, discovery, health) {
+  if (health.authFailed) {
+    return {
+      kind: "failed",
+      reason: "OpenCode authentication failed; managed credentials were not rotated"
+    };
+  }
+  const stored = (options.store ?? defaultStore).get(options.agentId);
+  if (health.healthy) {
+    if (!stored) {
+      return {
+        kind: "failed",
+        reason: "Managed credentials are missing for the serving OpenCode process; restart required"
+      };
+    }
+    return reaffirmStored(options, stored);
+  }
+  if (discovery.setup.acknowledged_at !== null && stored?.generation === discovery.setup.generation && stored.tokenId === discovery.setup.token_id) {
+    return reaffirmStored(options, stored);
+  }
+  const response = await post(options, "bootstrap", { generation: discovery.setup.generation });
+  if (!response?.ok) {
+    return {
+      kind: "failed",
+      reason: response ? safeFailure("Managed credential bootstrap", response.status) : safeFailure("Managed credential bootstrap")
+    };
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  const token = body?.inference_token;
+  const inferenceBaseUrl = body?.inference_base_url;
+  const modelDescriptors = body?.model_descriptors;
+  if (!setup || setup.generation !== discovery.setup.generation || typeof setup.token_id !== "string" || typeof token !== "string" || typeof inferenceBaseUrl !== "string" || !Array.isArray(modelDescriptors) || !modelDescriptors.every(
+    (descriptor) => typeof descriptor === "object" && descriptor !== null && typeof descriptor.id === "string" && typeof descriptor.provider === "string"
+  )) {
+    return { kind: "failed", reason: "Managed credential bootstrap returned an invalid response" };
+  }
+  const credential = {
+    generation: setup.generation,
+    tokenId: setup.token_id,
+    token,
+    inferenceBaseUrl,
+    modelDescriptors
+  };
+  const failure = applyCredential(options, credential);
+  if (failure) {
+    await reportManagedInferenceApplyFailure(options, credential);
+    return { kind: "failed", reason: failure };
+  }
+  return { kind: "ready", generation: credential.generation, tokenId: credential.tokenId };
+}
+async function acknowledgeManagedInferenceSetup(options, preparation) {
+  const response = await post(options, "acknowledge", {
+    generation: preparation.generation,
+    token_id: preparation.tokenId,
+    config_validated: options.autoConfigureCredentialsProxy === true
+  });
+  if (!response?.ok) {
+    throw new Error(
+      response ? safeFailure("Managed credential acknowledgment", response.status) : safeFailure("Managed credential acknowledgment")
+    );
+  }
+  const body = await responseJson(response);
+  const setup = readSetup(body?.setup);
+  if (!setup || setup.generation !== preparation.generation || setup.token_id !== preparation.tokenId) {
+    throw new Error("Managed credential acknowledgment returned a mismatch");
+  }
+  return response.status === 200 && setup.status === "acknowledged" ? "acknowledged" : "pending";
+}
+
 // src/commands/run.ts
 var MAX_ACTIVITY_LOG_ENTRIES = 10;
 var MAX_DISCONNECT_REASON_LENGTH = 200;
 var CHANNEL_POLL_INTERVAL_MS = Number(process.env.EVIDENT_CHANNEL_POLL_INTERVAL_MS) || 2e3;
+var CREDENTIAL_ADOPTION_PROBE_ATTEMPTS = 3;
+var CREDENTIAL_ADOPTION_PROBE_INTERVAL_MS = 1e3;
 var CHANNEL_STUCK_QUEUED_MS = Number(process.env.EVIDENT_STUCK_QUEUED_MS) || void 0;
 var SHUTDOWN_DRAIN_TIMEOUT_MS = Number(process.env.EVIDENT_SHUTDOWN_DRAIN_MS) || 25e3;
 var TELEMETRY_SHUTDOWN_TIMEOUT_MS = 5e3;
@@ -13676,33 +15194,49 @@ function resolveLogLevel(options) {
   }
   return "info";
 }
-function resolveFileSyncDirectories(raw, homeDir) {
-  const directories = [];
+function resolveFileSyncEntry(entry, homeDir, flagName, labels) {
+  const trimmed = entry.trim();
+  if (trimmed === "") {
+    throw new Error(`${flagName} requires a ${labels.noun} path (got an empty value)`);
+  }
+  const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join14(homeDir, trimmed.slice(2)) : trimmed;
+  if (!isAbsolute4(expanded)) {
+    throw new Error(`${flagName} requires an absolute ${labels.noun} path; got "${entry}"`);
+  }
+  const normalized = resolvePath2(expanded);
+  if (parse(normalized).root === normalized) {
+    throw new Error(
+      `${flagName} will not allow-list the filesystem root ("${entry}"); name the specific ${labels.noun} the credentials belong in (for example ${labels.rootExample})`
+    );
+  }
+  return normalized;
+}
+function resolveFileSyncAllowList(raw, homeDir, flagName, labels) {
+  const paths = [];
   for (const entry of raw ?? []) {
-    const trimmed = entry.trim();
-    if (trimmed === "") {
-      throw new Error("--enable-file-sync-to requires a directory path (got an empty value)");
-    }
-    const expanded = trimmed === "~" ? homeDir : trimmed.startsWith("~/") ? join12(homeDir, trimmed.slice(2)) : trimmed;
-    if (!isAbsolute4(expanded)) {
-      throw new Error(`--enable-file-sync-to requires an absolute directory path; got "${entry}"`);
-    }
-    const normalized = resolvePath2(expanded);
-    if (parse(normalized).root === normalized) {
-      throw new Error(
-        `--enable-file-sync-to will not allow-list the filesystem root ("${entry}"); name the specific directory the credentials belong in (for example ~/.claude)`
-      );
-    }
-    if (!directories.includes(normalized)) {
-      directories.push(normalized);
-    }
+    const normalized = resolveFileSyncEntry(entry, homeDir, flagName, labels);
+    if (!paths.includes(normalized)) paths.push(normalized);
   }
-  if (directories.length > MAX_FILE_SYNC_DIRECTORIES) {
+  if (paths.length > MAX_FILE_SYNC_DIRECTORIES) {
     throw new Error(
-      `--enable-file-sync-to accepts at most ${MAX_FILE_SYNC_DIRECTORIES} directories; got ${directories.length}`
+      `${flagName} accepts at most ${MAX_FILE_SYNC_DIRECTORIES} ${labels.plural}; got ${paths.length}`
     );
   }
-  return directories;
+  return paths;
+}
+function resolveFileSyncDirectories(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to", {
+    noun: "directory",
+    plural: "directories",
+    rootExample: "~/.claude"
+  });
+}
+function resolveFileSyncExactFiles(raw, homeDir) {
+  return resolveFileSyncAllowList(raw, homeDir, "--enable-file-sync-to-exact-file", {
+    noun: "file",
+    plural: "files",
+    rootExample: "~/.local/share/opencode/mcp-auth.json"
+  });
 }
 var DEFAULT_OPENCODE_START_TIMEOUT_SECONDS = 180;
 var MAX_OPENCODE_START_TIMEOUT_SECONDS = 3600;
@@ -13838,7 +15372,7 @@ function logActivity(state, entry) {
 }
 function reportSessionDbRecovery(state) {
   try {
-    const report = drainSessionDbRecoveryReport({ homeDir: homedir7(), env: process.env });
+    const report = drainSessionDbRecoveryReport({ homeDir: homedir8(), env: process.env });
     for (const record of report.records) {
       const activity = buildSessionDbRecoveryActivity(record);
       if (!activity) throw new Error("could not map session-DB recovery record");
@@ -13919,7 +15453,7 @@ async function importOpenCodeV2CredentialsForState(state) {
   }
   const result = await importOpenCodeV2Credentials({
     request: client.request,
-    homeDir: homedir7(),
+    homeDir: homedir8(),
     directory,
     guard: state.opencodeV2CredentialImportGuard,
     log: (message, level = "info") => logActivity(state, { type: "info", level, message })
@@ -13996,6 +15530,125 @@ async function handleAuthError(state, error2) {
     return { success: false };
   }
 }
+function logCredentialAdoptionActivity(state, activity, level) {
+  const message = (() => {
+    switch (activity.outcome) {
+      case "deferred":
+        return `CREDENTIAL-ADOPTION: deferred generation ${activity.generation} with ${activity.active_sessions} active session(s)`;
+      case "reloaded_ready":
+        return `CREDENTIAL-ADOPTION: adopted generation ${activity.generation} with ${activity.active_sessions} active session(s); readiness probe succeeded after ${activity.probe_attempts} attempt(s)`;
+      case "reloaded_interrupted": {
+        const response = activity.probe_status === null ? "without an HTTP response" : `with HTTP ${activity.probe_status} and ${activity.probe_body_empty ? "an empty" : "a non-empty"} body`;
+        return `CREDENTIAL-ADOPTION: generation ${activity.generation} with ${activity.active_sessions} active session(s); replacement instance answered ${response} after ${activity.probe_attempts} probe attempt(s)`;
+      }
+      case "reload_failed":
+        return `CREDENTIAL-ADOPTION: failed to adopt generation ${activity.generation} with ${activity.active_sessions} active session(s)`;
+      case "skipped_v2":
+        return `CREDENTIAL-ADOPTION: skipped generation ${activity.generation} with ${activity.active_sessions} active session(s) on OpenCode V2`;
+    }
+  })();
+  logActivity(state, {
+    type: level === "error" ? "error" : "info",
+    level,
+    ...level === "error" ? { error: message } : { message },
+    metadata: {
+      ...activity,
+      opencode_version: state.opencodeVersion,
+      port: state.port
+    }
+  });
+}
+async function adoptCredentialGeneration(state, generation, adoption, activeSessions, deferredForMs) {
+  const reload = await disposeAndReloadProviderConfig(
+    state.port,
+    state.opencodeClient ?? void 0
+  );
+  if (reload.outcome === "failed") {
+    logCredentialAdoptionActivity(
+      state,
+      {
+        outcome: "reload_failed",
+        generation,
+        active_sessions: activeSessions,
+        adoption,
+        deferred_for_ms: deferredForMs,
+        reload_status: reload.status,
+        reload_detail: reload.detail,
+        probe_attempts: null,
+        probe_status: null,
+        probe_body_empty: null,
+        probe_detail: null
+      },
+      "error"
+    );
+    return;
+  }
+  if (reload.outcome === "skipped_v2") {
+    logCredentialAdoptionActivity(
+      state,
+      {
+        outcome: "skipped_v2",
+        generation,
+        active_sessions: activeSessions,
+        adoption,
+        deferred_for_ms: deferredForMs,
+        reload_status: null,
+        reload_detail: null,
+        probe_attempts: null,
+        probe_status: null,
+        probe_body_empty: null,
+        probe_detail: null
+      },
+      "debug"
+    );
+    return;
+  }
+  let lastProbe = null;
+  let attempts = 0;
+  for (attempts = 1; attempts <= CREDENTIAL_ADOPTION_PROBE_ATTEMPTS; attempts++) {
+    lastProbe = await probeOpenCodeRequestReadiness(state.port, state.opencodeClient ?? void 0);
+    if (lastProbe.ok) {
+      logCredentialAdoptionActivity(
+        state,
+        {
+          outcome: "reloaded_ready",
+          generation,
+          active_sessions: activeSessions,
+          adoption,
+          deferred_for_ms: deferredForMs,
+          reload_status: null,
+          reload_detail: null,
+          probe_attempts: attempts,
+          probe_status: lastProbe.status,
+          probe_body_empty: lastProbe.bodyEmpty,
+          probe_detail: lastProbe.detail
+        },
+        "warn"
+      );
+      return;
+    }
+    if (attempts < CREDENTIAL_ADOPTION_PROBE_ATTEMPTS) {
+      await new Promise((resolve5) => setTimeout(resolve5, CREDENTIAL_ADOPTION_PROBE_INTERVAL_MS));
+    }
+  }
+  logCredentialAdoptionActivity(
+    state,
+    {
+      outcome: "reloaded_interrupted",
+      generation,
+      active_sessions: activeSessions,
+      adoption,
+      deferred_for_ms: deferredForMs,
+      reload_status: null,
+      reload_detail: null,
+      probe_attempts: CREDENTIAL_ADOPTION_PROBE_ATTEMPTS,
+      probe_status: lastProbe?.status ?? null,
+      probe_body_empty: lastProbe?.bodyEmpty ?? null,
+      probe_detail: lastProbe?.detail ?? null
+    },
+    "error"
+  );
+}
 async function driveChannels(state, driver) {
   let idlePolls = 0;
   let idleMs = 0;
@@ -14005,6 +15658,15 @@ async function driveChannels(state, driver) {
   let lastSeenAppliedFiles = driver.fileSyncActivity().appliedFiles;
   let lastSeenClaudeApplies = driver.fileSyncActivity().claudeCredentialApplies;
   let lastSeenOpencodeAuthApplies = driver.fileSyncActivity().opencodeAuthApplyCount;
+  const credentialAdoption = {
+    generation: 0,
+    pendingGeneration: null,
+    pendingSinceMs: null,
+    deferredGeneration: null,
+    adoption: 0
+  };
+  const stayAwakeHolds = () => state.stayAwakeUntilMs !== null && Date.now() < state.stayAwakeUntilMs;
+  let stayAwakeSuppressionLogged = false;
   while (state.running) {
     const cycleStartedAtMs = performance.now();
     let idleThisCycle = false;
@@ -14046,12 +15708,30 @@ async function driveChannels(state, driver) {
       lastSeenOpencodeAuthApplies = opencodeAuthApplies;
       if (opencodeAuthApplied) state.openaiUsageRearm?.();
       if (claudeCredentialApplied || opencodeAuthApplied) {
-        void reloadProviderCache(state.port, state.opencodeClient ?? void 0).catch(
-          (error2) => logActivity(state, {
-            type: "error",
-            error: `OpenCode provider cache reload failed on port ${state.port}: ${error2 instanceof Error ? error2.message : String(error2)}`
-          })
-        );
+        credentialAdoption.generation++;
+        if (state.opencodeApiVersion === "v2") {
+          logCredentialAdoptionActivity(
+            state,
+            {
+              outcome: "skipped_v2",
+              generation: credentialAdoption.generation,
+              active_sessions: driver.protectedSessionIds().size,
+              adoption: null,
+              deferred_for_ms: null,
+              reload_status: null,
+              reload_detail: null,
+              probe_attempts: null,
+              probe_status: null,
+              probe_body_empty: null,
+              probe_detail: null
+            },
+            "debug"
+          );
+        } else {
+          credentialAdoption.pendingGeneration = credentialAdoption.generation;
+          credentialAdoption.pendingSinceMs = Date.now();
+          credentialAdoption.deferredGeneration = null;
+        }
       }
       if (opencodeAuthApplied && state.opencodeApiVersion === "v2") {
         void importOpenCodeV2CredentialsForState(state).catch(
@@ -14106,6 +15786,49 @@ async function driveChannels(state, driver) {
         }
       }
     }
+    if (credentialAdoption.pendingGeneration !== null) {
+      const activeSessions = driver.protectedSessionIds();
+      const generation = credentialAdoption.pendingGeneration;
+      if (activeSessions.size > 0) {
+        if (credentialAdoption.deferredGeneration !== generation) {
+          credentialAdoption.deferredGeneration = generation;
+          logCredentialAdoptionActivity(
+            state,
+            {
+              outcome: "deferred",
+              generation,
+              active_sessions: activeSessions.size,
+              adoption: null,
+              deferred_for_ms: null,
+              reload_status: null,
+              reload_detail: null,
+              probe_attempts: null,
+              probe_status: null,
+              probe_body_empty: null,
+              probe_detail: null
+            },
+            "warn"
+          );
+        }
+      } else {
+        const deferredForMs = credentialAdoption.deferredGeneration === generation && credentialAdoption.pendingSinceMs !== null ? Math.max(0, Date.now() - credentialAdoption.pendingSinceMs) : null;
+        credentialAdoption.pendingGeneration = null;
+        credentialAdoption.pendingSinceMs = null;
+        credentialAdoption.adoption++;
+        void adoptCredentialGeneration(
+          state,
+          generation,
+          credentialAdoption.adoption,
+          activeSessions.size,
+          deferredForMs
+        ).catch(
+          (error2) => logActivity(state, {
+            type: "error",
+            error: `CREDENTIAL-ADOPTION: adoption failed for generation ${generation} with ${activeSessions.size} active session(s) on port ${state.port}: ${error2 instanceof Error ? error2.message : String(error2)}`
+          })
+        );
+      }
+    }
     await new Promise((resolve5) => setTimeout(resolve5, CHANNEL_POLL_INTERVAL_MS));
     const cycleMs = performance.now() - cycleStartedAtMs;
     if (idleThisCycle) idleMs += cycleMs;
@@ -14119,11 +15842,20 @@ async function driveChannels(state, driver) {
       if (state.interactive) displayStatus(state);
       break;
     }
-    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3) {
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && !stayAwakeHolds()) {
       logActivity(state, { type: "info", message: "Idle timeout reached" });
       if (state.interactive) displayStatus(state);
       break;
     }
+    if (state.idleTimeout !== null && idlePolls >= 2 && idleMs > state.idleTimeout * 1e3 && stayAwakeHolds()) {
+      if (!stayAwakeSuppressionLogged) {
+        stayAwakeSuppressionLogged = true;
+        logActivity(state, {
+          type: "info",
+          message: "Idle, but staying awake until the requested minimum passes"
+        });
+      }
+    }
   }
 }
 var SESSION_CLEANUP_FIRST_SWEEP_MS = 1e4;
@@ -14141,7 +15873,7 @@ function shouldWarnForReclaimSkip(reason) {
   return major > 22 || major === 22 && (minor > 13 || minor === 13 && patch >= 0);
 }
 function sessionDbPath() {
-  return join12(homedir7(), ".local", "share", "opencode", "opencode.db");
+  return join14(homedir8(), ".local", "share", "opencode", "opencode.db");
 }
 function logSessionCleanupActivity(state, phase, entry) {
   logActivity(state, {
@@ -14150,6 +15882,47 @@ function logSessionCleanupActivity(state, phase, entry) {
     metadata: { ...entry.metadata, phase }
   });
 }
+async function drainSessionDeletionReports(state) {
+  const path = sessionDeletionReportPath(homedir8(), process.env);
+  let delivered = 0;
+  let failure = null;
+  try {
+    const spool = readSessionDeletionRecords(path);
+    if (spool.readError !== null) {
+      failure = `could not read spool: ${spool.readError}`;
+    } else if (spool.records.length === 0) {
+      return;
+    } else if (!state.agentId || !state.authHeader) {
+      failure = "runner authentication is not available";
+    } else {
+      for (let offset = 0; offset < spool.records.length; offset += 200) {
+        const batch = spool.records.slice(offset, offset + 200);
+        const result = await reportSessionDeletions(state.agentId, state.authHeader, batch);
+        if (!result.ok) {
+          failure = result.error ?? "unknown API error";
+          break;
+        }
+        removeDeliveredSessionDeletionRecords(path, batch);
+        delivered += batch.length;
+      }
+    }
+  } catch (error2) {
+    failure = error2 instanceof Error ? error2.message : String(error2);
+  }
+  const pending = readSessionDeletionRecords(path);
+  const pendingCount = pending.readError === null ? pending.records.length : null;
+  const message = `Session deletion reports: delivered ${delivered}, ${pendingCount === null ? "pending count unavailable" : `${pendingCount} pending`}` + (failure === null ? "." : `; delivery failed: ${failure}.`);
+  logActivity(state, {
+    type: "info",
+    level: failure === null ? "info" : "warn",
+    message,
+    metadata: {
+      outcome: failure === null ? "session-deletion-reports-drained" : "session-deletion-reports-pending",
+      delivered,
+      pending: pendingCount
+    }
+  });
+}
 function logSessionDbProvenanceMismatch(state, provenance, currentVersion, preBootMigrationCount) {
   const record = {
     v: 1,
@@ -14207,17 +15980,22 @@ async function runSweep(state, driver, config) {
     let failedThrew = 0;
     let skippedNewlyActive = 0;
     let remaining = 0;
+    const deletionRecords = [];
     let protectedNow = driver.protectedSessionIds();
     if (sessions !== null) {
-      const toDelete = selectSessionsToDelete(
-        sessions.map((s) => ({ id: s.id, lastActivityMs: sessionLastActivityMs(s) })),
-        {
-          maxAgeMs: config.maxAgeMs,
-          maxCount: config.maxCount,
-          nowMs: Date.now(),
-          protectedIds: protectedNow
-        }
+      const snapshots = sessions.map((session) => ({
+        id: session.id,
+        lastActivityMs: sessionLastActivityMs(session)
+      }));
+      const lastActivityById = new Map(
+        snapshots.map(({ id, lastActivityMs }) => [id, lastActivityMs])
       );
+      const toDelete = selectSessionsToDelete(snapshots, {
+        maxAgeMs: config.maxAgeMs,
+        maxCount: config.maxCount,
+        nowMs: Date.now(),
+        protectedIds: protectedNow
+      });
       const eligibleToDelete = toDelete.filter(
         (id) => (state.sessionDeleteFailures.get(id)?.isolatedFailures ?? 0) < SESSION_CLEANUP_GIVE_UP_AFTER_FAILURES
       );
@@ -14237,6 +16015,17 @@ async function runSweep(state, driver, config) {
         const outcome = await deleteSession(state.port, id, state.opencodeClient ?? void 0);
         if (outcome.ok) {
           deleted++;
+          const lastActivityMs = lastActivityById.get(id) ?? null;
+          deletionRecords.push({
+            opencode_session_id: id,
+            deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
+            reason: "auto_cleanup",
+            policy: {
+              max_age_ms: config.maxAgeMs ?? null,
+              max_count: config.maxCount ?? null,
+              last_activity_at: lastActivityMs === null ? null : new Date(lastActivityMs).toISOString()
+            }
+          });
         } else if (outcome.status === "threw") {
           failed++;
           failedThrew++;
@@ -14292,6 +16081,32 @@ async function runSweep(state, driver, config) {
         message: `Session cleanup: inspected ${sessions.length}, deleted ${deleted}${failedNote}${skippedNote}${remainingNote} (${mode})`
       });
     }
+    if (deletionRecords.length > 0) {
+      try {
+        const dropped = appendSessionDeletionRecords(
+          sessionDeletionReportPath(homedir8(), process.env),
+          deletionRecords
+        );
+        if (dropped > 0) {
+          logSessionCleanupActivity(state, "sweep", {
+            type: "info",
+            level: "warn",
+            message: `Session cleanup: dropped ${dropped} oldest pending deletion report(s) after reaching the spool limit`,
+            metadata: { outcome: "deletion-reports-dropped", dropped_count: dropped }
+          });
+        }
+      } catch (error2) {
+        logSessionCleanupActivity(state, "sweep", {
+          type: "info",
+          level: "warn",
+          message: `Session cleanup: could not persist ${deletionRecords.length} confirmed deletion report(s): ${error2 instanceof Error ? error2.message : String(error2)}`,
+          metadata: {
+            outcome: "deletion-report-spool-write-failed",
+            records: deletionRecords.length
+          }
+        });
+      }
+    }
     const sessionMetadata = {
       sessions_inspected: sessions?.length ?? null,
       sessions_deleted: deleted,
@@ -14361,6 +16176,7 @@ async function runSweep(state, driver, config) {
         }
       });
     }
+    await drainSessionDeletionReports(state);
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     logSessionCleanupActivity(state, "sweep", {
@@ -14385,7 +16201,7 @@ function scheduleSessionCleanup(state, driver, options) {
   for (const warning2 of config.warnings) {
     logActivity(state, { type: "info", level: "warn", message: `Session cleanup: ${warning2}` });
   }
-  const dbBytes = statSessionDbBytes(homedir7());
+  const dbBytes = statSessionDbBytes(homedir8());
   void (async () => {
     const reclaimAvailability = dbBytes !== null && config.enabled ? await probeReclaimAvailability({ dbPath: sessionDbPath(), requiredBytes: dbBytes }) : null;
     if (reclaimAvailability !== null) {
@@ -14452,10 +16268,12 @@ function scheduleUsageReporting(state, params) {
   let phase = "dormant";
   let rearmRequested = false;
   const armProbe = () => {
+    if (!state.running) return;
     phase = "probe-pending";
     params.setTimer(setTimeout(() => void tick(true), params.firstDelayMs()));
   };
   const scheduleNextTick = () => {
+    if (!state.running) return;
     if (rearmRequested) {
       rearmRequested = false;
       armProbe();
@@ -14489,6 +16307,7 @@ function scheduleUsageReporting(state, params) {
     phase = "tick-in-flight";
     try {
       const usage = await params.fetchUsage();
+      if (!state.running) return;
       const result = await params.report(usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -14601,7 +16420,7 @@ function scheduleResourceUsageReporting(state, options) {
     });
     return;
   }
-  const { collect, stop } = createResourceUsageCollector(homedir7());
+  const { collect, stop } = createResourceUsageCollector(homedir8());
   state.stopResourceUsageSampling = stop;
   let consecutiveFailures = 0;
   const tick = async () => {
@@ -14627,6 +16446,7 @@ function scheduleResourceUsageReporting(state, options) {
           message: lowDiskDecision.warning
         });
       }
+      if (!state.running) return;
       const result = await reportResourceUsage(state.agentId, state.authHeader, usage);
       if (result.ok) {
         if (consecutiveFailures > 0) {
@@ -14659,7 +16479,9 @@ function scheduleResourceUsageReporting(state, options) {
         message: `Resource usage reporting failed: ${message}${failureStreakSuffix(consecutiveFailures)}`
       });
     } finally {
-      state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      if (state.running) {
+        state.resourceUsageTimer = setTimeout(() => void tick(), usageReportDelayMs());
+      }
     }
   };
   state.resourceUsageTimer = setTimeout(() => void tick(), firstReportDelayMs());
@@ -14837,9 +16659,11 @@ async function run(options) {
   const interactive = isInteractive(options.json);
   let logLevel;
   let fileSyncDirectories;
+  let fileSyncExactFiles;
   try {
     logLevel = resolveLogLevel(options);
-    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir7());
+    fileSyncDirectories = resolveFileSyncDirectories(options.enableFileSyncTo, homedir8());
+    fileSyncExactFiles = resolveFileSyncExactFiles(options.enableFileSyncToExactFile, homedir8());
     if (options.restoreSessionDb && !options.sessionDbNoReplicateMarker) {
       throw new Error(
         "--restore-session-db requires --session-db-no-replicate-marker <path>; restore failures must block Litestream replication"
@@ -14862,6 +16686,8 @@ async function run(options) {
     port: options.port ?? 4096,
     conversationFilter: options.conversation ?? null,
     idleTimeout: options.idleTimeout ?? null,
+    stayAwakeSeconds: null,
+    stayAwakeUntilMs: null,
     json: options.json ?? false,
     interactive,
     logLevel,
@@ -14913,7 +16739,11 @@ async function run(options) {
   }
   if (fileSyncDirectories.length > 0) {
     log2(state, `File sync enabled for: ${fileSyncDirectories.join(", ")}`);
-  } else {
+  }
+  if (fileSyncExactFiles.length > 0) {
+    log2(state, `File sync exact files enabled for: ${fileSyncExactFiles.join(", ")}`);
+  }
+  if (fileSyncDirectories.length === 0 && fileSyncExactFiles.length === 0) {
     log2(state, "File sync is disabled (no --enable-file-sync-to given)", "debug");
   }
   if (!options.runner && options.agent) {
@@ -15051,6 +16881,17 @@ async function run(options) {
     }
     spinner?.succeed(`Runner: ${validation.agent.name || state.agentId}`);
     state.agentName = validation.agent.name;
+    const requestedStayAwakeSeconds = validation.agent?.wake_stay_awake_seconds;
+    if (typeof requestedStayAwakeSeconds === "number" && Number.isFinite(requestedStayAwakeSeconds) && requestedStayAwakeSeconds > 0) {
+      state.stayAwakeSeconds = requestedStayAwakeSeconds;
+    } else if (requestedStayAwakeSeconds !== void 0 && requestedStayAwakeSeconds !== null) {
+      state.stayAwakeSeconds = null;
+      log2(
+        state,
+        `Ignoring invalid wake_stay_awake_seconds (type: ${typeof requestedStayAwakeSeconds})`,
+        "warn"
+      );
+    }
     const microvmId = process.env.MICROVM_ID?.trim();
     if (microvmId) {
       const reported = await reportMicrovmId(state.agentId, state.authHeader, microvmId);
@@ -15112,7 +16953,7 @@ async function run(options) {
     state.credentialSync?.arm();
     const dependencyInstallDiagnosticReporter = createDependencyInstallDiagnosticReporter({
       context: {
-        homeDir: homedir7(),
+        homeDir: homedir8(),
         cwd: process.cwd(),
         microvmId: process.env.MICROVM_ID?.trim(),
         euid: process.getuid?.(),
@@ -15135,7 +16976,7 @@ async function run(options) {
       dependencyInstallDiagnosticReporter
     );
     const openCodeLogTail = tailOpenCodeLogFile(
-      resolveOpenCodeLogPath(homedir7(), process.env),
+      resolveOpenCodeLogPath(homedir8(), process.env),
       openCodeActivityForwarder
     );
     state.stopOpenCodeLogTail = () => {
@@ -15184,6 +17025,7 @@ async function run(options) {
       }
     }
     reportSessionDbRecovery(state);
+    await drainSessionDeletionReports(state);
     if (sessionDbVerifyFatal) {
       throw new Error(
         sessionDbVerifyFatalReason === void 0 ? "SESSION-DB-INTEGRITY-EXHAUSTED: the corrupt session DB could not be proven separated from the active backup prefix or removed from disk" : `SESSION-DB-VERIFY-TIMEOUT: session DB verification timed out (${sessionDbVerifyFatalReason}); refusing to start`
@@ -15210,6 +17052,44 @@ async function run(options) {
     for (const warning2 of opencodeVersionWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
     }
+    const managedSetupOptions = {
+      agentId: state.agentId,
+      apiUrl: getApiUrlConfig(),
+      getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
+      log: (message, level = "info") => logActivity(state, {
+        type: level === "error" ? "error" : "info",
+        level,
+        ...level === "error" ? { error: message } : { message }
+      })
+    };
+    let managedDiscovery = await discoverManagedInferenceSetup(managedSetupOptions);
+    if (managedDiscovery.kind === "none") {
+      managedDiscovery = await enrollManagedInferenceSetup(managedSetupOptions);
+    }
+    let managedPreparation = { kind: "none" };
+    if (managedDiscovery.kind === "failed") {
+      managedPreparation = managedDiscovery;
+      managedSetupOptions.log(`MANAGED-INFERENCE-NOT-READY: ${managedDiscovery.reason}`, "warn");
+    } else if (managedDiscovery.kind === "setup") {
+      const managedHealth = opencodeVersion === "v2" ? await checkOpenCode2Health(state.port) : await checkOpenCodeHealth(state.port);
+      managedPreparation = await prepareManagedInferenceSetup(
+        managedSetupOptions,
+        managedDiscovery,
+        managedHealth
+      );
+      if (managedPreparation.kind === "failed") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-NOT-READY: ${managedPreparation.reason}`,
+          "warn"
+        );
+      } else if (managedPreparation.kind === "ready") {
+        managedSetupOptions.log(
+          `MANAGED-INFERENCE-PREPARED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+          "info"
+        );
+      }
+    }
     const { value: maxActiveSessions, warnings: maxActiveSessionsWarnings } = resolveMaxActiveSessions(options, process.env);
     for (const warning2 of maxActiveSessionsWarnings) {
       logActivity(state, { type: "info", level: "warn", message: warning2 });
@@ -15236,6 +17116,32 @@ async function run(options) {
       state.opencodeProcess = options.opencodePidFile ? null : oc.process;
       state.opencodeVersion = oc.version;
       state.opencodeApiVersion = opencodeVersion;
+      let configuredPlugins = [];
+      let resolvedPlugins = [];
+      try {
+        const provenanceLog = (message) => logActivity(state, { type: "info", level: "warn", message });
+        configuredPlugins = readConfiguredPluginSpecs({ log: provenanceLog });
+        resolvedPlugins = resolveInstalledPluginVersions({ log: provenanceLog });
+      } catch (error2) {
+        const kind = error2 instanceof Error ? error2.name : "unknown error";
+        logActivity(state, {
+          type: "info",
+          level: "warn",
+          message: `Could not collect OpenCode runtime provenance: ${kind}`
+        });
+      }
+      logActivity(state, {
+        type: "info",
+        level: "info",
+        message: "OpenCode runtime provenance",
+        metadata: {
+          opencode_version: state.opencodeVersion,
+          opencode_api_version: state.opencodeApiVersion,
+          configured_plugins: JSON.stringify(configuredPlugins),
+          resolved_plugins: JSON.stringify(resolvedPlugins)
+        },
+        source: "cli.runtime-provenance"
+      });
       let opencodePassword = null;
       if (opencodeVersion === "v2" && "password" in oc) {
         const value = oc.password;
@@ -15250,7 +17156,7 @@ async function run(options) {
       state.opencodeClient = openCodeClient;
       if (options.opencodePidFile && oc.process?.pid !== void 0) {
         try {
-          writeFileSync6(options.opencodePidFile, `${oc.process.pid}
+          writeFileSync7(options.opencodePidFile, `${oc.process.pid}
 `, { mode: 384 });
           chmodSync3(options.opencodePidFile, 384);
         } catch (error2) {
@@ -15264,7 +17170,7 @@ async function run(options) {
         const provenance = checkSessionDbProvenance({
           dbPath: sessionDbPath(),
           currentVersion: state.opencodeVersion,
-          homeDir: homedir7(),
+          homeDir: homedir8(),
           env: process.env
         });
         if (provenance.anomaly) {
@@ -15278,6 +17184,30 @@ async function run(options) {
         }
       }
       state.opencodeConnected = oc.notReadyReason === null;
+      if (managedPreparation.kind === "ready" && oc.notReadyReason === null) {
+        try {
+          const acknowledgement = await acknowledgeManagedInferenceSetup(
+            managedSetupOptions,
+            managedPreparation
+          );
+          if (acknowledgement === "acknowledged") {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-ACKNOWLEDGED: runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "info"
+            );
+          } else {
+            managedSetupOptions.log(
+              `MANAGED-INFERENCE-NOT-READY: policy refresh is pending for runner=${state.agentId} generation=${managedPreparation.generation}`,
+              "warn"
+            );
+          }
+        } catch (error2) {
+          managedSetupOptions.log(
+            `MANAGED-INFERENCE-NOT-READY: ${error2 instanceof Error ? error2.message : String(error2)}`,
+            "warn"
+          );
+        }
+      }
       const version2 = state.opencodeVersion ? ` (v${state.opencodeVersion})` : "";
       ocSpinner?.succeed(`OpenCode running on port ${state.port}${version2}`);
       if (!state.interactive && oc.notReadyReason !== null) {
@@ -15294,7 +17224,7 @@ async function run(options) {
             logActivity(state, { type: "info", level: "warn", message: versionWarning });
           }
         }
-        await reloadProviderCache(state.port, state.opencodeClient ?? void 0);
+        await disposeAndReloadProviderConfig(state.port, state.opencodeClient ?? void 0);
         if (state.opencodeApiVersion === "v2" && state.opencodeClient !== null) {
           await importOpenCodeV2CredentialsForState(state);
         }
@@ -15336,7 +17266,7 @@ async function run(options) {
         let existingPid;
         if (existsSync3(options.litestreamPidFile)) {
           try {
-            const rawPid = readFileSync7(options.litestreamPidFile, "utf8").trim();
+            const rawPid = readFileSync9(options.litestreamPidFile, "utf8").trim();
             const parsedPid = Number(rawPid);
             if (/^\d+$/.test(rawPid) && Number.isSafeInteger(parsedPid) && parsedPid > 0) {
               existingPid = parsedPid;
@@ -15373,7 +17303,7 @@ async function run(options) {
           });
           try {
             if (litestreamProcess.pid !== void 0) {
-              writeFileSync6(options.litestreamPidFile, `${litestreamProcess.pid}
+              writeFileSync7(options.litestreamPidFile, `${litestreamProcess.pid}
 `, {
                 mode: 384
               });
@@ -15432,10 +17362,11 @@ async function run(options) {
       conversationFilter: state.conversationFilter,
       stuckQueuedMs: CHANNEL_STUCK_QUEUED_MS,
       sessionStoreHealth: state.sessionStoreHealth,
-      // #559: the `--enable-file-sync-to` allow-list. Empty ⇒ pending files are
-      // REJECTED with `file_sync_disabled` on the ack, not silently ignored.
+      // #559: the file-sync allow-lists. Empty ⇒ pending files are REJECTED with
+      // `file_sync_disabled` on the ack, not silently ignored.
       fileSyncDirectories,
-      homeDir: homedir7(),
+      fileSyncExactFiles,
+      homeDir: homedir8(),
       maxActiveSessions,
       log: (entry) => (
         // Thread the driver's real level straight through so `debug`/`warn`
@@ -15460,11 +17391,18 @@ async function run(options) {
         onConnected: (agentId, isReconnect, transition) => {
           state.connected = true;
           state.agentId = agentId;
-          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation})`;
+          const connectionMessage = isReconnect ? `Tunnel reconnected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, attempt: ${transition.attempt}, offline for ${transition.downtimeMs}ms)` : `Tunnel connected (runner: ${agentId}, generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"})`;
           logActivity(state, {
             type: "info",
             message: connectionMessage
           });
+          if (!isReconnect && state.stayAwakeSeconds !== null && state.stayAwakeUntilMs === null) {
+            state.stayAwakeUntilMs = Date.now() + state.stayAwakeSeconds * 1e3;
+            logActivity(state, {
+              type: "info",
+              message: `Staying awake for at least ${state.stayAwakeSeconds}s as requested by the wake`
+            });
+          }
           if (options.tunnelReadyFile) {
             const marker = writeTunnelReadyMarker(options.tunnelReadyFile, agentId);
             if (marker.ok) {
@@ -15486,6 +17424,7 @@ async function run(options) {
               connected: state.opencodeConnected
             }),
             connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {},
             ...isReconnect && transition.downtimeMs !== null ? {
               reconnect_attempt: transition.attempt,
               downtime_ms: transition.downtimeMs
@@ -15516,12 +17455,13 @@ async function run(options) {
           const safeReason2 = redactDiagnosticText(reason).slice(0, MAX_DISCONNECT_REASON_LENGTH);
           logActivity(state, {
             type: "info",
-            message: `Tunnel disconnected (generation: ${transition.generation}, code: ${code}, reason: ${safeReason2})`
+            message: `Tunnel disconnected (generation: ${transition.generation}, relay connection: ${transition.relayConnectionId ?? "unknown"}, code: ${code}, reason: ${safeReason2})`
           });
           emitAgentDisconnected(state.agentId, {
             code,
             reason: safeReason2,
-            connection_generation: transition.generation
+            connection_generation: transition.generation,
+            ...transition.relayConnectionId !== null ? { relay_connection_id: transition.relayConnectionId } : {}
           });
           if (state.interactive) displayStatus(state);
         },
@@ -15599,6 +17539,7 @@ async function run(options) {
       if (error2.message === "Unauthorized") tunnelSpinner?.fail("Unauthorized");
       throw error2;
     }
+    if (!state.running) return;
     scheduleSessionCleanup(state, channelDriver, options);
     state.claudeUsageRearm = scheduleClaudeUsageReporting(state, options);
     state.openaiUsageRearm = scheduleUsageReporting(state, {
@@ -15671,9 +17612,9 @@ program.name("evident").description("Run OpenCode locally and connect it to Evid
   "--endpoint <url>",
   "Evident API base URL (default: production; e.g. http://localhost:3001)"
 ).option("--tunnel <url>", "Tunnel WebSocket URL (default: production; e.g. ws://localhost:8787)").hook("preAction", (thisCommand) => {
-  const { endpoint, tunnel } = thisCommand.opts();
-  if (endpoint) {
-    setEndpoint(endpoint);
+  const { endpoint: endpoint2, tunnel } = thisCommand.opts();
+  if (endpoint2) {
+    setEndpoint(endpoint2);
   }
   if (tunnel) {
     setTunnelUrl(tunnel);
@@ -15723,6 +17664,11 @@ program.command("run").description("Connect to Evident and process messages").op
   "Allow Evident to write files into this directory (repeatable). Omit to disable file sync entirely.",
   (value, previous) => previous.concat([value]),
   []
+).option(
+  "--enable-file-sync-to-exact-file <path>",
+  "Allow Evident to write files to exactly this path (repeatable).",
+  (value, previous) => previous.concat([value]),
+  []
 ).option(
   "--tunnel-ready-file <path>",
   "Path to write once the tunnel is connected (opt-in; unused unless an operator/image sets it)"
@@ -15747,6 +17693,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -15782,6 +17731,9 @@ program.command("run").description("Connect to Evident and process messages").op
       // Raw values — expansion/validation is single-sourced in run.ts's
       // resolveFileSyncDirectories.
       enableFileSyncTo: options.enableFileSyncTo,
+      // Raw values — expansion/validation is single-sourced in run.ts's
+      // resolveFileSyncExactFiles.
+      enableFileSyncToExactFile: options.enableFileSyncToExactFile,
       tunnelReadyFile: options.tunnelReadyFile,
       litestreamConfig: options.litestreamConfig,
       opencodePidFile: options.opencodePidFile,
@@ -15790,6 +17742,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }