@gajae-gateway/cli 0.1.8 → 0.2.1

package/dist/main.js

@@ -2,11 +2,63 @@
 // @bun
 
 // src/main.ts
-import { Database } from "bun:sqlite";
-import { copyFile as copyFile2, lstat as lstat2, readFile as readFile8, stat as stat3 } from "fs/promises";
-import { isAbsolute, join as join10 } from "path";
-import { LOOPBACK_ORIGIN, originKey as originKey2 } from "@gajae-gateway/protocol";
+import { isAbsolute } from "path";
+import { LOOPBACK_ORIGIN, originKey as originKey2, WORK_JOBS_MAX_LIMIT } from "@gajae-gateway/protocol";
 import { GajaewayClient } from "@gajae-gateway/sdk";
+// package.json
+var package_default = {
+  name: "@gajae-gateway/cli",
+  version: "0.2.1",
+  type: "module",
+  description: "Owner CLI for the gajaeway gateway: status, sessions, chat, monitors, and worker lanes over the gateway socket. Requires the Bun runtime (uses Bun.file/Bun.spawn).",
+  license: "AGPL-3.0-only",
+  author: "Yeachan Heo",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/Yeachan-Heo/gajae-way.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://github.com/Yeachan-Heo/gajae-way/tree/main/packages/cli#readme",
+  bugs: "https://github.com/Yeachan-Heo/gajae-way/issues",
+  keywords: [
+    "gajaeway",
+    "cli",
+    "gateway"
+  ],
+  files: [
+    "dist",
+    "src"
+  ],
+  main: "./dist/main.js",
+  types: "./src/main.ts",
+  exports: {
+    ".": {
+      bun: "./src/main.ts",
+      types: "./src/main.ts",
+      default: "./dist/main.js"
+    }
+  },
+  bin: {
+    gajaeway: "./dist/main.js"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "rm -rf dist && bun build src/main.ts --outdir dist --target bun --format esm --external @gajae-gateway/protocol --external @gajae-gateway/sdk && tsc -p tsconfig.build.json",
+    prepublishOnly: "bun run build"
+  },
+  dependencies: {
+    "@gajae-gateway/sdk": "workspace:*",
+    "@gajae-gateway/protocol": "workspace:*"
+  },
+  engines: {
+    bun: ">=1.4.0"
+  },
+  devDependencies: {
+    "@gajae-gateway/home": "workspace:*"
+  }
+};
 
 // src/list.ts
 import { originKey } from "@gajae-gateway/protocol";
@@ -145,11 +197,203 @@ function renderList(columns, rows, options, envelope) {
 }
 
 // src/migrate.ts
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { join as join4 } from "path";
+import { randomUUID } from "crypto";
+import { chmod, mkdir as mkdir2, readFile as readFile3, rename, rm, writeFile } from "fs/promises";
+import { join as join5 } from "path";
+
+// ../home/src/layout.ts
+import { join } from "path";
+function homeLayout(home) {
+  const leasesDir = join(home, "leases");
+  const brokerDir = join(home, "broker");
+  const brokerProvisionDir = join(brokerDir, "provision");
+  const gjcPrefix = join(home, "gjc");
+  const gjcCurrent = join(gjcPrefix, "current");
+  return {
+    home,
+    leasesDir,
+    lease: (name) => join(leasesDir, name),
+    brokerAgentDir: join(brokerDir, "agent"),
+    brokerProvisionDir,
+    brokerProvisionManifest: join(brokerProvisionDir, "manifest.json"),
+    backupsDir: join(home, "backups"),
+    gjcPrefix,
+    gjcCurrent,
+    gjcExecutable: (version) => join(version === undefined ? gjcCurrent : join(gjcPrefix, version), "bin", "gjc"),
+    socket: join(home, "gateway.sock"),
+    db: join(home, "gateway.db")
+  };
+}
+// ../home/src/lease.ts
+import { dlopen, FFIType, read } from "bun:ffi";
+import { constants } from "fs";
+import { mkdir, open, readFile } from "fs/promises";
+var LOCK_EX = 2;
+var LOCK_NB = 4;
+var F_GETFD = 1;
+var FD_CLOEXEC = 1;
+var MAX_OWNER_BYTES = 4096;
+var PLATFORMS = {
+  darwin: { library: "/usr/lib/libSystem.B.dylib", errnoSymbol: "__error", oCloexec: 16777216, ewouldblock: 35 },
+  linux: { library: "libc.so.6", errnoSymbol: "__errno_location", oCloexec: 524288, ewouldblock: 11 }
+};
+var libc;
+var heldHandles = new Set;
+function loadLibc(name) {
+  if (libc)
+    return libc;
+  const platform = PLATFORMS[process.platform];
+  if (!platform)
+    throw new LeaseError("lease_unsupported", name, "dlopen", process.platform);
+  const symbols = {
+    flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    fcntl: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+    [platform.errnoSymbol]: { args: [], returns: FFIType.ptr }
+  };
+  const library = dlopen(platform.library, symbols);
+  const errnoLocation = library.symbols[platform.errnoSymbol];
+  libc = {
+    platform,
+    flock: (fd, operation) => library.symbols.flock(fd, operation),
+    getfd: (fd) => library.symbols.fcntl(fd, F_GETFD),
+    errno: () => read.i32(errnoLocation(), 0)
+  };
+  return libc;
+}
+
+class LeaseHeldError extends Error {
+  name;
+  owner;
+  code = "lease_held";
+  constructor(name, owner) {
+    super(`lease_held name=${name}${owner ? ` owner_pid=${owner.pid} since=${owner.startedAt}` : ""}`);
+    this.name = name;
+    this.owner = owner;
+  }
+}
 
+class LeaseError extends Error {
+  code;
+  name;
+  syscall;
+  errno;
+  constructor(code, name, syscall, errno) {
+    super(`${code} name=${name} syscall=${syscall} errno=${errno}`);
+    this.code = code;
+    this.name = name;
+    this.syscall = syscall;
+    this.errno = errno;
+  }
+}
+async function openLeaseFile(path, name, lib, create) {
+  const flags = constants.O_RDWR | constants.O_NOFOLLOW | lib.platform.oCloexec | (create ? constants.O_CREAT : 0);
+  let handle;
+  try {
+    handle = await open(path, flags, 384);
+  } catch (error) {
+    const code = error.code ?? String(error);
+    throw new LeaseError("lease_failed", name, "open", code);
+  }
+  try {
+    const info = await handle.stat();
+    if (!info.isFile() || info.nlink !== 1)
+      throw new LeaseError("lease_failed", name, "fstat", "not_regular_file");
+    const fdFlags = lib.getfd(handle.fd);
+    if (fdFlags < 0 || (fdFlags & FD_CLOEXEC) === 0)
+      throw new LeaseError("lease_failed", name, "fcntl", fdFlags < 0 ? lib.errno() : "cloexec_missing");
+    return handle;
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+function tryLock(handle, name, lib) {
+  if (lib.flock(handle.fd, LOCK_EX | LOCK_NB) === 0)
+    return true;
+  const errno = lib.errno();
+  if (errno === lib.platform.ewouldblock)
+    return false;
+  throw new LeaseError("lease_failed", name, "flock", errno);
+}
+function parseOwner(raw) {
+  if (!raw.trim() || raw.length > MAX_OWNER_BYTES)
+    return;
+  try {
+    const value = JSON.parse(raw);
+    if (Number.isSafeInteger(value.pid) && typeof value.token === "string" && typeof value.startedAt === "string")
+      return { pid: value.pid, token: value.token, startedAt: value.startedAt };
+  } catch {}
+  return;
+}
+async function readLeaseOwner(home, name) {
+  try {
+    return parseOwner(await readFile(homeLayout(home).lease(name), "utf8"));
+  } catch {
+    return;
+  }
+}
+async function leaseHeld(home, name) {
+  const lib = loadLibc(name);
+  let handle;
+  try {
+    handle = await openLeaseFile(homeLayout(home).lease(name), name, lib, false);
+  } catch (error) {
+    if (error instanceof LeaseError && error.syscall === "open" && error.errno === "ENOENT")
+      return false;
+    throw error;
+  }
+  try {
+    return !tryLock(handle, name, lib);
+  } finally {
+    await handle.close();
+  }
+}
+async function acquireLease(home, name) {
+  const lib = loadLibc(name);
+  const layout = homeLayout(home);
+  try {
+    await mkdir(layout.leasesDir, { recursive: true, mode: 448 });
+  } catch (error) {
+    throw new LeaseError("lease_failed", name, "mkdir", error.code ?? String(error));
+  }
+  const path = layout.lease(name);
+  const handle = await openLeaseFile(path, name, lib, true);
+  try {
+    if (!tryLock(handle, name, lib))
+      throw new LeaseHeldError(name, await readLeaseOwner(home, name));
+    const owner = { pid: process.pid, token: crypto.randomUUID(), startedAt: new Date().toISOString() };
+    const bytes = Buffer.from(`${JSON.stringify(owner)}
+`);
+    try {
+      await handle.truncate(0);
+      let offset = 0;
+      while (offset < bytes.length) {
+        const { bytesWritten } = await handle.write(bytes, offset, bytes.length - offset, offset);
+        if (bytesWritten === 0)
+          throw new Error("short write");
+        offset += bytesWritten;
+      }
+      await handle.sync();
+    } catch (error) {
+      throw new LeaseError("lease_failed", name, "write", error.code ?? String(error));
+    }
+    heldHandles.add(handle);
+    let released = false;
+    const release = async () => {
+      if (released)
+        return;
+      released = true;
+      heldHandles.delete(handle);
+      await handle.close();
+    };
+    return { name, token: owner.token, path, release, [Symbol.asyncDispose]: release };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
 // src/migrate/hermes.ts
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/migrate/plan.ts
 import { eventTypeOrigin, validateOriginRef } from "@gajae-gateway/protocol";
@@ -385,9 +629,9 @@ function emitImportedAxis(extract) {
 }
 
 // src/migrate/source-fs.ts
-import { lstat, readdir, readFile } from "fs/promises";
+import { lstat, readdir, readFile as readFile2 } from "fs/promises";
 import { homedir } from "os";
-import { join, relative } from "path";
+import { join as join2, relative } from "path";
 
 class SourceTree {
   root;
@@ -419,14 +663,14 @@ class SourceTree {
     if (!info)
       return;
     this.consume(path);
-    return readFile(path, "utf8");
+    return readFile2(path, "utf8");
   }
   async bytes(path) {
     const info = await regularFile(path);
     if (!info)
       return;
     this.consume(path);
-    return new Uint8Array(await readFile(path));
+    return new Uint8Array(await readFile2(path));
   }
 }
 async function regularFile(path) {
@@ -454,16 +698,16 @@ async function entries(path) {
 async function walkFiles(dir, prefix = "") {
   const out = [];
   for (const name of await entries(dir)) {
-    const full = join(dir, name);
+    const full = join2(dir, name);
     const info = await lstat(full).catch(() => {
       return;
     });
     if (!info)
       continue;
     if (info.isDirectory())
-      out.push(...await walkFiles(full, join(prefix, name)));
+      out.push(...await walkFiles(full, join2(prefix, name)));
     else if (info.isFile())
-      out.push(join(prefix, name));
+      out.push(join2(prefix, name));
   }
   return out;
 }
@@ -487,7 +731,7 @@ function parseDotenv(text) {
   return values;
 }
 function expandHome(path) {
-  return path === "~" ? homedir() : path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+  return path === "~" ? homedir() : path.startsWith("~/") ? join2(homedir(), path.slice(2)) : path;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -502,7 +746,7 @@ var HERMES_ENTRY_DELIMITER = `
 \xA7
 `;
 async function detectHermes(root) {
-  return await regularFile(join2(root, "config.yaml")) !== undefined || await isDirectory(join2(root, "memories")) || await regularFile(join2(root, "cron", "jobs.json")) !== undefined;
+  return await regularFile(join3(root, "config.yaml")) !== undefined || await isDirectory(join3(root, "memories")) || await regularFile(join3(root, "cron", "jobs.json")) !== undefined;
 }
 var TOKEN_KEYS = {
   DISCORD_BOT_TOKEN: "discord",
@@ -520,7 +764,7 @@ async function readHermes(tree, home) {
   const root = tree.root;
   const extract = emptyExtract("hermes", root);
   for (const name of ["SOUL.md", "AGENTS.md"]) {
-    const path = join2(root, name);
+    const path = join3(root, name);
     const text = await tree.text(path);
     if (text === undefined)
       continue;
@@ -534,8 +778,8 @@ async function readHermes(tree, home) {
       mtime: info?.mtime
     });
   }
-  const memoryDir = join2(root, "memories");
-  const userPath = join2(memoryDir, "USER.md");
+  const memoryDir = join3(root, "memories");
+  const userPath = join3(memoryDir, "USER.md");
   const userText = await tree.text(userPath);
   if (userText !== undefined) {
     const info = await regularFile(userPath);
@@ -548,7 +792,7 @@ async function readHermes(tree, home) {
       mtime: info?.mtime
     });
   }
-  const memoryPath = join2(memoryDir, "MEMORY.md");
+  const memoryPath = join3(memoryDir, "MEMORY.md");
   const memoryText = await tree.text(memoryPath);
   if (memoryText !== undefined) {
     const info = await regularFile(memoryPath);
@@ -560,13 +804,12 @@ async function readHermes(tree, home) {
       content: entriesToMarkdown("Long-term memory (imported from Hermes)", memoryText),
       mtime: info?.mtime
     });
-    emitImportedAxis(extract);
   }
-  const envPath = join2(root, ".env");
+  const envPath = join3(root, ".env");
   const envText = await tree.text(envPath);
   const env = envText === undefined ? new Map : parseDotenv(envText);
   const consumedEnv = new Set;
-  const configPath = join2(root, "config.yaml");
+  const configPath = join3(root, "config.yaml");
   const configText = await tree.text(configPath);
   let config = {};
   if (configText !== undefined) {
@@ -693,7 +936,7 @@ function readHermesChannelPolicy(config, env, channels, consumedConfig, consumed
   }
 }
 async function readHermesCron(tree, env, consumedEnv, extract) {
-  const path = join2(tree.root, "cron", "jobs.json");
+  const path = join3(tree.root, "cron", "jobs.json");
   const text = await tree.text(path);
   if (text === undefined)
     return;
@@ -793,11 +1036,11 @@ function hermesTarget(job, env, consumedEnv, extract, source) {
   return resolved[0];
 }
 async function readHermesSkills(tree, extract) {
-  const skillsDir = join2(tree.root, "skills");
+  const skillsDir = join3(tree.root, "skills");
   if (!await isDirectory(skillsDir))
     return;
   tree.consume(skillsDir);
-  const bundledText = await tree.text(join2(skillsDir, ".bundled_manifest"));
+  const bundledText = await tree.text(join3(skillsDir, ".bundled_manifest"));
   const bundled = new Set((bundledText ?? "").split(/\r?\n/).map((line) => line.split(":")[0]?.trim() ?? "").filter(Boolean));
   const files = (await walkFiles(skillsDir)).filter((file) => !file.split("/").some((part) => part.startsWith(".")));
   const skillRoots = files.filter((file) => file.endsWith("/SKILL.md") || file === "SKILL.md").map((file) => file.slice(0, -"/SKILL.md".length));
@@ -806,7 +1049,7 @@ async function readHermesSkills(tree, extract) {
     const name = skillRoot.split("/").at(-1) ?? skillRoot;
     if (bundled.has(name))
       continue;
-    await copySkill(tree, join2(skillsDir, skillRoot), name, extract, seen);
+    await copySkill(tree, join3(skillsDir, skillRoot), name, extract, seen);
   }
   if (bundled.size)
     extract.warnings.push(`${bundled.size} Hermes-bundled skill(s) skipped; they ship with Hermes, not with your data`);
@@ -824,7 +1067,7 @@ async function copySkill(tree, dir, name, extract, seen) {
   }
   seen.add(name);
   for (const file of await walkFiles(dir)) {
-    const path = join2(dir, file);
+    const path = join3(dir, file);
     const content = await tree.bytes(path);
     if (content === undefined)
       continue;
@@ -839,17 +1082,17 @@ async function copySkill(tree, dir, name, extract, seen) {
 }
 
 // src/migrate/openclaw.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var OPENCLAW_CONFIG = "config.json";
 async function detectOpenClaw(root) {
-  const configPath = join3(root, OPENCLAW_CONFIG);
+  const configPath = join4(root, OPENCLAW_CONFIG);
   const stat = await regularFile(configPath);
   return stat !== undefined;
 }
 async function readOpenClaw(tree, _home) {
   const extract = emptyExtract("openclaw", tree.root);
-  const configPath = join3(tree.root, OPENCLAW_CONFIG);
-  const envPath = join3(tree.root, ".env");
+  const configPath = join4(tree.root, OPENCLAW_CONFIG);
+  const envPath = join4(tree.root, ".env");
   let config = {};
   const configText = await tree.text(configPath);
   if (configText) {
@@ -999,25 +1242,25 @@ function buildOpenClawMonitor(name, spec) {
   });
 }
 async function readOpenClawSkills(tree, skillsConfig, extract) {
-  const skillsDir = join3(tree.root, "skills");
+  const skillsDir = join4(tree.root, "skills");
   const hasSkillsDir = await isDirectory(skillsDir);
   for (const [skillName] of Object.entries(skillsConfig)) {
     if (!hasSkillsDir)
       continue;
-    const skillPath = join3(skillsDir, `${skillName}.md`);
+    const skillPath = join4(skillsDir, `${skillName}.md`);
     const skillContent = await tree.text(skillPath);
     if (skillContent) {
       extract.files.push({
         category: "skills",
         sources: [skillPath],
-        target: join3(".gjc", "skills", `${slug(skillName)}.md`),
+        target: join4(".gjc", "skills", `${slug(skillName)}.md`),
         content: skillContent
       });
     }
   }
 }
 async function readOpenClawMemory(tree, _memoryConfig, extract) {
-  const memoryDir = join3(tree.root, "memory");
+  const memoryDir = join4(tree.root, "memory");
   const hasMemoryDir = await isDirectory(memoryDir);
   if (!hasMemoryDir) {
     return;
@@ -1025,13 +1268,13 @@ async function readOpenClawMemory(tree, _memoryConfig, extract) {
   const files = await walkFiles(memoryDir);
   for (const file of files) {
     if (file.endsWith(".md")) {
-      const fullPath = join3(memoryDir, file);
+      const fullPath = join4(memoryDir, file);
       const content = await tree.text(fullPath);
       if (content) {
         extract.files.push({
           category: "memory",
           sources: [fullPath],
-          target: join3("memory", "imported.md"),
+          target: join4("memory", "imported.md"),
           content
         });
       }
@@ -1041,8 +1284,25 @@ async function readOpenClawMemory(tree, _memoryConfig, extract) {
 
 // src/migrate.ts
 async function migrate(options) {
+  const targetHome = expandHome(options.target ?? process.env.GAJAEWAY_HOME ?? `${process.env.HOME ?? "~"}/.gajaeway`);
+  if (options.dryRun)
+    return migrateUnlocked(options, targetHome);
+  let lease;
+  try {
+    lease = await acquireLease(targetHome, "memory");
+  } catch (error) {
+    if (error instanceof LeaseHeldError)
+      throw new Error(`${error.message}; stop the gateway first before importing memory data`, { cause: error });
+    throw error;
+  }
+  try {
+    await migrateUnlocked(options, targetHome);
+  } finally {
+    await lease.release();
+  }
+}
+async function migrateUnlocked(options, targetHome) {
   const sourceRoot = expandHome(options.source ?? ".");
-  const targetHome = expandHome(options.target ?? `${process.env.HOME ?? "~"}/.gajaeway`);
   let sourceType;
   if (await detectHermes(sourceRoot)) {
     sourceType = "hermes";
@@ -1099,22 +1359,34 @@ Migration summary:`);
     }
     return;
   }
-  await mkdir(targetHome, { recursive: true });
+  await mkdir2(targetHome, { recursive: true });
   const channels = emptyChannelPlan();
   emitChannels(extract, channels, targetHome, sourceType);
   emitMonitors(extract);
   emitImportedAxis(extract);
   for (const file of extract.files) {
-    const filePath = join4(targetHome, file.target);
-    await mkdir(join4(filePath, ".."), { recursive: true });
-    await writeFile(filePath, file.content);
+    const filePath = join5(targetHome, file.target);
+    await mkdir2(join5(filePath, ".."), { recursive: true });
+    if (file.secret) {
+      const temporary = `${filePath}.${randomUUID()}.tmp`;
+      try {
+        await writeFile(temporary, file.content, { mode: 384 });
+        await chmod(temporary, 384);
+        await rename(temporary, filePath);
+      } catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+      }
+    } else {
+      await writeFile(filePath, file.content);
+    }
   }
   for (const merge of extract.merges) {
-    const filePath = join4(targetHome, merge.target);
-    await mkdir(join4(filePath, ".."), { recursive: true });
+    const filePath = join5(targetHome, merge.target);
+    await mkdir2(join5(filePath, ".."), { recursive: true });
     let existing;
     try {
-      const text = await readFile2(filePath, "utf-8");
+      const text = await readFile3(filePath, "utf-8");
       existing = JSON.parse(text);
     } catch {}
     const merged = merge.merge(existing);
@@ -1145,21 +1417,29 @@ function parseMigrateArgs(args) {
 }
 
 // src/restart-stack.ts
-import { randomUUID } from "crypto";
-import { access, mkdir as mkdir3, readFile as readFile4, rename, stat, writeFile as writeFile3 } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+import { access, mkdir as mkdir4, readFile as readFile5, rename as rename2, stat, writeFile as writeFile3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
+import { dirname, join as join7 } from "path";
 
 // src/services.ts
-import { chmod, mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { parseRuntimeConfig, RuntimeConfigError } from "@gajae-gateway/protocol";
 var CONFIG_SCHEMA_VERSION = 1;
 var FALLBACK_PATH_DIRS = ["/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"];
 var LOGIN_PATH_COMMAND = 'printf %s "$PATH"';
+var BROKER_UNIT = "gajaeway-broker.service";
 var GATEWAY_UNIT = "gajaeway-gateway.service";
 var SERVICE_SPECS = [
+  {
+    id: "broker",
+    label: "dev.gajaeway.broker",
+    binary: "gajaeway-gateway",
+    args: ["broker"],
+    dependsOnGateway: false
+  },
   {
     id: "gateway",
     label: "dev.gajaeway.gateway",
@@ -1181,16 +1461,23 @@ var SERVICE_SPECS = [
     args: [],
     dependsOnGateway: true
   },
+  {
+    id: "adapter-telegram",
+    label: "dev.gajaeway.adapter-telegram",
+    binary: "gajaeway-telegram",
+    args: [],
+    dependsOnGateway: true
+  },
   { id: "admin", label: "dev.gajaeway.admin", binary: "gajaeway-admin", args: ["serve"], dependsOnGateway: true }
 ];
 function serviceSpecs() {
   return SERVICE_SPECS;
 }
 function homeForEnvironment(env) {
-  return env.GAJAEWAY_HOME || join5(env.HOME || homedir2(), ".gajaeway");
+  return env.GAJAEWAY_HOME || join6(env.HOME || homedir2(), ".gajaeway");
 }
 function expandHome2(value, home) {
-  return value.startsWith("~/") ? join5(home, value.slice(2)) : value;
+  return value.startsWith("~/") ? join6(home, value.slice(2)) : value;
 }
 function normalizedEntries(entries2, home) {
   const seen = new Set;
@@ -1209,9 +1496,9 @@ function normalizedEntries(entries2, home) {
 function mergePathEntries(binDir, userHome, loginPath) {
   return normalizedEntries([
     expandHome2(binDir, userHome),
-    join5(userHome, "bin"),
-    join5(userHome, ".local", "bin"),
-    join5(userHome, ".bun", "bin"),
+    join6(userHome, "bin"),
+    join6(userHome, ".local", "bin"),
+    join6(userHome, ".bun", "bin"),
     ...loginPath.replace(/(?:\r\n|\n)+$/, "").split(":"),
     ...FALLBACK_PATH_DIRS
   ], userHome);
@@ -1254,7 +1541,7 @@ function plistString(value) {
   return `<string>${escapeXml(value)}</string>`;
 }
 function renderLaunchAgent(spec, binDir, home, path) {
-  const program = join5(binDir, spec.binary);
+  const program = join6(binDir, spec.binary);
   const argumentsXml = [program, ...spec.args].map(plistString).join("");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1268,8 +1555,8 @@ function renderLaunchAgent(spec, binDir, home, path) {
   </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key>${plistString(join5(home, `${spec.id}.stdout.log`))}
-  <key>StandardErrorPath</key>${plistString(join5(home, `${spec.id}.stderr.log`))}
+  <key>StandardOutPath</key>${plistString(join6(home, `${spec.id}.stdout.log`))}
+  <key>StandardErrorPath</key>${plistString(join6(home, `${spec.id}.stderr.log`))}
 </dict></plist>
 `;
 }
@@ -1279,21 +1566,30 @@ function unitEnvironment(name, value) {
 function systemdUnitName(spec) {
   return `gajaeway-${spec.id}.service`;
 }
+function unitPath(path) {
+  if (!path.startsWith("/") || /[\n\r\0]/.test(path))
+    throw new Error(`unit path must be absolute and single-line: ${path}`);
+  return path.replaceAll("%", "%%");
+}
+function unitEnvironmentFile(path) {
+  return `EnvironmentFile=-${unitPath(path)}`;
+}
 function renderSystemdUnit(spec, binDir, home, path) {
-  const execStart = [join5(binDir, spec.binary), ...spec.args].join(" ");
+  const execStart = [join6(binDir, spec.binary), ...spec.args].join(" ");
   const unit = [
     "[Unit]",
     `Description=gajaeway ${spec.id}`,
-    ...spec.dependsOnGateway ? [`BindsTo=${GATEWAY_UNIT}`, `After=${GATEWAY_UNIT}`, `PartOf=${GATEWAY_UNIT}`] : [],
+    ...spec.id === "broker" ? [`ConditionPathExists=${unitPath(homeLayout(home).brokerProvisionManifest)}`] : spec.id === "gateway" ? [`Wants=${BROKER_UNIT}`, `After=${BROKER_UNIT}`] : spec.dependsOnGateway ? [`BindsTo=${GATEWAY_UNIT}`, `After=${GATEWAY_UNIT}`, `PartOf=${GATEWAY_UNIT}`] : [],
     "",
     "[Service]",
     `ExecStart=${execStart}`,
     `WorkingDirectory=${binDir}`,
     unitEnvironment("GAJAEWAY_HOME", home),
     unitEnvironment("PATH", path),
+    ...spec.id === "broker" ? [unitEnvironmentFile(join6(home, "broker.env"))] : [],
     "Restart=always",
-    "RestartSec=2",
-    ...spec.dependsOnGateway ? [] : ["KillMode=mixed", "TimeoutStopSec=30s"],
+    spec.id === "broker" ? "RestartSec=2s" : "RestartSec=2",
+    ...spec.id === "broker" ? ["KillMode=control-group", "TimeoutStopSec=30s", "SuccessExitStatus=143"] : spec.id === "gateway" ? ["KillMode=mixed", "TimeoutStopSec=30s"] : [],
     "",
     "[Install]",
     `WantedBy=${spec.dependsOnGateway ? GATEWAY_UNIT : "default.target"}`,
@@ -1303,18 +1599,21 @@ function renderSystemdUnit(spec, binDir, home, path) {
 `);
 }
 function systemdUnitDir(env, userHome) {
-  const base = env.XDG_CONFIG_HOME || join5(userHome, ".config");
-  return join5(base, "systemd", "user");
+  const base = env.XDG_CONFIG_HOME || join6(userHome, ".config");
+  return join6(base, "systemd", "user");
 }
 function launchAgentPlistPath(spec, launchAgentsDir) {
-  return join5(launchAgentsDir, `dev.gajaeway.${spec.id}.plist`);
+  return join6(launchAgentsDir, `dev.gajaeway.${spec.id}.plist`);
 }
 function systemdUnitPath(spec, unitDir) {
-  return join5(unitDir, systemdUnitName(spec));
+  return join6(unitDir, systemdUnitName(spec));
 }
 function restartStackCommands(platform, uid) {
   if (platform === "linux")
-    return [["systemctl", "--user", "restart", GATEWAY_UNIT]];
+    return [
+      ["systemctl", "--user", "restart", BROKER_UNIT],
+      ["systemctl", "--user", "restart", GATEWAY_UNIT]
+    ];
   if (platform === "darwin") {
     const target = uid ?? process.getuid?.() ?? 0;
     return restartOrder().map((spec) => ["launchctl", "kickstart", "-k", `gui/${target}/${spec.label}`]);
@@ -1338,10 +1637,10 @@ function currentPlatform() {
   throw new Error(`unsupported service platform: ${process.platform}`);
 }
 async function readRuntime(home) {
-  const configPath = join5(home, "config.json");
+  const configPath = join6(home, "config.json");
   let raw;
   try {
-    raw = await readFile3(configPath, "utf8");
+    raw = await readFile4(configPath, "utf8");
   } catch (error) {
     throw new Error(`could not read ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -1371,7 +1670,7 @@ async function installServices(options) {
   const userHome = env.HOME || homedir2();
   const home = homeForEnvironment(env);
   const binDir = expandHome2(options.binDir, userHome);
-  const targetDir = platform === "darwin" ? expandHome2(options.launchAgentsDir ?? join5(userHome, "Library", "LaunchAgents"), userHome) : expandHome2(options.unitDir ?? systemdUnitDir(env, userHome), userHome);
+  const targetDir = platform === "darwin" ? expandHome2(options.launchAgentsDir ?? join6(userHome, "Library", "LaunchAgents"), userHome) : expandHome2(options.unitDir ?? systemdUnitDir(env, userHome), userHome);
   const runtime = await readRuntime(home);
   const path = await resolvePath({
     binDir,
@@ -1380,18 +1679,36 @@ async function installServices(options) {
     env,
     loginPathRunner: options.loginPathRunner
   });
-  await mkdir2(targetDir, { recursive: true, mode: 448 });
-  const definitions = SERVICE_SPECS.map((spec) => platform === "darwin" ? {
-    path: join5(targetDir, `dev.gajaeway.${spec.id}.plist`),
+  await mkdir3(targetDir, { recursive: true, mode: 448 });
+  const specs = [];
+  for (const spec of SERVICE_SPECS) {
+    if (options.configuredAdaptersOnly && spec.id.startsWith("adapter-")) {
+      const adapter = spec.id.slice("adapter-".length);
+      if (!await Bun.file(join6(home, `adapter-${adapter}.json`)).exists())
+        continue;
+    }
+    specs.push(spec);
+  }
+  const definitions = specs.map((spec) => platform === "darwin" ? {
+    path: join6(targetDir, `dev.gajaeway.${spec.id}.plist`),
     contents: renderLaunchAgent(spec, binDir, home, path)
-  } : { path: join5(targetDir, systemdUnitName(spec)), contents: renderSystemdUnit(spec, binDir, home, path) });
+  } : { path: join6(targetDir, systemdUnitName(spec)), contents: renderSystemdUnit(spec, binDir, home, path) });
   const write = options.writeFile;
   for (const definition of definitions) {
+    if (options.compareAndWrite) {
+      try {
+        if (await readFile4(definition.path, "utf8") === definition.contents)
+          continue;
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
     if (write)
       await write(definition.path, definition.contents);
     else {
       await writeFile2(definition.path, definition.contents, { encoding: "utf8", mode: 384 });
-      await chmod(definition.path, 384);
+      await chmod2(definition.path, 384);
     }
   }
   return definitions.map((definition) => definition.path);
@@ -1405,12 +1722,12 @@ var RECEIPT_FILE = "restart-stack.json";
 var VERIFY_TIMEOUT_MS = 90000;
 var POLL_MS = 1000;
 function restartReceiptPath(home) {
-  return join6(home, RECEIPT_FILE);
+  return join7(home, RECEIPT_FILE);
 }
 async function readRestartReceipt(home) {
   let raw;
   try {
-    raw = await readFile4(restartReceiptPath(home), "utf8");
+    raw = await readFile5(restartReceiptPath(home), "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -1419,23 +1736,24 @@ async function readRestartReceipt(home) {
   return JSON.parse(raw);
 }
 async function writeReceipt(home, receipt) {
-  await mkdir3(home, { recursive: true });
+  await mkdir4(home, { recursive: true });
   const path = restartReceiptPath(home);
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile3(temporary, `${JSON.stringify(receipt, null, 2)}
 `, { mode: 384 });
-  await rename(temporary, path);
+  await rename2(temporary, path);
 }
-function newReceipt(id, platform, uid, now) {
+function newReceipt(id, platform, uid, now, trigger) {
   const commands = restartStackCommands(platform, uid);
   return {
     id,
+    trigger,
     state: "queued",
     platform,
     requestedAt: new Date(now).toISOString(),
     steps: restartOrder().map((spec, index) => ({
       label: spec.label,
-      ...platform === "darwin" ? { command: commands[index] } : index === 0 ? { command: commands[0] } : {},
+      ...platform === "darwin" ? { command: commands[index] } : spec.id === "broker" ? { command: commands[0] } : spec.id === "gateway" ? { command: commands[1] } : {},
       result: "pending"
     }))
   };
@@ -1454,33 +1772,17 @@ async function capture(command) {
   const output = await new Response(child.stdout).text();
   return await child.exited === 0 ? output : undefined;
 }
-function defaultServiceProbe(platform) {
+function defaultServiceProbe(platform, uid = process.getuid?.() ?? 0) {
   return async (label) => {
     const spec = serviceSpecs().find((candidate) => candidate.label === label);
     if (spec === undefined)
       throw new Error(`unknown service label: ${label}`);
-    let pid;
-    if (platform === "darwin") {
-      const listed = await capture(["launchctl", "list", label]);
-      const match = listed?.match(/"PID"\s*=\s*(\d+);/);
-      pid = match ? Number(match[1]) : undefined;
-    } else {
-      const shown = await capture(["systemctl", "--user", "show", "-p", "MainPID", "--value", systemdUnitName(spec)]);
-      pid = shown === undefined ? undefined : Number(shown.trim());
-    }
-    if (pid === undefined || !Number.isInteger(pid) || pid <= 0)
-      return;
-    const lstart = await capture(["ps", "-o", "lstart=", "-p", String(pid)]);
-    const args = await capture(["ps", "-ww", "-o", "args=", "-p", String(pid)]);
-    if (lstart === undefined || args === undefined)
+    const shown = platform === "darwin" ? await capture(["launchctl", "print", `gui/${uid}/${label}`]) : await capture(["systemctl", "--user", "show", "-p", "MainPID", "--value", systemdUnitName(spec)]);
+    const rawPid = platform === "darwin" ? shown?.match(/^\s*pid = (\d+);?\s*$/m)?.[1] : shown?.trim();
+    const pid = rawPid === undefined ? undefined : Number(rawPid);
+    if (pid === undefined || !Number.isSafeInteger(pid) || pid <= 0)
       return;
-    const startedAt = Date.parse(lstart.trim());
-    if (!Number.isFinite(startedAt))
-      return;
-    const suffix = spec.args.length > 0 ? ` ${spec.args.join(" ")}` : "";
-    const line = args.trim();
-    const binary = suffix && line.endsWith(suffix) ? line.slice(0, -suffix.length) : line;
-    return { pid, startedAt, binary };
+    return { pid };
   };
 }
 async function defaultBinaryModifiedAt(path) {
@@ -1493,7 +1795,7 @@ function defaultIsServiceInstalled(options) {
       return false;
     if (options.platform === "darwin") {
       const userHome2 = options.env.HOME || homedir3();
-      const agentsDir = options.launchAgentsDir || join6(userHome2, "Library", "LaunchAgents");
+      const agentsDir = options.launchAgentsDir || join7(userHome2, "Library", "LaunchAgents");
       const plistPath = launchAgentPlistPath(spec, agentsDir);
       try {
         await access(plistPath);
@@ -1504,23 +1806,61 @@ function defaultIsServiceInstalled(options) {
     }
     const userHome = options.env.HOME || homedir3();
     const unitDirPath = options.unitDir || systemdUnitDir(options.env, userHome);
-    const unitPath = systemdUnitPath(spec, unitDirPath);
+    const unitPath2 = systemdUnitPath(spec, unitDirPath);
     try {
-      await access(unitPath);
+      await access(unitPath2);
       return true;
     } catch {
       return false;
     }
   };
 }
-function psStartBound(ms) {
-  return Math.floor(ms / 1000) * 1000 - PS_START_SKEW_MS;
+var SERVICE_LEASES = {
+  broker: "broker",
+  gateway: "gateway",
+  "adapter-discord": "adapter-discord",
+  "adapter-slack": "adapter-slack",
+  "adapter-telegram": "adapter-telegram"
+};
+function serviceStopCommand(platform, uid) {
+  if (platform === "linux")
+    return ["systemctl", "--user", "stop", BROKER_UNIT];
+  const target = uid ?? process.getuid?.() ?? 0;
+  return ["launchctl", "bootout", `gui/${target}/dev.gajaeway.broker`];
+}
+function serviceBootstrapCommand(options, platform, label) {
+  if (platform === "linux")
+    return ["systemctl", "--user", "start", BROKER_UNIT];
+  const target = options.uid ?? process.getuid?.() ?? 0;
+  const userHome = options.env?.HOME || homedir3();
+  const agentsDir = options.launchAgentsDir ?? join7(userHome, "Library", "LaunchAgents");
+  const spec = serviceSpecs().find((candidate) => candidate.label === label);
+  if (spec === undefined)
+    throw new Error(`unknown service label: ${label}`);
+  return ["launchctl", "bootstrap", `gui/${target}`, launchAgentPlistPath(spec, agentsDir)];
 }
-var PS_START_SKEW_MS = 1000;
 async function runRestartStack(options) {
+  let lease;
+  try {
+    lease = await acquireLease(options.home, "update");
+    console.info(`lease_acquired name=update pid=${process.pid}`);
+  } catch (error) {
+    if (error instanceof LeaseHeldError)
+      console.error(error.message);
+    else
+      console.error(`lease_failed name=update detail=${error instanceof Error ? error.message : String(error)}`);
+    throw error;
+  }
+  try {
+    return await runRestartStackWithLease(options);
+  } finally {
+    await lease.release();
+  }
+}
+async function runRestartStackWithLease(options) {
   const platform = options.platform ?? currentPlatform();
   const runner = options.runner ?? defaultCommandRunner;
-  const probe = options.probe ?? defaultServiceProbe(platform);
+  const probe = options.probe ?? defaultServiceProbe(platform, options.uid);
   const modifiedAt = options.binaryModifiedAt ?? defaultBinaryModifiedAt;
   const isInstalled = options.isServiceInstalled ?? defaultIsServiceInstalled({
     platform,
@@ -1532,8 +1872,16 @@ async function runRestartStack(options) {
   const sleep = options.sleep ?? ((ms) => Bun.sleep(ms));
   const timeoutMs = options.verifyTimeoutMs ?? VERIFY_TIMEOUT_MS;
   const pollMs = options.pollMs ?? POLL_MS;
+  const binDir = options.binDir ?? process.env.GAJAEWAY_BIN_DIR ?? dirname(process.execPath);
+  const originalPids = new Map;
+  for (const spec of restartOrder()) {
+    if (SERVICE_LEASES[spec.id] === undefined && await isInstalled(spec.label))
+      originalPids.set(spec.label, (await probe(spec.label))?.pid);
+  }
   const existing = await readRestartReceipt(options.home);
-  const receipt = existing?.id === options.id && existing.state === "queued" ? existing : newReceipt(options.id, platform, options.uid, now());
+  if (existing?.id === options.id && existing.state !== "queued")
+    throw new Error(`restart-stack ${options.id}: receipt is ${existing.state}; refusing to start worker`);
+  const receipt = existing?.id === options.id ? existing : newReceipt(options.id, platform, options.uid, now(), options.trigger ?? "manual");
   receipt.state = "running";
   receipt.supervisorPid = process.pid;
   await writeReceipt(options.home, receipt);
@@ -1544,6 +1892,12 @@ async function runRestartStack(options) {
       continue;
     }
     try {
+      if (step.label === "dev.gajaeway.broker" && !await Bun.file(homeLayout(options.home).brokerProvisionManifest).exists()) {
+        step.result = "skipped";
+        step.detail = "broker agent is not provisioned";
+        await writeReceipt(options.home, receipt);
+        continue;
+      }
       const installed = await isInstalled(step.label);
       if (!installed) {
         step.result = "skipped";
@@ -1551,17 +1905,68 @@ async function runRestartStack(options) {
         await writeReceipt(options.home, receipt);
         continue;
       }
-      if (step.command !== undefined) {
-        issuedAt = now();
-        const status = await runner(step.command);
-        step.exitStatus = status;
-        if (status !== 0) {
+      if (step.label === "dev.gajaeway.broker" && receipt.trigger === "update") {
+        const stopCommand = serviceStopCommand(platform, options.uid);
+        const stopStatus = await runner(stopCommand);
+        if (stopStatus !== 0 && !(platform === "darwin" && await probe(step.label) === undefined))
+          throw new Error(`${stopCommand.join(" ")} exited with status ${stopStatus}`);
+        const provisionCommand = [
+          join7(binDir, "gajaeway-gateway"),
+          "broker-agent",
+          "provision",
+          "--mode",
+          "update",
+          "--lease-wait-ms",
+          "35000"
+        ];
+        const provisionStatus = await runner(provisionCommand);
+        step.agentSync = {
+          command: provisionCommand,
+          exitStatus: provisionStatus,
+          ...provisionStatus === 1 || provisionStatus === 3 ? { error: `broker-agent provision exited with status ${provisionStatus}` } : provisionStatus === 4 ? { error: "broker_agent_unrecoverable" } : {}
+        };
+        if (provisionStatus === 4) {
+          delete step.command;
+          step.exitStatus = 4;
           step.result = "failed";
-          step.detail = `${step.command.join(" ")} exited with status ${status}`;
+          step.detail = "broker left stopped: broker_agent_unrecoverable; run gajaeway setup --broker-agent";
+        } else if (provisionStatus === 0 || provisionStatus === 1 || provisionStatus === 3) {
+          const startCommand = serviceBootstrapCommand(options, platform, step.label);
+          step.command = startCommand;
+          issuedAt = now();
+          const startStatus = await runner(startCommand);
+          step.exitStatus = startStatus;
+          if (startStatus !== 0) {
+            step.result = "failed";
+            step.detail = `${startCommand.join(" ")} exited with status ${startStatus}`;
+          } else
+            await verifyStep(step, issuedAt);
+        } else {
+          delete step.command;
+          step.exitStatus = provisionStatus;
+          step.result = "failed";
+          step.detail = `broker-agent provision exited with unexpected status ${provisionStatus}`;
         }
+      } else {
+        if (step.command !== undefined) {
+          issuedAt = now();
+          let command = step.command;
+          let status = await runner(command);
+          if (status !== 0 && receipt.trigger === "update" && platform === "darwin" && await probe(step.label) === undefined) {
+            command = serviceBootstrapCommand(options, platform, step.label);
+            step.command = command;
+            issuedAt = now();
+            status = await runner(command);
+          }
+          step.exitStatus = status;
+          if (status !== 0) {
+            step.result = "failed";
+            step.detail = `${command.join(" ")} exited with status ${status}`;
+          }
+        }
+        if (step.result === "pending")
+          await verifyStep(step, issuedAt);
       }
-      if (step.result === "pending")
-        await verifyStep(step, issuedAt);
     } catch (error) {
       step.result = "failed";
       step.detail = error instanceof Error ? error.message : String(error);
@@ -1577,29 +1982,53 @@ async function runRestartStack(options) {
   await writeReceipt(options.home, receipt);
   return receipt;
   async function verifyStep(step, since) {
+    const spec = serviceSpecs().find((candidate) => candidate.label === step.label);
+    if (spec === undefined)
+      throw new Error(`unknown service label: ${step.label}`);
+    const leaseName = SERVICE_LEASES[spec.id];
+    const binary = join7(binDir, spec.binary);
+    const binaryModifiedAt = leaseName === undefined ? undefined : await modifiedAt(binary);
     const deadline = now() + timeoutMs;
     for (;; ) {
       const running = await probe(step.label);
-      let binaryModifiedAt = 0;
-      if (running !== undefined) {
-        binaryModifiedAt = await modifiedAt(running.binary);
+      const owner = leaseName === undefined ? undefined : await readLeaseOwner(options.home, leaseName);
+      if (running !== undefined)
         step.pid = running.pid;
-        step.processStartedAt = new Date(running.startedAt).toISOString();
-        step.binary = running.binary;
+      if (leaseName !== undefined) {
+        step.binary = binary;
         step.binaryModifiedAt = new Date(binaryModifiedAt).toISOString();
-        if (running.startedAt >= psStartBound(Math.max(binaryModifiedAt, since))) {
+        if (owner !== undefined)
+          step.processStartedAt = owner.startedAt;
+        const startedAt = owner === undefined ? Number.NaN : Date.parse(owner.startedAt);
+        if (running !== undefined && owner !== undefined && running.pid === owner.pid && Number.isFinite(startedAt) && startedAt >= Math.max(since, binaryModifiedAt)) {
           step.result = "ok";
           delete step.detail;
           return;
         }
+      } else if (running !== undefined && running.pid !== originalPids.get(step.label)) {
+        step.result = "ok";
+        delete step.detail;
+        return;
       }
       if (now() >= deadline) {
         if (running === undefined) {
           step.result = "failed";
           step.detail = "no running process after restart";
+        } else if (leaseName === undefined) {
+          step.result = "stale";
+          step.detail = "MainPID did not change after restart";
+        } else if (owner === undefined) {
+          step.result = "stale";
+          step.detail = "no lease owner after restart";
+        } else if (running.pid !== owner.pid) {
+          step.result = "stale";
+          step.detail = "lease owner PID does not match service MainPID";
+        } else if (Date.parse(owner.startedAt) < binaryModifiedAt) {
+          step.result = "stale";
+          step.detail = "process started before the deployed binary was modified";
         } else {
           step.result = "stale";
-          step.detail = running.startedAt < binaryModifiedAt ? "process started before the deployed binary was modified" : "process was not restarted by this sequence";
+          step.detail = "lease owner predates this restart sequence";
         }
         return;
       }
@@ -1607,38 +2036,80 @@ async function runRestartStack(options) {
     }
   }
 }
+var SYSTEMD_RUN_TIMEOUT_MS = 30000;
 function cliCommand() {
   return Bun.main.startsWith("/$bunfs/") ? [process.execPath] : [process.execPath, Bun.main];
 }
-function alive(pid) {
-  if (pid === undefined)
-    return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
 async function launchRestartStack(options) {
   const platform = options.platform ?? currentPlatform();
-  const existing = await readRestartReceipt(options.home);
-  if (existing?.state === "running" && alive(existing.supervisorPid))
-    throw new Error(`restart-stack ${existing.id} is still running (supervisor pid ${existing.supervisorPid})`);
-  const receipt = newReceipt(randomUUID(), platform, options.uid, Date.now());
+  if (await leaseHeld(options.home, "update"))
+    throw new LeaseHeldError("update", await readLeaseOwner(options.home, "update"));
+  const receipt = newReceipt(randomUUID2(), platform, options.uid, Date.now(), options.trigger ?? "manual");
   await writeReceipt(options.home, receipt);
   const worker = [...options.worker ?? [...cliCommand(), "ops", "restart-stack"], "--run", receipt.id];
-  const child = Bun.spawn(supervisorArgv(platform, worker, options.home, receipt.id), {
+  const argv = supervisorArgv(platform, worker, options.home, receipt.id, options.binDir);
+  const spawnOptions = {
     detached: true,
     stdin: "ignore",
     stdout: "ignore",
     stderr: "ignore",
-    env: { ...options.env ?? process.env, GAJAEWAY_HOME: options.home }
-  });
+    env: {
+      ...options.env ?? process.env,
+      GAJAEWAY_HOME: options.home,
+      ...options.binDir === undefined ? {} : { GAJAEWAY_BIN_DIR: options.binDir }
+    }
+  };
+  let child;
+  try {
+    child = platform === "linux" ? (options.systemdRun ?? ((command) => Bun.spawn([...command], spawnOptions)))(argv) : Bun.spawn(argv, spawnOptions);
+  } catch (error) {
+    const detail = platform === "linux" ? `supervisor systemd-run could not be started (${error instanceof Error ? error.message : String(error)}); without a service manager here, restart through the host's own supervisor` : `supervisor ${argv[0]} could not be started (${error instanceof Error ? error.message : String(error)})`;
+    await failLaunch(options.home, receipt, detail);
+    throw new Error(`restart-stack ${receipt.id}: failed: ${detail}`);
+  }
+  if (platform === "linux") {
+    const outcome = await waitForLauncher(child, options.systemdRunTimeoutMs ?? SYSTEMD_RUN_TIMEOUT_MS);
+    if (outcome.kind === "timed_out") {
+      const detail = `supervisor systemd-run timed out after ${options.systemdRunTimeoutMs ?? SYSTEMD_RUN_TIMEOUT_MS}ms; handoff outcome is indeterminate`;
+      await failLaunch(options.home, receipt, detail);
+      throw new Error(`restart-stack ${receipt.id}: failed: ${detail}`);
+    }
+    if (outcome.exitStatus !== 0) {
+      const detail = `supervisor systemd-run exited with status ${outcome.exitStatus}`;
+      await failLaunch(options.home, receipt, detail);
+      throw new Error(`restart-stack ${receipt.id}: failed: ${detail}`);
+    }
+  }
   child.unref();
   return { receipt, supervisorPid: child.pid };
 }
-function supervisorArgv(platform, worker, home, id) {
+async function failLaunch(home, receipt, detail) {
+  receipt.state = "failed";
+  receipt.finishedAt = new Date().toISOString();
+  receipt.detail = detail;
+  for (const step of receipt.steps)
+    step.result = "skipped";
+  await writeReceipt(home, receipt);
+}
+async function waitForLauncher(child, timeoutMs) {
+  let timer;
+  const outcome = await Promise.race([
+    child.exited.then((exitStatus) => ({ kind: "exited", exitStatus })),
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve({ kind: "timed_out" }), timeoutMs);
+    })
+  ]);
+  if (timer !== undefined)
+    clearTimeout(timer);
+  if (outcome.kind === "timed_out") {
+    child.kill("SIGKILL");
+    child.exited.catch(() => {
+      return;
+    });
+  }
+  return outcome;
+}
+function supervisorArgv(platform, worker, home, id, binDir) {
   if (platform === "darwin")
     return [...worker];
   return [
@@ -1646,28 +2117,32 @@ function supervisorArgv(platform, worker, home, id) {
     "--user",
     "--collect",
     "--quiet",
+    "--service-type=exec",
     `--unit=gajaeway-restart-stack-${id}`,
     `--setenv=GAJAEWAY_HOME=${home}`,
+    ...binDir === undefined ? [] : [`--setenv=GAJAEWAY_BIN_DIR=${binDir}`],
     "--",
     ...worker
   ];
 }
-function effectiveRestartState(receipt) {
-  if (receipt.state === "running" && !alive(receipt.supervisorPid))
+async function effectiveRestartState(receipt, home) {
+  if (receipt.state === "running" && !await leaseHeld(home, "update"))
     return "interrupted";
   return receipt.state;
 }
-function renderRestartReceipt(receipt) {
+function renderRestartReceipt(receipt, state = receipt.state) {
   const lines = [
-    `restart-stack ${receipt.id}: ${effectiveRestartState(receipt)}`,
+    `restart-stack ${receipt.id}: ${state}`,
     `requestedAt: ${receipt.requestedAt}`,
-    `finishedAt: ${receipt.finishedAt ?? "-"}`
+    `finishedAt: ${receipt.finishedAt ?? "-"}`,
+    ...receipt.detail === undefined ? [] : [`detail: ${receipt.detail}`]
   ];
   for (const step of receipt.steps) {
     const facts = [
       step.pid === undefined ? undefined : `pid=${step.pid}`,
       step.processStartedAt === undefined ? undefined : `started=${step.processStartedAt}`,
       step.binaryModifiedAt === undefined ? undefined : `binary=${step.binaryModifiedAt}`,
+      step.agentSync?.error === undefined ? undefined : `agentSync.error=${step.agentSync.error}`,
       step.detail
     ].filter((fact) => fact !== undefined);
     lines.push(`${step.label}: ${step.result}${facts.length > 0 ? ` ${facts.join(" ")}` : ""}`);
@@ -1676,9 +2151,74 @@ function renderRestartReceipt(receipt) {
 }
 
 // src/setup.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { chmod as chmod2, mkdir as mkdir4, readFile as readFile5, rename as rename2, rm, writeFile as writeFile4 } from "fs/promises";
-import { join as join7 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod3, mkdir as mkdir5, readFile as readFile6, realpath, rename as rename3, rm as rm2, writeFile as writeFile4 } from "fs/promises";
+import { basename, dirname as dirname2, join as join8 } from "path";
+
+// src/discord-setup.ts
+var DEVELOPER_PORTAL_URL = "https://discord.com/developers/applications";
+var DISCORD_BOT_SCOPES = ["bot", "applications.commands"];
+var DISCORD_BOT_PERMISSIONS = 2048 | 16384 | 33554432 | 65536 | 131072 | 8192 | 64;
+function printDiscordSetupGuide(log) {
+  log("");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("  Getting your Discord bot token");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("");
+  log("1. Open the Discord Developer Portal:");
+  log(`   ${DEVELOPER_PORTAL_URL}`);
+  log("");
+  log("2. Click 'New Application' and choose a name (e.g., 'My gajae-way agent')");
+  log("");
+  log("3. In the left menu, click 'Bot' \u2192 'Add Bot'");
+  log("");
+  log("4. Under 'TOKEN', click 'Reset Token' \u2192 'Yes, do it!'");
+  log("");
+  log("5. Click 'Copy' to copy your bot token (it starts with 'MTI...')");
+  log("");
+  log("6. (Important) Scroll down to 'GATEWAY INTENTS' and enable 'MESSAGE CONTENT INTENT'");
+  log("   This allows the bot to read message text, not just usernames.");
+  log("");
+  log("7. Click 'Save Changes'");
+  log("");
+  log("8. Come back here and paste your token below");
+  log("");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("");
+}
+function generateDiscordInviteUrl(appId) {
+  const scopeParam = DISCORD_BOT_SCOPES.join("+");
+  const permissionsParam = String(DISCORD_BOT_PERMISSIONS);
+  return `https://discord.com/oauth2/authorize?client_id=${appId}&scope=${scopeParam}&permissions=${permissionsParam}`;
+}
+function printDiscordBotReady(log, appId, botName) {
+  const inviteUrl = generateDiscordInviteUrl(appId);
+  log("");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("  \u2713 Discord bot token validated");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("");
+  log(`Application ID: ${appId}`);
+  if (botName) {
+    log(`Bot name: ${botName}`);
+  }
+  log("");
+  log("To invite your bot to your Discord server, click this link:");
+  log("");
+  log(`  ${inviteUrl}`);
+  log("");
+  log("Then:");
+  log("  1. Choose the server where you want to add the bot");
+  log("  2. Click 'Authorize'");
+  log("  3. Complete the CAPTCHA");
+  log("");
+  log("Once authorized, send the bot a DM and start chatting!");
+  log("");
+  log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  log("");
+}
+
+// src/setup.ts
 var SETUP_PLATFORMS = ["discord", "slack", "telegram"];
 var SETUP_ENV = {
   discordToken: "GAJAEWAY_DISCORD_TOKEN",
@@ -1688,7 +2228,7 @@ var SETUP_ENV = {
   telegramToken: "GAJAEWAY_TELEGRAM_TOKEN",
   ownerIds: "GAJAEWAY_OWNER_IDS"
 };
-var SETUP_USAGE = "usage: gajaeway setup [--from-env] [--adapters discord,slack,telegram] [--owner ID[,ID...]] [--discord-app-id ID] | setup --status";
+var SETUP_USAGE = "usage: gajaeway setup [--from-env] [--adapters discord,slack,telegram] [--owner ID[,ID...]] [--discord-app-id ID] | setup --status | setup --broker-agent [--from DIR]";
 var SECRET_FILES2 = {
   discord: "discord-token",
   slackBot: "slack-bot-token",
@@ -1713,6 +2253,8 @@ function redact(text, secrets) {
 function parseSetupArgs(args) {
   let fromEnv = false;
   let status = false;
+  let brokerAgent = false;
+  let from;
   let adapters;
   const owners = [];
   let discordAppId;
@@ -1722,7 +2264,15 @@ function parseSetupArgs(args) {
       fromEnv = true;
     else if (flag === "--status")
       status = true;
-    else if (flag === "--adapters" || flag === "--owner" || flag === "--discord-app-id") {
+    else if (flag === "--broker-agent")
+      brokerAgent = true;
+    else if (flag === "--from") {
+      const value = args[++i];
+      if (value === undefined || value.trim() === "" || value.startsWith("--"))
+        throw new SetupError(`${flag} expects a value
+${SETUP_USAGE}`);
+      from = value;
+    } else if (flag === "--adapters" || flag === "--owner" || flag === "--discord-app-id") {
       const value = args[++i];
       if (value === undefined || value.trim() === "" || value.startsWith("--"))
         throw new SetupError(`${flag} expects a value
@@ -1739,15 +2289,22 @@ ${SETUP_USAGE}`);
       throw new SetupError(`unknown option: ${flag.split("=")[0]}
 ${SETUP_USAGE}`);
   }
-  if (status && (fromEnv || adapters || owners.length > 0 || discordAppId))
+  if (status && (fromEnv || brokerAgent || from !== undefined || adapters || owners.length > 0 || discordAppId))
     throw new SetupError(`--status takes no other options
+${SETUP_USAGE}`);
+  if (brokerAgent && (fromEnv || adapters || owners.length > 0 || discordAppId))
+    throw new SetupError(`--broker-agent is standalone and cannot be combined with adapter setup options
+${SETUP_USAGE}`);
+  if (from !== undefined && !brokerAgent)
+    throw new SetupError(`--from requires --broker-agent
 ${SETUP_USAGE}`);
   return {
-    mode: status ? "status" : "setup",
+    mode: status ? "status" : brokerAgent ? "broker-agent" : "setup",
     fromEnv,
     ...adapters ? { adapters } : {},
     owners,
-    ...discordAppId ? { discordAppId } : {}
+    ...discordAppId ? { discordAppId } : {},
+    ...from === undefined ? {} : { from }
   };
 }
 function splitList(value) {
@@ -1845,7 +2402,8 @@ async function validateDiscord(credentials, fetcher) {
   const ownerId = !hasTeam && typeof owner?.id === "string" ? owner.id : undefined;
   return {
     platform: "discord",
-    summary: `bot ${String(me.body.username ?? "?")} (${String(me.body.id ?? "?")}) of application ${appId}`,
+    summary: `bot named ${String(me.body.username ?? "?")} (${String(me.body.id ?? "?")}) of application ${appId}`,
+    appId,
     ...ownerId ? { ownerId } : {}
   };
 }
@@ -1899,19 +2457,19 @@ async function validateAll(tokens, fetcher) {
   return identities;
 }
 async function writePrivateFile(path, contents) {
-  const temporary = `${path}.${randomUUID2()}.tmp`;
+  const temporary = `${path}.${randomUUID3()}.tmp`;
   try {
     await writeFile4(temporary, contents, { flag: "wx", mode: 384 });
-    await chmod2(temporary, 384);
-    await rename2(temporary, path);
+    await chmod3(temporary, 384);
+    await rename3(temporary, path);
   } finally {
-    await rm(temporary, { force: true });
+    await rm2(temporary, { force: true });
   }
 }
 async function readJsonObject(path) {
   let text;
   try {
-    text = await readFile5(path, "utf8");
+    text = await readFile6(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -1929,21 +2487,21 @@ async function readJsonObject(path) {
 }
 async function applySetup(options) {
   const { home, tokens } = options;
-  const secretsDir = join7(home, "secrets");
-  const configPath = join7(home, "config.json");
-  const adapterPath = (platform) => join7(home, `adapter-${platform}.json`);
+  const secretsDir = join8(home, "secrets");
+  const configPath = join8(home, "config.json");
+  const adapterPath = (platform) => join8(home, `adapter-${platform}.json`);
   const existingConfig = await readJsonObject(configPath);
   const existingAdapters = new Map;
   for (const platform of SETUP_PLATFORMS)
     if (tokens[platform])
       existingAdapters.set(platform, await readJsonObject(adapterPath(platform)));
-  await mkdir4(home, { recursive: true, mode: 448 });
-  await chmod2(home, 448);
-  await mkdir4(secretsDir, { recursive: true, mode: 448 });
-  await chmod2(secretsDir, 448);
+  await mkdir5(home, { recursive: true, mode: 448 });
+  await chmod3(home, 448);
+  await mkdir5(secretsDir, { recursive: true, mode: 448 });
+  await chmod3(secretsDir, 448);
   const written = [];
   const secret = async (name, value) => {
-    const path = join7(secretsDir, name);
+    const path = join8(secretsDir, name);
     await writePrivateFile(path, `${value}
 `);
     written.push(path);
@@ -1990,7 +2548,7 @@ async function applySetup(options) {
 async function enabledAdapters(home) {
   const enabled = [];
   for (const platform of SETUP_PLATFORMS) {
-    if (await Bun.file(join7(home, `adapter-${platform}.json`)).exists())
+    if (await Bun.file(join8(home, `adapter-${platform}.json`)).exists())
       enabled.push(platform);
   }
   return enabled;
@@ -2011,12 +2569,14 @@ async function askRequiredSecret(prompter, question) {
       return answer;
   }
 }
-async function tokensFromPrompts(prompter, parsed) {
+async function tokensFromPrompts(prompter, parsed, log) {
   const wanted = parsed.adapters ?? [];
   const enable = async (platform, label) => parsed.adapters ? wanted.includes(platform) : await askYes(prompter, `Enable ${label}?`);
   const tokens = {};
   if (await enable("discord", "Discord")) {
-    const token = await askRequiredSecret(prompter, "Discord bot token (input hidden): ");
+    const logger = log ?? (() => {});
+    printDiscordSetupGuide(logger);
+    const token = await askRequiredSecret(prompter, "Paste your Discord bot token here (input hidden): ");
     const appId = parsed.discordAppId ?? (await prompter.ask("Discord application id (optional): ")).trim();
     tokens.discord = { token, ...appId ? { appId } : {} };
   }
@@ -2085,6 +2645,28 @@ function terminalPrompter() {
     close: () => stdin.pause()
   };
 }
+async function defaultBrokerAgentRunner(command) {
+  const child = Bun.spawn([...command], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+async function setupBinDir(options) {
+  if (options.binDir !== undefined)
+    return options.binDir;
+  const env = options.env ?? process.env;
+  if (env.GAJAEWAY_BIN_DIR)
+    return env.GAJAEWAY_BIN_DIR;
+  const executable = await realpath(process.execPath).catch(() => {
+    return;
+  });
+  if (executable !== undefined && basename(executable).startsWith("gajaeway"))
+    return dirname2(executable);
+  throw new SetupError("setup --broker-agent requires the installed gajaeway binary or an explicit bin directory");
+}
 async function runSetup(args, options) {
   const log = options.log ?? ((line) => console.log(line));
   const parsed = parseSetupArgs(args);
@@ -2092,6 +2674,26 @@ async function runSetup(args, options) {
     log((await enabledAdapters(options.home)).join(","));
     return;
   }
+  if (parsed.mode === "broker-agent") {
+    const command = [
+      join8(await setupBinDir(options), "gajaeway-gateway"),
+      "broker-agent",
+      "provision",
+      "--mode",
+      "force",
+      ...parsed.from === undefined ? [] : ["--from", parsed.from]
+    ];
+    const result = await (options.runBrokerAgent ?? defaultBrokerAgentRunner)(command);
+    if (result.stdout.length > 0)
+      process.stdout.write(result.stdout);
+    if (result.stderr.length > 0)
+      process.stderr.write(result.stderr);
+    if (result.exitCode === 1 && /lease_held name=broker/.test(`${result.stdout}
+${result.stderr}`))
+      log("broker lease is held; stop it with: systemctl --user stop gajaeway-broker");
+    process.exitCode = result.exitCode;
+    return;
+  }
   let tokens;
   let owners;
   if (parsed.fromEnv) {
@@ -2100,7 +2702,7 @@ async function runSetup(args, options) {
   } else {
     const prompter = (options.prompter ?? terminalPrompter)();
     try {
-      ({ tokens, owners } = await tokensFromPrompts(prompter, parsed));
+      ({ tokens, owners } = await tokensFromPrompts(prompter, parsed, log));
     } finally {
       prompter.close();
     }
@@ -2110,6 +2712,11 @@ async function runSetup(args, options) {
     const identities = await validateAll(tokens, options.fetch ?? ((input, init) => fetch(input, init)));
     for (const identity of identities)
       log(`${identity.platform}: token valid \u2014 ${identity.summary}`);
+    const discordIdentity = identities.find((i) => i.platform === "discord");
+    if (discordIdentity && tokens.discord && discordIdentity.appId) {
+      const botName = (discordIdentity.summary.match(/named (\S+)/) ?? [])[1];
+      printDiscordBotReady(log, discordIdentity.appId, botName);
+    }
     for (const identity of identities)
       if (identity.ownerId && owners.length === 0) {
         owners.push(identity.ownerId);
@@ -2129,77 +2736,152 @@ async function runSetup(args, options) {
 
 // src/update.ts
 import {
-  chmod as chmod3,
+  chmod as chmod5,
   copyFile,
-  mkdir as mkdir5,
+  mkdir as mkdir7,
+  mkdtemp as mkdtemp2,
+  readdir as readdir3,
+  readFile as readFile7,
+  realpath as realpath2,
+  rename as rename5,
+  rm as rm4,
+  stat as stat2,
+  writeFile as writeFile6
+} from "fs/promises";
+import { tmpdir } from "os";
+import { basename as basename2, dirname as dirname3, join as join10 } from "path";
+
+// src/gjc-install.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import {
+  access as access2,
+  chmod as chmod4,
+  lstat as lstat2,
+  mkdir as mkdir6,
   mkdtemp,
-  open,
   readdir as readdir2,
-  readFile as readFile6,
-  realpath,
-  rename as rename3,
-  rm as rm2,
-  stat as stat2,
+  readlink as readlink2,
+  rename as rename4,
+  rm as rm3,
+  symlink,
   writeFile as writeFile5
 } from "fs/promises";
-import { tmpdir } from "os";
-import { basename, dirname, join as join8 } from "path";
-// package.json
-var package_default = {
-  name: "@gajae-gateway/cli",
-  version: "0.1.8",
-  type: "module",
-  description: "Owner CLI for the gajaeway gateway: status, sessions, chat, monitors, and worker lanes over the gateway socket. Requires the Bun runtime (uses Bun.file/Bun.spawn).",
-  license: "AGPL-3.0-only",
-  author: "Yeachan Heo",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/Yeachan-Heo/gajae-way.git",
-    directory: "packages/cli"
-  },
-  homepage: "https://github.com/Yeachan-Heo/gajae-way/tree/main/packages/cli#readme",
-  bugs: "https://github.com/Yeachan-Heo/gajae-way/issues",
-  keywords: [
-    "gajaeway",
-    "cli",
-    "gateway"
-  ],
-  files: [
-    "dist",
-    "src"
-  ],
-  main: "./dist/main.js",
-  types: "./src/main.ts",
-  exports: {
-    ".": {
-      bun: "./src/main.ts",
-      types: "./src/main.ts",
-      default: "./dist/main.js"
+import { join as join9 } from "path";
+var VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+async function defaultRunner(command, cwd) {
+  const child = Bun.spawn([...command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+function assertSuccessful(command, result) {
+  if (result.exitCode !== 0) {
+    const detail = result.stderr.trim();
+    throw new Error(`${command.join(" ")} exited with status ${result.exitCode}${detail.length === 0 ? "" : `: ${detail}`}`);
+  }
+}
+function versionFromOutput(output) {
+  return output.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\b/)?.[0];
+}
+async function verifyGjc(path, cwd, version, runner) {
+  await access2(path);
+  const command = [path, "--version"];
+  const result = await runner(command, cwd);
+  assertSuccessful(command, result);
+  const reported = versionFromOutput(`${result.stdout}
+${result.stderr}`);
+  if (reported !== version)
+    throw new Error(`gjc version verification failed: expected ${version}, got ${reported ?? "unknown"}`);
+}
+async function currentVersion(prefix, current) {
+  try {
+    const target = await readlink2(current);
+    if (target.includes("/") || !VERSION_PATTERN.test(target))
+      return;
+    const targetPath = join9(prefix, target);
+    if (!(await lstat2(targetPath)).isDirectory())
+      return;
+    return target;
+  } catch {
+    return;
+  }
+}
+async function pruneVersions(prefix, keep) {
+  const retained = new Set(keep);
+  const entries2 = await readdir2(prefix, { withFileTypes: true });
+  const versions = entries2.filter((entry) => entry.isDirectory() && VERSION_PATTERN.test(entry.name)).map((entry) => entry.name).sort((left, right) => Bun.semver.order(right, left));
+  for (const version of versions) {
+    if (retained.size >= 2)
+      break;
+    retained.add(version);
+  }
+  for (const version of versions)
+    if (!retained.has(version))
+      await rm3(join9(prefix, version), { recursive: true, force: true });
+}
+async function installPinnedGjc(options) {
+  const { home, version } = options;
+  if (!VERSION_PATTERN.test(version))
+    throw new Error(`invalid pinned gjc version: ${version}`);
+  const layout = homeLayout(home);
+  const runner = options.runner ?? defaultRunner;
+  await mkdir6(layout.gjcPrefix, { recursive: true, mode: 448 });
+  await chmod4(layout.gjcPrefix, 448);
+  const versionDir = join9(layout.gjcPrefix, version);
+  const previousVersion = await currentVersion(layout.gjcPrefix, layout.gjcCurrent);
+  let staging;
+  try {
+    let installed = false;
+    try {
+      const info = await lstat2(versionDir);
+      if (!info.isDirectory())
+        throw new Error(`gjc version path is not a directory: ${versionDir}`);
+      installed = true;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
     }
-  },
-  bin: {
-    gajaeway: "./dist/main.js"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  scripts: {
-    build: "rm -rf dist && bun build src/main.ts --outdir dist --target bun --format esm --external @gajae-gateway/protocol --external @gajae-gateway/sdk && tsc -p tsconfig.build.json",
-    prepublishOnly: "bun run build"
-  },
-  dependencies: {
-    "@gajae-gateway/sdk": "workspace:*",
-    "@gajae-gateway/protocol": "workspace:*"
-  },
-  engines: {
-    bun: ">=1.4.0"
+    if (!installed) {
+      staging = await mkdtemp(join9(layout.gjcPrefix, ".staging-"));
+      await chmod4(staging, 448);
+      await writeFile5(join9(staging, "package.json"), `${JSON.stringify({ private: true, dependencies: { "gajae-code": version } }, null, 2)}
+`, { mode: 384 });
+      const installCommand = ["bun", "install", "--production"];
+      assertSuccessful(installCommand, await runner(installCommand, staging));
+      const installedBin = join9(staging, "node_modules", ".bin", "gjc");
+      await access2(installedBin);
+      const binDir = join9(staging, "bin");
+      await mkdir6(binDir, { mode: 448 });
+      await symlink("../node_modules/.bin/gjc", join9(binDir, "gjc"), "file");
+      await verifyGjc(join9(binDir, "gjc"), staging, version, runner);
+      await rename4(staging, versionDir);
+      staging = undefined;
+    } else {
+      await verifyGjc(join9(versionDir, "bin", "gjc"), versionDir, version, runner);
+    }
+    await pruneVersions(layout.gjcPrefix, [version, ...previousVersion === undefined ? [] : [previousVersion]]);
+    const temporaryLink = join9(layout.gjcPrefix, `.current-${randomUUID4()}`);
+    try {
+      await symlink(version, temporaryLink, "dir");
+      await rename4(temporaryLink, layout.gjcCurrent);
+    } finally {
+      await rm3(temporaryLink, { force: true });
+    }
+    return layout.gjcExecutable();
+  } finally {
+    if (staging !== undefined)
+      await rm3(staging, { recursive: true, force: true });
   }
-};
+}
 
 // src/update.ts
 var UPDATE_USAGE = "usage: gajaeway update [--check] [--force] [--bin-dir DIR] [--no-restart]";
 var DEFAULT_RELEASE_REPO = "Yeachan-Heo/gajae-way";
 var RELEASE_REPO_OVERRIDE_ENV = "GAJAEWAY_UPDATE_REPO";
+var PIN_MANIFEST = "package.json";
 function releaseRepo(env = process.env) {
   const override = env[RELEASE_REPO_OVERRIDE_ENV]?.trim();
   return override ? override : declaredReleaseRepo();
@@ -2262,13 +2944,12 @@ var CORE_BINARIES = ["gajaeway", "gajaeway-gateway"];
 var MIN_BINARY_BYTES = 1048576;
 var MAX_ASSET_BYTES = 512 * 1024 * 1024;
 var RELEASE_MARKER = ".gajaeway-release";
-var LOCK_FILE = ".gajaeway-update.lock";
 function releaseMarkerPath(binDir) {
-  return join8(binDir, RELEASE_MARKER);
+  return join10(binDir, RELEASE_MARKER);
 }
 async function readInstalledRelease(binDir) {
   try {
-    const version = releaseVersion(await readFile6(releaseMarkerPath(binDir), "utf8"));
+    const version = releaseVersion(await readFile7(releaseMarkerPath(binDir), "utf8"));
     return version;
   } catch {
     return;
@@ -2277,12 +2958,12 @@ async function readInstalledRelease(binDir) {
 async function resolveBinDir(flag, execPath = process.execPath) {
   if (flag !== undefined)
     return flag;
-  const real = await realpath(execPath).catch(() => {
+  const real = await realpath2(execPath).catch(() => {
     return;
   });
   if (real === undefined)
     return;
-  return basename(real).startsWith("gajaeway") ? dirname(real) : undefined;
+  return basename2(real).startsWith("gajaeway") ? dirname3(real) : undefined;
 }
 function renderUpdate(result) {
   const lines = [];
@@ -2302,8 +2983,71 @@ function renderUpdate(result) {
     lines.push(`restart: queued ${result.restartQueued} \u2014 check with: gajaeway ops restart-stack --status`);
   else if (result.restartSkipped)
     lines.push("restart: skipped (--no-restart)");
+  if (result.brokerNotEnabled)
+    lines.push("broker unit installed, not enabled: run gajaeway setup --broker-agent");
   return lines;
 }
+async function readPinnedGjcVersion(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile7(path, "utf8"));
+  } catch (error) {
+    throw new Error(`could not read pinned gjc version from ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+    throw new Error(`invalid release package metadata at ${path}`);
+  const gjc = parsed.gjc;
+  if (typeof gjc !== "object" || gjc === null || Array.isArray(gjc))
+    throw new Error(`release package metadata at ${path} has no gjc.version`);
+  const version = gjc.version;
+  if (typeof version !== "string" || version.trim() === "")
+    throw new Error(`release package metadata at ${path} has no gjc.version`);
+  return version;
+}
+async function defaultUpdateCommandRunner(command) {
+  const child = Bun.spawn([...command], { stdin: "ignore", stdout: "ignore", stderr: "pipe" });
+  const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+  if (exitCode !== 0) {
+    const detail = stderr.trim();
+    throw new Error(`${command.join(" ")} exited with status ${exitCode}${detail.length === 0 ? "" : `: ${detail}`}`);
+  }
+  return exitCode;
+}
+async function installUpdatedServices(options) {
+  const { home, binDir, platform, noRestart, deps } = options;
+  const brokerProvisioned = await exists(homeLayout(home).brokerProvisionManifest);
+  const env = { ...deps.env ?? process.env, GAJAEWAY_HOME: home };
+  await installServices({
+    binDir,
+    platform,
+    env,
+    configuredAdaptersOnly: true,
+    compareAndWrite: true,
+    ...deps.serviceOptions
+  });
+  if (platform === "linux") {
+    const run = deps.serviceRunner ?? defaultUpdateCommandRunner;
+    const execute = async (command) => {
+      const exitCode = await run(command);
+      if (exitCode !== 0)
+        throw new Error(`${command.join(" ")} exited with status ${exitCode}`);
+    };
+    await execute(["systemctl", "--user", "daemon-reload"]);
+    if (!noRestart) {
+      const enableUnits = [];
+      for (const spec of serviceSpecs()) {
+        if (spec.id === "broker" && !brokerProvisioned)
+          continue;
+        if (spec.id.startsWith("adapter-") && !await Bun.file(join10(home, `adapter-${spec.id.slice(8)}.json`)).exists())
+          continue;
+        enableUnits.push(systemdUnitName(spec));
+      }
+      if (enableUnits.length > 0)
+        await execute(["systemctl", "--user", "enable", ...enableUnits]);
+    }
+  }
+  return !brokerProvisioned;
+}
 async function runUpdate(options) {
   const deps = options.deps ?? {};
   const platform = deps.platform ?? process.platform;
@@ -2326,46 +3070,67 @@ async function runUpdate(options) {
     return { current, latest, tag: release.tag, repo, checkedOnly: true, upToDate: false, installed: [] };
   if (binDir === undefined)
     throw new Error("run the update from a compiled gajaeway binary, or pass --bin-dir DIR");
-  const unlock = await acquireUpdateLock(binDir);
+  let lease;
   try {
-    const staged = await stageRelease(asset, deps);
-    const installedNames = await knownBinariesIn(binDir);
-    const toInstall = binariesToInstall(staged.names, installedNames);
-    const missingCore = CORE_BINARIES.filter((name) => !toInstall.includes(name));
-    if (missingCore.length > 0)
-      throw new Error(`release tarball is missing core binaries: ${missingCore.join(", ")}`);
-    await assertStagedBinariesUsable(staged, toInstall);
-    const stamp = new Date((deps.now ?? Date.now)()).toISOString().replace(/[-:]/g, "").slice(0, 15);
-    const backupDir = join8(binDir, `backup-${current}-${stamp}Z`);
-    await mkdir5(backupDir, { recursive: false });
-    for (const name of toInstall) {
-      const target = join8(binDir, name);
-      if (await exists(target))
-        await copyFile(target, join8(backupDir, name));
-    }
-    for (const name of toInstall) {
-      const stagedPath = join8(staged.dir, name);
-      const tempPath = join8(binDir, `.update-${name}`);
-      await copyFile(stagedPath, tempPath);
-      await chmod3(tempPath, 493);
-      await rename3(tempPath, join8(binDir, name));
+    lease = await acquireLease(options.home, "update");
+    console.info(`lease_acquired name=update pid=${process.pid}`);
+  } catch (error) {
+    if (error instanceof LeaseHeldError) {
+      console.error(error.message);
+      throw new Error(`another gajaeway update is running (${error.message})`, { cause: error });
     }
-    await writeFile5(releaseMarkerPath(binDir), `${latest}
+    console.error(`lease_failed name=update detail=${error instanceof Error ? error.message : String(error)}`);
+    throw error;
+  }
+  const installed = await (async () => {
+    let staged;
+    try {
+      staged = await stageRelease(asset, deps);
+      const installedNames = await knownBinariesIn(binDir);
+      const toInstall = binariesToInstall(staged.names, installedNames);
+      const missingCore = CORE_BINARIES.filter((name) => !toInstall.includes(name));
+      if (missingCore.length > 0)
+        throw new Error(`release tarball is missing core binaries: ${missingCore.join(", ")}`);
+      await assertStagedBinariesUsable(staged, toInstall);
+      const gjcVersion = await readPinnedGjcVersion(join10(staged.dir, PIN_MANIFEST));
+      await installPinnedGjc({
+        home: options.home,
+        version: gjcVersion,
+        ...deps.gjcInstallRunner === undefined ? {} : { runner: deps.gjcInstallRunner }
+      });
+      const stamp = new Date((deps.now ?? Date.now)()).toISOString().replace(/[-:]/g, "").slice(0, 15);
+      const backupDir = join10(binDir, `backup-${current}-${stamp}Z`);
+      await mkdir7(backupDir, { recursive: false });
+      const replaced = [...toInstall, PIN_MANIFEST];
+      for (const name of replaced) {
+        const target = join10(binDir, name);
+        if (await exists(target))
+          await copyFile(target, join10(backupDir, name));
+      }
+      for (const name of replaced) {
+        const stagedPath = join10(staged.dir, name);
+        const tempPath = join10(binDir, `.update-${name}`);
+        await copyFile(stagedPath, tempPath);
+        await chmod5(tempPath, name === PIN_MANIFEST ? 420 : 493);
+        await rename5(tempPath, join10(binDir, name));
+      }
+      await writeFile6(releaseMarkerPath(binDir), `${latest}
 `, "utf8");
-    await rm2(staged.dir, { recursive: true, force: true });
-    if (options.args.noRestart)
-      return {
-        current,
-        latest,
-        tag: release.tag,
-        repo,
-        checkedOnly: false,
-        upToDate: false,
-        installed: toInstall,
-        backupDir,
-        restartSkipped: true
-      };
-    const receipt = await (deps.queueRestart ?? defaultQueueRestart)(options.home);
+      const brokerNotEnabled = await installUpdatedServices({
+        home: options.home,
+        binDir,
+        platform,
+        noRestart: options.args.noRestart,
+        deps
+      });
+      return { toInstall, backupDir, brokerNotEnabled };
+    } finally {
+      if (staged !== undefined)
+        await rm4(staged.dir, { recursive: true, force: true });
+      await lease.release();
+    }
+  })();
+  if (options.args.noRestart)
     return {
       current,
       latest,
@@ -2373,26 +3138,37 @@ async function runUpdate(options) {
       repo,
       checkedOnly: false,
       upToDate: false,
-      installed: toInstall,
-      backupDir,
-      restartQueued: receipt.receiptId
+      installed: installed.toInstall,
+      backupDir: installed.backupDir,
+      brokerNotEnabled: installed.brokerNotEnabled,
+      restartSkipped: true
     };
-  } finally {
-    await unlock();
-  }
+  const receipt = await (deps.queueRestart ?? defaultQueueRestart)(options.home, binDir, "update");
+  return {
+    current,
+    latest,
+    tag: release.tag,
+    repo,
+    checkedOnly: false,
+    upToDate: false,
+    installed: installed.toInstall,
+    backupDir: installed.backupDir,
+    brokerNotEnabled: installed.brokerNotEnabled,
+    restartQueued: receipt.receiptId
+  };
 }
 function binariesToInstall(stagedNames, installedNames) {
   const installed = new Set(installedNames);
   return KNOWN_BINARIES.filter((name) => stagedNames.includes(name) && (installed.has(name) || CORE_BINARIES.includes(name)));
 }
 async function knownBinariesIn(dir) {
-  const entries2 = await readdir2(dir).catch(() => []);
+  const entries2 = await readdir3(dir).catch(() => []);
   const names = new Set(entries2);
   return KNOWN_BINARIES.filter((name) => names.has(name));
 }
 async function assertStagedBinariesUsable(staged, toInstall) {
   for (const name of toInstall) {
-    const info = await stat2(join8(staged.dir, name));
+    const info = await stat2(join10(staged.dir, name));
     if (!info.isFile())
       throw new Error(`staged ${name} is not a regular file`);
     if (info.size < MIN_BINARY_BYTES)
@@ -2408,10 +3184,10 @@ async function exists(path) {
   }
 }
 async function stageRelease(asset, deps) {
-  const dir = await mkdtemp(join8(tmpdir(), "gajaeway-update-"));
+  const dir = await mkdtemp2(join10(tmpdir(), "gajaeway-update-"));
   const tarball = await (deps.downloadAsset ?? defaultDownloadAsset)(asset);
   await (deps.extractTarball ?? defaultExtractTarball)(tarball, dir);
-  const names = (await readdir2(dir)).filter((name) => KNOWN_BINARIES.includes(name));
+  const names = (await readdir3(dir)).filter((name) => KNOWN_BINARIES.includes(name));
   return { dir, names };
 }
 async function defaultFetchLatestRelease(repo) {
@@ -2437,8 +3213,8 @@ async function defaultDownloadAsset(asset) {
   return bytes;
 }
 async function defaultExtractTarball(tarball, intoDir) {
-  const tarballPath = join8(intoDir, "release.tar.gz");
-  await writeFile5(tarballPath, tarball);
+  const tarballPath = join10(intoDir, "release.tar.gz");
+  await writeFile6(tarballPath, tarball);
   const process2 = Bun.spawn(["tar", "-xzf", tarballPath, "-C", intoDir], {
     stdout: "ignore",
     stderr: "pipe"
@@ -2446,186 +3222,19 @@ async function defaultExtractTarball(tarball, intoDir) {
   const exitCode = await process2.exited;
   if (exitCode !== 0) {
     const detail = await new Response(process2.stderr).text();
-    throw new Error(`extracting ${basename(tarballPath)} failed (tar exit ${exitCode}): ${detail.trim()}`);
+    throw new Error(`extracting ${basename2(tarballPath)} failed (tar exit ${exitCode}): ${detail.trim()}`);
   }
-  await rm2(tarballPath, { force: true });
+  await rm4(tarballPath, { force: true });
 }
-async function defaultQueueRestart(home) {
-  const { receipt, supervisorPid } = await launchRestartStack({ home });
+async function defaultQueueRestart(home, binDir, trigger) {
+  const { receipt, supervisorPid } = await launchRestartStack({ home, binDir, trigger });
   return { receiptId: receipt.id, supervisorPid };
 }
-async function acquireUpdateLock(binDir) {
-  const lockPath = join8(binDir, LOCK_FILE);
-  for (let attempt = 0;attempt < 2; attempt++) {
-    try {
-      const handle = await open(lockPath, "wx");
-      try {
-        await handle.write(`${JSON.stringify({ pid: process.pid, at: new Date().toISOString() })}
-`);
-      } finally {
-        await handle.close();
-      }
-      return async () => {
-        await rm2(lockPath, { force: true });
-      };
-    } catch (error) {
-      if (!isFileExistsError(error))
-        throw error;
-      const holder = await readLockHolder(lockPath);
-      if (holder !== undefined && isProcessAlive(holder)) {
-        throw new Error(`another gajaeway update is running (pid ${holder}); refusing to run concurrently`);
-      }
-      await rm2(lockPath, { force: true });
-    }
-  }
-  throw new Error(`could not acquire the update lock at ${lockPath}`);
-}
-function isFileExistsError(error) {
-  return error !== null && typeof error === "object" && error.code === "EEXIST";
-}
-async function readLockHolder(lockPath) {
-  try {
-    const parsed = JSON.parse(await readFile6(lockPath, "utf8"));
-    return typeof parsed.pid === "number" ? parsed.pid : undefined;
-  } catch {
-    return;
-  }
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-
-// src/upgrade.ts
-import { readFile as readFile7 } from "fs/promises";
-import { dirname as dirname2, join as join9 } from "path";
-async function readGatewayPinnedGjcVersion(home) {
-  const candidates = [
-    join9(home, "..", "..", "packages", "gateway", "package.json"),
-    join9(dirname2(process.execPath), "package.json")
-  ];
-  for (const path of candidates) {
-    try {
-      const version = JSON.parse(await readFile7(path, "utf-8")).gjc?.version;
-      if (typeof version === "string" && version.length > 0)
-        return version;
-    } catch {}
-  }
-  throw new Error(`Failed to read pinned GJC version from any of ${candidates.join(", ")}`);
-}
-async function checkLatestCiStatus(repo) {
-  try {
-    const branchProc = Bun.spawnSync(["git", "rev-parse", "--abbrev-ref", "HEAD"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    if (branchProc.exitCode !== 0) {
-      throw new Error("Could not determine current git branch");
-    }
-    const branch = branchProc.stdout?.toString().trim();
-    if (!branch) {
-      throw new Error("Empty branch name");
-    }
-    const runProc = Bun.spawnSync(["gh", "run", "list", "-R", repo, "--branch", branch, "--limit", "1", "--json", "conclusion,status"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    if (runProc.exitCode !== 0) {
-      throw new Error(`gh run list failed: ${runProc.stderr?.toString()}`);
-    }
-    const output = runProc.stdout?.toString() || "[]";
-    const runs = JSON.parse(output);
-    if (!Array.isArray(runs) || runs.length === 0) {
-      throw new Error("No CI runs found for this branch");
-    }
-    const latestRun = runs[0];
-    if (!latestRun.conclusion || !latestRun.status) {
-      throw new Error(`Latest CI run status is incomplete: ${JSON.stringify(latestRun)}`);
-    }
-    if (latestRun.status === "in_progress") {
-      throw new Error("CI is currently running; wait for completion");
-    }
-    return latestRun.conclusion === "success";
-  } catch (error) {
-    throw new Error(`Failed to check CI status: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function performUpgrade(options) {
-  const readVersion = options.readPinnedVersion || readGatewayPinnedGjcVersion;
-  const targetVersion = options.gjcVersion ?? await readVersion(options.home);
-  try {
-    const checkCi = options.checkCiStatus || checkLatestCiStatus;
-    let ciPassed = false;
-    try {
-      ciPassed = await checkCi("Yeachan-Heo/gajae-way");
-    } catch (ciError) {
-      const ciDetail = ciError instanceof Error ? ciError.message : String(ciError);
-      return { status: "failed", detail: `CI status check failed: ${ciDetail}` };
-    }
-    if (!ciPassed) {
-      return {
-        status: "failed",
-        detail: `Cannot upgrade: latest CI run did not pass. Fix failures and try again.`
-      };
-    }
-    const gjcProc = Bun.spawnSync(["gjc", "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    if (gjcProc.exitCode !== 0) {
-      return { status: "failed", detail: "Failed to get current gjc version" };
-    }
-    const currentVersionMatch = ((gjcProc.stdout?.toString() || "") + (gjcProc.stderr?.toString() || "")).match(/(?:gjc\/)?(\d+)\.(\d+)\.(\d+)/);
-    if (!currentVersionMatch) {
-      return { status: "failed", detail: "Could not parse current gjc version" };
-    }
-    const currentVersion = currentVersionMatch.slice(1, 4).join(".");
-    if (currentVersion === targetVersion) {
-      return { status: "ok", detail: `Already running gjc ${targetVersion}` };
-    }
-    const installProc = Bun.spawnSync(["bun", "add", "-g", `gajae-code@${targetVersion}`], {
-      stdout: "pipe",
-      stderr: "pipe",
-      cwd: join9(options.home, "workspace")
-    });
-    if (installProc.exitCode !== 0) {
-      return {
-        status: "failed",
-        detail: `Failed to install gjc ${targetVersion}: ${installProc.stderr?.toString()}`
-      };
-    }
-    const verifyProc = Bun.spawnSync(["gjc", "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    if (verifyProc.exitCode !== 0) {
-      return { status: "failed", detail: "Failed to verify gjc installation" };
-    }
-    const verifiedVersionMatch = ((verifyProc.stdout?.toString() || "") + (verifyProc.stderr?.toString() || "")).match(/(?:gjc\/)?(\d+)\.(\d+)\.(\d+)/);
-    if (!verifiedVersionMatch) {
-      return { status: "failed", detail: "Could not verify installed gjc version" };
-    }
-    const verifiedVersion = verifiedVersionMatch.slice(1, 4).join(".");
-    if (verifiedVersion !== targetVersion) {
-      return {
-        status: "failed",
-        detail: `Verification failed: expected ${targetVersion}, got ${verifiedVersion}`
-      };
-    }
-    return { status: "ok", detail: `Successfully upgraded gjc from ${currentVersion} to ${targetVersion}` };
-  } catch (error) {
-    return {
-      status: "failed",
-      detail: `Upgrade failed: ${error instanceof Error ? error.message : String(error)}`
-    };
-  }
-}
 
 // src/main.ts
+async function connectGatewaySocket(path, options = {}) {
+  return GajaewayClient.connectSocketWithBackoff(path, { ...options, deadlineMs: 30000 });
+}
 function socketPath(home = process.env.GAJAEWAY_HOME) {
   return `${home ?? `${process.env.HOME ?? "~"}/.gajaeway`}/gateway.sock`;
 }
@@ -2644,7 +3253,7 @@ var COMMANDS = [
   "update",
   "setup"
 ];
-var CLI_USAGE = "usage: gajaeway [--socket PATH] status|shutdown|chat|daemon run|sessions list [--json] [--fields a,b,c] [--limit N] [--offset N]|sessions inspect <originKey-or-index>|memory audit|memory search <query>|monitors ... (test <id> [--type T] [--payload J] [--wait[=SECONDS]])|work run|start <name> [--cwd DIR] [--resume] [--model ID|--preset NAME] [--notify originKey (start only)] <text>|work status <name>|work steer <name> <text>|work retire [--force] <name>|work retire --all-dead|work jobs|ops backup <path>|ops redeliver <deliveryId>|ops redeliver --since <iso>|ops cycle [--json]|ops integrity|ops restore <backupPath>|ops restart-stack [--status]|services install|repair --bin-dir DIR [--launch-agents-dir DIR] [--unit-dir DIR] [--platform darwin|linux]|migrate [--source PATH] [--target PATH] [--dry-run]|update [--check] [--force] [--bin-dir DIR] [--no-restart]|setup [--from-env] [--adapters discord,slack,telegram] [--owner ID] [--discord-app-id ID]|setup --status (work run waits for a response; caller timeout does not end the attempt); cron timezone is an IANA zone and defaults to the gateway host's local timezone";
+var CLI_USAGE = "usage: gajaeway [--version] [--socket PATH] status|shutdown|chat|daemon run|sessions list [--json] [--fields a,b,c] [--limit N] [--offset N]|sessions inspect <originKey-or-index>|memory audit|memory search <query>|monitors ... (settle <eventId>|retry <eventId>|test <id> [--type T] [--payload J] [--wait[=SECONDS]])|work run|start <name> [--cwd DIR] [--resume] [--model ID|--preset NAME] [--notify originKey (start only)] <text>|work status <name>|work steer <name> <text>|work retire [--force] <name>|work retire --all-dead|work jobs [--limit N] [--offset N]|ops backup <path>|ops deliveries [--since ISO] [--state S] [--limit N] [--json]|ops redeliver <deliveryId>|ops redeliver --since <iso>|ops cycle [--json]|ops integrity|ops restart-stack [--status]|services install|repair --bin-dir DIR [--launch-agents-dir DIR] [--unit-dir DIR] [--platform darwin|linux]|migrate [--source PATH] [--target PATH] [--dry-run]|update [--check] [--force] [--bin-dir DIR] [--no-restart]|setup [--from-env] [--adapters discord,slack,telegram] [--owner ID] [--discord-app-id ID]|setup --status|setup --broker-agent [--from DIR] (work run waits for a response; caller timeout does not end the attempt); cron timezone is an IANA zone and defaults to the gateway host's local timezone";
 var USAGE_EXIT_CODE = 2;
 function usageFor(command) {
   return command !== undefined && COMMANDS.includes(command) ? undefined : CLI_USAGE;
@@ -2753,6 +3362,13 @@ function parseMonitorUpdateArgs(args) {
 var MONITOR_TEST_USAGE = "usage: gajaeway monitors test <id> [--type T] [--payload J] [--wait[=SECONDS]]";
 var MONITOR_WAIT_ERROR = `${MONITOR_TEST_USAGE}
 --wait expects a finite non-negative integer up to 86400`;
+var MONITOR_OPERATOR_USAGE = "usage: gajaeway monitors settle <eventId>|retry <eventId>";
+function parseMonitorEventOperatorArgs(args) {
+  const eventId = args[0];
+  if (args.length !== 1 || !eventId?.trim() || eventId.startsWith("--"))
+    throw new Error(MONITOR_OPERATOR_USAGE);
+  return eventId;
+}
 function parseMonitorTestArgs(args) {
   const [monitorId, ...flags] = args;
   if (!monitorId || monitorId.startsWith("--"))
@@ -2803,7 +3419,7 @@ unknown argument: ${flag}`);
     ...waitSeconds === undefined ? {} : { waitSeconds }
   };
 }
-var TERMINAL_MONITOR_STAGES = new Set(["delivered", "authored_no_delivery", "failed", "failed_no_retry"]);
+var TERMINAL_MONITOR_STAGES = new Set(["delivered", "authored_no_delivery", "failed", "failed_no_retry", "skipped"]);
 function waitForMonitorStage(client, eventId, timeoutSeconds) {
   return new Promise((resolve) => {
     let stage = "admitted";
@@ -2848,11 +3464,23 @@ function renderCycle(cycle) {
   lines.push(`context: unread=${cycle.contextDiff.unread} expired=${cycle.contextDiff.expired} truncated=${cycle.contextDiff.truncated} omitted_oldest=${cycle.contextDiff.omittedOldestAt ?? "-"} omitted_newest=${cycle.contextDiff.omittedNewestAt ?? "-"}`);
   lines.push(`deliveries: pending=${cycle.deliveries.pending} inflight=${cycle.deliveries.inflight} confirmed=${cycle.deliveries.confirmed} failed_ambiguous=${cycle.deliveries.failedAmbiguous} expired=${cycle.deliveries.expired}`);
   lines.push(`memory: queued=${cycle.memoryIntents.queued} written=${cycle.memoryIntents.written} committed=${cycle.memoryIntents.committed} receipted=${cycle.memoryIntents.receipted} quarantined=${cycle.memoryIntents.quarantined}${cycle.memoryClosing ? " (closing)" : ""}`);
+  if (cycle.memoryGitIndexLock) {
+    const { path, ageMs } = cycle.memoryGitIndexLock;
+    lines.push(`memory_git_index_lock: ${path} age=${Math.round(ageMs)}ms`);
+  }
   if (cycle.agentDisk) {
     const { path, freeBytes, totalBytes } = cycle.agentDisk;
     const gib = (bytes) => (bytes / 1024 ** 3).toFixed(1);
     lines.push(freeBytes === null || totalBytes === null ? `agent_disk: ${path} unobservable` : `agent_disk: ${path} free=${gib(freeBytes)}GiB total=${gib(totalBytes)}GiB`);
   }
+  if (cycle.brokerAgent !== null) {
+    lines.push(`broker_agent: ${cycle.brokerAgent.status}`);
+    for (const entry of cycle.brokerAgent.entries)
+      if (entry.state !== "in_sync")
+        lines.push(`broker_agent ${entry.name}: kind=${entry.kind} state=${entry.state}`);
+  }
+  const sloState = cycle.slo.ok ? "ok" : cycle.slo.days.some((day) => day.status === "failed") ? "failed" : cycle.slo.days.some((day) => day.status === "insufficient") ? "insufficient" : "pending";
+  lines.push(`slo: seven-day=${sloState}`);
   lines.push(`monitors: ${cycle.monitorEvents.length ? cycle.monitorEvents.map((m) => `${m.stage}=${m.count}`).join(" ") : "none"}`);
   if (cycle.monitorAuthoringLost.length > 0)
     lines.push(`monitor authoring lost: ${cycle.monitorAuthoringLost.map((m) => `${m.eventType}=${m.consecutive} (last ${m.lastFiredAt})`).join(" ")}`);
@@ -2870,82 +3498,110 @@ function renderCycle(cycle) {
 function cycleExitCode(cycle) {
   return cycle.gates.length > 0 ? 1 : 0;
 }
-function verifyBackupIntegrity(backupPath) {
-  let database;
-  try {
-    database = new Database(backupPath, { readonly: true });
-  } catch (error) {
-    throw new Error(`Backup is not readable: ${backupPath} (${error instanceof Error ? error.message : String(error)})`);
-  }
-  let detail;
-  let pageCount;
-  try {
-    pageCount = database.query("PRAGMA page_count").get()?.page_count ?? 0;
-    detail = database.query("PRAGMA integrity_check").get()?.integrity_check ?? "unknown";
-  } catch (error) {
-    throw new Error(`Backup is not a readable SQLite database: ${backupPath} (${error instanceof Error ? error.message : String(error)})`);
-  } finally {
-    database.close();
+function renderSlo(result) {
+  const message = result.ok ? `SLO ok: ${result.days.length} consecutive UTC days` : result.days.some((day) => day.status === "failed") ? "SLO failed: counted failure events or journal overflow" : result.days.some((day) => day.status === "insufficient") ? "SLO insufficient: coverage or durable evidence is incomplete" : "SLO pending: an update window is still running; rerun later";
+  const lines = [message];
+  for (const day of result.days)
+    lines.push(`${day.date} status=${day.status} coverage=${day.complete ? "complete" : "incomplete"} alive_ms=${day.aliveMs} max_gap_ms=${day.maxUncoveredGapMs} broker_unavailable=${day.broker_unavailable} persona_bind_failed=${day.persona_bind_failed} excluded=${day.excluded}`);
+  for (const window of result.windows)
+    lines.push(`window id=${window.id} trigger=${window.trigger} state=${window.state} requested=${window.requestedAt} finished=${window.finishedAt ?? "-"} verified=${window.verified} eligible=${window.eligibleStart ?? "-"}..${window.eligibleEnd ?? "-"} over_cap_ms=${window.overCapMs}`);
+  return lines;
+}
+function sloExitCode(result) {
+  return result.ok ? 0 : 1;
+}
+var OPS_USAGE = "usage: gajaeway ops backup <path>|deliveries [--since ISO] [--state S] [--limit N] [--json]|redeliver <deliveryId>|redeliver --since <iso>|slo [--days N] [--json]|cycle [--json]|integrity|restart-stack [--status]";
+function parseOpsSloArgs(args) {
+  let days = 7;
+  let json = false;
+  const seen = new Set;
+  for (let index = 0;index < args.length; index++) {
+    const flag = args[index];
+    if (flag === "--json") {
+      if (json)
+        throw new Error(OPS_USAGE);
+      json = true;
+      continue;
+    }
+    if (flag !== "--days" || seen.has(flag))
+      throw new Error(OPS_USAGE);
+    seen.add(flag);
+    const value = args[++index];
+    if (!value || !/^\d+$/.test(value))
+      throw new Error(OPS_USAGE);
+    days = Number(value);
+    if (!Number.isSafeInteger(days) || days < 1 || days > 3650)
+      throw new Error(OPS_USAGE);
   }
-  if (pageCount === 0)
-    throw new Error(`Backup is an empty SQLite database: ${backupPath}`);
-  if (detail !== "ok")
-    throw new Error(`Backup failed SQLite integrity_check: ${backupPath} (${detail})`);
+  return { params: { days }, json };
 }
-async function restoreTargetPath(home = gatewayHome()) {
-  const configPath = join10(home, "config.json");
-  let raw;
-  try {
-    raw = await readFile8(configPath, "utf8");
-  } catch (error) {
-    const code = error.code;
-    const entryExists = await lstat2(configPath).then(() => true, () => false);
-    if (code !== "ENOENT" || entryExists)
-      throw new Error(`Cannot read ${configPath}; refusing restore.`);
+function parseOpsDeliveriesArgs(args) {
+  const params = {};
+  const seen = new Set;
+  let json = false;
+  for (let index = 0;index < args.length; index++) {
+    const flag = args[index];
+    if (flag === "--json") {
+      if (json)
+        throw new Error(OPS_USAGE);
+      json = true;
+      continue;
+    }
+    if (flag !== "--since" && flag !== "--state" && flag !== "--limit")
+      throw new Error(OPS_USAGE);
+    if (seen.has(flag))
+      throw new Error(OPS_USAGE);
+    seen.add(flag);
+    const value = args[++index];
+    if (!value || value.startsWith("--"))
+      throw new Error(OPS_USAGE);
+    if (flag === "--since") {
+      if (!Number.isFinite(Date.parse(value)))
+        throw new Error(OPS_USAGE);
+      params.since = value;
+    } else if (flag === "--state")
+      params.state = value;
+    else {
+      if (!/^\d+$/.test(value))
+        throw new Error(OPS_USAGE);
+      const limit = Number(value);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500)
+        throw new Error(OPS_USAGE);
+      params.limit = limit;
+    }
   }
-  if (raw === undefined)
-    return join10(home, "gateway.db");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`Cannot parse ${configPath}; refusing restore.`);
+  return { params, json };
+}
+function parseWorkJobsArgs(args, usage) {
+  const params = {};
+  for (let index = 0;index < args.length; index++) {
+    const flag = args[index];
+    const value = args[++index];
+    if (flag !== "--limit" && flag !== "--offset" || value === undefined || !/^\d+$/.test(value))
+      throw new Error(usage);
+    const key = flag === "--limit" ? "limit" : "offset";
+    if (params[key] !== undefined)
+      throw new Error(usage);
+    const number = Number(value);
+    if (!Number.isSafeInteger(number) || key === "limit" && (number < 1 || number > WORK_JOBS_MAX_LIMIT))
+      throw new Error(usage);
+    params[key] = number;
   }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
-    throw new Error(`Invalid configuration ${configPath}: config must be an object; refusing restore.`);
-  const dbPath = parsed.dbPath;
-  if (dbPath === undefined)
-    return join10(home, "gateway.db");
-  if (typeof dbPath !== "string" || dbPath.length === 0)
-    throw new Error(`Invalid configuration ${configPath}: dbPath must be a non-empty string; refusing restore.`);
-  return dbPath;
-}
-async function restoreDatabase(socket, backupPath) {
-  if (!isAbsolute(backupPath))
-    throw new Error("ops restore requires an absolute backup path");
-  try {
-    await stat3(socket);
-    throw new Error(`Refusing restore: gateway socket ${socket} exists. Stop the daemon before restoring.`);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Refusing restore:"))
-      throw error;
-    if (error.code !== "ENOENT")
-      throw new Error(`Cannot verify gateway socket ${socket}; refusing restore.`);
-  }
-  verifyBackupIntegrity(backupPath);
-  const databasePath = await restoreTargetPath();
-  const preservedPath = `${databasePath}.pre-restore-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-  await copyFile2(databasePath, preservedPath);
-  await copyFile2(backupPath, databasePath);
-  console.log(`Validated SQLite backup: ${backupPath}`);
-  console.log(`Copied current database to: ${preservedPath}`);
-  console.log(`Restored backup to: ${databasePath}`);
+  return params;
+}
+function renderDeliveries(result) {
+  if (result.rows.length === 0)
+    return ["deliveries: none"];
+  return [
+    `deliveries: ${result.rows.length}`,
+    ...result.rows.map((row) => `${row.createdAt} ${row.state} delivery=${row.deliveryId} turn=${row.turnId} origin=${row.originKey} conversation=${row.conversationId} text=${JSON.stringify(row.textPrefix)}`)
+  ];
 }
 var CHAT_TURN_TIMEOUT_MS = 30 * 60000;
 async function chat(socket) {
   let client;
   try {
-    client = await GajaewayClient.connectSocket(socket);
+    client = await connectGatewaySocket(socket);
   } catch {
     console.error(`Unable to connect to gateway socket ${socket}. Start the daemon out-of-band first.`);
     process.exitCode = 1;
@@ -3000,8 +3656,31 @@ async function chat(socket) {
     await client.close();
   }
 }
+async function pollMemoryOp(client, opRef, maxWaitMs = 300000, pollIntervalMs = 1000) {
+  const startTime = Date.now();
+  let operationElapsedMs = 0;
+  while (Date.now() - startTime < maxWaitMs) {
+    const status = await client.request("memory.status", { opRef });
+    operationElapsedMs = status.elapsedMs;
+    if (status.status === "completed") {
+      return { status: "completed", elapsedMs: status.elapsedMs, result: status.result };
+    }
+    if (status.status === "failed") {
+      return { status: "failed", elapsedMs: status.elapsedMs, error: status.error };
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+  }
+  const waitedMs = Date.now() - startTime;
+  console.error(`memory operation still running (${Math.round(operationElapsedMs / 1000)}s operation elapsed; CLI wait ended after ${Math.round(waitedMs / 1000)}s).
+Check status: gajaeway memory status ${opRef}`);
+  return { status: "still_running", elapsedMs: operationElapsedMs };
+}
 async function main(args = process.argv.slice(2), options = {}) {
   const parsed = parseArgs(args);
+  if (parsed.command === "--version" && parsed.rest.length === 0) {
+    console.log(package_default.version);
+    return;
+  }
   const usage = usageFor(parsed.command);
   if (usage !== undefined) {
     console.error(usage);
@@ -3010,7 +3689,7 @@ async function main(args = process.argv.slice(2), options = {}) {
   try {
     switch (parsed.command) {
       case "status": {
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           console.log(JSON.stringify(await client.status()));
         } finally {
@@ -3019,7 +3698,7 @@ async function main(args = process.argv.slice(2), options = {}) {
         break;
       }
       case "shutdown": {
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           await client.shutdown();
         } finally {
@@ -3038,7 +3717,7 @@ async function main(args = process.argv.slice(2), options = {}) {
         break;
       case "sessions": {
         const listOptions = parsed.rest[0] === "list" ? parseListOptions(parsed.rest.slice(1), SESSION_COLUMNS) : undefined;
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           const result = await client.request("session.list");
           const [command, selector] = parsed.rest;
@@ -3073,30 +3752,12 @@ async function main(args = process.argv.slice(2), options = {}) {
         break;
       }
       case "ops": {
-        const [command, path, ...extraArgs] = parsed.rest;
-        if (command === "upgrade") {
-          const home = gatewayHome();
-          let gjcVersion;
-          if (path === "--gjc" && extraArgs[0]) {
-            gjcVersion = extraArgs[0];
-          } else if (path && path !== "--gjc") {
-            throw new Error("usage: gajaeway ops upgrade [--gjc X.Y.Z]");
-          }
-          const result = await performUpgrade({ home, gjcVersion });
-          console.log(result.detail);
-          if (result.status !== "ok") {
-            process.exitCode = 1;
-            break;
-          }
-          const { receipt, supervisorPid } = await launchRestartStack({ home });
-          console.log(`restart-stack ${receipt.id}: queued (supervisor pid ${supervisorPid})`);
-          console.log("read the outcome with: gajaeway ops restart-stack --status");
-          break;
-        }
-        if (command === "restore" && path) {
-          await restoreDatabase(parsed.socket, path);
-          break;
-        }
+        const [command, path] = parsed.rest;
+        if (command === undefined || !["backup", "deliveries", "redeliver", "integrity", "slo", "cycle", "restart-stack"].includes(command))
+          throw new Error(`unknown ops command: ${command ?? "(missing)"}
+${OPS_USAGE}`);
+        const deliveries = command === "deliveries" ? parseOpsDeliveriesArgs(parsed.rest.slice(1)) : undefined;
+        const slo = command === "slo" ? parseOpsSloArgs(parsed.rest.slice(1)) : undefined;
         if (command === "restart-stack") {
           const usage2 = "usage: gajaeway ops restart-stack [--status]";
           const home = gatewayHome();
@@ -3115,9 +3776,10 @@ async function main(args = process.argv.slice(2), options = {}) {
             const receipt = await readRestartReceipt(home);
             if (receipt === undefined)
               throw new Error("no restart-stack receipt");
-            for (const line of renderRestartReceipt(receipt))
+            const state = await effectiveRestartState(receipt, home);
+            for (const line of renderRestartReceipt(receipt, state))
               console.log(line);
-            if (effectiveRestartState(receipt) !== "ok")
+            if (state !== "ok")
               process.exitCode = 1;
           } else if (parsed.rest.length === 1) {
             const { receipt, supervisorPid } = await launchRestartStack({ ...options.restartStack?.launch, home });
@@ -3136,11 +3798,18 @@ async function main(args = process.argv.slice(2), options = {}) {
           else
             throw new Error("usage: gajaeway ops redeliver <deliveryId>|--since <iso>");
         }
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           if (command === "backup" && path)
             console.log(JSON.stringify(await client.request("ops.backup", { path })));
-          else if (redeliverParams)
+          else if (deliveries) {
+            const result = await client.opsDeliveries(deliveries.params);
+            if (deliveries.json)
+              console.log(JSON.stringify(result));
+            else
+              for (const line of renderDeliveries(result))
+                console.log(line);
+          } else if (redeliverParams)
             console.log(JSON.stringify(await client.request("ops.redeliver", redeliverParams)));
           else if (command === "integrity")
             console.log(JSON.stringify(await client.request("ops.integrity")));
@@ -3154,28 +3823,68 @@ async function main(args = process.argv.slice(2), options = {}) {
               for (const line of renderCycle(cycle))
                 console.log(line);
             process.exitCode = cycleExitCode(cycle);
+          } else if (slo) {
+            const result = await client.opsSlo(slo.params);
+            if (slo.json)
+              console.log(JSON.stringify(result));
+            else
+              for (const line of renderSlo(result))
+                console.log(line);
+            process.exitCode = sloExitCode(result);
           } else
-            throw new Error("usage: gajaeway ops backup <path>|redeliver <deliveryId>|redeliver --since <iso>|cycle [--json]|integrity|restore <backupPath>|upgrade [--gjc X.Y.Z]|restart-stack [--status]");
+            throw new Error(OPS_USAGE);
         } finally {
           await client.close();
         }
         break;
       }
       case "memory": {
-        const usage2 = "usage: gajaeway memory audit|memory autolink|memory search <query>";
+        const usage2 = "usage: gajaeway memory audit|autolink|search <query>|status <opRef>";
         if ((parsed.rest[0] === "audit" || parsed.rest[0] === "autolink") && parsed.rest.length > 1)
           throw new Error(`${usage2} (unknown argument: ${parsed.rest[1]})`);
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        if (parsed.rest[0] === "status" && parsed.rest.length < 2)
+          throw new Error(`${usage2} (status requires opRef)`);
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           if (parsed.rest[0] === "audit") {
-            const result = await client.request("memory.audit");
-            console.log(JSON.stringify(result.issues));
-            if (!result.ok)
+            const initResp = await client.request("memory.audit");
+            const poll = await pollMemoryOp(client, initResp.opRef);
+            if (poll.status === "failed") {
+              console.error(`audit failed after ${poll.elapsedMs}ms: ${poll.error}`);
               process.exitCode = 1;
+            } else if (poll.status === "still_running") {
+              process.exitCode = 75;
+            } else {
+              const auditResult = poll.result;
+              console.log(JSON.stringify(auditResult?.issues ?? []));
+              console.error(`audit completed in ${poll.elapsedMs}ms`);
+              if (!auditResult?.ok)
+                process.exitCode = 1;
+            }
           } else if (parsed.rest[0] === "autolink") {
-            console.log(JSON.stringify(await client.request("memory.autolink")));
+            const initResp = await client.request("memory.autolink");
+            const poll = await pollMemoryOp(client, initResp.opRef);
+            if (poll.status === "failed") {
+              console.error(`autolink failed after ${poll.elapsedMs}ms: ${poll.error}`);
+              process.exitCode = 1;
+            } else if (poll.status === "still_running") {
+              process.exitCode = 75;
+            } else {
+              console.log(JSON.stringify(poll.result));
+            }
           } else if (parsed.rest[0] === "search" && parsed.rest.slice(1).join(" ")) {
             console.log(JSON.stringify(await client.request("memory.search", { query: parsed.rest.slice(1).join(" ") })));
+          } else if (parsed.rest[0] === "status" && parsed.rest[1]) {
+            const opRef = parsed.rest[1];
+            const result = await client.request("memory.status", { opRef });
+            if (result.status === "failed") {
+              console.error(`operation ${opRef} failed after ${result.elapsedMs}ms: ${result.error}`);
+              process.exitCode = 1;
+            } else if (result.status === "completed") {
+              console.log(JSON.stringify(result));
+            } else {
+              console.log(JSON.stringify({ status: result.status, elapsedMs: result.elapsedMs }));
+            }
           } else
             throw new Error(usage2);
         } finally {
@@ -3188,7 +3897,8 @@ async function main(args = process.argv.slice(2), options = {}) {
         const listOptions = command === "list" ? parseListOptions(args2, MONITOR_COLUMNS) : undefined;
         const update = command === "update" ? parseMonitorUpdateArgs(args2) : undefined;
         const monitorTest = command === "test" ? parseMonitorTestArgs(args2) : undefined;
-        const client = await GajaewayClient.connectSocket(parsed.socket);
+        const operatorEventId = command === "settle" || command === "retry" ? parseMonitorEventOperatorArgs(args2) : undefined;
+        const client = await connectGatewaySocket(parsed.socket);
         try {
           if (command === "add" && args2[0] === "--json" && args2[1])
             console.log(JSON.stringify(await client.request("monitor.add", JSON.parse(args2[1]))));
@@ -3223,8 +3933,15 @@ async function main(args = process.argv.slice(2), options = {}) {
               const stage = await waitForMonitorStage(client, result.eventId, monitorTest.waitSeconds);
               console.log(JSON.stringify({ eventId: result.eventId, stage }));
             }
+          } else if ((command === "settle" || command === "retry") && operatorEventId !== undefined) {
+            const result = await client.request(`monitor.${command}`, {
+              eventId: operatorEventId
+            });
+            console.log(JSON.stringify(result));
+            if (!result.done)
+              process.exitCode = 1;
           } else
-            throw new Error(`usage: gajaeway monitors add --json '<MonitorSpec json>'|update <id> (--json '<partial MonitorSpec JSON>'|--schedule '<cron>' [--enabled true|false]|--enabled true|false [--schedule '<cron>'])|list [--json] [--fields ${columnNames(MONITOR_COLUMNS).join(",")}] [--limit N] [--offset N]|inspect <id>|remove <id>|test <id> [--type T] [--payload J] [--wait[=SECONDS]]`);
+            throw new Error(`usage: gajaeway monitors add --json '<MonitorSpec json>'|update <id> (--json '<partial MonitorSpec JSON>'|--schedule '<cron>' [--enabled true|false]|--enabled true|false [--schedule '<cron>'])|list [--json] [--fields ${columnNames(MONITOR_COLUMNS).join(",")}] [--limit N] [--offset N]|inspect <id>|remove <id>|settle <eventId>|retry <eventId>|test <id> [--type T] [--payload J] [--wait[=SECONDS]]`);
         } finally {
           await client.close();
         }
@@ -3238,7 +3955,7 @@ async function main(args = process.argv.slice(2), options = {}) {
           const text2 = args2.slice(1).join(" ").trim();
           if (!name2 || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name2) || (command === "status" ? args2.length !== 1 : !text2 || args2.slice(1).some((arg) => arg.startsWith("--"))))
             throw new Error(usage2);
-          const client2 = await GajaewayClient.connectSocket(parsed.socket);
+          const client2 = await connectGatewaySocket(parsed.socket);
           try {
             if (command === "status") {
               console.log(JSON.stringify(await client2.request("work.status", { name: name2 })));
@@ -3257,6 +3974,7 @@ async function main(args = process.argv.slice(2), options = {}) {
           let force = false;
           let allDead = false;
           let name2;
+          let jobsPage;
           if (command === "retire") {
             for (let i = 0;i < args2.length; i++) {
               const arg = args2[i];
@@ -3280,9 +3998,9 @@ async function main(args = process.argv.slice(2), options = {}) {
             if (allDead && name2)
               throw new Error(usage2);
           } else if (args2.length !== 0) {
-            throw new Error(usage2);
+            jobsPage = parseWorkJobsArgs(args2, usage2);
           }
-          const client2 = await GajaewayClient.connectSocket(parsed.socket);
+          const client2 = await connectGatewaySocket(parsed.socket);
           try {
             if (command === "retire") {
               const result = await client2.request("work.retire", {
@@ -3297,13 +4015,18 @@ async function main(args = process.argv.slice(2), options = {}) {
                 console.log(result.retired ? `retired: ${result.sessionKey} session=${result.sessionId} closed=${result.closed}${forced}` : `not retired: ${result.reason}`);
               }
             } else {
-              const result = await client2.request("work.jobs");
+              const result = await client2.request("work.jobs", jobsPage);
               for (const job of result.jobs) {
                 const name3 = job.lane_key.startsWith("work-") ? job.lane_key.slice("work-".length) : job.lane_key;
                 const state = job.quarantined ? `HELD: quarantined reason=${job.reason} historical_state=${job.state}` : job.state;
                 const head = job.last_commit ? `${job.last_commit.sha.slice(0, 7)}@${job.last_commit.committed_at} ${JSON.stringify(job.last_commit.subject)}` : "-";
                 console.log(`${name3} ${state} session=${job.session_id || "-"} accepted=${job.accepted_at || "-"} op=${job.attempt?.op_ref || "-"} last=${job.last_activity_at || "-"} head=${head} ${job.worktree_path}${job.reports && (job.reports.pending !== 0 || job.reports.claimed !== 0 || job.reports.held !== 0 || job.reports.undeliverable !== 0) ? ` reports=p:${job.reports.pending} c:${job.reports.claimed} h:${job.reports.held} u:${job.reports.undeliverable}` : ""}`);
               }
+              const shownEnd = result.offset + result.jobs.length;
+              if (result.jobs.length === 0)
+                console.error(`jobs: none at offset ${result.offset} of ${result.total}`);
+              else if (result.offset > 0 || shownEnd < result.total)
+                console.error(`jobs ${result.offset + 1}-${shownEnd} of ${result.total}${shownEnd < result.total ? ` (next: --offset ${shownEnd})` : ""}`);
             }
           } finally {
             await client2.close();
@@ -3315,11 +4038,13 @@ async function main(args = process.argv.slice(2), options = {}) {
         const name = args2[0];
         let cwd;
         let resume = false;
+        let repo;
+        let base;
         let model;
         const textParts = [];
         for (let i = 1;i < args2.length; i++) {
           const arg = args2[i];
-          if (arg === "--cwd" || arg === "--model" || arg === "--preset") {
+          if (arg === "--cwd" || arg === "--repo" || arg === "--base" || arg === "--model" || arg === "--preset") {
             const value = args2[++i];
             if (!value?.trim() || value.startsWith("--"))
               throw new Error(usage2);
@@ -3327,6 +4052,14 @@ async function main(args = process.argv.slice(2), options = {}) {
               if (cwd !== undefined || !isAbsolute(value))
                 throw new Error(usage2);
               cwd = value;
+            } else if (arg === "--repo") {
+              if (repo !== undefined)
+                throw new Error(usage2);
+              repo = value;
+            } else if (arg === "--base") {
+              if (base !== undefined)
+                throw new Error(usage2);
+              base = value;
             } else {
               if (model !== undefined)
                 throw new Error(`${usage2}
@@ -3343,7 +4076,7 @@ async function main(args = process.argv.slice(2), options = {}) {
         const text = textParts.join(" ").trim();
         if (!name || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name) || !text)
           throw new Error(usage2);
-        const client = await GajaewayClient.connectSocket(parsed.socket, {
+        const client = await connectGatewaySocket(parsed.socket, {
           requestTimeoutMs: command === "run" ? 3600000 : 120000
         });
         try {
@@ -3352,6 +4085,8 @@ async function main(args = process.argv.slice(2), options = {}) {
             name,
             text,
             ...cwd ? { cwd } : {},
+            ...repo ? { repo } : {},
+            ...base ? { base } : {},
             ...resume ? { resume: true } : {},
             ...model === undefined ? {} : { model },
             ...callerSessionId ? { callerSessionId } : {}
@@ -3430,10 +4165,11 @@ export {
   main,
   parseArgs,
   parseServicesArgs,
+  pollMemoryOp,
   renderCycle,
-  restoreDatabase,
-  restoreTargetPath,
+  renderDeliveries,
+  renderSlo,
+  sloExitCode,
   socketPath,
-  usageFor,
-  verifyBackupIntegrity
+  usageFor
 };