@inerrata-corporation/errata 2.0.6-dev.2008 → 2.0.6-dev.2028

package/errata.mjs

@@ -77008,7 +77008,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2008" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2028" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -79337,7 +79337,7 @@ init_identity2();
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync30, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
 
 // src/principle-sync.ts
 init_src5();
@@ -82293,10 +82293,14 @@ function applyStopRequest(profile, now = () => /* @__PURE__ */ new Date()) {
     }
   };
 }
-async function startHistoryStage(root, profile, client, walk10 = {}) {
+async function startHistoryStage(root, input, client, walk10 = {}) {
+  let profile = input;
   if (!profile.projectId) return { started: false, reason: "no-project", profile };
-  const consents = historyConsents(profile);
   const response = await reportHistoryStage(client, profile);
+  if (response?.consents && walk10.applyConsents) {
+    profile = walk10.applyConsents(profile, response.consents);
+  }
+  const consents = historyConsents(profile);
   if (response?.stopRequested && profile.historyStage && profile.historyStage.state !== "refused") {
     const stopped = applyStopRequest(profile);
     await reportHistoryStage(client, stopped);
@@ -82307,1197 +82311,1610 @@ async function startHistoryStage(root, profile, client, walk10 = {}) {
   return { started: true, profile: outcome.profile };
 }
 
-// src/multi.ts
-init_registry();
+// src/link-flow.ts
+init_cloud_auth();
+import { createHash as createHash15 } from "node:crypto";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync29, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join34 } from "node:path";
 
-// src/adopt.ts
-init_git_remote();
-import { existsSync as existsSync29 } from "node:fs";
-import { dirname as dirname12, join as join34 } from "node:path";
-function findGitRoot(absPath) {
-  let dir = absPath;
-  for (let depth = 0; depth < 64; depth++) {
-    if (existsSync29(join34(dir, ".git"))) return dir;
-    const parent = dirname12(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
-}
-var RETRY_COOLDOWN_MS = 15 * 6e4;
-function createRootAdopter(deps) {
-  const attempted = /* @__PURE__ */ new Map();
-  let chain2 = Promise.resolve();
-  const tryAdopt = async (path2) => {
-    if (!deps.linkingAllowed()) return;
-    const root = findGitRoot(path2);
-    if (!root || deps.isKnownRoot(root)) return;
-    const last = attempted.get(root);
-    const now = Date.now();
-    if (last !== void 0 && now - last < RETRY_COOLDOWN_MS) return;
-    attempted.set(root, now);
-    if (!resolveGitDir(root)) return;
-    const locator = detectRepoLocator(root);
-    if (!locator) return;
-    const claimed = await deps.lookup(locator);
-    if (!claimed) return;
-    await deps.adopt(root);
-    deps.log(`[errata] adopted ${root} \u2014 ${locator} is claimed by your org (project ${claimed.id})`);
-  };
+// src/oauth-login.ts
+init_src7();
+init_cloud_auth();
+import { createServer } from "node:http";
+var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
+var strip = (u) => u.replace(/\/+$/, "");
+function deviceEndpoints(tokenEndpoint) {
+  const token = new URL(tokenEndpoint);
+  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
+  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
+  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
+  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
   return {
-    noteMiss(path2) {
-      if (!path2) return;
-      chain2 = chain2.then(() => tryAdopt(path2)).catch(() => void 0);
-    },
-    idle: () => chain2
+    code: at(`${prefix}/api/auth/device/code`),
+    token: at(`${prefix}/api/auth/device/token`),
+    resource: at(`${prefix}/api/gate/session-token`)
   };
 }
-
-// src/health-sentinel.ts
-function numEnv4(key, fallback) {
-  const n = Number(process.env[key]);
-  return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-var SENTINEL_TICK_MS = numEnv4("ERRATA_SENTINEL_TICK_MS", 3e4);
-var SENTINEL_WINDOW_TICKS = numEnv4("ERRATA_SENTINEL_WINDOW_TICKS", 6);
-var SENTINEL_BURN_CORES = numEnv4("ERRATA_SENTINEL_BURN_CORES", 1.2);
-var SENTINEL_STORM_RATE = numEnv4("ERRATA_SENTINEL_STORM_RATE", 1e3);
-var SENTINEL_STORM_TICKS = numEnv4("ERRATA_SENTINEL_STORM_TICKS", 4);
-var SENTINEL_RENOTIFY_MS = numEnv4("ERRATA_SENTINEL_RENOTIFY_MS", 18e5);
-var SENTINEL_CALM_TICKS = numEnv4("ERRATA_SENTINEL_CALM_TICKS", 2);
-var SENTINEL_TOAST_COOLDOWN_MS = numEnv4("ERRATA_SENTINEL_TOAST_COOLDOWN_MS", 6e5);
-function createHealthSentinel(deps = {}) {
-  const now = deps.now ?? Date.now;
-  const cpuUsage = deps.cpuUsage ?? (() => process.cpuUsage());
-  const readCensus = deps.readCensus ?? (() => {
-    const c = watchCensus();
-    return {
-      dispatched: c.dispatched,
-      logged: c.logged,
-      topOffender: c.topOffender ? { path: c.topOffender.path, count: c.topOffender.count } : null
-    };
+async function loginOAuthDevice(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope })
   });
-  const activePasses = deps.activePasses ?? (() => passState().active.map((p) => p.name));
-  const rssMb = deps.rssMb ?? (() => Math.round(process.memoryUsage.rss() / 1048576));
-  const toast = deps.notify ?? ((body2, key) => notifyOpsEvent("daemon-distress", body2, { key }));
-  let prevCpu = cpuUsage();
-  let prevTs = now();
-  let prevDispatched = null;
-  let prevLogged = 0;
-  const coreSamples = [];
-  let stormTicks = 0;
-  let calmTicks = 0;
-  let distress = null;
-  let lastNotifiedAt = 0;
-  const lastToastByKind = /* @__PURE__ */ new Map();
-  const attribution = () => {
-    const parts2 = [];
-    const passes = activePasses();
-    if (passes.length > 0) parts2.push(`active pass: ${passes.join(", ")}`);
-    const c = readCensus();
-    if (c.topOffender) parts2.push(`hottest watch path: ${c.topOffender.path}`);
-    parts2.push(`rss ${rssMb()}MB`);
-    return parts2.join(" \xB7 ");
-  };
-  const maybeToast = (d, t) => {
-    if (t - (lastToastByKind.get(d.kind) ?? 0) < SENTINEL_TOAST_COOLDOWN_MS) return;
-    lastToastByKind.set(d.kind, t);
-    toast(d.headline, d.kind);
-    lastNotifiedAt = t;
-  };
-  const transition = (next) => {
-    const t = now();
-    if (next && !distress) {
-      distress = next;
-      deps.ledger?.("enter", next);
-      maybeToast(next, t);
-      deps.onChange?.(next);
-    } else if (next && distress) {
-      distress.body = next.body;
-      distress.headline = next.headline;
-      if (t - lastNotifiedAt >= SENTINEL_RENOTIFY_MS) maybeToast(distress, t);
-    } else if (!next && distress) {
-      deps.ledger?.("clear", distress);
-      distress = null;
-      deps.onChange?.(null);
-    }
-  };
-  const evaluate = () => {
-    const t = now();
-    const wallMs = Math.max(1, t - prevTs);
-    const cpu = cpuUsage();
-    const cores = (cpu.user + cpu.system - prevCpu.user - prevCpu.system) / 1e3 / wallMs;
-    prevCpu = cpu;
-    prevTs = t;
-    coreSamples.push(cores);
-    if (coreSamples.length > SENTINEL_WINDOW_TICKS) coreSamples.shift();
-    const c = readCensus();
-    const dispatchRate = prevDispatched === null ? 0 : (c.dispatched - prevDispatched) / wallMs * 1e3;
-    const survived = c.logged - prevLogged;
-    prevDispatched = c.dispatched;
-    prevLogged = c.logged;
-    stormTicks = dispatchRate > SENTINEL_STORM_RATE && survived === 0 ? stormTicks + 1 : 0;
-    let wanted = null;
-    if (stormTicks >= SENTINEL_STORM_TICKS) {
-      wanted = {
-        kind: "watch-storm",
-        headline: `errata's file watcher is stuck busy (~${Math.round(dispatchRate)} events/sec with nothing changing) \u2014 run \`errata status\` for detail`,
-        body: `filesystem watcher is processing ~${Math.round(dispatchRate)} events/sec with NOTHING surviving \u2014 a wedged or ignored-tree watch is burning CPU for no signal \xB7 ${attribution()}`,
-        sinceTs: distress?.kind === "watch-storm" ? distress.sinceTs : t
-      };
-    } else {
-      const windowFull = coreSamples.length >= SENTINEL_WINDOW_TICKS;
-      const avgCores = coreSamples.reduce((a, b) => a + b, 0) / Math.max(1, coreSamples.length);
-      if (windowFull && avgCores >= SENTINEL_BURN_CORES && cores >= SENTINEL_BURN_CORES && activePasses().length === 0) {
-        wanted = {
-          kind: "cpu-burn",
-          headline: `errata is using more CPU than expected (${avgCores.toFixed(1)} cores with no work running) \u2014 run \`errata status\` for detail`,
-          body: `sustained CPU with no pass running \u2014 avg ${avgCores.toFixed(1)} cores \xB7 ${attribution()}`,
-          sinceTs: distress?.kind === "cpu-burn" ? distress.sinceTs : t
-        };
+  if (!codeResponse.ok) {
+    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
+  }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("device authorization returned an incomplete response");
+  }
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  let deviceSession = null;
+  let approvedInstallation = null;
+  while (Date.now() < deadline) {
+    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
       }
+      throw new Error(`device authorization failed: ${error48}`);
     }
-    if (wanted) {
-      calmTicks = 0;
-      transition(wanted);
-    } else if (distress) {
-      calmTicks++;
-      if (calmTicks >= SENTINEL_CALM_TICKS) {
-        calmTicks = 0;
-        transition(null);
-      }
-    }
-  };
-  const interval = deps.scheduleTicks === false ? null : setInterval(() => {
-    try {
-      evaluate();
-    } catch {
-    }
-  }, SENTINEL_TICK_MS);
-  interval?.unref?.();
-  return {
-    current: () => distress ? { ...distress } : null,
-    tick: evaluate,
-    stop: () => {
-      if (interval) clearInterval(interval);
+    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
+    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
+    break;
+  }
+  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
+  if (approvedInstallation !== opts.installationId) {
+    throw new Error("approved installation does not match the terminal request");
+  }
+  const resourceResponse = await fetchFn(device.resource, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${deviceSession}`,
+      "content-type": "application/json",
+      accept: "application/json"
+    },
+    body: JSON.stringify({
+      installationId: approvedInstallation,
+      clientId,
+      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
+    })
+  });
+  const resource = await resourceResponse.json().catch(() => null);
+  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
+    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
+  }
+  return {
+    installationId: approvedInstallation,
+    clientId,
+    tokenEndpoint: device.resource,
+    tokens: {
+      accessToken: resource["access_token"],
+      refreshToken: deviceSession,
+      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
     }
   };
 }
-
-// src/codex-wake.ts
-var CODEX_WAKE_LOOKBACK_MS = 10 * 6e4;
-var CODEX_WAKE_BOOT_LOOKBACK_MS = 24 * 60 * 6e4;
-function codexWakeCandidates(input) {
-  if (input.disabled) return [];
-  const find = input.find ?? ((cwd, since) => codexRolloutsForCwd(cwd, { sinceMs: since, limit: 1 }).length + geminiTranscriptsForCwd(cwd, { sinceMs: since, limit: 1 }).length + opencodeTranscriptsForCwd(cwd, { sinceMs: since, limit: 1 }).length);
-  const out2 = [];
-  for (const entry of input.entries) {
-    if (input.liveRoots.has(input.normPath(entry.path))) continue;
-    let n = 0;
-    try {
-      n = find(entry.path, input.sinceMs);
-    } catch {
-      continue;
+async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
+  let consoleUrl = cloudUrl;
+  try {
+    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
+    if (prm.ok) {
+      const j = await prm.json();
+      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
     }
-    if (n > 0) out2.push({ name: entry.name, path: entry.path });
+  } catch {
   }
-  return out2;
-}
-
-// src/multi.ts
-var projectSymbolSalts = /* @__PURE__ */ new Map();
-async function resolveProjectSymbolSalt(client, projectId) {
-  const cached2 = projectSymbolSalts.get(projectId);
-  if (cached2) return { projectId, salt: cached2 };
-  const { salt } = await client.projectSymbolSalt(projectId);
-  projectSymbolSalts.set(projectId, salt);
-  return { projectId, salt };
-}
-function normPath(p) {
-  return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
-}
-function contextKey(p) {
-  return `${[...p.stack].sort().join(",")}|${p.domains[0] ?? p.languages[0] ?? "?"}`;
-}
-function pickOwnerRoot(roots, absPath) {
-  if (!absPath) return null;
-  const n = normPath(absPath);
-  let best = null;
-  let bestLen = -1;
-  for (const root of roots) {
-    const r = normPath(root);
-    if ((n === r || n.startsWith(r + "/")) && r.length > bestLen) {
-      best = root;
-      bestLen = r.length;
+  try {
+    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
+    if (asm.ok) {
+      const j = await asm.json();
+      if (j.authorization_endpoint && j.token_endpoint) {
+        return {
+          authorizationEndpoint: j.authorization_endpoint,
+          tokenEndpoint: j.token_endpoint,
+          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
+        };
+      }
     }
+  } catch {
   }
-  return best;
+  const base = strip(consoleUrl);
+  return {
+    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
+    tokenEndpoint: `${base}/api/auth/oauth2/token`
+  };
 }
-function ownerOf(records, absPath) {
-  const root = pickOwnerRoot(records.map((r) => r.root), absPath);
-  return root == null ? null : records.find((r) => r.root === root) ?? null;
+function buildAuthorizeUrl(endpoint, p) {
+  const u = new URL(endpoint);
+  u.searchParams.set("response_type", "code");
+  u.searchParams.set("client_id", p.clientId);
+  u.searchParams.set("redirect_uri", p.redirectUri);
+  u.searchParams.set("scope", p.scope);
+  u.searchParams.set("state", p.state);
+  u.searchParams.set("code_challenge", p.challenge);
+  u.searchParams.set("code_challenge_method", p.method);
+  return u.toString();
 }
-async function startMultiDaemon(opts = {}) {
-  const lockPath = globalDaemonLock();
-  if (opts.enforceSingleton !== false && isDaemonAlive(lockPath)) {
-    throw new Error(
-      `an errata daemon is already running (lock: ${lockPath}). Run \`errata stop\` first, or attach to the running one.`
-    );
-  }
-  const cfg = loadConfig();
-  const CLOUD_TIMEOUT_MS = 12e4;
-  const initialCloudUrl = normalizeCloudUrl(opts.cloudUrl ?? cfg.cloudUrl);
-  const initialCfg = { ...cfg, cloudUrl: initialCloudUrl };
-  if (opts.apiKey) {
-    initialCfg.apiKey = opts.apiKey;
-    initialCfg.accessToken = null;
-    initialCfg.refreshToken = null;
-    initialCfg.tokenEndpoint = null;
-    initialCfg.oauthClientId = null;
-  }
-  const cloud = authedCloudClient(initialCfg, { timeoutMs: CLOUD_TIMEOUT_MS, daemonVersion: DAEMON_VERSION });
-  const cloudNow = () => {
-    const c = loadConfig();
-    const baseUrl2 = normalizeCloudUrl(opts.cloudUrl ?? c.cloudUrl);
-    const current = { ...c, cloudUrl: baseUrl2 };
-    if (opts.apiKey) {
-      current.apiKey = opts.apiKey;
-      current.accessToken = null;
-      current.refreshToken = null;
-      current.tokenEndpoint = null;
-      current.oauthClientId = null;
-    }
-    return authedCloudClient(current, { timeoutMs: CLOUD_TIMEOUT_MS, daemonVersion: DAEMON_VERSION });
-  };
-  const identityFor = (entry) => {
-    if (opts.apiKey) {
-      return {
-        profileName: null,
-        profile: null,
-        rule: "env-config-path",
-        invalid: false,
-        reason: "daemon started with an explicit --api-key (process-pinned)"
-      };
-    }
-    return resolveWorkspaceIdentity(loadConfig(), entry);
-  };
-  const identityBlocks = /* @__PURE__ */ new Map();
-  const noteIdentityBlock = (wsId, wsName, identity) => {
-    if (!identityBlocks.has(wsId)) {
-      identityBlocks.set(wsId, {
-        workspace: wsName,
-        profileName: identity.profileName,
-        reason: identity.reason,
-        since: Date.now()
+async function loginOAuthLoopback(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const pkce = generatePkce();
+  const state = randomState();
+  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
+  const { code, redirectUri, clientId } = await new Promise(
+    (resolve7, reject) => {
+      const server = createServer((req, res) => {
+        const u = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (u.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const addr2 = server.address();
+        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+        const err2 = u.searchParams.get("error");
+        const code2 = u.searchParams.get("code");
+        const returnedState = u.searchParams.get("state");
+        if (err2 || !code2 || returnedState !== state) {
+          res.writeHead(400, { "content-type": "text/plain" });
+          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
+          server.close();
+          reject(new Error(err2 ?? "invalid_callback"));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html" });
+        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
+        server.close();
+        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
       });
-      console.error(`[identity] HOLDING cloud traffic for workspace "${wsName}": ${identity.reason}`);
-    }
-  };
-  const clearIdentityBlock = (wsId) => {
-    if (identityBlocks.delete(wsId)) console.log(`[identity] workspace unblocked \u2014 spooled capture drains on this pass`);
-  };
-  const projectHolds = /* @__PURE__ */ new Map();
-  const noteProjectHold = (wsId, wsName, reason) => {
-    if (!projectHolds.has(wsId)) {
-      projectHolds.set(wsId, { workspace: wsName, reason, since: Date.now() });
-      console.error(
-        `[project] HOLDING cloud push for workspace "${wsName}": cannot prove its project \u2014 ${reason}. Shipping without the assertion would publish project-scoped knowledge to the whole org; the batch stays pending instead.`
-      );
-    }
-  };
-  const clearProjectHold = (wsId) => {
-    if (projectHolds.delete(wsId)) console.log(`[project] project assertion restored \u2014 held contributions drain on this pass`);
-  };
-  const cloudForIdentity = (identity) => {
-    if (identity.invalid) return blockedCloudClient(identity.reason);
-    if (identity.rule === "workspace-binding" && identity.profileName) {
-      return authedCloudClientForProfile(loadConfig(), identity.profileName, {
-        timeoutMs: CLOUD_TIMEOUT_MS,
-        daemonVersion: DAEMON_VERSION
+      let activeClientId = oauthClientId();
+      server.on("error", reject);
+      server.listen(0, "127.0.0.1", () => {
+        void (async () => {
+          try {
+            const addr2 = server.address();
+            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
+            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
+            if (endpoints.registrationEndpoint) {
+              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
+                redirectUri: redirectUri2,
+                scope,
+                clientName: "errata daemon"
+              });
+              activeClientId = registered.clientId;
+            }
+            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
+              clientId: activeClientId,
+              redirectUri: redirectUri2,
+              scope,
+              state,
+              challenge: pkce.challenge,
+              method: pkce.method
+            });
+            if (opts.open) opts.open(url2);
+            else console.log(`approve this login in your browser:
+  ${url2}`);
+          } catch (err2) {
+            server.close();
+            reject(err2);
+          }
+        })();
       });
-    }
-    return cloudNow();
-  };
-  const sharedDbPath = sharedStorePath();
-  ensureParent(sharedDbPath);
-  const sharedStore = openGraphStore({ path: sharedDbPath });
-  const bundledRun = import.meta.url.endsWith(".mjs");
-  const consolidateWorker = bundledRun && sharedDbPath !== ":memory:" ? new ConsolidateWorker() : null;
-  startLoopLagMonitor();
-  let baseUrl = "";
-  const records = [];
-  const mountedIds = /* @__PURE__ */ new Set();
-  const machineDominantLanguage = () => {
-    const langCounts = /* @__PURE__ */ new Map();
-    for (const r of records) {
-      for (const l of r.engine.profile.languages ?? []) {
-        const k = String(l).trim().toLowerCase();
-        if (k) langCounts.set(k, (langCounts.get(k) ?? 0) + 1);
-      }
-    }
-    return [...langCounts.entries()].sort(
-      (a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)
-    )[0]?.[0];
-  };
-  const updatePoller = opts.updateCheck ? startUpdatePoller({
-    channel: loadConfig().updateChannel,
-    onChange: (pending) => {
-      if (pending) {
-        console.log(`\u26A1 errata update available: ${pending.current} \u2192 ${pending.latest} \u2014 run: errata update`);
-      }
-      for (const r of records) r.engine.markContextDirty();
-    }
-  }) : null;
-  const healthSentinel = createHealthSentinel({
-    onChange: () => {
-      for (const r of records) r.engine.markContextDirty();
-    },
-    ledger: (event, d) => {
-      const dir = records[0]?.engine.paths.configDir;
-      if (dir) {
-        appendPassLedger(dir, "health-sentinel", 0, {
-          [`distress:${event}:${d.kind}`]: 1,
-          distressSinceTs: d.sinceTs
-        });
+      if (opts.timeoutMs) {
+        setTimeout(() => {
+          server.close();
+          reject(new Error("login timed out \u2014 run `errata login` again"));
+        }, opts.timeoutMs).unref?.();
       }
     }
+  );
+  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
+    code,
+    codeVerifier: pkce.verifier,
+    redirectUri,
+    clientId
   });
-  let serverPending = null;
-  const boundaryListeners = [];
-  let boundaryFlushing = false;
-  let settleRunning = false;
-  let boundaryFlushStartedAt = 0;
-  let boundaryFlushStage = "";
-  let boundaryFlushUnits = 0;
-  let boundaryFlushLastAdvanceAt = 0;
-  let boundaryFlushBatches = 0;
-  const beginFlush = (stage2) => {
-    boundaryFlushing = true;
-    boundaryFlushStartedAt = Date.now();
-    boundaryFlushLastAdvanceAt = Date.now();
-    boundaryFlushUnits = 0;
-    boundaryFlushBatches = 0;
-    boundaryFlushItems = 0;
-    boundaryFlushDetail = "";
-    boundaryFlushStage = stage2;
-  };
-  const flushStage = (stage2) => {
-    boundaryFlushStage = stage2;
-  };
-  let boundaryFlushItems = 0;
-  let boundaryFlushDetail = "";
-  const noteFlushProgress = (units, items = 0, detail = "") => {
-    boundaryFlushBatches++;
-    boundaryFlushUnits += Math.max(0, units);
-    boundaryFlushItems += Math.max(0, items);
-    if (detail) boundaryFlushDetail = detail;
-    if (units > 0 || items > 0) boundaryFlushLastAdvanceAt = Date.now();
+  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+}
+
+// src/link-flow.ts
+function remoteFingerprint(locator) {
+  return createHash15("sha256").update(locator).digest("hex");
+}
+function isDecision(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
+}
+async function linkThroughConsole(opts) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
+  const device = deviceEndpoints(endpoints.tokenEndpoint);
+  const clientId = oauthClientId();
+  const link = {
+    locator: opts.facts.locator,
+    remoteFingerprint: remoteFingerprint(opts.facts.locator),
+    ...opts.facts.name ? { name: opts.facts.name } : {},
+    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
+    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
+    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
+    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
   };
-  const flushSnapshot = () => ({
-    running: boundaryFlushing,
-    stage: boundaryFlushStage,
-    detail: boundaryFlushDetail,
-    ageMs: boundaryFlushStartedAt ? Date.now() - boundaryFlushStartedAt : 0,
-    units: boundaryFlushUnits,
-    items: boundaryFlushItems,
-    chunks: boundaryFlushBatches,
-    stalledMs: boundaryFlushLastAdvanceAt ? Date.now() - boundaryFlushLastAdvanceAt : 0,
-    // Held workspaces, so a hold is REPORTABLE and not merely logged once at the
-    // transition. `errata status` reads this rather than the on-disk profile:
-    // the profile records what the workspace INTENDS to assert, which is why
-    // status could print "→ project 019f462d" for hours while every batch was
-    // being held or shipped unlinked. A hold is the daemon's actual behavior.
-    holds: [
-      ...[...projectHolds.values()].map((h) => ({
-        workspace: h.workspace,
-        kind: "project",
-        reason: h.reason,
-        sinceMs: Date.now() - h.since
-      })),
-      ...[...identityBlocks.values()].map((h) => ({
-        workspace: h.workspace,
-        kind: "identity",
-        reason: h.reason,
-        sinceMs: Date.now() - h.since
-      }))
-    ]
+  const codeResponse = await fetchFn(device.code, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
   });
-  const endFlush = () => {
-    boundaryFlushing = false;
-    boundaryFlushStage = "";
-  };
-  const fireBoundary = () => {
-    for (const l of boundaryListeners) {
-      try {
-        l();
-      } catch {
-      }
-    }
-  };
-  const buildRecord = (entry) => {
-    const id = entry.id;
-    const wsIdentity = identityFor(entry);
-    let wsCloud = cloud;
-    if (wsIdentity.rule === "workspace-binding") {
-      if (wsIdentity.invalid) {
-        noteIdentityBlock(entry.id, entry.name, wsIdentity);
-        wsCloud = blockedCloudClient(wsIdentity.reason);
-      } else {
-        wsCloud = authedCloudClientForProfile(loadConfig(), wsIdentity.profileName, {
-          timeoutMs: CLOUD_TIMEOUT_MS,
-          daemonVersion: DAEMON_VERSION
-        });
-        console.log(`[identity] workspace "${entry.name}" bound \u2192 profile "${wsIdentity.profileName}"`);
-      }
+  if (!codeResponse.ok) {
+    const text = (await codeResponse.text()).slice(0, 200);
+    if (codeResponse.status === 404) {
+      throw new Error("this console does not offer the link flow yet (device authorization is off)");
     }
-    const engine = createWorkspaceEngine({
-      workspaceRoot: entry.path,
-      cloud: wsCloud,
-      apiKey: opts.apiKey,
-      reviewUrl: () => `${baseUrl}/ws/${id}/review`,
-      sharedStore,
-      pendingUpdate: () => serverPending ?? updatePoller?.current() ?? null,
-      // Ops-gated (default OFF): the 🚨 notice reads as "errata broke my
-      // machine" to a non-operator. Detection + ledger run regardless — only
-      // this push surface (and the toast, gated in notifyOpsEvent) is scoped.
-      daemonDistress: () => loadConfig().opsNotices ? healthSentinel.current() : null,
-      ...opts.skipWatchers ? { skipWatchers: true } : {}
-    });
-    const webApp = buildWebUi({
-      paths: engine.paths,
-      store: engine.store,
-      log: engine.log,
-      profile: engine.profile,
-      daemonVersion: DAEMON_VERSION,
-      basePath: `/ws/${id}`,
-      onWorkingFileChanged: engine.webHooks.onWorkingFileChanged,
-      onHook: engine.webHooks.onHook,
-      onHookEvent: engine.webHooks.onHookEvent,
-      onShellEvent: engine.webHooks.onShellEvent,
-      // The tool-run RECORD seam (SP-tool-ground). The single-engine path wired
-      // this in #1172; this sibling builder never did, so on every multi
-      // deployment (i.e. every real one) the webui logged "tool-run recorded"
-      // and dropped the record on the floor — toolSessionsTracked read 0 across
-      // 936 turns while the log showed records landing (VS-corroboration-rate).
-      onToolsObserved: engine.webHooks.onToolsObserved,
-      onToolError: engine.webHooks.onToolError,
-      onDiagnostics: engine.webHooks.onDiagnostics,
-      onTurn: engine.webHooks.onTurn,
-      onMessage: engine.webHooks.onMessage,
-      onSessionEnd: (e) => {
-        engine.webHooks.onSessionEnd(e);
-        fireBoundary();
-      }
-    });
-    return { entry, engine, webApp, root: entry.path, id, lastHookAt: Date.now() };
-  };
-  const pruned = pruneMissingWorkspaces();
-  if (pruned.length > 0) {
-    console.log(`[errata] pruned ${pruned.length} registered workspace(s) whose path no longer exists`);
+    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
   }
-  if (registryCorrupt()) {
-    console.error("[identity] workspaces.json is UNREADABLE \u2014 all per-workspace cloud push will hold until it parses (fail-closed)");
-  } else {
-    for (const b of boundWorkspaceEntries()) {
-      console.log(`[identity] bound workspace: ${b.name} \u2192 profile "${b.installationProfile}"`);
-    }
+  const code = await codeResponse.json();
+  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
+    throw new Error("link request returned an incomplete response");
   }
-  const entries = listWorkspaceEntries();
-  if (opts.eagerWorkspaces ?? EAGER_WORKSPACES_AT_BOOT) {
-    for (const entry of entries) {
-      try {
-        records.push(buildRecord(entry));
-      } catch (err2) {
-        console.warn(`[errata] skipping ${entry.name} (${entry.path}): ${err2 instanceof Error ? err2.message : err2}`);
+  opts.onVerification?.({
+    url: code.verification_uri_complete ?? code.verification_uri,
+    userCode: code.user_code,
+    expiresInSec: code.expires_in
+  });
+  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
+  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const poll = await fetchFn(device.token, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: code.device_code,
+        client_id: clientId
+      })
+    });
+    const payload = await poll.json().catch(() => null);
+    if (!poll.ok) {
+      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
+      if (error48 === "authorization_pending") continue;
+      if (error48 === "slow_down") {
+        intervalMs += 5e3;
+        continue;
       }
+      if (error48 === "access_denied") return { status: "denied" };
+      if (error48 === "expired_token") return { status: "expired" };
+      throw new Error(`link approval failed: ${error48}`);
     }
-    if (entries.length > 0 && records.length < entries.length) {
-      const failed = entries.length - records.length;
-      console.warn(
-        `[errata] \u26A0 ${failed} of ${entries.length} project(s) failed to start \u2014 likely a stale daemon holding DB locks. Run \`errata stop\` (or kill the old errata process) and retry.`
-      );
+    const decision = payload?.["link"];
+    if (!isDecision(decision)) {
+      throw new Error("the console approved the device but returned no link decision");
     }
-  } else if (entries.length > 0) {
-    console.log(
-      `[errata] ${entries.length} workspace(s) registered \xB7 cold \u2014 an engine spawns on the first hook from each`
-    );
+    return {
+      status: "approved",
+      decision,
+      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
+    };
   }
-  const app = new Hono2();
-  const attachWorkspace = (root) => {
-    const norm = normPath(root);
-    if (records.some((r) => normPath(r.root) === norm)) return { attached: false, id: null, reason: "already-watched" };
-    const entry = listWorkspaceEntries().find((e) => normPath(e.path) === norm);
-    if (!entry) return { attached: false, id: null, reason: "not-registered" };
-    let rec;
-    try {
-      rec = buildRecord(entry);
-    } catch (err2) {
-      return { attached: false, id: null, reason: err2 instanceof Error ? err2.message : "build-failed" };
-    }
-    records.push(rec);
-    void ambientLinkAll();
+  return { status: "expired" };
+}
+function collectRepoFacts(root) {
+  const git3 = (args2) => {
     try {
-      writeFileSync22(
-        rec.engine.paths.daemonLock,
-        JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${rec.id}`, startedAt: Date.now() }),
-        "utf8"
-      );
-      registerWorkspace(rec.engine.profile, rec.root);
+      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     } catch {
+      return null;
     }
-    void rec.engine.reindex({ skipEmbed: true, quiet: rec.engine.store.nodeCount() > 0 }).catch(() => {
-    });
-    console.log(`[errata] hot-registered ${rec.entry.name} (${rec.id}) \u2014 now watching live`);
-    return { attached: true, id: rec.id };
   };
-  app.post("/api/attach", async (c) => {
-    let body2 = {};
-    try {
-      body2 = await c.req.json();
-    } catch {
-      return c.json({ error: "bad-json" }, 400);
-    }
-    const root = typeof body2["path"] === "string" ? body2["path"] : null;
-    if (!root) return c.json({ error: "path-required" }, 400);
-    return c.json(attachWorkspace(root));
-  });
-  app.post("/api/notify-test", (c) => {
-    notify("Errata \xB7 test", "Fired from the daemon \u2014 if you see this, daemon toasts render.");
-    return c.json({ ok: true });
-  });
-  app.get(
-    "/",
-    (c) => c.json({
-      daemonVersion: DAEMON_VERSION,
-      pendingUpdate: updatePoller?.current() ?? null,
-      projects: records.map((r) => ({
-        id: r.id,
-        name: r.entry.name,
-        path: r.root,
-        stack: r.entry.stack,
-        nodes: r.engine.store.nodeCount(),
-        // COUNT(*) — the materializing findNodesByLabel(...).length form held
-        // the event loop for seconds per poll once stores grew (HZ-index-hydrate).
-        problems: r.engine.store.countNodesByLabel("Problem"),
-        solutions: r.engine.store.countNodesByLabel("Solution"),
-        endpoints: `/ws/${r.id}/`
-      })),
-      humanView: "run `errata report` \u2014 the dashboard was retired (GRAFT 4e)"
-    })
-  );
-  const STRANDED_TTL_MS = 6e4;
-  const strandedCache = /* @__PURE__ */ new Map();
-  const strandedRefreshing = /* @__PURE__ */ new Set();
-  const strandedCount = (r) => {
-    const hit = strandedCache.get(r.id);
-    if (hit && Date.now() - hit.at < STRANDED_TTL_MS) return hit.count;
-    if (!strandedRefreshing.has(r.id)) {
-      strandedRefreshing.add(r.id);
-      const finish = (count) => {
-        strandedCache.set(r.id, { at: Date.now(), count });
-        strandedRefreshing.delete(r.id);
-      };
-      if (consolidateWorker && r.engine.paths.castalia !== ":memory:") {
-        consolidateWorker.run({ kind: "strandedCount", sharedDbPath, castaliaPath: r.engine.paths.castalia }).then((n) => finish(Number(n))).catch(() => {
-          setImmediate(() => {
-            const done = markPass(`stranded-scan:${r.entry.name}`);
-            try {
-              finish(findStrandedSymbols(r.engine.store).length);
-            } catch {
-              strandedRefreshing.delete(r.id);
-            } finally {
-              done();
-            }
-          });
-        });
-      } else {
-        setImmediate(() => {
-          const done = markPass(`stranded-scan:${r.entry.name}`);
-          try {
-            finish(findStrandedSymbols(r.engine.store).length);
-          } catch {
-            strandedRefreshing.delete(r.id);
-          } finally {
-            done();
-          }
-        });
-      }
-    }
-    return hit?.count ?? -1;
+  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
+  const count = git3(["rev-list", "--count", "HEAD"]);
+  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
+  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
+  return {
+    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
+    ...typeof commitCount === "number" ? { commitCount } : {}
   };
-  let lastHook = null;
-  app.get(
-    "/health",
-    (c) => c.json({
-      ok: true,
-      daemonVersion: DAEMON_VERSION,
-      lastHook,
-      // What the daemon is DOING, not just what it holds. Without these a
-      // pegged daemon is only diagnosable by attaching a CPU profiler to the
-      // live process — see watch-census.ts for the incident that proved it.
-      pass: passState(),
-      watch: watchCensus(),
-      // Registered but with no engine running (WS-cold-start). Listed so a cold
-      // daemon is legible as "nothing has needed waking yet" rather than as
-      // "the registry lost my projects" — an invisible cold workspace is
-      // indistinguishable from a missing one, and only one of those is fine.
-      cold: listWorkspaceEntries().filter((e) => !records.some((r) => normPath(r.root) === normPath(e.path))).map((e) => ({ name: e.name, path: e.path })),
-      projects: records.map((r) => ({
-        id: r.id,
-        name: r.entry.name,
-        path: r.root,
-        nodes: r.engine.store.nodeCount(),
-        // COUNT(*) — same hydration hazard as `/` (HZ-index-hydrate).
-        problems: r.engine.store.countNodesByLabel("Problem"),
-        solutions: r.engine.store.countNodesByLabel("Solution"),
-        stranded: strandedCount(r)
-      }))
-    })
-  );
-  const forward = async (c, pathInBody) => {
-    const raw2 = await c.req.text();
-    let body2 = {};
-    try {
-      body2 = JSON.parse(raw2);
-    } catch {
-      return c.json({ error: "bad-json" }, 400);
-    }
-    lastHook = { at: Date.now(), event: typeof body2["hook_event_name"] === "string" ? body2["hook_event_name"] : c.req.path };
-    let owner = ownerOf(records, pathInBody(body2));
-    if (!owner) {
-      const missPath = pathInBody(body2);
-      const registeredRoot = missPath ? pickOwnerRoot(listWorkspaceEntries().map((e) => e.path), missPath) : null;
-      const wakeRoot = registeredRoot ?? (missPath ? findGitRoot(missPath) : null);
-      if (wakeRoot && attachWorkspace(wakeRoot).attached) {
-        owner = ownerOf(records, missPath) ?? null;
-        if (owner) console.log(`[errata] woke workspace ${owner.entry.name}`);
-      }
-    }
-    if (!owner) {
-      rootAdopter.noteMiss(pathInBody(body2));
-      return c.json({ error: "no-matching-project" }, 404);
-    }
-    owner.lastHookAt = Date.now();
-    const sub = c.req.path;
-    const done = markPass(`${sub}:${owner.entry.name}`);
-    try {
-      return await owner.webApp.fetch(
-        new Request(`http://local${sub}`, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: raw2
-        })
-      );
-    } finally {
-      done();
+}
+var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
+# Paths, content keywords and tags listed here are dropped from hunks and
+# narrative before anything leaves this machine, and an ignored path yields no
+# symbol anchor at all. Scrubbing is best effort; this list is absolute.
+# A personal list can only add to the organization's list, never weaken it.
+
+# secrets and environment
+.env
+.env.*
+*.pem
+*.key
+*.p12
+secrets/
+credentials*
+
+# fixtures and captured data
+fixtures/
+**/testdata/
+*.dump
+*.sql.gz
+`;
+function applyConsents(profile, config2, c, decidedAt, now = Date.now) {
+  const nextConfig = {
+    ...config2,
+    consent: {
+      ...config2.consent,
+      sync: c.sync !== "off",
+      telemetry: c.telemetry,
+      contributePackages: c.packages && c.sync !== "off"
+    },
+    onboardedAt: config2.onboardedAt ?? now()
+  };
+  const nextProfile = {
+    ...profile,
+    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
+    linkConsents: {
+      structure: c.structure,
+      mineHistory: c.mineHistory,
+      contributeHistory: c.contributeHistory && c.mineHistory && c.sync !== "off",
+      decidedAt
     }
   };
-  app.post(
-    "/api/hook",
-    (c) => forward(c, (b) => {
-      const input = b["tool_input"] ?? {};
-      const fp = input["file_path"];
-      const cwd = b["cwd"];
-      return (typeof fp === "string" ? fp : void 0) ?? (typeof cwd === "string" ? cwd : void 0);
-    })
-  );
-  app.post(
-    "/api/diagnostics",
-    (c) => forward(c, (b) => {
-      const loc = b["path"] ?? b["uri"];
-      return typeof loc === "string" ? fileUriToFsPath(loc) : void 0;
-    })
-  );
-  const cwdOf = (b) => typeof b["cwd"] === "string" ? b["cwd"] : void 0;
-  app.post("/api/turn", (c) => forward(c, cwdOf));
-  app.post("/api/message", (c) => forward(c, cwdOf));
-  app.post("/api/session-end", (c) => forward(c, cwdOf));
-  app.post("/api/context-inject", (c) => forward(c, cwdOf));
-  for (const r of records) {
-    mountedIds.add(r.id);
-    app.route(`/ws/${r.id}`, r.webApp);
-  }
-  const dispatchHot = async (c) => {
-    const id = c.req.param("id");
-    const rec = records.find((r) => r.id === id);
-    if (!rec) return c.notFound();
-    const url2 = new URL(c.req.url);
-    url2.pathname = url2.pathname.slice(`/ws/${id}`.length) || "/";
-    const method = c.req.method;
-    const body2 = method === "GET" || method === "HEAD" ? void 0 : await c.req.raw.arrayBuffer();
-    return rec.webApp.fetch(new Request(url2.toString(), { method, headers: c.req.raw.headers, body: body2 }));
+  const prev = profile.linkConsents;
+  const changed = profile.syncConsent !== nextProfile.syncConsent || config2.consent.sync !== nextConfig.consent.sync || config2.consent.telemetry !== nextConfig.consent.telemetry || config2.consent.contributePackages !== nextConfig.consent.contributePackages || !prev || prev.structure !== nextProfile.linkConsents.structure || prev.mineHistory !== nextProfile.linkConsents.mineHistory || prev.contributeHistory !== nextProfile.linkConsents.contributeHistory;
+  return { profile: nextProfile, config: nextConfig, changed };
+}
+function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
+  const applied = applyConsents(profile, config2, decision.consents, decision.approvedAt, now);
+  const nextConfig = applied.config;
+  const nextProfile = {
+    ...applied.profile,
+    projectId: decision.projectId,
+    projectLocator: decision.locator
   };
-  app.all("/ws/:id", dispatchHot);
-  app.all("/ws/:id/*", dispatchHot);
-  const retireWorkspace = async (rec, reason) => {
-    const idx = records.indexOf(rec);
-    if (idx === -1) return;
-    records.splice(idx, 1);
-    try {
-      await rec.engine.stop();
-    } catch (err2) {
-      console.warn(`[errata] retire ${rec.entry.name}: engine.stop failed \u2014 ${err2 instanceof Error ? err2.message : err2}`);
+  delete nextProfile.projectLinkDisabled;
+  let wroteIgnore = false;
+  if (decision.writeIgnoreStarter !== false) {
+    const target = join34(root, ".errataignore");
+    if (!existsSync29(target)) {
+      writeFileSync22(target, IGNORE_STARTER, "utf8");
+      wroteIgnore = true;
     }
-    console.log(
-      `[errata] retired ${rec.entry.name} (${reason})` + (reason === "idle" ? " \u2014 idle; the next hook from it re-attaches" : "")
-    );
-  };
-  const sweepIdleWorkspaces = () => {
+  }
+  return { profile: nextProfile, config: nextConfig, wroteIgnore };
+}
+
+// src/multi.ts
+init_registry();
+
+// src/adopt.ts
+init_git_remote();
+import { existsSync as existsSync30 } from "node:fs";
+import { dirname as dirname12, join as join35 } from "node:path";
+function findGitRoot(absPath) {
+  let dir = absPath;
+  for (let depth = 0; depth < 64; depth++) {
+    if (existsSync30(join35(dir, ".git"))) return dir;
+    const parent = dirname12(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var RETRY_COOLDOWN_MS = 15 * 6e4;
+function createRootAdopter(deps) {
+  const attempted = /* @__PURE__ */ new Map();
+  let chain2 = Promise.resolve();
+  const tryAdopt = async (path2) => {
+    if (!deps.linkingAllowed()) return;
+    const root = findGitRoot(path2);
+    if (!root || deps.isKnownRoot(root)) return;
+    const last = attempted.get(root);
     const now = Date.now();
-    for (const rec of [...records]) {
-      let lastActiveAt = rec.lastHookAt;
-      try {
-        lastActiveAt = Math.max(lastActiveAt, rec.engine.lastActivityAt());
-      } catch {
-      }
-      const reason = retireDecision({ exists: existsSync30(rec.root), lastActiveAt, now });
-      if (reason) void retireWorkspace(rec, reason);
-    }
+    if (last !== void 0 && now - last < RETRY_COOLDOWN_MS) return;
+    attempted.set(root, now);
+    if (!resolveGitDir(root)) return;
+    const locator = detectRepoLocator(root);
+    if (!locator) return;
+    const claimed = await deps.lookup(locator);
+    if (!claimed) return;
+    await deps.adopt(root);
+    deps.log(`[errata] adopted ${root} \u2014 ${locator} is claimed by your org (project ${claimed.id})`);
   };
-  const idleSweep = setInterval(sweepIdleWorkspaces, WORKSPACE_SWEEP_INTERVAL_MS);
-  idleSweep.unref?.();
-  let codexWakeFirstPass = true;
-  const sweepCodexWake = () => {
-    const lookback = codexWakeFirstPass ? CODEX_WAKE_BOOT_LOOKBACK_MS : CODEX_WAKE_LOOKBACK_MS;
-    codexWakeFirstPass = false;
-    let entries2;
-    try {
-      entries2 = listWorkspaceEntries();
-    } catch {
-      return;
-    }
-    const candidates = codexWakeCandidates({
-      entries: entries2,
-      liveRoots: new Set(records.map((r) => normPath(r.root))),
-      normPath,
-      sinceMs: Date.now() - lookback,
-      disabled: process.env["ERRATA_CODEX_WAKE_DISABLE"] === "1"
-    });
-    for (const c of candidates) {
-      if (attachWorkspace(c.path).attached) {
-        console.log(`[errata] woke workspace ${c.name} \u2014 recent Codex/Gemini/OpenCode transcript (headless capture)`);
-      }
-    }
+  return {
+    noteMiss(path2) {
+      if (!path2) return;
+      chain2 = chain2.then(() => tryAdopt(path2)).catch(() => void 0);
+    },
+    idle: () => chain2
   };
-  const codexWake = setInterval(sweepCodexWake, WORKSPACE_SWEEP_INTERVAL_MS);
-  codexWake.unref?.();
-  const codexWakeBoot = setTimeout(sweepCodexWake, 5e3);
-  codexWakeBoot.unref?.();
-  const reindexAll = async (rOpts) => {
-    const out2 = /* @__PURE__ */ new Map();
-    const toIndex = records.filter((r) => rOpts?.force || r.engine.store.nodeCount() === 0);
-    const plural = (n) => `repositor${n === 1 ? "y" : "ies"}`;
-    if (toIndex.length > 0) {
-      notifyEvent("index-started", `Indexing ${toIndex.length} ${plural(toIndex.length)}\u2026`);
+}
+
+// src/health-sentinel.ts
+function numEnv4(key, fallback) {
+  const n = Number(process.env[key]);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+var SENTINEL_TICK_MS = numEnv4("ERRATA_SENTINEL_TICK_MS", 3e4);
+var SENTINEL_WINDOW_TICKS = numEnv4("ERRATA_SENTINEL_WINDOW_TICKS", 6);
+var SENTINEL_BURN_CORES = numEnv4("ERRATA_SENTINEL_BURN_CORES", 1.2);
+var SENTINEL_STORM_RATE = numEnv4("ERRATA_SENTINEL_STORM_RATE", 1e3);
+var SENTINEL_STORM_TICKS = numEnv4("ERRATA_SENTINEL_STORM_TICKS", 4);
+var SENTINEL_RENOTIFY_MS = numEnv4("ERRATA_SENTINEL_RENOTIFY_MS", 18e5);
+var SENTINEL_CALM_TICKS = numEnv4("ERRATA_SENTINEL_CALM_TICKS", 2);
+var SENTINEL_TOAST_COOLDOWN_MS = numEnv4("ERRATA_SENTINEL_TOAST_COOLDOWN_MS", 6e5);
+function createHealthSentinel(deps = {}) {
+  const now = deps.now ?? Date.now;
+  const cpuUsage = deps.cpuUsage ?? (() => process.cpuUsage());
+  const readCensus = deps.readCensus ?? (() => {
+    const c = watchCensus();
+    return {
+      dispatched: c.dispatched,
+      logged: c.logged,
+      topOffender: c.topOffender ? { path: c.topOffender.path, count: c.topOffender.count } : null
+    };
+  });
+  const activePasses = deps.activePasses ?? (() => passState().active.map((p) => p.name));
+  const rssMb = deps.rssMb ?? (() => Math.round(process.memoryUsage.rss() / 1048576));
+  const toast = deps.notify ?? ((body2, key) => notifyOpsEvent("daemon-distress", body2, { key }));
+  let prevCpu = cpuUsage();
+  let prevTs = now();
+  let prevDispatched = null;
+  let prevLogged = 0;
+  const coreSamples = [];
+  let stormTicks = 0;
+  let calmTicks = 0;
+  let distress = null;
+  let lastNotifiedAt = 0;
+  const lastToastByKind = /* @__PURE__ */ new Map();
+  const attribution = () => {
+    const parts2 = [];
+    const passes = activePasses();
+    if (passes.length > 0) parts2.push(`active pass: ${passes.join(", ")}`);
+    const c = readCensus();
+    if (c.topOffender) parts2.push(`hottest watch path: ${c.topOffender.path}`);
+    parts2.push(`rss ${rssMb()}MB`);
+    return parts2.join(" \xB7 ");
+  };
+  const maybeToast = (d, t) => {
+    if (t - (lastToastByKind.get(d.kind) ?? 0) < SENTINEL_TOAST_COOLDOWN_MS) return;
+    lastToastByKind.set(d.kind, t);
+    toast(d.headline, d.kind);
+    lastNotifiedAt = t;
+  };
+  const transition = (next) => {
+    const t = now();
+    if (next && !distress) {
+      distress = next;
+      deps.ledger?.("enter", next);
+      maybeToast(next, t);
+      deps.onChange?.(next);
+    } else if (next && distress) {
+      distress.body = next.body;
+      distress.headline = next.headline;
+      if (t - lastNotifiedAt >= SENTINEL_RENOTIFY_MS) maybeToast(distress, t);
+    } else if (!next && distress) {
+      deps.ledger?.("clear", distress);
+      distress = null;
+      deps.onChange?.(null);
     }
-    let indexed = 0;
-    for (const r of records) {
-      if (!rOpts?.force && r.engine.store.nodeCount() > 0) {
-        out2.set(r.id, r.engine.store.nodeCount());
-        continue;
-      }
-      const done = markPass(`reindex:${r.entry.name}`);
-      try {
-        const idx = await r.engine.reindex({ skipEmbed: rOpts?.skipEmbed ?? true, quiet: true });
-        out2.set(r.id, idx.nodes);
-        indexed++;
-        console.log(`[errata] indexed ${r.entry.name}: ${idx.nodes} nodes / ${idx.edges} edges`);
-      } catch (err2) {
-        console.warn(`[errata] index failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
-        out2.set(r.id, r.engine.store.nodeCount());
-      } finally {
-        done();
+  };
+  const evaluate = () => {
+    const t = now();
+    const wallMs = Math.max(1, t - prevTs);
+    const cpu = cpuUsage();
+    const cores = (cpu.user + cpu.system - prevCpu.user - prevCpu.system) / 1e3 / wallMs;
+    prevCpu = cpu;
+    prevTs = t;
+    coreSamples.push(cores);
+    if (coreSamples.length > SENTINEL_WINDOW_TICKS) coreSamples.shift();
+    const c = readCensus();
+    const dispatchRate = prevDispatched === null ? 0 : (c.dispatched - prevDispatched) / wallMs * 1e3;
+    const survived = c.logged - prevLogged;
+    prevDispatched = c.dispatched;
+    prevLogged = c.logged;
+    stormTicks = dispatchRate > SENTINEL_STORM_RATE && survived === 0 ? stormTicks + 1 : 0;
+    let wanted = null;
+    if (stormTicks >= SENTINEL_STORM_TICKS) {
+      wanted = {
+        kind: "watch-storm",
+        headline: `errata's file watcher is stuck busy (~${Math.round(dispatchRate)} events/sec with nothing changing) \u2014 run \`errata status\` for detail`,
+        body: `filesystem watcher is processing ~${Math.round(dispatchRate)} events/sec with NOTHING surviving \u2014 a wedged or ignored-tree watch is burning CPU for no signal \xB7 ${attribution()}`,
+        sinceTs: distress?.kind === "watch-storm" ? distress.sinceTs : t
+      };
+    } else {
+      const windowFull = coreSamples.length >= SENTINEL_WINDOW_TICKS;
+      const avgCores = coreSamples.reduce((a, b) => a + b, 0) / Math.max(1, coreSamples.length);
+      if (windowFull && avgCores >= SENTINEL_BURN_CORES && cores >= SENTINEL_BURN_CORES && activePasses().length === 0) {
+        wanted = {
+          kind: "cpu-burn",
+          headline: `errata is using more CPU than expected (${avgCores.toFixed(1)} cores with no work running) \u2014 run \`errata status\` for detail`,
+          body: `sustained CPU with no pass running \u2014 avg ${avgCores.toFixed(1)} cores \xB7 ${attribution()}`,
+          sinceTs: distress?.kind === "cpu-burn" ? distress.sinceTs : t
+        };
       }
     }
-    if (toIndex.length > 0) {
-      notifyEvent("index-completed", `Indexed ${indexed} ${plural(indexed)}`);
+    if (wanted) {
+      calmTicks = 0;
+      transition(wanted);
+    } else if (distress) {
+      calmTicks++;
+      if (calmTicks >= SENTINEL_CALM_TICKS) {
+        calmTicks = 0;
+        transition(null);
+      }
     }
-    return out2;
   };
-  const { server, port } = await listenServer(app.fetch, opts.webPort ?? 7891);
-  baseUrl = `http://127.0.0.1:${port}`;
-  try {
-    ensureDir(globalDir());
-    writeFileSync22(
-      lockPath,
-      JSON.stringify({ pid: process.pid, webUiUrl: baseUrl, startedAt: Date.now() }),
-      "utf8"
-    );
-  } catch {
-  }
-  for (const r of records) {
+  const interval = deps.scheduleTicks === false ? null : setInterval(() => {
     try {
-      writeFileSync22(
-        r.engine.paths.daemonLock,
-        JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${r.id}`, startedAt: Date.now() }),
-        "utf8"
-      );
-      registerWorkspace(r.engine.profile, r.root);
+      evaluate();
     } catch {
     }
-  }
-  if (opts.reindexOnStart !== false && records.length > 0) {
-    void reindexAll({ skipEmbed: opts.skipEmbed ?? true });
-  }
-  const rootAdopter = createRootAdopter({
-    isKnownRoot: (root) => pickOwnerRoot(records.map((r) => r.root), root) !== null,
-    linkingAllowed: () => {
-      const c = loadConfig();
-      return c.consent.sync && hasCloudCredential(c);
-    },
-    lookup: async (locator) => cloudNow().lookupProject(locator),
-    adopt: async (root) => {
-      let profile = loadProfile(root);
-      if (!profile) {
-        profile = autodetectProfile(root);
-        saveProfile(root, profile);
-      }
-      registerWorkspace(profile, root);
-      attachWorkspace(root);
-    },
-    // eslint-disable-next-line no-console
-    log: (line) => console.log(line)
-  });
-  const ambientLinkAll = async () => {
+  }, SENTINEL_TICK_MS);
+  interval?.unref?.();
+  return {
+    current: () => distress ? { ...distress } : null,
+    tick: evaluate,
+    stop: () => {
+      if (interval) clearInterval(interval);
+    }
+  };
+}
+
+// src/codex-wake.ts
+var CODEX_WAKE_LOOKBACK_MS = 10 * 6e4;
+var CODEX_WAKE_BOOT_LOOKBACK_MS = 24 * 60 * 6e4;
+function codexWakeCandidates(input) {
+  if (input.disabled) return [];
+  const find = input.find ?? ((cwd, since) => codexRolloutsForCwd(cwd, { sinceMs: since, limit: 1 }).length + geminiTranscriptsForCwd(cwd, { sinceMs: since, limit: 1 }).length + opencodeTranscriptsForCwd(cwd, { sinceMs: since, limit: 1 }).length);
+  const out2 = [];
+  for (const entry of input.entries) {
+    if (input.liveRoots.has(input.normPath(entry.path))) continue;
+    let n = 0;
+    try {
+      n = find(entry.path, input.sinceMs);
+    } catch {
+      continue;
+    }
+    if (n > 0) out2.push({ name: entry.name, path: entry.path });
+  }
+  return out2;
+}
+
+// src/multi.ts
+var projectSymbolSalts = /* @__PURE__ */ new Map();
+async function resolveProjectSymbolSalt(client, projectId) {
+  const cached2 = projectSymbolSalts.get(projectId);
+  if (cached2) return { projectId, salt: cached2 };
+  const { salt } = await client.projectSymbolSalt(projectId);
+  projectSymbolSalts.set(projectId, salt);
+  return { projectId, salt };
+}
+function normPath(p) {
+  return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function contextKey(p) {
+  return `${[...p.stack].sort().join(",")}|${p.domains[0] ?? p.languages[0] ?? "?"}`;
+}
+function pickOwnerRoot(roots, absPath) {
+  if (!absPath) return null;
+  const n = normPath(absPath);
+  let best = null;
+  let bestLen = -1;
+  for (const root of roots) {
+    const r = normPath(root);
+    if ((n === r || n.startsWith(r + "/")) && r.length > bestLen) {
+      best = root;
+      bestLen = r.length;
+    }
+  }
+  return best;
+}
+function ownerOf(records, absPath) {
+  const root = pickOwnerRoot(records.map((r) => r.root), absPath);
+  return root == null ? null : records.find((r) => r.root === root) ?? null;
+}
+async function startMultiDaemon(opts = {}) {
+  const lockPath = globalDaemonLock();
+  if (opts.enforceSingleton !== false && isDaemonAlive(lockPath)) {
+    throw new Error(
+      `an errata daemon is already running (lock: ${lockPath}). Run \`errata stop\` first, or attach to the running one.`
+    );
+  }
+  const cfg = loadConfig();
+  const CLOUD_TIMEOUT_MS = 12e4;
+  const initialCloudUrl = normalizeCloudUrl(opts.cloudUrl ?? cfg.cloudUrl);
+  const initialCfg = { ...cfg, cloudUrl: initialCloudUrl };
+  if (opts.apiKey) {
+    initialCfg.apiKey = opts.apiKey;
+    initialCfg.accessToken = null;
+    initialCfg.refreshToken = null;
+    initialCfg.tokenEndpoint = null;
+    initialCfg.oauthClientId = null;
+  }
+  const cloud = authedCloudClient(initialCfg, { timeoutMs: CLOUD_TIMEOUT_MS, daemonVersion: DAEMON_VERSION });
+  const cloudNow = () => {
     const c = loadConfig();
-    if (!c.consent.sync || !hasCloudCredential(c)) return;
-    const client = cloudNow();
-    for (const r of records) {
-      const out2 = await ensureProjectLink(r.root, r.engine.profile, client);
-      if (out2.linked) {
-        console.log(
-          `[errata] linked ${r.engine.profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`
-        );
-      } else if (out2.reason === "error") {
-        console.warn(`[errata] project link failed for ${r.engine.profile.name}: ${out2.detail}`);
-      }
-      const hyd = await hydrateProject({
-        root: r.root,
-        profile: r.engine.profile,
-        store: r.engine.store,
-        cloud: client
+    const baseUrl2 = normalizeCloudUrl(opts.cloudUrl ?? c.cloudUrl);
+    const current = { ...c, cloudUrl: baseUrl2 };
+    if (opts.apiKey) {
+      current.apiKey = opts.apiKey;
+      current.accessToken = null;
+      current.refreshToken = null;
+      current.tokenEndpoint = null;
+      current.oauthClientId = null;
+    }
+    return authedCloudClient(current, { timeoutMs: CLOUD_TIMEOUT_MS, daemonVersion: DAEMON_VERSION });
+  };
+  const identityFor = (entry) => {
+    if (opts.apiKey) {
+      return {
+        profileName: null,
+        profile: null,
+        rule: "env-config-path",
+        invalid: false,
+        reason: "daemon started with an explicit --api-key (process-pinned)"
+      };
+    }
+    return resolveWorkspaceIdentity(loadConfig(), entry);
+  };
+  const identityBlocks = /* @__PURE__ */ new Map();
+  const noteIdentityBlock = (wsId, wsName, identity) => {
+    if (!identityBlocks.has(wsId)) {
+      identityBlocks.set(wsId, {
+        workspace: wsName,
+        profileName: identity.profileName,
+        reason: identity.reason,
+        since: Date.now()
       });
-      if (hyd.hydrated) {
-        r.engine.markContextDirty();
-        console.log(
-          `[errata] primed ${r.engine.profile.name} from project \u2014 ${hyd.nodes} priors, ${hyd.edges} links`
-        );
-      } else if (hyd.reason === "error") {
-        console.warn(`[errata] project prime failed for ${r.engine.profile.name}: ${hyd.detail}`);
-      }
-      if (r.engine.profile.projectId) {
-        try {
-          const { salt } = await resolveProjectSymbolSalt(client, r.engine.profile.projectId);
-          const re = await reanchorProject({
-            root: r.root,
-            profile: r.engine.profile,
-            store: r.engine.store,
-            cloud: client,
-            salt
-          });
-          if (re.reanchored) {
-            r.engine.markContextDirty();
-            console.log(
-              `[errata] reanchored ${r.engine.profile.name} \u2014 ${re.anchors} anchors onto local code (${re.dropped} unresolved, dropped)`
-            );
-          } else if (re.reason === "error") {
-            console.warn(`[errata] project reanchor failed for ${r.engine.profile.name}: ${re.detail}`);
-          }
-          if (r.engine.profile.linkConsents && r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
-            historyInFlight.add(r.root);
-            const engine = r.engine;
-            const root = r.root;
-            const anchorIndex = {
-              nodesByRelPath: (paths) => {
-                if (!records.some((x) => x.root === root)) {
-                  throw new Error("workspace detached mid-walk; the watermark holds and the next pass resumes");
-                }
-                return engine.store.nodesByRelPath(paths);
-              }
-            };
-            void startHistoryStage(root, engine.profile, client, {
-              anchors: { index: anchorIndex, salt },
-              saveProfile: (p) => {
-                Object.assign(engine.profile, p);
-                saveProfile(root, engine.profile);
-              },
-              log: (line) => console.warn(line)
-            }).then((stage2) => {
-              if (stage2.profile !== engine.profile) {
-                Object.assign(engine.profile, stage2.profile);
-                saveProfile(root, engine.profile);
-              }
-              const state = engine.profile.historyStage?.state ?? "consent-pending";
-              const c2 = engine.profile.historyStage?.counts;
-              console.log(
-                `[errata] history ${state} for ${engine.profile.name}` + (c2 ? ` \xB7 ${c2.commitsWalked ?? 0} commits walked \xB7 ${c2.changesExtracted ?? 0} changes extracted \xB7 ${c2.pairs ?? 0} pairs \xB7 ${c2.claims ?? 0} claims \xB7 ${c2.anchors ?? 0} anchors \xB7 ${c2.packages ?? 0} packages` : "") + (engine.profile.historyStage?.lastError ? ` \xB7 ${engine.profile.historyStage.lastError}` : "")
-              );
-            }).catch((err2) => {
-              console.warn(`[errata] history walk failed for ${engine.profile.name}: ${err2 instanceof Error ? err2.message : err2}`);
-            }).finally(() => historyInFlight.delete(root));
-          }
-        } catch {
-        }
-      }
+      console.error(`[identity] HOLDING cloud traffic for workspace "${wsName}": ${identity.reason}`);
     }
   };
-  const historyInFlight = /* @__PURE__ */ new Set();
-  void ambientLinkAll();
-  const packageAutoAll = async () => {
-    const out2 = /* @__PURE__ */ new Map();
-    for (const r of records) {
-      await new Promise((resolve7) => setImmediate(resolve7));
-      const done = markPass(`package-index:${r.entry.name}`);
-      try {
-        out2.set(
-          r.id,
-          runLockfilePass({
-            root: r.root,
-            store: r.engine.store,
-            workspaceId: r.id,
-            languages: r.engine.profile.languages,
-            log: (m) => console.log(m)
-          })
-        );
-      } catch (err2) {
-        console.warn(`[errata] package index failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
-      } finally {
-        done();
-      }
+  const clearIdentityBlock = (wsId) => {
+    if (identityBlocks.delete(wsId)) console.log(`[identity] workspace unblocked \u2014 spooled capture drains on this pass`);
+  };
+  const projectHolds = /* @__PURE__ */ new Map();
+  const noteProjectHold = (wsId, wsName, reason) => {
+    if (!projectHolds.has(wsId)) {
+      projectHolds.set(wsId, { workspace: wsName, reason, since: Date.now() });
+      console.error(
+        `[project] HOLDING cloud push for workspace "${wsName}": cannot prove its project \u2014 ${reason}. Shipping without the assertion would publish project-scoped knowledge to the whole org; the batch stays pending instead.`
+      );
     }
-    return out2;
   };
-  const daemon = {
-    url: baseUrl,
-    records,
-    sharedStore,
-    attachWorkspace,
-    reindexAll,
-    packageAutoAll,
-    async tickAll() {
-      const out2 = /* @__PURE__ */ new Map();
-      for (const r of records) {
-        const done = markPass(`tick:${r.entry.name}`);
-        try {
-          out2.set(r.id, await r.engine.tick());
-        } catch (err2) {
-          console.warn(`[errata] tick failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
-        } finally {
-          done();
-        }
-      }
-      return out2;
-    },
-    semanticMaintenanceAll() {
-      const out2 = /* @__PURE__ */ new Map();
-      for (const r of records) {
-        const done = markPass(`semantic:${r.entry.name}`);
-        try {
-          out2.set(r.id, r.engine.semanticMaintenance());
-        } catch (err2) {
-          console.warn(
-            `[errata] semantic maintenance failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`
-          );
-        } finally {
-          done();
-        }
+  const clearProjectHold = (wsId) => {
+    if (projectHolds.delete(wsId)) console.log(`[project] project assertion restored \u2014 held contributions drain on this pass`);
+  };
+  const cloudForIdentity = (identity) => {
+    if (identity.invalid) return blockedCloudClient(identity.reason);
+    if (identity.rule === "workspace-binding" && identity.profileName) {
+      return authedCloudClientForProfile(loadConfig(), identity.profileName, {
+        timeoutMs: CLOUD_TIMEOUT_MS,
+        daemonVersion: DAEMON_VERSION
+      });
+    }
+    return cloudNow();
+  };
+  const sharedDbPath = sharedStorePath();
+  ensureParent(sharedDbPath);
+  const sharedStore = openGraphStore({ path: sharedDbPath });
+  const bundledRun = import.meta.url.endsWith(".mjs");
+  const consolidateWorker = bundledRun && sharedDbPath !== ":memory:" ? new ConsolidateWorker() : null;
+  startLoopLagMonitor();
+  let baseUrl = "";
+  const records = [];
+  const mountedIds = /* @__PURE__ */ new Set();
+  const machineDominantLanguage = () => {
+    const langCounts = /* @__PURE__ */ new Map();
+    for (const r of records) {
+      for (const l of r.engine.profile.languages ?? []) {
+        const k = String(l).trim().toLowerCase();
+        if (k) langCounts.set(k, (langCounts.get(k) ?? 0) + 1);
       }
-      return out2;
-    },
-    async nightlyFor(ids) {
-      const want = new Set(ids);
-      const out2 = /* @__PURE__ */ new Map();
-      for (const r of records) {
-        if (!want.has(r.id)) continue;
-        const done = markPass(`nightly:${r.entry.name}`);
-        try {
-          out2.set(r.id, await r.engine.nightly());
-        } catch (err2) {
-          console.warn(`[errata] nightly failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
-        } finally {
-          done();
-        }
+    }
+    return [...langCounts.entries()].sort(
+      (a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)
+    )[0]?.[0];
+  };
+  const updatePoller = opts.updateCheck ? startUpdatePoller({
+    channel: loadConfig().updateChannel,
+    onChange: (pending) => {
+      if (pending) {
+        console.log(`\u26A1 errata update available: ${pending.current} \u2192 ${pending.latest} \u2014 run: errata update`);
       }
-      return out2;
-    },
-    async nightlyAll() {
-      return daemon.nightlyFor(records.map((r) => r.id));
+      for (const r of records) r.engine.markContextDirty();
+    }
+  }) : null;
+  const healthSentinel = createHealthSentinel({
+    onChange: () => {
+      for (const r of records) r.engine.markContextDirty();
     },
-    async percolateAll() {
-      const ts = Date.now();
-      const out2 = /* @__PURE__ */ new Map();
-      const repoBasename = (locator) => (locator.split("/").filter(Boolean).pop() ?? locator).toLowerCase();
-      for (const r of records) {
-        const profile = r.engine.profile;
-        const aliases = profile.repoLocatorAliases ?? [];
-        const locator = profile.repoLocator;
-        if (!locator || aliases.length === 0) continue;
-        try {
-          for (const alias of aliases) {
-            if (repoBasename(alias) !== repoBasename(locator)) {
-              console.log(
-                `[errata] project alias NOT auto-migrated for ${r.entry.name} (${alias} \u2192 ${locator}: repo name differs \u2014 a fork/repoint, not a rename). Run scripts/migrate-project-alias.ts if this really is the same repo.`
-              );
-              continue;
-            }
-            const m = migrateProjectAlias(sharedStore, { from: alias, to: locator, ts });
-            if (m.nodesRewritten || m.edgesRewritten) {
-              console.log(
-                `[errata] project alias migrated for ${r.entry.name}: ${alias} \u2192 ${locator} (${m.nodesRewritten} nodes, ${m.edgesRewritten} edges)`
-              );
-            }
-          }
-          delete profile.repoLocatorAliases;
-          const onDisk = loadProfile(r.root);
-          if (onDisk) {
-            delete onDisk.repoLocatorAliases;
-            saveProfile(r.root, onDisk);
-          }
-        } catch (err2) {
-          console.warn(`[errata] project-alias migration failed for ${r.entry.name} (kept for next pass): ${err2 instanceof Error ? err2.message : err2}`);
-        }
+    ledger: (event, d) => {
+      const dir = records[0]?.engine.paths.configDir;
+      if (dir) {
+        appendPassLedger(dir, "health-sentinel", 0, {
+          [`distress:${event}:${d.kind}`]: 1,
+          distressSinceTs: d.sinceTs
+        });
       }
-      let inlineRecords = records;
-      if (consolidateWorker) {
-        const fileBacked = records.filter((r) => r.engine.paths.castalia !== ":memory:");
-        if (fileBacked.length > 0) {
-          try {
-            const res = await consolidateWorker.run({
-              kind: "percolateAll",
-              sharedDbPath,
-              ts,
-              workspaces: fileBacked.map((r) => ({
-                recordId: r.id,
-                // Repo-keyed when linked: two checkouts of one repo are ONE
-                // project in observedInProjects, not two independent
-                // observations (PJ-local — the Q9 independence gate).
-                workspaceId: r.engine.profile.repoLocator ?? r.engine.profile.id,
-                castaliaPath: r.engine.paths.castalia
-              }))
-            });
-            for (const [id, v] of res) out2.set(id, v);
-            inlineRecords = records.filter((r) => r.engine.paths.castalia === ":memory:");
-          } catch (err2) {
-            console.warn(`[errata] percolate worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
-          }
-        }
+    }
+  });
+  let serverPending = null;
+  const boundaryListeners = [];
+  let boundaryFlushing = false;
+  let settleRunning = false;
+  let boundaryFlushStartedAt = 0;
+  let boundaryFlushStage = "";
+  let boundaryFlushUnits = 0;
+  let boundaryFlushLastAdvanceAt = 0;
+  let boundaryFlushBatches = 0;
+  const beginFlush = (stage2) => {
+    boundaryFlushing = true;
+    boundaryFlushStartedAt = Date.now();
+    boundaryFlushLastAdvanceAt = Date.now();
+    boundaryFlushUnits = 0;
+    boundaryFlushBatches = 0;
+    boundaryFlushItems = 0;
+    boundaryFlushDetail = "";
+    boundaryFlushStage = stage2;
+  };
+  const flushStage = (stage2) => {
+    boundaryFlushStage = stage2;
+  };
+  let boundaryFlushItems = 0;
+  let boundaryFlushDetail = "";
+  const noteFlushProgress = (units, items = 0, detail = "") => {
+    boundaryFlushBatches++;
+    boundaryFlushUnits += Math.max(0, units);
+    boundaryFlushItems += Math.max(0, items);
+    if (detail) boundaryFlushDetail = detail;
+    if (units > 0 || items > 0) boundaryFlushLastAdvanceAt = Date.now();
+  };
+  const flushSnapshot = () => ({
+    running: boundaryFlushing,
+    stage: boundaryFlushStage,
+    detail: boundaryFlushDetail,
+    ageMs: boundaryFlushStartedAt ? Date.now() - boundaryFlushStartedAt : 0,
+    units: boundaryFlushUnits,
+    items: boundaryFlushItems,
+    chunks: boundaryFlushBatches,
+    stalledMs: boundaryFlushLastAdvanceAt ? Date.now() - boundaryFlushLastAdvanceAt : 0,
+    // Held workspaces, so a hold is REPORTABLE and not merely logged once at the
+    // transition. `errata status` reads this rather than the on-disk profile:
+    // the profile records what the workspace INTENDS to assert, which is why
+    // status could print "→ project 019f462d" for hours while every batch was
+    // being held or shipped unlinked. A hold is the daemon's actual behavior.
+    holds: [
+      ...[...projectHolds.values()].map((h) => ({
+        workspace: h.workspace,
+        kind: "project",
+        reason: h.reason,
+        sinceMs: Date.now() - h.since
+      })),
+      ...[...identityBlocks.values()].map((h) => ({
+        workspace: h.workspace,
+        kind: "identity",
+        reason: h.reason,
+        sinceMs: Date.now() - h.since
+      }))
+    ]
+  });
+  const endFlush = () => {
+    boundaryFlushing = false;
+    boundaryFlushStage = "";
+  };
+  const fireBoundary = () => {
+    for (const l of boundaryListeners) {
+      try {
+        l();
+      } catch {
       }
-      for (const r of inlineRecords) {
-        const done = markPass(`percolate-inline:${r.entry.name}`);
-        try {
-          out2.set(
-            r.id,
-            percolate(r.engine.store, sharedStore, {
-              workspaceId: r.engine.profile.repoLocator ?? r.engine.profile.id,
-              ts
-            })
-          );
-        } catch (err2) {
-          console.warn(
-            `[errata] percolate failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`
-          );
-        } finally {
-          done();
-        }
+    }
+  };
+  const buildRecord = (entry) => {
+    const id = entry.id;
+    const wsIdentity = identityFor(entry);
+    let wsCloud = cloud;
+    if (wsIdentity.rule === "workspace-binding") {
+      if (wsIdentity.invalid) {
+        noteIdentityBlock(entry.id, entry.name, wsIdentity);
+        wsCloud = blockedCloudClient(wsIdentity.reason);
+      } else {
+        wsCloud = authedCloudClientForProfile(loadConfig(), wsIdentity.profileName, {
+          timeoutMs: CLOUD_TIMEOUT_MS,
+          daemonVersion: DAEMON_VERSION
+        });
+        console.log(`[identity] workspace "${entry.name}" bound \u2192 profile "${wsIdentity.profileName}"`);
       }
-      return out2;
-    },
-    async induceL2Abstractions(touched) {
-      const ctxByWs = /* @__PURE__ */ new Map();
-      for (const r of records) ctxByWs.set(r.engine.profile.id, contextKey(r.engine.profile));
-      const ts = Date.now();
-      if (consolidateWorker) {
-        try {
-          return await consolidateWorker.run({
-            kind: "induceAbstractions",
-            sharedDbPath,
-            ts,
-            ctxByWs: Object.fromEntries(ctxByWs),
-            originMachine: machineId(),
-            ...touched ? { touched: new Set(touched) } : {}
-          });
-        } catch (err2) {
-          console.warn(`[errata] abstraction worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
-        }
+    }
+    const engine = createWorkspaceEngine({
+      workspaceRoot: entry.path,
+      cloud: wsCloud,
+      apiKey: opts.apiKey,
+      reviewUrl: () => `${baseUrl}/ws/${id}/review`,
+      sharedStore,
+      pendingUpdate: () => serverPending ?? updatePoller?.current() ?? null,
+      // Ops-gated (default OFF): the 🚨 notice reads as "errata broke my
+      // machine" to a non-operator. Detection + ledger run regardless — only
+      // this push surface (and the toast, gated in notifyOpsEvent) is scoped.
+      daemonDistress: () => loadConfig().opsNotices ? healthSentinel.current() : null,
+      ...opts.skipWatchers ? { skipWatchers: true } : {}
+    });
+    const webApp = buildWebUi({
+      paths: engine.paths,
+      store: engine.store,
+      log: engine.log,
+      profile: engine.profile,
+      daemonVersion: DAEMON_VERSION,
+      basePath: `/ws/${id}`,
+      onWorkingFileChanged: engine.webHooks.onWorkingFileChanged,
+      onHook: engine.webHooks.onHook,
+      onHookEvent: engine.webHooks.onHookEvent,
+      onShellEvent: engine.webHooks.onShellEvent,
+      // The tool-run RECORD seam (SP-tool-ground). The single-engine path wired
+      // this in #1172; this sibling builder never did, so on every multi
+      // deployment (i.e. every real one) the webui logged "tool-run recorded"
+      // and dropped the record on the floor — toolSessionsTracked read 0 across
+      // 936 turns while the log showed records landing (VS-corroboration-rate).
+      onToolsObserved: engine.webHooks.onToolsObserved,
+      onToolError: engine.webHooks.onToolError,
+      onDiagnostics: engine.webHooks.onDiagnostics,
+      onTurn: engine.webHooks.onTurn,
+      onMessage: engine.webHooks.onMessage,
+      onSessionEnd: (e) => {
+        engine.webHooks.onSessionEnd(e);
+        fireBoundary();
       }
-      return induceAbstractions(sharedStore, {
-        contextOf: (ws) => ctxByWs.get(ws) ?? null,
-        ts,
-        // Source-tag minted principles to this machine so they stay attributable
-        // across the user's machines once L3 sync lands (P4 / §8.6).
-        originMachine: machineId(),
-        ...touched ? { touched } : {}
-      });
-    },
-    async induceL2Triage() {
-      const ctxByWs = /* @__PURE__ */ new Map();
-      for (const r of records) {
-        const p = r.engine.profile;
-        ctxByWs.set(p.id, {
-          features: { stack: [...p.stack].sort().join(","), domain: p.domains[0] ?? p.languages[0] ?? "" }
-        });
+    });
+    return { entry, engine, webApp, root: entry.path, id, lastHookAt: Date.now() };
+  };
+  const pruned = pruneMissingWorkspaces();
+  if (pruned.length > 0) {
+    console.log(`[errata] pruned ${pruned.length} registered workspace(s) whose path no longer exists`);
+  }
+  if (registryCorrupt()) {
+    console.error("[identity] workspaces.json is UNREADABLE \u2014 all per-workspace cloud push will hold until it parses (fail-closed)");
+  } else {
+    for (const b of boundWorkspaceEntries()) {
+      console.log(`[identity] bound workspace: ${b.name} \u2192 profile "${b.installationProfile}"`);
+    }
+  }
+  const entries = listWorkspaceEntries();
+  if (opts.eagerWorkspaces ?? EAGER_WORKSPACES_AT_BOOT) {
+    for (const entry of entries) {
+      try {
+        records.push(buildRecord(entry));
+      } catch (err2) {
+        console.warn(`[errata] skipping ${entry.name} (${entry.path}): ${err2 instanceof Error ? err2.message : err2}`);
       }
-      const ts = Date.now();
-      if (consolidateWorker) {
-        try {
-          return await consolidateWorker.run({
-            kind: "induceTriage",
-            sharedDbPath,
-            ts,
-            triageCtxByWs: Object.fromEntries(ctxByWs)
+    }
+    if (entries.length > 0 && records.length < entries.length) {
+      const failed = entries.length - records.length;
+      console.warn(
+        `[errata] \u26A0 ${failed} of ${entries.length} project(s) failed to start \u2014 likely a stale daemon holding DB locks. Run \`errata stop\` (or kill the old errata process) and retry.`
+      );
+    }
+  } else if (entries.length > 0) {
+    console.log(
+      `[errata] ${entries.length} workspace(s) registered \xB7 cold \u2014 an engine spawns on the first hook from each`
+    );
+  }
+  const app = new Hono2();
+  const attachWorkspace = (root) => {
+    const norm = normPath(root);
+    if (records.some((r) => normPath(r.root) === norm)) return { attached: false, id: null, reason: "already-watched" };
+    const entry = listWorkspaceEntries().find((e) => normPath(e.path) === norm);
+    if (!entry) return { attached: false, id: null, reason: "not-registered" };
+    let rec;
+    try {
+      rec = buildRecord(entry);
+    } catch (err2) {
+      return { attached: false, id: null, reason: err2 instanceof Error ? err2.message : "build-failed" };
+    }
+    records.push(rec);
+    void ambientLinkAll();
+    try {
+      writeFileSync23(
+        rec.engine.paths.daemonLock,
+        JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${rec.id}`, startedAt: Date.now() }),
+        "utf8"
+      );
+      registerWorkspace(rec.engine.profile, rec.root);
+    } catch {
+    }
+    void rec.engine.reindex({ skipEmbed: true, quiet: rec.engine.store.nodeCount() > 0 }).catch(() => {
+    });
+    console.log(`[errata] hot-registered ${rec.entry.name} (${rec.id}) \u2014 now watching live`);
+    return { attached: true, id: rec.id };
+  };
+  app.post("/api/attach", async (c) => {
+    let body2 = {};
+    try {
+      body2 = await c.req.json();
+    } catch {
+      return c.json({ error: "bad-json" }, 400);
+    }
+    const root = typeof body2["path"] === "string" ? body2["path"] : null;
+    if (!root) return c.json({ error: "path-required" }, 400);
+    return c.json(attachWorkspace(root));
+  });
+  app.post("/api/notify-test", (c) => {
+    notify("Errata \xB7 test", "Fired from the daemon \u2014 if you see this, daemon toasts render.");
+    return c.json({ ok: true });
+  });
+  app.get(
+    "/",
+    (c) => c.json({
+      daemonVersion: DAEMON_VERSION,
+      pendingUpdate: updatePoller?.current() ?? null,
+      projects: records.map((r) => ({
+        id: r.id,
+        name: r.entry.name,
+        path: r.root,
+        stack: r.entry.stack,
+        nodes: r.engine.store.nodeCount(),
+        // COUNT(*) — the materializing findNodesByLabel(...).length form held
+        // the event loop for seconds per poll once stores grew (HZ-index-hydrate).
+        problems: r.engine.store.countNodesByLabel("Problem"),
+        solutions: r.engine.store.countNodesByLabel("Solution"),
+        endpoints: `/ws/${r.id}/`
+      })),
+      humanView: "run `errata report` \u2014 the dashboard was retired (GRAFT 4e)"
+    })
+  );
+  const STRANDED_TTL_MS = 6e4;
+  const strandedCache = /* @__PURE__ */ new Map();
+  const strandedRefreshing = /* @__PURE__ */ new Set();
+  const strandedCount = (r) => {
+    const hit = strandedCache.get(r.id);
+    if (hit && Date.now() - hit.at < STRANDED_TTL_MS) return hit.count;
+    if (!strandedRefreshing.has(r.id)) {
+      strandedRefreshing.add(r.id);
+      const finish = (count) => {
+        strandedCache.set(r.id, { at: Date.now(), count });
+        strandedRefreshing.delete(r.id);
+      };
+      if (consolidateWorker && r.engine.paths.castalia !== ":memory:") {
+        consolidateWorker.run({ kind: "strandedCount", sharedDbPath, castaliaPath: r.engine.paths.castalia }).then((n) => finish(Number(n))).catch(() => {
+          setImmediate(() => {
+            const done = markPass(`stranded-scan:${r.entry.name}`);
+            try {
+              finish(findStrandedSymbols(r.engine.store).length);
+            } catch {
+              strandedRefreshing.delete(r.id);
+            } finally {
+              done();
+            }
           });
-        } catch (err2) {
-          console.warn(`[errata] triage-induction worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
-        }
-      }
-      return induceTriage(sharedStore, {
-        contextOf: (ws) => ctxByWs.get(ws) ?? null,
-        ts
-      });
-    },
-    async revisitStaleTriageRoutes() {
-      if (consolidateWorker) {
-        try {
-          return await consolidateWorker.run({ kind: "revisitTriage", sharedDbPath, ts: Date.now() });
-        } catch {
-        }
-      }
-      return revisitStaleRoutes(sharedStore, Date.now());
-    },
-    async revisitStalePrinciples() {
-      if (consolidateWorker) {
-        try {
-          return await consolidateWorker.run({ kind: "revisitPrinciples", sharedDbPath, ts: Date.now() });
-        } catch {
-        }
+        });
+      } else {
+        setImmediate(() => {
+          const done = markPass(`stranded-scan:${r.entry.name}`);
+          try {
+            finish(findStrandedSymbols(r.engine.store).length);
+          } catch {
+            strandedRefreshing.delete(r.id);
+          } finally {
+            done();
+          }
+        });
       }
-      return revisitContradictedPrinciples(sharedStore, Date.now());
-    },
-    async syncPrinciplesPublic() {
-      if (!loadConfig().consent.sync) return { uploaded: 0, skipped: "consent-off" };
-      const ignore2 = loadClaimIgnorePatterns(globalDir());
-      const primaryLanguage = machineDominantLanguage();
-      const payload = buildPrincipleIngest(sharedStore, DAEMON_VERSION, ignore2, 2, {
-        ...primaryLanguage ? { primaryLanguage } : {}
-      });
-      if (!payload) return { uploaded: 0 };
-      const res = await cloudNow().ingest(payload);
-      return { uploaded: res.accepted };
-    },
-    async syncTriagePublic() {
-      const cfg2 = loadConfig();
-      if (!cfg2.consent.sync) return { uploaded: 0, skipped: "consent-off" };
-      const ignore2 = loadClaimIgnorePatterns(globalDir());
-      const primaryLanguage = machineDominantLanguage();
-      const languages = records.flatMap((r) => r.engine.profile.languages ?? []);
-      const packages = cfg2.consent.contributePackages ? records.flatMap(
-        (r) => r.engine.store.findNodesByLabel("Package").map((p) => ({
-          name: String(p.attrs["name"] ?? ""),
-          purl: String(p.attrs["purl"] ?? p.id)
-        }))
-      ) : [];
-      const tokenAnchors = buildBucketTokenAnchors(languages, packages);
-      const payload = buildTriageIngest(sharedStore, DAEMON_VERSION, ignore2, 2, {
+    }
+    return hit?.count ?? -1;
+  };
+  let lastHook = null;
+  app.get(
+    "/health",
+    (c) => c.json({
+      ok: true,
+      daemonVersion: DAEMON_VERSION,
+      lastHook,
+      // What the daemon is DOING, not just what it holds. Without these a
+      // pegged daemon is only diagnosable by attaching a CPU profiler to the
+      // live process — see watch-census.ts for the incident that proved it.
+      pass: passState(),
+      watch: watchCensus(),
+      // Registered but with no engine running (WS-cold-start). Listed so a cold
+      // daemon is legible as "nothing has needed waking yet" rather than as
+      // "the registry lost my projects" — an invisible cold workspace is
+      // indistinguishable from a missing one, and only one of those is fine.
+      cold: listWorkspaceEntries().filter((e) => !records.some((r) => normPath(r.root) === normPath(e.path))).map((e) => ({ name: e.name, path: e.path })),
+      projects: records.map((r) => ({
+        id: r.id,
+        name: r.entry.name,
+        path: r.root,
+        nodes: r.engine.store.nodeCount(),
+        // COUNT(*) — same hydration hazard as `/` (HZ-index-hydrate).
+        problems: r.engine.store.countNodesByLabel("Problem"),
+        solutions: r.engine.store.countNodesByLabel("Solution"),
+        stranded: strandedCount(r)
+      }))
+    })
+  );
+  const forward = async (c, pathInBody) => {
+    const raw2 = await c.req.text();
+    let body2 = {};
+    try {
+      body2 = JSON.parse(raw2);
+    } catch {
+      return c.json({ error: "bad-json" }, 400);
+    }
+    lastHook = { at: Date.now(), event: typeof body2["hook_event_name"] === "string" ? body2["hook_event_name"] : c.req.path };
+    let owner = ownerOf(records, pathInBody(body2));
+    if (!owner) {
+      const missPath = pathInBody(body2);
+      const registeredRoot = missPath ? pickOwnerRoot(listWorkspaceEntries().map((e) => e.path), missPath) : null;
+      const wakeRoot = registeredRoot ?? (missPath ? findGitRoot(missPath) : null);
+      if (wakeRoot && attachWorkspace(wakeRoot).attached) {
+        owner = ownerOf(records, missPath) ?? null;
+        if (owner) console.log(`[errata] woke workspace ${owner.entry.name}`);
+      }
+    }
+    if (!owner) {
+      rootAdopter.noteMiss(pathInBody(body2));
+      return c.json({ error: "no-matching-project" }, 404);
+    }
+    owner.lastHookAt = Date.now();
+    const sub = c.req.path;
+    const done = markPass(`${sub}:${owner.entry.name}`);
+    try {
+      return await owner.webApp.fetch(
+        new Request(`http://local${sub}`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: raw2
+        })
+      );
+    } finally {
+      done();
+    }
+  };
+  app.post(
+    "/api/hook",
+    (c) => forward(c, (b) => {
+      const input = b["tool_input"] ?? {};
+      const fp = input["file_path"];
+      const cwd = b["cwd"];
+      return (typeof fp === "string" ? fp : void 0) ?? (typeof cwd === "string" ? cwd : void 0);
+    })
+  );
+  app.post(
+    "/api/diagnostics",
+    (c) => forward(c, (b) => {
+      const loc = b["path"] ?? b["uri"];
+      return typeof loc === "string" ? fileUriToFsPath(loc) : void 0;
+    })
+  );
+  const cwdOf = (b) => typeof b["cwd"] === "string" ? b["cwd"] : void 0;
+  app.post("/api/turn", (c) => forward(c, cwdOf));
+  app.post("/api/message", (c) => forward(c, cwdOf));
+  app.post("/api/session-end", (c) => forward(c, cwdOf));
+  app.post("/api/context-inject", (c) => forward(c, cwdOf));
+  for (const r of records) {
+    mountedIds.add(r.id);
+    app.route(`/ws/${r.id}`, r.webApp);
+  }
+  const dispatchHot = async (c) => {
+    const id = c.req.param("id");
+    const rec = records.find((r) => r.id === id);
+    if (!rec) return c.notFound();
+    const url2 = new URL(c.req.url);
+    url2.pathname = url2.pathname.slice(`/ws/${id}`.length) || "/";
+    const method = c.req.method;
+    const body2 = method === "GET" || method === "HEAD" ? void 0 : await c.req.raw.arrayBuffer();
+    return rec.webApp.fetch(new Request(url2.toString(), { method, headers: c.req.raw.headers, body: body2 }));
+  };
+  app.all("/ws/:id", dispatchHot);
+  app.all("/ws/:id/*", dispatchHot);
+  const retireWorkspace = async (rec, reason) => {
+    const idx = records.indexOf(rec);
+    if (idx === -1) return;
+    records.splice(idx, 1);
+    try {
+      await rec.engine.stop();
+    } catch (err2) {
+      console.warn(`[errata] retire ${rec.entry.name}: engine.stop failed \u2014 ${err2 instanceof Error ? err2.message : err2}`);
+    }
+    console.log(
+      `[errata] retired ${rec.entry.name} (${reason})` + (reason === "idle" ? " \u2014 idle; the next hook from it re-attaches" : "")
+    );
+  };
+  const sweepIdleWorkspaces = () => {
+    const now = Date.now();
+    for (const rec of [...records]) {
+      let lastActiveAt = rec.lastHookAt;
+      try {
+        lastActiveAt = Math.max(lastActiveAt, rec.engine.lastActivityAt());
+      } catch {
+      }
+      const reason = retireDecision({ exists: existsSync31(rec.root), lastActiveAt, now });
+      if (reason) void retireWorkspace(rec, reason);
+    }
+  };
+  const idleSweep = setInterval(sweepIdleWorkspaces, WORKSPACE_SWEEP_INTERVAL_MS);
+  idleSweep.unref?.();
+  let codexWakeFirstPass = true;
+  const sweepCodexWake = () => {
+    const lookback = codexWakeFirstPass ? CODEX_WAKE_BOOT_LOOKBACK_MS : CODEX_WAKE_LOOKBACK_MS;
+    codexWakeFirstPass = false;
+    let entries2;
+    try {
+      entries2 = listWorkspaceEntries();
+    } catch {
+      return;
+    }
+    const candidates = codexWakeCandidates({
+      entries: entries2,
+      liveRoots: new Set(records.map((r) => normPath(r.root))),
+      normPath,
+      sinceMs: Date.now() - lookback,
+      disabled: process.env["ERRATA_CODEX_WAKE_DISABLE"] === "1"
+    });
+    for (const c of candidates) {
+      if (attachWorkspace(c.path).attached) {
+        console.log(`[errata] woke workspace ${c.name} \u2014 recent Codex/Gemini/OpenCode transcript (headless capture)`);
+      }
+    }
+  };
+  const codexWake = setInterval(sweepCodexWake, WORKSPACE_SWEEP_INTERVAL_MS);
+  codexWake.unref?.();
+  const codexWakeBoot = setTimeout(sweepCodexWake, 5e3);
+  codexWakeBoot.unref?.();
+  const reindexAll = async (rOpts) => {
+    const out2 = /* @__PURE__ */ new Map();
+    const toIndex = records.filter((r) => rOpts?.force || r.engine.store.nodeCount() === 0);
+    const plural = (n) => `repositor${n === 1 ? "y" : "ies"}`;
+    if (toIndex.length > 0) {
+      notifyEvent("index-started", `Indexing ${toIndex.length} ${plural(toIndex.length)}\u2026`);
+    }
+    let indexed = 0;
+    for (const r of records) {
+      if (!rOpts?.force && r.engine.store.nodeCount() > 0) {
+        out2.set(r.id, r.engine.store.nodeCount());
+        continue;
+      }
+      const done = markPass(`reindex:${r.entry.name}`);
+      try {
+        const idx = await r.engine.reindex({ skipEmbed: rOpts?.skipEmbed ?? true, quiet: true });
+        out2.set(r.id, idx.nodes);
+        indexed++;
+        console.log(`[errata] indexed ${r.entry.name}: ${idx.nodes} nodes / ${idx.edges} edges`);
+      } catch (err2) {
+        console.warn(`[errata] index failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
+        out2.set(r.id, r.engine.store.nodeCount());
+      } finally {
+        done();
+      }
+    }
+    if (toIndex.length > 0) {
+      notifyEvent("index-completed", `Indexed ${indexed} ${plural(indexed)}`);
+    }
+    return out2;
+  };
+  const { server, port } = await listenServer(app.fetch, opts.webPort ?? 7891);
+  baseUrl = `http://127.0.0.1:${port}`;
+  try {
+    ensureDir(globalDir());
+    writeFileSync23(
+      lockPath,
+      JSON.stringify({ pid: process.pid, webUiUrl: baseUrl, startedAt: Date.now() }),
+      "utf8"
+    );
+  } catch {
+  }
+  for (const r of records) {
+    try {
+      writeFileSync23(
+        r.engine.paths.daemonLock,
+        JSON.stringify({ pid: process.pid, webUiUrl: `${baseUrl}/ws/${r.id}`, startedAt: Date.now() }),
+        "utf8"
+      );
+      registerWorkspace(r.engine.profile, r.root);
+    } catch {
+    }
+  }
+  if (opts.reindexOnStart !== false && records.length > 0) {
+    void reindexAll({ skipEmbed: opts.skipEmbed ?? true });
+  }
+  const rootAdopter = createRootAdopter({
+    isKnownRoot: (root) => pickOwnerRoot(records.map((r) => r.root), root) !== null,
+    linkingAllowed: () => {
+      const c = loadConfig();
+      return c.consent.sync && hasCloudCredential(c);
+    },
+    lookup: async (locator) => cloudNow().lookupProject(locator),
+    adopt: async (root) => {
+      let profile = loadProfile(root);
+      if (!profile) {
+        profile = autodetectProfile(root);
+        saveProfile(root, profile);
+      }
+      registerWorkspace(profile, root);
+      attachWorkspace(root);
+    },
+    // eslint-disable-next-line no-console
+    log: (line) => console.log(line)
+  });
+  const ambientLinkAll = async () => {
+    const c = loadConfig();
+    if (!c.consent.sync || !hasCloudCredential(c)) return;
+    const client = cloudNow();
+    for (const r of records) {
+      const out2 = await ensureProjectLink(r.root, r.engine.profile, client);
+      if (out2.linked) {
+        console.log(
+          `[errata] linked ${r.engine.profile.name} \u2192 project ${out2.projectId}${out2.created ? " (created)" : ""}`
+        );
+      } else if (out2.reason === "error") {
+        console.warn(`[errata] project link failed for ${r.engine.profile.name}: ${out2.detail}`);
+      }
+      const hyd = await hydrateProject({
+        root: r.root,
+        profile: r.engine.profile,
+        store: r.engine.store,
+        cloud: client
+      });
+      if (hyd.hydrated) {
+        r.engine.markContextDirty();
+        console.log(
+          `[errata] primed ${r.engine.profile.name} from project \u2014 ${hyd.nodes} priors, ${hyd.edges} links`
+        );
+      } else if (hyd.reason === "error") {
+        console.warn(`[errata] project prime failed for ${r.engine.profile.name}: ${hyd.detail}`);
+      }
+      if (r.engine.profile.projectId) {
+        try {
+          const { salt } = await resolveProjectSymbolSalt(client, r.engine.profile.projectId);
+          const re = await reanchorProject({
+            root: r.root,
+            profile: r.engine.profile,
+            store: r.engine.store,
+            cloud: client,
+            salt
+          });
+          if (re.reanchored) {
+            r.engine.markContextDirty();
+            console.log(
+              `[errata] reanchored ${r.engine.profile.name} \u2014 ${re.anchors} anchors onto local code (${re.dropped} unresolved, dropped)`
+            );
+          } else if (re.reason === "error") {
+            console.warn(`[errata] project reanchor failed for ${r.engine.profile.name}: ${re.detail}`);
+          }
+          if (r.engine.profile.projectHydratedAt && !historyInFlight.has(r.root)) {
+            historyInFlight.add(r.root);
+            const engine = r.engine;
+            const root = r.root;
+            const anchorIndex = {
+              nodesByRelPath: (paths) => {
+                if (!records.some((x) => x.root === root)) {
+                  throw new Error("workspace detached mid-walk; the watermark holds and the next pass resumes");
+                }
+                return engine.store.nodesByRelPath(paths);
+              }
+            };
+            void startHistoryStage(root, engine.profile, client, {
+              anchors: { index: anchorIndex, salt },
+              // PS-web projects: the console's consents (Privacy tab) win over
+              // the profile's memory; applied to config and profile here, with
+              // the change printed so a flipped switch is visible in the log.
+              applyConsents: (p, consents) => {
+                const cfg2 = loadConfig();
+                const applied = applyConsents(p, cfg2, consents, (/* @__PURE__ */ new Date()).toISOString());
+                if (applied.changed) {
+                  saveConfig(applied.config);
+                  Object.assign(engine.profile, applied.profile);
+                  saveProfile(root, engine.profile);
+                  console.log(
+                    `[errata] consents applied from the console for ${engine.profile.name}: sync=${consents.sync} telemetry=${consents.telemetry ? "on" : "off"} packages=${consents.packages ? "on" : "off"} structure=${consents.structure ? "on" : "off"} history=${consents.mineHistory ? consents.contributeHistory ? "mine+contribute" : "mine" : "off"}`
+                  );
+                }
+                return applied.profile;
+              },
+              saveProfile: (p) => {
+                Object.assign(engine.profile, p);
+                saveProfile(root, engine.profile);
+              },
+              log: (line) => console.warn(line)
+            }).then((stage2) => {
+              if (stage2.profile !== engine.profile) {
+                Object.assign(engine.profile, stage2.profile);
+                saveProfile(root, engine.profile);
+              }
+              const state = engine.profile.historyStage?.state ?? "consent-pending";
+              const c2 = engine.profile.historyStage?.counts;
+              console.log(
+                `[errata] history ${state} for ${engine.profile.name}` + (c2 ? ` \xB7 ${c2.commitsWalked ?? 0} commits walked \xB7 ${c2.changesExtracted ?? 0} changes extracted \xB7 ${c2.pairs ?? 0} pairs \xB7 ${c2.claims ?? 0} claims \xB7 ${c2.anchors ?? 0} anchors \xB7 ${c2.packages ?? 0} packages` : "") + (engine.profile.historyStage?.lastError ? ` \xB7 ${engine.profile.historyStage.lastError}` : "")
+              );
+            }).catch((err2) => {
+              console.warn(`[errata] history walk failed for ${engine.profile.name}: ${err2 instanceof Error ? err2.message : err2}`);
+            }).finally(() => historyInFlight.delete(root));
+          }
+        } catch {
+        }
+      }
+    }
+  };
+  const historyInFlight = /* @__PURE__ */ new Set();
+  void ambientLinkAll();
+  const packageAutoAll = async () => {
+    const out2 = /* @__PURE__ */ new Map();
+    for (const r of records) {
+      await new Promise((resolve7) => setImmediate(resolve7));
+      const done = markPass(`package-index:${r.entry.name}`);
+      try {
+        out2.set(
+          r.id,
+          runLockfilePass({
+            root: r.root,
+            store: r.engine.store,
+            workspaceId: r.id,
+            languages: r.engine.profile.languages,
+            log: (m) => console.log(m)
+          })
+        );
+      } catch (err2) {
+        console.warn(`[errata] package index failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
+      } finally {
+        done();
+      }
+    }
+    return out2;
+  };
+  const daemon = {
+    url: baseUrl,
+    records,
+    sharedStore,
+    attachWorkspace,
+    reindexAll,
+    packageAutoAll,
+    async tickAll() {
+      const out2 = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        const done = markPass(`tick:${r.entry.name}`);
+        try {
+          out2.set(r.id, await r.engine.tick());
+        } catch (err2) {
+          console.warn(`[errata] tick failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
+        } finally {
+          done();
+        }
+      }
+      return out2;
+    },
+    semanticMaintenanceAll() {
+      const out2 = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        const done = markPass(`semantic:${r.entry.name}`);
+        try {
+          out2.set(r.id, r.engine.semanticMaintenance());
+        } catch (err2) {
+          console.warn(
+            `[errata] semantic maintenance failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`
+          );
+        } finally {
+          done();
+        }
+      }
+      return out2;
+    },
+    async nightlyFor(ids) {
+      const want = new Set(ids);
+      const out2 = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        if (!want.has(r.id)) continue;
+        const done = markPass(`nightly:${r.entry.name}`);
+        try {
+          out2.set(r.id, await r.engine.nightly());
+        } catch (err2) {
+          console.warn(`[errata] nightly failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`);
+        } finally {
+          done();
+        }
+      }
+      return out2;
+    },
+    async nightlyAll() {
+      return daemon.nightlyFor(records.map((r) => r.id));
+    },
+    async percolateAll() {
+      const ts = Date.now();
+      const out2 = /* @__PURE__ */ new Map();
+      const repoBasename = (locator) => (locator.split("/").filter(Boolean).pop() ?? locator).toLowerCase();
+      for (const r of records) {
+        const profile = r.engine.profile;
+        const aliases = profile.repoLocatorAliases ?? [];
+        const locator = profile.repoLocator;
+        if (!locator || aliases.length === 0) continue;
+        try {
+          for (const alias of aliases) {
+            if (repoBasename(alias) !== repoBasename(locator)) {
+              console.log(
+                `[errata] project alias NOT auto-migrated for ${r.entry.name} (${alias} \u2192 ${locator}: repo name differs \u2014 a fork/repoint, not a rename). Run scripts/migrate-project-alias.ts if this really is the same repo.`
+              );
+              continue;
+            }
+            const m = migrateProjectAlias(sharedStore, { from: alias, to: locator, ts });
+            if (m.nodesRewritten || m.edgesRewritten) {
+              console.log(
+                `[errata] project alias migrated for ${r.entry.name}: ${alias} \u2192 ${locator} (${m.nodesRewritten} nodes, ${m.edgesRewritten} edges)`
+              );
+            }
+          }
+          delete profile.repoLocatorAliases;
+          const onDisk = loadProfile(r.root);
+          if (onDisk) {
+            delete onDisk.repoLocatorAliases;
+            saveProfile(r.root, onDisk);
+          }
+        } catch (err2) {
+          console.warn(`[errata] project-alias migration failed for ${r.entry.name} (kept for next pass): ${err2 instanceof Error ? err2.message : err2}`);
+        }
+      }
+      let inlineRecords = records;
+      if (consolidateWorker) {
+        const fileBacked = records.filter((r) => r.engine.paths.castalia !== ":memory:");
+        if (fileBacked.length > 0) {
+          try {
+            const res = await consolidateWorker.run({
+              kind: "percolateAll",
+              sharedDbPath,
+              ts,
+              workspaces: fileBacked.map((r) => ({
+                recordId: r.id,
+                // Repo-keyed when linked: two checkouts of one repo are ONE
+                // project in observedInProjects, not two independent
+                // observations (PJ-local — the Q9 independence gate).
+                workspaceId: r.engine.profile.repoLocator ?? r.engine.profile.id,
+                castaliaPath: r.engine.paths.castalia
+              }))
+            });
+            for (const [id, v] of res) out2.set(id, v);
+            inlineRecords = records.filter((r) => r.engine.paths.castalia === ":memory:");
+          } catch (err2) {
+            console.warn(`[errata] percolate worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
+          }
+        }
+      }
+      for (const r of inlineRecords) {
+        const done = markPass(`percolate-inline:${r.entry.name}`);
+        try {
+          out2.set(
+            r.id,
+            percolate(r.engine.store, sharedStore, {
+              workspaceId: r.engine.profile.repoLocator ?? r.engine.profile.id,
+              ts
+            })
+          );
+        } catch (err2) {
+          console.warn(
+            `[errata] percolate failed for ${r.entry.name}: ${err2 instanceof Error ? err2.message : err2}`
+          );
+        } finally {
+          done();
+        }
+      }
+      return out2;
+    },
+    async induceL2Abstractions(touched) {
+      const ctxByWs = /* @__PURE__ */ new Map();
+      for (const r of records) ctxByWs.set(r.engine.profile.id, contextKey(r.engine.profile));
+      const ts = Date.now();
+      if (consolidateWorker) {
+        try {
+          return await consolidateWorker.run({
+            kind: "induceAbstractions",
+            sharedDbPath,
+            ts,
+            ctxByWs: Object.fromEntries(ctxByWs),
+            originMachine: machineId(),
+            ...touched ? { touched: new Set(touched) } : {}
+          });
+        } catch (err2) {
+          console.warn(`[errata] abstraction worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
+        }
+      }
+      return induceAbstractions(sharedStore, {
+        contextOf: (ws) => ctxByWs.get(ws) ?? null,
+        ts,
+        // Source-tag minted principles to this machine so they stay attributable
+        // across the user's machines once L3 sync lands (P4 / §8.6).
+        originMachine: machineId(),
+        ...touched ? { touched } : {}
+      });
+    },
+    async induceL2Triage() {
+      const ctxByWs = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        const p = r.engine.profile;
+        ctxByWs.set(p.id, {
+          features: { stack: [...p.stack].sort().join(","), domain: p.domains[0] ?? p.languages[0] ?? "" }
+        });
+      }
+      const ts = Date.now();
+      if (consolidateWorker) {
+        try {
+          return await consolidateWorker.run({
+            kind: "induceTriage",
+            sharedDbPath,
+            ts,
+            triageCtxByWs: Object.fromEntries(ctxByWs)
+          });
+        } catch (err2) {
+          console.warn(`[errata] triage-induction worker failed \u2014 running inline: ${err2 instanceof Error ? err2.message : err2}`);
+        }
+      }
+      return induceTriage(sharedStore, {
+        contextOf: (ws) => ctxByWs.get(ws) ?? null,
+        ts
+      });
+    },
+    async revisitStaleTriageRoutes() {
+      if (consolidateWorker) {
+        try {
+          return await consolidateWorker.run({ kind: "revisitTriage", sharedDbPath, ts: Date.now() });
+        } catch {
+        }
+      }
+      return revisitStaleRoutes(sharedStore, Date.now());
+    },
+    async revisitStalePrinciples() {
+      if (consolidateWorker) {
+        try {
+          return await consolidateWorker.run({ kind: "revisitPrinciples", sharedDbPath, ts: Date.now() });
+        } catch {
+        }
+      }
+      return revisitContradictedPrinciples(sharedStore, Date.now());
+    },
+    async syncPrinciplesPublic() {
+      if (!loadConfig().consent.sync) return { uploaded: 0, skipped: "consent-off" };
+      const ignore2 = loadClaimIgnorePatterns(globalDir());
+      const primaryLanguage = machineDominantLanguage();
+      const payload = buildPrincipleIngest(sharedStore, DAEMON_VERSION, ignore2, 2, {
+        ...primaryLanguage ? { primaryLanguage } : {}
+      });
+      if (!payload) return { uploaded: 0 };
+      const res = await cloudNow().ingest(payload);
+      return { uploaded: res.accepted };
+    },
+    async syncTriagePublic() {
+      const cfg2 = loadConfig();
+      if (!cfg2.consent.sync) return { uploaded: 0, skipped: "consent-off" };
+      const ignore2 = loadClaimIgnorePatterns(globalDir());
+      const primaryLanguage = machineDominantLanguage();
+      const languages = records.flatMap((r) => r.engine.profile.languages ?? []);
+      const packages = cfg2.consent.contributePackages ? records.flatMap(
+        (r) => r.engine.store.findNodesByLabel("Package").map((p) => ({
+          name: String(p.attrs["name"] ?? ""),
+          purl: String(p.attrs["purl"] ?? p.id)
+        }))
+      ) : [];
+      const tokenAnchors = buildBucketTokenAnchors(languages, packages);
+      const payload = buildTriageIngest(sharedStore, DAEMON_VERSION, ignore2, 2, {
         ...primaryLanguage ? { primaryLanguage } : {},
         tokenAnchors,
         // Scoped bucket keys carry package names — same consent as the purls.
@@ -83733,660 +84150,274 @@ async function startMultiDaemon(opts = {}) {
               // failing every pass. Same total, different bug.
               blockedRepeat,
               rejectedRepeat
-            });
-            return res.accepted;
-          });
-        }
-      }
-      return { uploaded, ...errors.length > 0 ? { errors } : {} };
-    },
-    async backfillCausalEdges() {
-      if (!loadConfig().consent.sync) return { accepted: 0, rejected: 0, skipped: "consent-off" };
-      const client = cloudNow();
-      let accepted = 0;
-      let rejected = 0;
-      const errors = [];
-      for (const r of records) {
-        const payload = buildCausalEdgeBackfill(r.engine.store, r.engine.profile, DAEMON_VERSION);
-        if (!payload) continue;
-        try {
-          const res = await client.ingest(payload);
-          accepted += res.accepted;
-          rejected += res.rejected;
-          if (res.rejected > 0) errors.push(...res.violations.slice(0, 5));
-        } catch (err2) {
-          errors.push(
-            `[${r.engine.profile.name ?? r.engine.profile.id}] backfill: ${err2 instanceof Error ? err2.message : String(err2)}`
-          );
-        }
-      }
-      return { accepted, rejected, ...errors.length > 0 ? { errors } : {} };
-    },
-    async pullTriagePublic() {
-      if (!loadConfig().consent.sync) return { merged: 0, skipped: "consent-off" };
-      const stack = /* @__PURE__ */ new Set();
-      const domains = /* @__PURE__ */ new Set();
-      for (const r of records) {
-        for (const s of r.engine.profile.stack) stack.add(s);
-        for (const d of r.engine.profile.domains) domains.add(d);
-      }
-      const merged = await pullCloudTriage(sharedStore, cloudNow(), {
-        stack: [...stack],
-        domains: [...domains]
-      });
-      return { merged };
-    },
-    async syncPrinciplesPrivate() {
-      if (!loadConfig().consent.sync) return null;
-      return syncPrinciples(sharedStore, cloudNow(), {
-        machine: machineId(),
-        daemonVersion: DAEMON_VERSION,
-        ts: Date.now()
-      });
-    },
-    async syncSkillsAll() {
-      let written = 0;
-      let pruned2 = 0;
-      let stale;
-      for (const r of records) {
-        const s = await r.engine.fetchSkills();
-        written += s.written;
-        pruned2 += s.pruned;
-        if (s.staleDaemon) stale = s.staleDaemon;
-      }
-      const next = pendingFromServerVerdict(
-        stale?.latest,
-        loadConfig().updateChannel
-      );
-      if ((next?.latest ?? null) !== (serverPending?.latest ?? null)) {
-        serverPending = next;
-        for (const rec of records) rec.engine.markContextDirty();
-      }
-      return { written, pruned: pruned2 };
-    },
-    async sessionBoundaryFlush() {
-      if (!settleRunning) {
-        settleRunning = true;
-        try {
-          for (const r of records) {
-            await r.engine.embedSettled();
-          }
-        } finally {
-          settleRunning = false;
-        }
-      }
-      if (boundaryFlushing) return { uploaded: 0, written: 0, pruned: 0, skipped: "in-flight" };
-      beginFlush("instances");
-      try {
-        flushStage("instances");
-        const inst = await daemon.syncInstancesPublic();
-        flushStage("skills");
-        const skills = await daemon.syncSkillsAll();
-        return {
-          uploaded: inst.uploaded,
-          written: skills.written,
-          pruned: skills.pruned,
-          ...inst.errors ? { errors: inst.errors } : {}
-        };
-      } finally {
-        endFlush();
+            });
+            return res.accepted;
+          });
+        }
       }
+      return { uploaded, ...errors.length > 0 ? { errors } : {} };
     },
-    onSessionBoundary(cb) {
-      boundaryListeners.push(cb);
-    },
-    async stop() {
-      clearInterval(idleSweep);
-      clearInterval(codexWake);
-      clearTimeout(codexWakeBoot);
-      try {
-        const cur = readFileSync30(lockPath, "utf8");
-        if (JSON.parse(cur).pid === process.pid) unlinkSync3(lockPath);
-      } catch {
-      }
-      await new Promise(
-        (res) => server.close(res)
-      );
-      updatePoller?.stop();
-      healthSentinel.stop();
-      for (const r of records) await r.engine.stop();
-      if (consolidateWorker) await consolidateWorker.stop();
-      try {
-        sharedStore.close();
-      } catch {
+    async backfillCausalEdges() {
+      if (!loadConfig().consent.sync) return { accepted: 0, rejected: 0, skipped: "consent-off" };
+      const client = cloudNow();
+      let accepted = 0;
+      let rejected = 0;
+      const errors = [];
+      for (const r of records) {
+        const payload = buildCausalEdgeBackfill(r.engine.store, r.engine.profile, DAEMON_VERSION);
+        if (!payload) continue;
+        try {
+          const res = await client.ingest(payload);
+          accepted += res.accepted;
+          rejected += res.rejected;
+          if (res.rejected > 0) errors.push(...res.violations.slice(0, 5));
+        } catch (err2) {
+          errors.push(
+            `[${r.engine.profile.name ?? r.engine.profile.id}] backfill: ${err2 instanceof Error ? err2.message : String(err2)}`
+          );
+        }
       }
-    }
-  };
-  app.post("/api/sync", async (c) => {
-    if (boundaryFlushing) return c.json({ skipped: "in-flight", ...flushSnapshot() }, 409);
-    beginFlush("principles");
-    try {
-      const principles = await daemon.syncPrinciplesPublic();
-      flushStage("triage");
-      const triage = await daemon.syncTriagePublic();
-      flushStage("instances");
-      const instances = await daemon.syncInstancesPublic();
-      flushStage("edge-backfill");
-      const edgeBackfill = await daemon.backfillCausalEdges();
-      return c.json({ principles, triage, instances, edgeBackfill });
-    } catch (err2) {
-      return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 500);
-    } finally {
-      endFlush();
-    }
-  });
-  app.get("/api/sync", (c) => c.json(flushSnapshot()));
-  app.post("/api/tick", async (c) => {
-    try {
-      return c.json({ reports: Object.fromEntries(await daemon.tickAll()) });
-    } catch (err2) {
-      return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 500);
-    }
-  });
-  return daemon;
-}
-
-// src/cli.ts
-init_src5();
-init_git_remote();
-init_config();
-init_src7();
-init_cloud_auth();
-
-// src/agent-switch.ts
-function parseUseArgs(args2) {
-  const positional = [];
-  let clear = false;
-  for (const arg of args2) {
-    if (arg === "--none" || arg === "--clear") {
-      clear = true;
-      continue;
-    }
-    if (arg.startsWith("--")) continue;
-    positional.push(arg);
-  }
-  if (clear) return { kind: "clear" };
-  const handle2 = positional[0];
-  if (!handle2) return { kind: "show" };
-  return { kind: "set", handle: handle2 };
-}
-function normalizeHandle(handle2) {
-  return handle2.trim().replace(/^@/, "").toLowerCase();
-}
-function findActable(agents, handle2) {
-  const want = normalizeHandle(handle2);
-  return agents.find((a) => normalizeHandle(a.handle) === want) ?? null;
-}
-async function runUse(action, ctx) {
-  switch (action.kind) {
-    case "clear":
-      return runClear(ctx);
-    case "show":
-      return runShow(ctx);
-    case "set":
-      return runSet(action.handle, ctx);
-  }
-}
-function runClear(ctx) {
-  const active2 = ctx.getActiveAgent();
-  ctx.clearActiveAgent();
-  if (active2) {
-    ctx.log(`no longer acting as ${active2.handle} \u2014 the daemon acts as your default identity`);
-  } else {
-    ctx.log(`already on the default identity \u2014 nothing to clear`);
-  }
-  return 0;
-}
-async function runShow(ctx) {
-  const active2 = ctx.getActiveAgent();
-  ctx.log(active2 ? `active agent: ${active2.handle} (id ${active2.id})` : `active agent: (default identity)`);
-  if (!ctx.loggedIn) {
-    ctx.log(`  log in to list the agents you can act as:  errata login`);
-    return 0;
-  }
-  let resp;
-  try {
-    resp = await ctx.actableAgents();
-  } catch (err2) {
-    ctx.log(`  couldn't list actable agents: ${errText(err2)}`);
-    return 1;
-  }
-  printActable(resp, active2, ctx);
-  return 0;
-}
-async function runSet(handle2, ctx) {
-  if (!ctx.loggedIn) {
-    ctx.log(`not logged in \u2014 run \`errata login\` first, then \`errata use ${handle2}\``);
-    return 1;
-  }
-  let resp;
-  try {
-    resp = await ctx.actableAgents();
-  } catch (err2) {
-    ctx.log(`couldn't verify \`${handle2}\`: ${errText(err2)}`);
-    return 1;
-  }
-  const match2 = findActable(resp.agents, handle2);
-  if (!match2) {
-    ctx.log(`unknown agent: ${handle2}`);
-    if (resp.agents.length === 0) {
-      ctx.log(`  you can't act as any agents yet.`);
-    } else {
-      ctx.log(`  agents you can act as: ${resp.agents.map((a) => a.handle).join(", ")}`);
-    }
-    return 2;
-  }
-  ctx.setActiveAgent({ handle: match2.handle, id: match2.id });
-  ctx.log(`now acting as ${match2.handle} (id ${match2.id}) \u2014 saved; persists across daemon restarts`);
-  return 0;
-}
-function printActable(resp, active2, ctx) {
-  if (resp.agents.length === 0) {
-    ctx.log(`  (no agents you can act as)`);
-    return;
-  }
-  ctx.log(`  agents you can act as:`);
-  for (const a of resp.agents) {
-    const marks = [];
-    if (active2 && a.id === active2.id) marks.push("active");
-    if (a.id === resp.defaultAgentId) marks.push("default");
-    const suffix = marks.length ? `  (${marks.join(", ")})` : "";
-    const scope = a.scope ? ` \xB7 ${a.scope}` : "";
-    ctx.log(`    ${a.handle}${scope}${suffix}`);
-  }
-}
-function errText(err2) {
-  return err2 instanceof Error ? err2.message : String(err2);
-}
-
-// src/cli.ts
-init_cloud_endpoint_policy();
-
-// src/oauth-login.ts
-init_src7();
-init_cloud_auth();
-import { createServer } from "node:http";
-var DEFAULT_OAUTH_SCOPE = "openid profile graph:read graph:write mcp:tools";
-var strip = (u) => u.replace(/\/+$/, "");
-function deviceEndpoints(tokenEndpoint) {
-  const token = new URL(tokenEndpoint);
-  const authRoot = token.pathname.replace(/\/(?:oauth2|mcp)\/token\/?$/, "");
-  if (authRoot === token.pathname) throw new Error("authorization server exposes no device endpoint");
-  const prefix = authRoot.replace(/\/api\/auth\/?$/, "");
-  const at = (path2) => new URL(`${path2}`, `${token.origin}${prefix || "/"}`).toString();
-  return {
-    code: at(`${prefix}/api/auth/device/code`),
-    token: at(`${prefix}/api/auth/device/token`),
-    resource: at(`${prefix}/api/gate/session-token`)
-  };
-}
-async function loginOAuthDevice(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope })
-  });
-  if (!codeResponse.ok) {
-    throw new Error(`device authorization failed: HTTP ${codeResponse.status} ${(await codeResponse.text()).slice(0, 200)}`);
-  }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("device authorization returned an incomplete response");
-  }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  let deviceSession = null;
-  let approvedInstallation = null;
-  while (Date.now() < deadline) {
-    await (opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
+      return { accepted, rejected, ...errors.length > 0 ? { errors } : {} };
+    },
+    async pullTriagePublic() {
+      if (!loadConfig().consent.sync) return { merged: 0, skipped: "consent-off" };
+      const stack = /* @__PURE__ */ new Set();
+      const domains = /* @__PURE__ */ new Set();
+      for (const r of records) {
+        for (const s of r.engine.profile.stack) stack.add(s);
+        for (const d of r.engine.profile.domains) domains.add(d);
       }
-      throw new Error(`device authorization failed: ${error48}`);
-    }
-    deviceSession = typeof payload?.["access_token"] === "string" ? payload["access_token"] : null;
-    approvedInstallation = typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null;
-    break;
-  }
-  if (!deviceSession || !approvedInstallation) throw new Error("device authorization expired");
-  if (approvedInstallation !== opts.installationId) {
-    throw new Error("approved installation does not match the terminal request");
-  }
-  const resourceResponse = await fetchFn(device.resource, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${deviceSession}`,
-      "content-type": "application/json",
-      accept: "application/json"
+      const merged = await pullCloudTriage(sharedStore, cloudNow(), {
+        stack: [...stack],
+        domains: [...domains]
+      });
+      return { merged };
     },
-    body: JSON.stringify({
-      installationId: approvedInstallation,
-      clientId,
-      scopes: scope.split(/\s+/).filter((value) => !["openid", "profile", "email", "offline_access"].includes(value))
-    })
-  });
-  const resource = await resourceResponse.json().catch(() => null);
-  if (!resourceResponse.ok || typeof resource?.["access_token"] !== "string") {
-    throw new Error(`device resource exchange failed: HTTP ${resourceResponse.status}`);
-  }
-  return {
-    installationId: approvedInstallation,
-    clientId,
-    tokenEndpoint: device.resource,
-    tokens: {
-      accessToken: resource["access_token"],
-      refreshToken: deviceSession,
-      ...typeof resource["expires_in"] === "number" ? { expiresInSec: resource["expires_in"] } : {}
-    }
-  };
-}
-async function discoverEndpoints(cloudUrl, fetchFn = fetch) {
-  let consoleUrl = cloudUrl;
-  try {
-    const prm = await fetchFn(`${strip(cloudUrl)}/.well-known/oauth-protected-resource`);
-    if (prm.ok) {
-      const j = await prm.json();
-      if (j.authorization_servers?.[0]) consoleUrl = j.authorization_servers[0];
-    }
-  } catch {
-  }
-  try {
-    const asm = await fetchFn(`${strip(consoleUrl)}/.well-known/oauth-authorization-server`);
-    if (asm.ok) {
-      const j = await asm.json();
-      if (j.authorization_endpoint && j.token_endpoint) {
+    async syncPrinciplesPrivate() {
+      if (!loadConfig().consent.sync) return null;
+      return syncPrinciples(sharedStore, cloudNow(), {
+        machine: machineId(),
+        daemonVersion: DAEMON_VERSION,
+        ts: Date.now()
+      });
+    },
+    async syncSkillsAll() {
+      let written = 0;
+      let pruned2 = 0;
+      let stale;
+      for (const r of records) {
+        const s = await r.engine.fetchSkills();
+        written += s.written;
+        pruned2 += s.pruned;
+        if (s.staleDaemon) stale = s.staleDaemon;
+      }
+      const next = pendingFromServerVerdict(
+        stale?.latest,
+        loadConfig().updateChannel
+      );
+      if ((next?.latest ?? null) !== (serverPending?.latest ?? null)) {
+        serverPending = next;
+        for (const rec of records) rec.engine.markContextDirty();
+      }
+      return { written, pruned: pruned2 };
+    },
+    async sessionBoundaryFlush() {
+      if (!settleRunning) {
+        settleRunning = true;
+        try {
+          for (const r of records) {
+            await r.engine.embedSettled();
+          }
+        } finally {
+          settleRunning = false;
+        }
+      }
+      if (boundaryFlushing) return { uploaded: 0, written: 0, pruned: 0, skipped: "in-flight" };
+      beginFlush("instances");
+      try {
+        flushStage("instances");
+        const inst = await daemon.syncInstancesPublic();
+        flushStage("skills");
+        const skills = await daemon.syncSkillsAll();
         return {
-          authorizationEndpoint: j.authorization_endpoint,
-          tokenEndpoint: j.token_endpoint,
-          ...j.registration_endpoint ? { registrationEndpoint: j.registration_endpoint } : {}
+          uploaded: inst.uploaded,
+          written: skills.written,
+          pruned: skills.pruned,
+          ...inst.errors ? { errors: inst.errors } : {}
         };
+      } finally {
+        endFlush();
+      }
+    },
+    onSessionBoundary(cb) {
+      boundaryListeners.push(cb);
+    },
+    async stop() {
+      clearInterval(idleSweep);
+      clearInterval(codexWake);
+      clearTimeout(codexWakeBoot);
+      try {
+        const cur = readFileSync30(lockPath, "utf8");
+        if (JSON.parse(cur).pid === process.pid) unlinkSync3(lockPath);
+      } catch {
+      }
+      await new Promise(
+        (res) => server.close(res)
+      );
+      updatePoller?.stop();
+      healthSentinel.stop();
+      for (const r of records) await r.engine.stop();
+      if (consolidateWorker) await consolidateWorker.stop();
+      try {
+        sharedStore.close();
+      } catch {
       }
     }
-  } catch {
-  }
-  const base = strip(consoleUrl);
-  return {
-    authorizationEndpoint: `${base}/api/auth/oauth2/authorize`,
-    tokenEndpoint: `${base}/api/auth/oauth2/token`
   };
-}
-function buildAuthorizeUrl(endpoint, p) {
-  const u = new URL(endpoint);
-  u.searchParams.set("response_type", "code");
-  u.searchParams.set("client_id", p.clientId);
-  u.searchParams.set("redirect_uri", p.redirectUri);
-  u.searchParams.set("scope", p.scope);
-  u.searchParams.set("state", p.state);
-  u.searchParams.set("code_challenge", p.challenge);
-  u.searchParams.set("code_challenge_method", p.method);
-  return u.toString();
-}
-async function loginOAuthLoopback(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const pkce = generatePkce();
-  const state = randomState();
-  const scope = opts.scope ?? DEFAULT_OAUTH_SCOPE;
-  const { code, redirectUri, clientId } = await new Promise(
-    (resolve7, reject) => {
-      const server = createServer((req, res) => {
-        const u = new URL(req.url ?? "/", "http://127.0.0.1");
-        if (u.pathname !== "/callback") {
-          res.writeHead(404);
-          res.end();
-          return;
-        }
-        const addr2 = server.address();
-        const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-        const err2 = u.searchParams.get("error");
-        const code2 = u.searchParams.get("code");
-        const returnedState = u.searchParams.get("state");
-        if (err2 || !code2 || returnedState !== state) {
-          res.writeHead(400, { "content-type": "text/plain" });
-          res.end(`login failed: ${err2 ?? (returnedState !== state ? "state_mismatch" : "no_code")}`);
-          server.close();
-          reject(new Error(err2 ?? "invalid_callback"));
-          return;
-        }
-        res.writeHead(200, { "content-type": "text/html" });
-        res.end("<html><body>inErrata: you're logged in. You can close this tab.</body></html>");
-        server.close();
-        resolve7({ code: code2, redirectUri: `http://127.0.0.1:${port}/callback`, clientId: activeClientId });
-      });
-      let activeClientId = oauthClientId();
-      server.on("error", reject);
-      server.listen(0, "127.0.0.1", () => {
-        void (async () => {
-          try {
-            const addr2 = server.address();
-            const port = typeof addr2 === "object" && addr2 ? addr2.port : 0;
-            const redirectUri2 = `http://127.0.0.1:${port}/callback`;
-            if (endpoints.registrationEndpoint) {
-              const registered = await registerOAuthClient(fetchFn, endpoints.registrationEndpoint, {
-                redirectUri: redirectUri2,
-                scope,
-                clientName: "errata daemon"
-              });
-              activeClientId = registered.clientId;
-            }
-            const url2 = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
-              clientId: activeClientId,
-              redirectUri: redirectUri2,
-              scope,
-              state,
-              challenge: pkce.challenge,
-              method: pkce.method
-            });
-            if (opts.open) opts.open(url2);
-            else console.log(`approve this login in your browser:
-  ${url2}`);
-          } catch (err2) {
-            server.close();
-            reject(err2);
-          }
-        })();
-      });
-      if (opts.timeoutMs) {
-        setTimeout(() => {
-          server.close();
-          reject(new Error("login timed out \u2014 run `errata login` again"));
-        }, opts.timeoutMs).unref?.();
-      }
+  app.post("/api/sync", async (c) => {
+    if (boundaryFlushing) return c.json({ skipped: "in-flight", ...flushSnapshot() }, 409);
+    beginFlush("principles");
+    try {
+      const principles = await daemon.syncPrinciplesPublic();
+      flushStage("triage");
+      const triage = await daemon.syncTriagePublic();
+      flushStage("instances");
+      const instances = await daemon.syncInstancesPublic();
+      flushStage("edge-backfill");
+      const edgeBackfill = await daemon.backfillCausalEdges();
+      return c.json({ principles, triage, instances, edgeBackfill });
+    } catch (err2) {
+      return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 500);
+    } finally {
+      endFlush();
+    }
+  });
+  app.get("/api/sync", (c) => c.json(flushSnapshot()));
+  app.post("/api/tick", async (c) => {
+    try {
+      return c.json({ reports: Object.fromEntries(await daemon.tickAll()) });
+    } catch (err2) {
+      return c.json({ error: err2 instanceof Error ? err2.message : String(err2) }, 500);
     }
-  );
-  const tokens = await exchangeAuthorizationCode(fetchFn, endpoints.tokenEndpoint, {
-    code,
-    codeVerifier: pkce.verifier,
-    redirectUri,
-    clientId
   });
-  return { tokens, tokenEndpoint: endpoints.tokenEndpoint, clientId };
+  return daemon;
 }
 
-// src/link-flow.ts
+// src/cli.ts
+init_src5();
+init_git_remote();
+init_config();
+init_src7();
 init_cloud_auth();
-import { createHash as createHash15 } from "node:crypto";
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync31, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join35 } from "node:path";
-function remoteFingerprint(locator) {
-  return createHash15("sha256").update(locator).digest("hex");
+
+// src/agent-switch.ts
+function parseUseArgs(args2) {
+  const positional = [];
+  let clear = false;
+  for (const arg of args2) {
+    if (arg === "--none" || arg === "--clear") {
+      clear = true;
+      continue;
+    }
+    if (arg.startsWith("--")) continue;
+    positional.push(arg);
+  }
+  if (clear) return { kind: "clear" };
+  const handle2 = positional[0];
+  if (!handle2) return { kind: "show" };
+  return { kind: "set", handle: handle2 };
 }
-function isDecision(value) {
-  if (!value || typeof value !== "object") return false;
-  const v = value;
-  return typeof v["projectId"] === "string" && typeof v["locator"] === "string" && (v["visibility"] === "public" || v["visibility"] === "private") && typeof v["consents"] === "object" && v["consents"] !== null;
+function normalizeHandle(handle2) {
+  return handle2.trim().replace(/^@/, "").toLowerCase();
 }
-async function linkThroughConsole(opts) {
-  const fetchFn = opts.fetchFn ?? fetch;
-  const endpoints = await discoverEndpoints(opts.cloudUrl, fetchFn);
-  const device = deviceEndpoints(endpoints.tokenEndpoint);
-  const clientId = oauthClientId();
-  const link = {
-    locator: opts.facts.locator,
-    remoteFingerprint: remoteFingerprint(opts.facts.locator),
-    ...opts.facts.name ? { name: opts.facts.name } : {},
-    ...opts.facts.rootCommitSha ? { rootCommitSha: opts.facts.rootCommitSha } : {},
-    ...opts.facts.installationId ? { installationId: opts.facts.installationId } : {},
-    ...opts.facts.agents && opts.facts.agents.length > 0 ? { agents: opts.facts.agents.slice(0, 12) } : {},
-    ...typeof opts.facts.commitCount === "number" ? { commitCount: opts.facts.commitCount } : {}
-  };
-  const codeResponse = await fetchFn(device.code, {
-    method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json" },
-    body: JSON.stringify({ client_id: clientId, scope: "project:link", link })
-  });
-  if (!codeResponse.ok) {
-    const text = (await codeResponse.text()).slice(0, 200);
-    if (codeResponse.status === 404) {
-      throw new Error("this console does not offer the link flow yet (device authorization is off)");
-    }
-    throw new Error(`link request failed: HTTP ${codeResponse.status} ${text}`);
+function findActable(agents, handle2) {
+  const want = normalizeHandle(handle2);
+  return agents.find((a) => normalizeHandle(a.handle) === want) ?? null;
+}
+async function runUse(action, ctx) {
+  switch (action.kind) {
+    case "clear":
+      return runClear(ctx);
+    case "show":
+      return runShow(ctx);
+    case "set":
+      return runSet(action.handle, ctx);
   }
-  const code = await codeResponse.json();
-  if (!code.device_code || !code.user_code || !code.verification_uri || !code.expires_in) {
-    throw new Error("link request returned an incomplete response");
+}
+function runClear(ctx) {
+  const active2 = ctx.getActiveAgent();
+  ctx.clearActiveAgent();
+  if (active2) {
+    ctx.log(`no longer acting as ${active2.handle} \u2014 the daemon acts as your default identity`);
+  } else {
+    ctx.log(`already on the default identity \u2014 nothing to clear`);
   }
-  opts.onVerification?.({
-    url: code.verification_uri_complete ?? code.verification_uri,
-    userCode: code.user_code,
-    expiresInSec: code.expires_in
-  });
-  const deadline = Date.now() + Math.min(code.expires_in * 1e3, opts.timeoutMs ?? Number.POSITIVE_INFINITY);
-  let intervalMs = Math.max(2, code.interval ?? 5) * 1e3;
-  const sleep = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  while (Date.now() < deadline) {
-    await sleep(intervalMs);
-    const poll = await fetchFn(device.token, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: code.device_code,
-        client_id: clientId
-      })
-    });
-    const payload = await poll.json().catch(() => null);
-    if (!poll.ok) {
-      const error48 = typeof payload?.["error"] === "string" ? payload["error"] : "device_poll_failed";
-      if (error48 === "authorization_pending") continue;
-      if (error48 === "slow_down") {
-        intervalMs += 5e3;
-        continue;
-      }
-      if (error48 === "access_denied") return { status: "denied" };
-      if (error48 === "expired_token") return { status: "expired" };
-      throw new Error(`link approval failed: ${error48}`);
-    }
-    const decision = payload?.["link"];
-    if (!isDecision(decision)) {
-      throw new Error("the console approved the device but returned no link decision");
-    }
-    return {
-      status: "approved",
-      decision,
-      installationId: typeof payload?.["installation_id"] === "string" ? payload["installation_id"] : null
-    };
+  return 0;
+}
+async function runShow(ctx) {
+  const active2 = ctx.getActiveAgent();
+  ctx.log(active2 ? `active agent: ${active2.handle} (id ${active2.id})` : `active agent: (default identity)`);
+  if (!ctx.loggedIn) {
+    ctx.log(`  log in to list the agents you can act as:  errata login`);
+    return 0;
   }
-  return { status: "expired" };
+  let resp;
+  try {
+    resp = await ctx.actableAgents();
+  } catch (err2) {
+    ctx.log(`  couldn't list actable agents: ${errText(err2)}`);
+    return 1;
+  }
+  printActable(resp, active2, ctx);
+  return 0;
 }
-function collectRepoFacts(root) {
-  const git3 = (args2) => {
-    try {
-      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    } catch {
-      return null;
+async function runSet(handle2, ctx) {
+  if (!ctx.loggedIn) {
+    ctx.log(`not logged in \u2014 run \`errata login\` first, then \`errata use ${handle2}\``);
+    return 1;
+  }
+  let resp;
+  try {
+    resp = await ctx.actableAgents();
+  } catch (err2) {
+    ctx.log(`couldn't verify \`${handle2}\`: ${errText(err2)}`);
+    return 1;
+  }
+  const match2 = findActable(resp.agents, handle2);
+  if (!match2) {
+    ctx.log(`unknown agent: ${handle2}`);
+    if (resp.agents.length === 0) {
+      ctx.log(`  you can't act as any agents yet.`);
+    } else {
+      ctx.log(`  agents you can act as: ${resp.agents.map((a) => a.handle).join(", ")}`);
     }
-  };
-  const roots = git3(["rev-list", "--max-parents=0", "HEAD"]);
-  const count = git3(["rev-list", "--count", "HEAD"]);
-  const rootCommitSha = roots?.split(/\s+/).filter(Boolean).pop();
-  const commitCount = count && /^\d+$/.test(count) ? Number(count) : void 0;
-  return {
-    ...rootCommitSha && /^[0-9a-f]{40,64}$/i.test(rootCommitSha) ? { rootCommitSha } : {},
-    ...typeof commitCount === "number" ? { commitCount } : {}
-  };
+    return 2;
+  }
+  ctx.setActiveAgent({ handle: match2.handle, id: match2.id });
+  ctx.log(`now acting as ${match2.handle} (id ${match2.id}) \u2014 saved; persists across daemon restarts`);
+  return 0;
 }
-var IGNORE_STARTER = `# .errataignore \u2014 the hard control over what errata may read or send.
-# Paths, content keywords and tags listed here are dropped from hunks and
-# narrative before anything leaves this machine, and an ignored path yields no
-# symbol anchor at all. Scrubbing is best effort; this list is absolute.
-# A personal list can only add to the organization's list, never weaken it.
-
-# secrets and environment
-.env
-.env.*
-*.pem
-*.key
-*.p12
-secrets/
-credentials*
-
-# fixtures and captured data
-fixtures/
-**/testdata/
-*.dump
-*.sql.gz
-`;
-function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
-  const c = decision.consents;
-  const nextConfig = {
-    ...config2,
-    consent: {
-      ...config2.consent,
-      sync: c.sync !== "off",
-      telemetry: c.telemetry,
-      contributePackages: c.packages && c.sync !== "off"
-    },
-    onboardedAt: config2.onboardedAt ?? now()
-  };
-  const nextProfile = {
-    ...profile,
-    syncConsent: c.sync === "automatic" ? "automatic" : c.sync === "ask" ? "ask-each-time" : "disabled",
-    projectId: decision.projectId,
-    projectLocator: decision.locator,
-    linkConsents: {
-      structure: c.structure,
-      mineHistory: c.mineHistory,
-      contributeHistory: c.contributeHistory && c.sync !== "off",
-      decidedAt: decision.approvedAt
-    }
-  };
-  delete nextProfile.projectLinkDisabled;
-  let wroteIgnore = false;
-  if (decision.writeIgnoreStarter !== false) {
-    const target = join35(root, ".errataignore");
-    if (!existsSync31(target)) {
-      writeFileSync23(target, IGNORE_STARTER, "utf8");
-      wroteIgnore = true;
-    }
+function printActable(resp, active2, ctx) {
+  if (resp.agents.length === 0) {
+    ctx.log(`  (no agents you can act as)`);
+    return;
+  }
+  ctx.log(`  agents you can act as:`);
+  for (const a of resp.agents) {
+    const marks = [];
+    if (active2 && a.id === active2.id) marks.push("active");
+    if (a.id === resp.defaultAgentId) marks.push("default");
+    const suffix = marks.length ? `  (${marks.join(", ")})` : "";
+    const scope = a.scope ? ` \xB7 ${a.scope}` : "";
+    ctx.log(`    ${a.handle}${scope}${suffix}`);
   }
-  return { profile: nextProfile, config: nextConfig, wroteIgnore };
 }
+function errText(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+
+// src/cli.ts
+init_cloud_endpoint_policy();
 
 // src/device-login.ts
 init_src7();
@@ -86070,6 +86101,13 @@ async function cmdLink(args2) {
       }
       const consents = historyConsents(applied.profile);
       const reported = await reportHistoryStage(authedCloudClient(applied.config), applied.profile, (line) => console.warn(line));
+      if (reported?.consents) {
+        const synced = applyConsents(applied.profile, applied.config, reported.consents, (/* @__PURE__ */ new Date()).toISOString());
+        if (synced.changed) {
+          saveProfile(ROOT, synced.profile);
+          saveConfig(synced.config);
+        }
+      }
       if (!consents.mineHistory) console.log("history: not mined (consent off)");
       else if (reported?.stopRequested) console.log("history: a stop request is standing in the console; the daemon honours it");
       else console.log(`history: consents recorded${consents.contributeHistory ? "" : " (mine only)"} \xB7 the daemon walks the repo on its next pass`);