@integrity-labs/agt-cli 0.27.9-test.13 → 0.27.9-test.14

package/dist/lib/manager-worker.js

@@ -12,52 +12,52 @@ import {
   getHostId,
   getIntegration,
   provision,
+  provisionAutoKanbanProgressHook,
   provisionIsolationHook,
   provisionOrientHook,
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-VNIHFGA2.js";
+} from "../chunk-R7NKCGWN.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
   loadSchedulerState,
   markTaskFired,
   syncTasksToScheduler
-} from "../chunk-HR5T2RQF.js";
+} from "../chunk-I3YS5WFV.js";
 import {
   buildAllowedTools,
   checkChannelInputs,
   creditWatchdogGiveUpCount,
+  expandTemplateVars,
   formatMissingVar,
   getLastFailureContext,
   getProjectDir,
   getSessionState,
   injectMessage,
   injectMessageWithStatus,
-  isAgentIdle,
   isAgentPromptReady,
   isSessionHealthy,
-  isStaleForToday,
   paneLogPath,
   parseEnvIntegrations,
-  peekCurrentSession,
   prepareForRespawn,
   probeMcpEnvSubstitution,
   readPaneLogTail,
   resetRestartCount,
   resolveClaudeBinary,
+  rotateSessionForWedge,
   sanitizeMcpJson,
   sendToAgent,
-  sessionTranscriptDir,
   startPersistentSession,
   stopAllSessionsAndWait,
   stopPersistentSession,
   takeWatchdogGiveUpCount,
   takeZombieDetection
-} from "../chunk-MQJ5DMPT.js";
+} from "../chunk-7GKJZBTB.js";
 import {
   KANBAN_CHECK_COMMAND,
+  MAX_AVATAR_ENV_URL_BYTES,
   SUPPRESS_SENTINEL,
   appendDmFooter,
   attributeTranscriptUsageByRun,
@@ -74,12 +74,22 @@ import {
   parseDeliveryTarget,
   parseTranscriptUsage,
   parseUsageBanner,
+  probeComposioAccount,
+  probeComposioMcpToolCall,
   probeHttpProvider,
+  resolveAvatarEnvUrl,
   resolveChannels,
   resolveConnectivityProbe,
   resolveDmTarget,
+  worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "../chunk-I2OTQJH3.js";
+} from "../chunk-WOOYOAPG.js";
+import {
+  isAgentIdle,
+  isStaleForToday,
+  peekCurrentSession,
+  sessionTranscriptDir
+} from "../chunk-354FAVQR.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -123,6 +133,25 @@ function channelSecretValueHash(envEntries, channelSecretKeys) {
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);
 }
 
+// src/lib/mcp-restart-verify.ts
+var RESTART_VERIFY_DEADLINE_MS = 9e4;
+var RESTART_VERIFY_MAX_ATTEMPTS = 3;
+function decidePostRestartVerification(pending, sessionStartedAt, sessionHealthy, sessionRespawnId, now, opts = {}) {
+  const deadlineMs = opts.deadlineMs ?? RESTART_VERIFY_DEADLINE_MS;
+  const maxAttempts = opts.maxAttempts ?? RESTART_VERIFY_MAX_ATTEMPTS;
+  if (sessionStartedAt !== null && sessionStartedAt > pending.firedAt && sessionHealthy && sessionRespawnId !== null) {
+    return { kind: "verified" };
+  }
+  if (now - pending.firedAt < deadlineMs) {
+    return { kind: "waiting" };
+  }
+  const attempt = pending.attempts + 1;
+  return { kind: "unverified", attempt, final: attempt >= maxAttempts };
+}
+function shouldRemediateUnverifiedRestart(outcome, ctx) {
+  return ctx.enabled && !ctx.breakerTripped && outcome.kind === "unverified" && outcome.final;
+}
+
 // src/lib/integration-hash.ts
 import { createHash as createHash2 } from "crypto";
 function canonicalize(value) {
@@ -482,14 +511,14 @@ function reapMissingMcpSessions(args) {
     if (!missingRaw.includes(key)) liveKeys.add(key);
   }
   for (const key of liveKeys) {
-    const state6 = presenceReaperState.get(stateKey(codeName, key));
-    if (state6) {
-      state6.attempts = 0;
-      state6.lastSeenLiveAt = now();
-      state6.lastAttemptedSessionStartedAt = null;
-      state6.gaveUpLogged = false;
-      state6.firstMissingAt = null;
-      state6.quarantineLogged = false;
+    const state7 = presenceReaperState.get(stateKey(codeName, key));
+    if (state7) {
+      state7.attempts = 0;
+      state7.lastSeenLiveAt = now();
+      state7.lastAttemptedSessionStartedAt = null;
+      state7.gaveUpLogged = false;
+      state7.firstMissingAt = null;
+      state7.quarantineLogged = false;
     }
   }
   if (missing.length === 0) {
@@ -507,7 +536,7 @@ function reapMissingMcpSessions(args) {
   const wouldQuarantine = [];
   for (const key of missing) {
     const sk = stateKey(codeName, key);
-    const state6 = presenceReaperState.get(sk) ?? {
+    const state7 = presenceReaperState.get(sk) ?? {
       attempts: 0,
       lastSeenLiveAt: null,
       lastAttemptedSessionStartedAt: null,
@@ -515,19 +544,19 @@ function reapMissingMcpSessions(args) {
       firstMissingAt: null,
       quarantineLogged: false
     };
-    if (state6.firstMissingAt === null) state6.firstMissingAt = nowMs;
-    if (state6.lastAttemptedSessionStartedAt !== sessionStartedAt) {
-      state6.attempts += 1;
-      state6.lastAttemptedSessionStartedAt = sessionStartedAt;
+    if (state7.firstMissingAt === null) state7.firstMissingAt = nowMs;
+    if (state7.lastAttemptedSessionStartedAt !== sessionStartedAt) {
+      state7.attempts += 1;
+      state7.lastAttemptedSessionStartedAt = sessionStartedAt;
     }
-    presenceReaperState.set(sk, state6);
-    if (state6.attempts > MAX_PRESENCE_RESTART_ATTEMPTS) {
+    presenceReaperState.set(sk, state7);
+    if (state7.attempts > MAX_PRESENCE_RESTART_ATTEMPTS) {
       givenUp.push(key);
-      if (!state6.gaveUpLogged) {
+      if (!state7.gaveUpLogged) {
         log2(
           `[mcp-presence-reaper] giving up on '${codeName}:${key}' after ${MAX_PRESENCE_RESTART_ATTEMPTS} consecutive failed restarts \u2014 declared but never recovers (likely orphaned config; see ENG-5279)`
         );
-        state6.gaveUpLogged = true;
+        state7.gaveUpLogged = true;
         if (onGiveUp) {
           try {
             onGiveUp(codeName, key);
@@ -538,10 +567,10 @@ function reapMissingMcpSessions(args) {
           }
         }
       }
-      if (quarantineMode !== "off" && !state6.quarantineLogged && classifyKey(key) === "optional") {
-        const dwellElapsed = quarantineDwellMs <= 0 || state6.firstMissingAt !== null && nowMs - state6.firstMissingAt >= quarantineDwellMs;
+      if (quarantineMode !== "off" && !state7.quarantineLogged && classifyKey(key) === "optional") {
+        const dwellElapsed = quarantineDwellMs <= 0 || state7.firstMissingAt !== null && nowMs - state7.firstMissingAt >= quarantineDwellMs;
         if (dwellElapsed) {
-          state6.quarantineLogged = true;
+          state7.quarantineLogged = true;
           if (quarantineMode === "enforce") {
             quarantined.push(key);
             log2(
@@ -706,12 +735,15 @@ function extractMsTeamsBehaviourSubset(config2) {
 // src/lib/slack-behaviour-restart.ts
 function extractSlackBehaviourSubset(config2) {
   const rawAllowed = config2?.["allowed_users"];
+  const blockKitEnabled = config2?.["block_kit_enabled"] === true;
   return {
     thread_auto_follow: config2?.["thread_auto_follow"] ?? "off",
     channel_response_mode: config2?.["channel_response_mode"] ?? "mention_only",
     // Mirror the adapter's defensive filter exactly — a malformed entry the
     // adapter would drop must not count as an env change.
-    allowed_users: Array.isArray(rawAllowed) ? rawAllowed.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : []
+    allowed_users: Array.isArray(rawAllowed) ? rawAllowed.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [],
+    block_kit_enabled: blockKitEnabled,
+    block_kit_ask_user_enabled: blockKitEnabled && config2?.["block_kit_ask_user_enabled"] === true
   };
 }
 
@@ -965,6 +997,135 @@ function formatStatusMessage(events, windowMs) {
   return `Circuit breaker tripped: ${events.length} restarts in ${windowLabel} (${breakdown}); most recent=${last.reason} at ${new Date(last.at).toISOString()}`;
 }
 
+// src/lib/mcp-flap-dampener.ts
+var DEFAULT_WINDOW_MS2 = 6e5;
+var DEFAULT_MIN_TRANSITIONS = 4;
+var DEFAULT_MIN_DISTINCT = 2;
+function readEnvNumber2(name, fallback) {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function membershipSignature(keys) {
+  return [...new Set(keys)].sort().join(",");
+}
+var McpFlapDampener = class {
+  windowMs;
+  minTransitions;
+  minDistinct;
+  now;
+  history = /* @__PURE__ */ new Map();
+  flapping = /* @__PURE__ */ new Set();
+  constructor(opts = {}) {
+    this.windowMs = opts.windowMs ?? readEnvNumber2("AGT_MCP_FLAP_WINDOW_MS", DEFAULT_WINDOW_MS2);
+    this.minTransitions = opts.minTransitions ?? readEnvNumber2("AGT_MCP_FLAP_MIN_TRANSITIONS", DEFAULT_MIN_TRANSITIONS);
+    this.minDistinct = opts.minDistinct ?? readEnvNumber2("AGT_MCP_FLAP_MIN_DISTINCT", DEFAULT_MIN_DISTINCT);
+    this.now = opts.now ?? Date.now;
+    if (!Number.isFinite(this.windowMs) || this.windowMs < 1e3) {
+      throw new Error("mcp-flap-dampener windowMs must be a finite number >= 1000");
+    }
+    if (!Number.isFinite(this.minTransitions) || this.minTransitions < 2) {
+      throw new Error("mcp-flap-dampener minTransitions must be a finite number >= 2");
+    }
+    if (!Number.isFinite(this.minDistinct) || this.minDistinct < 2) {
+      throw new Error("mcp-flap-dampener minDistinct must be a finite number >= 2");
+    }
+  }
+  key(codeName, channel) {
+    return `${codeName}\0${channel}`;
+  }
+  /**
+   * Record an observed membership signature for (codeName, channel) and return
+   * the current flap decision. Call this on every poll where the manager has
+   * computed the desired set — including unchanged polls — so a set that has
+   * gone quiet ages out of the window and the channel recovers.
+   */
+  record(codeName, channel, signature) {
+    const k = this.key(codeName, channel);
+    const at = this.now();
+    const cutoff = at - this.windowMs;
+    const prior = (this.history.get(k) ?? []).filter((o) => o.at >= cutoff);
+    prior.push({ sig: signature, at });
+    this.history.set(k, prior);
+    let transitions = 0;
+    for (let i = 1; i < prior.length; i++) {
+      if (prior[i].sig !== prior[i - 1].sig) transitions++;
+    }
+    const distinctStates = new Set(prior.map((o) => o.sig)).size;
+    const revisited = prior.slice(0, -1).some((o, i) => o.sig === signature && i !== prior.length - 2);
+    const transitionNow = prior.length >= 2 && prior[prior.length - 1].sig !== prior[prior.length - 2].sig;
+    const oscillating = transitions >= this.minTransitions && distinctStates >= this.minDistinct && revisited;
+    const wasFlapping = this.flapping.has(k);
+    let onset = false;
+    if (wasFlapping) {
+      if (!transitionNow) this.flapping.delete(k);
+    } else if (transitionNow && oscillating) {
+      this.flapping.add(k);
+      onset = true;
+    }
+    return {
+      flapping: this.flapping.has(k),
+      distinctStates,
+      transitions,
+      windowCount: prior.length,
+      onset
+    };
+  }
+  /** True if (codeName, channel) is currently dampened. */
+  isFlapping(codeName, channel) {
+    return this.flapping.has(this.key(codeName, channel));
+  }
+  /** Drop all state for an agent (called on deprovision / agent removal). */
+  forget(codeName) {
+    const prefix = `${codeName}\0`;
+    for (const k of [...this.history.keys()]) {
+      if (k.startsWith(prefix)) this.history.delete(k);
+    }
+    for (const k of [...this.flapping]) {
+      if (k.startsWith(prefix)) this.flapping.delete(k);
+    }
+  }
+};
+var FLAP_CHANNEL_INTEGRATIONS = "integrations";
+var FLAP_CHANNEL_MANAGED_MCP = "managed-mcp";
+
+// src/lib/auto-resume.ts
+var DEFAULT_QUIET_MS = 18e5;
+var DEFAULT_BACKOFF_RESET_MS = 864e5;
+function readAutoResumeConfig(env = process.env) {
+  const raw = (env["AGT_AUTO_RESUME_ENABLED"] ?? "").trim().toLowerCase();
+  return {
+    enabled: raw === "1" || raw === "true" || raw === "yes" || raw === "on",
+    quietMs: readEnvNumber("AGT_AUTO_RESUME_QUIET_MS", DEFAULT_QUIET_MS),
+    backoffResetMs: readEnvNumber("AGT_AUTO_RESUME_BACKOFF_RESET_MS", DEFAULT_BACKOFF_RESET_MS)
+  };
+}
+function decideAutoResume(opts) {
+  const { trip, marker, config: config2, now } = opts;
+  if (!config2.enabled) return { action: "skip", reason: "disabled" };
+  if (!trip) return { action: "skip", reason: "no-trip" };
+  if (marker && now - marker.autoResumedAt < config2.backoffResetMs) {
+    return { action: "skip", reason: "already-auto-resumed" };
+  }
+  const lastEventAt = trip.eventsAtTrip.length > 0 ? Math.max(trip.trippedAt, ...trip.eventsAtTrip.map((e) => e.at)) : trip.trippedAt;
+  const quietFor = now - lastEventAt;
+  if (quietFor < config2.quietMs) {
+    return { action: "skip", reason: "not-quiet-yet", remainingMs: config2.quietMs - quietFor };
+  }
+  return { action: "resume", quietMs: quietFor };
+}
+function hydrateAutoResumeMarkers(saved) {
+  const map = /* @__PURE__ */ new Map();
+  if (!saved) return map;
+  for (const [codeName, rec] of Object.entries(saved)) {
+    if (rec && typeof rec.trippedAt === "number" && typeof rec.autoResumedAt === "number") {
+      map.set(codeName, rec);
+    }
+  }
+  return map;
+}
+
 // src/lib/model-change-respawn.ts
 function shouldRespawnForModelChange(input) {
   const { previousModel, primaryModel, framework, sessionHealthy } = input;
@@ -980,7 +1141,12 @@ async function executeConnectivityProbe(target, deps = {}) {
   const descriptor = resolveConnectivityProbe({
     definitionId: target.definitionId,
     sourceType: target.sourceType,
-    authType: target.authType
+    authType: target.authType,
+    // ENG-6242: carry the toolkit's connectivity_test override so a managed
+    // descriptor surfaces `probeTool`/`probeArgs` (the prescribed read-only tool)
+    // — without this the hourly probe auto-picked a different tool than the Test
+    // path, the false-RED that flagged every managed Linear install "unreachable".
+    connectivityTest: target.connectivityTest ?? null
   });
   if (!descriptor.readOnly) {
     throw new Error(`Refusing non-read-only probe for ${target.definitionId}`);
@@ -991,6 +1157,35 @@ async function executeConnectivityProbe(target, deps = {}) {
     case "composio_account":
       if (!deps.composioProbe) return null;
       return deps.composioProbe(target.definitionId, target.credentials);
+    case "managed_composite": {
+      const outcomes = [];
+      if (deps.mcpProbe) {
+        outcomes.push(
+          await deps.mcpProbe({
+            serverKey: target.mcpServerKey ?? target.definitionId,
+            definitionId: target.definitionId
+          })
+        );
+      }
+      if (deps.composioProbe) {
+        outcomes.push(await deps.composioProbe(target.definitionId, target.credentials));
+      }
+      if (deps.composioToolCallProbe) {
+        const toolCall = await deps.composioToolCallProbe({
+          serverKey: target.mcpServerKey ?? target.definitionId,
+          definitionId: target.definitionId,
+          // ENG-6242: thread the prescribed tool through to the live tool-call
+          // leg. resolveConnectivityProbe only sets these for managed toolkits
+          // with a stored override; the probe re-validates read-only and falls
+          // back to auto-pick on drift, so a missing/invalid override is safe.
+          toolName: descriptor.probeTool ?? null,
+          toolArgs: descriptor.probeArgs ?? null
+        });
+        if (toolCall) outcomes.push(toolCall);
+      }
+      if (outcomes.length === 0) return null;
+      return outcomes.reduce((acc, o) => worseConnectivityOutcome(acc, o));
+    }
     case "mcp_tools_list":
       if (!deps.mcpProbe) return null;
       return deps.mcpProbe({
@@ -1038,7 +1233,8 @@ async function runConnectivityProbes(integrations, options = {}) {
       authType: integ.auth_type ?? null,
       credentials: integ.credentials ?? {},
       cliBinary: integ.cli_binary,
-      mcpServerKey: integ.mcp_server_key
+      mcpServerKey: integ.mcp_server_key,
+      connectivityTest: integ.connectivity_test ?? null
     };
     let outcome;
     try {
@@ -1926,14 +2122,173 @@ function readRecentTurns(dir, nowMs) {
   return turns;
 }
 
+// src/lib/memory-extractor.ts
+var MIN_CHECK_INTERVAL_MS4 = 10 * 6e4;
+var WINDOW_PAD_MS2 = 5 * 6e4;
+var VALID_MEMORY_TYPES = /* @__PURE__ */ new Set(["user", "feedback", "project", "reference"]);
+var SECRET_PATTERNS = [
+  // labelled secrets: `api_key=...`, `password: ...`, `bearer ...`
+  /\b[\w-]*(?:secret|password|passwd|token|api[_-]?key|bearer)[\w-]*\s*[=:]\s*\S+/gi,
+  // common credential prefixes (stripe, github, slack, augmented host keys, …)
+  /\b(?:sk|pk|rk|tlk|ghp|gho|ghs|xox[baprs])[-_][A-Za-z0-9]{12,}\b/g,
+  // long hex blobs (hashes / hex-encoded keys)
+  /\b[A-Fa-f0-9]{32,}\b/g,
+  // long base64 blobs (tokens / encoded secrets)
+  /\b[A-Za-z0-9+/]{40,}={0,2}\b/g,
+  // email addresses
+  /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g
+];
+function scrubSensitive(text) {
+  let out = text;
+  for (const re of SECRET_PATTERNS) out = out.replace(re, "[redacted]");
+  return out;
+}
+var state4 = /* @__PURE__ */ new Map();
+function buildExtractionPrompt(channel, transcript) {
+  return `You are extracting durable, reusable memories from one completed ${channel} conversation between an AI agent and an end-user. A good memory is a stable preference, fact, correction, or recurring work context that will help the agent in FUTURE conversations \u2014 not a one-off task detail or pleasantry.
+
+Conversation transcript:
+"""
+${transcript}
+"""
+
+Extract 0-5 candidate memories. For each:
+- name: short descriptive title (max 50 chars)
+- content: the memory itself, self-contained (max 200 chars). Do NOT include secrets or sensitive personal data.
+- type: "user" (a person's stable preference), "feedback" (a correction to how the agent should work), "project" (durable work context), or "reference" (a pointer to an external resource)
+- confidence: 0.0-1.0 \u2014 how sure you are this is worth remembering long-term
+- rationale: why this should persist (max 100 chars)
+
+If there is nothing durable worth remembering, return an empty array. Do NOT invent memories to fill the list.
+
+Respond with ONLY a JSON array, no other text:
+[{"name":"...","content":"...","type":"...","confidence":0.8,"rationale":"..."}]`;
+}
+function parseCandidates(raw) {
+  const match = raw.match(/\[[\s\S]*\]/);
+  if (!match) return null;
+  let arr;
+  try {
+    arr = JSON.parse(match[0]);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(arr)) return null;
+  const out = [];
+  for (const entry of arr) {
+    if (!entry || typeof entry !== "object") continue;
+    const c = entry;
+    const name = typeof c.name === "string" ? c.name.trim() : "";
+    if (!name) continue;
+    if (typeof c.type !== "string" || !VALID_MEMORY_TYPES.has(c.type)) continue;
+    const confidence = typeof c.confidence === "number" && Number.isFinite(c.confidence) ? Math.max(0, Math.min(1, c.confidence)) : 0;
+    if (confidence === 0) continue;
+    out.push({
+      name: name.slice(0, 80),
+      content: (typeof c.content === "string" ? c.content : "").trim().slice(0, 500),
+      type: c.type,
+      confidence,
+      rationale: (typeof c.rationale === "string" ? c.rationale : "").trim().slice(0, 200)
+    });
+  }
+  return out;
+}
+async function maybeExtractMemories(args) {
+  const { api: api2, backend, codeName, agentId, log: log2 } = args;
+  const now = args.now ?? /* @__PURE__ */ new Date();
+  const nowMs = now.getTime();
+  const existing = state4.get(codeName);
+  if (existing && nowMs - existing.lastCheckedAt < MIN_CHECK_INTERVAL_MS4) {
+    return;
+  }
+  state4.set(codeName, { lastCheckedAt: nowMs });
+  let pending;
+  try {
+    const resp = await api2.get(
+      `/host/memories/pending-extraction?agent_id=${encodeURIComponent(agentId)}`
+    );
+    pending = resp?.conversations ?? [];
+  } catch (err) {
+    log2(`[memory-extract] ${codeName}: pending fetch failed: ${err.message}`);
+    return;
+  }
+  if (pending.length === 0) return;
+  const dir = args.transcriptDir ?? sessionTranscriptDir(getProjectDir(codeName));
+  const allTurns = readRecentTurns(dir, nowMs);
+  if (allTurns.length === 0) {
+    for (const conv of pending) {
+      await reportSkip2(api2, agentId, conv.conversation_id, log2, codeName);
+    }
+    return;
+  }
+  for (const conv of pending) {
+    const tokens = channelRefTokens(conv.channel_ref);
+    const windowStart = Date.parse(conv.started_at) - WINDOW_PAD_MS2;
+    const windowEnd = Date.parse(conv.last_message_at) + WINDOW_PAD_MS2;
+    const turns = reconstructConversation(allTurns, tokens, windowStart, windowEnd);
+    if (turns.length === 0) {
+      await reportSkip2(api2, agentId, conv.conversation_id, log2, codeName);
+      continue;
+    }
+    const transcript = renderTranscript(turns);
+    if (!transcript.trim()) {
+      await reportSkip2(api2, agentId, conv.conversation_id, log2, codeName);
+      continue;
+    }
+    let candidates;
+    try {
+      const out = await backend.run(buildExtractionPrompt(conv.channel, transcript));
+      candidates = parseCandidates(out);
+    } catch (err) {
+      log2(`[memory-extract] ${codeName}: extraction failed: ${err.message}`);
+      continue;
+    }
+    if (candidates === null) {
+      log2(`[memory-extract] ${codeName}: unparseable output for ${conv.conversation_id.slice(0, 8)} \u2014 will retry`);
+      continue;
+    }
+    const scrubbed = candidates.map((c) => ({
+      ...c,
+      content: scrubSensitive(c.content),
+      rationale: scrubSensitive(c.rationale)
+    }));
+    try {
+      const res = await api2.post(
+        "/host/memories/candidates",
+        {
+          agent_id: agentId,
+          conversation_id: conv.conversation_id,
+          candidates: scrubbed
+        }
+      );
+      log2(
+        `[memory-extract] ${codeName}: ${conv.conversation_id.slice(0, 8)} \u2192 ${candidates.length} candidate(s), ${res?.promoted ?? 0} promoted`
+      );
+    } catch (err) {
+      log2(`[memory-extract] ${codeName}: report failed: ${err.message}`);
+    }
+  }
+}
+async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
+  try {
+    await api2.post("/host/memories/candidates", {
+      agent_id: agentId,
+      conversation_id: conversationId,
+      skipped: true
+    });
+  } catch (err) {
+    log2(`[memory-extract] ${codeName}: skip report failed: ${err.message}`);
+  }
+}
+
 // src/lib/activity-cache-monitor.ts
 import { existsSync as existsSync2, readFileSync as readFileSync6 } from "fs";
 import { homedir } from "os";
 import { join as join4 } from "path";
-var MIN_CHECK_INTERVAL_MS4 = 6e4;
+var MIN_CHECK_INTERVAL_MS5 = 6e4;
 var STATS_CACHE_PATH = join4(homedir(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var state4 = { lastObservedDate: null, lastCheckedAt: 0 };
+var state5 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
   let parsed;
   try {
@@ -1972,8 +2327,8 @@ async function maybeReportActivityCache(args) {
   const { api: api2, log: log2 } = args;
   const now = args.now ?? /* @__PURE__ */ new Date();
   const nowMs = now.getTime();
-  if (nowMs - state4.lastCheckedAt < MIN_CHECK_INTERVAL_MS4) return;
-  state4.lastCheckedAt = nowMs;
+  if (nowMs - state5.lastCheckedAt < MIN_CHECK_INTERVAL_MS5) return;
+  state5.lastCheckedAt = nowMs;
   if (!existsSync2(STATS_CACHE_PATH)) {
     return;
   }
@@ -1984,12 +2339,12 @@ async function maybeReportActivityCache(args) {
     log2(`[activity-cache] readFileSync failed: ${err.message}`);
     return;
   }
-  const rows = selectNewDailyRows(raw, state4.lastObservedDate);
+  const rows = selectNewDailyRows(raw, state5.lastObservedDate);
   if (rows.length === 0) return;
   for (const row of rows) {
     try {
       await api2.post("/host/activity-observations", row);
-      state4.lastObservedDate = row.date;
+      state5.lastObservedDate = row.date;
     } catch (err) {
       log2(
         `[activity-cache] POST /host/activity-observations failed for date=${row.date}: ${err.message}`
@@ -3019,6 +3374,128 @@ function clearAgentState(agentId, codeName) {
   return channelCacheMutated;
 }
 
+// src/lib/wedge-detection.ts
+var DEFAULTS = {
+  inboundWaitSeconds: 120,
+  // ENG-6238: the hard cap is now an ABSOLUTE BACKSTOP, not the primary
+  // discriminator — a still-producing session (e.g. a runaway loop) is only
+  // reaped here. Raised 300→1200 because the soft path now reliably catches
+  // the frozen-turn wedge via the transcript signal, so the hard cap no longer
+  // needs to fire early (which is exactly what false-killed kylie's long
+  // legitimate turns, ENG-6238).
+  inboundHardWaitSeconds: 1200,
+  paneStaleSeconds: 120,
+  transcriptStaleSeconds: 60,
+  minCycles: 3
+};
+function parseMode(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  return v === "shadow" || v === "enforce" ? v : "off";
+}
+function parsePositiveInt(raw, fallback, floor) {
+  const n = raw ? Number.parseInt(raw, 10) : NaN;
+  return Number.isInteger(n) && n >= floor ? n : fallback;
+}
+function resolveWedgeConfig(env = process.env) {
+  const inboundWaitSeconds = parsePositiveInt(
+    env.AGT_WEDGE_INBOUND_WAIT_SECONDS,
+    DEFAULTS.inboundWaitSeconds,
+    30
+  );
+  const inboundHardWaitSeconds = Math.max(
+    inboundWaitSeconds,
+    parsePositiveInt(env.AGT_WEDGE_INBOUND_HARD_WAIT_SECONDS, DEFAULTS.inboundHardWaitSeconds, 30)
+  );
+  return {
+    mode: parseMode(env.AGT_WEDGE_RESTART_MODE),
+    inboundWaitSeconds,
+    inboundHardWaitSeconds,
+    paneStaleSeconds: parsePositiveInt(env.AGT_WEDGE_PANE_STALE_SECONDS, DEFAULTS.paneStaleSeconds, 30),
+    transcriptStaleSeconds: parsePositiveInt(
+      env.AGT_WEDGE_TRANSCRIPT_STALE_SECONDS,
+      DEFAULTS.transcriptStaleSeconds,
+      15
+    ),
+    minCycles: parsePositiveInt(env.AGT_WEDGE_MIN_CYCLES, DEFAULTS.minCycles, 2)
+  };
+}
+function isSessionProducing(signals, config2) {
+  const transcriptAge = signals.transcriptActivityAgeSeconds;
+  if (transcriptAge !== null) return transcriptAge < config2.transcriptStaleSeconds;
+  const paneAge = signals.paneActivityAgeSeconds;
+  return paneAge !== null && paneAge < config2.paneStaleSeconds;
+}
+function isWedgeCandidateCycle(signals, config2) {
+  const inboundAge = signals.pendingInboundOldestAgeSeconds;
+  if (inboundAge === null) return false;
+  if (inboundAge < config2.inboundWaitSeconds) return false;
+  if (isSessionProducing(signals, config2)) {
+    return inboundAge >= config2.inboundHardWaitSeconds;
+  }
+  return true;
+}
+function decideWedgeRestart(input, config2) {
+  if (!isWedgeCandidateCycle(input, config2)) return "none";
+  return input.consecutiveWedgeCycles >= config2.minCycles ? "wedged" : "none";
+}
+
+// src/lib/wedge-poison-card.ts
+var DEFAULTS2 = {
+  threshold: 3,
+  cooldownSeconds: 1800
+  // 30 min — matches the kanban stale-auto-fail window
+};
+function parsePositiveInt2(raw, fallback, floor) {
+  const n = raw ? Number.parseInt(raw, 10) : NaN;
+  return Number.isInteger(n) && n >= floor ? n : fallback;
+}
+function resolvePoisonCardConfig(env = process.env) {
+  return {
+    threshold: parsePositiveInt2(env.AGT_WEDGE_POISON_CARD_THRESHOLD, DEFAULTS2.threshold, 2),
+    cooldownMs: parsePositiveInt2(
+      env.AGT_WEDGE_POISON_CARD_COOLDOWN_SECONDS,
+      DEFAULTS2.cooldownSeconds,
+      300
+    ) * 1e3
+  };
+}
+function recordWedgeForCards(states, inProgressCardIds, nowMs, config2) {
+  if (inProgressCardIds.length === 0) {
+    return { next: new Map(states), newlyPoisoned: [] };
+  }
+  const next = /* @__PURE__ */ new Map();
+  const newlyPoisoned = [];
+  for (const id of inProgressCardIds) {
+    if (next.has(id)) continue;
+    const count = (states.get(id)?.count ?? 0) + 1;
+    next.set(id, { count, lastWedgeAtMs: nowMs });
+    if (count === config2.threshold) newlyPoisoned.push(id);
+  }
+  return { next, newlyPoisoned };
+}
+function pruneCardStates(states, liveInProgressCardIds, nowMs, config2) {
+  const live = liveInProgressCardIds instanceof Set ? liveInProgressCardIds : new Set(liveInProgressCardIds);
+  const next = /* @__PURE__ */ new Map();
+  for (const [id, state7] of states) {
+    if (!live.has(id)) continue;
+    if (nowMs - state7.lastWedgeAtMs > config2.cooldownMs) continue;
+    next.set(id, state7);
+  }
+  return next;
+}
+function isCardPoisoned(states, cardId, config2) {
+  return (states.get(cardId)?.count ?? 0) >= config2.threshold;
+}
+function partitionActionableByPoison(actionable, states, config2) {
+  const allowed = [];
+  const suppressed = [];
+  for (const item of actionable) {
+    if (isCardPoisoned(states, item.id, config2)) suppressed.push(item);
+    else allowed.push(item);
+  }
+  return { allowed, suppressed };
+}
+
 // src/lib/restart-flags.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync8, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -3095,8 +3572,9 @@ async function processOne(flag, opts) {
     await sendError(flag, opts, `\`/restart\` is only supported for Claude Code agents (this agent runs on \`${framework}\`).`);
     return;
   }
-  opts.log(`[restart-handler] Restarting tmux session for '${flag.codeName}' (source: ${flag.source})`);
-  opts.stopSession(flag.codeName);
+  const reasonSuffix = flag.source === "agent" && flag.reason ? ` reason="${flag.reason}"` : "";
+  opts.log(`[restart-handler] Restarting tmux session for '${flag.codeName}' (source: ${flag.source})${reasonSuffix}`);
+  opts.stopSession(flag.codeName, flag);
   await sendAck(flag, opts, `\u{1F504} Restart initiated for \`${flag.codeName}\` \u2014 the replacement session is being created.`);
 }
 async function sendAck(flag, opts, text) {
@@ -3692,12 +4170,40 @@ var KNOWN_SAFE_TAIL_SIGNATURES = /* @__PURE__ */ new Set(["session_id_in_use"]);
 function shouldSkipRevokedCleanup(previousKnownStatus) {
   return previousKnownStatus === "revoked";
 }
-function hasRevokedResiduals(state6) {
-  return state6.gatewayRunning || state6.portAllocated || state6.provisionDirExists;
+function hasRevokedResiduals(state7) {
+  return state7.gatewayRunning || state7.portAllocated || state7.provisionDirExists;
 }
 var pendingSessionRestarts = /* @__PURE__ */ new Map();
+var pendingRestartVerifications = /* @__PURE__ */ new Map();
 var restartBreaker = new RestartBreaker();
 var reportedTrips = /* @__PURE__ */ new Map();
+var mcpFlapDampener = new McpFlapDampener();
+function recordConfigChurnEvent(agentId, codeName, channel, signature) {
+  api.post("/host/mcp-config-churn", {
+    agent_id: agentId,
+    code_name: codeName,
+    channel,
+    signature
+  }).catch((err) => {
+    log(
+      `[mcp-flap-dampener] failed to record config-churn event for '${codeName}' (${channel}) (ENG-6123): ${err.message} \u2014 local suppression still active; CloudWatch metric will under-count`
+    );
+  });
+}
+async function reportReaperEvent(agentId, reaper, action, reason) {
+  try {
+    await api.post("/host/reaper-event", {
+      agent_id: agentId,
+      reaper,
+      action,
+      reason
+    });
+  } catch (err) {
+    log(
+      `[${reaper}] failed to report reaper-event (ENG-6184): ${err.message} \u2014 local reap still proceeded; the alert may be missed`
+    );
+  }
+}
 function recordRestartForBreaker(codeName, reason) {
   const result = restartBreaker.record(codeName, reason);
   if (!result.tripped || !result.trip) return;
@@ -3727,6 +4233,65 @@ function maybeReportCurrentTrip(codeName) {
     log(`[circuit-breaker] Failed to report trip for '${codeName}' to API: ${err.message}`);
   });
 }
+var autoResumeMarkers = /* @__PURE__ */ new Map();
+var autoResumeInFlight = /* @__PURE__ */ new Set();
+var AUTO_RESUME_SELF_WINDOW_MS = 12e4;
+var autoResumeLoggedSkips = /* @__PURE__ */ new Map();
+var autoResumeStandDowns = /* @__PURE__ */ new Set();
+var killPausedCodeNames = /* @__PURE__ */ new Set();
+function maybeAutoResume(agent) {
+  const codeName = agent.code_name;
+  if (autoResumeInFlight.has(codeName)) return;
+  const trip = restartBreaker.getTrip(codeName);
+  if (trip && autoResumeStandDowns.has(`${codeName}:${trip.trippedAt}`)) return;
+  const decision = decideAutoResume({
+    trip,
+    marker: autoResumeMarkers.get(codeName),
+    config: readAutoResumeConfig(),
+    now: Date.now()
+  });
+  if (decision.action === "skip") {
+    if ((decision.reason === "already-auto-resumed" || decision.reason === "not-quiet-yet") && trip) {
+      const key = `${codeName}:${trip.trippedAt}`;
+      if (autoResumeLoggedSkips.get(key) !== decision.reason) {
+        autoResumeLoggedSkips.set(key, decision.reason);
+        const detail = decision.reason === "not-quiet-yet" ? ` (~${Math.ceil((decision.remainingMs ?? 0) / 6e4)}min remaining)` : " \u2014 credit spent for this cycle; operator resume re-arms it";
+        log(`[auto-resume] agent=${codeName} decision=skip reason=${decision.reason}${detail} (ENG-6088)`);
+      }
+    }
+    return;
+  }
+  const trippedAt = trip.trippedAt;
+  log(
+    `[auto-resume] agent=${codeName} decision=resume quiet=${Math.round(decision.quietMs / 6e4)}min trippedAt=${new Date(trippedAt).toISOString()} (ENG-6088)`
+  );
+  autoResumeInFlight.add(codeName);
+  api.post("/host/circuit-breaker/auto-resume", {
+    agent_id: agent.agent_id,
+    quiet_ms: decision.quietMs,
+    tripped_at: new Date(trippedAt).toISOString()
+  }).then((res) => {
+    autoResumeInFlight.delete(codeName);
+    if (res.resumed) {
+      autoResumeMarkers.set(codeName, { trippedAt, autoResumedAt: Date.now() });
+      restartBreaker.clear(codeName);
+      reportedTrips.delete(codeName);
+      state6 = {
+        ...state6,
+        circuitBreakerTrips: restartBreaker.serialize(),
+        circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
+      };
+      send({ type: "state-update", state: state6 });
+      log(`[auto-resume] agent=${codeName} resumed \u2014 re-trip within backoff window will stay paused (ENG-6088)`);
+    } else {
+      autoResumeStandDowns.add(`${codeName}:${trippedAt}`);
+      log(`[auto-resume] agent=${codeName} not applied (reason=${res.reason ?? "unknown"}) \u2014 standing down for this trip (ENG-6088)`);
+    }
+  }).catch((err) => {
+    autoResumeInFlight.delete(codeName);
+    log(`[auto-resume] agent=${codeName} POST failed (will retry next poll): ${err.message}`);
+  });
+}
 function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-reload-mcp") {
   const existing = pendingSessionRestarts.get(codeName);
   if (existing) {
@@ -3737,29 +4302,104 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
     pendingSessionRestarts.delete(codeName);
     const gate = restartGateFor(codeName, breakerReason);
     if (gate !== "bypass" && gate !== "proceed") {
+      const lastLogged = deferLogThrottle.get(codeName);
+      if (lastLogged === void 0 || Date.now() - lastLogged >= DEFER_LOG_THROTTLE_MS) {
+        log(
+          `[maintenance-window] Deferring '${reason}' restart for '${codeName}' (${gate}) \u2014 re-checking every ${RESTART_DEFER_RECHECK_MS / 1e3}s until the window opens`
+        );
+        deferLogThrottle.set(codeName, Date.now());
+      }
+      scheduleSessionRestart(codeName, RESTART_DEFER_RECHECK_MS, reason, breakerReason);
+      return;
+    }
+    deferLogThrottle.delete(codeName);
+    if (breakerReason === "bind-remediation" && restartBreaker.isTripped(codeName)) {
       log(
-        `[maintenance-window] Deferring '${reason}' restart for '${codeName}' (${gate}) \u2014 re-checking in ${RESTART_DEFER_RECHECK_MS / 1e3}s`
+        `[bind-remediation] '${codeName}' breaker tripped before the re-respawn fired \u2014 aborting to avoid stopping a session the breaker won't let respawn (ENG-6203)`
       );
-      scheduleSessionRestart(codeName, RESTART_DEFER_RECHECK_MS, reason, breakerReason);
       return;
     }
     stopPersistentSession(codeName, log);
     runningMcpHashes.delete(codeName);
     recordRestartForBreaker(codeName, breakerReason);
     log(`[hot-reload] Session stopped for '${codeName}' \u2014 will respawn with ${reason}`);
+    if (breakerReason === "hot-reload-mcp" || breakerReason === "bind-remediation") {
+      const prior = pendingRestartVerifications.get(codeName);
+      pendingRestartVerifications.set(codeName, {
+        firedAt: Date.now(),
+        attempts: prior?.attempts ?? 0
+      });
+    }
   }, delayMs);
   timer.unref?.();
   pendingSessionRestarts.set(codeName, timer);
 }
 function cancelPendingSessionRestart(codeName) {
+  pendingRestartVerifications.delete(codeName);
   const existing = pendingSessionRestarts.get(codeName);
   if (!existing) return;
   clearTimeout(existing);
   pendingSessionRestarts.delete(codeName);
+  deferLogThrottle.delete(codeName);
   log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
 }
+function bindRemediationEnabled() {
+  const v = (process.env["AGT_BIND_REMEDIATION_ENABLED"] ?? "").trim().toLowerCase();
+  return v === "true" || v === "1";
+}
+var BIND_REMEDIATION_JITTER_MS = 3e4;
+function verifyPendingRestarts(now) {
+  if (pendingRestartVerifications.size === 0) return;
+  for (const [codeName, pending] of pendingRestartVerifications) {
+    const healthy = isSessionHealthy(codeName);
+    const session = getSessionState(codeName);
+    const startedAt = session?.startedAt ?? null;
+    const respawnId = session?.currentSessionId ?? null;
+    const outcome = decidePostRestartVerification(pending, startedAt, healthy, respawnId, now);
+    switch (outcome.kind) {
+      case "verified":
+        pendingRestartVerifications.delete(codeName);
+        log(`[restart-verify] '${codeName}' respawned healthy after MCP change \u2014 tools bound (ENG-6174)`);
+        break;
+      case "waiting":
+        break;
+      case "unverified":
+        if (outcome.final) {
+          pendingRestartVerifications.delete(codeName);
+          log(
+            `[restart-verify] ERROR '${codeName}' did NOT respawn healthy after ${outcome.attempt} attempts following an MCP change \u2014 the live session may be stuck on its pre-restart tools. Check session health / manager.log; a manual session restart may be required (ENG-6174)`
+          );
+          if (shouldRemediateUnverifiedRestart(outcome, {
+            enabled: bindRemediationEnabled(),
+            breakerTripped: restartBreaker.isTripped(codeName)
+          })) {
+            const jitterMs = Math.floor(Math.random() * BIND_REMEDIATION_JITTER_MS);
+            log(
+              `[bind-remediation] '${codeName}' restart never bound MCP tools \u2014 forcing one gated re-respawn in ${Math.round(jitterMs / 1e3)}s (breaker-capped, ENG-6203)`
+            );
+            scheduleSessionRestart(
+              codeName,
+              jitterMs,
+              "bind-remediation: prior restart left MCP tools unbound",
+              "bind-remediation"
+            );
+          }
+        } else {
+          pendingRestartVerifications.set(codeName, { firedAt: now, attempts: outcome.attempt });
+          log(
+            `[restart-verify] WARN '${codeName}' not yet respawned healthy after MCP change (attempt ${outcome.attempt}) \u2014 still watching (ENG-6174)`
+          );
+        }
+        break;
+    }
+  }
+}
 var RESTART_DEFER_RECHECK_MS = 6e4;
+var DEFER_LOG_THROTTLE_MS = 6e5;
+var deferLogThrottle = /* @__PURE__ */ new Map();
 var lastInboundMs = /* @__PURE__ */ new Map();
+var consecutiveWedgeCycles = /* @__PURE__ */ new Map();
+var wedgeRestartsByCard = /* @__PURE__ */ new Map();
 function noteInbound(codeName) {
   lastInboundMs.set(codeName, Date.now());
 }
@@ -3808,13 +4448,26 @@ function projectMcpKeys(_codeName, projectDir) {
     return null;
   }
 }
-function readMcpHttpServerConfig(projectDir, serverKey) {
+function readMcpHttpServerConfig(projectDir, serverKey, env) {
   try {
     const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const entry = servers[serverKey];
     if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
-      return { url: entry.url, ...entry.headers ? { headers: entry.headers } : {} };
+      const unresolved = /* @__PURE__ */ new Set();
+      const sub = (value) => {
+        if (!env) return value;
+        const r = expandTemplateVars(value, env);
+        for (const name of r.unresolved) unresolved.add(name);
+        return r.value;
+      };
+      const url = sub(entry.url);
+      let headers;
+      if (entry.headers) {
+        headers = {};
+        for (const [k, v] of Object.entries(entry.headers)) headers[k] = sub(v);
+      }
+      return { url, ...headers ? { headers } : {}, unresolved: [...unresolved] };
     }
     return null;
   } catch {
@@ -3823,15 +4476,76 @@ function readMcpHttpServerConfig(projectDir, serverKey) {
 }
 async function runAgentConnectivityProbes(agent, integrations, projectDir) {
   if (integrations.length === 0) return;
+  const probeEnv = { ...process.env };
+  try {
+    const envIntPath = join8(projectDir, ".env.integrations");
+    if (existsSync5(envIntPath)) {
+      Object.assign(probeEnv, parseEnvIntegrations(readFileSync9(envIntPath, "utf-8")));
+    }
+  } catch {
+  }
   const probeDeps = {
     fetchImpl: fetch,
-    runCli: (binary, args) => runCliProbe(binary, args),
+    runCli: (binary, args) => runCliProbe(binary, args, { env: probeEnv }),
     mcpProbe: async (target) => {
-      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey);
+      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
       if (!cfg) {
         return { status: "transient_error", message: `MCP server '${target.serverKey}' not resolvable from .mcp.json` };
       }
+      if (cfg.unresolved.length > 0) {
+        return {
+          status: "transient_error",
+          message: `MCP '${target.serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
+        };
+      }
       return probeMcpHttp(cfg);
+    },
+    // ENG-6139: connected-account binding check for managed (Composio) toolkits.
+    // The MCP handshake reads green on a dead/mis-bound account, so the managed
+    // probe also verifies the account is ACTIVE + bound to the entity the agent
+    // queries with. Inputs come from the agent's OWN wired MCP server: the
+    // `x-api-key` header and the `user_id` query param (the agent already
+    // authenticates with these), plus the recorded connected_account_id.
+    composioProbe: async (definitionId, credentials) => {
+      const serverKey = definitionId.replace(/[^a-z0-9]/gi, "_").toLowerCase();
+      const cfg = readMcpHttpServerConfig(projectDir, serverKey, probeEnv);
+      if (!cfg) {
+        return { status: "transient_error", message: `MCP server '${serverKey}' not resolvable from .mcp.json` };
+      }
+      if (cfg.unresolved.length > 0) {
+        return {
+          status: "transient_error",
+          message: `MCP '${serverKey}' auth unresolved: ${cfg.unresolved.join(", ")}`
+        };
+      }
+      const apiKey = cfg.headers?.["x-api-key"] ?? cfg.headers?.["X-API-Key"] ?? "";
+      let expectedUserId = "";
+      let serverId;
+      try {
+        const u = new URL(cfg.url);
+        expectedUserId = u.searchParams.get("user_id") ?? "";
+        const m = u.pathname.match(/\/v3\/mcp\/([^/]+)\/mcp/);
+        serverId = m?.[1] ? decodeURIComponent(m[1]) : void 0;
+      } catch {
+        expectedUserId = "";
+      }
+      const connectedAccountId = typeof credentials?.["connected_account_id"] === "string" ? credentials["connected_account_id"] : "";
+      return probeComposioAccount({ connectedAccountId, apiKey, expectedUserId, serverId });
+    },
+    // ENG-6157 (Phase 2): the live tool-call leg. Uses the agent's OWN wired MCP
+    // URL + headers (the exact path tool calls take), so a broken auth_config
+    // linkage surfaces as a real `No connected account found` instead of a
+    // green handshake. Skips (`null`) when no safe read-only tool is callable.
+    composioToolCallProbe: async (target) => {
+      const cfg = readMcpHttpServerConfig(projectDir, target.serverKey, probeEnv);
+      if (!cfg) return null;
+      if (cfg.unresolved.length > 0) return null;
+      return probeComposioMcpToolCall({
+        url: cfg.url,
+        headers: cfg.headers,
+        toolName: target.toolName,
+        toolArgs: target.toolArgs
+      });
     }
   };
   const intervalSec = Number(process.env.AGT_CONNECTIVITY_PROBE_INTERVAL_SECONDS) || 3600;
@@ -3850,7 +4564,9 @@ async function runAgentConnectivityProbes(agent, integrations, projectDir) {
       // (definition_id === toolkit_id, sanitised: non-alnum → '_', lowercased —
       // e.g. 'composio_outlook'). The executor looks this up in .mcp.json; an
       // unresolvable key degrades to transient_error, never a false 'down'.
-      mcp_server_key: i.source_type === "managed" || i.source_type === "mcp_server" ? i.definition_id.replace(/[^a-z0-9]/gi, "_").toLowerCase() : void 0
+      mcp_server_key: i.source_type === "managed" || i.source_type === "mcp_server" ? i.definition_id.replace(/[^a-z0-9]/gi, "_").toLowerCase() : void 0,
+      // ENG-6242: forward the prescribed connectivity-test tool to the executor.
+      connectivity_test: i.connectivity_test ?? null
     })),
     { probeDeps, intervalMs: intervalSec * 1e3 }
   );
@@ -3912,6 +4628,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
         const removed = decision.addedOrRemoved.filter((k) => !currentKeys.has(k));
         quarantineOnlyDrift = added.length === 0 && removed.length > 0 && removed.every((k) => quarantined.has(k));
       }
+      const flapSuppressed = decision.restart && !quarantineOnlyDrift && mcpFlapDampener.isFlapping(codeName, FLAP_CHANNEL_MANAGED_MCP);
       if (decision.membershipUnknown) {
         clearPresenceReaperState(codeName);
         log(
@@ -3921,6 +4638,10 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
         log(
           `[channel-quarantine] .mcp.json drift for '${codeName}' is quarantined-channel removal only [${decision.addedOrRemoved.join(", ")}] \u2014 adopting new baseline WITHOUT restart (0-restart-on-removal, ENG-5932)`
         );
+      } else if (flapSuppressed) {
+        log(
+          `[mcp-flap-dampener] .mcp.json membership drift for '${codeName}' [${decision.addedOrRemoved.join(", ")}] held \u2014 managed-MCP set is flapping, adopting baseline WITHOUT restart until it settles (ENG-6123)`
+        );
       } else if (decision.restart) {
         clearPresenceReaperStateForKeys(codeName, new Set(decision.addedOrRemoved));
         log(
@@ -3931,10 +4652,11 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
           `[hot-reload] .mcp.json value-only drift for '${codeName}' \u2014 preserving presence-reaper state and NOT restarting (ENG-5285/ENG-5537)`
         );
       }
-      if (decision.restart && !quarantineOnlyDrift) {
+      if (decision.restart && !quarantineOnlyDrift && !flapSuppressed) {
         scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
         runningMcpHashes.delete(codeName);
         runningMcpServerKeys.delete(codeName);
+      } else if (flapSuppressed) {
       } else {
         runningMcpHashes.set(codeName, action.current);
         if (currentKeys) runningMcpServerKeys.set(codeName, currentKeys);
@@ -3996,7 +4718,7 @@ function __setAgentChannelTokensForTest(codeName, tokens) {
 }
 var activeChannels = /* @__PURE__ */ new Map();
 var gatewaysStartedThisCycle = /* @__PURE__ */ new Set();
-var state5 = {
+var state6 = {
   pid: process.pid,
   startedAt: (/* @__PURE__ */ new Date()).toISOString(),
   lastPollAt: null,
@@ -4029,6 +4751,8 @@ function clearAgentCaches(agentId, codeName) {
   for (const key of taskDisplayInfo.keys()) {
     if (key.startsWith(`${codeName}:`)) taskDisplayInfo.delete(key);
   }
+  mcpFlapDampener.forget(codeName);
+  deferLogThrottle.delete(codeName);
   if (channelCacheMutated) saveChannelHashCache2();
 }
 var cachedFrameworkVersion = null;
@@ -4036,7 +4760,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.9-test.13" : "dev";
+var agtCliVersion = true ? "0.27.9-test.14" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -4688,6 +5412,10 @@ async function runEvalClaude(prompt, model) {
   });
   return stdout;
 }
+function memoryExtractionEnabled() {
+  const v = (process.env["AGT_MEMORY_EXTRACTION_ENABLED"] ?? "").trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes";
+}
 var conversationEvalBackend = null;
 function resolveConversationEvalBackend() {
   if (conversationEvalBackend) return conversationEvalBackend;
@@ -5014,10 +5742,10 @@ function isGatewayHung(codeName) {
     if (!Array.isArray(jobs)) return false;
     const now = Date.now();
     for (const job of jobs) {
-      const state6 = job.state;
-      if (!state6) continue;
-      const runStartedAt = state6.runStartedAtMs;
-      const isRunning = state6.status === "running" || state6.running === true;
+      const state7 = job.state;
+      if (!state7) continue;
+      const runStartedAt = state7.runStartedAtMs;
+      const isRunning = state7.status === "running" || state7.running === true;
       if (isRunning && runStartedAt && now - runStartedAt > GATEWAY_HUNG_TIMEOUT_MS) {
         return true;
       }
@@ -5167,8 +5895,9 @@ async function pollCycle() {
     await processRestartFlags({
       log,
       resolveFramework: (codeName) => agentFrameworkCache.get(codeName) ?? null,
-      stopSession: (codeName) => {
-        stopPersistentSessionAndForgetMcpBaseline(codeName, "channel-restart-flag");
+      stopSession: (codeName, flag) => {
+        const breakerReason = flag.source === "agent" ? "agent-requested" : "channel-restart-flag";
+        stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason);
         agentState.persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
       },
@@ -5218,7 +5947,7 @@ async function pollCycle() {
     const now = Date.now();
     if (now - lastVersionCheckAt > VERSION_CHECK_INTERVAL_MS) {
       try {
-        const firstAgent = state5.agents[0];
+        const firstAgent = state6.agents[0];
         const versionAdapter = firstAgent ? resolveAgentFramework(firstAgent.codeName) : getFramework("openclaw");
         if (versionAdapter.getVersion) {
           cachedFrameworkVersion = await versionAdapter.getVersion();
@@ -5229,7 +5958,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-OL5EDYB4.js");
+      const { collectDiagnostics } = await import("../persistent-session-35PWSTLO.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -5262,7 +5991,7 @@ async function pollCycle() {
         const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
-      const hostHasClaudeCode = state5.agents.some(
+      const hostHasClaudeCode = state6.agents.some(
         (a) => agentFrameworkCache.get(a.codeName) === "claude-code"
       );
       if (hostHasClaudeCode) {
@@ -5316,23 +6045,30 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-B6LJJRUD.js");
+      } = await import("../responsiveness-probe-MA4M2QM4.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
         if (probeCodeNames.length > 0) {
+          const { takeAcpxExecFailureCount, creditAcpxExecFailureCount } = await import("../persistent-session-35PWSTLO.js");
           const drainedGiveUps = /* @__PURE__ */ new Map();
+          const drainedAcpxFailures = /* @__PURE__ */ new Map();
           const probes = collectResponsivenessProbes(probeCodeNames).map((p) => {
             const giveUps = takeWatchdogGiveUpCount(p.code_name);
             if (giveUps > 0) drainedGiveUps.set(p.code_name, giveUps);
-            return { ...p, input_stuck_give_ups: giveUps };
+            const acpxFailures = takeAcpxExecFailureCount(p.code_name);
+            if (acpxFailures > 0) drainedAcpxFailures.set(p.code_name, acpxFailures);
+            return { ...p, input_stuck_give_ups: giveUps, acpx_exec_failures: acpxFailures };
           });
           if (probes.length > 0) {
             void api.post("/host/responsiveness-probe", { host_id: hostId, probes }).catch((err) => {
               for (const [codeName, count] of drainedGiveUps) {
                 creditWatchdogGiveUpCount(codeName, count);
               }
-              log(`[responsiveness-probe] post failed (give-up counts re-credited): ${err.message}`);
+              for (const [codeName, count] of drainedAcpxFailures) {
+                creditAcpxExecFailureCount(codeName, count);
+              }
+              log(`[responsiveness-probe] post failed (give-up + acpx-failure counts re-credited): ${err.message}`);
             });
           }
         }
@@ -5341,6 +6077,100 @@ async function pollCycle() {
     } catch (err) {
       log(`[responsiveness-probe] collection failed: ${err.message}`);
     }
+    try {
+      const wedgeConfig = resolveWedgeConfig();
+      if (wedgeConfig.mode !== "off") {
+        const {
+          collectResponsivenessProbes,
+          livePendingInboundOldestAgeSeconds,
+          deadLetterPendingInbound
+        } = await import("../responsiveness-probe-MA4M2QM4.js");
+        const { transcriptActivityAgeSeconds } = await import("../daily-session-PNQX5URX.js");
+        const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
+        const wedgeNow = /* @__PURE__ */ new Date();
+        const liveAgents = agentState.persistentSessionAgents;
+        for (const tracked of consecutiveWedgeCycles.keys()) {
+          if (!liveAgents.has(tracked)) consecutiveWedgeCycles.delete(tracked);
+        }
+        for (const tracked of wedgeRestartsByCard.keys()) {
+          if (!liveAgents.has(tracked)) wedgeRestartsByCard.delete(tracked);
+        }
+        const poisonConfig = resolvePoisonCardConfig();
+        for (const probe of collectResponsivenessProbes([...liveAgents])) {
+          const codeName = probe.code_name;
+          if (!isSessionHealthy(codeName)) {
+            consecutiveWedgeCycles.delete(codeName);
+            continue;
+          }
+          const wedgeSession = getSessionState(codeName);
+          const sessionStartMs = wedgeSession?.startedAt ?? null;
+          const transcriptAge = transcriptActivityAgeSeconds(
+            wedgeProjectDir(codeName),
+            wedgeSession?.currentSessionId ?? null,
+            wedgeNow
+          );
+          const signals = {
+            paneActivityAgeSeconds: probe.pane_activity_age_seconds,
+            transcriptActivityAgeSeconds: transcriptAge,
+            pendingInboundOldestAgeSeconds: livePendingInboundOldestAgeSeconds(
+              codeName,
+              sessionStartMs,
+              wedgeNow
+            )
+          };
+          if (!isWedgeCandidateCycle(signals, wedgeConfig)) {
+            consecutiveWedgeCycles.delete(codeName);
+            continue;
+          }
+          const streak = (consecutiveWedgeCycles.get(codeName) ?? 0) + 1;
+          consecutiveWedgeCycles.set(codeName, streak);
+          if (decideWedgeRestart({ ...signals, consecutiveWedgeCycles: streak }, wedgeConfig) !== "wedged") {
+            continue;
+          }
+          const transcriptAgeLabel = transcriptAge === null ? "n/a" : `${transcriptAge}s`;
+          const detail = `agent=${codeName} paneAge=${signals.paneActivityAgeSeconds}s transcriptAge=${transcriptAgeLabel} inboundAge=${signals.pendingInboundOldestAgeSeconds}s cycles=${streak}`;
+          if (wedgeConfig.mode === "shadow") {
+            if (streak === wedgeConfig.minCycles) {
+              log(`[wedge] SHADOW would force-fresh respawn ${detail}`);
+            }
+            continue;
+          }
+          try {
+            const newId = rotateSessionForWedge(codeName);
+            try {
+              const { execSync: es } = await import("child_process");
+              es(`tmux kill-session -t agt-${codeName} 2>/dev/null`, { stdio: "ignore" });
+            } catch {
+            }
+            stopPersistentSessionAndForgetMcpBaseline(codeName);
+            consecutiveWedgeCycles.delete(codeName);
+            const deadLettered = deadLetterPendingInbound(codeName, wedgeNow);
+            const deadNote = deadLettered > 0 ? `, ${deadLettered} stale inbound dead-lettered` : "";
+            log(
+              `[wedge] forced fresh respawn ${detail} \u2192 new session ${newId} (transcript preserved${deadNote})`
+            );
+            const inProgressCardIds = (kanbanBoardCache.get(codeName) ?? []).filter((item) => item.status === "in_progress" && isHybridActionable(item)).map((item) => item.id);
+            const cardStates = wedgeRestartsByCard.get(codeName) ?? /* @__PURE__ */ new Map();
+            const { next, newlyPoisoned } = recordWedgeForCards(
+              cardStates,
+              inProgressCardIds,
+              wedgeNow.getTime(),
+              poisonConfig
+            );
+            wedgeRestartsByCard.set(codeName, next);
+            for (const cardId of newlyPoisoned) {
+              log(
+                `[wedge] poison-card suspected agent=${codeName} card=${cardId} consecutiveWedgeRespawns=${poisonConfig.threshold} \u2014 suppressing re-nudge (falls to stale-auto-fail). See ENG-6171.`
+              );
+            }
+          } catch (err) {
+            log(`[wedge] force-fresh respawn failed for ${codeName}: ${err.message}`);
+          }
+        }
+      }
+    } catch (err) {
+      log(`[wedge] detection failed: ${err.message}`);
+    }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
       const observations = [];
@@ -5384,7 +6214,7 @@ async function pollCycle() {
     for (const agent of agents) {
       const requested = agent.restart_requested_at ?? null;
       if (!requested) continue;
-      const prev = state5.agents.find((a) => a.agentId === agent.agent_id);
+      const prev = state6.agents.find((a) => a.agentId === agent.agent_id);
       const lastProcessed = prev?.lastRestartProcessedAt ?? null;
       if (lastProcessed && Date.parse(lastProcessed) >= Date.parse(requested)) continue;
       log(`[restart] Dashboard requested restart for '${agent.code_name}' at ${requested}`);
@@ -5407,7 +6237,7 @@ async function pollCycle() {
         await processAgent(agent, agentStates);
       } catch (err) {
         log(`Error processing agent '${agent.code_name}': ${err.message}`);
-        const existing = state5.agents.find((a) => a.agentId === agent.agent_id);
+        const existing = state6.agents.find((a) => a.agentId === agent.agent_id);
         if (existing) {
           agentStates.push(existing);
         } else {
@@ -5433,12 +6263,12 @@ async function pollCycle() {
     void maybeReportActivityCache({ api, log });
     const restartAckStateChanged = applyRestartAcks({
       agentStates,
-      priorAgents: state5.agents,
+      priorAgents: state6.agents,
       restartAcks
     });
     if (restartAckStateChanged) {
       try {
-        const ackedState = { ...state5, agents: agentStates };
+        const ackedState = { ...state6, agents: agentStates };
         atomicWriteFileSync(getStateFile(), JSON.stringify(ackedState, null, 2));
       } catch (err) {
         log(`[restart] failed to persist ack immediately: ${err.message}`);
@@ -5456,7 +6286,7 @@ async function pollCycle() {
     } catch {
     }
     const currentIds = new Set(agents.map((a) => a.agent_id));
-    for (const prev of state5.agents) {
+    for (const prev of state6.agents) {
       if (!currentIds.has(prev.agentId)) {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
@@ -5597,23 +6427,26 @@ async function pollCycle() {
       }
     } catch {
     }
-    state5 = {
-      ...state5,
+    state6 = {
+      ...state6,
       lastPollAt: (/* @__PURE__ */ new Date()).toISOString(),
-      pollCount: state5.pollCount + 1,
+      pollCount: state6.pollCount + 1,
       agents: agentStates,
       // ENG-5441: serialise trip state on every poll so manager restarts
       // never silently clear a tripped breaker. Cheap — only tripped
       // entries are stored, and the typical state is zero entries.
-      circuitBreakerTrips: restartBreaker.serialize()
+      circuitBreakerTrips: restartBreaker.serialize(),
+      // ENG-6088: spent auto-resume credits survive manager restarts too.
+      circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
     };
     if (consecutivePollFailures > 0) {
       log(`[poll-backoff] recovered after ${consecutivePollFailures} failure(s), resuming normal interval`);
       consecutivePollFailures = 0;
     }
-    send({ type: "state-update", state: state5 });
+    verifyPendingRestarts(Date.now());
+    send({ type: "state-update", state: state6 });
   } catch (err) {
-    state5.errorCount++;
+    state6.errorCount++;
     const message = err.message;
     log(`Poll error: ${message}`);
     send({ type: "error", message });
@@ -5664,6 +6497,15 @@ async function processAgent(agent, agentStates) {
       agentId: agent.agent_id,
       log
     });
+    if (memoryExtractionEnabled()) {
+      void maybeExtractMemories({
+        api,
+        backend: resolveConversationEvalBackend(),
+        codeName: agent.code_name,
+        agentId: agent.agent_id,
+        log
+      });
+    }
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
@@ -5672,6 +6514,16 @@ async function processAgent(agent, agentStates) {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     }
+    if (agent.kill_switch) {
+      killPausedCodeNames.add(agent.code_name);
+      if (previousKnownStatus !== agent.status) {
+        log(
+          `[kill-switch] '${agent.code_name}' halted by ${agent.kill_switch.scope ?? "unknown"} kill switch` + (agent.kill_switch.reason ? ` (reason: ${agent.kill_switch.reason})` : "") + ` source=${agent.kill_switch.source ?? "unknown"}`
+        );
+      }
+    } else if (killPausedCodeNames.delete(agent.code_name)) {
+      log(`[kill-switch] '${agent.code_name}' kill switch cleared while still ${agent.status} (no resume \u2014 paused for another reason)`);
+    }
     await stopGatewayIfRunning(agent.code_name, adapter);
     stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
@@ -5680,6 +6532,9 @@ async function processAgent(agent, agentStates) {
       log(`Killed tmux session for paused agent '${agent.code_name}'`);
     } catch {
     }
+    if (agent.status === "paused" && !agent.kill_switch) {
+      maybeAutoResume(agent);
+    }
     agentStates.push({
       agentId: agent.agent_id,
       codeName: agent.code_name,
@@ -5771,6 +6626,28 @@ async function processAgent(agent, agentStates) {
       reportedTrips.delete(agent.code_name);
       log(`[circuit-breaker] Cleared trip for '${agent.code_name}' on operator resume (paused \u2192 active)`);
     }
+    if (previousStatus === "paused" && agent.status === "active") {
+      const marker = autoResumeMarkers.get(agent.code_name);
+      const isSelfResume = marker !== void 0 && Date.now() - marker.autoResumedAt < AUTO_RESUME_SELF_WINDOW_MS;
+      if (!isSelfResume && autoResumeMarkers.delete(agent.code_name)) {
+        state6 = {
+          ...state6,
+          circuitBreakerAutoResumes: Object.fromEntries(autoResumeMarkers.entries())
+        };
+        send({ type: "state-update", state: state6 });
+        log(`[auto-resume] Cleared auto-resume marker for '${agent.code_name}' on operator resume \u2014 credit re-armed (ENG-6088)`);
+      }
+    }
+    if (previousStatus === "paused" && agent.status === "active" && killPausedCodeNames.delete(agent.code_name)) {
+      log(`[kill-switch] '${agent.code_name}' kill switch cleared \u2014 resuming session`);
+      void injectMessage(
+        agent.code_name,
+        "system",
+        "The kill switch that halted you has been cleared. Your session is resuming.",
+        { task_name: "kill-switch-resume" },
+        log
+      ).catch(() => false);
+    }
     let channelCacheMutated = false;
     for (const key of agentState.knownChannelConfigHashes.keys()) {
       if (key.startsWith(`${agent.agent_id}:`)) {
@@ -5788,7 +6665,7 @@ async function processAgent(agent, agentStates) {
     });
   } catch (err) {
     log(`Refresh failed for '${agent.code_name}': ${err.message}`);
-    const existing = state5.agents.find((a) => a.agentId === agent.agent_id);
+    const existing = state6.agents.find((a) => a.agentId === agent.agent_id);
     agentStates.push(existing ?? {
       agentId: agent.agent_id,
       codeName: agent.code_name,
@@ -5852,7 +6729,7 @@ async function processAgent(agent, agentStates) {
   const charterVersion = refreshData.charter.version;
   const toolsVersion = refreshData.tools.version;
   const known = agentState.knownVersions.get(agent.agent_id);
-  let lastProvisionAt = state5.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
+  let lastProvisionAt = state6.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
   const quarantinedChannels = channelQuarantineStore().getQuarantinedKeys(agent.code_name);
   const currentChannelIds = setWithout(
     launchableChannelIds(refreshData.channel_configs),
@@ -6158,6 +7035,17 @@ async function processAgent(agent, agentStates) {
             const telegramPeers = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
             const slackPeers = channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
             const senderPolicyForCall = channelId === "slack" || channelId === "msteams" ? refreshData.sender_policy ?? void 0 : void 0;
+            let agentAvatarUrl;
+            if (channelId === "slack") {
+              const rawAvatarUrl = refreshData.agent.avatar_url ?? void 0;
+              const avatarResolution = resolveAvatarEnvUrl(rawAvatarUrl);
+              agentAvatarUrl = avatarResolution.url ?? void 0;
+              if (avatarResolution.skipReason && avatarResolution.skipReason !== "empty") {
+                log(
+                  `WARN: skipped Slack bot avatar for '${agent.code_name}' (reason=${avatarResolution.skipReason}${avatarResolution.bytes !== void 0 ? `, bytes=${avatarResolution.bytes}` : ""}) \u2014 not a hosted URL / exceeds ${MAX_AVATAR_ENV_URL_BYTES}B cap; Slack runs without the custom photo. Upload the avatar to storage and store the hosted URL to restore it (ENG-6245).`
+                );
+              }
+            }
             frameworkAdapter.writeChannelCredentials(
               agent.code_name,
               channelId,
@@ -6170,7 +7058,8 @@ async function processAgent(agent, agentStates) {
                 telegramPeers,
                 slackPeers,
                 agentTimezone,
-                senderPolicy: senderPolicyForCall
+                senderPolicy: senderPolicyForCall,
+                agentAvatarUrl
               }
             );
             agentState.knownChannelConfigHashes.set(cacheKey, configHash);
@@ -6414,7 +7303,7 @@ async function processAgent(agent, agentStates) {
       log(`Failed to provision direct-chat channel for '${agent.code_name}': ${err.message}`);
     }
   }
-  let lastSecretsProvisionAt = state5.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
+  let lastSecretsProvisionAt = state6.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
   let secretsHash = agentState.knownSecretsHashes.get(agent.agent_id) ?? null;
   try {
     const secretsData = await api.post("/host/secrets", { agent_id: agent.agent_id });
@@ -6477,6 +7366,14 @@ async function processAgent(agent, agentStates) {
     if (integrations.length > 0) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
+      const intMembership = membershipSignature(integrations.map((i) => i.definition_id));
+      const intFlap = mcpFlapDampener.record(agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
+      if (intFlap.onset) {
+        log(
+          `[mcp-flap-dampener] integration set for '${agent.code_name}' is FLAPPING (${intFlap.transitions} transitions / ${intFlap.distinctStates} states in window) \u2014 suppressing integration-update notices until it settles (ENG-6123)`
+        );
+        recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
+      }
       if (intHash !== prevIntHash) {
         const projectDir = join8(homedir4(), ".augmented", agent.code_name, "project");
         const envIntPath = join8(projectDir, ".env.integrations");
@@ -6510,11 +7407,15 @@ async function processAgent(agent, agentStates) {
             }
             const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
             const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
-            injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
-              task_name: "integration-update"
-            }, log).catch(() => {
-            });
-            log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+            if (intFlap.flapping) {
+              log(`[mcp-flap-dampener] suppressed integration-update notice for '${agent.code_name}' (set flapping, ENG-6123): ${names}`);
+            } else {
+              injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
+                task_name: "integration-update"
+              }, log).catch(() => {
+              });
+              log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+            }
           } catch (err) {
             rotationHandled = false;
             log(`[hot-reload] Failed to compute / reap affected MCP servers for '${agent.code_name}': ${err.message} \u2014 will retry next tick`);
@@ -6554,6 +7455,14 @@ async function processAgent(agent, agentStates) {
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
+        const mcpMembership = membershipSignature(expectedServerIds);
+        const mcpFlap = mcpFlapDampener.record(agent.code_name, FLAP_CHANNEL_MANAGED_MCP, mcpMembership);
+        if (mcpFlap.onset) {
+          log(
+            `[mcp-flap-dampener] managed-MCP set for '${agent.code_name}' is FLAPPING (${mcpFlap.transitions} transitions / ${mcpFlap.distinctStates} states in window) \u2014 suppressing mcp-update notice + restart until it settles (ENG-6123)`
+          );
+          recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_MANAGED_MCP, mcpMembership);
+        }
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
@@ -6592,7 +7501,12 @@ async function processAgent(agent, agentStates) {
           }
           agentState.knownManagedMcpHashes.set(agent.agent_id, mcpHash);
           agentState.knownManagedMcpStructure.set(agent.agent_id, structureHash);
-          if (prevStructureHash !== void 0 && structureHash !== prevStructureHash && fwForMcp === "claude-code" && isSessionHealthy(agent.code_name)) {
+          if (prevStructureHash !== void 0 && structureHash !== prevStructureHash && fwForMcp === "claude-code" && isSessionHealthy(agent.code_name) && // ENG-6123: hold the restart + inject-notice while the managed-MCP
+          // membership is oscillating. The .mcp.json above was still written
+          // (the file converges to the live set); we only withhold the
+          // opus-facing notice + the session reload — the two per-flip burns.
+          // When the set settles, the next structural change restarts once.
+          !mcpFlap.flapping) {
             const mcpNames = agentToolkits.map((tk) => tk.toolkit_name).join(", ") || "none (all removed)";
             log(`[hot-reload] MCP servers changed for '${agent.code_name}': ${mcpNames} \u2014 restarting session`);
             const restartNotice = agentToolkits.length > 0 ? `New MCP tool servers have been configured: ${mcpNames}. Note: MCP servers require a session restart to connect. Your manager will restart your session shortly.` : "Managed MCP tool servers were removed. Your manager will restart your session shortly so the session drops those tools.";
@@ -6868,11 +7782,22 @@ async function processAgent(agent, agentStates) {
     }
     void reconcileScheduledRuns(agent.code_name, agent.agent_id, hybridBoard);
     if (wantsHybridInject) {
-      if (hasHybridActionableItems(hybridBoard)) {
-        const actionableCount = hybridBoard.filter(isHybridActionable).length;
-        void maybeInjectKanbanCheck(agent.code_name, agent.agent_id, actionableCount);
+      const poisonCfg = resolvePoisonCardConfig();
+      const existingStates = wedgeRestartsByCard.get(agent.code_name);
+      if (existingStates && existingStates.size > 0) {
+        const liveInProgress = hybridBoard.filter((item) => item.status === "in_progress" && isHybridActionable(item)).map((item) => item.id);
+        const pruned = pruneCardStates(existingStates, liveInProgress, Date.now(), poisonCfg);
+        if (pruned.size > 0) wedgeRestartsByCard.set(agent.code_name, pruned);
+        else wedgeRestartsByCard.delete(agent.code_name);
+      }
+      const cardStates = wedgeRestartsByCard.get(agent.code_name);
+      const actionable = hybridBoard.filter(isHybridActionable);
+      const { allowed, suppressed } = cardStates ? partitionActionableByPoison(actionable, cardStates, poisonCfg) : { allowed: actionable, suppressed: [] };
+      if (allowed.length > 0) {
+        void maybeInjectKanbanCheck(agent.code_name, agent.agent_id, allowed.length);
       } else {
-        closeInjectedRunIfOpen(agent.code_name, "completed", "kanban board drained");
+        const reason = suppressed.length > 0 ? "kanban inject suppressed \u2014 suspected poison card(s) (ENG-6171)" : "kanban board drained";
+        closeInjectedRunIfOpen(agent.code_name, "completed", reason);
       }
     }
   }
@@ -6996,6 +7921,12 @@ async function processAgent(agent, agentStates) {
               `[mcp-presence-reaper] failed to record restart event for '${codeName}' (ENG-5286): ${err.message} \u2014 local restart still proceeded; CloudWatch metric will under-count this event`
             );
           });
+          void reportReaperEvent(
+            agent.agent_id,
+            "mcp-presence-reaper",
+            "restart",
+            givenUpKeys.length > 0 ? `restarted session; MCP server(s) still down after restart budget: ${givenUpKeys.join(", ")}` : `restarted session to recover MCP server(s): ${activeKeys.join(", ")}`
+          );
         },
         // ENG-5932: classify each declared key for the quarantine path. Reads a
         // server-declared criticality field off the .mcp.json entry when
@@ -7026,6 +7957,12 @@ async function processAgent(agent, agentStates) {
             log(
               `[channel-quarantine] persisted quarantine marker for '${codeName}:${serverKey}' \u2014 will be dropped from .mcp.json on next provisioning poll (ENG-5932)`
             );
+            void reportReaperEvent(
+              agent.agent_id,
+              "mcp-presence-reaper",
+              "quarantine",
+              `optional channel '${serverKey}' dead past restart budget + dwell \u2014 quarantined`
+            );
           }
         }
       });
@@ -7359,19 +8296,19 @@ function clearStaleCronRunState(jobsPath) {
     let changed = false;
     const now = Date.now();
     for (const job of jobs) {
-      const state6 = job.state;
-      if (!state6) continue;
-      const runStartedAt = state6.runningAtMs ?? state6.runStartedAtMs;
-      const isRunning = state6.running === true || state6.status === "running";
+      const state7 = job.state;
+      if (!state7) continue;
+      const runStartedAt = state7.runningAtMs ?? state7.runStartedAtMs;
+      const isRunning = state7.running === true || state7.status === "running";
       if (isRunning && runStartedAt && now - runStartedAt > STALE_RUN_TIMEOUT_MS) {
-        state6.running = false;
-        delete state6.status;
-        delete state6.runStartedAtMs;
-        delete state6.currentRunId;
+        state7.running = false;
+        delete state7.status;
+        delete state7.runStartedAtMs;
+        delete state7.currentRunId;
         changed = true;
         log(`Cleared stale running state for cron job '${job.name}' (stuck for ${Math.round((now - runStartedAt) / 6e4)}min)`);
       } else if (isRunning && !runStartedAt) {
-        state6.running = false;
+        state7.running = false;
         changed = true;
         log(`Cleared stale running state for cron job '${job.name}' (no start timestamp)`);
       }
@@ -7405,6 +8342,26 @@ function cleanupOldFiles(dir, maxAgeDays, ext) {
   } catch {
   }
 }
+function buildSchedulerTaskInput(t) {
+  return {
+    id: t.id,
+    template_id: t.template_id,
+    name: t.name,
+    schedule_kind: t.schedule_kind,
+    schedule_expr: t.schedule_expr ?? null,
+    schedule_every: t.schedule_every ?? null,
+    schedule_at: t.schedule_at ?? null,
+    timezone: t.timezone ?? "UTC",
+    prompt: t.prompt ?? "",
+    session_target: t.session_target ?? "isolated",
+    delivery_mode: t.delivery_mode ?? "none",
+    delivery_policy: t.delivery_policy ?? "always",
+    delivery_channel: t.delivery_channel ?? null,
+    delivery_to: t.delivery_to ?? null,
+    enabled: t.enabled ?? true,
+    triggered_at: t.triggered_at ?? null
+  };
+}
 var inFlightClaudeTasks = /* @__PURE__ */ new Set();
 var claudeTaskConcurrency = /* @__PURE__ */ new Map();
 var MAX_CLAUDE_CONCURRENCY = 2;
@@ -7437,33 +8394,17 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
-    const taskInputs = tasks.map((t) => ({
-      id: t.id,
-      template_id: t.template_id,
-      name: t.name,
-      schedule_kind: t.schedule_kind,
-      schedule_expr: t.schedule_expr ?? null,
-      schedule_every: t.schedule_every ?? null,
-      schedule_at: t.schedule_at ?? null,
-      timezone: t.timezone ?? "UTC",
-      prompt: t.prompt ?? "",
-      session_target: t.session_target ?? "isolated",
-      delivery_mode: t.delivery_mode ?? "none",
-      delivery_channel: t.delivery_channel ?? null,
-      delivery_to: t.delivery_to ?? null,
-      enabled: t.enabled ?? true,
-      triggered_at: t.triggered_at ?? null
-    }));
-    const state7 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
-    claudeSchedulerStates.set(codeName, state7);
+    const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
+    const state8 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
+    claudeSchedulerStates.set(codeName, state8);
     agentState.knownTasksHashes.set(agent.agent_id, combinedHash);
     log(`[claude-scheduler] Tasks synced for '${codeName}' (${taskInputs.length} task(s))`);
   }
   if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state6 = claudeSchedulerStates.get(codeName);
-  const ready = getReadyTasks(state6, inFlightClaudeTasks);
+  const state7 = claudeSchedulerStates.get(codeName);
+  const ready = getReadyTasks(state7, inFlightClaudeTasks);
   if (ready.length === 0) return;
   for (const task of ready) {
     if ((claudeTaskConcurrency.get(codeName) ?? 0) >= MAX_CLAUDE_CONCURRENCY) break;
@@ -7623,8 +8564,8 @@ async function deliverScheduledCardResult(codeName, agentId, cardId) {
     markScheduledCardDeliveryComplete(cardId);
     return "terminal";
   }
-  const state6 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
-  const task = state6.tasks[card.source_ref];
+  const state7 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
+  const task = state7.tasks[card.source_ref];
   if (!task) {
     log(`[scheduled-kanban] delivery: no scheduler task for source_ref=${card.source_ref} on '${codeName}' \u2014 skipping`);
     markScheduledCardDeliveryComplete(cardId);
@@ -7635,6 +8576,31 @@ async function deliverScheduledCardResult(codeName, agentId, cardId) {
     markScheduledCardDeliveryComplete(cardId);
     return "terminal";
   }
+  const deliveryPolicy = task.deliveryPolicy ?? "always";
+  if (deliveryPolicy === "never" || deliveryPolicy === "conditional" && card.suppress_delivery !== false) {
+    log(
+      `[scheduled-kanban] Suppressed by delivery_policy=${deliveryPolicy} for card ${cardId} (task '${task.name}') on '${codeName}' \u2014 result recorded on the card only (tombstone)`
+    );
+    if (task.deliveryMode === "announce" && task.deliveryTo) {
+      await reportDeliveryStatus(agentId, task.taskId, {
+        status: "skipped",
+        error_code: "SUPPRESSED_BY_POLICY"
+      });
+    }
+    markScheduledCardDeliveryComplete(cardId);
+    return "delivered";
+  }
+  if (card.suppress_delivery === true) {
+    log(`[scheduled-kanban] Suppressing delivery (structured flag) for card ${cardId} (task '${task.name}') on '${codeName}' \u2014 result recorded on the card only`);
+    if (task.deliveryMode === "announce" && task.deliveryTo) {
+      await reportDeliveryStatus(agentId, task.taskId, {
+        status: "skipped",
+        error_code: "NO_CONTENT"
+      });
+    }
+    markScheduledCardDeliveryComplete(cardId);
+    return "delivered";
+  }
   await processClaudeTaskResult(codeName, agentId, task.templateId, card.result ?? "", {
     mode: task.deliveryMode,
     channel: task.deliveryChannel,
@@ -7664,6 +8630,12 @@ async function reconcileScheduledRuns(codeName, agentId, board) {
   }
   if (m.size === 0) scheduledRunsByCode.delete(codeName);
 }
+var SCHEDULED_CARD_DELIVERY_CONTRACT = `
+
+---
+[delivery contract \u2014 system]
+The result you write on this card IS the message that will be delivered to the user. Delivery happens automatically from the card \u2014 never send, post, or message it yourself.
+If \u2014 and ONLY if \u2014 the task above contains explicit opt-out wording the user typed ("DO NOT notify me unless \u2026", "only if X", "stay silent unless \u2026") and that condition is NOT met this run, call kanban_done with suppress_delivery: true \u2014 your result is still recorded on the card but will NOT be messaged to the user. That is how you honor the user's do-not-notify instruction; a "nothing urgent" / "all quiet" result WITHOUT the flag would still be DELIVERED as a message. (Legacy fallback: writing exactly ${SUPPRESS_SENTINEL} alone as the result also suppresses.) If the task asks for a digest/report WITHOUT opt-out wording, a zero-item report is a valid deliverable \u2014 deliver it.`;
 async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
   const { run_id, kanban_item_id } = await startRun({
     agent_id: agentId,
@@ -7672,7 +8644,7 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
     metadata: { template_id: task.templateId, name: task.name, via: "kanban-inject" },
     materialize_kanban: {
       title: task.name,
-      description: prompt,
+      description: prompt + SCHEDULED_CARD_DELIVERY_CONTRACT,
       priority: 2,
       initial_status: "todo",
       ...deriveScheduledTaskNotify(task)
@@ -7683,9 +8655,11 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
     if (run_id) void finishRun(run_id, "failed", { outcomeMessage: "kanban materialise incomplete", completeKanbanItemId: kanban_item_id });
     return false;
   }
-  const nudge = `You have a new scheduled task on your kanban board: id=${kanban_item_id} title=${JSON.stringify(task.name)}. Call kanban_move("${kanban_item_id}", "in_progress"), do the work described on the card, then write the finished result onto the card and mark it done. Do NOT send, post, or message the result to anyone yourself \u2014 recording it on the card is enough; delivery to the recipient is handled for you.
-If \u2014 and ONLY if \u2014 the task description contains explicit opt-out wording the user typed (e.g. "DO NOT notify me unless urgent", "only if X", "stay silent unless \u2026") and that condition is NOT met this run, write exactly \`${SUPPRESS_SENTINEL}\` ALONE as the card result (no other text, no "nothing urgent", no notes) and mark the card done \u2014 that tells the delivery pipeline to skip the send. A report with zero items ("nothing urgent", "no follow-ups", "all quiet") is still a valid deliverable when the task asks for a digest, NOT a reason to suppress \u2014 when in doubt, deliver.
-` + formatRunMarker(run_id);
+  const suppressionTeaching = (task.deliveryPolicy ?? "always") === "conditional" ? `THIS task is CONDITIONAL: quiet runs stay SILENT automatically. Write your findings on the card and mark it done \u2014 if nothing met the user's criteria, NOTHING will be sent (no flag needed). If something DID meet the criteria and the user must be told, call kanban_done with suppress_delivery: false \u2014 that explicit assert is the ONLY way this result reaches the user.
+` : `If \u2014 and ONLY if \u2014 the task description contains explicit opt-out wording the user typed (e.g. "DO NOT notify me unless urgent", "only if X", "stay silent unless \u2026") and that condition is NOT met this run, call kanban_done with suppress_delivery: true \u2014 your result stays on the card but will NOT be messaged to the user. That is how you honor the user's do-not-notify instruction: a "nothing urgent" result without the flag would still be DELIVERED as a message. A report with zero items is only a valid deliverable when the task asks for a digest WITHOUT opt-out wording \u2014 when in doubt, deliver.
+`;
+  const nudge = `You have a new scheduled task on your kanban board: id=${kanban_item_id} title=${JSON.stringify(task.name)}. Call kanban_move("${kanban_item_id}", "in_progress"), do the work described on the card, then write the finished result onto the card and mark it done. Do NOT send, post, or message the result to anyone yourself \u2014 the result you write on the card IS the message that will be delivered to the user; delivery happens automatically from the card.
+` + suppressionTeaching + formatRunMarker(run_id);
   let injectStatus;
   try {
     injectStatus = await injectMessageWithStatus(codeName, "task", nudge, { task_name: "scheduled-task" }, log);
@@ -8108,6 +9082,11 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
     } catch (err) {
       log(`[persistent-session] Failed to provision orient hook for '${codeName}': ${err.message}`);
     }
+    try {
+      provisionAutoKanbanProgressHook(codeName);
+    } catch (err) {
+      log(`[persistent-session] Failed to provision auto-progress hook for '${codeName}': ${err.message}`);
+    }
     const sessionRunResult = await startRun({
       agent_id: agent.agent_id,
       source_type: "system",
@@ -8146,23 +9125,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
   const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
-    const taskInputs = tasks.map((t) => ({
-      id: t.id,
-      template_id: t.template_id,
-      name: t.name,
-      schedule_kind: t.schedule_kind,
-      schedule_expr: t.schedule_expr ?? null,
-      schedule_every: t.schedule_every ?? null,
-      schedule_at: t.schedule_at ?? null,
-      timezone: t.timezone ?? "UTC",
-      prompt: t.prompt ?? "",
-      session_target: t.session_target ?? "isolated",
-      delivery_mode: t.delivery_mode ?? "none",
-      delivery_channel: t.delivery_channel ?? null,
-      delivery_to: t.delivery_to ?? null,
-      enabled: t.enabled ?? true,
-      triggered_at: t.triggered_at ?? null
-    }));
+    const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
     const schedulerState = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
     claudeSchedulerStates.set(codeName, schedulerState);
     agentState.knownTasksHashes.set(agent.agent_id, stableTasksHash);
@@ -8170,9 +9133,9 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
   } else if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state6 = claudeSchedulerStates.get(codeName);
-  if (state6) {
-    const ready = getReadyTasks(state6, inFlightClaudeTasks);
+  const state7 = claudeSchedulerStates.get(codeName);
+  if (state7) {
+    const ready = getReadyTasks(state7, inFlightClaudeTasks);
     if (ready.length > 0) {
       log(`[persistent-session] ${ready.length} ready task(s) for '${codeName}': ${ready.map((t) => `${t.name}(next=${t.nextFireAt ? new Date(t.nextFireAt).toISOString() : "null"})`).join(", ")}`);
     }
@@ -8581,7 +9544,7 @@ ${escapeXml(msg.content)}
         return;
       }
       log(`[direct-chat] One-shot spawn for '${agent.codeName}' (msg=${msg.id}; host in-flight=${directChatSpawnGate.hostInFlight}, queued=${directChatSpawnGate.queuedCount})`);
-      const { getProjectDir: ccProjectDir } = await import("../claude-scheduler-EM24LTGV.js");
+      const { getProjectDir: ccProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
       const projDir = ccProjectDir(agent.codeName);
       const mcpConfigPath = join8(projDir, ".mcp.json");
       const serverNames = [];
@@ -9652,7 +10615,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-F6USL3EW.js");
+  } = await import("../claude-pair-runtime-GIUCD7IG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -10270,14 +11233,19 @@ function startManager(opts) {
       const raw = readFileSync9(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
-        state5.agents = parsed.agents;
-        log(`[startup] rehydrated ${state5.agents.length} agent state(s) from ${stateFile}`);
+        state6.agents = parsed.agents;
+        log(`[startup] rehydrated ${state6.agents.length} agent state(s) from ${stateFile}`);
       }
       if (parsed.circuitBreakerTrips && typeof parsed.circuitBreakerTrips === "object") {
         restartBreaker.hydrate(parsed.circuitBreakerTrips);
         const n = Object.keys(parsed.circuitBreakerTrips).length;
         if (n > 0) log(`[startup] rehydrated ${n} circuit-breaker trip(s) \u2014 agents will remain paused until manually resumed`);
       }
+      if (parsed.circuitBreakerAutoResumes && typeof parsed.circuitBreakerAutoResumes === "object") {
+        autoResumeMarkers = hydrateAutoResumeMarkers(parsed.circuitBreakerAutoResumes);
+        const n = autoResumeMarkers.size;
+        if (n > 0) log(`[startup] rehydrated ${n} auto-resume marker(s) (ENG-6088)`);
+      }
     }
   } catch (err) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
@@ -10455,8 +11423,14 @@ function deployMcpAssets() {
     "slack-channel.js",
     "direct-chat-channel.js",
     "telegram-channel.js",
-    "teams-channel.js"
+    "teams-channel.js",
     // ENG-6019
+    // ENG-6195: the staff-only admin-debug broker, bundled with the CLI (never
+    // published to npm). NOT in RESTARTABLE_CHANNEL_FILES — it's not a channel,
+    // so it doesn't drive the channel-restart path; the mcp-presence-reaper
+    // (re)starts it with the session, and a bundle update applies on the next
+    // natural session restart.
+    "augmented-admin.js"
   ]) {
     const src = join8(mcpSourceDir, file);
     const dst = join8(targetDir, file);
@@ -10529,10 +11503,12 @@ process.on("disconnect", () => {
 });
 export {
   ChildProcessError,
+  SCHEDULED_CARD_DELIVERY_CONTRACT,
   __resetScheduledDeliveryDedupeForTest,
   __setAgentChannelTokensForTest,
   applyRestartAcks,
   buildDoneCardNotification,
+  buildSchedulerTaskInput,
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
   claudeManagedSettingsPath,