@integrity-labs/agt-cli 0.28.1005 → 0.28.1007

package/dist/lib/manager-worker.js

@@ -1,6 +1,7 @@
 import {
   ApiError,
   COMPUTER_USE_MCP_KEY,
+  DEAD_CHANNEL_MS,
   FIRST_CONNECT_WINDOW_MS,
   HostFlagStore,
   RestartBreaker,
@@ -63,7 +64,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-6U4NB3LJ.js";
+} from "../chunk-FLJNRC3D.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -141,7 +142,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-TGTUE7Y2.js";
+} from "../chunk-SQX4ZGD5.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -240,16 +241,23 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-DVSYT4MU.js";
+} from "../chunk-XWMUQR65.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  claudeConfigDirFor,
+  claudeConfigDirIsReady,
+  effectiveClaudeJsonPath,
+  seedClaudeConfigFromLegacy
+} from "../chunk-EL5MWGGH.js";
 import "../chunk-DGUM43GV.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash20 } from "crypto";
-import { readFileSync as readFileSync33, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync13, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync13, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
 
 // src/lib/atomic-file-replace.ts
 import { copyFileSync, renameSync, unlinkSync } from "fs";
@@ -276,7 +284,7 @@ function defaultUnique() {
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join42, dirname as dirname11, delimiter as pathDelimiter } from "path";
-import { homedir as homedir18 } from "os";
+import { homedir as homedir17 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/provisioning/channel-policy-env.js
@@ -1053,9 +1061,157 @@ function clearOnboardingDriveMarker(path) {
   }
 }
 
-// src/lib/channel-quarantine.ts
+// src/lib/channel-auto-resume.ts
 import { readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
+var AUTO_RESUME_BASE_MS = 2 * 60 * 6e4;
+var AUTO_RESUME_MAX_MS = 24 * 60 * 6e4;
+var AUTO_RESUME_MAX_ATTEMPTS = 5;
+var QUARANTINE_DWELL_FLOOR_MS = 18e4;
+var AUTO_RESUME_SUCCESS_GRACE_MS = 2 * (DEAD_CHANNEL_MS + QUARANTINE_DWELL_FLOOR_MS);
+function defaultResumeHistoryPath(configDir) {
+  return join3(configDir, "channel-quarantine-resumes.json");
+}
+function isResumeFile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  for (const forAgent of Object.values(value)) {
+    if (!forAgent || typeof forAgent !== "object" || Array.isArray(forAgent)) return false;
+    for (const entry of Object.values(forAgent)) {
+      if (!entry || typeof entry !== "object") return false;
+      const e = entry;
+      if (e.gaveUpLogged !== void 0 && typeof e.gaveUpLogged !== "boolean") return false;
+      const attempts = e.attempts;
+      const lastAttemptAt = e.lastAttemptAt;
+      if (typeof attempts !== "number" || !Number.isSafeInteger(attempts) || attempts < 0 || typeof lastAttemptAt !== "number" || !Number.isSafeInteger(lastAttemptAt) || lastAttemptAt < 0) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+var ChannelResumeHistoryStore = class {
+  path;
+  cache = null;
+  constructor(path) {
+    this.path = path;
+  }
+  load() {
+    if (this.cache) return this.cache;
+    try {
+      const parsed = JSON.parse(readFileSync3(this.path, "utf-8"));
+      this.cache = isResumeFile(parsed) ? parsed : {};
+    } catch {
+      this.cache = {};
+    }
+    return this.cache;
+  }
+  persist() {
+    atomicWriteFileSync(this.path, JSON.stringify(this.cache ?? {}, null, 2));
+  }
+  get(codeName, serverKey) {
+    return this.load()[codeName]?.[serverKey];
+  }
+  /**
+   * Every recorded key for one agent, as [storedKey, entry] pairs.
+   *
+   * Needed because the success sweep asks about channels that are NOT in the
+   * quarantine store — a trial that worked leaves history behind and no marker,
+   * so a loop over quarantine entries can never reach it. Returns the STORED
+   * key (see `resumeHistoryKey`), not the channel key, because the caller is
+   * the only thing that knows which namespace it is working in.
+   */
+  entriesFor(codeName) {
+    return Object.entries(this.load()[codeName] ?? {});
+  }
+  /** Record a trial. Returns the entry as written. */
+  recordAttempt(codeName, serverKey, now) {
+    const file = this.load();
+    const forAgent = file[codeName] ??= {};
+    const prior = forAgent[serverKey];
+    const next = {
+      attempts: (prior?.attempts ?? 0) + 1,
+      lastAttemptAt: now,
+      // Carried, not reset: a further trial inside the same episode must not
+      // re-arm the give-up line. It clears with the entry itself on forget().
+      ...prior?.gaveUpLogged ? { gaveUpLogged: true } : {}
+    };
+    forAgent[serverKey] = next;
+    this.persist();
+    return next;
+  }
+  /**
+   * Forget a key's history — called when an OPERATOR clears the quarantine.
+   *
+   * A human pressing Re-enable is a statement that the underlying fault was
+   * addressed, so the next automatic trial should start from a clean two hours
+   * rather than inheriting strikes from before the fix. Without this an
+   * operator could fix a channel, watch it break again for an unrelated reason
+   * weeks later, and find auto-resume already exhausted.
+   */
+  forget(codeName, serverKey) {
+    const file = this.load();
+    const forAgent = file[codeName];
+    if (!forAgent || !forAgent[serverKey]) return false;
+    delete forAgent[serverKey];
+    if (Object.keys(forAgent).length === 0) delete file[codeName];
+    this.persist();
+    return true;
+  }
+  /**
+   * Latch the give-up line for this key. Returns whether it had ALREADY been
+   * logged, so the caller logs only on the first call of an episode.
+   *
+   * Returns true (already logged) when there is no entry at all: with no
+   * history there are no strikes, so there is nothing to have given up ON, and
+   * announcing an abandonment would be false.
+   */
+  noteGaveUpLogged(codeName, serverKey) {
+    const file = this.load();
+    const entry = file[codeName]?.[serverKey];
+    if (!entry) return true;
+    if (entry.gaveUpLogged) return true;
+    entry.gaveUpLogged = true;
+    this.persist();
+    return false;
+  }
+  __invalidateCacheForTests() {
+    this.cache = null;
+  }
+};
+function resumeHistoryKey(mode, serverKey) {
+  return mode === "shadow" ? `shadow:${serverKey}` : serverKey;
+}
+function backoffForAttempt(attemptsAlreadyMade) {
+  const doubled = AUTO_RESUME_BASE_MS * 2 ** Math.max(0, attemptsAlreadyMade);
+  return Math.min(doubled, AUTO_RESUME_MAX_MS);
+}
+function resolveAutoResumeEffectiveMode(autoResume, quarantine) {
+  if (autoResume === "enforce" && quarantine !== "enforce") return "shadow";
+  return autoResume;
+}
+function autoResumeSuccessGraceMs(configuredDwellMs) {
+  const dwell = typeof configuredDwellMs === "number" && Number.isFinite(configuredDwellMs) && configuredDwellMs > QUARANTINE_DWELL_FLOOR_MS ? configuredDwellMs : QUARANTINE_DWELL_FLOOR_MS;
+  return 2 * (DEAD_CHANNEL_MS + dwell);
+}
+function shouldForgetResumeHistory(input) {
+  if (input.isQuarantined) return false;
+  const history = input.history;
+  if (!history || history.attempts === 0) return false;
+  return input.now - history.lastAttemptAt >= autoResumeSuccessGraceMs(input.configuredDwellMs);
+}
+function decideChannelAutoResume(input) {
+  const attempts = input.history?.attempts ?? 0;
+  if (attempts >= AUTO_RESUME_MAX_ATTEMPTS) return { action: "give-up", attempts };
+  const since = Math.max(input.quarantinedAt, input.history?.lastAttemptAt ?? 0);
+  const waited = input.now - since;
+  const need = backoffForAttempt(attempts);
+  if (waited >= need) return { action: "resume", waitedMs: waited, attempt: attempts + 1 };
+  return { action: "wait", dueInMs: need - waited, attempt: attempts + 1 };
+}
+
+// src/lib/channel-quarantine.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
 var ESSENTIAL_CHANNEL_KEYS = /* @__PURE__ */ new Set(["direct-chat", "augmented"]);
 var OPTIONAL_CHANNEL_KEYS = /* @__PURE__ */ new Set([
   "telegram",
@@ -1087,7 +1243,7 @@ function classifyChannelCriticality(serverKey, entry) {
   return "essential";
 }
 function defaultQuarantinePath(configDir) {
-  return join3(configDir, "channel-quarantine.json");
+  return join4(configDir, "channel-quarantine.json");
 }
 var ChannelQuarantineStore = class {
   path;
@@ -1098,7 +1254,7 @@ var ChannelQuarantineStore = class {
   load() {
     if (this.cache) return this.cache;
     try {
-      const raw = readFileSync3(this.path, "utf-8");
+      const raw = readFileSync4(this.path, "utf-8");
       const parsed = JSON.parse(raw);
       this.cache = isQuarantineFile(parsed) ? parsed : {};
     } catch {
@@ -1186,13 +1342,13 @@ function isQuarantineFile(value) {
 }
 
 // src/lib/claude-md-size.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 function measureClaudeMd(configDir, codeName, ceiling = CLAUDE_MD_CONTEXT_ALARM_CHARS) {
   let chars;
   let bytes;
   try {
-    const buf = readFileSync4(join4(configDir, codeName, "project", "CLAUDE.md"));
+    const buf = readFileSync5(join5(configDir, codeName, "project", "CLAUDE.md"));
     chars = buf.toString("utf8").length;
     bytes = buf.length;
   } catch {
@@ -1212,8 +1368,8 @@ function measureClaudeMd(configDir, codeName, ceiling = CLAUDE_MD_CONTEXT_ALARM_
 function measureCoreKnowledgeDescription(configDir, codeName) {
   let text;
   try {
-    text = readFileSync4(
-      join4(configDir, codeName, "project", ".claude", "skills", "core-knowledge", "SKILL.md"),
+    text = readFileSync5(
+      join5(configDir, codeName, "project", ".claude", "skills", "core-knowledge", "SKILL.md"),
       "utf8"
     );
   } catch {
@@ -1247,16 +1403,16 @@ function logClaudeMdCeilingTransition(codeName, report, log2) {
 }
 
 // ../../packages/core/dist/integrations/forwarded-tools-report.js
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join6 } from "path";
 var FORWARDED_TOOLS_REPORT_FILENAME = "forwarded-tools.json";
 function forwardedToolsReportPath(agentDir) {
-  return join5(agentDir, FORWARDED_TOOLS_REPORT_FILENAME);
+  return join6(agentDir, FORWARDED_TOOLS_REPORT_FILENAME);
 }
 function readForwardedToolsReport(agentDir) {
   let raw;
   try {
-    raw = readFileSync5(forwardedToolsReportPath(agentDir), "utf-8");
+    raw = readFileSync6(forwardedToolsReportPath(agentDir), "utf-8");
   } catch {
     return null;
   }
@@ -1873,9 +2029,9 @@ var DependencyRecoveryLedger = class {
 // src/lib/mcp-assets-ready.ts
 import { existsSync as nodeExistsSync, readFileSync as nodeReadFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join6, resolve, sep } from "path";
+import { join as join7, resolve, sep } from "path";
 function getSharedMcpDir(homeDir = homedir2()) {
-  return join6(homeDir, ".augmented", "_mcp");
+  return join7(homeDir, ".augmented", "_mcp");
 }
 function isPathInsideDir(candidate, dir) {
   const resolvedDir = resolve(dir);
@@ -1885,11 +2041,11 @@ function isPathInsideDir(candidate, dir) {
 }
 function findMissingMcpBundles(mcpConfigPath, deps = {}) {
   const existsSync20 = deps.existsSync ?? nodeExistsSync;
-  const readFileSync34 = deps.readFileSync ?? nodeReadFileSync;
+  const readFileSync35 = deps.readFileSync ?? nodeReadFileSync;
   const mcpDir = deps.mcpDir ?? getSharedMcpDir();
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync34(mcpConfigPath, "utf-8"));
+    parsed = JSON.parse(readFileSync35(mcpConfigPath, "utf-8"));
   } catch {
     return [];
   }
@@ -1927,7 +2083,7 @@ function formatMissingMcpBundles(missing) {
 }
 
 // src/lib/self-update-coalesce.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname4 } from "path";
 var DEFAULT_SELF_UPDATE_COALESCE_MS = 30 * 60 * 1e3;
 function resolveCoalesceWindowMs(env = process.env) {
@@ -1937,7 +2093,7 @@ function resolveCoalesceWindowMs(env = process.env) {
   if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_SELF_UPDATE_COALESCE_MS;
   return Math.trunc(parsed);
 }
-function readLastSelfUpdateAppliedMs(markerPath, now = Date.now(), read = (p) => readFileSync6(p, "utf-8")) {
+function readLastSelfUpdateAppliedMs(markerPath, now = Date.now(), read = (p) => readFileSync7(p, "utf-8")) {
   let raw;
   try {
     raw = read(markerPath);
@@ -2242,11 +2398,11 @@ async function reportModelApiError(opts) {
 }
 
 // src/lib/claude-pid-tracker.ts
-import { existsSync, readFileSync as readFileSync7 } from "fs";
+import { existsSync, readFileSync as readFileSync8 } from "fs";
 function readPidFile(path) {
   if (!existsSync(path)) return { version: 1, spawns: [] };
   try {
-    const raw = JSON.parse(readFileSync7(path, "utf-8"));
+    const raw = JSON.parse(readFileSync8(path, "utf-8"));
     if (raw.version !== 1 || !Array.isArray(raw.spawns)) return { version: 1, spawns: [] };
     const spawns = raw.spawns.filter(
       (s) => !!s && typeof s.pid === "number" && Number.isFinite(s.pid) && s.pid > 0
@@ -2346,14 +2502,14 @@ async function killSessionsConcurrently(sessions, killOne) {
 }
 
 // src/lib/direct-chat-delivery.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var DEFAULT_DIRECT_CHAT_MAX_AGE_MS = 30 * 6e4;
 function directChatMaxAgeMs() {
   const raw = parseInt(process.env["AGT_DIRECT_CHAT_MAX_AGE_MS"] ?? "", 10);
   return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_DIRECT_CHAT_MAX_AGE_MS;
 }
 function directChatDoorbellPath(agentId, home) {
-  return join7(home, ".augmented", agentId, "direct-chat-doorbell");
+  return join8(home, ".augmented", agentId, "direct-chat-doorbell");
 }
 function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
   if (!maxAgeMs || maxAgeMs <= 0) return false;
@@ -2364,8 +2520,8 @@ function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
 }
 
 // src/lib/review-poster-asset.ts
-import { copyFileSync as copyFileSync2, chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, join as join8 } from "path";
+import { copyFileSync as copyFileSync2, chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname5, join as join9 } from "path";
 import { fileURLToPath } from "url";
 var POSTER_FILENAME = "post-review-findings.mjs";
 var AUTH_FILENAME = "obiwan-auth.mjs";
@@ -2378,14 +2534,14 @@ function resolveBundledReviewAssetDir() {
   const moduleDir = dirname5(fileURLToPath(import.meta.url));
   const candidates = [
     // Built output: dist/<chunk>.js → dist/assets/review
-    join8(moduleDir, "assets", REVIEW_ASSET_DIRNAME),
+    join9(moduleDir, "assets", REVIEW_ASSET_DIRNAME),
     // Built output sibling case: dist/<sub>/<chunk>.js → dist/assets/review
-    join8(moduleDir, "..", "assets", REVIEW_ASSET_DIRNAME),
+    join9(moduleDir, "..", "assets", REVIEW_ASSET_DIRNAME),
     // Dev source: src/lib/review-poster-asset.ts → ../../assets/review
-    join8(moduleDir, "..", "..", "assets", REVIEW_ASSET_DIRNAME)
+    join9(moduleDir, "..", "..", "assets", REVIEW_ASSET_DIRNAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync2(join8(candidate, POSTER_FILENAME))) return candidate;
+    if (existsSync2(join9(candidate, POSTER_FILENAME))) return candidate;
   }
   throw new Error(
     `[review-poster] could not locate bundled assets; tried:
@@ -2393,18 +2549,18 @@ function resolveBundledReviewAssetDir() {
   );
 }
 function reviewPosterDir(codeName) {
-  return join8(getFramework("claude-code").getAgentDir(codeName), REVIEW_ASSET_DIRNAME);
+  return join9(getFramework("claude-code").getAgentDir(codeName), REVIEW_ASSET_DIRNAME);
 }
 function provisionReviewPoster(codeName, sourceDir = resolveBundledReviewAssetDir()) {
   const destDir = reviewPosterDir(codeName);
   mkdirSync4(destDir, { recursive: true });
   for (const [name, mode] of ASSET_FILES) {
-    const src = join8(sourceDir, name);
-    const dest = join8(destDir, name);
+    const src = join9(sourceDir, name);
+    const dest = join9(destDir, name);
     if (!existsSync2(src)) {
       throw new Error(`[review-poster] bundled asset missing: ${src}`);
     }
-    if (!existsSync2(dest) || !readFileSync8(src).equals(readFileSync8(dest))) {
+    if (!existsSync2(dest) || !readFileSync9(src).equals(readFileSync9(dest))) {
       copyFileSync2(src, dest);
     }
     chmodSync(dest, mode);
@@ -2413,7 +2569,7 @@ function provisionReviewPoster(codeName, sourceDir = resolveBundledReviewAssetDi
 
 // src/lib/id-keyed-migration.ts
 import { existsSync as existsSync3, lstatSync, readlinkSync, renameSync as renameSync2 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { homedir as homedir3 } from "os";
 var ID_KEYED_MIGRATION_FLAG = "id-keyed-layout-migration";
 function agentHasActiveWhatsapp(channelConfigs, codeNameDir) {
@@ -2421,7 +2577,7 @@ function agentHasActiveWhatsapp(channelConfigs, codeNameDir) {
     return true;
   }
   try {
-    if (existsSync3(join9(codeNameDir, "whatsapp-pending-inbound"))) return true;
+    if (existsSync3(join10(codeNameDir, "whatsapp-pending-inbound"))) return true;
   } catch {
   }
   return false;
@@ -2453,10 +2609,10 @@ function finishTranscriptMove(oldCwd, newCwd, codeName, log2) {
 function maybeMigrateAgentToIdKeyedLayout(agent, deps) {
   const home = deps.home ?? homedir3();
   const { code_name: codeName, agent_id: agentId } = agent;
-  const codeNamePath = join9(home, ".augmented", codeName);
-  const idPath = join9(home, ".augmented", agentId);
-  const oldCwd = join9(home, ".augmented", codeName, "project");
-  const newCwd = join9(idPath, "project");
+  const codeNamePath = join10(home, ".augmented", codeName);
+  const idPath = join10(home, ".augmented", agentId);
+  const oldCwd = join10(home, ".augmented", codeName, "project");
+  const newCwd = join10(idPath, "project");
   let codeNameKind;
   try {
     codeNameKind = lstatSync(codeNamePath).isSymbolicLink() ? "symlink" : "realdir";
@@ -2583,8 +2739,8 @@ function collectEnvGates(env) {
 }
 
 // ../../packages/core/dist/direct-chat/cursor-advance-telemetry.js
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { join as join10 } from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
 var CURSOR_SHORTFALL_COUNTER_SUFFIX = "-cursor-advance-classifications.json";
 function recordCursorAdvanceOutcome(agentDir, source, route, verdict) {
   if (!agentDir)
@@ -2592,10 +2748,10 @@ function recordCursorAdvanceOutcome(agentDir, source, route, verdict) {
   const key = cursorAdvanceCounterKey(route, verdict);
   if (key === null)
     return;
-  const path = join10(agentDir, `${source}${CURSOR_SHORTFALL_COUNTER_SUFFIX}`);
+  const path = join11(agentDir, `${source}${CURSOR_SHORTFALL_COUNTER_SUFFIX}`);
   const counts = {};
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       for (const [k, v] of Object.entries(parsed)) {
         if (typeof v === "number" && Number.isInteger(v) && v >= 0)
@@ -2612,7 +2768,7 @@ function recordCursorAdvanceOutcome(agentDir, source, route, verdict) {
 }
 
 // src/lib/artifact-stream.ts
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { homedir as homedir4 } from "os";
 import { readdir, stat, readFile } from "fs/promises";
 var ARTEFACT_ENTRY_FILE = "index.html";
@@ -2698,7 +2854,7 @@ var ArtifactStreamScanner = class {
         return;
       }
       for (const name of names) {
-        const file = join11(this.artifactsDir, name, ARTEFACT_ENTRY_FILE);
+        const file = join12(this.artifactsDir, name, ARTEFACT_ENTRY_FILE);
         const mtime = await this.fsDeps.mtimeMs(file).catch(() => null);
         if (mtime === null) continue;
         if (this.seenMtime.get(name) === mtime) continue;
@@ -2729,7 +2885,7 @@ var ArtifactStreamScanner = class {
   }
 };
 function artifactsDirFor(codeName) {
-  return join11(homedir4(), ".augmented", codeName, "artifacts");
+  return join12(homedir4(), ".augmented", codeName, "artifacts");
 }
 var nodeArtifactFs = {
   async listArtefactNames(artifactsDir) {
@@ -3005,12 +3161,12 @@ async function maybePollHostUsage(deps) {
 import { createHash as createHash6 } from "crypto";
 import { readFile as readFile3, readdir as readdir3 } from "fs/promises";
 import { homedir as homedir6, platform as platform2 } from "os";
-import { dirname as dirname6, join as join13 } from "path";
+import { dirname as dirname6, join as join14 } from "path";
 
 // src/lib/claude-auth-detect.ts
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { homedir as homedir5, platform } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -3025,16 +3181,16 @@ async function detectClaudeAuth() {
 }
 async function findClaudeCredentialsPaths() {
   const candidates = [
-    join12(homedir5(), ".claude", ".credentials.json"),
-    join12(homedir5(), ".claude", "credentials.json")
+    join13(homedir5(), ".claude", ".credentials.json"),
+    join13(homedir5(), ".claude", "credentials.json")
   ];
   const isLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
   if (isLinuxRoot) {
     try {
       const entries = await readdir2("/home", { withFileTypes: true });
       for (const entry of entries.filter((entry2) => entry2.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
-        candidates.push(join12("/home", entry.name, ".claude", ".credentials.json"));
-        candidates.push(join12("/home", entry.name, ".claude", "credentials.json"));
+        candidates.push(join13("/home", entry.name, ".claude", ".credentials.json"));
+        candidates.push(join13("/home", entry.name, ".claude", "credentials.json"));
       }
     } catch {
     }
@@ -3118,7 +3274,7 @@ async function candidateHomes() {
     try {
       const entries = await readdir3("/home", { withFileTypes: true });
       for (const entry of entries.filter((e) => e.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
-        homes.push(join13("/home", entry.name));
+        homes.push(join14("/home", entry.name));
       }
     } catch {
     }
@@ -3138,11 +3294,11 @@ async function homeOfActiveCredentials() {
 async function claudeConfigCandidatePaths() {
   const paths = [];
   const configDir = process.env["CLAUDE_CONFIG_DIR"]?.trim();
-  if (configDir) paths.push(join13(configDir, ".claude.json"));
+  if (configDir) paths.push(join14(configDir, ".claude.json"));
   const activeHome = await homeOfActiveCredentials();
-  if (activeHome) paths.push(join13(activeHome, ".claude.json"));
+  if (activeHome) paths.push(join14(activeHome, ".claude.json"));
   for (const home of await candidateHomes()) {
-    const path = join13(home, ".claude.json");
+    const path = join14(home, ".claude.json");
     if (!paths.includes(path)) paths.push(path);
   }
   return paths;
@@ -3261,9 +3417,9 @@ function diffAuthTuples(recorded, current) {
 // src/lib/account-enforcement-marker.ts
 import { mkdirSync as mkdirSync5, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function accountEnforcementMarkerPath(codeName) {
-  return join14(homedir7(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
+  return join15(homedir7(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
 }
 function syncAccountEnforcementMarker(codeName, level, log2 = (m) => process.stderr.write(`${m}
 `), text) {
@@ -3271,8 +3427,8 @@ function syncAccountEnforcementMarker(codeName, level, log2 = (m) => process.std
     clearAccountEnforcementMarker(codeName, log2);
     return;
   }
-  const dir = join14(homedir7(), ".augmented", codeName);
-  const path = join14(dir, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
+  const dir = join15(homedir7(), ".augmented", codeName);
+  const path = join15(dir, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
   const tempPath = `${path}.${process.pid}.tmp`;
   try {
     mkdirSync5(dir, { recursive: true });
@@ -3297,8 +3453,8 @@ function clearAccountEnforcementMarker(codeName, log2 = (m) => process.stderr.wr
 }
 
 // src/lib/token-usage-monitor.ts
-import { readdirSync, readFileSync as readFileSync10, statSync } from "fs";
-import { join as join15 } from "path";
+import { readdirSync, readFileSync as readFileSync11, statSync } from "fs";
+import { join as join16 } from "path";
 var MIN_CHECK_INTERVAL_MS2 = 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
 var MAX_ENTRIES_PER_POST = 200;
@@ -3327,7 +3483,7 @@ async function maybeReportTokenUsage(args) {
     if (!name.endsWith(".jsonl")) continue;
     const sessionId = name.slice(0, -".jsonl".length);
     if (!sessionId) continue;
-    const path = join15(dir, name);
+    const path = join16(dir, name);
     let st;
     try {
       st = statSync(path);
@@ -3343,7 +3499,7 @@ async function maybeReportTokenUsage(args) {
     }
     let content;
     try {
-      content = readFileSync10(path, "utf-8");
+      content = readFileSync11(path, "utf-8");
     } catch (err) {
       log2(`[token-usage] read failed for '${codeName}/${name}': ${err.message}`);
       continue;
@@ -3424,8 +3580,8 @@ async function maybeReportTokenUsage(args) {
 }
 
 // src/lib/workflow-run-reconciler.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync2 } from "fs";
-import { join as join16 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync as statSync2 } from "fs";
+import { join as join17 } from "path";
 var MIN_CHECK_INTERVAL_MS3 = 5 * 6e4;
 var SETTLE_MS = 3e4;
 var TRANSCRIPT_MTIME_WINDOW_MS2 = 2 * 24 * 60 * 60 * 1e3;
@@ -3444,7 +3600,7 @@ function collectJsonlRecursive(dir, minMtimeMs, out, depth) {
     return;
   }
   for (const name of entries) {
-    const p = join16(dir, name);
+    const p = join17(dir, name);
     let st;
     try {
       st = statSync2(p);
@@ -3467,7 +3623,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
     return out;
   }
   for (const name of entries) {
-    const path = join16(transcriptDir, name);
+    const path = join17(transcriptDir, name);
     let st;
     try {
       st = statSync2(path);
@@ -3479,7 +3635,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
       continue;
     }
     if (st.isDirectory()) {
-      collectJsonlRecursive(join16(path, "subagents"), minMtimeMs, out, 0);
+      collectJsonlRecursive(join17(path, "subagents"), minMtimeMs, out, 0);
     }
   }
   return out;
@@ -3524,7 +3680,7 @@ async function maybeReconcileWorkflowRunTokens(args) {
   const contents = [];
   for (const path of files) {
     try {
-      contents.push(readFileSync11(path, "utf-8"));
+      contents.push(readFileSync12(path, "utf-8"));
     } catch {
     }
   }
@@ -3569,8 +3725,8 @@ async function maybeReconcileWorkflowRunTokens(args) {
 }
 
 // src/lib/conversation-evaluator.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { join as join17 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync13, statSync as statSync3 } from "fs";
+import { join as join18 } from "path";
 
 // src/lib/detect-meta-egress.ts
 var REPOST_PREAMBLE_WINDOW = 200;
@@ -4055,7 +4211,7 @@ function readRecentTurns(dir, nowMs) {
       return;
     }
     for (const ent of entries) {
-      const full = join17(d, ent.name);
+      const full = join18(d, ent.name);
       if (ent.isDirectory()) {
         visit(full);
         continue;
@@ -4070,7 +4226,7 @@ function readRecentTurns(dir, nowMs) {
       if (nowMs - mtimeMs > TRANSCRIPT_MTIME_WINDOW_MS3) continue;
       let content;
       try {
-        content = readFileSync12(full, "utf8");
+        content = readFileSync13(full, "utf8");
       } catch {
         continue;
       }
@@ -4443,22 +4599,22 @@ async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
 
 // src/lib/tool-call-audit.ts
 import { homedir as homedir11 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // src/lib/agent-logging-mode.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var LOGGING_MODES = ["hash-only", "redacted", "full-local"];
 function charterPath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir8());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join18(home, ".augmented", key, "provision", "CHARTER.md");
+  return join19(home, ".augmented", key, "provision", "CHARTER.md");
 }
 function readAgentLoggingMode(codeName, homeDir) {
   let raw;
   try {
-    raw = readFileSync13(charterPath(codeName, homeDir), "utf-8");
+    raw = readFileSync14(charterPath(codeName, homeDir), "utf-8");
   } catch {
     return { mode: null, reason: "no-charter" };
   }
@@ -4482,15 +4638,15 @@ function loggingModeWithholdsTargets(reading) {
 
 // src/lib/tool-call-path-salt.ts
 import { randomBytes } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync14, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname7, join as join19 } from "path";
+import { dirname as dirname7, join as join20 } from "path";
 var SALT_BYTES = 32;
 var SALT_RE = /^[0-9a-f]{64}$/;
 function pathSaltPath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir9());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join19(home, ".augmented", key, "tool-call-path-salt");
+  return join20(home, ".augmented", key, "tool-call-path-salt");
 }
 function readToolCallPathSalt(codeName, homeDir) {
   let file;
@@ -4501,7 +4657,7 @@ function readToolCallPathSalt(codeName, homeDir) {
   }
   try {
     if (existsSync4(file)) {
-      const existing = readFileSync14(file, "utf-8").trim();
+      const existing = readFileSync15(file, "utf-8").trim();
       if (SALT_RE.test(existing)) return existing;
     }
   } catch {
@@ -4527,8 +4683,8 @@ function readToolCallPathSalt(codeName, homeDir) {
 import { statSync as statSync4 } from "fs";
 
 // src/lib/tool-call-extractor.ts
-import { closeSync, fstatSync, openSync, readFileSync as readFileSync15, readSync, readdirSync as readdirSync4 } from "fs";
-import { basename as basename2, join as join20, relative } from "path";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync16, readSync, readdirSync as readdirSync4 } from "fs";
+import { basename as basename2, join as join21, relative } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/lib/tool-call-redaction.ts
@@ -4657,7 +4813,7 @@ function redactToolTargetInner(toolName, input, ctx) {
 var EXTRACTOR_VERSION = "e1";
 function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
   const files = [];
-  const mainAbs = join20(transcriptDir, `${sessionId}.jsonl`);
+  const mainAbs = join21(transcriptDir, `${sessionId}.jsonl`);
   files.push({
     absPath: mainAbs,
     relPath: relative(projectsRoot, mainAbs),
@@ -4665,7 +4821,7 @@ function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
     isSubagent: false,
     subagentId: null
   });
-  const subDir = join20(transcriptDir, sessionId, "subagents");
+  const subDir = join21(transcriptDir, sessionId, "subagents");
   let entries;
   try {
     entries = readdirSync4(subDir);
@@ -4674,7 +4830,7 @@ function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
   }
   for (const name of entries) {
     if (!name.endsWith(".jsonl")) continue;
-    const abs = join20(subDir, name);
+    const abs = join21(subDir, name);
     const stem = basename2(name, ".jsonl");
     files.push({
       absPath: abs,
@@ -4872,9 +5028,9 @@ function extractTranscriptWindow(file, opts, from) {
 }
 
 // src/lib/tool-call-cursor.ts
-import { existsSync as existsSync5, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync17 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var COVERAGE_DISPOSITIONS = [
   "ok",
   "not_entitled",
@@ -4929,13 +5085,13 @@ function parseCursorKey(key) {
 function cursorStatePath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir10());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join21(home, ".augmented", key, "tool-call-cursors.json");
+  return join22(home, ".augmented", key, "tool-call-cursors.json");
 }
 function loadCursors(path) {
   const out = /* @__PURE__ */ new Map();
   if (!existsSync5(path)) return out;
   try {
-    const parsed = JSON.parse(readFileSync16(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(path, "utf-8"));
     if (!parsed || parsed.version !== 1 || typeof parsed.files !== "object") return out;
     for (const [k, v] of Object.entries(parsed.files)) {
       if (!v || typeof v !== "object") continue;
@@ -5342,7 +5498,7 @@ async function maybeScanToolCalls(args) {
       log2(`[tool-call-audit] ${codeName}: no path-hash salt available \u2014 file targets withheld`);
     }
     const home = args.homeDir ?? (process.env["HOME"]?.trim() || homedir11());
-    const projectsRoot = args.projectsRoot ?? join22(home, ".claude", "projects");
+    const projectsRoot = args.projectsRoot ?? join23(home, ".claude", "projects");
     const transcriptDir = args.transcriptDir ?? sessionTranscriptDir(getProjectDir(codeName));
     const current = peekCurrentSession(codeName);
     const sessionIds = current ? [current.sessionId] : [];
@@ -5371,11 +5527,11 @@ async function maybeScanToolCalls(args) {
 }
 
 // src/lib/activity-cache-monitor.ts
-import { existsSync as existsSync6, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync18 } from "fs";
 import { homedir as homedir12 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var MIN_CHECK_INTERVAL_MS7 = 6e4;
-var STATS_CACHE_PATH = join23(homedir12(), ".claude", "stats-cache.json");
+var STATS_CACHE_PATH = join24(homedir12(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var state7 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
@@ -5423,7 +5579,7 @@ async function maybeReportActivityCache(args) {
   }
   let raw;
   try {
-    raw = readFileSync17(STATS_CACHE_PATH, "utf-8");
+    raw = readFileSync18(STATS_CACHE_PATH, "utf-8");
   } catch (err) {
     log2(`[activity-cache] readFileSync failed: ${err.message}`);
     return;
@@ -5726,7 +5882,7 @@ import { createHash as createHash9 } from "crypto";
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync5,
   renameSync as renameSync5,
   rmSync as rmSync3,
@@ -5734,7 +5890,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var KNOWLEDGE_FETCH_CHUNK = 100;
 var CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -5743,12 +5899,12 @@ function knowledgeHash(content) {
   return createHash9("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath(cacheDir, hash) {
-  return join24(cacheDir, hash);
+  return join25(cacheDir, hash);
 }
 function readCachedKnowledge(cacheDir, hash) {
   const path = cachePath(cacheDir, hash);
   try {
-    const content = readFileSync18(path, "utf-8");
+    const content = readFileSync19(path, "utf-8");
     try {
       const now = /* @__PURE__ */ new Date();
       utimesSync(path, now, now);
@@ -5777,7 +5933,7 @@ function sweepKnowledgeCache(cacheDir, now = Date.now()) {
   try {
     if (!existsSync7(cacheDir)) return;
     for (const name of readdirSync5(cacheDir)) {
-      const path = join24(cacheDir, name);
+      const path = join25(cacheDir, name);
       try {
         if (now - statSync6(path).mtimeMs > CACHE_TTL_MS) rmSync3(path, { force: true });
       } catch {
@@ -5829,7 +5985,7 @@ import { createHash as createHash10 } from "crypto";
 import {
   existsSync as existsSync8,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync6,
   renameSync as renameSync6,
   rmSync as rmSync4,
@@ -5837,7 +5993,7 @@ import {
   utimesSync as utimesSync2,
   writeFileSync as writeFileSync9
 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var MEMORY_FETCH_CHUNK = 100;
 var CACHE_TTL_MS2 = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS2 = 24 * 60 * 60 * 1e3;
@@ -5846,12 +6002,12 @@ function memoryHash(content) {
   return createHash10("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath2(cacheDir, hash) {
-  return join25(cacheDir, hash);
+  return join26(cacheDir, hash);
 }
 function readCachedMemory(cacheDir, hash) {
   const path = cachePath2(cacheDir, hash);
   try {
-    const content = readFileSync19(path, "utf-8");
+    const content = readFileSync20(path, "utf-8");
     try {
       const now = /* @__PURE__ */ new Date();
       utimesSync2(path, now, now);
@@ -5880,7 +6036,7 @@ function sweepMemoryCache(cacheDir, now = Date.now()) {
   try {
     if (!existsSync8(cacheDir)) return;
     for (const name of readdirSync6(cacheDir)) {
-      const path = join25(cacheDir, name);
+      const path = join26(cacheDir, name);
       try {
         if (now - statSync7(path).mtimeMs > CACHE_TTL_MS2) rmSync4(path, { force: true });
       } catch {
@@ -5938,7 +6094,7 @@ import { createHash as createHash11 } from "crypto";
 import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync7,
   renameSync as renameSync7,
   rmSync as rmSync5,
@@ -5946,7 +6102,7 @@ import {
   utimesSync as utimesSync3,
   writeFileSync as writeFileSync10
 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var SKILL_FETCH_CHUNK = 100;
 var CACHE_TTL_MS3 = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS3 = 24 * 60 * 60 * 1e3;
@@ -5955,12 +6111,12 @@ function skillHash(content) {
   return createHash11("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath3(cacheDir, hash) {
-  return join26(cacheDir, hash);
+  return join27(cacheDir, hash);
 }
 function readCachedSkill(cacheDir, hash) {
   const path = cachePath3(cacheDir, hash);
   try {
-    const content = readFileSync20(path, "utf-8");
+    const content = readFileSync21(path, "utf-8");
     try {
       const now = /* @__PURE__ */ new Date();
       utimesSync3(path, now, now);
@@ -5989,7 +6145,7 @@ function sweepSkillCache(cacheDir, now = Date.now()) {
   try {
     if (!existsSync9(cacheDir)) return;
     for (const name of readdirSync7(cacheDir)) {
-      const path = join26(cacheDir, name);
+      const path = join27(cacheDir, name);
       try {
         if (now - statSync8(path).mtimeMs > CACHE_TTL_MS3) rmSync5(path, { force: true });
       } catch {
@@ -6276,18 +6432,18 @@ function resolveConditionalResponse(wire, hasCachedBody) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync10, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
+import { join as join28 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join27(configDir, CACHE_FILENAME);
+  return join28(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
   if (!existsSync10(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync21(path, "utf-8"));
+    parsed = JSON.parse(readFileSync22(path, "utf-8"));
   } catch {
     return;
   }
@@ -6307,8 +6463,8 @@ function saveChannelHashCache(source, configDir) {
 }
 
 // src/lib/sender-policy-baseline.ts
-import { existsSync as existsSync11, readFileSync as readFileSync22 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync23 } from "fs";
+import { join as join29 } from "path";
 var BASELINE_FILENAME = "sender-policy-baseline.json";
 var SENDER_POLICY_BASELINE_VERSION = 1;
 var BASELINE_CONCERNS = [
@@ -6346,14 +6502,14 @@ function createDeliveryBaselineMaps() {
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
-  return join28(configDir, BASELINE_FILENAME);
+  return join29(configDir, BASELINE_FILENAME);
 }
 function loadSenderPolicyBaseline(target, configDir, log2) {
   const path = getSenderPolicyBaselineFile(configDir);
   if (!existsSync11(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync22(path, "utf-8"));
+    parsed = JSON.parse(readFileSync23(path, "utf-8"));
   } catch (err) {
     log2?.(
       `[sender-policy] discarding corrupt ${BASELINE_FILENAME} (${err.message}) - restrictive-policy agents will take one fail-closed restart`
@@ -6402,8 +6558,8 @@ function saveSenderPolicyBaseline(source, configDir, log2) {
 }
 
 // src/lib/stuck-streak-store.ts
-import { existsSync as existsSync12, readFileSync as readFileSync23 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync24 } from "fs";
+import { join as join30 } from "path";
 var STORE_FILENAME = "stuck-streaks.json";
 var STUCK_STREAK_STORE_VERSION = 1;
 var STUCK_STREAK_CONCERNS = ["channelSync", "realtimeRebind"];
@@ -6411,7 +6567,7 @@ function createStuckStreakMaps() {
   return { channelSync: /* @__PURE__ */ new Map(), realtimeRebind: /* @__PURE__ */ new Map() };
 }
 function getStuckStreakStoreFile(configDir) {
-  return join29(configDir, STORE_FILENAME);
+  return join30(configDir, STORE_FILENAME);
 }
 function isValidPersistedStreak(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -6453,7 +6609,7 @@ function loadStuckStreaks(target, configDir, log2) {
   if (!existsSync12(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync23(path, "utf-8"));
+    parsed = JSON.parse(readFileSync24(path, "utf-8"));
   } catch (err) {
     log2?.(
       `[stuck-streaks] discarding corrupt ${STORE_FILENAME} (${err.message}) \u2014 stuck-streak ages restart from zero and one spurious "recovered" close may follow`
@@ -6496,11 +6652,9 @@ function pruneStuckStreaksToAgents(maps, activeAgentIds) {
 }
 
 // src/lib/claude-device-state.ts
-import { readFileSync as readFileSync24, statSync as statSync9 } from "fs";
-import { homedir as homedir13 } from "os";
-import { join as join30 } from "path";
+import { readFileSync as readFileSync25, statSync as statSync9 } from "fs";
 function claudeDeviceStatePath(env = process.env) {
-  return join30(env.HOME?.trim() || homedir13(), ".claude.json");
+  return effectiveClaudeJsonPath(void 0, env);
 }
 function probeClaudeDeviceStatePresence(path = claudeDeviceStatePath()) {
   try {
@@ -6523,7 +6677,7 @@ function checkClaudeDeviceState(path = claudeDeviceStatePath()) {
   }
   let raw;
   try {
-    raw = readFileSync24(path, "utf-8");
+    raw = readFileSync25(path, "utf-8");
   } catch {
     return { usable: false, reason: "unreadable" };
   }
@@ -7222,7 +7376,7 @@ function removeIntegrationSkillFolder(opts) {
 }
 
 // src/lib/manager/managed-skill-manifest.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync25, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync26, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname8, join as join32 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
@@ -7231,7 +7385,7 @@ function managedSkillManifestPath(agentRootDir) {
 function readManagedSkillManifest(path) {
   try {
     if (!existsSync13(path)) return /* @__PURE__ */ new Set();
-    const parsed = JSON.parse(readFileSync25(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync26(path, "utf-8"));
     const ids = Array.isArray(parsed?.globalSkillIds) ? parsed.globalSkillIds : [];
     return new Set(ids.filter((id) => typeof id === "string" && id.length > 0));
   } catch {
@@ -7362,7 +7516,7 @@ function resolveModelChain(refreshData) {
 // src/lib/manager/claude-auth.ts
 import { existsSync as existsSync14, rmSync as rmSync6 } from "fs";
 import { join as join33 } from "path";
-import { homedir as homedir14 } from "os";
+import { homedir as homedir13 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -7374,7 +7528,7 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join33(homedir14(), ".claude");
+    const claudeDir = join33(homedir13(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
       const p = join33(claudeDir, filename);
       if (existsSync14(p)) {
@@ -7732,7 +7886,7 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/nudge-state-cache.ts
-import { existsSync as existsSync15, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync27, writeFileSync as writeFileSync13 } from "fs";
 import { join as join34 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
@@ -7744,7 +7898,7 @@ function loadKanbanNudgeState(target, configDir) {
   if (!existsSync15(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(path, "utf-8"));
+    parsed = JSON.parse(readFileSync27(path, "utf-8"));
   } catch {
     return;
   }
@@ -8362,8 +8516,8 @@ function closeSessionRunForCode(codeName, outcome, reason) {
 
 // src/lib/manager/scheduler/kanban-route.ts
 import { createHash as createHash15 } from "crypto";
-import { writeFileSync as writeFileSync14, renameSync as renameSync8, mkdirSync as mkdirSync11, readFileSync as readFileSync27, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir15 } from "os";
+import { writeFileSync as writeFileSync14, renameSync as renameSync8, mkdirSync as mkdirSync11, readFileSync as readFileSync28, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir14 } from "os";
 import { join as join35, dirname as dirname9 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
@@ -8723,7 +8877,7 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join35(homedir15(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join35(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
     writeFileSync14(tmp, JSON.stringify(marker), "utf8");
@@ -8733,9 +8887,9 @@ function stampScheduledTurnMarker(codeName, taskId, target) {
   }
 }
 function clearScheduledTurnMarkerForTask(codeName, taskId) {
-  const file = join35(homedir15(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+  const file = join35(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
   try {
-    const raw = JSON.parse(readFileSync27(file, "utf8"));
+    const raw = JSON.parse(readFileSync28(file, "utf8"));
     if (typeof raw?.task_id !== "string" || raw.task_id !== taskId) return;
     unlinkSync3(file);
     log(`[scheduled-kanban] scheduled-turn marker cleared for '${codeName}' (task ${taskId} complete)`);
@@ -8795,7 +8949,7 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt, dura
       return false;
     }
     try {
-      const doorbell = directChatDoorbellPath(agentId, homedir15());
+      const doorbell = directChatDoorbellPath(agentId, homedir14());
       mkdirSync11(dirname9(doorbell), { recursive: true });
       writeFileSync14(doorbell, String(Date.now()));
     } catch (err) {
@@ -8950,11 +9104,11 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 
 // src/lib/manager/scheduler/execution.ts
 import { createHash as createHash16 } from "crypto";
-import { homedir as homedir16 } from "os";
+import { homedir as homedir15 } from "os";
 import { join as join37 } from "path";
 
 // src/lib/agent-serving-probe.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync8, statSync as statSync10 } from "fs";
+import { readFileSync as readFileSync29, readdirSync as readdirSync8, statSync as statSync10 } from "fs";
 import { join as join36 } from "path";
 var RATE_LIMIT_WINDOW_MS = 6 * 60 * 60 * 1e3;
 function probeRateLimit(args) {
@@ -8980,7 +9134,7 @@ function probeRateLimit(args) {
     }
     let content;
     try {
-      content = readFileSync28(path, "utf-8");
+      content = readFileSync29(path, "utf-8");
     } catch {
       continue;
     }
@@ -9042,7 +9196,7 @@ function shouldLogUsageCapDeferral(site, codeName, limitedUntil) {
 
 // src/lib/manager/scheduler/execution.ts
 function claudePidFilePath() {
-  return join37(homedir16(), ".augmented", "manager-claude-pids.json");
+  return join37(homedir15(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -9442,7 +9596,7 @@ function stopPaneOccupancySampler() {
 }
 
 // src/lib/pid-pressure-sampler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync29 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync30 } from "fs";
 var SAMPLE_INTERVAL_MS2 = 3e4;
 function warnFraction() {
   const raw = Number(process.env.AGT_PID_PRESSURE_WARN_FRACTION);
@@ -9470,7 +9624,7 @@ function parseMemoryEvents(text) {
 }
 function readTextReal(path) {
   try {
-    return readFileSync29(path, "utf-8");
+    return readFileSync30(path, "utf-8");
   } catch {
     return null;
   }
@@ -10753,7 +10907,7 @@ async function fireOpencodeScheduledTask(agent, task) {
 
 // src/lib/opencode-telegram-ingest.ts
 import { createHash as createHash19 } from "crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync30, renameSync as renameSync9, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync31, renameSync as renameSync9, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
 import { randomUUID } from "crypto";
 import { join as join39 } from "path";
 
@@ -11321,7 +11475,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
     load() {
       if (!filePath) return 0;
       try {
-        const parsed = JSON.parse(readFileSync30(filePath, "utf-8"));
+        const parsed = JSON.parse(readFileSync31(filePath, "utf-8"));
         if (currentBotId != null && typeof parsed?.bot_id === "number" && parsed.bot_id !== currentBotId) {
           log2(`[telegram-ingest:${codeName}] offset cursor belongs to a different bot; ignoring (bot swap)`);
           return 0;
@@ -11595,12 +11749,12 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync31, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
-import { homedir as homedir17 } from "os";
+import { existsSync as existsSync18, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync32, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir16 } from "os";
 import { join as join40 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join40(homedir17(), ".augmented", "restart-flags");
+  return join40(homedir16(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
   return join40(restartFlagsDir(), `${codeName}.flag`);
@@ -11612,7 +11766,7 @@ function readRestartFlags() {
   for (const entry of readdirSync10(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync31(join40(dir, entry), "utf8");
+      const raw = readFileSync32(join40(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -11730,7 +11884,7 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync32, writeFileSync as writeFileSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync5 } from "fs";
+import { readdirSync as readdirSync11, readFileSync as readFileSync33, writeFileSync as writeFileSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync5 } from "fs";
 import { dirname as dirname10, join as join41 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
@@ -11788,7 +11942,7 @@ function safeReaddir(dir) {
 }
 function readStrandedMarker(path) {
   try {
-    const parsed = JSON.parse(readFileSync32(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync33(path, "utf-8"));
     if (typeof parsed.channel === "string" && typeof parsed.thread_ts === "string") {
       return { channel: parsed.channel, thread_ts: parsed.thread_ts };
     }
@@ -13311,7 +13465,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-6NWZAXIZ.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-J2DYGC7T.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13636,7 +13790,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join42(projectDir, ".mcp.json"), "utf-8");
     return createHash20("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -13644,7 +13798,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join42(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -13662,7 +13816,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join42(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -13797,7 +13951,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync33(join42(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync34(join42(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -13945,7 +14099,7 @@ function shouldInjectChannelSecrets(agentId) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync33(join42(projectDir, ".env.integrations"), "utf-8")
+      readFileSync34(join42(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -14054,7 +14208,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1005" : "dev";
+var agtCliVersion = true ? "0.28.1007" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14389,7 +14543,7 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
     if (existsSync19(path)) {
-      const raw = readFileSync33(path, "utf-8").trim();
+      const raw = readFileSync34(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -14596,7 +14750,7 @@ async function maybeUpgradeClaudeCode() {
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join42(homedir18(), ".augmented", ".last-self-update-applied");
+  return join42(homedir17(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -14647,7 +14801,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join42(homedir18(), ".augmented", ".last-update-check");
+    const markerPath = join42(homedir17(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -15058,7 +15212,7 @@ async function runClaudeRuntimeAuthProbe() {
   ];
   try {
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-      cwd: homedir18(),
+      cwd: homedir17(),
       timeout: RUNTIME_AUTH_PROBE_TIMEOUT_MS,
       stdin: "ignore",
       env: childEnv,
@@ -15098,7 +15252,7 @@ async function runHostUsageCommand() {
       ""
     ];
     const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-      cwd: homedir18(),
+      cwd: homedir17(),
       timeout: HOST_USAGE_POLL_TIMEOUT_MS,
       stdin: "ignore",
       env: childEnv,
@@ -15145,7 +15299,7 @@ async function checkClaudeAuth() {
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
   if (evalEmptyMcpConfigPath && existsSync19(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join42(homedir18(), ".augmented");
+  const dir = join42(homedir17(), ".augmented");
   try {
     mkdirSync15(dir, { recursive: true });
   } catch {
@@ -15176,7 +15330,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir18(),
+    cwd: homedir17(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -15466,6 +15620,24 @@ function channelQuarantineStore() {
   }
   return _channelQuarantineStore;
 }
+var _channelResumeHistoryStore = null;
+function channelResumeHistoryStore() {
+  if (!_channelResumeHistoryStore) {
+    const dir = config?.configDir ?? join42(process.env["HOME"] ?? "/tmp", ".augmented");
+    _channelResumeHistoryStore = new ChannelResumeHistoryStore(defaultResumeHistoryPath(dir));
+  }
+  return _channelResumeHistoryStore;
+}
+var autoResumeDowngradeLogged = /* @__PURE__ */ new Set();
+function shouldLogAutoResumeModeDowngrade(autoResume, quarantine) {
+  const key = `${autoResume}->${quarantine}`;
+  if (autoResumeDowngradeLogged.has(key)) return false;
+  autoResumeDowngradeLogged.add(key);
+  return true;
+}
+function channelQuarantineAutoResumeMode() {
+  return hostFlagStore().getString("channel-quarantine-auto-resume");
+}
 function quarantineEntriesFor(codeName) {
   return channelQuarantineStore().getQuarantineEntries(codeName);
 }
@@ -15670,7 +15842,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-4PP3ON7H.js");
+      const { collectDiagnostics } = await import("../persistent-session-5KWYODZB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15812,7 +15984,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-4PP3ON7H.js");
+      const { collectDiagnostics } = await import("../persistent-session-5KWYODZB.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15968,7 +16140,7 @@ async function pollCycleInner() {
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
         if (desiredClaudeCodeVersion && decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "proceed") {
-          const { maybeUpdateClaudeCode } = await import("../claude-code-updater-45MB2AXE.js");
+          const { maybeUpdateClaudeCode } = await import("../claude-code-updater-NEJCTT7S.js");
           await maybeUpdateClaudeCode({
             desiredVersion: desiredClaudeCodeVersion,
             currentVersion: cachedFrameworkVersion,
@@ -15988,7 +16160,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-6NWZAXIZ.js");
+      } = await import("../responsiveness-probe-J2DYGC7T.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16105,7 +16277,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-6NWZAXIZ.js");
+        } = await import("../responsiveness-probe-J2DYGC7T.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16194,10 +16366,10 @@ async function pollCycleInner() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync33(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync34(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join42(homedir18(), ".augmented", codeName);
+                  const wedgeHome = join42(homedir17(), ".augmented", codeName);
                   if (existsSync19(wedgeHome)) {
                     atomicWriteFileSync(
                       join42(wedgeHome, "watchdog-give-up.json"),
@@ -16261,7 +16433,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-2V2BOXAG.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-4SE5Q7MU.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -16417,6 +16589,12 @@ async function pollCycleInner() {
           agent.code_name,
           clear.channel_id
         );
+        for (const mode of ["enforce", "shadow"]) {
+          channelResumeHistoryStore().forget(
+            agent.code_name,
+            resumeHistoryKey(mode, clear.channel_id)
+          );
+        }
         log(
           `[channel-reenable] ${removed ? "cleared" : "no marker for"} '${clear.channel_id}' on '${agent.code_name}' (operator re-enable)`
         );
@@ -16431,6 +16609,92 @@ async function pollCycleInner() {
         );
       }
     }
+    const autoResumeMode = channelQuarantineAutoResumeMode();
+    const quarantineMode = channelQuarantineMode();
+    const autoResumeEffective = resolveAutoResumeEffectiveMode(autoResumeMode, quarantineMode);
+    if (autoResumeMode === "enforce" && autoResumeEffective === "shadow") {
+      if (shouldLogAutoResumeModeDowngrade(autoResumeMode, quarantineMode)) {
+        log(
+          `[channel-auto-resume] channel-quarantine-auto-resume is 'enforce' but channel-quarantine-mode is '${quarantineMode}', so the reaper writes no quarantine marker and a failed trial could never be observed - every trial would score a success and permanently un-quarantine a dead channel. Running in SHADOW instead (bookkeeping only, nothing cleared). Set channel-quarantine-mode to 'enforce' first.`
+        );
+      }
+    }
+    if (autoResumeEffective !== "off") {
+      const nowMs = Date.now();
+      for (const agent of agents) {
+        if (agent.status !== "active") continue;
+        try {
+          const quarantineEntries = channelQuarantineStore().getQuarantineEntries(agent.code_name);
+          const quarantinedKeys = new Set(quarantineEntries.map((e) => e.serverKey));
+          for (const [storedKey, history] of channelResumeHistoryStore().entriesFor(agent.code_name)) {
+            const isShadowKey = storedKey.startsWith("shadow:");
+            if (isShadowKey !== (autoResumeEffective === "shadow")) continue;
+            const serverKey = isShadowKey ? storedKey.slice("shadow:".length) : storedKey;
+            if (!shouldForgetResumeHistory({
+              isQuarantined: quarantinedKeys.has(serverKey),
+              history,
+              now: nowMs,
+              // THE CONFIGURED DWELL, NOT THE FLOOR (obi-wan `7414dbf3d758`).
+              // A host that raised AGT_CHANNEL_QUARANTINE_DWELL_MS pushes
+              // re-quarantine PAST the floor-derived grace, so a failed trial
+              // read as a success and wiped the strikes - restarting the
+              // five-attempt budget every episode, forever.
+              configuredDwellMs: channelQuarantineDwellMs()
+            })) {
+              continue;
+            }
+            channelResumeHistoryStore().forget(agent.code_name, storedKey);
+            log(
+              `[channel-auto-resume] trial SUCCEEDED for '${serverKey}' on '${agent.code_name}' \u2014 un-quarantined for ${Math.round((nowMs - history.lastAttemptAt) / 6e4)}m, clearing ${history.attempts} strike(s) so the next episode starts from a full budget` + (autoResumeEffective === "shadow" ? " (shadow bookkeeping)" : "")
+            );
+          }
+          for (const entry of quarantineEntries) {
+            const historyKeyFor = (key) => resumeHistoryKey(autoResumeEffective, key);
+            const historyKey = historyKeyFor(entry.serverKey);
+            const history = channelResumeHistoryStore().get(agent.code_name, historyKey);
+            const decision = decideChannelAutoResume({
+              quarantinedAt: entry.quarantinedAt,
+              history,
+              now: nowMs
+            });
+            if (decision.action === "wait") continue;
+            if (decision.action === "give-up") {
+              if (!channelResumeHistoryStore().noteGaveUpLogged(agent.code_name, historyKeyFor(entry.serverKey))) {
+                log(
+                  autoResumeEffective === "shadow" ? `[channel-auto-resume] WOULD HAVE GIVEN UP on '${entry.serverKey}' for '${agent.code_name}' \u2014 ${decision.attempts} shadow trials recorded, which is the cap. No trial ran and nothing is abandoned: the strikes are in the shadow namespace, so enforcing would start this key at attempt 1 (shadow bookkeeping)` : `[channel-auto-resume] GIVING UP on '${entry.serverKey}' for '${agent.code_name}' \u2014 ${decision.attempts} trials over ~2 days all ended in re-quarantine, so it will NOT be retried automatically again. It stays quarantined until a human presses Re-enable, which also clears the strike count.`
+                );
+              }
+              continue;
+            }
+            const quarantineAgeMin = Math.round((nowMs - entry.quarantinedAt) / 6e4);
+            const waitedMin = Math.round(decision.waitedMs / 6e4);
+            const recorded = channelResumeHistoryStore().recordAttempt(
+              agent.code_name,
+              historyKey,
+              nowMs
+            );
+            if (autoResumeEffective === "shadow") {
+              log(
+                `[channel-auto-resume] WOULD resume '${entry.serverKey}' on '${agent.code_name}' (attempt ${recorded.attempts}/${AUTO_RESUME_MAX_ATTEMPTS}, quarantined ${quarantineAgeMin}m ago, waited ${waitedMin}m since the last trial) \u2014 shadow mode, not acting`
+              );
+              continue;
+            }
+            const cleared = channelQuarantineStore().clearQuarantine(
+              agent.code_name,
+              entry.serverKey
+            );
+            log(
+              `[channel-auto-resume] ${cleared ? "resumed" : "no marker for"} '${entry.serverKey}' on '${agent.code_name}' for a TRIAL run (attempt ${recorded.attempts}/${AUTO_RESUME_MAX_ATTEMPTS}, quarantined ${quarantineAgeMin}m ago, waited ${waitedMin}m since the last trial). The reaper will re-quarantine it if it is still dead.`
+            );
+          }
+        } catch (err) {
+          log(
+            `[channel-auto-resume] a write FAILED partway through '${agent.code_name}' \u2014 ${err instanceof Error ? err.message : String(err)}. Skipping the REST of auto-resume for this agent this cycle; every other agent still gets its poll. State is PARTIAL, not untouched: entries processed before the throw have already been written (channel-resume-history.json, channel-quarantine.json). Every strike is recorded before its marker is cleared, so the failure direction is a wasted strike rather than a trial nobody paid for - but do not read this as "nothing happened".`
+          );
+          continue;
+        }
+      }
+    }
     const frameworksThisCycle = new Set(agents.map((a) => a.framework).filter(Boolean));
     for (const fw of frameworksThisCycle) {
       await ensureFrameworkBinary(fw);
@@ -16637,7 +16901,7 @@ async function pollCycleInner() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join42(homedir18(), ".augmented", codeName);
+          const dir = join42(homedir17(), ".augmented", codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
             join42(dir, "watchdog-give-up.json"),
@@ -17249,7 +17513,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
           const projectClaudeMd = join42(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync33(projectClaudeMd, "utf-8");
+          const existing = readFileSync34(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -17267,7 +17531,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync33(filePath, "utf-8");
+          existingRaw = readFileSync34(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -17283,7 +17547,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       } else if (artifact.relativePath === "opencode.json") {
         let existingRaw = null;
         try {
-          existingRaw = readFileSync33(filePath, "utf-8");
+          existingRaw = readFileSync34(filePath, "utf-8");
         } catch {
         }
         const mergeResult = mergeOpencodeConfigArtifact(artifact.content, existingRaw);
@@ -17727,7 +17991,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join42(homedir18(), ".augmented", agent.code_name);
+        const agentAugmentedDir = join42(homedir17(), ".augmented", agent.code_name);
         mkdirSync15(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
@@ -18034,18 +18298,18 @@ async function processAgent(agent, agentStates, managedToolkits) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
+      const projectDir = join42(homedir17(), ".augmented", agent.code_name, "project");
       mkdirSync15(agentProvisionDir, { recursive: true });
       mkdirSync15(projectDir, { recursive: true });
       const provisionMcpPath = join42(agentProvisionDir, ".mcp.json");
       const projectMcpPath = join42(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync33(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync34(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join42(homedir18(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join42(homedir17(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
@@ -18204,7 +18468,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join42(homedir17(), ".augmented", agent.code_name, "project");
         let probeSet = integrations;
         const fetchQuarantined = async () => {
           const quarantined = await api.post("/host/agent-integrations/quarantined", { agent_id: agent.agent_id });
@@ -18264,7 +18528,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join42(homedir17(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -18341,11 +18605,11 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
+        const projectDir = join42(homedir17(), ".augmented", agent.code_name, "project");
         const envIntPath = join42(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync33(envIntPath, "utf-8");
+          preWriteEnv = readFileSync34(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -18365,8 +18629,8 @@ async function processAgent(agent, agentStates, managedToolkits) {
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
             const projectMcpPath = join42(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync33(envIntPath, "utf-8");
-            const mcpContent = readFileSync33(projectMcpPath, "utf-8");
+            const postWriteEnv = readFileSync34(envIntPath, "utf-8");
+            const mcpContent = readFileSync34(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -18665,13 +18929,13 @@ async function processAgent(agent, agentStates, managedToolkits) {
       }
       try {
         const { readdirSync: readdirSync13, rmSync: rmSync9 } = await import("fs");
-        const { homedir: homedir19 } = await import("os");
+        const { homedir: homedir18 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join42(homedir19(), ".augmented", agent.code_name, "skills"),
+          join42(homedir18(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join42(homedir19(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join42(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
           join42(agentDir, ".claude", "skills")
@@ -18717,7 +18981,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join42(homedir18(), ".augmented", agent.code_name)
+          join42(homedir17(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -18737,8 +19001,8 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join42(homedir18(), ".augmented", agent.code_name, "skills"),
-            join42(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join42(homedir17(), ".augmented", agent.code_name, "skills"),
+            join42(homedir17(), ".augmented", agent.code_name, "project", ".claude", "skills"),
             join42(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
@@ -19002,7 +19266,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         let mcpJsonParsed = null;
         try {
           const mcpPath = join42(getProjectDir(agent.code_name), ".mcp.json");
-          mcpJsonParsed = JSON.parse(readFileSync33(mcpPath, "utf-8"));
+          mcpJsonParsed = JSON.parse(readFileSync34(mcpPath, "utf-8"));
         } catch {
         }
         const computerUseIsolated = isolationMode(agent.code_name) === "docker";
@@ -19509,7 +19773,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join42(homedir18(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join42(homedir17(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const obContactRaw = refreshData.agent.manager_last_contacted_at;
       const obContact = typeof obContactRaw === "string" && obContactRaw ? obContactRaw : null;
@@ -20549,7 +20813,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-6NWZAXIZ.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-J2DYGC7T.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20592,7 +20856,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-4PP3ON7H.js");
+        const { collectDiagnostics } = await import("../persistent-session-5KWYODZB.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20643,7 +20907,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-4PP3ON7H.js");
+      const { collectDiagnostics } = await import("../persistent-session-5KWYODZB.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -21067,7 +21331,7 @@ async function processDirectChatMessage(agent, msg) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir18());
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir17());
         mkdirSync15(dirname11(doorbell), { recursive: true });
         writeFileSync18(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
@@ -21196,7 +21460,7 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir18());
+    const doorbell = directChatDoorbellPath(agentId, homedir17());
     mkdirSync15(dirname11(doorbell), { recursive: true });
     writeFileSync18(doorbell, String(Date.now()));
   } catch (err) {
@@ -21302,8 +21566,19 @@ async function processClaudePairSessions(agents) {
     spawnPairSession,
     killPairSession,
     pairTmuxSession,
-    finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-DDSYAHQW.js");
+    finalizeClaudePairOnboarding,
+    // ENG-10862: the failure vocabulary lives beside the loop that produces it,
+    // so the code the console stores and the message the operator reads cannot
+    // drift from the reason finalize actually returned.
+    PAIR_FINALIZE_ERROR_CODES,
+    describePairFinalizeFailure,
+    // ENG-10862: the last-chance re-read before a failure is reported.
+    confirmPairFailure,
+    // ENG-10862: the pre-submit mtime baseline. Taken here because finalize
+    // cannot take it for itself — by the time it runs, the write it is looking
+    // for may already have happened.
+    snapshotPairConfig
+  } = await import("../claude-pair-runtime-X27QVAXL.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -21323,7 +21598,8 @@ async function processClaudePairSessions(agents) {
   async function reportAndCleanup(pairId, body) {
     await api.post("/host/claude-pair/result", { pair_id: pairId, ...body });
     if (typeof body.status === "string" && TERMINAL.has(body.status)) {
-      if (body.status === "success") {
+      const isOnboardingFailure = typeof body.error_code === "string" && body.error_code.startsWith("onboarding_");
+      if (body.status === "success" || isOnboardingFailure) {
         await new Promise((r) => setTimeout(r, 3e3));
       }
       const killed = await killPairSession(pairTmuxSession(pairId));
@@ -21375,16 +21651,50 @@ async function processClaudePairSessions(agents) {
         }
       } else if (session.status === "code_submitted" && session.code) {
         log(`[claude-pair] submitting code (pair ${session.pair_id.slice(0, 8)})`);
+        const configBaseline = snapshotPairConfig();
         const result = await submitClaudePairCode({
           session: pairSession,
           code: session.code
         });
         if (result.kind === "success") {
-          const finalize = await finalizeClaudePairOnboarding(pairSession, log);
-          if (!finalize.finalized) {
-            log(`[claude-pair] WARN: ~/.claude.json was not updated during onboarding (pair ${session.pair_id.slice(0, 8)}) \u2014 first agent launch may show the login picker`);
+          const finalize = await finalizeClaudePairOnboarding(pairSession, log, {
+            baseline: configBaseline
+          });
+          const pairShort = session.pair_id.slice(0, 8);
+          const confirmed = finalize.finalized ? "landed-after-all" : await confirmPairFailure({
+            configPath: finalize.configPath,
+            sinceMtimeMs: configBaseline.mtimeMs,
+            log
+          });
+          if (!finalize.finalized && confirmed === "confirmed") {
+            const reason = finalize.reason ?? "not-flushed";
+            const errorCode = PAIR_FINALIZE_ERROR_CODES[reason];
+            log(
+              `[claude-pair] onboarding did NOT persist (pair ${pairShort}) reason=${reason} code=${errorCode} iterations=${finalize.iterations} graceWaits=${finalize.graceWaits} consumerTerms=${finalize.counts.consumerTerms} dialogEnter=${finalize.counts.dialogEnter} noMatch=${finalize.counts.noMatch} \u2014 reporting the pairing as FAILED`
+            );
+            await reportAndCleanup(session.pair_id, {
+              status: "failure",
+              error_code: errorCode,
+              // The path finalize actually watched, returned by it rather than
+              // recomputed here — two copies of that rule is how the operator
+              // ends up reading about a file the flow never looked at.
+              error_message: describePairFinalizeFailure(reason, finalize.configPath),
+              // AC5: the loop's own accounting, so "do real pairings need more
+              // than 10 dismissals?" stops being unanswerable. Counts only —
+              // never pane text, which carries `Logged in as <email>`. These
+              // are NOT stored on the pair row (no column, by decision); the
+              // route forwards them into the alert payload, which is jsonb.
+              finalize_iterations: finalize.iterations,
+              finalize_grace_waits: finalize.graceWaits,
+              finalize_dialog_counts: finalize.counts
+            });
+          } else {
+            const lateness = finalize.finalized ? "" : ` (late: finalize said ${finalize.reason}, config landed during the confirm window)`;
+            log(
+              `[claude-pair] onboarding persisted (pair ${pairShort}) iterations=${finalize.iterations} graceWaits=${finalize.graceWaits} consumerTerms=${finalize.counts.consumerTerms} dialogEnter=${finalize.counts.dialogEnter} noMatch=${finalize.counts.noMatch}${lateness}`
+            );
+            await reportAndCleanup(session.pair_id, { status: "success" });
           }
-          await reportAndCleanup(session.pair_id, { status: "success" });
         } else if (result.kind === "failure") {
           await reportAndCleanup(session.pair_id, {
             status: "failure",
@@ -21545,7 +21855,7 @@ function loadMemoryManifest(agentId, configDir, codeName) {
   if (cached) return cached;
   let manifest = {};
   try {
-    const raw = readFileSync33(memoryManifestPath(configDir, codeName), "utf-8");
+    const raw = readFileSync34(memoryManifestPath(configDir, codeName), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -21660,7 +21970,7 @@ function applyMemoryTombstones(opts) {
       continue;
     }
     try {
-      const actual = createHash20("sha256").update(readFileSync33(filePath)).digest("hex");
+      const actual = createHash20("sha256").update(readFileSync34(filePath)).digest("hex");
       if (actual !== entry.sha) {
         outcomes.kept_modified++;
         outcomes.unapplied.push({ name: tomb.name, reason: "kept_modified" });
@@ -21760,7 +22070,7 @@ async function syncMemories(agent, configDir, log2) {
     for (const file of readdirSync12(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync33(join42(memoryDir, file), "utf-8");
+        const raw = readFileSync34(join42(memoryDir, file), "utf-8");
         const fileHash = createHash20("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -21785,7 +22095,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync33(join42(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync34(join42(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -21924,7 +22234,7 @@ ${mem.content}
         if (existsSync19(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync33(filePath, "utf-8");
+            existing = readFileSync34(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) {
@@ -22089,6 +22399,16 @@ function startPolling() {
   livenessTimer.unref();
   startPaneOccupancySampler(() => agentState.persistentSessionAgents);
   startPidPressureSampler(() => agentState.persistentSessionAgents);
+  {
+    const seedOutcome = seedClaudeConfigFromLegacy({ log });
+    const configDirUsable = claudeConfigDirIsReady();
+    if (configDirUsable && !process.env[CLAUDE_CONFIG_DIR_ENV]?.trim()) {
+      process.env[CLAUDE_CONFIG_DIR_ENV] = claudeConfigDirFor();
+    }
+    log(
+      `[claude-config] ${CLAUDE_CONFIG_DIR_ENV}=${process.env[CLAUDE_CONFIG_DIR_ENV] ?? "<not adopted>"} configDirUsable=${configDirUsable} seed=${seedOutcome}`
+    );
+  }
   void startCaffeinate();
   loadChannelHashCache2();
   loadSenderPolicyBaseline2();
@@ -22304,7 +22624,7 @@ function startManager(opts) {
   try {
     const stateFile = getStateFile();
     if (existsSync19(stateFile)) {
-      const raw = readFileSync33(stateFile, "utf-8");
+      const raw = readFileSync34(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state8.agents = parsed.agents;
@@ -22331,7 +22651,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join42(homedir18(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join42(homedir17(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -22360,7 +22680,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync33(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync34(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -22457,7 +22777,7 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join42(homedir18(), ".augmented", "_mcp");
+  const targetDir = join42(homedir17(), ".augmented", "_mcp");
   mkdirSync15(targetDir, { recursive: true });
   const moduleDir = dirname11(fileURLToPath2(import.meta.url));
   let mcpSourceDir = "";
@@ -22482,7 +22802,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync19(p)) return null;
-      return createHash20("sha256").update(readFileSync33(p)).digest("hex");
+      return createHash20("sha256").update(readFileSync34(p)).digest("hex");
     } catch {
       return null;
     }
@@ -22593,14 +22913,14 @@ function deployMcpAssets() {
   }
   const localMcpPath = join42(targetDir, "index.js");
   try {
-    const agentsDir = join42(homedir18(), ".augmented", "agents");
+    const agentsDir = join42(homedir17(), ".augmented", "agents");
     if (existsSync19(agentsDir)) {
       for (const entry of readdirSync12(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
           const mcpJsonPath = join42(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync33(mcpJsonPath, "utf-8");
+            const raw = readFileSync34(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];