@integrity-labs/agt-cli 0.28.907 → 0.28.909

package/dist/lib/manager-worker.js

@@ -63,7 +63,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-GBQRH5RE.js";
+} from "../chunk-A2GUODU3.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -136,7 +136,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-I2PUWPUR.js";
+} from "../chunk-4M4POU6Q.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -231,14 +231,14 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-N47GH7MJ.js";
+} from "../chunk-7WKTBFAD.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash20 } from "crypto";
-import { readFileSync as readFileSync32, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync11, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
+import { readFileSync as readFileSync33, writeFileSync as writeFileSync18, mkdirSync as mkdirSync15, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync12, statSync as statSync12, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4 } from "fs";
 
 // src/lib/atomic-file-replace.ts
 import { copyFileSync, renameSync, unlinkSync } from "fs";
@@ -264,8 +264,8 @@ function defaultUnique() {
 
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join41, dirname as dirname11, delimiter as pathDelimiter } from "path";
-import { homedir as homedir17 } from "os";
+import { join as join42, dirname as dirname11, delimiter as pathDelimiter } from "path";
+import { homedir as homedir18 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/provisioning/channel-policy-env.js
@@ -1858,11 +1858,11 @@ function isPathInsideDir(candidate, dir) {
 }
 function findMissingMcpBundles(mcpConfigPath, deps = {}) {
   const existsSync20 = deps.existsSync ?? nodeExistsSync;
-  const readFileSync33 = deps.readFileSync ?? nodeReadFileSync;
+  const readFileSync34 = deps.readFileSync ?? nodeReadFileSync;
   const mcpDir = deps.mcpDir ?? getSharedMcpDir();
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync33(mcpConfigPath, "utf-8"));
+    parsed = JSON.parse(readFileSync34(mcpConfigPath, "utf-8"));
   } catch {
     return [];
   }
@@ -6359,6 +6359,86 @@ function pruneStuckStreaksToAgents(maps, activeAgentIds) {
   return dropped;
 }
 
+// src/lib/claude-device-state.ts
+import { readFileSync as readFileSync24, statSync as statSync8 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join30 } from "path";
+function claudeDeviceStatePath(env = process.env) {
+  return join30(env.HOME?.trim() || homedir13(), ".claude.json");
+}
+function checkClaudeDeviceState(path = claudeDeviceStatePath()) {
+  try {
+    if (!statSync8(path).isFile()) return { usable: false, reason: "not-a-file" };
+  } catch (err) {
+    return {
+      usable: false,
+      reason: err?.code === "ENOENT" ? "missing" : "unreadable"
+    };
+  }
+  let raw;
+  try {
+    raw = readFileSync24(path, "utf-8");
+  } catch {
+    return { usable: false, reason: "unreadable" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { usable: false, reason: "unparseable" };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { usable: false, reason: "not-an-object" };
+  }
+  if (Object.keys(parsed).length === 0) return { usable: false, reason: "empty-object" };
+  return { usable: true };
+}
+var DeviceStateRotationGate = class {
+  constructor(check = () => checkClaudeDeviceState()) {
+    this.check = check;
+  }
+  held = /* @__PURE__ */ new Map();
+  /**
+   * Ask before tearing `codeName`'s session down for a planned rotation.
+   * Returns `ready: true` when the respawn can start; otherwise the rotation must
+   * be skipped this tick. `firstHold` is true only on the tick a hold begins for
+   * this agent, so the caller logs once per episode rather than every poll.
+   */
+  mayRotate(codeName, nowMs) {
+    const verdict = this.check();
+    if (verdict.usable) {
+      this.held.clear();
+      return { ready: true };
+    }
+    const firstHold = !this.held.has(codeName);
+    if (firstHold) this.held.set(codeName, nowMs);
+    return { ready: false, reason: verdict.reason, firstHold };
+  }
+  /**
+   * The value for the heartbeat. Re-checks the file while anything is held, so
+   * the alert closes on the next heartbeat after the operator pairs the host,
+   * not only when some agent's rollover next asks. Reads nothing when nothing is
+   * held, so a healthy host pays no file read per heartbeat.
+   */
+  heartbeatField() {
+    if (this.held.size === 0) return null;
+    const verdict = this.check();
+    if (verdict.usable) {
+      this.held.clear();
+      return null;
+    }
+    return {
+      reason: verdict.reason,
+      deferred_agents: [...this.held.keys()].sort(),
+      blocked_since: new Date(Math.min(...this.held.values())).toISOString()
+    };
+  }
+  /** For tests and logs. */
+  heldAgents() {
+    return [...this.held.keys()].sort();
+  }
+};
+
 // src/lib/channel-sweep.ts
 import { execFileSync } from "child_process";
 var CHANNEL_BASENAMES = [
@@ -6927,7 +7007,7 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash, options)
 }
 
 // src/lib/manager/integration-skill-cache.ts
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function integrationSkillHashKey(agentId, skillId) {
   return `plugin-skill:${agentId}:${skillId}`;
 }
@@ -6943,21 +7023,21 @@ function forgetIntegrationSkill(cache2, agentId, skillId) {
 function removeIntegrationSkillFolder(opts) {
   forgetIntegrationSkill(opts.cache, opts.agentId, opts.entry);
   for (const dir of opts.dirs) {
-    opts.removeDir(join30(dir, opts.entry));
+    opts.removeDir(join31(dir, opts.entry));
   }
 }
 
 // src/lib/manager/managed-skill-manifest.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync24, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname8, join as join31 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync25, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname8, join as join32 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
-  return join31(agentRootDir, "managed-skills.json");
+  return join32(agentRootDir, "managed-skills.json");
 }
 function readManagedSkillManifest(path) {
   try {
     if (!existsSync13(path)) return /* @__PURE__ */ new Set();
-    const parsed = JSON.parse(readFileSync24(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(path, "utf-8"));
     const ids = Array.isArray(parsed?.globalSkillIds) ? parsed.globalSkillIds : [];
     return new Set(ids.filter((id) => typeof id === "string" && id.length > 0));
   } catch {
@@ -7087,8 +7167,8 @@ function resolveModelChain(refreshData) {
 
 // src/lib/manager/claude-auth.ts
 import { existsSync as existsSync14, rmSync as rmSync6 } from "fs";
-import { join as join32 } from "path";
-import { homedir as homedir13 } from "os";
+import { join as join33 } from "path";
+import { homedir as homedir14 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -7100,9 +7180,9 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join32(homedir13(), ".claude");
+    const claudeDir = join33(homedir14(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join32(claudeDir, filename);
+      const p = join33(claudeDir, filename);
       if (existsSync14(p)) {
         try {
           rmSync6(p, { force: true });
@@ -7458,19 +7538,19 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/nudge-state-cache.ts
-import { existsSync as existsSync15, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "fs";
+import { join as join34 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
 function getKanbanNudgeStateFile(configDir) {
-  return join33(configDir, CACHE_FILENAME2);
+  return join34(configDir, CACHE_FILENAME2);
 }
 function loadKanbanNudgeState(target, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
   if (!existsSync15(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync25(path, "utf-8"));
+    parsed = JSON.parse(readFileSync26(path, "utf-8"));
   } catch {
     return;
   }
@@ -8088,9 +8168,9 @@ function closeSessionRunForCode(codeName, outcome, reason) {
 
 // src/lib/manager/scheduler/kanban-route.ts
 import { createHash as createHash15 } from "crypto";
-import { writeFileSync as writeFileSync14, renameSync as renameSync8, mkdirSync as mkdirSync11, readFileSync as readFileSync26, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir14 } from "os";
-import { join as join34, dirname as dirname9 } from "path";
+import { writeFileSync as writeFileSync14, renameSync as renameSync8, mkdirSync as mkdirSync11, readFileSync as readFileSync27, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir15 } from "os";
+import { join as join35, dirname as dirname9 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
 import { createHash as createHash14 } from "crypto";
@@ -8449,7 +8529,7 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join34(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join35(homedir15(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
     writeFileSync14(tmp, JSON.stringify(marker), "utf8");
@@ -8459,9 +8539,9 @@ function stampScheduledTurnMarker(codeName, taskId, target) {
   }
 }
 function clearScheduledTurnMarkerForTask(codeName, taskId) {
-  const file = join34(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+  const file = join35(homedir15(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
   try {
-    const raw = JSON.parse(readFileSync26(file, "utf8"));
+    const raw = JSON.parse(readFileSync27(file, "utf8"));
     if (typeof raw?.task_id !== "string" || raw.task_id !== taskId) return;
     unlinkSync3(file);
     log(`[scheduled-kanban] scheduled-turn marker cleared for '${codeName}' (task ${taskId} complete)`);
@@ -8521,7 +8601,7 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt, dura
       return false;
     }
     try {
-      const doorbell = directChatDoorbellPath(agentId, homedir14());
+      const doorbell = directChatDoorbellPath(agentId, homedir15());
       mkdirSync11(dirname9(doorbell), { recursive: true });
       writeFileSync14(doorbell, String(Date.now()));
     } catch (err) {
@@ -8673,12 +8753,12 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 
 // src/lib/manager/scheduler/execution.ts
 import { createHash as createHash16 } from "crypto";
-import { homedir as homedir15 } from "os";
-import { join as join36 } from "path";
+import { homedir as homedir16 } from "os";
+import { join as join37 } from "path";
 
 // src/lib/agent-serving-probe.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
-import { join as join35 } from "path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
+import { join as join36 } from "path";
 var RATE_LIMIT_WINDOW_MS = 6 * 60 * 60 * 1e3;
 function probeRateLimit(args) {
   const now = args.now ?? /* @__PURE__ */ new Date();
@@ -8694,16 +8774,16 @@ function probeRateLimit(args) {
   let newest = UNKNOWN_RATE_LIMIT;
   for (const name of entries) {
     if (!name.endsWith(".jsonl")) continue;
-    const path = join35(dir, name);
+    const path = join36(dir, name);
     try {
-      const st = statSync8(path);
+      const st = statSync9(path);
       if (!st.isFile() || st.mtimeMs < startMs) continue;
     } catch {
       continue;
     }
     let content;
     try {
-      content = readFileSync27(path, "utf-8");
+      content = readFileSync28(path, "utf-8");
     } catch {
       continue;
     }
@@ -8765,7 +8845,7 @@ function shouldLogUsageCapDeferral(site, codeName, limitedUntil) {
 
 // src/lib/manager/scheduler/execution.ts
 function claudePidFilePath() {
-  return join36(homedir15(), ".augmented", "manager-claude-pids.json");
+  return join37(homedir16(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -8835,8 +8915,8 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 }
 
 // src/lib/occupancy-gate.ts
-import { closeSync as closeSync2, openSync as openSync2, readdirSync as readdirSync9, readSync as readSync2, statSync as statSync9 } from "fs";
-import { join as join37 } from "path";
+import { closeSync as closeSync2, openSync as openSync2, readdirSync as readdirSync9, readSync as readSync2, statSync as statSync10 } from "fs";
+import { join as join38 } from "path";
 function rostersMeasuredZero(mode, attested, runtimeRunning) {
   return mode === "enforce" && attested && runtimeRunning;
 }
@@ -8850,7 +8930,7 @@ var brackets = /* @__PURE__ */ new Map();
 function readAlignedTail(path, tailBytes, maxAlignBytes) {
   let fd = null;
   try {
-    const size = statSync9(path).size;
+    const size = statSync10(path).size;
     if (size <= 0) return { content: "", complete: true, truncated: false };
     fd = openSync2(path, "r");
     let readStart = Math.max(0, size - tailBytes);
@@ -8927,10 +9007,10 @@ function candidateTranscriptPaths(dir) {
   let complete = true;
   for (const name of top) {
     if (name.endsWith(".jsonl")) {
-      paths.push(join37(dir, name));
+      paths.push(join38(dir, name));
       continue;
     }
-    const subDir = join37(dir, name, "subagents");
+    const subDir = join38(dir, name, "subagents");
     let subs;
     try {
       subs = readdirSync9(subDir);
@@ -8939,7 +9019,7 @@ function candidateTranscriptPaths(dir) {
       continue;
     }
     for (const sub of subs) {
-      if (sub.endsWith(".jsonl")) paths.push(join37(subDir, sub));
+      if (sub.endsWith(".jsonl")) paths.push(join38(subDir, sub));
     }
   }
   return { paths, complete };
@@ -8994,7 +9074,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   for (const path of paths) {
     let st;
     try {
-      st = statSync9(path);
+      st = statSync10(path);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
@@ -9100,7 +9180,7 @@ function qualifyBuckets(buckets, qualifying, mode, nowMs, neighbourhoodMs = DEFA
 }
 
 // src/lib/pane-occupancy-sampler.ts
-import { statSync as statSync10 } from "fs";
+import { statSync as statSync11 } from "fs";
 var SAMPLE_INTERVAL_MS = 1e4;
 var IDLE_GAP_MS = 12e4;
 var POST_IDLE_CREDIT_MS = 6e4;
@@ -9114,7 +9194,7 @@ function hasFreshPaneObservation(codeName, nowMs, maxAgeMs = OBSERVATION_FRESH_M
 }
 function paneMtimeMs(codeName) {
   try {
-    return statSync10(paneLogPath(codeName)).mtimeMs;
+    return statSync11(paneLogPath(codeName)).mtimeMs;
   } catch {
     return null;
   }
@@ -9165,7 +9245,7 @@ function stopPaneOccupancySampler() {
 }
 
 // src/lib/pid-pressure-sampler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync29 } from "fs";
 var SAMPLE_INTERVAL_MS2 = 3e4;
 function warnFraction() {
   const raw = Number(process.env.AGT_PID_PRESSURE_WARN_FRACTION);
@@ -9178,7 +9258,7 @@ function configuredCeiling() {
 }
 function readTextReal(path) {
   try {
-    return readFileSync28(path, "utf-8");
+    return readFileSync29(path, "utf-8");
   } catch {
     return null;
   }
@@ -10495,9 +10575,9 @@ async function fireOpencodeScheduledTask(agent, task) {
 
 // src/lib/opencode-telegram-ingest.ts
 import { createHash as createHash19 } from "crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync29, renameSync as renameSync9, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync30, renameSync as renameSync9, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
 import { randomUUID } from "crypto";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 
 // src/lib/telegram-ingest.ts
 import https2 from "https";
@@ -11054,7 +11134,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
   let filePath;
   try {
     dir = getFramework("opencode").getAgentDir(codeName);
-    filePath = join38(dir, "telegram-getupdates-offset-opencode.json");
+    filePath = join39(dir, "telegram-getupdates-offset-opencode.json");
   } catch {
     dir = null;
     filePath = null;
@@ -11063,7 +11143,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
     load() {
       if (!filePath) return 0;
       try {
-        const parsed = JSON.parse(readFileSync29(filePath, "utf-8"));
+        const parsed = JSON.parse(readFileSync30(filePath, "utf-8"));
         if (currentBotId != null && typeof parsed?.bot_id === "number" && parsed.bot_id !== currentBotId) {
           log2(`[telegram-ingest:${codeName}] offset cursor belongs to a different bot; ignoring (bot swap)`);
           return 0;
@@ -11337,15 +11417,15 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync30, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join39 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync13, readdirSync as readdirSync10, readFileSync as readFileSync31, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join40 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join39(homedir16(), ".augmented", "restart-flags");
+  return join40(homedir17(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join39(restartFlagsDir(), `${codeName}.flag`);
+  return join40(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
@@ -11354,7 +11434,7 @@ function readRestartFlags() {
   for (const entry of readdirSync10(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync30(join39(dir, entry), "utf8");
+      const raw = readFileSync31(join40(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -11472,8 +11552,8 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync31, writeFileSync as writeFileSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync5 } from "fs";
-import { dirname as dirname10, join as join40 } from "path";
+import { readdirSync as readdirSync11, readFileSync as readFileSync32, writeFileSync as writeFileSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync5 } from "fs";
+import { dirname as dirname10, join as join41 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
 var MAX_TOPIC_CHARS = 140;
@@ -11485,10 +11565,10 @@ function augmentedAgentDir(codeName) {
   return dirname10(getProjectDir(codeName));
 }
 function slackPendingInboundDir(codeName) {
-  return join40(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
+  return join41(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
 }
 function slackRestartContextDir(codeName) {
-  return join40(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
+  return join41(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
 }
 function sanitizeTopic(raw) {
   const cleaned = raw.replace(/\s+/g, " ").trim().replace(/[<>]/g, " ").replace(/\s+/g, " ").trim();
@@ -11530,7 +11610,7 @@ function safeReaddir(dir) {
 }
 function readStrandedMarker(path) {
   try {
-    const parsed = JSON.parse(readFileSync31(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync32(path, "utf-8"));
     if (typeof parsed.channel === "string" && typeof parsed.thread_ts === "string") {
       return { channel: parsed.channel, thread_ts: parsed.thread_ts };
     }
@@ -11548,7 +11628,7 @@ function pruneHintsExcept(codeName, freshFilenames) {
     if (!filename.endsWith(".json")) continue;
     if (freshFilenames.has(filename)) continue;
     try {
-      unlinkSync5(join40(ctxDir, filename));
+      unlinkSync5(join41(ctxDir, filename));
     } catch {
     }
   }
@@ -11569,7 +11649,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       }
       const markers = [];
       for (const filename of markerFilenames.slice(0, cap)) {
-        const parsed = readStrandedMarker(join40(markerDir, filename));
+        const parsed = readStrandedMarker(join41(markerDir, filename));
         if (parsed) markers.push({ filename, channel: parsed.channel, thread_ts: parsed.thread_ts });
       }
       if (markers.length === 0) {
@@ -11583,7 +11663,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       const freshFilenames = /* @__PURE__ */ new Set();
       for (const { filename, hint } of hints) {
         try {
-          writeHintFile(join40(ctxDir, filename), ctxDir, hint);
+          writeHintFile(join41(ctxDir, filename), ctxDir, hint);
           freshFilenames.add(filename);
         } catch (err) {
           log2(`[restart-context] ${codeName}: hint write failed for ${filename}: ${err.message}`);
@@ -13053,7 +13133,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-BNQIJAFF.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-3M3556MN.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -13094,6 +13174,7 @@ function decideDayRolloverAction(i) {
   if (age !== null && age !== void 0 && age < graceSec && heldMin < maxHoldMin) {
     return "inbound-wait";
   }
+  if (i.deviceStateReady === false) return "defer-device-state";
   return "force-reset";
 }
 function classifyLazyDayRolloverReset(i) {
@@ -13101,7 +13182,19 @@ function classifyLazyDayRolloverReset(i) {
   if (!i.sessionHealthy) return "clear-stale";
   if (!i.staleForToday) return "clear-stale";
   if (!i.hasCurrent) return "skip";
-  return i.idle ? "reset" : "skip";
+  if (!i.idle) return "skip";
+  return i.deviceStateReady === false ? "defer-device-state" : "reset";
+}
+var deviceStateRotationGate = new DeviceStateRotationGate();
+function deviceStateAllowsRollover(codeName, path) {
+  const gate = deviceStateRotationGate.mayRotate(codeName, Date.now());
+  if (gate.ready) return true;
+  if (gate.firstHold) {
+    log(
+      `[persistent-session] Day rollover for '${codeName}' HELD (${path}) \u2014 the host's ~/.claude.json is not usable (${gate.reason}), so a fresh session would land on the login picker. Keeping the working session; the rotation runs the first tick the file is usable again. Pair the host from the Hosts page. (further holds this episode are not logged) [ENG-10351]`
+    );
+  }
+  return false;
 }
 function resolveEffectiveAgentTimezone(inputs) {
   const orgTierTz = cachedMaintenanceWindow?.timezone ?? null;
@@ -13130,18 +13223,22 @@ function performLazyDayRolloverReset(codeName, agentTimezone) {
   const sessionHealthy = flagged && isSessionHealthy(codeName);
   const staleForToday = flagged ? isStaleForToday(codeName, /* @__PURE__ */ new Date(), agentTimezone ?? void 0) : false;
   const current = flagged && sessionHealthy && staleForToday ? peekCurrentSession(codeName) : null;
-  const outcome = classifyLazyDayRolloverReset({
+  const lazyInputs = {
     flagged,
     staleForToday,
     sessionHealthy,
     hasCurrent: current !== null,
     idle: current ? isAgentIdle(getProjectDir(codeName), current.sessionId) : false
-  });
+  };
+  let outcome = classifyLazyDayRolloverReset(lazyInputs);
+  if (outcome === "reset" && !deviceStateAllowsRollover(codeName, "lazy-reset")) {
+    outcome = classifyLazyDayRolloverReset({ ...lazyInputs, deviceStateReady: false });
+  }
   if (outcome === "clear-stale") {
     pendingDayRolloverReset.delete(codeName);
     return false;
   }
-  if (outcome === "skip" || !current) return false;
+  if (outcome !== "reset" || !current) return false;
   log(
     `[persistent-session] Day rollover for '${codeName}' (yesterday=${current.date}) \u2014 first real trigger after an idle rollover; minting a fresh session now (deferred boot, paid alongside real work) [ENG-8461]`
   );
@@ -13153,7 +13250,7 @@ function performLazyDayRolloverReset(codeName, agentTimezone) {
 }
 function paneLogAgeSecondsFor(codeName) {
   try {
-    const mtimeMs = statSync11(paneLogPath(codeName)).mtimeMs;
+    const mtimeMs = statSync12(paneLogPath(codeName)).mtimeMs;
     return Math.max(0, Math.floor((Date.now() - mtimeMs) / 1e3));
   } catch (err) {
     if (err?.code === "ENOENT") return null;
@@ -13303,7 +13400,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync32(join41(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
     return createHash20("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -13311,7 +13408,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync32(join41(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -13329,7 +13426,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync32(join41(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync33(join42(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -13464,7 +13561,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync32(join41(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync33(join42(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -13612,7 +13709,7 @@ function shouldInjectChannelSecrets(agentId) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync32(join41(projectDir, ".env.integrations"), "utf-8")
+      readFileSync33(join42(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -13721,7 +13818,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.907" : "dev";
+var agtCliVersion = true ? "0.28.909" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -14055,7 +14152,7 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
     if (existsSync19(path)) {
-      const raw = readFileSync32(path, "utf-8").trim();
+      const raw = readFileSync33(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -14111,7 +14208,7 @@ async function ensureOpencodeBinary() {
   try {
     const prefix = execFileSync2("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
-      const npmBin = join41(prefix, "bin");
+      const npmBin = join42(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
       if (!current.includes(npmBin)) {
         process.env.PATH = [npmBin, ...current.filter(Boolean)].join(pathDelimiter);
@@ -14251,7 +14348,7 @@ async function maybeUpgradeClaudeCode() {
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join41(homedir17(), ".augmented", ".last-self-update-applied");
+  return join42(homedir18(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -14302,7 +14399,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join41(homedir17(), ".augmented", ".last-update-check");
+    const markerPath = join42(homedir18(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -14709,7 +14806,7 @@ async function runClaudeRuntimeAuthProbe() {
   ];
   try {
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-      cwd: homedir17(),
+      cwd: homedir18(),
       timeout: RUNTIME_AUTH_PROBE_TIMEOUT_MS,
       stdin: "ignore",
       env: childEnv,
@@ -14749,7 +14846,7 @@ async function runHostUsageCommand() {
       ""
     ];
     const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-      cwd: homedir17(),
+      cwd: homedir18(),
       timeout: HOST_USAGE_POLL_TIMEOUT_MS,
       stdin: "ignore",
       env: childEnv,
@@ -14796,12 +14893,12 @@ async function checkClaudeAuth() {
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
   if (evalEmptyMcpConfigPath && existsSync19(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join41(homedir17(), ".augmented");
+  const dir = join42(homedir18(), ".augmented");
   try {
     mkdirSync15(dir, { recursive: true });
   } catch {
   }
-  const p = join41(dir, ".eval-empty-mcp.json");
+  const p = join42(dir, ".eval-empty-mcp.json");
   writeFileSync18(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
@@ -14827,7 +14924,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir17(),
+    cwd: homedir18(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -14896,10 +14993,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join41(config?.configDir ?? join41(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join42(config?.configDir ?? join42(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join41(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join42(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -15112,7 +15209,7 @@ function removeDeliveryBaselineEntries(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join41(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join42(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -15128,12 +15225,12 @@ function claudeMdSizeFor(codeName) {
 }
 function forwardedToolsFor(codeName) {
   if (!config?.configDir) return null;
-  return readForwardedToolsReport(join41(config.configDir, codeName));
+  return readForwardedToolsReport(join42(config.configDir, codeName));
 }
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join41(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join42(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -15207,12 +15304,12 @@ function parseSkillFrontmatter(content) {
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
   const { readdirSync: readdirSync13, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync19 } = await import("fs");
-  const skillsDir = join41(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join41(configDir, codeName, "project", "CLAUDE.md");
+  const skillsDir = join42(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join42(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
   for (const dir of readdirSync13(skillsDir).sort()) {
-    const skillFile = join41(skillsDir, dir, "SKILL.md");
+    const skillFile = join42(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -15311,7 +15408,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-ZOEBA7KM.js");
+      const { collectDiagnostics } = await import("../persistent-session-A2IB5WGW.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -15453,7 +15550,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-ZOEBA7KM.js");
+      const { collectDiagnostics } = await import("../persistent-session-A2IB5WGW.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
       let tailscaleHostname;
@@ -15570,6 +15667,12 @@ async function pollCycleInner() {
         // customer agents had been dark for three minutes. Bounding the retry
         // without this would fix the CPU and leave the blindness.
         realtime_rebind_stuck: stuckRealtimeRebinds(realtimeRebindFailures, Date.now()),
+        // ENG-10351: ONE host-level verdict for rotations held because the
+        // host's ~/.claude.json is not usable. ALWAYS sent: `null` is the
+        // affirmative all-clear that lets the API close the alert on the edge,
+        // and an absent field means an older CLI. Re-checks the file while a
+        // hold exists, so pairing the host closes the alert on the next beat.
+        claude_device_state_rotation_blocked: deviceStateRotationGate.heartbeatField(),
         // ENG-6251: capability advertisement — the flags schema version this
         // CLI compiled with, so the admin UI can show flip reach across a
         // mixed-CLI fleet (an older CLI sends an older fingerprint).
@@ -15622,7 +15725,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-BNQIJAFF.js");
+      } = await import("../responsiveness-probe-3M3556MN.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -15739,7 +15842,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-BNQIJAFF.js");
+        } = await import("../responsiveness-probe-3M3556MN.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -15828,13 +15931,13 @@ async function pollCycleInner() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync32(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync33(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join41(homedir17(), ".augmented", codeName);
+                  const wedgeHome = join42(homedir18(), ".augmented", codeName);
                   if (existsSync19(wedgeHome)) {
                     atomicWriteFileSync(
-                      join41(wedgeHome, "watchdog-give-up.json"),
+                      join42(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -15895,7 +15998,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-JA437JIB.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-TAAZTRTD.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-MRZ3A2N5.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -16169,7 +16272,7 @@ async function pollCycleInner() {
             `[drain-flush] FAILED for '${prev.codeName}': ${err.message} \u2014 proceeding to teardown; this session was NOT shipped (ENG-9491)`
           );
         }
-        const agentDir = join41(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join42(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -16256,10 +16359,10 @@ async function pollCycleInner() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join41(homedir17(), ".augmented", codeName);
+          const dir = join42(homedir18(), ".augmented", codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
-            join41(dir, "watchdog-give-up.json"),
+            join42(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         },
@@ -16280,7 +16383,7 @@ async function pollCycleInner() {
           const dir = getFramework("claude-code").getAgentDir(codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
-            join41(dir, "watchdog-give-up.json"),
+            join42(dir, "watchdog-give-up.json"),
             JSON.stringify({
               gave_up_at: (/* @__PURE__ */ new Date()).toISOString(),
               reason: "usage_limit",
@@ -16548,7 +16651,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join41(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join42(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     forgetChannelSyncState(agent.agent_id);
     if (previousKnownStatus !== agent.status) {
@@ -16695,7 +16798,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       if (refreshData.knowledge_manifest) {
         const resolved = await resolveKnowledgeFromManifest({
           manifest: refreshData.knowledge_manifest,
-          cacheDir: join41(config.configDir, "_knowledge"),
+          cacheDir: join42(config.configDir, "_knowledge"),
           delivery: refreshData.agent?.knowledge_delivery ?? "both",
           fetchContents: async (hashes) => {
             const res = await api.post(
@@ -16712,7 +16815,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const resolvedSkills = await resolveSkillsFromManifest({
           globals: refreshData.global_skills_manifest ?? [],
           shared: refreshData.shared_skills_manifest ?? [],
-          cacheDir: join41(config.configDir, "_skills"),
+          cacheDir: join42(config.configDir, "_skills"),
           fetchContents: async (hashes) => {
             const res = await api.post(
               "/host/skills/contents",
@@ -16730,7 +16833,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       if (refreshData.integration_skills_manifest) {
         const resolvedIntegrationSkills = await resolveIntegrationSkillsFromManifest({
           manifest: refreshData.integration_skills_manifest,
-          cacheDir: join41(config.configDir, "_skills"),
+          cacheDir: join42(config.configDir, "_skills"),
           fetchContents: async (hashes) => {
             const res = await api.post(
               "/host/skills/contents",
@@ -16792,7 +16895,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join41(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join42(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -16851,7 +16954,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     const changedFiles = [];
     mkdirSync15(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join41(agentDir, artifact.relativePath);
+      const filePath = join42(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -16870,8 +16973,8 @@ async function processAgent(agent, agentStates, managedToolkits) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join41(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync32(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join42(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync33(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -16889,7 +16992,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync32(filePath, "utf-8");
+          existingRaw = readFileSync33(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -16905,7 +17008,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       } else if (artifact.relativePath === "opencode.json") {
         let existingRaw = null;
         try {
-          existingRaw = readFileSync32(filePath, "utf-8");
+          existingRaw = readFileSync33(filePath, "utf-8");
         } catch {
         }
         const mergeResult = mergeOpencodeConfigArtifact(artifact.content, existingRaw);
@@ -16921,12 +17024,12 @@ async function processAgent(agent, agentStates, managedToolkits) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync19(join41(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync19(join42(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join41(agentDir, file.relativePath);
+        const filePath = join42(agentDir, file.relativePath);
         mkdirSync15(dirname11(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
@@ -16935,12 +17038,12 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
       }
       try {
-        const provSkillsDir = join41(agentDir, ".claude", "skills");
+        const provSkillsDir = join42(agentDir, ".claude", "skills");
         if (existsSync19(provSkillsDir)) {
           for (const folder of readdirSync12(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync8(join41(provSkillsDir, folder), { recursive: true });
+                rmSync8(join42(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -16953,7 +17056,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join41(agentDir, file));
+        const h = hashFile(join42(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -16971,14 +17074,14 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join41(agentDir, ".claude", "workflows");
+        const provWorkflowsDir = join42(agentDir, ".claude", "workflows");
         if (existsSync19(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync12(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync8(join41(provWorkflowsDir, file));
+              rmSync8(join42(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -17060,7 +17163,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   if (written && existsSync19(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join41(agentDir, file));
+      const localHash = hashFile(join42(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -17071,7 +17174,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join41(agentDir, file));
+          localHashes[file] = hashFile(join42(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -17349,7 +17452,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join41(homedir17(), ".augmented", agent.code_name);
+        const agentAugmentedDir = join42(homedir18(), ".augmented", agent.code_name);
         mkdirSync15(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
@@ -17357,7 +17460,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join41(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join42(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -17656,18 +17759,18 @@ async function processAgent(agent, agentStates, managedToolkits) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join41(homedir17(), ".augmented", agent.code_name, "project");
+      const projectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
       mkdirSync15(agentProvisionDir, { recursive: true });
       mkdirSync15(projectDir, { recursive: true });
-      const provisionMcpPath = join41(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join41(projectDir, ".mcp.json");
+      const provisionMcpPath = join42(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join42(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync32(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync33(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join41(homedir17(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join42(homedir18(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
@@ -17693,7 +17796,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join41(
+          AGT_TURN_INITIATOR_FILE: join42(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -17713,7 +17816,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join41(projectDir, ".mcp-channels.json");
+      const staleChannelsPath = join42(projectDir, ".mcp-channels.json");
       if (existsSync19(staleChannelsPath)) {
         try {
           rmSync8(staleChannelsPath, { force: true });
@@ -17826,7 +17929,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join41(homedir17(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
         let probeSet = integrations;
         const fetchQuarantined = async () => {
           const quarantined = await api.post("/host/agent-integrations/quarantined", { agent_id: agent.agent_id });
@@ -17886,7 +17989,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join41(homedir17(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -17963,11 +18066,11 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join41(homedir17(), ".augmented", agent.code_name, "project");
-        const envIntPath = join41(projectDir, ".env.integrations");
+        const projectDir = join42(homedir18(), ".augmented", agent.code_name, "project");
+        const envIntPath = join42(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync32(envIntPath, "utf-8");
+          preWriteEnv = readFileSync33(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -17986,9 +18089,9 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join41(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync32(envIntPath, "utf-8");
-            const mcpContent = readFileSync32(projectMcpPath, "utf-8");
+            const projectMcpPath = join42(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync33(envIntPath, "utf-8");
+            const mcpContent = readFileSync33(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -18287,16 +18390,16 @@ async function processAgent(agent, agentStates, managedToolkits) {
       }
       try {
         const { readdirSync: readdirSync13, rmSync: rmSync9 } = await import("fs");
-        const { homedir: homedir18 } = await import("os");
+        const { homedir: homedir19 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join41(homedir18(), ".augmented", agent.code_name, "skills"),
+          join42(homedir19(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join41(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join42(homedir19(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join41(agentDir, ".claude", "skills")
+          join42(agentDir, ".claude", "skills")
         ];
         const existingDirs = candidateSkillDirs.filter((d) => existsSync19(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
@@ -18339,7 +18442,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join41(homedir17(), ".augmented", agent.code_name)
+          join42(homedir18(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -18359,15 +18462,15 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join41(homedir17(), ".augmented", agent.code_name, "skills"),
-            join41(homedir17(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join41(agentDir, ".claude", "skills")
+            join42(homedir18(), ".augmented", agent.code_name, "skills"),
+            join42(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join42(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join41(dir, id);
-              if (existsSync19(p) && existsSync19(join41(p, "SKILL.md"))) {
+              const p = join42(dir, id);
+              if (existsSync19(p) && existsSync19(join42(p, "SKILL.md"))) {
                 rmSync8(p, { recursive: true, force: true });
                 prunedAny = true;
               }
@@ -18623,8 +18726,8 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const sess = getSessionState(agent.code_name);
         let mcpJsonParsed = null;
         try {
-          const mcpPath = join41(getProjectDir(agent.code_name), ".mcp.json");
-          mcpJsonParsed = JSON.parse(readFileSync32(mcpPath, "utf-8"));
+          const mcpPath = join42(getProjectDir(agent.code_name), ".mcp.json");
+          mcpJsonParsed = JSON.parse(readFileSync33(mcpPath, "utf-8"));
         } catch {
         }
         const computerUseIsolated = isolationMode(agent.code_name) === "docker";
@@ -19116,7 +19219,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
   if (trackedFiles.length > 0 && existsSync19(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join41(agentDir, file));
+      const h = hashFile(join42(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -19131,7 +19234,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join41(homedir17(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join42(homedir18(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const obContactRaw = refreshData.agent.manager_last_contacted_at;
       const obContact = typeof obContactRaw === "string" && obContactRaw ? obContactRaw : null;
@@ -19246,7 +19349,7 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   }
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
-  const opencodeProjectDir = join41(getFramework("opencode").getAgentDir(codeName), "provision");
+  const opencodeProjectDir = join42(getFramework("opencode").getAgentDir(codeName), "provision");
   const serveEnv = {
     AGT_HOST: requireHost(),
     AGT_API_KEY: getApiKey() ?? void 0,
@@ -19306,8 +19409,8 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
     });
   }
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join41(projectDir, ".mcp.json");
-  const claudeMdPath = join41(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join42(projectDir, ".mcp.json");
+  const claudeMdPath = join42(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -19544,7 +19647,7 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
   const overdueMin = rolloverCurrent ? minutesSinceLocalMidnight(/* @__PURE__ */ new Date(), agentTimezone) : 0;
   const rolloverMayForce = staleForToday && rolloverSessionHealthy && rolloverCurrent !== null && overdueMin >= DAY_ROLLOVER_FORCE_GRACE_MIN;
   const rolloverInboundAgeSec = rolloverMayForce ? await channelInboundActivityAgeSecondsFor(codeName) : null;
-  const rolloverDecision = decideDayRolloverAction({
+  const rolloverInputs = {
     staleForToday,
     sessionHealthy: rolloverSessionHealthy,
     hasCurrent: rolloverCurrent !== null,
@@ -19555,7 +19658,11 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
     inboundGraceSec: DAY_ROLLOVER_INBOUND_GRACE_SEC,
     inboundDeferredMin: inboundHeldMinutesFor(codeName),
     inboundDeferMaxMin: DAY_ROLLOVER_INBOUND_DEFER_MAX_MIN
-  });
+  };
+  let rolloverDecision = decideDayRolloverAction(rolloverInputs);
+  if (rolloverDecision === "force-reset" && !deviceStateAllowsRollover(codeName, "force-reset")) {
+    rolloverDecision = decideDayRolloverAction({ ...rolloverInputs, deviceStateReady: false });
+  }
   if (rolloverDecision === "defer-idle" && rolloverCurrent) {
     if (!pendingDayRolloverReset.has(codeName)) {
       pendingDayRolloverReset.add(codeName);
@@ -19582,6 +19689,8 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
       );
     }
     dayRolloverDeferred = true;
+  } else if (rolloverDecision === "defer-device-state" && rolloverCurrent) {
+    dayRolloverDeferred = true;
   } else if (rolloverDecision === "busy-wait" && rolloverCurrent) {
     log(
       `[persistent-session] Day rollover for '${codeName}' deferred \u2014 agent still active on session ${rolloverCurrent.sessionId} (${overdueMin}m past boundary, will force at ${DAY_ROLLOVER_FORCE_GRACE_MIN}m)`
@@ -20153,7 +20262,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-BNQIJAFF.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-3M3556MN.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20196,7 +20305,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-ZOEBA7KM.js");
+        const { collectDiagnostics } = await import("../persistent-session-A2IB5WGW.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20247,7 +20356,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-ZOEBA7KM.js");
+      const { collectDiagnostics } = await import("../persistent-session-A2IB5WGW.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
@@ -20653,7 +20762,7 @@ async function processDirectChatMessage(agent, msg) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir17());
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir18());
         mkdirSync15(dirname11(doorbell), { recursive: true });
         writeFileSync18(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
@@ -20782,7 +20891,7 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir17());
+    const doorbell = directChatDoorbellPath(agentId, homedir18());
     mkdirSync15(dirname11(doorbell), { recursive: true });
     writeFileSync18(doorbell, String(Date.now()));
   } catch (err) {
@@ -20889,7 +20998,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-A36CKF54.js");
+  } = await import("../claude-pair-runtime-UYWAQW3F.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -21119,17 +21228,17 @@ var lastLocalFileHash = /* @__PURE__ */ new Map();
 var lastMemoriesBody = /* @__PURE__ */ new Map();
 var memoryManifests = /* @__PURE__ */ new Map();
 function memoryRetirementDir(configDir, codeName) {
-  return join41(configDir, "_memory-retirement", codeName);
+  return join42(configDir, "_memory-retirement", codeName);
 }
 function memoryManifestPath(configDir, codeName) {
-  return join41(memoryRetirementDir(configDir, codeName), "manifest.json");
+  return join42(memoryRetirementDir(configDir, codeName), "manifest.json");
 }
 function loadMemoryManifest(agentId, configDir, codeName) {
   const cached = memoryManifests.get(agentId);
   if (cached) return cached;
   let manifest = {};
   try {
-    const raw = readFileSync32(memoryManifestPath(configDir, codeName), "utf-8");
+    const raw = readFileSync33(memoryManifestPath(configDir, codeName), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -21157,7 +21266,7 @@ function saveMemoryManifest(agentId, configDir, codeName) {
   }
 }
 function retiredMemoryDir(configDir, codeName) {
-  return join41(memoryRetirementDir(configDir, codeName), "retired");
+  return join42(memoryRetirementDir(configDir, codeName), "retired");
 }
 var RETIRED_MEMORY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var lastRetirementReport = /* @__PURE__ */ new Map();
@@ -21236,7 +21345,7 @@ function applyMemoryTombstones(opts) {
       log2(`[memory-retire] ${agent.code_name}: KEPT '${tomb.name}' \u2014 no write record, not ours to remove`);
       continue;
     }
-    const filePath = join41(memoryDir, entry.file);
+    const filePath = join42(memoryDir, entry.file);
     if (!existsSync19(filePath)) {
       outcomes.already_gone++;
       delete manifest[tomb.name];
@@ -21244,7 +21353,7 @@ function applyMemoryTombstones(opts) {
       continue;
     }
     try {
-      const actual = createHash20("sha256").update(readFileSync32(filePath)).digest("hex");
+      const actual = createHash20("sha256").update(readFileSync33(filePath)).digest("hex");
       if (actual !== entry.sha) {
         outcomes.kept_modified++;
         outcomes.unapplied.push({ name: tomb.name, reason: "kept_modified" });
@@ -21256,9 +21365,9 @@ function applyMemoryTombstones(opts) {
       const destDir = retiredMemoryDir(configDir, agent.code_name);
       mkdirSync15(destDir, { recursive: true });
       const stamp = Date.now();
-      let dest = join41(destDir, `${entry.file}.${stamp}.retired`);
+      let dest = join42(destDir, `${entry.file}.${stamp}.retired`);
       for (let n = 1; existsSync19(dest); n++) {
-        dest = join41(destDir, `${entry.file}.${stamp}-${n}.retired`);
+        dest = join42(destDir, `${entry.file}.${stamp}-${n}.retired`);
       }
       renameSync11(filePath, dest);
       try {
@@ -21297,9 +21406,9 @@ function reapRetiredMemories(configDir, codeName, log2) {
   try {
     for (const file of readdirSync12(dir)) {
       if (!file.endsWith(".retired")) continue;
-      const path = join41(dir, file);
+      const path = join42(dir, file);
       try {
-        if (statSync11(path).mtimeMs < cutoff) {
+        if (statSync12(path).mtimeMs < cutoff) {
           unlinkSync6(path);
           reaped++;
         }
@@ -21312,8 +21421,8 @@ function reapRetiredMemories(configDir, codeName, log2) {
   if (reaped > 0) log2(`[memory-retire] ${codeName}: reaped ${reaped} retired memory file(s) past TTL`);
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join41(configDir, agent.code_name, "project");
-  const memoryDir = join41(projectDir, "memory");
+  const projectDir = join42(configDir, agent.code_name, "project");
+  const memoryDir = join42(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -21344,7 +21453,7 @@ async function syncMemories(agent, configDir, log2) {
     for (const file of readdirSync12(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync32(join41(memoryDir, file), "utf-8");
+        const raw = readFileSync33(join42(memoryDir, file), "utf-8");
         const fileHash = createHash20("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -21369,7 +21478,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync32(join41(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync33(join42(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -21450,7 +21559,7 @@ async function downloadMemories(agent, memoryDir, log2, { force, configDir }) {
         // Per-agent, not host-wide: memories are agent-private, so a shared
         // store would buy almost no dedupe while exposing one agent's content
         // to every other agent on the host. See memory-cache.ts's header.
-        cacheDir: join41(configDir, agent.code_name, "_memory_bodies"),
+        cacheDir: join42(configDir, agent.code_name, "_memory_bodies"),
         fetchContents: async (hashes) => {
           const res = await api.post(
             "/host/memories/contents",
@@ -21488,7 +21597,7 @@ async function downloadMemories(agent, memoryDir, log2, { force, configDir }) {
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
         const fileName = `${slug}.md`;
-        const filePath = join41(memoryDir, fileName);
+        const filePath = join42(memoryDir, fileName);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -21508,7 +21617,7 @@ ${mem.content}
         if (existsSync19(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync32(filePath, "utf-8");
+            existing = readFileSync33(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) {
@@ -21874,7 +21983,7 @@ function startManager(opts) {
   try {
     const stateFile = getStateFile();
     if (existsSync19(stateFile)) {
-      const raw = readFileSync32(stateFile, "utf-8");
+      const raw = readFileSync33(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state8.agents = parsed.agents;
@@ -21901,7 +22010,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join41(homedir17(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join42(homedir18(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -21930,7 +22039,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync32(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync33(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -22027,14 +22136,14 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join41(homedir17(), ".augmented", "_mcp");
+  const targetDir = join42(homedir18(), ".augmented", "_mcp");
   mkdirSync15(targetDir, { recursive: true });
   const moduleDir = dirname11(fileURLToPath2(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join41(dir, "dist", "mcp");
-    if (existsSync19(join41(candidate, "index.js"))) {
+    const candidate = join42(dir, "dist", "mcp");
+    if (existsSync19(join42(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -22052,7 +22161,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync19(p)) return null;
-      return createHash20("sha256").update(readFileSync32(p)).digest("hex");
+      return createHash20("sha256").update(readFileSync33(p)).digest("hex");
     } catch {
       return null;
     }
@@ -22134,8 +22243,8 @@ function deployMcpAssets() {
     // natural session restart.
     "computer-use-proxy.js"
   ]) {
-    const src = join41(mcpSourceDir, file);
-    const dst = join41(targetDir, file);
+    const src = join42(mcpSourceDir, file);
+    const dst = join42(targetDir, file);
     if (!existsSync19(src)) continue;
     attemptedFiles.push(file);
     const before = fileHash(dst);
@@ -22161,16 +22270,16 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join41(targetDir, "index.js");
+  const localMcpPath = join42(targetDir, "index.js");
   try {
-    const agentsDir = join41(homedir17(), ".augmented", "agents");
+    const agentsDir = join42(homedir18(), ".augmented", "agents");
     if (existsSync19(agentsDir)) {
       for (const entry of readdirSync12(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join41(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join42(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync32(mcpJsonPath, "utf-8");
+            const raw = readFileSync33(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];