@jc_stack/ez-agents 0.1.0-beta.44 → 0.1.0-beta.46

package/AGENTS.md

@@ -120,8 +120,8 @@ round merely to seek more criticism, tests or hypothetical edge cases.
 - **Rate limits:** Avoid spamming bubbles to respect Telegram’s 1 message/sec per-chat rate limit.
 
 ## 6. Concurrency & Workspace Invariants
-- **1 Writer Job per Workspace:** The agent's Markdown folder (`./agent/`) is its mind. Never run concurrent background processes writing to the same workspace simultaneously.
-- Main-conversation and owner-scheduled jobs write the same mind workspace one at a time; the delivery socket carries every cross-process enqueue/receipt, never control/ files. Scheduled jobs keep separate native CLI sessions and control-side task state. Restricted contact tasks retain their separate authorization boundary. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
+- **Responsive owner channels:** One foreground turn and one owner-scheduled turn may run concurrently; each stream stays serial. Separate native sessions isolate history and engine state, while the agent-owned Markdown workspace is shared. The engine coordinates shared file updates and plugins guard canonical record writes. Do not add a second reply agent, scheduler or execution queue.
+- The delivery socket carries every cross-process enqueue/receipt, never control/ files. Host plugin workspace invocations remain excluded until both native turns finish. Scheduled jobs keep separate native CLI sessions and control-side task state. Restricted contact tasks retain their separate authorization boundary. Delegation decisions and goal persistence belong to the agent/executor; there is no automatic planner or canned chat ACK. Production executor runs have no wall-clock timeout; cancellation is explicit.
 
 ## 7. Fail-Closed Authority (Channel Access ≠ Execution)
 - Incoming messages outside the approved owner binding must **never** spawn the executor. A first DM or group message records a pending request only. Explicitly approved owner groups grant owner access to all human members in that exact chat; bots and anonymous posts are ignored.

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.1.0-beta.46
+
+- Allow private RC/QA candidates to graduate to their matching published beta
+  through the existing updater, without permitting a move to an older beta.
+
+- Refresh the isolated broker after plugin upgrade or rollback so status reports
+  the resulting installed versions rather than its startup inventory. Preserve
+  the previous registry snapshot independently during plugin activation.
+  Preserve stopped plugins as stopped when Docker retains a created container.
+
+- Include the existing Telegram runtime/version summary in authorized private
+  channel controls so channel status can show the running relay and host versions.
+
+## 0.1.0-beta.45
+
+- Keep owner chat responsive while a scheduled native turn runs. Foreground
+  turns and scheduled turns each stay serial, with separate native sessions.
+  Host workspace invocations remain excluded until both streams finish.
+
+- Expose the existing immediate scheduling command in bounded managed guidance;
+  scope the owner-requested preference to foreground turns and prevent scheduled
+  work from scheduling itself again. Upgrade and rollback render the selected
+  package's guidance while preserving agent-owned text.
+- Support real external agent workspaces and private control directories without
+  deployment convenience symlinks, including plugin grants and updater backups.
+- Treat a concurrently released workspace lock as busy without adding retries,
+  and allow bounded host initialization beyond the former ten-second window.
+- Preserve failed native Codex turn diagnostics for channel delivery instead of
+  losing the failure when a native turn completes without response text.
+
 ## 0.1.0-beta.44
 
 - Let isolated native agents read declared installed plugin skills through the

package/docs/application-channel.md

@@ -58,6 +58,9 @@ the ordinary last-selection-wins behavior. Already-admitted runs keep their
 captured conversation and AI. Uncertain control responses require a fresh read,
 not blind repetition of `/new`.
 
+The scope-control response includes `software`, the same current runtime/version
+summary used by Telegram status. It is read-only and does not create a session.
+
 For private application conversations, `GET /v1/scope-control?scope=<encoded-scope>` returns
 the same catalog and the current scope's public control ID and preset. The scope
 is the application's original admission scope, resolved under its authenticated

package/docs/local-qa.md

@@ -16,7 +16,7 @@ Commit, push and open a PR first — then stage only from that PR's exact commit
 ```sh
 node scripts/stage-qa.mjs --source /absolute/feature-checkout \
   --catalog /absolute/deployment/tools/qa --label beta-12 \
-  --version 0.1.0-beta.12.qa.1 --flow /absolute/feature-QA.md
+  --version 0.1.0-beta.12.rc.1 --flow /absolute/feature-QA.md
 ```
 
 `beta-12` is a local catalog label, distinct from public `0.1.0-beta.12`. The

package/docs/plugin-connection.md

@@ -64,8 +64,9 @@ environment. Calls have a 30-second timeout and 256 KiB combined output limit;
 connection frames are limited to 1 MiB. Connection closure aborts pending calls
 and removes their exact command containers. There is no automatic retry.
 
-Arbitrary calls take the same fail-fast workspace lease as non-scheduled native
-jobs. Native work stays pending while a call runs; calls refuse pending/running
+Arbitrary calls take the same fail-fast workspace lease as native jobs. Host
+foreground and scheduled turns share that lease until both finish. Native work
+stays pending while a call runs; calls refuse pending/running
 native work. Ordinary CLI calls inside an admitted native job do not reacquire
 the lease. Isolated scheduled work keeps its existing workspace behavior. A stale
 native `workspace-writer.lock` is recovered at host startup only after its host

package/docs/plugins.md

@@ -157,6 +157,11 @@ snapshots. Reinstallation reuses that data. Plain install does not replace a dif
 compatible upgrades under saved policy; see [upgrades](upgrades.md). Manual
 uninstall/reinstall remains available but does not promise schema rollback.
 
+Installed package files retain their reviewed modes (0644 for ordinary files,
+0755 for executables and nested directories), including under restrictive umasks
+or inherited default ACLs. The snapshot root remains private (0700); provider
+data and private operation receipts keep their separate permissions.
+
 For another reviewed local package, inspect with `plugins inspect <id> --source
 /absolute/source`, then install with that source and the returned `--revision
 sha256:...`. Changed contents fail. To make a reviewed package discoverable without installing,
@@ -281,6 +286,19 @@ survive command-time Compose regeneration and restarts. Before a routed plugin
 update, the host adds the inspected candidate revision to that route; both the
 current and candidate revisions may remain authorized during the transition.
 
+An isolated broker mounts `host-executor.json` as a read-only file. After the host
+atomically replaces that configuration, recreate the declared broker service
+through the deployment's bound launcher before activating the candidate:
+`ezenciel-agents-docker up -d --no-deps --no-build --force-recreate plugin-broker`.
+This refreshes the file mount without replacing the native relay or its sessions.
+Host-capable executors read the current host file directly. Verify a native plugin
+call and its provider receipt after the configuration change.
+
+Before a data-preserving uninstall, record the host-owned routes and any
+operator-created plugin network's name, labels and IPAM configuration. Restore
+that same network configuration before activation if uninstall removed it;
+private volumes alone do not preserve Docker networks.
+
 This is deployment configuration, not a package-descriptor field or an `ez`
 command: agents and plugins cannot request or alter host networks. The host
 installer owns the binding and must ensure the selected service is stopped

package/docs/responsive-channels.md

@@ -1,10 +1,17 @@
 # Responsive channels
 
-Owner input passes unchanged to the selected engine. The agent decides when to
-delegate or schedule long work to remain available. ez queues foreground input
-while a foreground run is active; it does not create a separate busy-reply agent.
-Owner-scheduled turns use the bound mind workspace under the same single-writer
-limit as foreground turns.
+Owner input passes unchanged to the selected engine. In a foreground owner turn,
+when work can continue independently, the global managed guidance tells the agent
+to prefer an immediate scheduled turn so the foreground channel remains available.
+A scheduled turn executes its assigned work directly instead of scheduling itself
+again. The agent still makes that choice; ez does not infer task duration or
+auto-schedule work. ez queues foreground input while a foreground run is active;
+it does not create a separate busy-reply agent.
+Owner-scheduled turns run independently of the foreground channel stream, so a
+long review does not block chat. Each stream runs one turn at a time. They share
+the agent-owned workspace, but use separate native sessions; session isolation
+does not isolate Markdown files. The agent coordinates shared file updates and
+plugins enforce their canonical record-write contracts.
 
 Background tasks receive literal task text. Their native sessions contain no
 generated role instructions or copied identity files; native workspace instructions

package/docs/scheduling.md

@@ -49,10 +49,14 @@ No identity files or role instructions are generated. Existing workspace Markdow
 provides context, including native `AGENTS.md` discovery and relative links; the
 engine chooses what to read. Per-run native state stays under `control/`.
 
-One writer runs in the agent workspace: owner schedules and foreground turns
-queue behind each other. Foreground inputs queue while another turn runs;
-ez does not create another reply agent. The agent can delegate or schedule long
-work and return to chat. It decides when to send through the message CLI.
+One foreground turn and one owner-scheduled turn can run at the same time.
+Foreground inputs queue behind foreground work; scheduled turns queue behind
+scheduled work. A long scheduled goal therefore does not block chat. Both streams
+use the existing admission and executor path, with separate native sessions.
+They share the agent-owned Markdown workspace: the agent coordinates shared file
+updates, and plugins enforce canonical record-write guards. The host keeps plugin
+workspace invocations excluded until both native turns finish.
+The agent decides when to send through the message CLI.
 A recurring schedule has at most one pending or active occurrence. Shared
 provider resources still need writer coordination. The former four background
 slots are no longer used for owner schedules.
@@ -150,7 +154,7 @@ Telegram delivery, and a sleep test does not prove native goal persistence.
 
 Create a normal recurring schedule with `--every-seconds 900 --when unreviewed-failures --text-file templates/failure-review.md`. The condition advances empty occurrences without launching an executor. It considers only failures belonging to the paired owner. No separate monitor or automatic retry is introduced.
 
-`failures [--all] [--limit N]` returns failedAt, reason, exit code, native session, captured error and runtime versions. Capture keeps at most 4 KiB of redacted stderr; historical failures are not backfilled. `run RUN_ID` reads an owned run. `review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT` records the investigation without rewriting execution history. A stale timestamp is rejected; a later failure needs a new review. Restricted reply, external and isolated-task callers cannot review failures. An attention review is handed off, not repeatedly relaunched; another new failure wakes the next review.
+`failures [--all] [--limit N]` returns failedAt, reason, exit code, native session, captured error and runtime versions. Capture keeps at most 4 KiB of redacted stderr, including a failed native Codex turn's error message when supplied. A failure without error details remains explicitly unknown; historical failures are not backfilled. `run RUN_ID` reads an owned run. `review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT` records the investigation without rewriting execution history. A stale timestamp is rejected; a later failure needs a new review. Restricted reply, external and isolated-task callers cannot review failures. An attention review is handed off, not repeatedly relaunched; another new failure wakes the next review.
 
 The prompt controls diagnosis, authorized recovery and quiet notification behavior. Inspect prior effects and receipts before retrying anything. A failed review run itself remains visible as a new failure for the next occurrence.
 

package/docs/upgrades.md

@@ -1,5 +1,9 @@
 # Agent-owned software upgrades
 
+Private `beta.N.rc.M` and `beta.N.qa.M` candidates may upgrade to the matching
+published `beta.N`, despite SemVer's prerelease ordering. All identity, integrity,
+deployment and owner-policy checks still apply; older betas remain rejected.
+
 For an application's independently deployed frontend, backend or embedded gateway,
 see [managed applications](managed-applications.md). They use their existing
 deployment tools and a saved maintenance mandate; this package updater inventories
@@ -245,10 +249,15 @@ handbook from workspace `AGENTS.md` (and existing `AGENTS.override.md`).
 Personal text outside that block is preserved byte-for-byte. Do not reinsert
 coding, KISS, contribution or repair loops into operating minds.
 
-The package-owned locator is the managed `<!-- ez tools -->` block: the bound
-`ez` launcher, `ez --help`, and `ez tools list --details`. Inventory is
-generated on read. Plugin registry init and update binding refresh that locator.
+The package-owned guidance is the managed `<!-- ez tools -->` block: the bound
+`ez` launcher, `ez --help`, `ez tools list --details`, and one routing hint for
+foreground owner turns to prefer `ezenciel-agents-schedule create --now` when work
+can continue independently without blocking interaction. The hint tells scheduled
+turns to execute their assigned work directly instead of rescheduling themselves.
+Inventory and full scheduler usage are generated on read. Plugin registry init and update binding refresh that block.
 Malformed markers and symlinks fail visibly rather than overwriting personal work.
+Upgrade and rollback render the block through the exact package root being activated,
+so an already-running package cannot leave stale guidance behind.
 
 Codex, Grok and OpenCode discover workspace instructions natively. Claude
 receives the native `--append-system-prompt-file` binding to `AGENTS.md`, alongside

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.44",
+  "version": "0.1.0-beta.46",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/scripts/stage-qa.mjs

@@ -8,10 +8,10 @@ import {parseArgs} from 'node:util';
 import {digest, extract, version, newer} from '../src/updates/artifact.mjs';
 
 const {values:v}=parseArgs({options:Object.fromEntries(['source','catalog','label','version','flow'].map(k=>[k,{type:'string'}]))});
-if(!['source','catalog','label','version','flow'].every(k=>v[k]))throw Error('Required: --source CHECKOUT --catalog DIRECTORY --label beta-12 --version 0.1.0-beta.12.qa.1 --flow QA.md');
+if(!['source','catalog','label','version','flow'].every(k=>v[k]))throw Error('Required: --source CHECKOUT --catalog DIRECTORY --label beta-12 --version 0.1.0-beta.12.rc.1 --flow QA.md');
 if(!/^beta-[1-9]\d*$/.test(v.label))throw Error('Label must be beta-N');
 version(v.version);
-if(!/^\d+\.\d+\.\d+-beta\.\d+\.qa\.[1-9]\d*$/.test(v.version))throw Error('Use a distinct private version: X.Y.Z-beta.N.qa.BUILD');
+if(!/^\d+\.\d+\.\d+-beta\.\d+\.rc\.[1-9]\d*$/.test(v.version))throw Error('Use a distinct private version: X.Y.Z-beta.N.rc.M');
 const source=await fs.realpath(v.source),catalog=path.resolve(v.catalog);
 const run=(cmd,args,cwd=source)=>execFileSync(cmd,args,{cwd,encoding:'utf8',stdio:['ignore','pipe','pipe']}).trim();
 if(run('git',['status','--porcelain']))throw Error('Commit the reviewed source before staging QA');

package/src/application-channel.ts

@@ -11,6 +11,7 @@ import { MAX_INCOMING_ATTACHMENT_BYTES, stageChatAttachment } from './files.js'
 import { assertEffort } from './model-policy.js'
 import { ApprovalStore } from './approval.js'
 import { Tasks } from './tasks.js'
+import { softwareStatus } from './software-status.js'
 import { SpeechCreditsDepletedError } from './audio.js'
 
 const hash = (value: string) => createHash('sha256').update(value).digest('hex')
@@ -72,7 +73,7 @@ export class ApplicationChannel {
   private admissions = Promise.resolve()
   readonly bindings: ApplicationBindings
   constructor(private options: {
-    controlDir: string; workspace?: string; initial: AiPreset
+    controlDir: string; workspace?: string; isolation?: string; initial: AiPreset
     wake: () => void
     cancel: (id: string) => Promise<void>
     speech?: (text: string, language: 'en' | 'es') => Promise<{ buffer: Buffer; mimeType: string }>
@@ -180,6 +181,7 @@ export class ApplicationChannel {
     await this.sharedBinding(bindingId, false)
     return {ai:{...ai, selectedId:session?.preset?.id ?? ai.selectedId,
       presets:session?.preset ? [...ai.presets.filter(item=>item.id!==session.preset!.id),session.preset] : ai.presets},
+      software: await softwareStatus(this.options.controlDir, this.options.isolation),
       models, activeSessionId:session?.sessionId ?? null, sessions:session ? [{id:session.sessionId,title:sessionTitle(session),cli:session.cli,archived:false}] : []}
   }
   async changeScopeControls(bindingId: string, scope: string, input: unknown) {

package/src/codex-session.ts

@@ -1,4 +1,5 @@
 import { executionDefaults } from './model-policy.js'
+import { redactFailure } from './failure.js'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
@@ -62,7 +63,12 @@ export async function runCodexSession(options:Options, io:{launch?:()=>ChildProc
     if(message.method==='thread/goal/cleared')settled(null)
     if(message.method==='turn/completed'){
       if(activeTurn===message.params.turn.id)activeTurn=undefined
-      if(message.params.turn.status!=='completed'){finish(message.params.turn.status==='interrupted'?130:1);return}
+      if(message.params.turn.status!=='completed'){
+        if(message.params.turn.status==='interrupted')finish(130)
+        else fail(new Error(redactFailure(typeof message.params.turn.error?.message==='string'
+          ? message.params.turn.error.message : 'Native turn failed without error details')))
+        return
+      }
       // Completion of a turn is not completion of a native goal. The native
       // app-server remains running and owns any automatic next turn.
       void request('thread/goal/get',{threadId}).then(result=>settled(result.goal)).catch(fail)

package/src/host-executor.ts

@@ -51,7 +51,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
   let catalogRefresh: Promise<void> | undefined
   const locks: string[] = []
   const sharedWorkspaces = new Map<HostBinding, string>()
-  const activeWorkspaces = new Set<HostBinding>()
+  const activeWorkspaces = new Map<HostBinding, { lanes: Set<boolean>; release?: () => Promise<void> }>()
   const additionalWorkspaces = new Map<HostBinding, string[]>()
   const catalog = async (agent: HostBinding) => {
     const discovered = await readModels(undefined, undefined, path.join(agent.controlDir, 'cli', 'codex'),
@@ -158,13 +158,27 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
           }
           const sharedWorkspace=sharedWorkspaces.get(agent)
           const base=path.join(directory,id)
-          if (activeWorkspaces.has(agent)) continue
-          const releaseWorkspace = agent.toolsHome
-            ? await (await import('./plugins/workspace-lease.mjs')).workspaceLease(agent.toolsHome,{kind:'native',runId:id}) : undefined
-          if (agent.toolsHome && !releaseWorkspace) continue
-          activeWorkspaces.add(agent)
+          const scheduled = Boolean(run?.scheduled)
+          let workspace = activeWorkspaces.get(agent)
+          if (workspace?.lanes.has(scheduled)) continue
+          if (!workspace) {
+            const release = agent.toolsHome
+              ? await (await import('./plugins/workspace-lease.mjs')).workspaceLease(agent.toolsHome,{kind:'native',runId:id}) : undefined
+            if (agent.toolsHome && !release) continue
+            workspace = { lanes: new Set(), release }
+            activeWorkspaces.set(agent, workspace)
+          }
+          workspace.lanes.add(scheduled)
+          // Keep plugin workspace invocations excluded until both streams finish.
+          const releaseWorkspace = async () => {
+            workspace.lanes.delete(scheduled)
+            if (!workspace.lanes.size) {
+              activeWorkspaces.delete(agent)
+              await workspace.release?.()
+            }
+          }
           try { await rename(base+'.request.json',base+'.running.json') }
-          catch (error) { activeWorkspaces.delete(agent); await releaseWorkspace?.(); throw error }
+          catch (error) { await releaseWorkspace(); throw error }
           const task=(async()=>{
             let job: Awaited<ReturnType<typeof startExecutorJob>> | undefined
             let cancellation: ReturnType<typeof setInterval> | undefined
@@ -220,7 +234,7 @@ export const serveHostExecutor = async (installation: HostInstallation, signal:
               await rm(base+'.process.json',{force:true})
               await rm(base+'.cancel',{force:true})
               active.delete(base)
-              try { await releaseWorkspace?.() } finally { activeWorkspaces.delete(agent) }
+              await releaseWorkspace()
             }
           })()
           tasks.add(task); void task.finally(()=>tasks.delete(task))

package/src/index.ts

@@ -100,7 +100,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
   }
 
   const applicationChannel = new ApplicationChannel({
-    controlDir: config.controlDir, workspace: config.workspace, initial: aiMenu.initial,
+    controlDir: config.controlDir, workspace: config.workspace, isolation: config.isolation, initial: aiMenu.initial,
     aiControls: aiMenu,
     speech: config.geminiApiKey ? (text, language) => synthesizeSpeech(text, {
       geminiApiKey: config.geminiApiKey,
@@ -205,8 +205,9 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
         return
       }
       if (run.scheduled && !(await scheduler.get(run.scheduled.id)).enabled) return
-      // Owner turns and schedules write the same mind. Keep one native writer.
-      if (activeChild || background.size) return
+      // A long scheduled turn must not occupy the owner's chat stream.
+      // Each stream remains serial, with separate native sessions.
+      if (run.scheduled ? background.size > 0 : activeChild !== null) return
       let texts = run.texts
       if (run.external) {
         // Availability failures leave durable queued work for a later check.

package/src/plugins/manager.mjs

@@ -41,16 +41,24 @@ export async function stewardOwned(file) {
   const parent = await fs.stat(path.dirname(file));
   await fs.chown(file, parent.uid, parent.gid);
 }
-// Only a registry locator lives in native instructions. Inventory is generated on read.
-export async function bindToolDiscovery(home,workspace) {
-  home=await fs.realpath(home);workspace=await fs.realpath(workspace);
+// Native instructions keep only the registry locator and one crucial routing
+// hint. Inventory and full scheduler usage are generated on read.
+export async function toolDiscoveryBlock(home,hostConfig) {
+  home=await fs.realpath(home);
   let launcher=path.join(home,'bin','ez');
-  const config=await json(path.join(home,'config.json')).catch(error=>{if(error.code==='ENOENT')return undefined;throw error;});
+  const config=hostConfig?{hostConfig}:await json(path.join(home,'config.json')).catch(error=>{if(error.code==='ENOENT')return undefined;throw error;});
   if(config?.hostConfig) {
     const host=await json(config.hostConfig);
     if(host.isolation==='isolated') launcher='ez';
   }
   const start='<!-- ez tools: begin -->',end='<!-- ez tools: end -->';
+  const block=start+'\nUse `'+launcher+'`; run it with `--help` or `tools list --details` to discover installed capabilities, and read the matching skill when needed.\nKeep the channel responsive: during a foreground owner turn, prefer `ezenciel-agents-schedule create --now ...` when work can continue independently. A `[schedule ...]` turn executes its assigned work directly and must not schedule it again.\n'+end;
+  if(Buffer.byteLength(block)>600)throw Error('Tool discovery guidance exceeds the 600-byte core budget');
+  return {block,start,end};
+}
+export async function bindToolDiscovery(home,workspace) {
+  home=await fs.realpath(home);workspace=await fs.realpath(workspace);
+  const {block,start,end}=await toolDiscoveryBlock(home);
   for(const name of ['AGENTS.md','AGENTS.override.md']) {
     const file=path.join(workspace,name);
     const stat=await fs.lstat(file).catch(e=>{if(e.code==='ENOENT')return null;throw e;});
@@ -59,7 +67,6 @@ export async function bindToolDiscovery(home,workspace) {
     const prior=stat?await fs.readFile(file,'utf8'):'';
     const from=prior.indexOf(start),to=prior.indexOf(end);
     if((from<0)!==(to<0)||(from>=0&&(to<from||prior.indexOf(start,from+start.length)>=0||prior.indexOf(end,to+end.length)>=0)))throw Error('Malformed tool discovery block');
-    const block=start+'\nInstalled capabilities: `'+launcher+' --help` and `'+launcher+' tools list --details`. Use this bound launcher; read the matching skill when needed.\n'+end;
     const next=from<0?prior+'\n'+block+'\n':prior.slice(0,from)+block+prior.slice(to+end.length);
     if(next===prior)continue;
     const tmp=file+'.'+randomUUID()+'.tmp';
@@ -226,18 +233,11 @@ async function hostFolderRoots(config, record, home) {
   if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host folder bindings');
   const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
   if (candidates.length !== 1) throw Error('Host folder binding does not belong to this registry');
-  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  const agent = candidates[0];
   if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
       realpathSync(agent.workspace) !== config.workspace ||
       childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
     throw Error('Invalid host folder binding deployment');
-  // The isolated broker receives only the exact workspace, control directory,
-  // tools home, and host config mounts. It must not require the host
-  // deployment's convenience mind/control symlinks (or a deployment mount).
-  if (process.env.EZ_DOCKER_COMPOSE !== 'standalone' &&
-      (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
-       realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir)))
-    throw Error('Invalid host folder binding deployment');
   const configured = agent.pluginFolderRoots;
   if (configured !== undefined && (!configured || typeof configured !== 'object' || Array.isArray(configured)))
     throw Error('Invalid host folder roots');
@@ -280,7 +280,7 @@ export async function hostNetworkBindings(config, record, home) {
   if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host network bindings');
   const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
   if (candidates.length !== 1) throw Error('Host network binding does not belong to this registry');
-  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  const agent = candidates[0];
   if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
       realpathSync(agent.workspace) !== config.workspace ||
       childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
@@ -292,11 +292,6 @@ export async function hostNetworkBindings(config, record, home) {
   if (route === undefined) return [];
   const isolated = process.env.EZ_DOCKER_COMPOSE === 'standalone';
   if (isolated && host.isolation !== 'isolated') throw Error('Isolated broker requires an isolated host binding');
-  // Like folder grants, network grants use the exact mounted identities. The
-  // broker does not receive the host deployment's convenience symlinks.
-  if (!isolated && (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
-      realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir)))
-    throw Error('Invalid host network binding deployment');
   keys(route, ['revisions', 'bindings']);
   const trusted = await snapshot(record.source);
   if (record.revision !== trusted.revision || record.source !== trusted.source ||
@@ -509,6 +504,7 @@ export async function init(home,workspace,catalogFile,hostConfig,standalone=fals
   if(standalone && hostConfig) throw Error('Standalone setup cannot bind a relay host config');
   if(typeof home!=='string'||typeof workspace!=='string'||!path.isAbsolute(home)||!path.isAbsolute(workspace)||/[\r\n\0$:,]/.test(home+workspace)) throw Error('Explicit absolute home/workspace required');
   workspace=await fs.realpath(workspace);await privateDir(home);home=await fs.realpath(home);if(hostConfig)hostConfig=await fs.realpath(hostConfig);
+  await toolDiscoveryBlock(home,hostConfig);
   if(await fs.lstat(path.join(home,'registry.json')).catch(()=>null)) throw Error('Registry already exists; refusing replacement');
   catalogFile=path.resolve(catalogFile||fileURLToPath(new URL('../../default-plugins.json',import.meta.url)));
   const sources=await json(catalogFile);
@@ -557,7 +553,13 @@ export async function install(home,config,name,source,revision) {
     const base=path.join(home,'packages',name),target=path.join(base,revision.slice(7));await privateDir(base);
     const stage=path.join(base,`.stage-${randomUUID()}`);await privateDir(stage);
     try {
-      for(const [relative,file] of p.files) {const dest=path.join(stage,relative);await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});await fs.writeFile(dest,file.data,{mode:file.mode,flag:'wx'});}
+      for(const [relative,file] of p.files) {
+        const dest=path.join(stage,relative);await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});
+        // Package modes are part of the reviewed snapshot; umask/default ACLs
+        // must not make Docker COPY inputs unreadable to the runtime user.
+        for(let dir=path.dirname(dest);dir!==stage;dir=path.dirname(dir))await fs.chmod(dir,0o755);
+        await fs.writeFile(dest,file.data,{mode:file.mode,flag:'wx'});await fs.chmod(dest,file.mode);
+      }
       // A previously interrupted install may leave a snapshot. Never silently replace it.
       try { await fs.rename(stage,target); } catch(error) {
         if(!['EEXIST','ENOTEMPTY'].includes(error.code)) throw error;

package/src/plugins/workspace-lease.mjs

@@ -23,7 +23,7 @@ export async function recoverNativeLease(home) {
 export async function workspaceLease(home,owner={kind:'plugin'}) {
   const file=path.join(home,'workspace-writer.lock'),temp=file+'.'+randomUUID()+'.tmp';
   await fs.writeFile(temp,JSON.stringify({...owner,pid:process.pid}),{flag:'wx',mode:0o600});
-  try {await fs.link(temp,file);}catch(error){if(error.code!=='EEXIST')throw error;const prior=await leaseOwner(file);if(!prior.alive)throw Error('Stale workspace-writer.lock: inspect stopped owner and command containers, then restart for recovery');return undefined;}
+  try {await fs.link(temp,file);}catch(error){if(error.code!=='EEXIST')throw error;let prior;try {prior=await leaseOwner(file);}catch(error){if(error.code==='ENOENT')return undefined;throw error;}if(!prior.alive)throw Error('Stale workspace-writer.lock: inspect stopped owner and command containers, then restart for recovery');return undefined;}
   finally {await fs.rm(temp);}
   return async()=>{await fs.rm(file);};
 }

package/src/runs.ts

@@ -235,7 +235,7 @@ export class RunStore {
 
   async nextQueued(background?: boolean): Promise<RunRecord | undefined> {
     const queued = [...runsFor(this.controlDir).values()].sort((a,b)=>a.createdAt.localeCompare(b.createdAt)).filter((run) => run.status === 'queued' && (background === undefined || Boolean(run.scheduled) === background))
-    return queued.find(run => !run.taskId) ?? queued[0]
+    return queued.find(run => !run.taskId && !run.scheduled) ?? queued.find(run => !run.taskId) ?? queued[0]
   }
 
   async deliveryStatus(): Promise<{ failed: number; unknown: number }> {

package/src/updates/binding.mjs

@@ -1,14 +1,21 @@
 import * as fs from 'node:fs/promises';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { atomic, bindToolDiscovery } from '../plugins/manager.mjs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { atomic } from '../plugins/manager.mjs';
 import { read } from './control.mjs';
 
+async function packageToolDiscovery(packageRoot,home,workspace) {
+  const entry=path.join(packageRoot,'src/plugins/manager.mjs');
+  const manager=await import(pathToFileURL(entry).href);
+  if(typeof manager.bindToolDiscovery!=='function')throw Error('Selected package has no tool discovery binding');
+  await manager.bindToolDiscovery(home,workspace);
+}
+
 export async function bindUpdates(home,hostConfig,packageRoot=fileURLToPath(new URL('../../',import.meta.url))) {
   home=await fs.realpath(home);hostConfig=await fs.realpath(hostConfig);
-  const config=await read(path.join(home,'config.json')),host=await read(hostConfig),deploymentDir=path.dirname(hostConfig);
-  if(path.basename(hostConfig)!=='host-executor.json'||host.agents.length!==1||host.agents[0].toolsHome!==home||host.agents[0].workspace!==config.workspace)throw Error('Updates require this agent registry and its own single-deployment host config');
-  if(await fs.realpath(path.join(deploymentDir,'mind'))!==config.workspace||await fs.realpath(path.join(deploymentDir,'control'))!==host.agents[0].controlDir)throw Error('Noncanonical deployment state paths');
+  const config=await read(path.join(home,'config.json')),host=await read(hostConfig),deploymentDir=path.dirname(hostConfig),agent=host.agents[0];
+  if(path.basename(hostConfig)!=='host-executor.json'||host.agents.length!==1||agent.toolsHome!==home||agent.workspace!==config.workspace)throw Error('Updates require this agent registry and its own single-deployment host config');
+  if(await fs.realpath(agent.workspace)!==agent.workspace||await fs.realpath(agent.controlDir)!==agent.controlDir)throw Error('Noncanonical deployment state paths');
   packageRoot=await fs.realpath(packageRoot);
   await fs.mkdir(path.join(home,'updates'),{recursive:true,mode:0o700});
   await atomic(path.join(home,'config.json'),{...config,hostConfig,packageRoot:packageRoot.replace(/\/$/,''),deploymentDir});
@@ -19,8 +26,8 @@ export async function bindUpdates(home,hostConfig,packageRoot=fileURLToPath(new
   await fs.writeFile(path.join(bin,'ez'),`#!${process.execPath}\nimport fs from 'node:fs';import {pathToFileURL} from 'node:url';const c=JSON.parse(fs.readFileSync(${configFile}));const m=await import(pathToFileURL(c.packageRoot+'/src/plugins/manager.mjs'));m.main(['--home',${JSON.stringify(home)},...process.argv.slice(2)]).catch(e=>{console.error(e.message);process.exitCode=1});\n`,{mode:0o700});
   for(const [name,entry] of Object.entries(pkg.bin)) {
     const dest=path.join(bin,name);await fs.rm(dest,{force:true});
-    await fs.writeFile(dest,`#!${process.execPath}\nimport fs from 'node:fs';import {spawn} from 'node:child_process';const c=JSON.parse(fs.readFileSync(${configFile}));const child=spawn(c.packageRoot+'/'+${JSON.stringify(entry)},process.argv.slice(2),{stdio:'inherit',env:{...process.env,EZ_DEPLOYMENT_DIR:c.deploymentDir,EZ_CONTROL_DIR:c.deploymentDir+'/control'}});for(const s of ['SIGTERM','SIGINT'])process.on(s,()=>child.kill(s));child.on('error',e=>{console.error(e.message);process.exitCode=1});child.on('close',c=>process.exitCode=c??1);\n`,{mode:0o700});
+    await fs.writeFile(dest,`#!${process.execPath}\nimport fs from 'node:fs';import {spawn} from 'node:child_process';const c=JSON.parse(fs.readFileSync(${configFile}));const child=spawn(c.packageRoot+'/'+${JSON.stringify(entry)},process.argv.slice(2),{stdio:'inherit',env:{...process.env,EZ_DEPLOYMENT_DIR:c.deploymentDir,EZ_CONTROL_DIR:${JSON.stringify(agent.controlDir)}}});for(const s of ['SIGTERM','SIGINT'])process.on(s,()=>child.kill(s));child.on('error',e=>{console.error(e.message);process.exitCode=1});child.on('close',c=>process.exitCode=c??1);\n`,{mode:0o700});
   }
-  await bindToolDiscovery(home,config.workspace);
+  await packageToolDiscovery(packageRoot,home,config.workspace);
   return {ok:true,home,deploymentDir,packageRoot,policy:'Automatic compatible beta-channel updates by default; saved stable-only or manual policies take precedence. Local candidates require an explicit owner request.'};
 }

package/src/updates/control.mjs

@@ -10,8 +10,9 @@ export const missing = error => {if(error.code!=='ENOENT')throw error;return nul
 export const targetId = value => {if(value!=='main'&&!/^[a-z][a-z0-9-]{0,39}$/.test(value))throw Error('Invalid update target');return value;};
 const jobId=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 const compatibilityBuild=/^(.+)\.compat\.\d+$/;
+const qaBuild=/^(\d+\.\d+\.\d+-beta\.\d+)\.(?:rc|qa)\.[1-9]\d*$/;
 const upgradeable=(candidate,installed)=>{
-  const match=compatibilityBuild.exec(installed);
+  const match=compatibilityBuild.exec(installed)||qaBuild.exec(installed);
   return newer(candidate,installed)||Boolean(match&&match[1]===candidate);
 };
 export const updateHome = home => path.join(home,'updates');

package/src/updates/runtime.mjs

@@ -61,6 +61,10 @@ export async function relayServices(config) {
   const env = await fs.readFile(path.join(config.deploymentDir,'docker.env'),'utf8').catch(() => '');
   return parseEnv(env).EZ_EXECUTOR_TRANSPORT === 'local' ? ['relay','plugin-broker'] : ['relay'];
 }
+async function refreshBroker(config, run) {
+  if ((await relayServices(config)).includes('plugin-broker'))
+    await run('docker', [...relayArgs(config), 'restart', 'plugin-broker']);
+}
 const healthCodes = new Set(['RELAY_UNREADABLE','RELAY_NOT_POLLING','RELAY_STALE','HOST_UNREADABLE','HOST_STALE','PLUGIN_BROKER_UNREADABLE']);
 async function healthEvidence(config,run) {
   const id=(await run('docker',[...relayArgs(config),'ps','-q','relay'])).trim();
@@ -90,7 +94,7 @@ async function backupVolume(run,record,name,directory) {
 // Interruptible work is journaled before any running installation is touched.
 // On restart, recovery restores code/config only, never provider journals.
 export async function perform(home,job,hooks) {
-  const run=hooks.execute||execute,{config}=await state(home),dir=jobPath(home,job.id),file=path.join(dir,'job.json');
+  const run=hooks.execute||execute,{config,agent}=await state(home),dir=jobPath(home,job.id),file=path.join(dir,'job.json');
   const save=()=>atomic(file,job);
   if(job.status==='applying'||job.recoveryRequested)return recover(home,job,hooks);
   if(job.status!=='queued')throw Error('Job is not queued');
@@ -129,7 +133,8 @@ export async function perform(home,job,hooks) {
       job.rollback={env:envValue(oldEnv,'EZ_RELAY_IMAGE',oldImage),packageRoot:config.packageRoot};await save();
       await run('docker',[...relayArgs(config),'stop','relay']);await hooks.stopHost();
       const backup=path.join(dir,'backup');await fs.mkdir(backup,{mode:0o700});
-      for(const name of ['mind','control'])await backupStateDirectory(path.join(config.deploymentDir,name),path.join(backup,name));
+      await backupStateDirectory(config.workspace,path.join(backup,'workspace'));
+      await backupStateDirectory(agent.controlDir,path.join(backup,'control'));
       for(const name of ['docker.env','host-executor.json','agent.json','purpose.md','relay.env'])await fs.copyFile(path.join(config.deploymentDir,name),path.join(backup,name));
       let env=oldEnv.split(job.previousRoot+path.sep).join(root+path.sep);env=envValue(env,'EZ_RELAY_IMAGE',image);
       await textAtomic(envFile,env);
@@ -144,8 +149,8 @@ export async function perform(home,job,hooks) {
       await checkFolders(config,candidate,home);
       const stage={...candidate,compose:path.join(dir,'compose.json')};await atomic(stage.compose,await compose(config,stage,secrets,home));
       for(const [service,spec] of Object.entries(stage.deployment.services))await run('docker',[...pluginArgs(stage),spec.image?'pull':'build',service]);
-      const running=Boolean((await run('docker',[...pluginArgs(old),'ps','-q'])).trim());
-      job.rollback={record:old,registry:r,compose:await read(old.compose),running};await save();
+      const running=Boolean((await run('docker',[...pluginArgs(old),'ps','--status','running','-q'])).trim());
+      job.rollback={record:old,registry:structuredClone(r),compose:await read(old.compose),running};await save();
       await run('docker',[...pluginArgs(old),'stop']);
       const backup=path.join(dir,'backup');await fs.mkdir(backup,{mode:0o700});
       const volumes=new Set(Object.values(old.deployment.services).flatMap(s=>Object.keys(s.volumes||{})));
@@ -155,6 +160,7 @@ export async function perform(home,job,hooks) {
       r.plugins[job.target]=candidate;
       for(const alias of Object.keys(candidate.manifest.commands))r.commands[alias]=job.target;
       await atomic(path.join(home,'registry.json'),r);
+      await refreshBroker(config,run);
       job.runtimeVerified=running;
     }
     job.status='completed';job.endedAt=new Date().toISOString();await save();
@@ -191,6 +197,7 @@ export async function recover(home,job,hooks) {
         const b=job.rollback;
         await run('docker',[...pluginArgs(b.record),'stop']);
         await atomic(b.record.compose,b.compose);await atomic(path.join(home,'registry.json'),b.registry);
+        await refreshBroker(config,run);
         if(b.running)await run('docker',[...pluginArgs(b.record),'up','-d','--wait','--wait-timeout','90','--no-build']);
       }
       job.status='rolled-back';

package/src/updates/supervisor.mjs

@@ -20,6 +20,16 @@ export function providerEnvironment(host, environment=process.env) {
 }
 
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+export async function waitForHostHeartbeat(controlDir,child,failure,{attempts=300,intervalMs=100,readHeartbeat=read,wait=sleep}={}) {
+  for(let n=0;n<attempts;n++) {
+    const error=failure();
+    if(error||child.exitCode!==null)throw error||Error('Host transport failed to start');
+    const beat=await readHeartbeat(path.join(controlDir,'host-executor/heartbeat.json')).catch(missing);
+    if(beat?.pid===child.pid&&Date.now()-beat.at<10000)return;
+    await wait(intervalMs);
+  }
+  throw Error('Host transport heartbeat timeout');
+}
 export async function idle(control) {
   const host=await fs.readdir(path.join(control,'host-executor')).catch(e=>{if(e.code==='ENOENT')return [];throw e;});
   if(host.some(f=>f.endsWith('.running.json')||f.endsWith('.request.json')))return false;
@@ -67,13 +77,7 @@ export async function supervise(deployment,signal,{discover=check}={}) {
     child=spawn(process.execPath,['--import',path.join(root,'node_modules/tsx/dist/loader.mjs'),path.join(root,'src/host-executor.ts'),path.join(deployment,'host-executor.json')],
       {env:{...environment(),...providerEnvironment(host),EZ_HOST_SUPERVISOR_PID:String(process.pid)},stdio:['ignore','inherit','inherit']});
     let error;child.once('error',e=>{error=e;});
-    for(let n=0;n<100;n++) {
-      if(error||child.exitCode!==null)throw error||Error('Host transport failed to start');
-      const beat=await read(path.join(agent.controlDir,'host-executor/heartbeat.json')).catch(missing);
-      if(beat?.pid===child.pid&&Date.now()-beat.at<10000)return;
-      await sleep(100);
-    }
-    throw Error('Host transport heartbeat timeout');
+    await waitForHostHeartbeat(agent.controlDir,child,()=>error);
   };
   const pause=path.join(agent.controlDir,'upgrade-pause.json');
   const beat=setInterval(()=>{void atomic(path.join(directory,'supervisor.json'),{pid:process.pid,at:Date.now()}).catch(()=>{});},1000);

package/test/application-controls.test.ts

@@ -8,6 +8,7 @@ import { ApplicationChannel, applicationScope } from '../src/application-channel
 import { ControlStore } from '../src/control-state.js'
 import { createAiMenu } from '../src/menu.js'
 import { RunStore } from '../src/runs.js'
+import { softwareStatus } from '../src/software-status.js'
 
 test('shared controls validate detected host presets against the host catalog', async t => {
   const root = await mkdtemp(join(tmpdir(), 'ez-host-controls-'))
@@ -67,6 +68,8 @@ test('private scope reset and model controls preserve running sessions and share
     ...(body===undefined?{}:{body:JSON.stringify(body)}),
   })
   const before = await (await call()).json() as any
+  assert.deepEqual(before.software,await softwareStatus(root))
+  assert.match(before.software[0],/^Relay: running · /)
   assert.equal(before.activeSessionId,run.execution!.sessionId)
   assert.equal(JSON.stringify(before).includes('native-private'),false)
   assert.equal((await channel.scopeControls(second.bindingId,'exercise')).activeSessionId,null)

package/test/codex-session.test.ts

@@ -3,7 +3,9 @@ import assert from 'node:assert/strict'
 import { spawn } from 'node:child_process'
 import { runCodexSession } from '../src/codex-session.js'
 
-for(const mode of ['external','goal','long-goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal'])test(`native Codex session: ${mode}`,async()=>{
+for(const mode of ['external','goal','long-goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal','failed','failed-redacted','failed-no-error','interrupted'])test(`native Codex session: ${mode}`,async(t)=>{
+  const diagnostics:string[]=[]
+  t.mock.method(console,'error',(...args:unknown[])=>diagnostics.push(args.join(' ')))
   const prompt=mode==='long-goal'?'/goal Complete the research.\n'+'Full workflow context.\n'.repeat(400)+'FINAL_COMPLETION_CRITERION':'test'
   const requests:string[]=[],output:string[]=[]
   const program=`
@@ -24,6 +26,10 @@ if(q.method==='turn/start'){
  send({method:'turn/completed',params:{threadId:'unrelated',turn:{id:'unrelated',status:'completed'}}});start('one');
  if(${JSON.stringify(mode)}==='disconnect')return process.exit(0);
  if(${JSON.stringify(mode)}==='approval')return send({id:999,method:'item/commandExecution/requestApproval',params:{threadId:'native-test'}});
+ if(['failed','failed-redacted','failed-no-error','interrupted'].includes(${JSON.stringify(mode)})){
+  const message=${JSON.stringify(mode)}==='failed-redacted'?'Native provider request failed: Bearer synthetic-private-token https://user:password@example.test/response?api_key=synthetic-private-key':'Native provider request failed';
+  return event('turn/completed',{turn:{id:'one',status:${JSON.stringify(mode)}==='interrupted'?'interrupted':'failed',error:${JSON.stringify(mode)}==='failed-no-error'?null:{message}}});
+ }
  if(${JSON.stringify(mode)}==='missing-goal')event('thread/goal/updated',{goal:{status:'active'}});
  end('one');return;
 }
@@ -57,9 +63,16 @@ if(q.method==='thread/goal/get'){
     assert.equal(threadConfig.model_provider,'openrouter')
     assert.deepEqual(threadConfig['model_providers.openrouter'],{name:'OpenRouter',base_url:'https://openrouter.ai/api/v1',env_key:'OPENROUTER_API_KEY',wire_api:'responses',supports_websockets:false})
   }
-  assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
+  assert.equal(result,mode==='interrupted'?130:['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
   assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
   assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)
   if(mode==='goal')assert.equal(requests.filter(x=>x==='thread/goal/get').length,2,'must wait for the second turn to complete')
+  if(mode==='failed' || mode==='failed-redacted')assert.ok(diagnostics.some(line=>line.includes('Native provider request failed')),'terminal native error must reach existing stderr diagnostics')
+  if(mode==='failed-redacted'){
+    assert.ok(diagnostics.some(line=>line.includes('https://example.test/response')))
+    assert.ok(diagnostics.every(line=>!line.includes('synthetic-private') && !line.includes('user:password')))
+  }
+  if(mode==='failed-no-error')assert.ok(diagnostics.some(line=>line.includes('Native turn failed without error details')))
+  if(mode==='interrupted')assert.equal(diagnostics.length,0,'owner interruption is not a provider failure')
   assert.equal(JSON.parse(output[0]).thread_id,'native-test')
 })

package/test/host-executor.test.ts

@@ -167,7 +167,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
   let server:Promise<void>|undefined
   try {
     const binary=path.join(root,'cli')
-    await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
+    await writeFile(binary,`#!${process.execPath}\nif(['r_hold','tg_43'].includes(process.env.EZ_RUN_ID))setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
     await writeFile(path.join(root,'claude'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'codex'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'opencode'),'#!/bin/sh\nexit 0\n',{mode:0o700})
@@ -284,18 +284,32 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.match(output, /"stream":"exit","code":0/)
       return output.trim().split('\n').map(line=>JSON.parse(line))
     }
-    // Another agent remains independent; this agent's queued schedule and chat
-    // wait behind its active owner schedule in the same mind.
+    // Chat completes while this agent's scheduled turn stays active. A second
+    // scheduled turn still waits, and the shared lifecycle lease stays held.
     await completed(otherDirectory,'r_other_shared')
+    const chatEvents=await completed(directory,'tg_42')
     assert.ok(await readFile(path.join(directory,'r_schedule_queued.request.json')))
-    assert.ok(await readFile(path.join(directory,'tg_42.request.json')))
+    assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
+    await ownerRun(agents[0].controlDir,'tg_43')
+    await writeFile(path.join(directory,'tg_43.request.json'),JSON.stringify({texts:['Hold chat'],options:{cli:'grok'}}))
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'tg_43.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'tg_43.running.json'))
     assert.doesNotMatch(await readFile(path.join(directory,'r_hold.events'),'utf8'),/"stream":"exit"/)
     await readFile(path.join(directory,'r_hold.running.json'))
     await writeFile(path.join(directory,'r_hold.cancel'),'')
     let heldOutput=''
     for(let n=0;n<200;n++){heldOutput=await readFile(path.join(directory,'r_hold.events'),'utf8');if(heldOutput.includes('"stream":"exit"'))break;await new Promise(r=>setTimeout(r,20))}
     assert.match(heldOutput, /"stream":"exit","code":1/)
-    const [scheduleEvents,chatEvents]=await Promise.all([completed(directory,'r_schedule_queued'),completed(directory,'tg_42')])
+    const scheduleEvents=await completed(directory,'r_schedule_queued')
+    // When the scheduled lane finishes first, chat still owns the lease.
+    assert.equal(await workspaceLease(agents[0].toolsHome),undefined)
+    await writeFile(path.join(directory,'tg_43.cancel'),'')
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'tg_43.running.json'))}catch{break}await new Promise(r=>setTimeout(r,20))}
+    // The running marker is removed before the lifecycle lease is released.
+    let unlock
+    for(let n=0;n<100;n++){unlock=await workspaceLease(agents[0].toolsHome);if(unlock)break;await new Promise(r=>setTimeout(r,20))}
+    assert.ok(unlock)
+    await unlock()
     const scheduled=JSON.parse(scheduleEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
     const chat=JSON.parse(chatEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
     assert.equal(scheduled.cwd,await realpath(agents[0].workspace))

package/test/local-qa.test.mjs

@@ -20,7 +20,7 @@ test('local QA staging preserves source and rejects label replacement and dirty
   git(['init']);git(['add','package.json','feature.txt','run.sh']);
   git(['-c','user.name=QA','-c','user.email=qa@example.invalid','-c','core.hooksPath=/dev/null','-c','commit.gpgsign=false','commit','-m','fixture']);
   const script=fileURLToPath(new URL('../scripts/stage-qa.mjs',import.meta.url));
-  const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.qa.1','--flow',flow];
+  const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.rc.1','--flow',flow];
   const stage=()=>{const prior=process.umask(0o027);try{return execFileSync(process.execPath,args,{stdio:'pipe'}).toString();}finally{process.umask(prior);}};
   try {
     const result=JSON.parse(stage()),data=await fs.readFile(path.join(result.directory,result.file));
@@ -28,7 +28,7 @@ test('local QA staging preserves source and rejects label replacement and dirty
     assert.equal(git(['status','--porcelain']),'');
     await extract(data,path.join(root,'unpacked'));
     const built=JSON.parse(await fs.readFile(path.join(root,'unpacked/package.json'),'utf8'));
-    assert.equal(built.version,'0.1.0-beta.12.qa.1');assert.equal(built.ezQa.commit,result.commit);
+    assert.equal(built.version,'0.1.0-beta.12.rc.1');assert.equal(built.ezQa.commit,result.commit);
     assert.equal(await fs.readFile(path.join(root,'unpacked/feature.txt'),'utf8'),'feature source');
     assert.equal((await fs.stat(path.join(root,'unpacked'))).mode&0o777,0o755);
     assert.equal((await fs.stat(path.join(root,'unpacked/feature.txt'))).mode&0o777,0o644);

package/test/plugin-connection.test.mjs

@@ -66,6 +66,17 @@ test('shared workspace lease excludes concurrent writers and refuses queued nati
     await fs.mkdir(path.join(dir,'host-executor'));await fs.writeFile(path.join(dir,'host.json'),JSON.stringify({agents:[{toolsHome:dir,workspace:dir,controlDir:dir}]}));await fs.writeFile(path.join(dir,'config.json'),JSON.stringify({hostConfig:path.join(dir,'host.json'),workspace:dir}));await fs.writeFile(path.join(dir,'host-executor','r.request.json'),'{}');await assert.rejects(invokeLease(dir),/pending/);await fs.rm(path.join(dir,'host-executor','r.request.json'));const unlock=await invokeLease(dir);await unlock();
   }finally{await fs.rm(dir,{recursive:true,force:true});}
 });
+test('workspace lease contention tolerates a concurrent owner release',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-lease-release-'));
+  try {
+    for(let n=0;n<100;n++) {
+      const release=await workspaceLease(dir);assert.ok(release);
+      const [,contender]=await Promise.all([release(),workspaceLease(dir)]);
+      if(contender)await contender();
+      const next=await workspaceLease(dir);assert.ok(next);await next();
+    }
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
 test('command output bound and timeout remove exact containers without leaking daemon secrets',async()=>{
   const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-bound-'));
   try {

package/test/plugin-manager.test.mjs

@@ -46,6 +46,21 @@ async function fixture(t) {
  const call=(...args)=>exec(process.execPath,[bin,'--home',home,...args],{env});
  return {root,source,home,deploymentDir,workspace,control,hostConfig,fake,log,manifest,deployment,env,call};
 }
+test('install preserves reviewed package modes under a restrictive umask',async t=>{
+ const f=await fixture(t);
+ await fs.mkdir(path.join(f.source,'nested'));await fs.writeFile(path.join(f.source,'nested','note.md'),'Synthetic');
+ const pkg=JSON.parse(await fs.readFile(path.join(f.source,'package.json'),'utf8'));pkg.files.push('nested');
+ await fs.writeFile(path.join(f.source,'package.json'),JSON.stringify(pkg));await fs.chmod(path.join(f.source,'client.mjs'),0o755);
+ const p=await snapshot(f.source);await init(f.home,f.workspace);
+ const argv=['--home',f.home,'plugins','install','sample','--source',f.source,'--revision',p.revision];
+ const script=`process.umask(0o077);const m=await import(${JSON.stringify(new URL('../src/plugins/manager.mjs',import.meta.url).href)});await m.main(${JSON.stringify(argv)});`;
+ await exec(process.execPath,['--input-type=module','-e',script],{env:f.env});
+ const record=JSON.parse(await fs.readFile(path.join(f.home,'registry.json'),'utf8')).plugins.sample;
+ for(const [relative,file]of p.files)assert.equal((await fs.stat(path.join(record.source,relative))).mode&0o777,file.mode,relative);
+ assert.equal((await fs.stat(path.join(record.source,'nested'))).mode&0o777,0o755);
+ assert.equal((await fs.stat(record.source)).mode&0o777,0o700);
+ assert.equal((await snapshot(record.source)).revision,p.revision);
+});
 test('persistent connection reuses one container and releases registry lock between frames',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
  await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nif(process.argv[2]==='container')process.exit(0);require('readline').createInterface({input:process.stdin}).on('line',line=>{const f=JSON.parse(line);console.log(JSON.stringify(f.coreResponse?{reply:f.coreResponse}:{coreRequest:{id:f.id,method:'tools.list',params:{}}}));});`,{mode:0o700});
@@ -68,13 +83,15 @@ test('catalog paths resolve relative to the catalog and pin each new agent indep
  assert.notEqual(first.sample.revision,next.catalog.sample.revision);
  assert.deepEqual(JSON.parse((await f.call('plugins','available')).stdout),first);
 });
-test('native discovery binding preserves notes and never seeds a tool inventory',async t=>{
+test('native discovery binding preserves notes and adds bounded nonblocking routing guidance',async t=>{
  const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),notes=path.join(f.workspace,'TOOLS.md');
  await fs.writeFile(instructions,'Owner mandate\n');
  await init(f.home,f.workspace);
  await assert.rejects(fs.access(notes),{code:'ENOENT'});
  const first=await fs.readFile(instructions,'utf8');assert(first.startsWith('Owner mandate\n'));assert(first.includes(f.home+'/bin/ez'));
- assert.match(first,/tools list --details/);assert.match(first,/ --help/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
+ assert.match(first,/tools list --details/);assert.match(first,/`--help`/);assert.match(first,/during a foreground owner turn, prefer `ezenciel-agents-schedule create --now \.\.\.`/);assert.match(first,/A `\[schedule \.\.\.\]` turn executes its assigned work directly and must not schedule it again/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
+ const managed=first.slice(first.indexOf('<!-- ez tools: begin -->'),first.indexOf('<!-- ez tools: end -->')+'<!-- ez tools: end -->'.length);
+ assert.ok(Buffer.byteLength(managed)<=600);
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(instructions,'utf8'),first);
  await fs.writeFile(notes,'Legacy policy');
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
@@ -91,7 +108,20 @@ test('isolated discovery uses the relay-bound ez client without exposing toolsHo
  const f=await fixture(t);await fs.mkdir(f.home);const workspace=await fs.realpath(f.workspace),controlDir=await fs.realpath(f.control),toolsHome=await fs.realpath(f.home),host={cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir,binDir:path.join(f.root,'bin'),toolsHome}]};
  await fs.mkdir(path.join(f.root,'bin'));await fs.writeFile(f.hostConfig,JSON.stringify(host));
  await init(f.home,f.workspace,undefined,f.hostConfig);
- const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/`ez tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+ const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/Use `ez`/);assert.match(instructions,/`tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+});
+test('discovery rejects an over-budget launcher before rewriting instructions',async t=>{
+ const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),longHome=path.join(f.root,'h'.repeat(200),'n'.repeat(200));
+ await fs.mkdir(longHome,{recursive:true});await fs.writeFile(instructions,'Owner mandate\n');
+ await assert.rejects(bindToolDiscovery(longHome,f.workspace),/600-byte core budget/);
+ assert.equal(await fs.readFile(instructions,'utf8'),'Owner mandate\n');
+});
+test('standalone init rejects over-budget guidance before creating activation state',async t=>{
+ const f=await fixture(t),instructions=path.join(f.workspace,'AGENTS.md'),longHome=path.join(f.root,'i'.repeat(200),'j'.repeat(200)),catalog=path.join(f.root,'empty-catalog.json');
+ await fs.writeFile(catalog,'{}');await fs.writeFile(instructions,'Owner mandate\n');
+ await assert.rejects(initManager(longHome,f.workspace,catalog,undefined,true),/600-byte core budget/);
+ assert.deepEqual(await fs.readdir(longHome),[]);
+ assert.equal(await fs.readFile(instructions,'utf8'),'Owner mandate\n');
 });
 test('installed snippets follow install, upgrade and uninstall without files or Docker reads',async t=>{
  const f=await fixture(t);await init(f.home,f.workspace);
@@ -290,6 +320,19 @@ test('isolated broker host binding validates exact mounts without deployment sym
   if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
  }
 });
+test('host-capable binding validates an external real workspace without deployment symlinks',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),workspace=path.join(f.root,'external-workspace');
+ await fs.rm(f.workspace,{recursive:true});await fs.mkdir(workspace);await fs.mkdir(f.home);
+ const binding={service:'sample',network:'sample_default'};
+ await fs.writeFile(f.hostConfig,JSON.stringify({cli:'synthetic',agents:[{name:'sample',workspace,controlDir:f.control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[binding]}}}]}));
+ const realWorkspace=await fs.realpath(workspace),config={workspace:realWorkspace,hostConfig:await fs.realpath(f.hostConfig),folders:{sample:[{service:'sample',source:realWorkspace,target:'/data/files'}]}};
+ const record={source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment};
+ const c=await compose(config,record,{},f.home);
+ assert.equal(c.services.sample.volumes.find(volume=>volume.target===realWorkspace).source,realWorkspace);
+ assert.equal(c.services.sample.volumes.find(volume=>volume.target==='/data/files').source,realWorkspace);
+ const network=Object.values(c.networks).find(candidate=>candidate.name==='sample_default');
+ assert.deepEqual(network,{external:true,name:'sample_default'});
+});
 test('isolated broker allows unbound plugins when another plugin has host binding',async t=>{
  const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated-other'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
  await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});

package/test/scheduler-host.test.ts

@@ -11,7 +11,7 @@ import { RunStore } from '../src/runs.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
 const stdout=(events:string) => events.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)).filter(event=>event.stream==='stdout').map(event=>event.text).join('')
-test('host transport serializes owner schedules and chat in the bound mind',async()=>{
+test('host transport keeps chat responsive beside a schedule in the bound mind',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
  await mkdir(workspace);await mkdir(controlDir)
  await writeFile(join(workspace,'AGENTS.md'),'bound-owner-instructions')
@@ -32,9 +32,7 @@ test('host transport serializes owner schedules and chat in the bound mind',asyn
   await submit(id)
   await until(async()=>Boolean(await exists(id+'.process.json')))
   await submit('tg_1')
-  await new Promise(resolve=>setTimeout(resolve,300))
-  assert.ok(await exists('tg_1.request.json'))
-  assert.equal(await exists('tg_1.events'),'')
+  await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists(id+'.events')).includes('"stream":"stdout"'))
   const scheduled=JSON.parse(stdout(await exists(id+'.events')))
@@ -47,7 +45,8 @@ test('host transport serializes owner schedules and chat in the bound mind',asyn
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await ownerRun(controlDir,'tg_2')
   await submit('tg_2')
-  assert.ok(await exists('tg_2.request.json'))
+  await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
+  assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
   await writeFile(join(dir,id+'.cancel'),'')
   await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))

package/test/scheduler-relay.test.ts

@@ -44,7 +44,50 @@ test('a wrapper-shaped run id has no maintenance treatment and a stale notice is
  }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-test('owner chat queues behind a scheduled CLI in the same workspace; targeted cancellation',async()=>{
+test('Slack application replies beside a schedule and keeps both streams serial',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-slack-scheduled-')),runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
+ const children=new Map<string,ReturnType<typeof spawn>>()
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(_texts,options)=>{
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:process.platform!=='win32'})
+  children.set(options.runId,child);await once(child,'spawn')
+  if(!options.runId.startsWith('r_schedule_'))await runs.enqueueMessage(options.runId,'Slack reply')
+  return {child,cleanup:async()=>{},stdout:''}
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok'))
+  const due=Date.now()+10000
+  for(const id of ['first','second'])await scheduler.save({id,name:id,text:'Long work',trigger:{at:new Date(due).toISOString()},enabled:true,owner,execution})
+  await scheduler.tick(owner,runs,due);await relay.drainSources()
+  const scheduled=(await runs.list()).filter(run=>run.scheduled)
+  assert.deepEqual(scheduled.map(run=>run.status),['running','queued'])
+  const binding=(await relay.applicationChannel.bindings.register('slack','s'.repeat(48),owner))!
+  const scope='slack:T_FIXTURE:C_FIXTURE'
+  const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'event-1',scope,text:'Top twenty'})
+  await until(async()=>children.has(first.id));await relay.drainOutbox()
+  assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,first.id)).messages[0].text,'Slack reply')
+  assert.equal((await runs.get(scheduled[0].id))?.status,'running')
+  const second=await relay.applicationChannel.submit(binding.bindingId,{requestId:'event-2',scope,text:'Next question'})
+  await relay.drainSources()
+  assert.equal((await runs.get(second.id))?.status,'queued')
+  assert.equal(children.size,2)
+  // Revoking the channel stops only its foreground work; background authority
+  // and the original one-occurrence-per-schedule limit remain intact.
+  await relay.applicationChannel.bindings.register('slack',null,owner)
+  await relay.drainSources()
+  await until(async()=> (await runs.get(first.id))?.status==='cancelled')
+  await relay.drainSources()
+  assert.equal((await runs.get(second.id))?.status,'cancelled')
+  assert.equal((await runs.get(scheduled[0].id))?.status,'running')
+  assert.equal((await runs.get(scheduled[1].id))?.status,'queued')
+ }finally{
+  await relay.stop()
+  await until(async()=>!(await runs.list()).some(run=>run.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})
+
+test('owner chat replies while a scheduled CLI keeps running; targeted cancellation',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-scheduler-relay-')), children:ReturnType<typeof spawn>[]=[]
  const runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
  const replies:string[]=[], workspaces:string[]=[]
@@ -67,19 +110,18 @@ test('owner chat queues behind a scheduled CLI in the same workspace; targeted c
   const [background]=await runs.list()
   assert.equal(background.status,'running')
   const update:Update={update_id:123,message:{message_id:123,date:0,text:'What is 17 × 19?',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}}
-  await relay.bot.handleUpdate(update);await relay.drainInbox(true);await relay.drainOutbox()
-  assert.ok(!replies.includes('323'))
+  await relay.bot.handleUpdate(update);await relay.drainInbox(true)
+  await until(async()=>children.length===2)
+  await relay.drainOutbox()
+  assert.ok(replies.includes('323'))
   assert.equal((await runs.get(background.id))?.status,'running')
   assert.equal(children[0].exitCode,null)
-  assert.deepEqual(workspaces,[dir])
+  assert.deepEqual(workspaces,[dir,dir])
   // Pausing future dispatch doesn't kill active work; cancelling this run does.
   await scheduler.enable('slow',false);await relay.drainSources()
   assert.equal(children[0].exitCode,null)
   await scheduler.cancel(background.id);await relay.drainSources()
   await until(async()=> (await runs.get(background.id))?.status==='cancelled')
-  await until(async()=>children.length===2)
-  await relay.drainOutbox()
-  assert.ok(replies.includes('323'))
   assert.deepEqual(workspaces,[dir,dir])
   assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
  }finally{

package/test/updates.test.mjs

@@ -13,7 +13,7 @@ import { perform, environment, packageManager, backupStateDirectory, execute } f
 import { atomic, snapshot, compose, prepareCommand } from '../src/plugins/manager.mjs';
 import { bindUpdates } from '../src/updates/binding.mjs';
 import { status as runtimeStatus } from '../src/updates/status.mjs';
-import { providerEnvironment, queueAutomatic } from '../src/updates/supervisor.mjs';
+import { providerEnvironment, queueAutomatic, waitForHostHeartbeat } from '../src/updates/supervisor.mjs';
 const exec=promisify(execFile);
 
 test('structured runtime output excludes warnings but failures retain diagnostics',async()=>{
@@ -42,6 +42,14 @@ test('supervisor forwards only provider keys declared by the agent installation'
  for(const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN'])
   assert.throws(()=>providerEnvironment({agents:[{codexProviders:[{envKey}]}]},{}),/Reserved Codex provider environment key/);
 });
+test('host startup gate tolerates initialization beyond the former ten-second window',async()=>{
+ let reads=0;
+ await waitForHostHeartbeat('/control',{pid:42,exitCode:null},()=>undefined,{
+  attempts:120,intervalMs:0,wait:async()=>{},
+  readHeartbeat:async()=>++reads===111?{pid:42,at:Date.now()}:null,
+ });
+ assert.equal(reads,111);
+});
 const contract=kind=>({protocol:1,kind,stateSchema:1,mainProtocol:1});
 function tar(entries) {
  const chunks=[];
@@ -56,7 +64,8 @@ async function fixture(t,kind='main') {
  const deployment=path.join(root,'agent'),home=path.join(deployment,'tools'),old=path.join(root,'old'),source=path.join(root,'candidate');
  for(const d of [home,old,source,path.join(home,'bin'),path.join(home,'updates'),path.join(deployment,'mind'),path.join(deployment,'control')])await fs.mkdir(d,{recursive:true});
  const pkg={name:'@ez-test/example',version:'0.1.0',packageManager:'pnpm@10.30.3',type:'module',files:['bin','src','docker','compose.yaml','compose.whatsapp.yaml','.dockerignore','Dockerfile'],bin:{example:'bin/example.mjs'},ezRelease:contract(kind)};
- const files={'package.json':JSON.stringify(pkg),'compose.yaml':'services: {}\n','compose.whatsapp.yaml':'services: {}\n','.dockerignore':'','Dockerfile':'FROM scratch AS runtime','docker/pnpm-lock.yaml':'lockfileVersion: 9.0\n','src/host-executor.ts':'','bin/example.mjs':'#!/usr/bin/env node\nconsole.log("example")','bin/ezenciel-agents.mjs':'console.log("0.1.1")'};
+ const guidance=text=>`export async function bindToolDiscovery(_home,workspace){const fs=await import('node:fs/promises');await fs.writeFile(workspace+'/AGENTS.md',${JSON.stringify(text+'\n')});}\n`;
+ const files={'package.json':JSON.stringify(pkg),'compose.yaml':'services: {}\n','compose.whatsapp.yaml':'services: {}\n','.dockerignore':'','Dockerfile':'FROM scratch AS runtime','docker/pnpm-lock.yaml':'lockfileVersion: 9.0\n','src/host-executor.ts':'','src/plugins/manager.mjs':guidance('old guidance'),'bin/example.mjs':'#!/usr/bin/env node\nconsole.log("example")','bin/ezenciel-agents.mjs':'console.log("0.1.1")'};
  let record,target='main';
  if(kind==='plugin') {
   target='sample';files['ez-plugin.json']=JSON.stringify({schemaVersion:1,id:'sample',version:pkg.version,commands:{sample:{executable:'bin/example.mjs',args:[]}},skills:[]});
@@ -76,11 +85,19 @@ async function fixture(t,kind='main') {
   await atomic(record.compose,await compose(config,record,{},home));
  }
  await atomic(path.join(home,'registry.json'),{schemaVersion:1,owner:home,plugins:record?{sample:record}:{},commands:record?{sample:'sample'}:{}});
- await fs.cp(old,source,{recursive:true});pkg.version='0.1.1';await atomic(path.join(source,'package.json'),pkg);
+ await fs.cp(old,source,{recursive:true});pkg.version='0.1.1';await atomic(path.join(source,'package.json'),pkg);await fs.writeFile(path.join(source,'src/plugins/manager.mjs'),guidance('candidate guidance'));
  if(kind==='plugin'){const m=await read(path.join(source,'ez-plugin.json'));m.version=pkg.version;await atomic(path.join(source,'ez-plugin.json'),m);}
  const pack=async()=>{const entries=[];async function walk(dir,prefix=''){for(const e of await fs.readdir(dir,{withFileTypes:true})){const rel=prefix+e.name;if(e.isDirectory())await walk(path.join(dir,e.name),rel+'/');else entries.push(['package/'+rel,await fs.readFile(path.join(dir,e.name))]);}}await walk(source);const file=path.join(root,'candidate.tgz');await fs.writeFile(file,tar(entries));return file;};
  return {root,home,old,source,agent,config,record,target,pack};
 }
+async function externalState(f) {
+ const workspace=path.join(f.root,'workspace'),controlDir=path.join(f.root,'control');
+ await fs.rename(f.agent.workspace,workspace);await fs.rename(f.agent.controlDir,controlDir);
+ f.agent.workspace=workspace;f.agent.controlDir=controlDir;f.config.workspace=workspace;
+ await atomic(path.join(f.config.deploymentDir,'host-executor.json'),{cli:'grok',agents:[f.agent]});
+ await atomic(path.join(f.home,'config.json'),f.config);
+ return f;
+}
 test('root preparation leaves private plugin updates readable by the installer', {
  skip:process.platform!=='linux'||process.geteuid?.()!==0,
 },async t=>{
@@ -259,6 +276,16 @@ test('compatibility bridge hands off any matching canonical beta release',async
  await atomic(path.join(f.source,'package.json'),{...candidate,version:'0.1.0-beta.34'});
  await assert.rejects(eligibility(f.home,'main',f.source,false),/newer/);
 });
+test('private RC and QA builds graduate only to their matching beta release',async t=>{
+ const f=await fixture(t),prior=await read(path.join(f.old,'package.json')),candidate=await read(path.join(f.source,'package.json'));
+ for(const suffix of ['rc.7','qa.4']) {
+  await atomic(path.join(f.old,'package.json'),{...prior,version:'0.1.0-beta.46.'+suffix});
+  await atomic(path.join(f.source,'package.json'),{...candidate,version:'0.1.0-beta.46'});
+  assert.equal((await eligibility(f.home,'main',f.source,true)).pkg.version,'0.1.0-beta.46');
+  await atomic(path.join(f.source,'package.json'),{...candidate,version:'0.1.0-beta.45'});
+  await assert.rejects(eligibility(f.home,'main',f.source,false),/newer/);
+ }
+});
 test('reviewed Library beta14 command migration is exact and fail-closed',()=>{
  const manifest=(version,document)=>({schemaVersion:1,id:'library',version,description:'library',commands:{library:{executable:'bin/ez-library.mjs',args:[]},'library-query':{executable:'bin/ez-library.mjs',args:[],channelQuery:true},...(document?{'library-document':{executable:'bin/ez-library.mjs',args:[],channelQuery:true}}:{})},skills:['skills/library/SKILL.md']});
  const deployment=(query,document)=>({schemaVersion:3,services:{library:{buildTarget:'runtime',volumes:{data:'/state'},healthcheck:['node','/app/bin/ez-library.mjs','--version'],memoryMiB:4096,cpus:2}},commands:{'library-query':{service:'library',argv:['node','/app/bin/ez-library.mjs',query]},...(document?{'library-document':{service:'library',argv:['node','/app/bin/ez-library.mjs','document']}}:{})},sharedServices:{}});
@@ -267,12 +294,14 @@ test('reviewed Library beta14 command migration is exact and fail-closed',()=>{
  const unsafe=structuredClone(next);unsafe.deployment.services.library.cpus=4;assert.equal(reviewedPluginDeploymentMigration('library',old,unsafe),undefined);
 });
 test('main transaction stages before stopping, pins rollback image, preserves state and rebinds root',async t=>{
- const f=await fixture(t),job=await queued(f),r=runtime(f);
+ const f=await externalState(await fixture(t)),job=await queued(f),r=runtime(f);
  await fs.writeFile(path.join(f.agent.workspace,'memory.md'),'retain me');
  // Mutable preparation files cannot alter the verified archive executed later.
  await fs.writeFile(path.join(jobPath(f.home,job.id),'package/bin/example.mjs'),'tampered');
  const result=await perform(f.home,job,r);assert.equal(result.status,'completed');
  assert.equal(await fs.readFile(path.join(f.agent.workspace,'memory.md'),'utf8'),'retain me');
+ assert.equal(await fs.readFile(path.join(jobPath(f.home,job.id),'backup/workspace/memory.md'),'utf8'),'retain me');
+ await assert.rejects(fs.access(path.join(f.config.deploymentDir,'mind')));
  const active=(await read(path.join(f.home,'config.json'))).packageRoot;assert(active.endsWith('/runtime'));
  assert.notEqual(await fs.readFile(path.join(active,'bin/example.mjs'),'utf8'),'tampered');
  assert(r.calls.findIndex(c=>c.includes('build'))<r.calls.findIndex(c=>c[0]==='stopHost'));
@@ -281,6 +310,16 @@ test('main transaction stages before stopping, pins rollback image, preserves st
  const status=await command(f.home,['status']);assert(!JSON.stringify(status).includes('private-test-token'));assert(!('rollback'in status.jobs[0]));
  assert.equal((await fs.stat(path.join(jobPath(f.home,job.id),'job.json'))).mode&0o777,0o600);
 });
+test('main activation and rollback bind guidance from the selected package root',async t=>{
+ const success=await fixture(t);await bindUpdates(success.home,path.join(success.config.deploymentDir,'host-executor.json'),success.old);
+ assert.equal(await fs.readFile(path.join(success.agent.workspace,'AGENTS.md'),'utf8'),'old guidance\n');
+ assert.equal((await perform(success.home,await queued(success),runtime(success))).status,'completed');
+ assert.equal(await fs.readFile(path.join(success.agent.workspace,'AGENTS.md'),'utf8'),'candidate guidance\n');
+
+ const failed=await fixture(t);await bindUpdates(failed.home,path.join(failed.config.deploymentDir,'host-executor.json'),failed.old);
+ assert.equal((await perform(failed.home,await queued(failed),runtime(failed,{fail:(_command,args)=>args.includes('up')}))).status,'rolled-back');
+ assert.equal(await fs.readFile(path.join(failed.agent.workspace,'AGENTS.md'),'utf8'),'old guidance\n');
+});
 test('the same archive with different deployment CLI pins gets distinct image bindings',async t=>{
  const tags=[],hashes=[];
  for(const pin of ['0.153.4','0.156.1']) {
@@ -343,6 +382,33 @@ test('plugin updates register additive command routes on an unchanged deployment
  const dispatch=await prepareCommand(f.home,'query',[]);assert.deepEqual(dispatch.argv.slice(-4),['node','sample','/app/bin/example.mjs','query']);
  assert(r.calls.some(call=>call.includes('up')));
 });
+test('isolated plugin replacement refreshes broker version inventory after registry activation',async t=>{
+ const f=await fixture(t,'plugin');
+ await fs.appendFile(path.join(f.config.deploymentDir,'docker.env'),'EZ_EXECUTOR_TRANSPORT=local\n');
+ const job=await queued(f),r=runtime(f),execute=r.execute;
+ let observed;
+ r.execute=async(command,args,options)=>{
+  if(args.includes('restart')&&args.at(-1)==='plugin-broker') observed=(await read(path.join(f.home,'registry.json'))).plugins.sample.manifest.version;
+  return execute(command,args,options);
+ };
+ assert.equal((await perform(f.home,job,r)).status,'completed');
+ assert.equal(observed,'0.1.1');
+ assert.equal(r.calls.filter(call=>call.includes('restart')).length,1);
+ const interrupted=await read(path.join(jobPath(f.home,job.id),'job.json'));interrupted.status='applying';
+ assert.equal((await perform(f.home,interrupted,r)).status,'rolled-back');
+ assert.equal(observed,'0.1.0');
+ assert.equal(r.calls.filter(call=>call.includes('restart')).length,2);
+});
+test('plugin update preserves a created but never running service as stopped',async t=>{
+ const f=await fixture(t,'plugin'),job=await queued(f),r=runtime(f),execute=r.execute;
+ r.execute=async(command,args,options)=>{
+  if(args.includes('ps')) {r.calls.push([command,...args]);return args.includes('--status')?'':'created-container';}
+  return execute(command,args,options);
+ };
+ assert.equal((await perform(f.home,job,r)).status,'completed');
+ assert.equal(job.rollback.running,false);
+ assert.equal(r.calls.some(call=>call.includes('up')),false);
+});
 test('plugin command additions ignore object key order but reject collisions and changed routes',async t=>{
  const f=await fixture(t,'plugin'),deployment=await read(path.join(f.source,'ez-deployment.json'));
  deployment.services.sample={healthcheck:deployment.services.sample.healthcheck,volumes:deployment.services.sample.volumes,buildTarget:deployment.services.sample.buildTarget};
@@ -366,7 +432,7 @@ test('interrupted activation recovers previous code; rollback failure is explici
  const retried=await read(path.join(jobPath(f.home,interrupted.id),'job.json'));assert.equal((await perform(f.home,retried,r)).status,'rolled-back');
 });
 test('bound dispatch follows active package root and retains private scope',async t=>{
- const f=await fixture(t);
+ const f=await externalState(await fixture(t));
  const prior=await fs.readFile(path.join(f.agent.workspace,'TOOLS.md'),'utf8');
  const bound=await bindUpdates(f.home,path.join(f.config.deploymentDir,'host-executor.json'));
  assert.match(bound.policy,/beta-channel/);