@kontextmind/kxm 0.7.128 → 0.7.131

package/plugins/kxm/dist/cli.js

@@ -17362,21 +17362,9 @@ function coreTemplate(projectId, projectName, variant) {
   ]);
   if (variant === "v4-registry") {
     const coordinator = files.get(".kxm/agents/coordinator.yaml");
-    if (coordinator) {
-      files.set(".kxm/agents/coordinator.yaml", {
-        ...coordinator,
-        harness: "claude",
-        model: { provider: "anthropic", model: "fable" }
-      });
-    }
+    if (coordinator) files.set(".kxm/agents/coordinator.yaml", { ...coordinator, role: "planner" });
     const implementer = files.get(".kxm/agents/implementer.yaml");
-    if (implementer) {
-      files.set(".kxm/agents/implementer.yaml", {
-        ...implementer,
-        harness: "grok",
-        model: { provider: "xai", model: "grok-4.6" }
-      });
-    }
+    if (implementer) files.set(".kxm/agents/implementer.yaml", { ...implementer, role: "writer" });
     const workflow = files.get(".kxm/workflows/default.yaml");
     if (workflow) {
       const limits = { ...workflow.limits };
@@ -18708,6 +18696,69 @@ function readJsonObject(file) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} is not a JSON object`);
   return parsed;
 }
+function validateRunEvent(value, file) {
+  const registry = cachedRunEventRegistry ??= new KxmSchemaRegistry();
+  if (!registry.runEventValidator(value)) {
+    throw new KxmConfigError([issue3(
+      "schema",
+      "run_event_invalid",
+      file,
+      registry.ajv.errorsText(registry.runEventValidator.errors, { separator: "; " })
+    )]);
+  }
+}
+function syncEventSchemaErrors(value) {
+  const registry = cachedRunEventRegistry ??= new KxmSchemaRegistry();
+  if (registry.syncEventValidator(value)) return void 0;
+  return registry.ajv.errorsText(registry.syncEventValidator.errors, { separator: "; " });
+}
+function validateDriveReceipt(value, file) {
+  const registry = cachedRunEventRegistry ??= new KxmSchemaRegistry();
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.schema !== "kxm.drive-receipt.v1") {
+    throw new KxmConfigError([issue3(
+      "schema",
+      "drive_receipt_invalid",
+      file,
+      "expected kxm.drive-receipt.v1"
+    )]);
+  }
+  if (!registry.driveReceiptValidator(value)) {
+    throw new KxmConfigError([issue3(
+      "schema",
+      "drive_receipt_invalid",
+      file,
+      registry.ajv.errorsText(registry.driveReceiptValidator.errors, { separator: "; " })
+    )]);
+  }
+}
+function validateCoordinator(value, file) {
+  const registry = cachedRunEventRegistry ??= new KxmSchemaRegistry();
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.schema !== "kxm.coordinator.v1") {
+    throw new KxmConfigError([issue3("schema", "coordinator_invalid", file, "expected kxm.coordinator.v1")]);
+  }
+  if (!registry.coordinatorValidator(value)) {
+    throw new KxmConfigError([issue3(
+      "schema",
+      "coordinator_invalid",
+      file,
+      registry.ajv.errorsText(registry.coordinatorValidator.errors, { separator: "; " })
+    )]);
+  }
+}
+function validateIntakeMessage(value, file) {
+  const registry = cachedRunEventRegistry ??= new KxmSchemaRegistry();
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.schema !== "kxm.intake-message.v1") {
+    throw new KxmConfigError([issue3("schema", "intake_message_invalid", file, "expected kxm.intake-message.v1")]);
+  }
+  if (!registry.intakeMessageValidator(value)) {
+    throw new KxmConfigError([issue3(
+      "schema",
+      "intake_message_invalid",
+      file,
+      registry.ajv.errorsText(registry.intakeMessageValidator.errors, { separator: "; " })
+    )]);
+  }
+}
 function schemaIssue(file, error) {
   const location = error.instancePath || "/";
   const suffix = error.params && "additionalProperty" in error.params ? ` (${String(error.params.additionalProperty)})` : "";
@@ -18847,7 +18898,7 @@ function readTemplateProvenance(registry, root) {
   }
   return value;
 }
-function listNamedResources(registry, root, directory, logicalDirectory, kind, replacedId) {
+function listNamedResources(registry, root, directory, logicalDirectory, kind, replacedId, collected) {
   const resources = /* @__PURE__ */ new Map();
   if (!existsSync6(directory)) return resources;
   const stat = lstatSync(directory);
@@ -18886,7 +18937,10 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind, r
       else throw error;
     }
   }
-  if (issues.length > 0) throw new KxmConfigError(issues);
+  if (issues.length > 0) {
+    if (collected) collected.push(...issues);
+    else throw new KxmConfigError(issues);
+  }
   return resources;
 }
 function valuesOf(object2, field) {
@@ -19146,6 +19200,9 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
     for (const repositoryId of Object.keys(objectValue(step.repositories) ?? {})) {
       if (!repositories.has(repositoryId)) issues.push(issue3("reference", "repository_unknown", file, `${stepId} references unknown repository ${repositoryId}`));
     }
+    if ((kind === "agent" || kind === "moa") && step.model !== void 0) {
+      issues.push(issue3("semantic", "producer_route_unsupported", file, `${stepId} model is not honored; remove model from the step`));
+    }
     selectorCandidates(step.model, models, file, `${stepId}.model`, issues);
     const assignment = objectValue(step.assignments);
     const declaredAgents = assignment ? names(assignment.allowedAgents) : [];
@@ -19328,7 +19385,7 @@ function validateModelReferences(models, issues) {
   };
   for (const id of models.keys()) walk(id, []);
 }
-function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, writerRole) {
+function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, roles = /* @__PURE__ */ new Map()) {
   const issues = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate) => Boolean(candidate));
   const repositoryIds = /* @__PURE__ */ new Set();
@@ -19369,84 +19426,84 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   const defaultHarness = stringValue(project.value.defaultHarness) ?? DEFAULT_HARNESS;
   if (!harnesses.has(defaultHarness)) issues.push(issue3("reference", "harness_unknown", project.logicalPath, `defaultHarness ${defaultHarness} is not registered`));
   for (const agent of agents.values()) {
+    if (agent.value.model !== void 0 || agent.value.harness !== void 0) {
+      issues.push(issue3("semantic", "retired_agent_routing_fields", agent.logicalPath, "routing resolves from role; remove model and harness"));
+    }
     validateToolPolicy(agent, objectValue(agent.value.tools), "tools", issues);
     const executor = stringValue(agent.value.executor);
     if (executor && !executors.has(executor)) issues.push(issue3("reference", "executor_unknown", agent.logicalPath, `executor ${executor} is not registered`));
-    const harness = stringValue(agent.value.harness) ?? defaultHarness;
-    if (!harnesses.has(harness)) issues.push(issue3("reference", "harness_unknown", agent.logicalPath, `harness ${harness} is not registered`));
     const preset = stringValue(objectValue(agent.value.tools)?.preset);
     if (preset && !presets.has(preset)) issues.push(issue3("reference", "tool_preset_unknown", agent.logicalPath, `tool preset ${preset} is not registered`));
     for (const repositoryId of Object.keys(objectValue(agent.value.repositories) ?? {})) {
       if (!repositoryIds.has(repositoryId)) issues.push(issue3("reference", "repository_unknown", agent.logicalPath, `references unknown repository ${repositoryId}`));
     }
-    const candidates = selectorCandidates(agent.value.model, models, agent.logicalPath, "model", issues);
-    const declaredHarness = stringValue(agent.value.harness);
-    if (declaredHarness && harnesses.has(declaredHarness)) {
-      for (const candidate of candidates) {
-        const candidateProvider = stringValue(candidate.value.provider);
-        const candidateModel = stringValue(candidate.value.model);
-        const validation = validateHarnessModelPair(declaredHarness, { provider: candidateProvider, model: candidateModel });
-        if (!validation.valid) {
-          issues.push(issue3("semantic", validation.issue ?? "harness_unhosted_model", agent.logicalPath, validation.message ?? `harness ${declaredHarness} cannot host model ${candidateModel ?? candidate.logicalPath}`));
-        }
-      }
-    }
   }
   validateModelReferences(models, issues);
   const defaultWorkflow = stringValue(project.value.defaultWorkflow) ?? "default";
   if (!workflows.has(defaultWorkflow)) issues.push(issue3("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
+  if (projectRoot && existsSync6(join6(projectRoot, ".kxm", "roster.yaml"))) {
+    issues.push(issue3("semantic", "retired_roster_file", ".kxm/roster.yaml", "create the role and model files and delete roster.yaml"));
+  }
+  if (projectRoot && existsSync6(join6(projectRoot, ".kxm", "roles"))) {
+    issues.push(...developerRolePolicyIssues(projectRoot));
+  }
   if (projectRoot) {
-    const writerRolePath = join6(projectRoot, ".kxm", "roles", "writer.yaml");
-    const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if ((writerRole !== void 0 || existsSync6(writerRolePath)) && implementerAgent) {
+    issues.push(...rosterModelIssues(projectRoot, roles));
+    issues.push(...originHashIssues(projectRoot, models));
+  }
+  return sortIssues3(issues);
+}
+function rosterModelIssues(projectRoot, roles) {
+  const issues = [];
+  for (const role of roles.values()) {
+    for (const entry of valuesOf(role.value, "roster")) {
+      const route = stringValue(objectValue(entry)?.route);
+      if (!route) continue;
+      const logical = `.kxm/models/${route}.yaml`;
+      const file = join6(projectRoot, ".kxm", "models", `${route}.yaml`);
+      let harness;
       try {
-        const rawRole = parseRestrictedYaml2(writerRole ?? readFileSync5(writerRolePath, "utf8"));
-        const roleObj = objectValue(rawRole);
-        const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
-        const enabledRosterModels = rosterEntries.flatMap((entry) => {
-          const direct = stringValue(entry.model);
-          const route = stringValue(entry.route);
-          const named = direct ? [direct] : [];
-          if (route) {
-            const modelFile = join6(projectRoot, ".kxm", "models", `${route}.yaml`);
-            if (existsSync6(modelFile)) {
-              try {
-                const modelDoc = objectValue(parseRestrictedYaml2(readFileSync5(modelFile, "utf8"), modelFile));
-                const model = modelDoc ? stringValue(modelDoc.model) : void 0;
-                const vendor = modelDoc ? stringValue(modelDoc.vendor) : void 0;
-                const harness = modelDoc ? stringValue(modelDoc.harness) : void 0;
-                if (model) named.push(model);
-                if (vendor && model) named.push(`${vendor}/${model}`);
-                if (harness && model) named.push(`${harness}/${model}`);
-              } catch {
-              }
-            }
-          }
-          return named;
-        });
-        const agentModelObj = objectValue(implementerAgent.value.model);
-        const agentModelStr = stringValue(implementerAgent.value.model);
-        const agentProvider = agentModelObj ? stringValue(agentModelObj.provider) : void 0;
-        const agentModel = agentModelObj ? stringValue(agentModelObj.model) : agentModelStr;
-        const canonicalAgentModel = agentProvider && agentModel ? `${agentProvider}/${agentModel}` : agentModel;
-        if (enabledRosterModels.length > 0 && canonicalAgentModel) {
-          const matches = enabledRosterModels.some((rm) => rm === canonicalAgentModel || rm === agentModel || rm.endsWith(`/${agentModel}`));
-          if (!matches) {
-            issues.push(issue3("semantic", "role_roster_conflicts_with_agent", ".kxm/roles/writer.yaml", `role roster in .kxm/roles/writer.yaml does not include agent model ${canonicalAgentModel} from ${implementerAgent.logicalPath}`));
-          }
-        }
-      } catch (error) {
-        if (error instanceof KxmConfigError) {
-          issues.push(...error.issues);
-        }
+        if (existsSync6(file)) harness = stringValue(parseRestrictedYaml2(readFileSync5(file, "utf8"), logical).harness);
+      } catch {
+        harness = void 0;
+      }
+      if (!harness) {
+        issues.push(issue3("semantic", "roster_model_unreadable", role.logicalPath, `roster route ${route} does not resolve to a readable ${logical} carrying harness`));
       }
     }
   }
-  if (projectRoot && existsSync6(join6(projectRoot, ".kxm", "roster.yaml"))) {
-    issues.push(...developerRolePolicyIssues(projectRoot));
+  return issues;
+}
+function originHashIssues(projectRoot, models) {
+  const issues = [];
+  for (const model of models.values()) {
+    const origin = objectValue(model.value.origin);
+    const source = origin ? stringValue(origin.source) : void 0;
+    const digest = origin ? stringValue(origin.sha256) : void 0;
+    if (!source || !digest) continue;
+    const file = resolve3(projectRoot, source);
+    const escaped = relative(projectRoot, file);
+    if (isAbsolute2(source) || escaped.startsWith("..") || isAbsolute2(escaped)) {
+      issues.push(issue3("semantic", "origin_evidence_missing", model.logicalPath, `missing evidence bytes for ${source}`));
+      continue;
+    }
+    let actual;
+    try {
+      actual = createHash7("sha256").update(readFileSync5(file, "utf8"), "utf8").digest("hex");
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT" || code === "EACCES" || code === "EPERM" || code === "EISDIR") {
+        issues.push(issue3("semantic", "origin_evidence_missing", model.logicalPath, `missing evidence bytes for ${source}`));
+        continue;
+      }
+      throw error;
+    }
+    if (actual !== digest) {
+      issues.push(issue3("semantic", "origin_hash_mismatch", model.logicalPath, "origin evidence hash does not match supplied bytes"));
+    }
   }
-  return sortIssues3(issues);
+  return issues;
 }
 function developerCeilings() {
   const script = join6(findKxmRepoRoot(import.meta.url), "scripts", "harness-run.mjs");
@@ -19475,6 +19532,7 @@ function developerCeilings() {
   }
 }
 function developerRolePolicyIssues(projectRoot) {
+  if (resolve3(projectRoot) !== findKxmRepoRoot(import.meta.url)) return [];
   const rolesDir = join6(projectRoot, ".kxm", "roles");
   const modelsDir = join6(projectRoot, ".kxm", "models");
   const roles = {};
@@ -19495,6 +19553,7 @@ function developerRolePolicyIssues(projectRoot) {
           parseIssues.push(...error.issues);
           continue;
         }
+        throw error;
       }
     }
   };
@@ -19509,7 +19568,7 @@ function developerRolePolicyIssues(projectRoot) {
   }
   const ceilings = developerCeilings();
   if (!ceilings.ok) {
-    return [...parseIssues, issue3("semantic", "developer_ceilings_unavailable", ".kxm/roster.yaml", `developer ceilings could not be loaded: ${ceilings.detail}`)];
+    return [...parseIssues, issue3("semantic", "developer_ceilings_unavailable", ".kxm/models", `developer ceilings could not be loaded: ${ceilings.detail}`)];
   }
   const result = validatePolicyDraft({ models, roles, evidence }, {
     ceilings: ceilings.ROUTES,
@@ -19617,7 +19676,8 @@ function loadProjectBundle(projectRoot, options, candidate) {
   }
   if (earlyIssues.length > 0) throw new KxmConfigError(earlyIssues);
   const agents = listNamedResources(registry, root, join6(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join6(root, ".kxm", "models"), ".kxm/models", "model");
+  const modelIssues = [];
+  const models = listNamedResources(registry, root, join6(root, ".kxm", "models"), ".kxm/models", "model", void 0, modelIssues);
   const roles = listNamedResources(registry, root, join6(root, ".kxm", "roles"), ".kxm/roles", "role", writerRole === void 0 ? void 0 : "writer");
   if (writerRole !== void 0) {
     const logicalPath = ".kxm/roles/writer.yaml";
@@ -19744,8 +19804,8 @@ function loadProjectBundle(projectRoot, options, candidate) {
       }
     }
   }
-  if (loadIssues.length > 0) throw new KxmConfigError(loadIssues);
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, writerRole);
+  if (loadIssues.length > 0) throw new KxmConfigError([...loadIssues, ...modelIssues]);
+  const issues = [...modelIssues, ...validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, roles)];
   if (issues.length > 0) throw new KxmConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...roles.values(), ...workflows.values(), ...environments, ...gateRegistry ? [gateRegistry] : []].sort((left, right) => compareCodeUnits4(left.logicalPath, right.logicalPath));
   return {
@@ -19853,7 +19913,7 @@ function planKxmInitialization(start = process.cwd(), options = {}) {
   }
   return { mode: "create", inspectedFrom, projectRoot: candidateRoot, changesRequired: true, issues: [], legacyInputs: [] };
 }
-var import__, KxmConfigError, DEFAULT_SCHEMA_DIR, RESOURCE_SCHEMA, IDENTIFIER2, WINDOWS_RESERVED, BUILTIN_EXECUTORS, BUILTIN_TOOL_PRESETS, SECRET_VALUE_PATTERNS, KxmSchemaRegistry, GATE_STEP_OUTCOMES, LEGACY_CONFIG_FILES;
+var import__, KxmConfigError, DEFAULT_SCHEMA_DIR, RESOURCE_SCHEMA, IDENTIFIER2, WINDOWS_RESERVED, BUILTIN_EXECUTORS, BUILTIN_TOOL_PRESETS, SECRET_VALUE_PATTERNS, KxmSchemaRegistry, cachedRunEventRegistry, GATE_STEP_OUTCOMES, LEGACY_CONFIG_FILES;
 var init_project_config = __esm({
   "plugins/kxm/src/project-config.ts"() {
     "use strict";
@@ -20418,12 +20478,169 @@ var init_runtime_paths = __esm({
 
 // plugins/kxm/src/sync-transform.ts
 import { createHash as createHash10 } from "node:crypto";
-var KXM_DEFAULT_SYNC_POLICY, KXM_DEFAULT_SYNC_POLICY_REVISION, SCALAR_FIELDS, CARRIED_FIELDS;
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function pickScalars(source, keys, redactor) {
+  if (!isRecord(source)) return void 0;
+  const result = {};
+  for (const key of keys) {
+    const value = source[key];
+    if (typeof value === "number" || typeof value === "boolean") {
+      result[key] = value;
+    } else if (typeof value === "string") {
+      if (redactor) {
+        const scrubbed = redactor.scrub(value);
+        if (scrubbed.text.length > 0) result[key] = scrubbed.text.slice(0, 200);
+      } else {
+        result[key] = value;
+      }
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function buildPayload(source, builder) {
+  for (const key of SCALAR_FIELDS) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") builder.set(key, value);
+  }
+  builder.set("displayTitle", builder.text(source.displayTitle, 200));
+  builder.set("summary", builder.text(source.summary, 1e3));
+  if (source.reason !== void 0) {
+    builder.set("reason", builder.text(source.reason, 1e3) ?? REDACTED);
+  }
+  builder.set("executor", builder.record(source.executor, ["id", "kind", "harness"], {
+    executorVersion: 128,
+    harnessVersion: 128,
+    helperGeneration: 256
+  }));
+  const model = builder.record(source.model, ["profile", "provider"], { model: 200, thinking: 64 });
+  if (model && isRecord(source.model) && Array.isArray(source.model.tags)) {
+    model.tags = source.model.tags.filter((tag) => typeof tag === "string").slice(0, 32);
+  }
+  builder.set("model", model);
+  builder.set("timing", builder.record(source.timing, ["startedAt", "finishedAt", "durationMs", "queueMs", "agentMs"]));
+  builder.set("usage", builder.record(source.usage, [
+    "inputTokens",
+    "outputTokens",
+    "cacheReadTokens",
+    "cacheWriteTokens",
+    "cost",
+    "currency",
+    "costKind"
+  ]));
+  const refs = (value, keys) => Array.isArray(value) ? value.slice(0, MAX_REFS).map((entry) => pickScalars(entry, keys)).filter((entry) => entry !== void 0) : void 0;
+  builder.set("evidenceRefs", refs(source.evidenceRefs, REF_KEYS));
+  builder.set("suppliedRefs", refs(source.suppliedRefs, REF_KEYS));
+  builder.set("artifacts", refs(source.artifacts, ARTIFACT_KEYS));
+  if (isRecord(source.receipt)) {
+    const receipt = builder.record(source.receipt, ["provider", "kind", "hash", "observedAt"], { id: 512 });
+    if (receipt) builder.set("receipts", [receipt]);
+    if (source.receipt.url !== void 0) builder.omitted.add("receipt.url");
+  }
+  builder.set("error", builder.record(source.error, ["class", "retryable"], { component: 128 }));
+  if (isRecord(source.effect)) {
+    const effect = pickScalars(source.effect, ["id", "idempotencyKeyHash"], builder.redactor) ?? {};
+    const policy = pickScalars(source.effect.policy, ["class", "sharedMutable", "idempotencyKey", "receiptQuery"], builder.redactor);
+    if (policy) effect.policy = policy;
+    builder.set("effect", effect);
+  }
+  builder.set("lease", pickScalars(source.lease, LEASE_KEYS, builder.redactor));
+  builder.set("actor", builder.record(source.actor, ["kind"], { id: 200 }));
+  builder.set("resolvedBy", builder.record(source.resolvedBy, ["kind"], { id: 200 }));
+  if (isRecord(source.counts)) {
+    const counts = Object.fromEntries(Object.entries(source.counts).filter((entry) => Number.isInteger(entry[1]) && entry[1] >= 0).slice(0, 32));
+    builder.set("counts", counts);
+  }
+}
+function envelope(event, policyRevision, payload, fieldsOmitted, valuesReplaced) {
+  return {
+    schema: KXM_SYNC_EVENT_SCHEMA,
+    sourceEventId: event.eventId,
+    eventType: event.eventType,
+    projectId: event.projectId,
+    runId: event.runId,
+    homeRuntimeId: event.homeRuntimeId,
+    sequence: event.sequence,
+    occurredAt: event.occurredAt,
+    configRevision: event.configRevision,
+    memoryRevision: event.memoryRevision,
+    executorPolicyRevision: event.executorPolicyRevision,
+    toolPolicyRevision: event.toolPolicyRevision,
+    syncPolicyRevision: policyRevision,
+    redaction: {
+      version: KXM_SYNC_REDACTOR_VERSION,
+      fieldsOmitted: [...new Set(fieldsOmitted)].sort().slice(0, 128),
+      valuesReplaced: Math.min(valuesReplaced, 1e5)
+    },
+    payload
+  };
+}
+function deriveKxmSyncEvent(event, options = {}) {
+  const redactor = options.redactor ?? new KxmSyncRedactor();
+  const policyRevision = options.policyRevision ?? KXM_DEFAULT_SYNC_POLICY_REVISION;
+  const source = isRecord(event.payload) ? event.payload : {};
+  const builder = new SyncPayloadBuilder(redactor);
+  buildPayload(source, builder);
+  const omitted = new Set(builder.omitted);
+  for (const key of Object.keys(source)) if (!CARRIED_FIELDS.has(key)) omitted.add(key);
+  if (event.protectedPayload !== void 0) omitted.add("protectedPayload");
+  const payload = Object.keys(builder.payload).length > 0 ? builder.payload : { counts: {} };
+  const full = envelope(event, policyRevision, payload, omitted, builder.replaced);
+  if (syncEventSchemaErrors(full) === void 0) return full;
+  const degradedPayload = { degraded: true };
+  for (const key of CONTROL_FIELDS) {
+    const value = builder.payload[key];
+    const restoreNested = (built, orig) => {
+      if (!isRecord(orig)) return built !== void 0 ? built : "[redacted]";
+      const result = {};
+      const builtRecord = isRecord(built) ? built : {};
+      for (const [k2, v2] of Object.entries(orig)) {
+        const builtValue = builtRecord[k2];
+        if (builtValue === void 0 || typeof builtValue === "string" && builtValue.trim().length === 0) {
+          result[k2] = isRecord(v2) ? restoreNested(void 0, v2) : "[redacted]";
+        } else {
+          result[k2] = builtValue;
+        }
+      }
+      return result;
+    };
+    if (value === void 0) {
+      const sourceValue = source[key];
+      if (sourceValue !== void 0) {
+        degradedPayload[key] = restoreNested(void 0, sourceValue);
+      }
+    } else if (typeof value === "string" && value.trim().length === 0) {
+      degradedPayload[key] = "[redacted]";
+    } else if (isRecord(value)) {
+      degradedPayload[key] = restoreNested(value, source[key]);
+    } else {
+      degradedPayload[key] = value;
+    }
+  }
+  const degradedOmitted = new Set(omitted);
+  for (const key of Object.keys(builder.payload)) if (!(key in degradedPayload)) degradedOmitted.add(key);
+  const degraded = envelope(event, policyRevision, degradedPayload, degradedOmitted, builder.replaced);
+  const errors = syncEventSchemaErrors(degraded);
+  if (errors === void 0) return degraded;
+  throw new KxmConfigError([{
+    phase: "schema",
+    code: "sync_event_invalid",
+    file: `${event.runId}#${event.sequence}`,
+    message: `event cannot be derived into kxm.sync-event.v1: ${errors}`
+  }]);
+}
+function kxmSyncEventBytes(event) {
+  return kxmCanonicalJson(event);
+}
+var KXM_SYNC_EVENT_SCHEMA, KXM_SYNC_REDACTOR_VERSION, KXM_DEFAULT_SYNC_POLICY, KXM_DEFAULT_SYNC_POLICY_REVISION, MIN_REGISTERED_SECRET_CHARS, REDACTED, PATH_REDACTED, CREDENTIAL_SHAPES, URL_USERINFO, ABSOLUTE_PATHS, CONTROL_CHARACTERS, KxmSyncRedactor, SyncPayloadBuilder, SCALAR_FIELDS, REF_KEYS, ARTIFACT_KEYS, LEASE_KEYS, MAX_REFS, CARRIED_FIELDS, CONTROL_FIELDS;
 var init_sync_transform = __esm({
   "plugins/kxm/src/sync-transform.ts"() {
     "use strict";
     init_project_config();
     init_redact();
+    KXM_SYNC_EVENT_SCHEMA = "kxm.sync-event.v1";
+    KXM_SYNC_REDACTOR_VERSION = "redactor-v1";
     KXM_DEFAULT_SYNC_POLICY = Object.freeze({
       prompts: "title-only",
       results: "bounded-summary",
@@ -20435,6 +20652,98 @@ var init_sync_transform = __esm({
       environmentValues: false
     });
     KXM_DEFAULT_SYNC_POLICY_REVISION = `sha256:${createHash10("sha256").update(kxmCanonicalJson(KXM_DEFAULT_SYNC_POLICY), "utf8").digest("hex")}`;
+    MIN_REGISTERED_SECRET_CHARS = 4;
+    REDACTED = "[redacted]";
+    PATH_REDACTED = "[path]";
+    CREDENTIAL_SHAPES = [
+      /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+      /\bssh-(?:rsa|ed25519|dss|ecdsa-[a-z0-9-]+) AAAA[0-9A-Za-z+/=]+/g,
+      /\bAKIA[0-9A-Z]{16}\b/g,
+      /\bgh[opsu]_[A-Za-z0-9]{20,}\b/g,
+      /\b(?:api[_-]?key|token|secret|password|passwd)\s*[:=]\s*\S+/gi
+    ];
+    URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi;
+    ABSOLUTE_PATHS = [
+      /\\\\[^\s\\"'`]+\\[^\s"'`]*/g,
+      // UNC
+      /\b[A-Za-z]:[\\/][^\s"'`]*/g,
+      // Windows drive
+      /(?<![\w.~:/-])~[\\/][^\s"'`]*/g,
+      // home
+      /(?<![\w.~:/-])\/(?:[\w.@%+-]+\/)*[\w.@%+-]+\/?/g
+      // POSIX
+    ];
+    CONTROL_CHARACTERS = /[\u0000-\u001F\u007F]/g;
+    KxmSyncRedactor = class {
+      values = /* @__PURE__ */ new Set();
+      register(value) {
+        const trimmed = value.trim();
+        if (trimmed.length >= MIN_REGISTERED_SECRET_CHARS) this.values.add(trimmed);
+      }
+      get size() {
+        return this.values.size;
+      }
+      /** Scrub one free-text value; `replaced` counts every substitution. */
+      scrub(input) {
+        let replaced = 0;
+        let text = input;
+        for (const secret of [...this.values].sort((left, right) => right.length - left.length)) {
+          const parts = text.split(secret);
+          if (parts.length > 1) {
+            replaced += parts.length - 1;
+            text = parts.join(REDACTED);
+          }
+        }
+        const substitute = (pattern, replacement) => {
+          text = text.replace(pattern, (...args) => {
+            replaced += 1;
+            return typeof replacement === "string" ? replacement : replacement(...args);
+          });
+        };
+        for (const pattern of CREDENTIAL_SHAPES) substitute(pattern, REDACTED);
+        substitute(URL_USERINFO, (_match, scheme) => `${scheme}${REDACTED}@`);
+        const shaped = redactSecrets(text);
+        if (shaped !== text) {
+          replaced += shaped.split(REDACTED).length - text.split(REDACTED).length;
+          text = shaped;
+        }
+        for (const pattern of ABSOLUTE_PATHS) substitute(pattern, PATH_REDACTED);
+        text = text.replace(CONTROL_CHARACTERS, " ").replace(/\s+/g, " ").trim();
+        return { text, replaced };
+      }
+    };
+    SyncPayloadBuilder = class {
+      payload = {};
+      omitted = /* @__PURE__ */ new Set();
+      replaced = 0;
+      redactor;
+      constructor(redactor) {
+        this.redactor = redactor;
+      }
+      /** Bounded, scrubbed free text; empty after scrubbing means absent. */
+      text(value, max) {
+        if (typeof value !== "string") return void 0;
+        const { text, replaced } = this.redactor.scrub(value);
+        this.replaced += replaced;
+        if (text.length === 0) return void 0;
+        return text.length > max ? `${text.slice(0, max - 1)}\u2026` : text;
+      }
+      /** A nested record rebuilt key by key, with the named keys scrubbed as text. */
+      record(source, keys, textKeys = {}) {
+        const scalars = pickScalars(source, keys.filter((key) => !(key in textKeys)));
+        const result = { ...scalars ?? {} };
+        if (isRecord(source)) {
+          for (const [key, max] of Object.entries(textKeys)) {
+            const value = this.text(source[key], max);
+            if (value !== void 0) result[key] = value;
+          }
+        }
+        return Object.keys(result).length > 0 ? result : void 0;
+      }
+      set(key, value) {
+        if (value !== void 0) this.payload[key] = value;
+      }
+    };
     SCALAR_FIELDS = [
       "workflowId",
       "promptHash",
@@ -20452,6 +20761,10 @@ var init_sync_transform = __esm({
       "scopeEpoch",
       "resolutionAction"
     ];
+    REF_KEYS = ["id", "kind", "hash", "status", "producerId"];
+    ARTIFACT_KEYS = ["id", "kind", "hash", "size", "classification", "availability"];
+    LEASE_KEYS = ["id", "fencingToken", "acquiredAt", "expiresAt", "operation"];
+    MAX_REFS = 64;
     CARRIED_FIELDS = /* @__PURE__ */ new Set([
       ...SCALAR_FIELDS,
       "displayTitle",
@@ -20472,6 +20785,7 @@ var init_sync_transform = __esm({
       "suppliedRefs",
       "counts"
     ]);
+    CONTROL_FIELDS = ["effect", "lease", "actor", "resolvedBy", "resolutionAction", "reason", "suppliedRefs", "outcome"];
   }
 });
 
@@ -20551,22 +20865,25 @@ function ensureWalJournalMode(database, file, description, timeoutMs = 5e3) {
     Atomics.wait(sleeper, 0, 0, 10);
   }
 }
+function assertDatabaseFile(file, description) {
+  checkedParent(file, description);
+  const stat = lstatSync3(file, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
+    }
+  }
+  for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
+    const info = lstatSync3(sidecar, { throwIfNoEntry: false });
+    if (info?.isSymbolicLink()) {
+      throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
+    }
+  }
+}
 function openDatabase(file, description, spec) {
   const isMemory = file === ":memory:";
   if (!isMemory) {
-    checkedParent(file, description);
-    const stat = lstatSync3(file, { throwIfNoEntry: false });
-    if (stat) {
-      if (stat.isSymbolicLink() || !stat.isFile()) {
-        throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
-      }
-    }
-    for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
-      const info = lstatSync3(sidecar, { throwIfNoEntry: false });
-      if (info?.isSymbolicLink()) {
-        throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
-      }
-    }
+    assertDatabaseFile(file, description);
   }
   const database = new DatabaseSync(file);
   let transaction = false;
@@ -20595,7 +20912,7 @@ function openDatabase(file, description, spec) {
       throw databaseError(
         "runtime_schema_outdated",
         file,
-        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for registry/event stores); \`kxm init\` is project-only and rebuilds no database \u2014 upgrading old state in place is deliberately unsupported`
+        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for event stores). The Runtime registry copy from schema 1 to 2 is the one exception. \`kxm init\` is project-only and rebuilds no database. Upgrading any other old state in place is deliberately unsupported`
       );
     }
     if (spec.tables) {
@@ -20615,6 +20932,84 @@ function openDatabase(file, description, spec) {
     throw error;
   }
 }
+function monotonicNowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+function finiteNow(clock, label) {
+  const now = clock();
+  if (typeof now !== "number" || !Number.isFinite(now)) {
+    throw databaseError(
+      "runtime_transaction_clock_invalid",
+      "transaction",
+      `${label} must return a finite monotonic number; got ${String(now)}`
+    );
+  }
+  return now;
+}
+function isTransactionContention(error) {
+  const carrier = error;
+  for (const value of [carrier?.errcode, carrier?.errCode, carrier?.errno]) {
+    if (typeof value === "number" && Number.isInteger(value)) return CONTENTION_PRIMARY_CODES.includes(value & 255);
+  }
+  for (const value of [carrier?.code, carrier?.name]) {
+    if (typeof value === "string" && SQLITE_RESULT_NAMES.test(value)) {
+      return CONTENTION_SYMBOLIC_NAMES.test(value);
+    }
+  }
+  return CONTENTION_MESSAGES.test(error instanceof Error ? error.message : String(error));
+}
+function withDatabaseTransaction(database, work, mode = "IMMEDIATE", clock = monotonicNowMs) {
+  if (activeTransactions.has(database)) {
+    throw databaseError("runtime_transaction_nested", "transaction", "nested transactions are not allowed");
+  }
+  if (mode !== "DEFERRED") {
+    const deadlines = transactionThrottles.get(database);
+    const until = deadlines?.get(clock);
+    if (until !== void 0) {
+      const remaining = until - finiteNow(clock, "the transaction clock");
+      if (remaining > 0) {
+        throw databaseError(
+          "runtime_transaction_busy",
+          "transaction",
+          `a previous BEGIN was blocked on this database; retry deferred ${String(remaining)}ms`
+        );
+      }
+      deadlines?.delete(clock);
+    }
+  }
+  try {
+    database.exec(`BEGIN ${mode}`);
+  } catch (error) {
+    if (!isTransactionContention(error)) throw error;
+    const now = finiteNow(clock, "the transaction clock");
+    let deadlines = transactionThrottles.get(database);
+    if (deadlines === void 0) {
+      deadlines = /* @__PURE__ */ new WeakMap();
+      transactionThrottles.set(database, deadlines);
+    }
+    deadlines.set(clock, now + TRANSACTION_BUSY_BACKOFF_MS);
+    throw databaseError(
+      "runtime_transaction_busy",
+      "transaction",
+      `BEGIN ${mode} blocked by another transaction: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  activeTransactions.add(database);
+  if (mode !== "DEFERRED") transactionThrottles.get(database)?.delete(clock);
+  try {
+    const result = work();
+    database.exec("COMMIT");
+    return result;
+  } catch (error) {
+    try {
+      database.exec("ROLLBACK");
+    } catch {
+    }
+    throw error;
+  } finally {
+    activeTransactions.delete(database);
+  }
+}
 function checkpointWal(database, mode = "TRUNCATE") {
   const row = database.prepare(`PRAGMA wal_checkpoint(${mode})`).get();
   return {
@@ -21083,16 +21478,23 @@ function applyRestorePlan(plan) {
     restoredStores
   };
 }
-var KXM_BACKUP_CEILINGS;
+var activeTransactions, TRANSACTION_BUSY_BACKOFF_MS, transactionThrottles, CONTENTION_PRIMARY_CODES, CONTENTION_SYMBOLIC_NAMES, SQLITE_RESULT_NAMES, CONTENTION_MESSAGES, KXM_BACKUP_CEILINGS;
 var init_database = __esm({
   "plugins/kxm/src/database.ts"() {
     "use strict";
     init_sqlite();
     init_project_config();
     init_runtime_paths();
+    activeTransactions = /* @__PURE__ */ new WeakSet();
+    TRANSACTION_BUSY_BACKOFF_MS = 1e3;
+    transactionThrottles = /* @__PURE__ */ new WeakMap();
+    CONTENTION_PRIMARY_CODES = [5, 6, 15];
+    CONTENTION_SYMBOLIC_NAMES = /^SQLITE_(?:BUSY|LOCKED|PROTOCOL)(?:_[A-Z0-9]+)?$/;
+    SQLITE_RESULT_NAMES = /^SQLITE_[A-Z][A-Z0-9_]*$/;
+    CONTENTION_MESSAGES = /^(?:database is locked|database table is locked|locking protocol|SQLITE_BUSY|SQLITE_LOCKED|SQLITE_PROTOCOL)(?:$|[\s.:])/i;
     KXM_BACKUP_CEILINGS = {
       "hub-store": 5,
-      registry: 1,
+      registry: 2,
       "binding-store": 1,
       events: 7
     };
@@ -21100,8 +21502,10 @@ var init_database = __esm({
 });
 
 // plugins/kxm/src/runtime-store.ts
-import { existsSync as existsSync10, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname7, resolve as resolve8 } from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { createHash as createHash12, randomUUID as randomUUID4 } from "node:crypto";
+import { existsSync as existsSync10, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync4, statSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, isAbsolute as isAbsolute5, resolve as resolve8 } from "node:path";
 function runtimeIssue(phase, code, file, message) {
   return { phase, code, file, message };
 }
@@ -21119,6 +21523,106 @@ function projectRuntimeOwnsRun(projectRoot, runId, env) {
     database.close();
   }
 }
+function registrationFromRow(row) {
+  return {
+    projectId: row.project_id,
+    projectRoot: row.project_root,
+    projectKey: row.project_key,
+    homeRuntimeId: row.home_runtime_id,
+    ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
+    ...row.lane_of !== null ? { laneOf: row.lane_of } : {},
+    registeredAt: row.registered_at
+  };
+}
+function controlRootDirectoryExists(projectRoot) {
+  const stat = statSync(projectRoot, { throwIfNoEntry: false });
+  return Boolean(stat?.isDirectory());
+}
+function gitEnv() {
+  return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
+}
+function gitCommonDirectory(projectRoot) {
+  const result = spawnSync4("git", ["-C", projectRoot, "rev-parse", "--git-common-dir"], {
+    encoding: "utf8",
+    env: gitEnv(),
+    timeout: 3e4,
+    windowsHide: true
+  });
+  if (result.status !== 0) return void 0;
+  const text = (result.stdout ?? "").trim();
+  if (!text) return void 0;
+  const absolute = isAbsolute5(text) ? text : resolve8(projectRoot, text);
+  let canonical2;
+  try {
+    canonical2 = realpathSync4.native(absolute);
+  } catch {
+    canonical2 = resolve8(absolute);
+  }
+  return process.platform === "win32" ? canonical2.toLocaleLowerCase("en-US") : canonical2;
+}
+function isPrimaryWorktree(projectRoot, commonDir) {
+  if (commonDir === void 0) return false;
+  const dotGit = resolve8(projectRoot, ".git");
+  let canonical2;
+  try {
+    canonical2 = realpathSync4.native(dotGit);
+  } catch {
+    canonical2 = resolve8(dotGit);
+  }
+  if (process.platform === "win32") canonical2 = canonical2.toLocaleLowerCase("en-US");
+  return canonical2 === commonDir;
+}
+function migrateRegistryLanes(file) {
+  const stat = lstatSync4(file, { throwIfNoEntry: false });
+  if (!stat) return;
+  assertDatabaseFile(file, "runtime registry");
+  const database = new DatabaseSync(file);
+  let transaction = false;
+  try {
+    database.exec("PRAGMA busy_timeout = 5000");
+    const current = database.prepare("PRAGMA user_version").get();
+    if ((current?.user_version ?? 0) !== 1) return;
+    database.exec("BEGIN IMMEDIATE");
+    transaction = true;
+    const locked = database.prepare("PRAGMA user_version").get();
+    if ((locked?.user_version ?? 0) !== 1) {
+      database.exec("ROLLBACK");
+      transaction = false;
+      return;
+    }
+    if (!tableColumns(database, "projects").includes("lane_of")) {
+      database.exec(`
+        CREATE TABLE projects_v2 (
+          project_key TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          project_root TEXT NOT NULL,
+          home_runtime_id TEXT NOT NULL,
+          config_revision TEXT,
+          registered_at TEXT NOT NULL,
+          lane_of TEXT
+        ) STRICT;
+        INSERT INTO projects_v2 (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+        SELECT project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, NULL FROM projects;
+        DROP TABLE projects;
+        ALTER TABLE projects_v2 RENAME TO projects;
+        CREATE INDEX projects_by_project_id ON projects (project_id);
+      `);
+    }
+    database.exec("PRAGMA user_version = 2");
+    database.exec("COMMIT");
+    transaction = false;
+  } catch (error) {
+    if (transaction) {
+      try {
+        database.exec("ROLLBACK");
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    database.close();
+  }
+}
 function readKxmSupervisorRecord(database) {
   const row = database.prepare("SELECT runtime_id, pid, port, token_hash, started_at, heartbeat_at, state FROM supervisor WHERE singleton_id = 1").get();
   return row ? {
@@ -21131,7 +21635,326 @@ function readKxmSupervisorRecord(database) {
     state: row.state
   } : void 0;
 }
-var KXM_REGISTRY_SCHEMA_VERSION, REGISTRY_TABLES, REGISTRY_SCHEMA, KxmRuntimeRegistry, DRIVE_RECEIPT_MAX_BYTES, EVENT_STORE_TABLES, KXM_EVENT_STORE_TABLE_NAMES;
+function coordinatorFromRow(row) {
+  const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.coordinator.v1") {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, `unexpected coordinator schema ${row.schema}`);
+  }
+  validateCoordinator(parsed, row.coordinator_id);
+  if (parsed.coordinatorId !== row.coordinator_id || parsed.projectId !== row.project_id || parsed.role !== row.role || parsed.channel !== row.channel || parsed.ceilingHash !== row.ceiling_hash || parsed.configRevision !== row.config_revision || parsed.boundAt !== row.bound_at) {
+    throw runtimeError("coordinator_record_divergent", row.coordinator_id, "coordinator columns do not match the persisted record");
+  }
+  return {
+    coordinatorId: row.coordinator_id,
+    projectId: row.project_id,
+    role: row.role,
+    channel: row.channel,
+    ceilingHash: row.ceiling_hash,
+    configRevision: row.config_revision,
+    boundAt: row.bound_at,
+    record: row.record
+  };
+}
+function intakeFromRow(row) {
+  const parsed = JSON.parse(row.record);
+  if (row.schema !== "kxm.intake-message.v1") {
+    throw runtimeError("intake_record_divergent", row.message_id, `unexpected intake schema ${row.schema}`);
+  }
+  validateIntakeMessage(parsed, row.message_id);
+  if (parsed.messageId !== row.message_id || parsed.projectId !== row.project_id || parsed.coordinatorId !== row.coordinator_id || parsed.idempotencyKey !== row.idempotency_key || parsed.contentHash !== row.content_hash || parsed.receivedAt !== row.received_at || parsed.dispatch?.state !== row.dispatch_state) {
+    throw runtimeError("intake_record_divergent", row.message_id, "intake columns do not match the persisted record");
+  }
+  return {
+    messageId: row.message_id,
+    projectId: row.project_id,
+    coordinatorId: row.coordinator_id,
+    idempotencyKey: row.idempotency_key,
+    contentHash: row.content_hash,
+    receivedAt: row.received_at,
+    dispatchState: row.dispatch_state,
+    record: row.record
+  };
+}
+function controlFromRow(row) {
+  const paused = row.paused === 1;
+  const expected = kxmCanonicalJson({
+    schema: "kxm.project-control.v1",
+    projectId: row.project_id,
+    paused,
+    ...row.reason !== null ? { reason: row.reason } : {},
+    updatedAt: row.updated_at,
+    actor: row.actor
+  });
+  if (row.record !== expected) {
+    throw runtimeError("project_control_divergent", row.project_id, "project control record does not match its columns");
+  }
+  return {
+    projectId: row.project_id,
+    paused,
+    ...row.reason !== null ? { reason: row.reason } : {},
+    updatedAt: row.updated_at,
+    actor: row.actor,
+    record: row.record
+  };
+}
+function parseDriveReceipt(raw) {
+  const parsed = JSON.parse(raw);
+  validateDriveReceipt(parsed, "drive-receipt");
+  return parsed;
+}
+function outboxFromRow(row) {
+  return {
+    seq: row.seq,
+    runId: row.run_id,
+    sequence: row.sequence,
+    syncEvent: row.sync_event,
+    attemptCount: row.attempt_count,
+    ...row.attempted_at !== null ? { attemptedAt: row.attempted_at } : {},
+    ...row.acked_at !== null ? { ackedAt: row.acked_at } : {},
+    ...row.refused_code !== null ? { refusedCode: row.refused_code } : {},
+    ...row.refused_at !== null ? { refusedAt: row.refused_at } : {}
+  };
+}
+function runFromRow(row) {
+  if (typeof row.memory_revision !== "string" || row.memory_revision.length === 0) {
+    throw runtimeError("runtime_schema_shape_invalid", row.run_id, "memory_revision is required");
+  }
+  return {
+    runId: row.run_id,
+    projectId: row.project_id,
+    homeRuntimeId: row.home_runtime_id,
+    workflowId: row.workflow_id,
+    promptSha256: row.prompt_sha256,
+    status: row.status,
+    configRevision: row.config_revision,
+    memoryRevision: row.memory_revision,
+    executorPolicyRevision: row.executor_policy_revision,
+    toolPolicyRevision: row.tool_policy_revision,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function gateRowContentHash(table, row) {
+  const copy = { ...row };
+  delete copy.contentHash;
+  void table;
+  return `sha256:${createHash12("sha256").update(kxmCanonicalJson(copy), "utf8").digest("hex")}`;
+}
+function assertClosedGateObservation(kind, row, id = "observation") {
+  if (row.completeness === "incomplete") return;
+  if (row.completeness === "no-start") {
+    const legitimateStartFailure = (row.errorClass === "validation" || row.errorClass === "spawn-error") && row.stopCause === "none";
+    const requestedStop = row.stopCause === "cancel" && row.errorClass === null;
+    if (row.spawned !== 0 || row.pid !== null || row.exitCode !== null || row.signal !== null || row.exitObserved !== 0 || row.closeObserved !== 0 || row.signalsAttempted !== "none" || row.stdoutSha256 !== null || row.stdoutBytes !== null || row.stdoutComplete !== null || row.stderrSha256 !== null || row.stderrBytes !== null || row.stderrComplete !== null || row.checkedCount !== null || row.failedCount !== null || !legitimateStartFailure && !requestedStop) {
+      throw gateRowInvalid(id, "no-start observation forbids PID/exit/close/stream/check facts and requires a legitimate no-start cause");
+    }
+    return;
+  }
+  if (kind === "command") {
+    if (row.spawned !== 1 || typeof row.pid !== "number" || typeof row.exitCode !== "number" || row.signal !== null || row.exitObserved !== 1 || row.closeObserved !== 1 || row.stopCause !== "none" || row.signalsAttempted !== "none" || row.stdoutComplete !== 1 || row.stderrComplete !== 1 || typeof row.stdoutSha256 !== "string" || typeof row.stderrSha256 !== "string" || typeof row.stdoutBytes !== "number" || typeof row.stderrBytes !== "number" || row.checkedCount !== null || row.failedCount !== null) {
+      throw gateRowInvalid(id, "complete command observation requires spawn, numeric exit, no signal, exit/close, complete streams, and stopCause none");
+    }
+    return;
+  }
+  if (row.spawned !== 0 || row.pid !== null || row.exitCode !== null || row.signal !== null || row.exitObserved !== 0 || row.closeObserved !== 0 || row.stopCause !== "none" || row.signalsAttempted !== "none" || row.stdoutSha256 !== null || row.stdoutBytes !== null || row.stdoutComplete !== null || row.stderrSha256 !== null || row.stderrBytes !== null || row.stderrComplete !== null || typeof row.checkedCount !== "number" || typeof row.failedCount !== "number" || row.checkedCount < 0 || row.failedCount < 0 || row.failedCount > row.checkedCount) {
+    throw gateRowInvalid(id, "complete artifacts observation requires consistent counts and no command facts");
+  }
+}
+function gateRowInvalid(file, message) {
+  return runtimeError("gate_row_invalid", file, message);
+}
+function assertExactRowKeys(row, keys, id) {
+  const actual = Object.keys(row);
+  if (actual.length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(row, key))) {
+    throw gateRowInvalid(id, "gate row does not have the exact key set");
+  }
+  for (const key of actual) {
+    if (FORBIDDEN_TEXT_KEYS.has(key)) throw gateRowInvalid(id, "gate row must not carry raw stdout/stderr/error text");
+  }
+}
+function assertId(value, prefix, id, label) {
+  if (typeof value !== "string" || !value.startsWith(prefix) || !OPAQUE.test(value)) {
+    throw gateRowInvalid(id, `${label} is not a valid ${prefix} opaque id`);
+  }
+}
+function assertSha(value, id, label) {
+  if (typeof value !== "string" || !SHA2562.test(value)) throw gateRowInvalid(id, `${label} is not a sha256 hash`);
+}
+function assertFlag(value, id, label) {
+  if (value !== 0 && value !== 1) throw gateRowInvalid(id, `${label} must be 0 or 1`);
+}
+function assertNullInt(value, id, label) {
+  if (value !== null && (typeof value !== "number" || !Number.isInteger(value))) {
+    throw gateRowInvalid(id, `${label} must be an integer or null`);
+  }
+}
+function assertGateAttemptRow(row) {
+  assertExactRowKeys(row, GATE_ATTEMPT_KEYS, row.attemptId);
+  assertId(row.attemptId, "att_", row.attemptId, "attemptId");
+  assertId(row.effectId, "eff_", row.attemptId, "effectId");
+  assertId(row.intentEventId, "evt_", row.attemptId, "intentEventId");
+  assertSha(row.gateDefinitionHash, row.attemptId, "gateDefinitionHash");
+  assertSha(row.registryHash, row.attemptId, "registryHash");
+  assertSha(row.runPlanHash, row.attemptId, "runPlanHash");
+  if (row.producerId !== "kxm-gate") throw gateRowInvalid(row.attemptId, "producerId must be kxm-gate");
+  if (row.gateKind !== "command" && row.gateKind !== "artifacts-exist") {
+    throw gateRowInvalid(row.attemptId, "gateKind is invalid");
+  }
+  if (row.expect !== "pass" && row.expect !== "fail") throw gateRowInvalid(row.attemptId, "expect is invalid");
+  if (row.gateKind === "artifacts-exist" && row.expect === "fail") {
+    throw gateRowInvalid(row.attemptId, "artifacts-exist cannot expect fail");
+  }
+  if (typeof row.controlProjectKey !== "string" || row.controlProjectKey.length === 0) {
+    throw gateRowInvalid(row.attemptId, "controlProjectKey is required");
+  }
+  if (gateRowContentHash("gate_attempts", row) !== row.contentHash) {
+    throw gateRowInvalid(row.attemptId, "contentHash does not match the canonical row");
+  }
+}
+function assertGateObservationRow(row) {
+  assertExactRowKeys(row, GATE_OBSERVATION_KEYS, row.observationId);
+  assertId(row.observationId, "obs_", row.observationId, "observationId");
+  assertId(row.attemptId, "att_", row.observationId, "attemptId");
+  assertId(row.effectId, "eff_", row.observationId, "effectId");
+  assertId(row.recordedEventId, "evt_", row.observationId, "recordedEventId");
+  if (!["complete", "incomplete", "no-start"].includes(row.completeness)) {
+    throw gateRowInvalid(row.observationId, "completeness is invalid");
+  }
+  assertFlag(row.spawned, row.observationId, "spawned");
+  assertFlag(row.exitObserved, row.observationId, "exitObserved");
+  assertFlag(row.closeObserved, row.observationId, "closeObserved");
+  assertNullInt(row.pid, row.observationId, "pid");
+  assertNullInt(row.exitCode, row.observationId, "exitCode");
+  assertNullInt(row.stdoutBytes, row.observationId, "stdoutBytes");
+  assertNullInt(row.stderrBytes, row.observationId, "stderrBytes");
+  assertNullInt(row.checkedCount, row.observationId, "checkedCount");
+  assertNullInt(row.failedCount, row.observationId, "failedCount");
+  if (typeof row.elapsedMs !== "number" || !Number.isInteger(row.elapsedMs) || row.elapsedMs < 0) {
+    throw gateRowInvalid(row.observationId, "elapsedMs is invalid");
+  }
+  if (row.stdoutSha256 !== null) assertSha(row.stdoutSha256, row.observationId, "stdoutSha256");
+  if (row.stderrSha256 !== null) assertSha(row.stderrSha256, row.observationId, "stderrSha256");
+  if (row.stdoutComplete !== null && row.stdoutComplete !== 0 && row.stdoutComplete !== 1) {
+    throw gateRowInvalid(row.observationId, "stdoutComplete must be 0, 1, or null");
+  }
+  if (row.stderrComplete !== null && row.stderrComplete !== 0 && row.stderrComplete !== 1) {
+    throw gateRowInvalid(row.observationId, "stderrComplete must be 0, 1, or null");
+  }
+  if (gateRowContentHash("gate_observations", row) !== row.contentHash) {
+    throw gateRowInvalid(row.observationId, "contentHash does not match the canonical row");
+  }
+}
+function assertGateEvidenceRow(row) {
+  assertExactRowKeys(row, GATE_EVIDENCE_KEYS, row.evidenceId);
+  assertId(row.evidenceId, "gev_", row.evidenceId, "evidenceId");
+  assertId(row.attemptId, "att_", row.evidenceId, "attemptId");
+  assertId(row.observationId, "obs_", row.evidenceId, "observationId");
+  assertId(row.effectId, "eff_", row.evidenceId, "effectId");
+  assertId(row.settledEventId, "evt_", row.evidenceId, "settledEventId");
+  if (row.kind !== "gate") throw gateRowInvalid(row.evidenceId, "kind must be gate");
+  if (!["passed", "implementation-failure", "repro-missing"].includes(row.outcome)) {
+    throw gateRowInvalid(row.evidenceId, "outcome is invalid");
+  }
+  if (gateRowContentHash("gate_evidence", row) !== row.contentHash) {
+    throw gateRowInvalid(row.evidenceId, "contentHash does not match the canonical row");
+  }
+}
+function assertSharedIdentity(row, attempt, id) {
+  if (row.runId !== attempt.runId || row.projectId !== attempt.projectId || row.homeRuntimeId !== attempt.homeRuntimeId || row.stepId !== attempt.stepId || row.stepAttempt !== attempt.stepAttempt || row.assignmentId !== attempt.assignmentId || row.effectId !== attempt.effectId) {
+    throw gateRowInvalid(id, "row identity does not match the gate attempt");
+  }
+}
+function gateAttemptFromSql(row) {
+  return {
+    attemptId: row.attempt_id,
+    runId: row.run_id,
+    projectId: row.project_id,
+    homeRuntimeId: row.home_runtime_id,
+    stepId: row.step_id,
+    stepAttempt: row.step_attempt,
+    assignmentId: row.assignment_id,
+    effectId: row.effect_id,
+    gateId: row.gate_id,
+    gateKind: row.gate_kind,
+    expect: row.expect,
+    gateDefinitionHash: row.gate_definition_hash,
+    registryHash: row.registry_hash,
+    runPlanHash: row.run_plan_hash,
+    controlProjectKey: row.control_project_key,
+    producerId: row.producer_id,
+    intentEventId: row.intent_event_id,
+    contentHash: row.content_hash
+  };
+}
+function gateObservationFromSql(row) {
+  return {
+    observationId: row.observation_id,
+    attemptId: row.attempt_id,
+    runId: row.run_id,
+    projectId: row.project_id,
+    homeRuntimeId: row.home_runtime_id,
+    stepId: row.step_id,
+    stepAttempt: row.step_attempt,
+    assignmentId: row.assignment_id,
+    effectId: row.effect_id,
+    completeness: row.completeness,
+    spawned: row.spawned === 1 ? 1 : 0,
+    pid: row.pid,
+    exitCode: row.exit_code,
+    signal: row.signal,
+    exitObserved: row.exit_observed === 1 ? 1 : 0,
+    closeObserved: row.close_observed === 1 ? 1 : 0,
+    stopCause: row.stop_cause,
+    signalsAttempted: row.signals_attempted,
+    errorClass: row.error_class,
+    stdoutSha256: row.stdout_sha256,
+    stdoutBytes: row.stdout_bytes,
+    stdoutComplete: row.stdout_complete === null ? null : row.stdout_complete === 1 ? 1 : 0,
+    stderrSha256: row.stderr_sha256,
+    stderrBytes: row.stderr_bytes,
+    stderrComplete: row.stderr_complete === null ? null : row.stderr_complete === 1 ? 1 : 0,
+    checkedCount: row.checked_count,
+    failedCount: row.failed_count,
+    elapsedMs: row.elapsed_ms,
+    startedAt: row.started_at,
+    finishedAt: row.finished_at,
+    recordedEventId: row.recorded_event_id,
+    contentHash: row.content_hash
+  };
+}
+function gateEvidenceFromSql(row) {
+  return {
+    evidenceId: row.evidence_id,
+    attemptId: row.attempt_id,
+    observationId: row.observation_id,
+    runId: row.run_id,
+    projectId: row.project_id,
+    homeRuntimeId: row.home_runtime_id,
+    stepId: row.step_id,
+    stepAttempt: row.step_attempt,
+    assignmentId: row.assignment_id,
+    effectId: row.effect_id,
+    evidenceKey: row.evidence_key,
+    kind: row.kind,
+    expect: row.expect,
+    outcome: row.outcome,
+    settledEventId: row.settled_event_id,
+    contentHash: row.content_hash
+  };
+}
+function capabilityFromRow(row) {
+  return row ? {
+    attemptId: row.attempt_id,
+    runId: row.run_id,
+    assignmentId: row.assignment_id,
+    stepId: row.step_id,
+    stepAttempt: row.step_attempt,
+    producerId: row.producer_id,
+    capabilityHash: row.capability_hash,
+    state: row.state
+  } : void 0;
+}
+var KXM_REGISTRY_SCHEMA_VERSION, REGISTRY_TABLES, REGISTRY_SCHEMA, PROJECT_COLUMNS, KxmRuntimeRegistry, KXM_EVENT_STORE_SCHEMA_VERSION, DRIVE_RECEIPT_MAX_BYTES, EVENT_STORE_TABLES, KXM_EVENT_STORE_TABLE_NAMES, EVENT_STORE_SCHEMA, KxmRunEventStore, SHA2562, OPAQUE, FORBIDDEN_TEXT_KEYS, GATE_ATTEMPT_KEYS, GATE_OBSERVATION_KEYS, GATE_EVIDENCE_KEYS;
 var init_runtime_store = __esm({
   "plugins/kxm/src/runtime-store.ts"() {
     "use strict";
@@ -21141,10 +21964,10 @@ var init_runtime_store = __esm({
     init_sync_transform();
     init_runtime_paths();
     init_database();
-    KXM_REGISTRY_SCHEMA_VERSION = 1;
+    KXM_REGISTRY_SCHEMA_VERSION = 2;
     REGISTRY_TABLES = {
       supervisor: ["singleton_id", "runtime_id", "pid", "port", "token_hash", "started_at", "heartbeat_at", "state"],
-      projects: ["project_id", "project_root", "project_key", "home_runtime_id", "config_revision", "registered_at"]
+      projects: ["project_id", "project_root", "project_key", "home_runtime_id", "config_revision", "registered_at", "lane_of"]
     };
     REGISTRY_SCHEMA = `
 CREATE TABLE supervisor (
@@ -21158,19 +21981,23 @@ CREATE TABLE supervisor (
   state TEXT NOT NULL
 ) STRICT;
 CREATE TABLE projects (
-  project_id TEXT PRIMARY KEY,
+  project_key TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
   project_root TEXT NOT NULL,
-  project_key TEXT NOT NULL UNIQUE,
   home_runtime_id TEXT NOT NULL,
   config_revision TEXT,
-  registered_at TEXT NOT NULL
+  registered_at TEXT NOT NULL,
+  lane_of TEXT
 ) STRICT;
+CREATE INDEX projects_by_project_id ON projects (project_id);
 `;
+    PROJECT_COLUMNS = "project_id, project_root, project_key, home_runtime_id, config_revision, registered_at, lane_of";
     KxmRuntimeRegistry = class {
       path;
       database;
       constructor(path4) {
         this.path = resolve8(path4);
+        migrateRegistryLanes(this.path);
         this.database = openDatabase(this.path, "runtime registry", {
           schema: REGISTRY_SCHEMA,
           version: KXM_REGISTRY_SCHEMA_VERSION,
@@ -21249,57 +22076,165 @@ CREATE TABLE projects (
       supervisor() {
         return this.readSupervisorRow();
       }
-      /** Register or revalidate a project's home binding. Home Runtime is immutable. */
-      /** All projects registered to this Runtime, for restart recovery: the
-       * supervisor needs to reopen their contexts so pending outbox rows resume
-       * syncing and presence keeps beating. */
+      /** All projects registered to this Runtime, including lane roots, for restart
+       * recovery: the supervisor reopens their contexts so pending outbox rows
+       * resume syncing and presence keeps beating. */
       projectsForRuntime(homeRuntimeId) {
         const rows = this.database.prepare(
           "SELECT project_root, project_id FROM projects WHERE home_runtime_id = ? ORDER BY registered_at"
         ).all(homeRuntimeId);
         return rows.map((row) => ({ projectRoot: row.project_root, projectId: row.project_id }));
       }
+      /**
+       * Register or revalidate a control root. The home runtime of a live row is
+       * immutable. A second root whose git common directory matches a live row
+       * for the same project is a lane, unless the registering root is the primary
+       * worktree and the live home row is not: then the primary becomes the home
+       * row (same home runtime id) and every other live row of that repository
+       * becomes its lane. A primary never becomes a lane. A root whose directory
+       * is gone is replaced. A live root that is a different repository is
+       * `project_home_conflict`.
+       */
       registerProject(registration) {
         const projectRoot = resolve8(registration.projectRoot);
         const projectKey = projectRuntimeKey(projectRoot);
-        this.database.exec("BEGIN IMMEDIATE");
-        try {
-          const byId = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_id = ?").get(registration.projectId);
-          const byKey = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_key = ?").get(projectKey);
-          const existing = byId ?? byKey;
-          if (existing) {
-            const problems = [];
-            if (byId && byId.project_key !== projectKey) problems.push(`project ${registration.projectId} is already bound to a different control root`);
-            if (byKey && byKey.project_id !== registration.projectId) problems.push(`control root is already bound to a different project id ${byKey.project_id}`);
-            if (existing.home_runtime_id !== registration.homeRuntimeId) problems.push(`project ${registration.projectId} home runtime is immutable and cannot be rebound`);
-            if (problems.length > 0) {
+        const candidateCommon = gitCommonDirectory(projectRoot);
+        const commonByRoot = /* @__PURE__ */ new Map();
+        for (let attempt = 0; attempt < 8; attempt += 1) {
+          this.database.exec("BEGIN IMMEDIATE");
+          let rootsToMeasure;
+          try {
+            const byKey = this.projectRow("SELECT " + PROJECT_COLUMNS + " FROM projects WHERE project_key = ?", projectKey);
+            if (byKey) {
+              const problems = [];
+              if (byKey.project_id !== registration.projectId) problems.push(`control root is already bound to a different project id ${byKey.project_id}`);
+              if (byKey.home_runtime_id !== registration.homeRuntimeId) problems.push(`project ${registration.projectId} home runtime is immutable and cannot be rebound`);
+              if (problems.length > 0) {
+                this.database.exec("ROLLBACK");
+                throw runtimeError("project_home_conflict", ".kxm/project.yaml", problems.join("; "));
+              }
+              const result = registrationFromRow(byKey);
+              this.database.exec("COMMIT");
+              return result;
+            }
+            const rows = this.database.prepare(
+              `SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_id = ? ORDER BY registered_at`
+            ).all(registration.projectId);
+            const live = rows.filter((row) => controlRootDirectoryExists(row.project_root));
+            const dead = rows.filter((row) => !controlRootDirectoryExists(row.project_root));
+            const unknown = live.filter((row) => !commonByRoot.has(row.project_root));
+            if (unknown.length > 0) {
+              rootsToMeasure = unknown.map((row) => row.project_root);
               this.database.exec("ROLLBACK");
-              throw runtimeError("project_home_conflict", ".kxm/project.yaml", problems.join("; "));
+            } else if (live.length > 0) {
+              const anchor = live.find((row) => {
+                const dir = commonByRoot.get(row.project_root);
+                return candidateCommon !== void 0 && dir === candidateCommon;
+              });
+              if (!anchor) {
+                this.database.exec("ROLLBACK");
+                throw runtimeError(
+                  "project_home_conflict",
+                  ".kxm/project.yaml",
+                  `project ${registration.projectId} is already bound to a different control root`
+                );
+              }
+              if (live.some((row) => row.home_runtime_id !== registration.homeRuntimeId)) {
+                this.database.exec("ROLLBACK");
+                throw runtimeError(
+                  "project_home_conflict",
+                  ".kxm/project.yaml",
+                  `project ${registration.projectId} home runtime is immutable and cannot be rebound`
+                );
+              }
+              const sameRepo = live.filter((row) => commonByRoot.get(row.project_root) === candidateCommon);
+              const home = sameRepo.find((row) => row.lane_of === null);
+              const registeringIsPrimary = isPrimaryWorktree(projectRoot, candidateCommon);
+              const homeIsPrimary = home !== void 0 && isPrimaryWorktree(home.project_root, commonByRoot.get(home.project_root));
+              if (registeringIsPrimary && !homeIsPrimary) {
+                this.insertHome(registration, projectRoot, projectKey);
+                for (const row of sameRepo) {
+                  this.database.prepare("UPDATE projects SET lane_of = ? WHERE project_key = ?").run(projectKey, row.project_key);
+                }
+                this.database.exec("COMMIT");
+                registration.logger?.({
+                  event: "project_home_promoted",
+                  projectId: registration.projectId,
+                  projectRoot,
+                  homeRuntimeId: registration.homeRuntimeId,
+                  previousHomeRoot: home?.project_root ?? null,
+                  previousHomeKey: home?.project_key ?? null
+                });
+                return this.insertedRegistration(registration, projectRoot, projectKey);
+              }
+              if (registeringIsPrimary) {
+                this.database.exec("ROLLBACK");
+                throw runtimeError(
+                  "project_home_conflict",
+                  ".kxm/project.yaml",
+                  `project ${registration.projectId} primary checkout is already the home row`
+                );
+              }
+              const laneOf = anchor.lane_of ?? anchor.project_key;
+              this.database.prepare(`
+            INSERT INTO projects (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+          `).run(projectKey, registration.projectId, projectRoot, registration.homeRuntimeId, registration.configRevision ?? null, registration.now, laneOf);
+              const result = this.insertedRegistration(registration, projectRoot, projectKey, laneOf);
+              this.database.exec("COMMIT");
+              return result;
+            } else if (dead.length > 0) {
+              const replaced = dead[0];
+              if (dead.some((row) => row.home_runtime_id !== registration.homeRuntimeId)) {
+                this.database.exec("ROLLBACK");
+                throw runtimeError(
+                  "project_home_conflict",
+                  ".kxm/project.yaml",
+                  `project ${registration.projectId} home runtime is immutable and cannot be rebound`
+                );
+              }
+              this.database.prepare("DELETE FROM projects WHERE project_id = ?").run(registration.projectId);
+              this.insertHome(registration, projectRoot, projectKey);
+              this.database.exec("COMMIT");
+              registration.logger?.({
+                event: "project_registration_replaced",
+                projectId: registration.projectId,
+                projectRoot,
+                replacedRoot: replaced.project_root,
+                replacedCount: dead.length,
+                replacedHomeRuntimeId: replaced.home_runtime_id,
+                replacedProjectKey: replaced.project_key
+              });
+              return this.insertedRegistration(registration, projectRoot, projectKey);
+            } else {
+              this.insertHome(registration, projectRoot, projectKey);
+              this.database.exec("COMMIT");
+              return this.insertedRegistration(registration, projectRoot, projectKey);
             }
-            const result = {
-              projectId: existing.project_id,
-              projectRoot: existing.project_root,
-              projectKey: existing.project_key,
-              homeRuntimeId: existing.home_runtime_id,
-              ...existing.config_revision !== null ? { configRevision: existing.config_revision } : {},
-              registeredAt: existing.registered_at
-            };
-            this.database.exec("COMMIT");
-            return result;
+          } catch (error) {
+            try {
+              this.database.exec("ROLLBACK");
+            } catch {
+            }
+            throw error;
+          }
+          for (const root of rootsToMeasure ?? []) {
+            commonByRoot.set(root, gitCommonDirectory(root));
           }
-          this.database.prepare(`
-        INSERT INTO projects (project_id, project_root, project_key, home_runtime_id, config_revision, registered_at)
-        VALUES (?, ?, ?, ?, ?, ?)
-      `).run(registration.projectId, projectRoot, projectKey, registration.homeRuntimeId, registration.configRevision ?? null, registration.now);
+        }
+        throw runtimeError(
+          "runtime_registry_busy",
+          projectRoot,
+          `project ${registration.projectId} registration could not be rechecked`
+        );
+      }
+      /** Remove one control root. Returns false when that root was not registered. */
+      unregisterProject(projectRoot) {
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+          const removed = this.deleteRegisteredRoot(projectRoot);
           this.database.exec("COMMIT");
-          return {
-            projectId: registration.projectId,
-            projectRoot,
-            projectKey,
-            homeRuntimeId: registration.homeRuntimeId,
-            ...registration.configRevision !== void 0 ? { configRevision: registration.configRevision } : {},
-            registeredAt: registration.now
-          };
+          return removed;
         } catch (error) {
           try {
             this.database.exec("ROLLBACK");
@@ -21308,30 +22243,91 @@ CREATE TABLE projects (
           throw error;
         }
       }
+      /**
+       * Delete the row only when `supervisorIsLive` is false for the supervisor
+       * row read inside this write transaction. A live supervisor keeps the row;
+       * the caller uses the supervisor route instead of editing the file.
+       */
+      unregisterProjectIfIdle(projectRoot, supervisorIsLive) {
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+          if (supervisorIsLive(this.readSupervisorRow())) {
+            this.database.exec("ROLLBACK");
+            return "supervisor_live";
+          }
+          const removed = this.deleteRegisteredRoot(projectRoot);
+          this.database.exec("COMMIT");
+          return removed ? "removed" : "absent";
+        } catch (error) {
+          try {
+            this.database.exec("ROLLBACK");
+          } catch {
+          }
+          throw error;
+        }
+      }
+      /** How many other rows share this home root's project. Zero when this root is a lane or missing. */
+      homeLaneCount(projectRoot) {
+        const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectRuntimeKey(resolve8(projectRoot)));
+        if (!row || row.lane_of !== null) return 0;
+        const count = this.database.prepare(
+          "SELECT COUNT(*) AS total FROM projects WHERE project_id = ? AND project_key != ?"
+        ).get(row.project_id, row.project_key);
+        return Number(count?.total ?? 0);
+      }
+      /** Caller holds the write transaction. Does not commit. */
+      deleteRegisteredRoot(projectRoot) {
+        const projectKey = projectRuntimeKey(resolve8(projectRoot));
+        const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectKey);
+        if (!row) return false;
+        this.database.prepare("DELETE FROM projects WHERE project_key = ?").run(projectKey);
+        if (row.lane_of === null) {
+          const successor = this.database.prepare(
+            "SELECT project_key FROM projects WHERE project_id = ? ORDER BY registered_at LIMIT 1"
+          ).get(row.project_id);
+          if (successor) {
+            this.database.prepare("UPDATE projects SET lane_of = NULL WHERE project_key = ?").run(successor.project_key);
+            this.database.prepare(
+              "UPDATE projects SET lane_of = ? WHERE project_id = ? AND project_key != ? AND (lane_of IS NULL OR lane_of = ?)"
+            ).run(successor.project_key, row.project_id, successor.project_key, projectKey);
+          }
+        }
+        return true;
+      }
+      /** The home row for a project id, or the earliest row when every row is a lane. */
       project(projectId) {
-        const row = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_id = ?").get(projectId);
-        return row ? {
-          projectId: row.project_id,
-          projectRoot: row.project_root,
-          projectKey: row.project_key,
-          homeRuntimeId: row.home_runtime_id,
-          ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
-          registeredAt: row.registered_at
-        } : void 0;
+        const row = this.projectRow(
+          `SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_id = ? ORDER BY CASE WHEN lane_of IS NULL THEN 0 ELSE 1 END, registered_at LIMIT 1`,
+          projectId
+        );
+        return row ? registrationFromRow(row) : void 0;
       }
       projectByRoot(projectRoot) {
-        const key = projectRuntimeKey(projectRoot);
-        const row = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_key = ?").get(key);
-        return row ? {
-          projectId: row.project_id,
-          projectRoot: row.project_root,
-          projectKey: row.project_key,
-          homeRuntimeId: row.home_runtime_id,
-          ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
-          registeredAt: row.registered_at
-        } : void 0;
+        const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectRuntimeKey(projectRoot));
+        return row ? registrationFromRow(row) : void 0;
+      }
+      projectRow(sql, parameter) {
+        return this.database.prepare(sql).get(parameter);
+      }
+      insertHome(registration, projectRoot, projectKey) {
+        this.database.prepare(`
+      INSERT INTO projects (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+      VALUES (?, ?, ?, ?, ?, ?, NULL)
+    `).run(projectKey, registration.projectId, projectRoot, registration.homeRuntimeId, registration.configRevision ?? null, registration.now);
+      }
+      insertedRegistration(registration, projectRoot, projectKey, laneOf) {
+        return {
+          projectId: registration.projectId,
+          projectRoot,
+          projectKey,
+          homeRuntimeId: registration.homeRuntimeId,
+          ...registration.configRevision !== void 0 ? { configRevision: registration.configRevision } : {},
+          ...laneOf !== void 0 ? { laneOf } : {},
+          registeredAt: registration.now
+        };
       }
     };
+    KXM_EVENT_STORE_SCHEMA_VERSION = 7;
     DRIVE_RECEIPT_MAX_BYTES = 8 * 1024;
     EVENT_STORE_TABLES = {
       runs: ["run_id", "project_id", "home_runtime_id", "workflow_id", "prompt_sha256", "status", "config_revision", "memory_revision", "executor_policy_revision", "tool_policy_revision", "created_at", "updated_at"],
@@ -21449,6 +22445,969 @@ CREATE TABLE projects (
       ]
     };
     KXM_EVENT_STORE_TABLE_NAMES = Object.keys(EVENT_STORE_TABLES).sort();
+    EVENT_STORE_SCHEMA = `
+CREATE TABLE runs (
+  run_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  home_runtime_id TEXT NOT NULL,
+  workflow_id TEXT NOT NULL,
+  prompt_sha256 TEXT NOT NULL,
+  status TEXT NOT NULL,
+  config_revision TEXT NOT NULL,
+  memory_revision TEXT NOT NULL,
+  executor_policy_revision TEXT NOT NULL,
+  tool_policy_revision TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+CREATE TABLE events (
+  project_id TEXT NOT NULL,
+  run_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL,
+  event_id TEXT NOT NULL UNIQUE,
+  event_type TEXT NOT NULL,
+  command_id TEXT,
+  occurred_at TEXT NOT NULL,
+  recorded_at TEXT NOT NULL,
+  monotonic_ns TEXT NOT NULL,
+  config_revision TEXT NOT NULL,
+  memory_revision TEXT NOT NULL,
+  executor_policy_revision TEXT NOT NULL,
+  tool_policy_revision TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  schema TEXT NOT NULL,
+  home_runtime_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, run_id, sequence)
+) STRICT;
+CREATE INDEX events_run ON events(run_id, sequence);
+CREATE TABLE commands (
+  command_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  result TEXT NOT NULL,
+  recorded_at TEXT NOT NULL
+) STRICT;
+CREATE TABLE run_plans (
+  run_id TEXT PRIMARY KEY REFERENCES runs(run_id),
+  run_plan_hash TEXT NOT NULL,
+  envelope TEXT NOT NULL,
+  pinned_sequence INTEGER NOT NULL
+) STRICT;
+CREATE TABLE run_state (
+  run_id TEXT PRIMARY KEY REFERENCES runs(run_id),
+  last_sequence INTEGER NOT NULL,
+  state TEXT NOT NULL
+) STRICT;
+CREATE TABLE attempt_capabilities (
+  attempt_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  assignment_id TEXT NOT NULL,
+  step_id TEXT NOT NULL,
+  step_attempt INTEGER NOT NULL,
+  producer_id TEXT NOT NULL,
+  capability_hash TEXT NOT NULL UNIQUE,
+  state TEXT NOT NULL CHECK (state IN ('issued','settled','revoked'))
+) STRICT;
+CREATE TABLE gate_attempts (
+  attempt_id TEXT PRIMARY KEY REFERENCES attempt_capabilities(attempt_id),
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  project_id TEXT NOT NULL,
+  home_runtime_id TEXT NOT NULL,
+  step_id TEXT NOT NULL,
+  step_attempt INTEGER NOT NULL,
+  assignment_id TEXT NOT NULL,
+  effect_id TEXT NOT NULL UNIQUE,
+  gate_id TEXT NOT NULL,
+  gate_kind TEXT NOT NULL CHECK (gate_kind IN ('command','artifacts-exist')),
+  expect TEXT NOT NULL CHECK (expect IN ('pass','fail')),
+  gate_definition_hash TEXT NOT NULL,
+  registry_hash TEXT NOT NULL,
+  run_plan_hash TEXT NOT NULL,
+  control_project_key TEXT NOT NULL,
+  producer_id TEXT NOT NULL CHECK (producer_id = 'kxm-gate'),
+  intent_event_id TEXT NOT NULL UNIQUE REFERENCES events(event_id),
+  content_hash TEXT NOT NULL
+) STRICT;
+CREATE INDEX gate_attempts_run ON gate_attempts(run_id);
+CREATE INDEX gate_attempts_project ON gate_attempts(project_id);
+CREATE TABLE gate_observations (
+  observation_id TEXT PRIMARY KEY,
+  attempt_id TEXT NOT NULL UNIQUE REFERENCES gate_attempts(attempt_id),
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  project_id TEXT NOT NULL,
+  home_runtime_id TEXT NOT NULL,
+  step_id TEXT NOT NULL,
+  step_attempt INTEGER NOT NULL,
+  assignment_id TEXT NOT NULL,
+  effect_id TEXT NOT NULL,
+  completeness TEXT NOT NULL CHECK (completeness IN ('complete','incomplete','no-start')),
+  spawned INTEGER NOT NULL CHECK (spawned IN (0, 1)),
+  pid INTEGER,
+  exit_code INTEGER,
+  signal TEXT,
+  exit_observed INTEGER NOT NULL CHECK (exit_observed IN (0, 1)),
+  close_observed INTEGER NOT NULL CHECK (close_observed IN (0, 1)),
+  stop_cause TEXT NOT NULL CHECK (stop_cause IN ('none','timeout','cancel','error')),
+  signals_attempted TEXT NOT NULL CHECK (signals_attempted IN ('none','term','term-kill')),
+  error_class TEXT CHECK (error_class IN ('validation','spawn-error','stream-error','stop-error','recording-error','lost-close')),
+  stdout_sha256 TEXT,
+  stdout_bytes INTEGER,
+  stdout_complete INTEGER CHECK (stdout_complete IN (0, 1)),
+  stderr_sha256 TEXT,
+  stderr_bytes INTEGER,
+  stderr_complete INTEGER CHECK (stderr_complete IN (0, 1)),
+  checked_count INTEGER,
+  failed_count INTEGER,
+  elapsed_ms INTEGER NOT NULL,
+  started_at TEXT NOT NULL,
+  finished_at TEXT,
+  recorded_event_id TEXT NOT NULL UNIQUE REFERENCES events(event_id),
+  content_hash TEXT NOT NULL
+) STRICT;
+CREATE INDEX gate_observations_run ON gate_observations(run_id);
+CREATE TABLE gate_evidence (
+  evidence_id TEXT PRIMARY KEY,
+  attempt_id TEXT NOT NULL UNIQUE REFERENCES gate_attempts(attempt_id),
+  observation_id TEXT NOT NULL UNIQUE REFERENCES gate_observations(observation_id),
+  run_id TEXT NOT NULL REFERENCES runs(run_id),
+  project_id TEXT NOT NULL,
+  home_runtime_id TEXT NOT NULL,
+  step_id TEXT NOT NULL,
+  step_attempt INTEGER NOT NULL,
+  assignment_id TEXT NOT NULL,
+  effect_id TEXT NOT NULL,
+  evidence_key TEXT,
+  kind TEXT NOT NULL CHECK (kind = 'gate'),
+  expect TEXT NOT NULL CHECK (expect IN ('pass','fail')),
+  outcome TEXT NOT NULL CHECK (outcome IN ('passed','implementation-failure','repro-missing')),
+  settled_event_id TEXT NOT NULL UNIQUE REFERENCES events(event_id),
+  content_hash TEXT NOT NULL
+) STRICT;
+CREATE UNIQUE INDEX gate_evidence_key ON gate_evidence(run_id, step_id, step_attempt, evidence_key) WHERE evidence_key IS NOT NULL;
+CREATE INDEX gate_evidence_run ON gate_evidence(run_id);
+CREATE TABLE drive_receipts (
+  drive_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  opened_sequence INTEGER NOT NULL,
+  last_sequence INTEGER NOT NULL,
+  closed_at TEXT NOT NULL,
+  schema TEXT NOT NULL,
+  receipt TEXT NOT NULL
+) STRICT;
+CREATE INDEX drive_receipts_run ON drive_receipts(run_id);
+CREATE TABLE coordinators (
+  coordinator_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  channel TEXT NOT NULL,
+  ceiling_hash TEXT NOT NULL,
+  config_revision TEXT NOT NULL,
+  bound_at TEXT NOT NULL,
+  schema TEXT NOT NULL,
+  record TEXT NOT NULL
+) STRICT;
+CREATE UNIQUE INDEX coordinators_slot ON coordinators(project_id, role, channel);
+CREATE TABLE intake_messages (
+  message_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  coordinator_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  content_hash TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  dispatch_state TEXT NOT NULL CHECK (dispatch_state IN ('ready','held_paused','admitted','refused')),
+  schema TEXT NOT NULL,
+  record TEXT NOT NULL
+) STRICT;
+CREATE UNIQUE INDEX intake_idempotency ON intake_messages(project_id, coordinator_id, idempotency_key);
+CREATE INDEX intake_dispatch ON intake_messages(project_id, dispatch_state, received_at, message_id);
+CREATE TABLE project_controls (
+  project_id TEXT PRIMARY KEY,
+  paused INTEGER NOT NULL CHECK (paused IN (0, 1)),
+  reason TEXT,
+  updated_at TEXT NOT NULL,
+  actor TEXT NOT NULL,
+  schema TEXT NOT NULL,
+  record TEXT NOT NULL
+) STRICT;
+CREATE TABLE IF NOT EXISTS outbox (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  run_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL,
+  sync_event TEXT NOT NULL,
+  attempted_at TEXT,
+  attempt_count INTEGER NOT NULL DEFAULT 0,
+  acked_at TEXT,
+  refused_code TEXT,
+  refused_at TEXT,
+  UNIQUE (run_id, sequence)
+) STRICT;
+CREATE INDEX outbox_pending ON outbox(seq) WHERE acked_at IS NULL AND refused_code IS NULL;
+CREATE INDEX outbox_refused ON outbox(seq) WHERE refused_code IS NOT NULL;
+`;
+    KxmRunEventStore = class {
+      path;
+      /** Secret values registered here are replaced in every sync object this
+       * store derives. In memory only: they are never written anywhere. */
+      syncRedactor = new KxmSyncRedactor();
+      database;
+      constructor(path4) {
+        this.path = resolve8(path4);
+        this.database = openDatabase(this.path, "run event store", {
+          schema: EVENT_STORE_SCHEMA,
+          version: KXM_EVENT_STORE_SCHEMA_VERSION,
+          tables: EVENT_STORE_TABLES
+        });
+      }
+      close() {
+        this.database.close();
+      }
+      /** Persist the accepted prompt outside the event log (hashed in events only). */
+      putRunPrompt(runId, prompt) {
+        const all = this.readRunPrompts();
+        all[runId] = prompt;
+        this.writeRunPrompts(all);
+      }
+      getRunPrompt(runId) {
+        const value = this.readRunPrompts()[runId];
+        return typeof value === "string" ? value : void 0;
+      }
+      runPromptSidecarPath() {
+        return `${this.path}.run-prompts.json`;
+      }
+      readRunPrompts() {
+        const sidecar = this.runPromptSidecarPath();
+        if (!existsSync10(sidecar)) return {};
+        try {
+          const parsed = JSON.parse(readFileSync8(sidecar, "utf8"));
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+          return Object.fromEntries(
+            Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
+          );
+        } catch {
+          return {};
+        }
+      }
+      writeRunPrompts(all) {
+        writeFileSync6(this.runPromptSidecarPath(), `${JSON.stringify(all)}
+`, { encoding: "utf8", mode: 384 });
+      }
+      /** Run one immutable transaction, rolling back on any failure. */
+      transaction(work) {
+        return withDatabaseTransaction(this.database, work);
+      }
+      command(commandId) {
+        const row = this.database.prepare("SELECT command_id, run_id, kind, result, recorded_at FROM commands WHERE command_id = ?").get(commandId);
+        return row ? { commandId: row.command_id, runId: row.run_id, kind: row.kind, result: JSON.parse(row.result), recordedAt: row.recorded_at } : void 0;
+      }
+      insertCommand(record) {
+        this.database.prepare("INSERT INTO commands (command_id, run_id, kind, result, recorded_at) VALUES (?, ?, ?, ?, ?)").run(record.commandId, record.runId, record.kind, JSON.stringify(record.result), record.recordedAt);
+      }
+      insertRun(record) {
+        this.database.prepare(`
+      INSERT INTO runs (run_id, project_id, home_runtime_id, workflow_id, prompt_sha256, status, config_revision, memory_revision, executor_policy_revision, tool_policy_revision, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          record.runId,
+          record.projectId,
+          record.homeRuntimeId,
+          record.workflowId,
+          record.promptSha256,
+          record.status,
+          record.configRevision,
+          record.memoryRevision,
+          record.executorPolicyRevision,
+          record.toolPolicyRevision,
+          record.createdAt,
+          record.updatedAt
+        );
+      }
+      updateRunStatus(runId, status, updatedAt) {
+        this.database.prepare("UPDATE runs SET status = ?, updated_at = ? WHERE run_id = ?").run(status, updatedAt, runId);
+      }
+      run(runId) {
+        const row = this.database.prepare(`
+      SELECT run_id, project_id, home_runtime_id, workflow_id, prompt_sha256, status, config_revision, memory_revision, executor_policy_revision, tool_policy_revision, created_at, updated_at
+      FROM runs WHERE run_id = ?
+    `).get(runId);
+        return row ? runFromRow(row) : void 0;
+      }
+      /** All projects registered to this Runtime, for restart recovery: the
+       * supervisor needs to reopen their contexts so pending outbox rows resume
+       * syncing and presence keeps beating. */
+      projectsForRuntime(homeRuntimeId) {
+        const rows = this.database.prepare(
+          "SELECT project_root, project_id FROM projects WHERE home_runtime_id = ? ORDER BY registered_at"
+        ).all(homeRuntimeId);
+        return rows.map((row) => ({ projectRoot: row.project_root, projectId: row.project_id }));
+      }
+      runsForProject(projectId, limit = 50) {
+        const rows = this.database.prepare(`
+      SELECT run_id, project_id, home_runtime_id, workflow_id, prompt_sha256, status, config_revision, memory_revision, executor_policy_revision, tool_policy_revision, created_at, updated_at
+      FROM runs WHERE project_id = ? ORDER BY created_at DESC, run_id DESC LIMIT ?
+    `).all(projectId, limit);
+        return rows.map(runFromRow);
+      }
+      nextSequence(runId) {
+        const row = this.database.prepare("SELECT COALESCE(MAX(sequence), 0) AS max_sequence FROM events WHERE run_id = ?").get(runId);
+        return row.max_sequence + 1;
+      }
+      appendEvent(event) {
+        validateRunEvent(event, "run-event");
+        const run = this.run(event.runId);
+        if (!run) throw runtimeError("run_unknown", event.runId, "run does not exist in this event store");
+        if (event.homeRuntimeId !== run.homeRuntimeId || event.projectId !== run.projectId) {
+          throw runtimeError("run_event_owner_mismatch", event.runId, "event homeRuntimeId or projectId does not match the run");
+        }
+        this.database.prepare(`
+      INSERT INTO events (project_id, run_id, sequence, event_id, event_type, command_id, occurred_at, recorded_at, monotonic_ns, config_revision, memory_revision, executor_policy_revision, tool_policy_revision, payload, schema, home_runtime_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          event.projectId,
+          event.runId,
+          event.sequence,
+          event.eventId,
+          event.eventType,
+          event.commandId ?? null,
+          event.occurredAt,
+          event.recordedAt,
+          event.monotonicNs,
+          event.configRevision,
+          event.memoryRevision,
+          event.executorPolicyRevision,
+          event.toolPolicyRevision,
+          JSON.stringify(event.payload),
+          event.schema,
+          event.homeRuntimeId
+        );
+        const syncEvent = deriveKxmSyncEvent(event, { redactor: this.syncRedactor });
+        this.database.prepare("INSERT INTO outbox (run_id, sequence, sync_event) VALUES (?, ?, ?)").run(event.runId, event.sequence, kxmSyncEventBytes(syncEvent));
+      }
+      /**
+       * Retryable outbox rows after `afterSeq`, in outbox order, oldest first.
+       * Acked and durably refused rows are never returned: a refused row is not
+       * waiting for a retry, it is waiting for an operator.
+       */
+      pendingOutbox(limit = 100, afterSeq = 0) {
+        const rows = this.database.prepare(`
+      SELECT seq, run_id, sequence, sync_event, attempt_count, attempted_at, acked_at, refused_code, refused_at
+      FROM outbox WHERE acked_at IS NULL AND refused_code IS NULL AND seq > ? ORDER BY seq ASC LIMIT ?
+    `).all(afterSeq, limit);
+        return rows.map(outboxFromRow);
+      }
+      /** Every outbox row of one run, in any state, in sequence order. */
+      outboxForRun(runId) {
+        const rows = this.database.prepare(`
+      SELECT seq, run_id, sequence, sync_event, attempt_count, attempted_at, acked_at, refused_code, refused_at
+      FROM outbox WHERE run_id = ? ORDER BY sequence ASC
+    `).all(runId);
+        return rows.map(outboxFromRow);
+      }
+      /**
+       * Count one attempt against each row. Refused rows are never re-counted: they
+       * are out of the queue, and a tick that reaches them again would mean the
+       * refusal was cleared (which resets the count).
+       */
+      markOutboxAttempted(seqs, at2) {
+        const statement = this.database.prepare(`
+      UPDATE outbox SET attempted_at = ?, attempt_count = attempt_count + 1
+      WHERE seq = ? AND acked_at IS NULL AND refused_code IS NULL
+    `);
+        this.transaction(() => {
+          for (const seq of seqs) statement.run(at2, seq);
+        });
+      }
+      /** Advance the cursor: the hub holds these rows now. Returns rows newly acked. */
+      ackOutbox(seqs, at2) {
+        const statement = this.database.prepare("UPDATE outbox SET acked_at = ?, refused_code = NULL, refused_at = NULL WHERE seq = ? AND acked_at IS NULL");
+        return this.transaction(() => {
+          let changed = 0;
+          for (const seq of seqs) changed += Number(statement.run(at2, seq).changes);
+          return changed;
+        });
+      }
+      /**
+       * Record a durable hub refusal: the answer will not change if the same bytes
+       * are sent again. Returns rows newly moved out of the pending queue.
+       */
+      refuseOutbox(refusals, at2) {
+        const statement = this.database.prepare(`
+      UPDATE outbox SET refused_code = ?, refused_at = ?
+      WHERE seq = ? AND acked_at IS NULL AND refused_code IS NULL
+    `);
+        return this.transaction(() => {
+          let changed = 0;
+          for (const refusal of refusals) changed += Number(statement.run(refusal.code, at2, refusal.seq).changes);
+          return changed;
+        });
+      }
+      /**
+       * Operator revive: put refused rows back in the pending queue with a fresh
+       * attempt budget. Used after the hub-side state is corrected — the Runtime
+       * must not decide on its own that a refusal has become retryable.
+       */
+      retryRefusedOutbox() {
+        return Number(this.database.prepare(`
+      UPDATE outbox SET refused_code = NULL, refused_at = NULL, attempted_at = NULL, attempt_count = 0
+      WHERE acked_at IS NULL AND refused_code IS NOT NULL
+    `).run().changes);
+      }
+      /**
+       * The outbox as one read model: what is still retryable, what the hub holds,
+       * and what the hub refused with which codes. This is what makes a stalled
+       * sync answerable without opening SQLite.
+       */
+      outboxStatus() {
+        const counts = this.database.prepare(`
+      SELECT
+        COALESCE(SUM(acked_at IS NULL AND refused_code IS NULL), 0) AS pending,
+        COALESCE(SUM(acked_at IS NOT NULL), 0) AS acked,
+        COALESCE(SUM(acked_at IS NULL AND refused_code IS NOT NULL), 0) AS refused,
+        MAX(attempted_at) AS last_attempt_at
+      FROM outbox
+    `).get();
+        const refusals = this.database.prepare(`
+      SELECT refused_code AS code, COUNT(*) AS count
+      FROM outbox WHERE acked_at IS NULL AND refused_code IS NOT NULL
+      GROUP BY refused_code ORDER BY count DESC, code ASC
+    `).all();
+        const oldest = this.database.prepare(`
+      SELECT seq FROM outbox WHERE acked_at IS NULL AND refused_code IS NULL ORDER BY seq ASC LIMIT 1
+    `).get();
+        return {
+          pending: counts.pending,
+          acked: counts.acked,
+          refused: counts.refused,
+          ...counts.last_attempt_at !== null ? { lastAttemptAt: counts.last_attempt_at } : {},
+          ...oldest ? { oldestPendingSeq: oldest.seq } : {},
+          // Mapped, not spread: node:sqlite rows are null-prototype objects, and this
+          // read model is handed straight to the CLI and the supervisor's JSON answer.
+          refusals: refusals.map((refusal) => ({ code: refusal.code, count: refusal.count }))
+        };
+      }
+      events(runId, afterSequence = 0, limit = 200) {
+        const rows = this.database.prepare(`
+      SELECT project_id, run_id, sequence, event_id, event_type, command_id, occurred_at, recorded_at, monotonic_ns, config_revision, memory_revision, executor_policy_revision, tool_policy_revision, payload, schema, home_runtime_id
+      FROM events WHERE run_id = ? AND sequence > ? ORDER BY sequence ASC LIMIT ?
+    `).all(runId, afterSequence, limit);
+        return rows.map((row) => ({
+          schema: row.schema,
+          eventId: row.event_id,
+          eventType: row.event_type,
+          projectId: row.project_id,
+          runId: row.run_id,
+          homeRuntimeId: row.home_runtime_id,
+          sequence: row.sequence,
+          ...row.command_id !== null ? { commandId: row.command_id } : {},
+          occurredAt: row.occurred_at,
+          recordedAt: row.recorded_at,
+          monotonicNs: row.monotonic_ns,
+          configRevision: row.config_revision,
+          memoryRevision: row.memory_revision,
+          executorPolicyRevision: row.executor_policy_revision,
+          toolPolicyRevision: row.tool_policy_revision,
+          payload: JSON.parse(row.payload)
+        }));
+      }
+      insertRunPlan(row) {
+        this.database.prepare("INSERT INTO run_plans (run_id, run_plan_hash, envelope, pinned_sequence) VALUES (?, ?, ?, ?)").run(row.runId, row.runPlanHash, row.envelope, row.pinnedSequence);
+      }
+      runPlan(runId) {
+        const row = this.database.prepare("SELECT run_id, run_plan_hash, envelope, pinned_sequence FROM run_plans WHERE run_id = ?").get(runId);
+        return row ? { runId: row.run_id, runPlanHash: row.run_plan_hash, envelope: row.envelope, pinnedSequence: row.pinned_sequence } : void 0;
+      }
+      runState(runId) {
+        const row = this.database.prepare("SELECT run_id, last_sequence, state FROM run_state WHERE run_id = ?").get(runId);
+        return row ? { runId: row.run_id, lastSequence: row.last_sequence, state: row.state } : void 0;
+      }
+      upsertRunState(row) {
+        this.database.prepare(`
+      INSERT INTO run_state (run_id, last_sequence, state) VALUES (?, ?, ?)
+      ON CONFLICT(run_id) DO UPDATE SET last_sequence = excluded.last_sequence, state = excluded.state
+    `).run(row.runId, row.lastSequence, row.state);
+      }
+      insertDriveReceipt(receipt) {
+        validateDriveReceipt(receipt, "drive-receipt");
+        const canonical2 = kxmCanonicalJson(receipt);
+        if (Buffer.byteLength(canonical2, "utf8") > DRIVE_RECEIPT_MAX_BYTES) {
+          throw runtimeError("drive_receipt_invalid", receipt.driveId, `drive receipt exceeds ${DRIVE_RECEIPT_MAX_BYTES} bytes`);
+        }
+        const result = this.database.prepare(`
+      INSERT INTO drive_receipts (drive_id, run_id, project_id, opened_sequence, last_sequence, closed_at, schema, receipt)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(drive_id) DO NOTHING
+    `).run(
+          receipt.driveId,
+          receipt.runId,
+          receipt.projectId,
+          receipt.openedSequence,
+          receipt.lastSequence,
+          receipt.closedAt,
+          receipt.schema,
+          canonical2
+        );
+        return { inserted: Number(result.changes) === 1 };
+      }
+      driveReceipt(driveId) {
+        const row = this.database.prepare("SELECT receipt FROM drive_receipts WHERE drive_id = ?").get(driveId);
+        return row ? parseDriveReceipt(row.receipt) : void 0;
+      }
+      driveReceiptsForRun(runId, limit = 20) {
+        const rows = this.database.prepare(`
+      SELECT drive_id, receipt FROM drive_receipts WHERE run_id = ? ORDER BY closed_at DESC, drive_id DESC LIMIT ?
+    `).all(runId, limit);
+        return rows.map((row) => {
+          try {
+            return parseDriveReceipt(row.receipt);
+          } catch {
+            return { driveId: row.drive_id, divergence: "receipt unreadable" };
+          }
+        });
+      }
+      /** Insert a coordinator unless the (project, role, channel) slot is taken. */
+      insertCoordinatorIfAbsent(row) {
+        const result = this.database.prepare(`
+      INSERT OR IGNORE INTO coordinators
+        (coordinator_id, project_id, role, channel, ceiling_hash, config_revision, bound_at, schema, record)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          row.coordinatorId,
+          row.projectId,
+          row.role,
+          row.channel,
+          row.ceilingHash,
+          row.configRevision,
+          row.boundAt,
+          "kxm.coordinator.v1",
+          row.record
+        );
+        return Number(result.changes) === 1;
+      }
+      coordinatorById(coordinatorId) {
+        const row = this.database.prepare("SELECT * FROM coordinators WHERE coordinator_id = ?").get(coordinatorId);
+        return row ? coordinatorFromRow(row) : void 0;
+      }
+      coordinatorInSlot(projectId, role, channel) {
+        const row = this.database.prepare(`
+      SELECT * FROM coordinators WHERE project_id = ? AND role = ? AND channel = ?
+    `).get(projectId, role, channel);
+        return row ? coordinatorFromRow(row) : void 0;
+      }
+      /**
+       * Replace the coordinator holding a (project, role, channel) slot, guarded by
+       * the identity that is currently there. A rebind therefore cannot clobber a
+       * record that changed underneath it, and cannot leave two live identities for
+       * one slot.
+       */
+      replaceCoordinatorInSlot(expectedCoordinatorId, row) {
+        const result = this.database.prepare(`
+      UPDATE coordinators
+      SET coordinator_id = ?, ceiling_hash = ?, config_revision = ?, bound_at = ?, schema = ?, record = ?
+      WHERE project_id = ? AND role = ? AND channel = ? AND coordinator_id = ?
+    `).run(
+          row.coordinatorId,
+          row.ceilingHash,
+          row.configRevision,
+          row.boundAt,
+          "kxm.coordinator.v1",
+          row.record,
+          row.projectId,
+          row.role,
+          row.channel,
+          expectedCoordinatorId
+        );
+        return Number(result.changes) === 1;
+      }
+      /** Insert an intake message unless its idempotency slot is taken. */
+      insertIntakeMessageIfAbsent(row) {
+        const result = this.database.prepare(`
+      INSERT OR IGNORE INTO intake_messages
+        (message_id, project_id, coordinator_id, idempotency_key, content_hash, received_at, dispatch_state, schema, record)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          row.messageId,
+          row.projectId,
+          row.coordinatorId,
+          row.idempotencyKey,
+          row.contentHash,
+          row.receivedAt,
+          row.dispatchState,
+          "kxm.intake-message.v1",
+          row.record
+        );
+        return Number(result.changes) === 1;
+      }
+      intakeMessage(messageId) {
+        const row = this.database.prepare("SELECT * FROM intake_messages WHERE message_id = ?").get(messageId);
+        return row ? intakeFromRow(row) : void 0;
+      }
+      intakeBySlot(projectId, coordinatorId, idempotencyKey) {
+        const row = this.database.prepare(`
+      SELECT * FROM intake_messages WHERE project_id = ? AND coordinator_id = ? AND idempotency_key = ?
+    `).get(projectId, coordinatorId, idempotencyKey);
+        return row ? intakeFromRow(row) : void 0;
+      }
+      /**
+       * Intake rows in the given dispatch states, in arrival order (replay-safe).
+       *
+       * `rowid` gives same-store arrival order, which is what queue priority needs
+       * here. It is **not** a durable sequence: this repository backs stores up with
+       * `VACUUM INTO`, and a vacuum may renumber implicit rowids. An explicit
+       * immutable arrival sequence is tracked in the plan's schema-v6 follow-ups.
+       */
+      intakeInStates(projectId, states, limit = 100) {
+        if (states.length === 0) return [];
+        const placeholders = states.map(() => "?").join(", ");
+        const rows = this.database.prepare(`
+      SELECT * FROM intake_messages
+      WHERE project_id = ? AND dispatch_state IN (${placeholders})
+      ORDER BY rowid ASC
+      LIMIT ?
+    `).all(projectId, ...states, limit);
+        return rows.map(intakeFromRow);
+      }
+      /** Rewrite one intake row's dispatch state and record. Returns false when it raced away. */
+      updateIntakeDispatch(messageId, expectState, next) {
+        const result = this.database.prepare(`
+      UPDATE intake_messages SET dispatch_state = ?, record = ?, schema = ?
+      WHERE message_id = ? AND dispatch_state = ?
+    `).run(next.state, next.record, "kxm.intake-message.v1", messageId, expectState);
+        return Number(result.changes) === 1;
+      }
+      projectControl(projectId) {
+        const row = this.database.prepare("SELECT * FROM project_controls WHERE project_id = ?").get(projectId);
+        return row ? controlFromRow(row) : void 0;
+      }
+      putProjectControl(row) {
+        this.database.prepare(`
+      INSERT INTO project_controls (project_id, paused, reason, updated_at, actor, schema, record)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(project_id) DO UPDATE SET
+        paused = excluded.paused,
+        reason = excluded.reason,
+        updated_at = excluded.updated_at,
+        actor = excluded.actor,
+        schema = excluded.schema,
+        record = excluded.record
+    `).run(
+          row.projectId,
+          row.paused ? 1 : 0,
+          row.reason ?? null,
+          row.updatedAt,
+          row.actor,
+          "kxm.project-control.v1",
+          row.record
+        );
+      }
+      insertCapability(row) {
+        this.database.prepare(`
+      INSERT INTO attempt_capabilities (attempt_id, run_id, assignment_id, step_id, step_attempt, producer_id, capability_hash, state)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(row.attemptId, row.runId, row.assignmentId, row.stepId, row.stepAttempt, row.producerId, row.capabilityHash, row.state);
+      }
+      capabilityByHash(capabilityHash) {
+        return capabilityFromRow(this.database.prepare(`
+      SELECT attempt_id, run_id, assignment_id, step_id, step_attempt, producer_id, capability_hash, state
+      FROM attempt_capabilities WHERE capability_hash = ?
+    `).get(capabilityHash));
+      }
+      capabilityByAttempt(attemptId) {
+        return capabilityFromRow(this.database.prepare(`
+      SELECT attempt_id, run_id, assignment_id, step_id, step_attempt, producer_id, capability_hash, state
+      FROM attempt_capabilities WHERE attempt_id = ?
+    `).get(attemptId));
+      }
+      settleCapability(attemptId, state) {
+        const updated = this.database.prepare("UPDATE attempt_capabilities SET state = ? WHERE attempt_id = ?").run(state, attemptId);
+        if (Number(updated.changes) !== 1) {
+          throw runtimeError("capability_unknown", attemptId, "attempt capability does not exist");
+        }
+      }
+      insertGateAttempt(row) {
+        assertGateAttemptRow(row);
+        this.assertEventType(row.runId, row.intentEventId, ["effect.intent_recorded"]);
+        const capability = this.capabilityByAttempt(row.attemptId);
+        if (!capability || capability.runId !== row.runId || capability.assignmentId !== row.assignmentId || capability.stepId !== row.stepId || capability.stepAttempt !== row.stepAttempt) {
+          throw gateRowInvalid(row.attemptId, "gate attempt identity does not match attempt_capabilities");
+        }
+        this.database.prepare(`
+      INSERT INTO gate_attempts (
+        attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id, effect_id,
+        gate_id, gate_kind, expect, gate_definition_hash, registry_hash, run_plan_hash, control_project_key,
+        producer_id, intent_event_id, content_hash
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          row.attemptId,
+          row.runId,
+          row.projectId,
+          row.homeRuntimeId,
+          row.stepId,
+          row.stepAttempt,
+          row.assignmentId,
+          row.effectId,
+          row.gateId,
+          row.gateKind,
+          row.expect,
+          row.gateDefinitionHash,
+          row.registryHash,
+          row.runPlanHash,
+          row.controlProjectKey,
+          row.producerId,
+          row.intentEventId,
+          row.contentHash
+        );
+      }
+      insertGateObservation(row) {
+        assertGateObservationRow(row);
+        this.assertEventType(row.runId, row.recordedEventId, ["effect.observed", "effect.blocked_uncertain"]);
+        const attempt = this.gateAttempt(row.attemptId);
+        if (!attempt) throw gateRowInvalid(row.attemptId, "gate observation has no matching gate attempt");
+        assertSharedIdentity(row, attempt, row.observationId);
+        assertClosedGateObservation(attempt.gateKind, row, row.observationId);
+        this.database.prepare(`
+      INSERT INTO gate_observations (
+        observation_id, attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id, effect_id,
+        completeness, spawned, pid, exit_code, signal, exit_observed, close_observed, stop_cause, signals_attempted,
+        error_class, stdout_sha256, stdout_bytes, stdout_complete, stderr_sha256, stderr_bytes, stderr_complete,
+        checked_count, failed_count, elapsed_ms, started_at, finished_at, recorded_event_id, content_hash
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          row.observationId,
+          row.attemptId,
+          row.runId,
+          row.projectId,
+          row.homeRuntimeId,
+          row.stepId,
+          row.stepAttempt,
+          row.assignmentId,
+          row.effectId,
+          row.completeness,
+          row.spawned,
+          row.pid,
+          row.exitCode,
+          row.signal,
+          row.exitObserved,
+          row.closeObserved,
+          row.stopCause,
+          row.signalsAttempted,
+          row.errorClass,
+          row.stdoutSha256,
+          row.stdoutBytes,
+          row.stdoutComplete,
+          row.stderrSha256,
+          row.stderrBytes,
+          row.stderrComplete,
+          row.checkedCount,
+          row.failedCount,
+          row.elapsedMs,
+          row.startedAt,
+          row.finishedAt,
+          row.recordedEventId,
+          row.contentHash
+        );
+      }
+      insertGateEvidence(row) {
+        assertGateEvidenceRow(row);
+        this.assertEventType(row.runId, row.settledEventId, ["effect.settled"]);
+        const attempt = this.gateAttempt(row.attemptId);
+        if (!attempt) throw gateRowInvalid(row.attemptId, "gate evidence has no matching gate attempt");
+        assertSharedIdentity(row, attempt, row.evidenceId);
+        const observation = this.gateObservationForAttempt(row.attemptId);
+        if (!observation || observation.observationId !== row.observationId) {
+          throw gateRowInvalid(row.evidenceId, "gate evidence observation_id does not match the attempt observation");
+        }
+        this.database.prepare(`
+      INSERT INTO gate_evidence (
+        evidence_id, attempt_id, observation_id, run_id, project_id, home_runtime_id, step_id, step_attempt,
+        assignment_id, effect_id, evidence_key, kind, expect, outcome, settled_event_id, content_hash
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+          row.evidenceId,
+          row.attemptId,
+          row.observationId,
+          row.runId,
+          row.projectId,
+          row.homeRuntimeId,
+          row.stepId,
+          row.stepAttempt,
+          row.assignmentId,
+          row.effectId,
+          row.evidenceKey,
+          row.kind,
+          row.expect,
+          row.outcome,
+          row.settledEventId,
+          row.contentHash
+        );
+      }
+      gateAttempt(attemptId) {
+        const row = this.database.prepare(`
+      SELECT attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id, effect_id,
+        gate_id, gate_kind, expect, gate_definition_hash, registry_hash, run_plan_hash, control_project_key,
+        producer_id, intent_event_id, content_hash
+      FROM gate_attempts WHERE attempt_id = ?
+    `).get(attemptId);
+        return row ? gateAttemptFromSql(row) : void 0;
+      }
+      gateAttemptsForRun(runId) {
+        const rows = this.database.prepare(`
+      SELECT attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id, effect_id,
+        gate_id, gate_kind, expect, gate_definition_hash, registry_hash, run_plan_hash, control_project_key,
+        producer_id, intent_event_id, content_hash
+      FROM gate_attempts WHERE run_id = ? ORDER BY step_attempt ASC, attempt_id ASC
+    `).all(runId);
+        return rows.map(gateAttemptFromSql);
+      }
+      gateAttemptsForProject(projectId) {
+        const rows = this.database.prepare(`
+      SELECT attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id, effect_id,
+        gate_id, gate_kind, expect, gate_definition_hash, registry_hash, run_plan_hash, control_project_key,
+        producer_id, intent_event_id, content_hash
+      FROM gate_attempts WHERE project_id = ? ORDER BY run_id ASC, step_attempt ASC, attempt_id ASC
+    `).all(projectId);
+        return rows.map(gateAttemptFromSql);
+      }
+      issuedOrRevokedCapabilities() {
+        const rows = this.database.prepare(`
+      SELECT attempt_id, run_id, assignment_id, step_id, step_attempt, producer_id, capability_hash, state
+      FROM attempt_capabilities
+      WHERE state IN ('issued','revoked')
+      ORDER BY run_id ASC, step_attempt ASC, attempt_id ASC
+    `).all();
+        const mapped = [];
+        for (const row of rows) {
+          const capability = capabilityFromRow(row);
+          if (!capability) {
+            throw runtimeError("gate_recovery_corrupt", "attempt_capabilities", "issued or revoked capability row could not be read");
+          }
+          mapped.push(capability);
+        }
+        return mapped;
+      }
+      gateObservationForAttempt(attemptId) {
+        const row = this.database.prepare(`
+      SELECT observation_id, attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id,
+        effect_id, completeness, spawned, pid, exit_code, signal, exit_observed, close_observed, stop_cause,
+        signals_attempted, error_class, stdout_sha256, stdout_bytes, stdout_complete, stderr_sha256, stderr_bytes,
+        stderr_complete, checked_count, failed_count, elapsed_ms, started_at, finished_at, recorded_event_id, content_hash
+      FROM gate_observations WHERE attempt_id = ?
+    `).get(attemptId);
+        return row ? gateObservationFromSql(row) : void 0;
+      }
+      gateObservationsForRun(runId) {
+        const rows = this.database.prepare(`
+      SELECT observation_id, attempt_id, run_id, project_id, home_runtime_id, step_id, step_attempt, assignment_id,
+        effect_id, completeness, spawned, pid, exit_code, signal, exit_observed, close_observed, stop_cause,
+        signals_attempted, error_class, stdout_sha256, stdout_bytes, stdout_complete, stderr_sha256, stderr_bytes,
+        stderr_complete, checked_count, failed_count, elapsed_ms, started_at, finished_at, recorded_event_id, content_hash
+      FROM gate_observations WHERE run_id = ? ORDER BY step_attempt ASC, observation_id ASC
+    `).all(runId);
+        return rows.map(gateObservationFromSql);
+      }
+      gateEvidenceForRun(runId) {
+        const rows = this.database.prepare(`
+      SELECT evidence_id, attempt_id, observation_id, run_id, project_id, home_runtime_id, step_id, step_attempt,
+        assignment_id, effect_id, evidence_key, kind, expect, outcome, settled_event_id, content_hash
+      FROM gate_evidence WHERE run_id = ? ORDER BY step_attempt ASC, evidence_id ASC
+    `).all(runId);
+        return rows.map(gateEvidenceFromSql);
+      }
+      gateEvidenceForAttempt(attemptId) {
+        const row = this.database.prepare(`
+      SELECT evidence_id, attempt_id, observation_id, run_id, project_id, home_runtime_id, step_id, step_attempt,
+        assignment_id, effect_id, evidence_key, kind, expect, outcome, settled_event_id, content_hash
+      FROM gate_evidence WHERE attempt_id = ?
+    `).get(attemptId);
+        return row ? gateEvidenceFromSql(row) : void 0;
+      }
+      gateRowCounts(runId) {
+        const attempts = this.database.prepare("SELECT COUNT(*) AS n FROM gate_attempts WHERE run_id = ?").get(runId);
+        const observations = this.database.prepare("SELECT COUNT(*) AS n FROM gate_observations WHERE run_id = ?").get(runId);
+        const evidence = this.database.prepare("SELECT COUNT(*) AS n FROM gate_evidence WHERE run_id = ?").get(runId);
+        return { attempts: Number(attempts.n), observations: Number(observations.n), evidence: Number(evidence.n) };
+      }
+      assertEventType(runId, eventId, allowed) {
+        const row = this.database.prepare("SELECT run_id, event_type FROM events WHERE event_id = ?").get(eventId);
+        if (!row || row.run_id !== runId || !allowed.includes(row.event_type)) {
+          throw gateRowInvalid(eventId, `referenced event is not ${allowed.join("|")} for this run`);
+        }
+      }
+    };
+    SHA2562 = /^sha256:[a-f0-9]{64}$/;
+    OPAQUE = /^[a-z][a-z0-9]{1,15}_[A-Za-z0-9][A-Za-z0-9_-]{5,127}$/;
+    FORBIDDEN_TEXT_KEYS = /* @__PURE__ */ new Set(["stdout", "stderr", "error", "errorText", "stdoutText", "stderrText", "errorMessage", "message"]);
+    GATE_ATTEMPT_KEYS = [
+      "attemptId",
+      "runId",
+      "projectId",
+      "homeRuntimeId",
+      "stepId",
+      "stepAttempt",
+      "assignmentId",
+      "effectId",
+      "gateId",
+      "gateKind",
+      "expect",
+      "gateDefinitionHash",
+      "registryHash",
+      "runPlanHash",
+      "controlProjectKey",
+      "producerId",
+      "intentEventId",
+      "contentHash"
+    ];
+    GATE_OBSERVATION_KEYS = [
+      "observationId",
+      "attemptId",
+      "runId",
+      "projectId",
+      "homeRuntimeId",
+      "stepId",
+      "stepAttempt",
+      "assignmentId",
+      "effectId",
+      "completeness",
+      "spawned",
+      "pid",
+      "exitCode",
+      "signal",
+      "exitObserved",
+      "closeObserved",
+      "stopCause",
+      "signalsAttempted",
+      "errorClass",
+      "stdoutSha256",
+      "stdoutBytes",
+      "stdoutComplete",
+      "stderrSha256",
+      "stderrBytes",
+      "stderrComplete",
+      "checkedCount",
+      "failedCount",
+      "elapsedMs",
+      "startedAt",
+      "finishedAt",
+      "recordedEventId",
+      "contentHash"
+    ];
+    GATE_EVIDENCE_KEYS = [
+      "evidenceId",
+      "attemptId",
+      "observationId",
+      "runId",
+      "projectId",
+      "homeRuntimeId",
+      "stepId",
+      "stepAttempt",
+      "assignmentId",
+      "effectId",
+      "evidenceKey",
+      "kind",
+      "expect",
+      "outcome",
+      "settledEventId",
+      "contentHash"
+    ];
   }
 });
 
@@ -21970,9 +23929,9 @@ var init_engine_compile = __esm({
 });
 
 // plugins/kxm/src/engine-plan.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 function kxmSha256(input) {
-  return `sha256:${createHash12("sha256").update(input, "utf8").digest("hex")}`;
+  return `sha256:${createHash13("sha256").update(input, "utf8").digest("hex")}`;
 }
 function parseGateDefinition(raw, gateId, runId) {
   const value = asObject(raw, runId, `gates.definitions.${gateId}`);
@@ -22184,8 +24143,8 @@ var init_price_calc = __esm({
 });
 
 // plugins/kxm/src/prices.ts
-import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash14 } from "node:crypto";
+import { existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 function hashPriceCatalog(catalog) {
   const canonical2 = {
@@ -22206,7 +24165,7 @@ function hashPriceCatalog(catalog) {
       }))
     })).sort((a, b2) => a.id.localeCompare(b2.id))
   };
-  return createHash13("sha256").update(JSON.stringify(canonical2), "utf8").digest("hex");
+  return createHash14("sha256").update(JSON.stringify(canonical2), "utf8").digest("hex");
 }
 function parsePriceCatalog(text) {
   const parsed = (0, import_yaml3.parse)(text);
@@ -22297,7 +24256,7 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync11(join11(rootOrPath, ".kxm", "prices.yaml")) ? join11(rootOrPath, ".kxm", "prices.yaml") : existsSync11(join11(rootOrPath, "prices.yaml")) ? join11(rootOrPath, "prices.yaml") : existsSync11(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  const candidatePath = existsSync11(join11(rootOrPath, ".kxm", "prices.yaml")) ? join11(rootOrPath, ".kxm", "prices.yaml") : existsSync11(join11(rootOrPath, "prices.yaml")) ? join11(rootOrPath, "prices.yaml") : existsSync11(rootOrPath) && statSync2(rootOrPath).isFile() ? rootOrPath : void 0;
   if (!candidatePath || !existsSync11(candidatePath)) {
     return void 0;
   }
@@ -22762,7 +24721,7 @@ function loadRoutePolicy(root) {
   if (!existsSync14(path4)) return empty();
   const value = (0, import_yaml6.parse)(readFileSync12(path4, "utf8"));
   if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
-  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x2) => typeof x2 === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k2, v2]) => [k2, v2.filter((x2) => typeof x2 === "string")])) : {} };
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x2) => typeof x2 === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [] };
 }
 function updateRouteState(root, model, state) {
   return setRouteState(root, model, state);
@@ -22782,21 +24741,7 @@ function setRouteState(root, model, state, role, removeRole2 = false) {
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
     const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
-    const modelsDir = join14(root, ".kxm", "models");
-    let routeId2;
-    if (existsSync14(modelsDir)) {
-      for (const name of readdirSync4(modelsDir)) {
-        if (!name.endsWith(".yaml") || name === "inventory.yaml") continue;
-        const parsedModel = (0, import_yaml6.parse)(readFileSync12(join14(modelsDir, name), "utf8"));
-        if (parsedModel?.schema !== "kxm.model.v2") continue;
-        const vendor = typeof parsedModel.vendor === "string" ? parsedModel.vendor : "";
-        const named = typeof parsedModel.model === "string" ? parsedModel.model : "";
-        if (named === model || vendor && `${vendor}/${named}` === model) {
-          routeId2 = name.slice(0, -5);
-          break;
-        }
-      }
-    }
+    const routeId2 = routeIdForInventoryModel(root, model);
     if (!routeId2) throw new Error(`unknown route: no v2 model file matches '${model}'`);
     const existing = roster.findIndex((entry) => entry.route === routeId2 || entry.model === model);
     if (removeRole2) {
@@ -22817,6 +24762,24 @@ function setRouteState(root, model, state, role, removeRole2 = false) {
   writeFileSync10(join14(root, ".kxm", "routes.yaml"), (0, import_yaml6.stringify)(policy), "utf8");
   return policy;
 }
+function routeIdForInventoryModel(root, model) {
+  const modelsDir = join14(root, ".kxm", "models");
+  if (!existsSync14(modelsDir)) return void 0;
+  for (const name of readdirSync4(modelsDir)) {
+    if (!name.endsWith(".yaml") || name === "inventory.yaml") continue;
+    const parsedModel = (0, import_yaml6.parse)(readFileSync12(join14(modelsDir, name), "utf8"));
+    if (parsedModel?.schema !== "kxm.model.v2") continue;
+    const vendor = typeof parsedModel.vendor === "string" ? parsedModel.vendor : "";
+    const named = typeof parsedModel.model === "string" ? parsedModel.model : "";
+    if (named === model || vendor && `${vendor}/${named}` === model) return name.slice(0, -5);
+  }
+  return void 0;
+}
+function rolesForInventoryModel(root, inventoryId) {
+  const routeId2 = routeIdForInventoryModel(root, inventoryId);
+  if (!routeId2) return [];
+  return Object.entries(listRoleBindings(root)).filter(([, ids]) => ids.includes(routeId2)).map(([role]) => role);
+}
 function listRoleBindings(root) {
   const dir = join14(root, ".kxm", "roles");
   const result = {};
@@ -22828,10 +24791,6 @@ function listRoleBindings(root) {
   }
   return result;
 }
-function isRouteAdmitted(root, modelId2) {
-  const policy = loadRoutePolicy(root);
-  return policy.admitted.includes(modelId2) && !policy.disabled.includes(modelId2);
-}
 function listInventoryModels(root) {
   const path4 = join14(root, ".kxm", "models", "inventory.yaml");
   if (!existsSync14(path4)) return [];
@@ -22845,7 +24804,7 @@ var init_routes = __esm({
     import_yaml6 = __toESM(require_dist(), 1);
     init_role();
     RETIRED_POLICY = ".kxm/producers.yaml";
-    empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
+    empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [] });
   }
 });
 
@@ -22883,7 +24842,7 @@ var init_arbiter = __esm({
 });
 
 // plugins/kxm/src/memory.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync10, readdirSync as readdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync11 } from "node:fs";
 import { extname as extname2, join as join15, resolve as resolve10 } from "node:path";
 function parseFrontmatter(content) {
@@ -23020,7 +24979,7 @@ function createMemoryNote(repoRoot, summary, options = {}) {
   if (!VALID_SCOPES.has(scope)) {
     throw new Error(`invalid memory note scope: ${scope}; must be one of agent, project, run, operator`);
   }
-  const hex = randomUUID4().replaceAll("-", "").slice(0, 12);
+  const hex = randomUUID5().replaceAll("-", "").slice(0, 12);
   const id = `cand_${scope}_${hex}`;
   const record = {
     schema: MEMORY_SCHEMA,
@@ -23166,11 +25125,11 @@ var init_memory = __esm({
 });
 
 // plugins/kxm/src/skills.ts
-import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync14, renameSync as renameSync3, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync12 } from "node:fs";
+import { createHash as createHash15 } from "node:crypto";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readdirSync as readdirSync6, readFileSync as readFileSync14, renameSync as renameSync3, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync12 } from "node:fs";
 import { dirname as dirname10, join as join16 } from "node:path";
 function skillContentSha256(content) {
-  return createHash14("sha256").update(content, "utf8").digest("hex");
+  return createHash15("sha256").update(content, "utf8").digest("hex");
 }
 function skillIdFor(name, contentSha256) {
   const slug = name.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
@@ -23243,7 +25202,7 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync6(dir).filter((entry) => statSync2(join16(dir, entry)).isDirectory()).sort();
+  return readdirSync6(dir).filter((entry) => statSync3(join16(dir, entry)).isDirectory()).sort();
 }
 var import_yaml8, SKILL_CANDIDATE_SCHEMA, SKILL_EVALUATION_SCHEMA, SKILL_DECISION_SCHEMA, MAX_SKILL_NAME_CHARS, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_EVIDENCE_REFS, MAX_SKILL_MODELS, PROMOTION_REQUIRED_EVALUATIONS, SkillLifecycleError, SkillLifecycle;
 var init_skills = __esm({
@@ -23587,11 +25546,11 @@ var init_dispatch_context = __esm({
 });
 
 // plugins/kxm/src/artifacts-exist.ts
-import { lstatSync as lstatSync5, realpathSync as realpathSync4, statSync as statSync3 } from "node:fs";
-import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve11 } from "node:path";
+import { lstatSync as lstatSync5, realpathSync as realpathSync5, statSync as statSync4 } from "node:fs";
+import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve11 } from "node:path";
 function staysUnder(root, candidate) {
   const child = relative4(root, candidate);
-  return child === "" || !isAbsolute5(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  return child === "" || !isAbsolute6(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function verifyArtifactExists(rootInput, pathInput) {
   const lexicalRoot = resolve11(rootInput);
@@ -23602,12 +25561,12 @@ function verifyArtifactExists(rootInput, pathInput) {
   let realRoot;
   let realPath;
   try {
-    realRoot = realpathSync4(lexicalRoot);
+    realRoot = realpathSync5(lexicalRoot);
   } catch {
     return { ok: false, error: "artifact_unreadable", path: lexicalPath };
   }
   try {
-    realPath = realpathSync4(lexicalPath);
+    realPath = realpathSync5(lexicalPath);
   } catch {
     return { ok: false, error: "artifact_missing", path: lexicalPath };
   }
@@ -23619,7 +25578,7 @@ function verifyArtifactExists(rootInput, pathInput) {
     if (link.isSymbolicLink()) {
       return { ok: false, error: "artifact_outside_workspace_assets", path: lexicalPath };
     }
-    const artifact = statSync3(realPath);
+    const artifact = statSync4(realPath);
     if (!artifact.isFile()) return { ok: false, error: "artifact_not_file", path: lexicalPath };
     if (artifact.size < 1) return { ok: false, error: "artifact_empty", path: lexicalPath };
     return { ok: true, path: realPath, bytes: artifact.size };
@@ -24273,103 +26232,132 @@ var init_routing = __esm({
 // plugins/kxm/src/engine.ts
 import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 import { join as join17 } from "node:path";
-function selectorsNamedByRoutes(projectRoot, routeIds) {
-  const selectors = /* @__PURE__ */ new Set();
-  for (const routeId2 of routeIds) {
-    const file = join17(projectRoot, ".kxm", "models", `${routeId2}.yaml`);
-    if (!existsSync17(file)) continue;
-    let parsed;
-    try {
-      parsed = (0, import_yaml9.parse)(readFileSync15(file, "utf8"));
-    } catch {
-      continue;
-    }
-    const model = typeof parsed.model === "string" ? parsed.model : "";
-    const vendor = typeof parsed.vendor === "string" ? parsed.vendor : "";
-    const harness = typeof parsed.harness === "string" ? parsed.harness : "";
-    if (model) selectors.add(model);
-    if (vendor && model) selectors.add(`${vendor}/${model}`);
-    if (harness && model) selectors.add(`${harness}/${model}`);
+function readYamlFile(file) {
+  return readModelDocument(file);
+}
+function readModelDocument(file) {
+  if (!existsSync17(file)) return void 0;
+  try {
+    const parsed = (0, import_yaml9.parse)(readFileSync15(file, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
   }
-  return [...selectors];
 }
 function resolveProducerRoute(projectRoot, step, agentId) {
-  let agentModel;
-  const agentFile = join17(projectRoot, ".kxm", "agents", `${agentId}.yaml`);
-  if (existsSync17(agentFile)) {
-    try {
-      const parsed = (0, import_yaml9.parse)(readFileSync15(agentFile, "utf8"));
-      if (typeof parsed?.model === "string") {
-        agentModel = parsed.model;
-      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
-        const declared = parsed.model;
-        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
-        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
-        if (providerOk && modelOk) {
-          agentModel = `${declared.provider}/${declared.model}`;
-        } else {
-          return {
-            error: {
-              reason: "step_unsupported",
-              field: "model",
-              detail: "producer_route_unsupported: invalid model declaration"
-            }
-          };
-        }
-      }
-    } catch {
-    }
-  }
-  let selector = typeof step.model === "string" ? step.model : agentModel;
-  if (!selector) {
-    if (agentId === "implementer") {
-      selector = "xai/grok-4.6";
-    }
-  }
-  if (!selector) {
+  if ((step.kind === "agent" || step.kind === "moa") && step.model !== void 0) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: "producer_route_unsupported: agent or step has no model declared"
+        detail: "producer_route_unsupported: agent step model is not honored"
       }
     };
   }
-  const slash = selector.indexOf("/");
-  if (slash <= 0 || slash === selector.length - 1) {
+  const agent = readYamlFile(join17(projectRoot, ".kxm", "agents", `${agentId}.yaml`));
+  const role = typeof agent?.role === "string" ? agent.role : "";
+  if (!role) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: `producer_route_unsupported: invalid selector '${selector}'`
+        detail: "producer_route_unsupported: agent has no role"
       }
     };
   }
-  if (!isRouteAdmitted(projectRoot, selector)) {
+  const roleDoc = readYamlFile(join17(projectRoot, ".kxm", "roles", `${role}.yaml`));
+  const roster = Array.isArray(roleDoc?.roster) ? roleDoc.roster : void 0;
+  if (!roster) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: `producer_route_unsupported: model '${selector}' is not admitted`
+        detail: `producer_route_unsupported: role '${role}' has no roster`
       }
     };
   }
-  const role = agentId === "implementer" ? "writer" : agentId;
-  const roleBindings = listRoleBindings(projectRoot);
-  const roster = roleBindings[role];
-  const rosterSelectors = roster ? selectorsNamedByRoutes(projectRoot, roster) : void 0;
-  if (rosterSelectors && !rosterSelectors.includes(selector)) {
+  const policy = loadRoutePolicy(projectRoot);
+  for (const entry of roster) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const record = entry;
+    if (typeof record.route !== "string" || record.route.length === 0) continue;
+    const modelPath = join17(projectRoot, ".kxm", "models", `${record.route}.yaml`);
+    const doc = readModelDocument(modelPath);
+    if (!doc) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: model file '.kxm/models/${record.route}.yaml' is missing or unreadable`
+        }
+      };
+    }
+    if (doc.status !== "admitted") continue;
+    const modelName = typeof doc.model === "string" ? doc.model : "";
+    const vendor = typeof doc.vendor === "string" ? doc.vendor : "";
+    const harness = typeof doc.harness === "string" ? doc.harness : "";
+    if (!modelName || !vendor || !harness) continue;
+    const candidates = [modelName, `${vendor}/${modelName}`, `${harness}/${modelName}`];
+    const admittedSelector = candidates.find((candidate) => policy.admitted.includes(candidate));
+    const disabledSelector = candidates.find((candidate) => policy.disabled.includes(candidate));
+    if (!admittedSelector && disabledSelector) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: first admitted route '${record.route}' for role '${role}' is disabled`
+        }
+      };
+    }
+    const selector = admittedSelector ?? (modelName.includes("/") ? modelName : `${vendor}/${modelName}`);
+    if (policy.disabled.includes(selector)) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: first admitted route '${record.route}' for role '${role}' is disabled`
+        }
+      };
+    }
+    if (!policy.admitted.includes(selector)) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: model '${selector}' is not admitted`
+        }
+      };
+    }
+    const slash = selector.indexOf("/");
+    if (slash <= 0 || slash === selector.length - 1) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: invalid selector '${selector}'`
+        }
+      };
+    }
+    const permissions = Array.isArray(doc.permissions) ? doc.permissions.filter((item) => typeof item === "string") : [];
     return {
-      error: {
-        reason: "step_unsupported",
-        field: "model",
-        detail: `producer_route_unsupported: model '${selector}' not in role '${role}' roster`
-      }
+      provider: selector.slice(0, slash),
+      model: selector.slice(slash + 1),
+      selector,
+      harness,
+      routeId: record.route,
+      role,
+      permissions,
+      ...typeof record.effort === "string" ? { effort: record.effort } : {}
     };
   }
-  const provider = selector.slice(0, slash);
-  const model = selector.slice(slash + 1);
-  return { provider, model, selector };
+  return {
+    error: {
+      reason: "step_unsupported",
+      field: "model",
+      detail: `producer_route_unsupported: role '${role}' has no admitted route`
+    }
+  };
 }
 function unsupportedAgentStepTimeout(step, limitMs) {
   if (step.kind !== "agent" && step.kind !== "moa") return void 0;
@@ -24384,9 +26372,9 @@ function kxmLiveRunPrerequisites(bundle, workflowId, projectRoot) {
   const workflow = bundle.workflows.get(workflowId);
   if (!workflow) throw runtimeError("run_workflow_unknown", workflowId, `workflow ${workflowId} does not exist in this project`);
   const plan = compileKxmWorkflow({ id: workflowId, value: workflow.value, logicalPath: workflow.logicalPath });
-  const envelope = { plan, projectLimits: kxmProjectAdmissionLimits(bundle), gates: pinnedGatesForCompiledPlan(plan, bundle, projectRoot) };
+  const envelope2 = { plan, projectLimits: kxmProjectAdmissionLimits(bundle), gates: pinnedGatesForCompiledPlan(plan, bundle, projectRoot) };
   const prerequisites = [];
-  const limit = unsupportedLimit(envelope);
+  const limit = unsupportedLimit(envelope2);
   if (limit) prerequisites.push(limit);
   const visited = /* @__PURE__ */ new Set();
   const pending = [plan.entryStepId];
@@ -24398,8 +26386,8 @@ function kxmLiveRunPrerequisites(bundle, workflowId, projectRoot) {
     for (const transition2 of Object.values(step.transitions)) {
       if (transition2.to === "step") pending.push(transition2.target);
     }
-    const limitMs = envelope.projectLimits.agentStepTimeoutMs ?? KXM_DEFAULT_AGENT_STEP_TIMEOUT_MS;
-    const unsupported = step.kind === "gate" ? unsupportedGateStep(plan, step, envelope, { projectRoot }) ?? starterGatePrerequisite(step, envelope.gates, projectRoot) : unsupportedAgentStepTimeout(step, limitMs) ?? unsupportedStep(plan, step, "oneshot");
+    const limitMs = envelope2.projectLimits.agentStepTimeoutMs ?? KXM_DEFAULT_AGENT_STEP_TIMEOUT_MS;
+    const unsupported = step.kind === "gate" ? unsupportedGateStep(plan, step, envelope2, { projectRoot }) ?? starterGatePrerequisite(step, envelope2.gates, projectRoot) : unsupportedAgentStepTimeout(step, limitMs) ?? unsupportedStep(plan, step, "oneshot");
     if (unsupported) {
       prerequisites.push({ ...unsupported, stepId });
       continue;
@@ -24407,26 +26395,26 @@ function kxmLiveRunPrerequisites(bundle, workflowId, projectRoot) {
     if (step.kind !== "agent" && step.kind !== "moa") continue;
     const agentIds = step.assignments.allowedAgents.length > 0 ? step.assignments.allowedAgents : [step.agent];
     for (const agentId of agentIds) {
-      const agent = bundle.agents.get(agentId);
-      const harness = String(agent?.value.harness ?? bundle.project.value.defaultHarness ?? "pi");
+      const route = resolveProducerRoute(projectRoot, step, agentId);
+      if ("error" in route) {
+        const detail = route.error.detail === "producer_route_unsupported: agent step model is not honored" ? `${agentId}: agent step model is not honored; remove model from the step` : `${agentId}: ${route.error.detail}; set role in .kxm/agents/${agentId}.yaml and admit the route model with kxm routes admit --model <provider/model>`;
+        prerequisites.push({ ...route.error, stepId, detail });
+        continue;
+      }
+      const harness = route.harness;
       const permission = Object.values(step.repositories).includes("write") ? "edit" : "read-only";
       if (!BUILTIN_HARNESSES.some((entry) => entry.id === harness && entry.oneShot) || !oneShotPermissionArgs(harness, permission)) {
         prerequisites.push({ reason: "step_unsupported", stepId, field: "harness", detail: `${agentId}: ${harness} has no audited ${permission} one-shot profile; use a supported workflow or execute this work directly in ${harness}, without substituting another harness` });
         continue;
       }
-      const route = resolveProducerRoute(projectRoot, step, agentId);
-      if ("error" in route) {
-        prerequisites.push({ ...route.error, stepId, detail: `${agentId}: ${route.error.detail}; configure its model in .kxm/agents/${agentId}.yaml and admit the installed model with kxm routes admit --model <provider/model>` });
-        continue;
-      }
-      const writeRefusal = unsupportedLiveWrite(projectRoot, step, agentId, route.selector, envelope.projectLimits.maxConcurrentRuns);
+      const writeRefusal = unsupportedLiveWrite(projectRoot, step, route, envelope2.projectLimits.maxConcurrentRuns);
       if (writeRefusal) {
         prerequisites.push({ ...writeRefusal, stepId });
         continue;
       }
       const compatible = validateHarnessModelPair(harness, route);
       if (!compatible.valid) {
-        prerequisites.push({ reason: "step_unsupported", stepId, field: "model", detail: `${agentId}: ${compatible.message ?? `${harness} cannot run ${route.selector}`}; configure a model supported by ${harness} in .kxm/agents/${agentId}.yaml` });
+        prerequisites.push({ reason: "step_unsupported", stepId, field: "model", detail: `${agentId}: ${compatible.message ?? `${harness} cannot run ${route.selector}`}; configure a model supported by ${harness} on the role roster` });
       }
     }
   }
@@ -24449,11 +26437,11 @@ function starterGatePrerequisite(step, gates, projectRoot) {
   }
   return void 0;
 }
-function unsupportedLimit(envelope) {
-  if (envelope.plan.limits.maxAgentTimeMs !== void 0) {
+function unsupportedLimit(envelope2) {
+  if (envelope2.plan.limits.maxAgentTimeMs !== void 0) {
     return { reason: "limit_unsupported", field: "limits.maxAgentTimeMs", detail: "agent-time budget enforcement is not available in this slice" };
   }
-  if (envelope.projectLimits.maxAgentTimeMs !== void 0) {
+  if (envelope2.projectLimits.maxAgentTimeMs !== void 0) {
     return { reason: "limit_unsupported", field: "project.limits.maxAgentTimeMs", detail: "agent-time budget enforcement is not available in this slice" };
   }
   return void 0;
@@ -24499,25 +26487,7 @@ function unsupportedStep(plan, step, producerId) {
   }
   return void 0;
 }
-function readYamlRecord(path4) {
-  if (!existsSync17(path4)) return void 0;
-  try {
-    const parsed = (0, import_yaml9.parse)(readFileSync15(path4, "utf8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
-  } catch {
-    return void 0;
-  }
-  return void 0;
-}
-function agentHarness(projectRoot, agentId) {
-  const harness = readYamlRecord(join17(projectRoot, ".kxm", "agents", `${agentId}.yaml`))?.harness;
-  return typeof harness === "string" && harness.length > 0 ? harness : void 0;
-}
-function projectDefaultHarness(projectRoot) {
-  const harness = readYamlRecord(join17(projectRoot, ".kxm", "project.yaml"))?.defaultHarness;
-  return typeof harness === "string" && harness.length > 0 ? harness : "pi";
-}
-function unsupportedLiveWrite(projectRoot, step, agentId, selector, maxConcurrentRuns) {
+function unsupportedLiveWrite(projectRoot, step, route, maxConcurrentRuns) {
   if (!Object.values(step.repositories).some((access) => access === "write")) return void 0;
   if (step.assignments.maximum !== 1) {
     return {
@@ -24533,52 +26503,33 @@ function unsupportedLiveWrite(projectRoot, step, agentId, selector, maxConcurren
       detail: "live write steps require limits.maxConcurrentRuns of 1; concurrent runs share one checkout"
     };
   }
-  const harness = agentHarness(projectRoot, agentId) ?? projectDefaultHarness(projectRoot);
-  if (!oneShotWriterArgs(harness)) {
+  if (!oneShotWriterArgs(route.harness)) {
     return {
       reason: "step_unsupported",
       field: "repositories",
-      detail: `live write steps require an audited writer profile; ${harness} has none`
-    };
-  }
-  const rosterPath = join17(projectRoot, ".kxm", "roster.yaml");
-  if (!existsSync17(rosterPath)) return void 0;
-  const roster = readYamlRecord(rosterPath);
-  if (!roster || roster.schema !== "kxm.developer-roster.v1") {
-    return { reason: "step_unsupported", field: "model", detail: "live write steps require a readable kxm.developer-roster.v1" };
-  }
-  const routes = roster.routes;
-  const lineup = roster.lineup;
-  const writerIds = lineup && typeof lineup === "object" && !Array.isArray(lineup) ? lineup.writer : void 0;
-  if (!routes || typeof routes !== "object" || Array.isArray(routes) || !Array.isArray(writerIds)) {
-    return { reason: "step_unsupported", field: "model", detail: "developer roster has no writer lineup" };
-  }
-  const allowed = writerIds.some((id) => {
-    if (typeof id !== "string") return false;
-    const route = routes[id];
-    if (!route || typeof route !== "object" || Array.isArray(route)) return false;
-    const record = route;
-    if (record.harness !== harness || record.status !== "admitted") return false;
-    if (!Array.isArray(record.permissions) || !record.permissions.includes("edit")) return false;
-    const model = typeof record.model === "string" ? record.model : "";
-    const vendor = typeof record.vendor === "string" ? record.vendor : "";
-    return model === selector || vendor.length > 0 && `${vendor}/${model}` === selector;
-  });
-  if (!allowed) {
+      detail: `live write steps require an audited writer profile; ${route.harness} has none`
+    };
+  }
+  const writerIds = listRoleBindings(projectRoot).writer;
+  if (!Array.isArray(writerIds) || writerIds.length === 0) {
+    return { reason: "step_unsupported", field: "model", detail: "writer roster has no admitted edit route" };
+  }
+  const named = writerIds.includes(route.routeId);
+  if (!named || !route.permissions.includes("edit")) {
     return {
       reason: "step_unsupported",
       field: "model",
-      detail: `live write route ${selector} on ${harness} is not on the developer roster writer lineup`
+      detail: `live write route ${route.selector} on ${route.harness} is not an admitted edit route on the writer roster`
     };
   }
   return void 0;
 }
-function unsupportedGateStep(plan, step, envelope, context) {
+function unsupportedGateStep(plan, step, envelope2, context) {
   if (!step.gate) return { reason: "step_unsupported", field: "gate", detail: "gate step is missing gate id" };
-  if (envelope.gates.registry === null) {
+  if (envelope2.gates.registry === null) {
     return { reason: "step_unsupported", field: "gate", detail: `step ${step.id} refers to a gate but registry is null` };
   }
-  const definition = envelope.gates.definitions[step.gate];
+  const definition = envelope2.gates.definitions[step.gate];
   if (!definition) {
     return { reason: "step_unsupported", field: "gate", detail: `gate definition ${step.gate} not found in registry` };
   }
@@ -24684,7 +26635,7 @@ function unsupportedGateStep(plan, step, envelope, context) {
       return { reason: "gate_outcome_undeclared", field: "outcomes", detail: "step expects fail but missing required failure outcome; declare implementation-failure or failed" };
     }
   }
-  if (context && projectRuntimeKey(context.projectRoot) !== envelope.gates.controlRoot.projectKey) {
+  if (context && projectRuntimeKey(context.projectRoot) !== envelope2.gates.controlRoot.projectKey) {
     throw runtimeError("run_owner_mismatch", plan.workflowId, `gate control root does not match project`);
   }
   if (definition.kind === "artifacts-exist" && step.expect === "fail") {
@@ -24754,21 +26705,21 @@ var init_oneshot_producer = __esm({
 // plugins/kxm/src/hub-binding.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync16, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname11, isAbsolute as isAbsolute6, join as join18, resolve as resolve12 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute7, join as join18, resolve as resolve12 } from "node:path";
 function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute6(explicit)) throw new HubBindingError("local_state_root_not_absolute");
+    if (!isAbsolute7(explicit)) throw new HubBindingError("local_state_root_not_absolute");
     return resolve12(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join18(homedir5(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute7(localAppData) ? localAppData : join18(homedir5(), "AppData", "Local");
     return resolve12(base2, "KXM");
   }
   if (process.platform === "darwin") return resolve12(homedir5(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join18(homedir5(), ".local", "state");
+  const base = xdgState && isAbsolute7(xdgState) ? xdgState : join18(homedir5(), ".local", "state");
   return resolve12(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
@@ -24904,9 +26855,9 @@ var init_logger = __esm({
 
 // plugins/kxm/src/runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash15, createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash16, createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { chmodSync as chmodSync4, existsSync as existsSync19, lstatSync as lstatSync6, mkdirSync as mkdirSync13, readFileSync as readFileSync17, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname12, isAbsolute as isAbsolute7, join as join19 } from "node:path";
+import { dirname as dirname12, isAbsolute as isAbsolute8, join as join19 } from "node:path";
 function kxmSupervisorTokenFile(paths) {
   return join19(paths.runtimeDir, "supervisor.token");
 }
@@ -24947,6 +26898,9 @@ function readRecentSupervisorError(paths) {
     return void 0;
   }
 }
+function kxmSupervisorRecordIsLive(record) {
+  return supervisorStatusOf(record).running;
+}
 function supervisorStatusOf(record) {
   if (!record) return { running: false };
   const heartbeatAgeMs = Date.now() - Date.parse(record.heartbeatAt);
@@ -25098,7 +27052,6 @@ var init_runtime_supervisor = __esm({
     init_sqlite();
     init_runtime_service();
     init_oneshot_producer();
-    init_routes();
     init_engine();
     init_runtime_owner();
     init_client();
@@ -25284,7 +27237,7 @@ function refuseDryRun(io, jsonMode, command, reason) {
 }
 function printWorker(runtime, worker, payload, text, outcome) {
   const sessionId = runtime.env.KXM_SESSION_ID?.trim();
-  const envelope = workerResult(worker, {
+  const envelope2 = workerResult(worker, {
     ...payload,
     summary: text,
     ...outcome ? { outcome } : {},
@@ -25292,7 +27245,7 @@ function printWorker(runtime, worker, payload, text, outcome) {
   });
   if (!runtime.dryRun) {
     try {
-      const safeEnvelope = redactCliValue(envelope);
+      const safeEnvelope = redactCliValue(envelope2);
       appendTelemetry(telemetryPath(runtime.dirs.logs), makeTelemetryEvent({
         envelope: safeEnvelope,
         ...sessionId ? { sessionId } : {},
@@ -25305,7 +27258,7 @@ function printWorker(runtime, worker, payload, text, outcome) {
     } catch {
     }
   }
-  print(runtime.io, runtime.json, envelope, text);
+  print(runtime.io, runtime.json, envelope2, text);
 }
 function hostMode(runtime) {
   try {
@@ -25561,8 +27514,8 @@ var init_model_inventory = __esm({
 });
 
 // plugins/kxm/src/permission.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { createHash as createHash17 } from "node:crypto";
 import { existsSync as existsSync24, mkdtempSync, mkdirSync as mkdirSync20, readFileSync as readFileSync24, rmSync as rmSync8, writeFileSync as writeFileSync19 } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname as dirname14, join as join28, resolve as resolve19, sep as sep4 } from "node:path";
@@ -25766,7 +27719,7 @@ function kxmProseEntries(resource) {
   return entries;
 }
 function valueHash(canonicalValue) {
-  return `sha256:${createHash16("sha256").update(canonicalValue, "utf8").digest("hex")}`;
+  return `sha256:${createHash17("sha256").update(canonicalValue, "utf8").digest("hex")}`;
 }
 function rankDirection(rank, baseValue, candidateValue) {
   const base = JSON.parse(baseValue);
@@ -26035,7 +27988,7 @@ function gitEnvironment2() {
   return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
 }
 function git(root, args) {
-  const result = spawnSync4("git", ["-C", root, ...args], {
+  const result = spawnSync5("git", ["-C", root, ...args], {
     encoding: "utf8",
     env: gitEnvironment2(),
     timeout: 15e3,
@@ -26053,7 +28006,7 @@ function git(root, args) {
   return result.stdout;
 }
 function gitBuffer(root, args) {
-  const result = spawnSync4("git", ["-C", root, ...args], {
+  const result = spawnSync5("git", ["-C", root, ...args], {
     env: gitEnvironment2(),
     timeout: 15e3,
     windowsHide: true,
@@ -26086,7 +28039,7 @@ function loadKxmProjectAtRevision(root, revision, options = {}) {
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
   const shadow = mkdtempSync(join28(tmpdir(), "kxm-permission-base-"));
   const shadowResolved = resolve19(shadow);
-  const shadowMembersDir = `.kxm-shadow-members-${createHash16("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
+  const shadowMembersDir = `.kxm-shadow-members-${createHash17("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
     for (const path4 of paths) {
       const segments = path4.split("/");
@@ -26251,7 +28204,7 @@ function loadBaseProjectDeclarations(projectFile) {
   return members;
 }
 function initShadowGitRoot(directory) {
-  const result = spawnSync4("git", ["-c", "init.defaultBranch=main", "init", "--quiet", directory], {
+  const result = spawnSync5("git", ["-c", "init.defaultBranch=main", "init", "--quiet", directory], {
     encoding: "utf8",
     env: gitEnvironment2(),
     timeout: 1e4,
@@ -26306,7 +28259,7 @@ var init_permission = __esm({
 });
 
 // plugins/kxm/src/repair.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync3,
@@ -26322,7 +28275,7 @@ import {
   rmSync as rmSync9,
   writeFileSync as writeFileSync20
 } from "node:fs";
-import { dirname as dirname15, isAbsolute as isAbsolute8, join as join29, relative as relative5, resolve as resolve20 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute9, join as join29, relative as relative5, resolve as resolve20 } from "node:path";
 function resourceKindForTemplatePath(path4) {
   if (path4 === ".kxm/project.yaml") return "project";
   if (path4 === ".kxm/gates.yaml") return "gate-registry";
@@ -26409,7 +28362,7 @@ function backupFile(projectRoot, portablePath2) {
   return join29(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
-  return path4.startsWith(".kxm/") && path4 !== KXM_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute8(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
+  return path4.startsWith(".kxm/") && path4 !== KXM_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute9(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
 }
 function readRegularBounded(file, label) {
   const stat = lstatSync7(file);
@@ -26596,7 +28549,7 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join29(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join29(root, `.operation-${operation.operationId}-${randomUUID11()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
@@ -26640,7 +28593,7 @@ function readOperation(projectRoot, schemasDir) {
     seen.add(folded);
     prior = entry.path;
   }
-  if (!isAbsolute8(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
+  if (!isAbsolute9(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
   validateOperationIntent(projectRoot, operation);
   return operation;
 }
@@ -26788,7 +28741,7 @@ function createOperation(projectRoot, kind, rendered, files, sourceTemplateRevis
   const root = resolve20(projectRoot);
   const operationWithoutHash = {
     schema: "kxm.init-operation.v1",
-    operationId: `op_${randomUUID10().replaceAll("-", "")}`,
+    operationId: `op_${randomUUID11().replaceAll("-", "")}`,
     kind,
     projectRoot: root,
     projectId: rendered.projectId,
@@ -26852,7 +28805,7 @@ function destinationSha(projectRoot, path4) {
   return kxmContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
-  const nonce = randomUUID10();
+  const nonce = randomUUID11();
   const source = join29(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
   const target = join29(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
@@ -26906,7 +28859,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join29(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const temporary = join29(directory, `${temporaryPrefix}${randomUUID11()}.tmp`);
   const mode = existsSync25(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
@@ -27182,7 +29135,7 @@ function commitKxmInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join29(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  const retired = join29(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID11()}`);
   renameSync7(transaction, retired);
   syncDirectory2(projectRoot);
   rmSync9(retired, { recursive: true, force: true });
@@ -27213,7 +29166,7 @@ var init_repair = __esm({
 });
 
 // plugins/kxm/src/init.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 import { existsSync as existsSync26 } from "node:fs";
 import { basename as basename6, join as join30 } from "node:path";
 function initIssue(code, file, message) {
@@ -27227,7 +29180,7 @@ function normalizedProjectName(root, requested) {
   return name;
 }
 function generatedProjectId(requested) {
-  const id = requested?.trim() || `prj_${randomUUID11().replaceAll("-", "")}`;
+  const id = requested?.trim() || `prj_${randomUUID12().replaceAll("-", "")}`;
   if (!PROJECT_ID.test(id) || id.length > 144) {
     throw new KxmConfigError([initIssue("project_id_invalid", ".kxm/project.yaml", "project ID must satisfy the kxm.project.v1 opaque ID grammar and use the prj_ prefix")]);
   }
@@ -28059,29 +30012,29 @@ function runEngineNotice(runId, defaultHarness, prerequisites) {
     "These are local Runtime runs, not webhook workflows; use kxm runs, not kxm workflow get."
   ].join("\n");
 }
-function resolveKxmRunTarget(runtime, workflow, forTask = false, envelope = {}, allowDefaultWorkflow = false) {
+function resolveKxmRunTarget(runtime, workflow, forTask = false, envelope2 = {}, allowDefaultWorkflow = false) {
   if (runtime.workspaceFlag !== void 0) {
     print(runtime.io, runtime.json, {
       ok: false,
       command: "run",
       error: "workspace_option_unsupported",
-      ...envelope
+      ...envelope2
     }, "kxm run discovers the authoritative project from the current directory; --workspace is not supported");
     return 2;
   }
   if (!workflow && !forTask && !allowDefaultWorkflow) {
-    print(runtime.io, runtime.json, { ok: false, command: "run", error: "workflow_required", ...envelope }, "usage: kxm run <workflow> [prompt]");
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "workflow_required", ...envelope2 }, "usage: kxm run <workflow> [prompt]");
     return 2;
   }
   const projectRoot = discoverKxmProjectRoot(runtime.cwd);
   if (!projectRoot) {
-    print(runtime.io, runtime.json, { ok: false, command: "run", error: "project_required", ...envelope }, "kxm run requires a KXM project (run kxm init first)");
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "project_required", ...envelope2 }, "kxm run requires a KXM project (run kxm init first)");
     return 1;
   }
   const bundle = loadKxmProject(projectRoot, {});
   const workflowId = workflow ?? String(bundle.project.value.defaultWorkflow ?? "default");
   if (!bundle.workflows.has(workflowId)) {
-    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow: workflowId, ...envelope }, `workflow ${workflowId} does not exist in this project`);
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_workflow_unknown", workflow: workflowId, ...envelope2 }, `workflow ${workflowId} does not exist in this project`);
     return 1;
   }
   const defaultHarness = String(bundle.project.value.defaultHarness ?? "pi");
@@ -28101,9 +30054,9 @@ ${prerequisites.map((item) => `${item.stepId ?? workflowId}: ${item.detail}`).jo
   return { projectRoot, workflowId, configRevision: bundle.configRevision, defaultHarness, prerequisites };
 }
 async function cmdKxmRun(runtime, workflow, promptParts, forTask = false, call) {
-  const envelope = call?.brief !== void 0 ? { brief: call.brief } : {};
+  const envelope2 = call?.brief !== void 0 ? { brief: call.brief } : {};
   try {
-    const target = resolveKxmRunTarget(runtime, workflow, forTask, envelope, call?.allowDefaultWorkflow === true);
+    const target = resolveKxmRunTarget(runtime, workflow, forTask, envelope2, call?.allowDefaultWorkflow === true);
     if (typeof target === "number") return target;
     const { projectRoot } = target;
     if (runtime.dryRun) {
@@ -28111,7 +30064,7 @@ async function cmdKxmRun(runtime, workflow, promptParts, forTask = false, call)
         ok: true,
         command: "run",
         dryRun: true,
-        ...envelope,
+        ...envelope2,
         ...target
       }, `run plan: workflow ${target.workflowId} at ${target.configRevision.slice(0, 19)}\u2026 (no run created)`);
       return 0;
@@ -28128,7 +30081,7 @@ async function cmdKxmRun(runtime, workflow, promptParts, forTask = false, call)
     print(runtime.io, runtime.json, {
       ok: true,
       command: "run",
-      ...envelope,
+      ...envelope2,
       execution: {
         status: "not_started",
         mode: "live",
@@ -28150,10 +30103,10 @@ ${runEngineNotice(run.runId, target.defaultHarness, target.prerequisites)}`);
     return 0;
   } catch (error) {
     if (error instanceof KxmConfigError) {
-      print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_failed", issues: error.issues, ...envelope }, `run failed: ${error.message}`);
+      print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_failed", issues: error.issues, ...envelope2 }, `run failed: ${error.message}`);
       return 1;
     }
-    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_io_failed", ...envelope }, "run failed because a local operation did not complete");
+    print(runtime.io, runtime.json, { ok: false, command: "run", error: "run_io_failed", ...envelope2 }, "run failed because a local operation did not complete");
     return 1;
   }
 }
@@ -28210,8 +30163,9 @@ async function cmdKxmRunStatus(runtime, runId) {
     print(
       runtime.io,
       runtime.json,
-      { ok: true, command: "runs status", run, ...drive !== void 0 ? { drive } : {} },
-      `${formatRunStatusLine(run, drive)}${driveLine ? `
+      { ok: true, command: "runs status", projectRoot, run, ...drive !== void 0 ? { drive } : {} },
+      `${formatRunStatusLine(run, drive)}
+root ${projectRoot}${driveLine ? `
 ${driveLine}` : ""}`
     );
     return 0;
@@ -28479,8 +30433,7 @@ async function cmdModelsScreen(runtime) {
   try {
     while (true) {
       const policy = loadRoutePolicy(runtime.dirs.workdir);
-      const roleBindings = listRoleBindings(runtime.dirs.workdir);
-      runtime.io.stdout(models.map((m2, i) => `${i + 1}. ${m2} [${policy.admitted.includes(m2) ? "admitted" : policy.disabled.includes(m2) ? "disabled" : "unset"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m2)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
+      runtime.io.stdout(models.map((m2, i) => `${i + 1}. ${m2} [${policy.admitted.includes(m2) ? "admitted" : policy.disabled.includes(m2) ? "disabled" : "unset"}] roles:${rolesForInventoryModel(runtime.dirs.workdir, m2).join(",") || "-"}`).join("\n") + "\n");
       const command = (await ask("[a]dmit [d]isable [r]ole-add [x]ole-remove [q]uit: ")).trim().toLowerCase();
       if (command === "q" || command === "quit") return 0;
       const index = Number.parseInt((await ask("model number: ")).trim(), 10) - 1;
@@ -28502,7 +30455,8 @@ async function cmdModelsScreen(runtime) {
 }
 async function cmdRouteList(runtime) {
   const policy = loadRoutePolicy(runtime.dirs.workdir);
-  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy }, [...policy.admitted.map((x2) => `admitted ${x2}`), ...policy.disabled.map((x2) => `disabled ${x2}`)].join("\n") || "no route decisions");
+  const membership = Object.entries(listRoleBindings(runtime.dirs.workdir)).flatMap(([role, ids]) => ids.map((id) => `${role} ${id}`));
+  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy, membership }, [...policy.admitted.map((x2) => `admitted ${x2}`), ...policy.disabled.map((x2) => `disabled ${x2}`), ...membership].join("\n") || "no route decisions");
   return 0;
 }
 async function cmdRouteCount(runtime) {
@@ -33215,7 +35169,7 @@ init_runtime_supervisor();
 init_runtime_store();
 init_workflow();
 init_types();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync20, readFileSync as readFileSync19 } from "node:fs";
 import { join as join22, resolve as resolve14 } from "node:path";
 import { createInterface } from "node:readline";
@@ -33649,7 +35603,7 @@ async function cmdRoleResume(runtime, runId, ruling) {
           JSON.stringify(resumeResult.run),
           runId
         );
-        const journalId = randomUUID5();
+        const journalId = randomUUID6();
         const journalPayload = {
           id: journalId,
           runId,
@@ -33695,7 +35649,7 @@ async function cmdRoleResume(runtime, runId, ruling) {
 // plugins/kxm/src/cli/workflows.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 init_sqlite();
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
 import { join as join24, resolve as resolve16 } from "node:path";
 
@@ -33943,7 +35897,7 @@ init_redact();
 // plugins/kxm/src/github-watch.ts
 init_redact();
 init_workflow();
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 async function fetchWithTimeout(fetchImpl, input, init, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), Math.max(1, timeoutMs));
@@ -34045,7 +35999,7 @@ async function watchGithubChecks(input) {
     "workflow.signal": input.signalKey
   };
   const explicitDeliveryId = input.deliveryId?.trim();
-  const deliveryGeneration = randomUUID6();
+  const deliveryGeneration = randomUUID7();
   let deliveryId = explicitDeliveryId || `github-watch:${deliveryGeneration}:pr-${input.pr}`;
   const deliver = async (status, summary, evidence) => {
     const boundedEvidence = Object.fromEntries(Object.entries({ ...contextEvidence, ...evidence }).slice(0, 64));
@@ -34786,7 +36740,7 @@ async function cmdWorkflowModify(runtime, workflowId, options) {
 }
 async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   const definitionId = definitionIdArg || runtime.env.KXM_WORKFLOW_ID?.trim();
-  const deliveryId = String(options.deliveryId || `cli-${randomUUID7()}`);
+  const deliveryId = String(options.deliveryId || `cli-${randomUUID8()}`);
   const event = options.event;
   const payloadFlag = options.payload ?? "{}";
   if (!definitionId) {
@@ -34917,7 +36871,7 @@ async function cmdSignal(runtime, runId, signalKey, status, summary, evidenceArg
       printWorker(runtime, worker, { ok: true, command: "signal", dryRun: true, runId, signalKey, status, summary, evidence }, "would post signal to KXM run");
       return 0;
     }
-    const deliveryId2 = String(deliveryIdFlag || `cli-signal:${randomUUID7()}`);
+    const deliveryId2 = String(deliveryIdFlag || `cli-signal:${randomUUID8()}`);
     try {
       const supervisor = await ensureKxmSupervisor({ env: runtime.env });
       const posted = await kxmRuntimeRequest(
@@ -34953,7 +36907,7 @@ async function cmdSignal(runtime, runId, signalKey, status, summary, evidenceArg
     printWorker(runtime, worker, { ok: true, command: "signal", dryRun: true, runId, signalKey, status, summary, evidence }, "would post signed signal");
     return 0;
   }
-  const deliveryId = String(deliveryIdFlag || `cli-signal:${randomUUID7()}`);
+  const deliveryId = String(deliveryIdFlag || `cli-signal:${randomUUID8()}`);
   try {
     const posted = await postWorkflowSignal({
       serverUrl: runtime.serverUrl,
@@ -35213,10 +37167,10 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
       supported: true,
       prerequisites: [
         "Run kxm init in the target repository if needed, then install the exact template with the suggested command. If that workflow ID already exists, stop and review it; the commands below apply only to a newly installed template, not an existing definition with potentially different agents or permissions.",
-        ...roles.map((role) => `Set harness: ${role.harness} and model: <your authenticated compatible model selector> in .kxm/agents/${role.agent}.yaml. Admit that exact selector in .kxm/routes.yaml and ensure it is not disabled; this recommendation does not choose a model or change routing.`),
+        ...roles.map((role) => `Set role on .kxm/agents/${role.agent}.yaml to a role whose roster names an admitted route for harness ${role.harness}. Admit that route's selector in .kxm/routes.yaml and ensure it is not disabled; this recommendation does not choose a model or change routing.`),
         ...writeStep ? [
           `Keep each writer step at assignments.maximum: 1 and set limits.maxConcurrentRuns: 1 in .kxm/project.yaml; the live ${selected.id} writer profile requires a lone writer in the checkout.`,
-          `If .kxm/roster.yaml exists, it must be readable kxm.developer-roster.v1 with a lineup.writer route matching harness: ${selected.id} and the selected writer model (model or vendor/model), status: admitted, and permissions containing edit.`,
+          `The writer role roster must name a route whose harness is ${selected.id}, whose status is admitted, and whose permissions contain edit.`,
           "Configure the test gate in .kxm/gates.yaml with kind: command and argv for this repository's actual verification command. A scaffold/example command or simulation is not evidence that the implementation works."
         ] : [],
         `Validate the installed workflow with kxm gate validate --file .kxm/workflows/${bestPattern.id}.yaml and the project configuration with kxm init --dry-run before creating a run.`
@@ -35232,7 +37186,7 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 
 // plugins/kxm/src/task-manager.ts
 var import_yaml13 = __toESM(require_dist(), 1);
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { existsSync as existsSync23, mkdirSync as mkdirSync17, readFileSync as readFileSync22, readdirSync as readdirSync8, writeFileSync as writeFileSync17 } from "node:fs";
 import { join as join25, resolve as resolve17 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
@@ -35250,7 +37204,7 @@ function taskFilePath(repoRoot, taskId) {
   return join25(tasksDirectory(repoRoot), `${taskId}.yaml`);
 }
 function createGoal(repoRoot, input, options = {}) {
-  const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
+  const id = `goal_${randomUUID9().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
     schema: GOAL_SCHEMA,
@@ -35286,7 +37240,7 @@ function listGoals(repoRoot) {
   return goals.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
 function createTask(repoRoot, input, options = {}) {
-  const id = `task_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
+  const id = `task_${randomUUID9().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
     schema: TASK_SCHEMA,
@@ -35367,7 +37321,7 @@ init_engine_compile();
 
 // plugins/kxm/src/studio-layout.ts
 import { createServer } from "node:http";
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 var STUDIO_LAYOUT_SCHEMA = "kxm.studio-layout.v1";
 function generateStudioLayout(plan, state) {
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -35630,7 +37584,7 @@ function createStudioServer(options = {}) {
         }));
         return;
       }
-      const mutationId = `mut_${randomUUID9().replaceAll("-", "").slice(0, 12)}`;
+      const mutationId = `mut_${randomUUID10().replaceAll("-", "").slice(0, 12)}`;
       if (options.onMutation) {
         try {
           const outcome = await options.onMutation(command, args);
@@ -36904,7 +38858,7 @@ init_project();
 init_repo_root();
 init_harness();
 init_types();
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 var PLUGIN_SUPPORTED_HARNESSES = Object.freeze(["pi", "omp", "claude"]);
 async function cmdPluginInstall(runtime, options) {
   const repoRoot = findKxmRepoRoot(import.meta.url);
@@ -36943,7 +38897,7 @@ async function cmdPluginInstall(runtime, options) {
           detail: `would install kxm plugin into pi: ${command} ${args.join(" ")}`
         });
       } else {
-        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, args) : spawnSync5(command, args, { encoding: "utf8", windowsHide: true, env: runtime.env });
+        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, args) : spawnSync6(command, args, { encoding: "utf8", windowsHide: true, env: runtime.env });
         if (run.error || run.status !== 0 && run.status !== null) {
           results.push({
             harness: "pi",
@@ -36974,7 +38928,7 @@ async function cmdPluginInstall(runtime, options) {
           detail: `would install kxm plugin into omp: ${command} ${args.join(" ")}`
         });
       } else {
-        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, args) : spawnSync5(command, args, { encoding: "utf8", windowsHide: true, env: runtime.env });
+        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, args) : spawnSync6(command, args, { encoding: "utf8", windowsHide: true, env: runtime.env });
         if (run.error || run.status !== 0 && run.status !== null) {
           results.push({
             harness: "omp",
@@ -37009,9 +38963,9 @@ async function cmdPluginInstall(runtime, options) {
         if (runtime.io.spawnSync) {
           runtime.io.spawnSync(command, marketplaceArgs);
         } else {
-          spawnSync5(command, marketplaceArgs, { encoding: "utf8", windowsHide: true, env: runtime.env });
+          spawnSync6(command, marketplaceArgs, { encoding: "utf8", windowsHide: true, env: runtime.env });
         }
-        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, installArgs) : spawnSync5(command, installArgs, { encoding: "utf8", windowsHide: true, env: runtime.env });
+        const run = runtime.io.spawnSync ? runtime.io.spawnSync(command, installArgs) : spawnSync6(command, installArgs, { encoding: "utf8", windowsHide: true, env: runtime.env });
         if (run.error || run.status !== 0 && run.status !== null) {
           results.push({
             harness: "claude",
@@ -37132,25 +39086,27 @@ async function cmdDocsServe(runtime, options = {}) {
 
 // plugins/kxm/src/cli/lanes.ts
 init_project_config();
+init_runtime_store();
 init_runtime_supervisor();
 init_types();
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { chmodSync as chmodSync6, existsSync as existsSync30, mkdirSync as mkdirSync24, readFileSync as readFileSync29, writeFileSync as writeFileSync22 } from "node:fs";
 import { basename as basename8, dirname as dirname17, join as join36, resolve as resolve24 } from "node:path";
 var LANE_SCHEMA = "kxm.lanes.v1";
 var SHA_RE = /^[a-f0-9]{40,64}$/;
 var TIMESTAMP_RE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?Z$/;
 var SETTLED_RUN = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+var LANE_RUN_LIST_LIMIT = 1e4;
 function lanesFile(runtime) {
   return join36(runtime.dirs.state, "lanes.json");
 }
-function gitEnv() {
+function gitEnv2() {
   return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
 }
 function git2(cwd, args) {
-  const result = spawnSync6("git", ["-C", cwd, ...args], {
+  const result = spawnSync7("git", ["-C", cwd, ...args], {
     encoding: "utf8",
-    env: gitEnv(),
+    env: gitEnv2(),
     timeout: 3e4,
     windowsHide: true
   });
@@ -37373,6 +39329,61 @@ async function projectedRunStatus(runtime, projectRoot, runId, allowStart) {
 function isSettled(status) {
   return SETTLED_RUN.has(status);
 }
+async function laneStoreRuns(runtime, lanePath) {
+  const project = await Promise.resolve().then(() => (init_project(), project_exports));
+  const request = project.kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest;
+  const handle = await attachKxmSupervisor({ env: runtime.env });
+  const projectId = () => String(loadKxmProject(lanePath, {}).project.value.id);
+  if (handle) {
+    try {
+      const result = await request(
+        handle,
+        "GET",
+        `/v1/projects/${encodeURIComponent(projectId())}/runs?projectRoot=${encodeURIComponent(lanePath)}&limit=${LANE_RUN_LIST_LIMIT}`
+      );
+      const runs = Array.isArray(result.runs) ? result.runs : [];
+      return runs.flatMap((run) => {
+        if (!run || typeof run !== "object" || Array.isArray(run)) return [];
+        const record = run;
+        if (typeof record.runId !== "string" || record.runId.length === 0) return [];
+        const status = typeof record.status === "string" && record.status.length > 0 ? record.status : "unknown";
+        return [{ runId: record.runId, status }];
+      });
+    } catch {
+    }
+  }
+  const eventsPath = kxmProjectRunEventsPath(lanePath, runtime.env);
+  if (!existsSync30(eventsPath)) return void 0;
+  const store = new KxmRunEventStore(eventsPath);
+  try {
+    return store.runsForProject(projectId(), LANE_RUN_LIST_LIMIT).map((run) => ({ runId: run.runId, status: run.status }));
+  } finally {
+    store.close();
+  }
+}
+async function refuseIfLaneStoreRunsOpen(runtime, unit, command) {
+  const loaded = loadLanes(runtime, command);
+  if (typeof loaded === "number") return loaded;
+  const lane = loaded.lanes[unit];
+  if (!lane) return void 0;
+  let runs;
+  try {
+    runs = await laneStoreRuns(runtime, lane.path);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : "run list failed";
+    return refuse(runtime, command, "lane_run_open", `lane ${unit} runs could not be read: ${detail.slice(0, 200)}`, { unit });
+  }
+  if (!runs) return void 0;
+  const unsettled = runs.filter((run) => !isSettled(run.status)).map((run) => run.runId);
+  if (unsettled.length === 0) return void 0;
+  return refuse(
+    runtime,
+    command,
+    "lane_run_open",
+    `lane ${unit} run ${unsettled.join(", ")} is unsettled`,
+    { unit, runIds: unsettled }
+  );
+}
 async function refuseIfLaneRunOpen(runtime, unit, command) {
   const loaded = loadLanes(runtime, command);
   if (typeof loaded === "number") return loaded;
@@ -37483,11 +39494,43 @@ async function cmdLaneStatus(runtime, unit) {
   print(
     runtime.io,
     runtime.json,
-    { ok: true, command, lane: { ...view, status: runStatus } },
-    `${formatLaneLine(view)} status=${runStatus}`
+    { ok: true, command, root: record.path, lane: { ...view, status: runStatus } },
+    `${formatLaneLine(view)} status=${runStatus} root=${record.path}`
   );
   return 0;
 }
+async function unregisterLaneRoot(runtime, projectRoot, force) {
+  const body = force ? { projectRoot, force: true } : { projectRoot };
+  try {
+    const project = await Promise.resolve().then(() => (init_project(), project_exports));
+    const request = project.kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest;
+    const post = async (handle2) => {
+      await request(handle2, "POST", "/v1/projects/unregister", body);
+    };
+    const handle = await attachKxmSupervisor({ env: runtime.env });
+    if (handle) {
+      await post(handle);
+      return void 0;
+    }
+    const paths = kxmRuntimePaths({ env: runtime.env });
+    if (!existsSync30(paths.registryDb)) return void 0;
+    const registry = new KxmRuntimeRegistry(paths.registryDb);
+    let outcome;
+    try {
+      outcome = registry.unregisterProjectIfIdle(projectRoot, kxmSupervisorRecordIsLive);
+    } finally {
+      registry.close();
+    }
+    if (outcome === "supervisor_live") {
+      const live = await attachKxmSupervisor({ env: runtime.env });
+      if (!live) return "runtime supervisor is live but could not be reached";
+      await post(live);
+    }
+    return void 0;
+  } catch (error) {
+    return error instanceof Error ? error.message : "lane root could not be unregistered";
+  }
+}
 async function cmdLaneDrop(runtime, unit, options = {}) {
   const command = "lane drop";
   const invalid = refuseUnit(runtime, command, unit);
@@ -37509,16 +39552,23 @@ async function cmdLaneDrop(runtime, unit, options = {}) {
         return refuse(runtime, command, "lane_dirty", `lane ${unit} has ${dirty} uncommitted change(s)`, { unit, dirty });
       }
     }
+    const listed = await refuseIfLaneStoreRunsOpen(runtime, unit, command);
+    if (listed !== void 0) return listed;
     const open = await refuseIfLaneRunOpen(runtime, unit, command);
     if (open !== void 0) return open;
   }
   if (runtime.dryRun) {
     printPlan(runtime, { command, unit, branchKept: record.branch }, [
+      { action: "delete", target: `runtime registry ${record.path}` },
       { action: "delete", target: record.path },
       { action: "write", target: lanesFile(runtime) }
     ], `drop lane ${unit}; branch ${record.branch} is not deleted`);
     return 0;
   }
+  const unregistered = await unregisterLaneRoot(runtime, record.path, force);
+  if (unregistered !== void 0) {
+    return refuse(runtime, command, "lane_unregister_failed", `lane ${unit} could not be unregistered: ${unregistered.slice(0, 300)}`, { unit });
+  }
   if (existsSync30(record.path)) {
     const removed = git2(root, ["worktree", "remove", ...force ? ["--force"] : [], record.path]);
     if (removed.status !== 0) {
@@ -37629,7 +39679,7 @@ function cmdLand(runtime, options = {}) {
 // plugins/kxm/src/cli/assign.ts
 init_project_config();
 init_types();
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { existsSync as existsSync31 } from "node:fs";
 import { join as join38 } from "node:path";
 var kxmAssignCliSeams = {};
@@ -37715,7 +39765,7 @@ async function cmdAssign(runtime, subcommand, args) {
     return 0;
   }
   const spawn6 = kxmAssignCliSeams.spawn ?? ((commandName, commandArgs, options) => {
-    const result2 = spawnSync7(commandName, commandArgs, {
+    const result2 = spawnSync8(commandName, commandArgs, {
       cwd: options.cwd,
       stdio: options.stdio,
       env: options.env,
@@ -37733,7 +39783,7 @@ async function cmdAssign(runtime, subcommand, args) {
 
 // plugins/kxm/src/cli/hub.ts
 init_redact();
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 import { existsSync as existsSync37, mkdirSync as mkdirSync28, readFileSync as readFileSync35, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync25 } from "node:fs";
 import { join as join48, resolve as resolve27 } from "node:path";
 init_hub_env();
@@ -46177,7 +48227,7 @@ var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 // plugins/kxm/src/tui.ts
 import { mkdirSync as mkdirSync25 } from "node:fs";
 import { join as join43, resolve as resolve26, dirname as dirname19 } from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 
 // packages/core/tui/src/types/surface.ts
 var KXM_TUI_LIMITS = Object.freeze({
@@ -46322,7 +48372,7 @@ init_sqlite();
 init_telemetry();
 import { existsSync as existsSync32, readdirSync as readdirSync11, readFileSync as readFileSync30 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { isAbsolute as isAbsolute9, join as join42, resolve as resolve25 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join42, resolve as resolve25 } from "node:path";
 var DEFAULT_BUSY_TIMEOUT_MS = 5e3;
 var RUNTIME_PROJECT_KEY = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
 function processExists2(pid) {
@@ -46461,19 +48511,19 @@ function resolveKxmStateRoot(stateDir, options) {
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute9(explicit) && existsSync32(resolve25(explicit))) {
+  if (explicit && isAbsolute10(explicit) && existsSync32(resolve25(explicit))) {
     return resolve25(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute9(localAppData) ? localAppData : join42(homedir6(), "AppData", "Local");
+    base = localAppData && isAbsolute10(localAppData) ? localAppData : join42(homedir6(), "AppData", "Local");
     base = resolve25(base, "KXM");
   } else if (process.platform === "darwin") {
     base = resolve25(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute9(xdgState) ? xdgState : join42(homedir6(), ".local", "state");
+    base = xdgState && isAbsolute10(xdgState) ? xdgState : join42(homedir6(), ".local", "state");
     base = resolve25(base, "kxm");
   }
   if (existsSync32(base)) return base;
@@ -46734,16 +48784,16 @@ function applyMeshTuiKey(view, key, itemCount = 0) {
 function copyToClipboard(text) {
   try {
     if (process.platform === "darwin") {
-      const proc = spawnSync8("pbcopy", { input: text, encoding: "utf8", windowsHide: true });
+      const proc = spawnSync9("pbcopy", { input: text, encoding: "utf8", windowsHide: true });
       return proc.status === 0;
     }
     if (process.platform === "win32") {
-      const proc = spawnSync8("clip", { input: text, encoding: "utf8", windowsHide: true });
+      const proc = spawnSync9("clip", { input: text, encoding: "utf8", windowsHide: true });
       return proc.status === 0;
     }
-    const wl = spawnSync8("wl-copy", [text], { encoding: "utf8", windowsHide: true });
+    const wl = spawnSync9("wl-copy", [text], { encoding: "utf8", windowsHide: true });
     if (wl.status === 0) return true;
-    const xclip = spawnSync8("xclip", ["-selection", "clipboard"], { input: text, encoding: "utf8", windowsHide: true });
+    const xclip = spawnSync9("xclip", ["-selection", "clipboard"], { input: text, encoding: "utf8", windowsHide: true });
     return xclip.status === 0;
   } catch {
     return false;
@@ -46751,7 +48801,7 @@ function copyToClipboard(text) {
 }
 function spawnDegradeWorktree(repoRoot, runId, options) {
   const runner = options?.execFn ?? ((cmd, args) => {
-    const res = spawnSync8(cmd, args, {
+    const res = spawnSync9(cmd, args, {
       cwd: repoRoot,
       encoding: "utf8",
       windowsHide: true,
@@ -47535,8 +49585,8 @@ async function runMeshTui(input) {
 }
 
 // plugins/kxm/src/session-work.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { spawnSync as spawnSync10 } from "node:child_process";
+import { randomUUID as randomUUID13 } from "node:crypto";
 import { existsSync as existsSync33, mkdirSync as mkdirSync26, readFileSync as readFileSync31, renameSync as renameSync8, writeFileSync as writeFileSync23 } from "node:fs";
 import { join as join44 } from "node:path";
 init_hub_binding();
@@ -47596,10 +49646,10 @@ function formatShipLine(ship) {
 }
 function readGitShip(cwd) {
   try {
-    const dirty = spawnSync9("git", ["-C", cwd, "status", "--porcelain"], { encoding: "utf8", windowsHide: true });
+    const dirty = spawnSync10("git", ["-C", cwd, "status", "--porcelain"], { encoding: "utf8", windowsHide: true });
     if (dirty.status !== 0) return void 0;
     const isDirty = dirty.stdout.trim().length > 0;
-    const upstream = spawnSync9("git", ["-C", cwd, "rev-list", "--count", "@{u}..HEAD"], { encoding: "utf8", windowsHide: true });
+    const upstream = spawnSync10("git", ["-C", cwd, "rev-list", "--count", "@{u}..HEAD"], { encoding: "utf8", windowsHide: true });
     if (upstream.status === 0) {
       return {
         dirty: isDirty,
@@ -47607,9 +49657,9 @@ function readGitShip(cwd) {
       };
     }
     for (const baseRef of ["origin/HEAD", "main", "origin/main", "master", "origin/master"]) {
-      const mb = spawnSync9("git", ["-C", cwd, "merge-base", baseRef, "HEAD"], { encoding: "utf8", windowsHide: true });
+      const mb = spawnSync10("git", ["-C", cwd, "merge-base", baseRef, "HEAD"], { encoding: "utf8", windowsHide: true });
       if (mb.status === 0 && mb.stdout.trim()) {
-        const count = spawnSync9("git", ["-C", cwd, "rev-list", "--count", `${mb.stdout.trim()}..HEAD`], { encoding: "utf8", windowsHide: true });
+        const count = spawnSync10("git", ["-C", cwd, "rev-list", "--count", `${mb.stdout.trim()}..HEAD`], { encoding: "utf8", windowsHide: true });
         if (count.status === 0) {
           return {
             dirty: isDirty,
@@ -47717,7 +49767,7 @@ function writeCachedSessionBrief(stateDir, brief) {
   try {
     mkdirSync26(stateDir, { recursive: true, mode: 448 });
     const file = join44(stateDir, "session-brief.json");
-    const tmp = `${file}.tmp.${randomUUID12().slice(0, 8)}`;
+    const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
     writeFileSync23(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
     renameSync8(tmp, file);
   } catch {
@@ -48588,16 +50638,16 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync35(join48(stateDir, file), "utf8"));
+      const envelope2 = JSON.parse(readFileSync35(join48(stateDir, file), "utf8"));
       recoveries.push({
         file,
-        reason: envelope.reason,
-        agentName: envelope.agentName,
-        project: envelope.project,
-        createdAt: envelope.createdAt,
-        runId: envelope.runId ?? void 0,
-        stageId: envelope.stageId ?? void 0,
-        freshSession: envelope.freshSession === true
+        reason: envelope2.reason,
+        agentName: envelope2.agentName,
+        project: envelope2.project,
+        createdAt: envelope2.createdAt,
+        runId: envelope2.runId ?? void 0,
+        stageId: envelope2.stageId ?? void 0,
+        freshSession: envelope2.freshSession === true
       });
     } catch {
       recoveries.push({ file, error: "invalid_recovery_envelope" });
@@ -48752,7 +50802,7 @@ Session token: ${sessionToken}
   return 0;
 }
 async function cmdSessionStart(runtime, options) {
-  const id = options.id?.trim() || `session_${randomUUID13().replaceAll("-", "").slice(0, 12)}`;
+  const id = options.id?.trim() || `session_${randomUUID14().replaceAll("-", "").slice(0, 12)}`;
   const workflowId = options.workflow?.trim();
   const mix = options.mix?.trim();
   if (workflowId && mix) {
@@ -48811,9 +50861,9 @@ init_redact();
 init_telemetry();
 init_routing();
 init_prices();
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import { createHash as createHash19 } from "node:crypto";
-import { existsSync as existsSync44, mkdtempSync as mkdtempSync3, readFileSync as readFileSync41, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync44, mkdtempSync as mkdtempSync3, readFileSync as readFileSync40, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename11, extname as extname3, join as join54, resolve as resolve32 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
@@ -48822,7 +50872,7 @@ import { createInterface as createInterface3 } from "node:readline";
 init_routing();
 init_protocol();
 init_relevance();
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import { existsSync as existsSync38, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join49, relative as relative7, resolve as resolve28 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
@@ -49039,7 +51089,7 @@ function groupRoutingRecords(records, options = {}) {
     }
     const candidateKind = isCandidate ? classifyCandidateKind(group.stepId, group.agentRole) : void 0;
     const safeSlug = group.stepId.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 16) || "step";
-    const keyHash = createHash17("sha256").update(`${group.workflowHash}:${group.stepId}:${group.agentRole}:${group.promptHash}`).digest("hex").slice(0, 10);
+    const keyHash = createHash18("sha256").update(`${group.workflowHash}:${group.stepId}:${group.agentRole}:${group.promptHash}`).digest("hex").slice(0, 10);
     const candidateId = isCandidate && candidateKind ? `cand_${candidateKind.replace(/-/g, "_")}_${safeSlug}_${keyHash}` : void 0;
     keyed.push({
       key: group.key,
@@ -49668,8 +51718,8 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 init_safety_integrity();
-import { spawnSync as spawnSync10 } from "node:child_process";
-import { existsSync as existsSync41, mkdirSync as mkdirSync30, readFileSync as readFileSync38, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
+import { spawnSync as spawnSync11 } from "node:child_process";
+import { existsSync as existsSync41, mkdirSync as mkdirSync30, readFileSync as readFileSync38, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync6 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { join as join51, resolve as resolve30 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
@@ -49744,7 +51794,7 @@ function parseSshConfig(configPath) {
     return [];
   }
 }
-function resolveSshHostG(host, execFn = spawnSync10) {
+function resolveSshHostG(host, execFn = spawnSync11) {
   try {
     const result = execFn("ssh", ["-G", host], { encoding: "utf-8" });
     if (result.status !== 0 || !result.stdout) {
@@ -49810,7 +51860,7 @@ function buildSshArgs(options) {
   args.push(options.host);
   return args;
 }
-function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync10) {
+function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync11) {
   const resolvedDir = ensureSocketDir(socketDir);
   const controlPath = join51(resolvedDir, "%C");
   try {
@@ -49822,7 +51872,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
     return false;
   }
 }
-function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync10) {
+function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync11) {
   const resolvedDir = ensureSocketDir(socketDir);
   const controlPath = join51(resolvedDir, "%C");
   try {
@@ -49836,7 +51886,7 @@ function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function executeSshRun(params) {
   const startTime = Date.now();
-  const execSyncFn = params.execFn ?? spawnSync10;
+  const execSyncFn = params.execFn ?? spawnSync11;
   if (params.action === "info") {
     if (params.host) {
       const hostInfo = resolveSshHostG(params.host, execSyncFn);
@@ -50277,7 +52327,7 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 // plugins/kxm/src/completion-install.ts
 import { existsSync as existsSync42, mkdirSync as mkdirSync31, readFileSync as readFileSync39, writeFileSync as writeFileSync27 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { basename as basename10, delimiter, dirname as dirname23, isAbsolute as isAbsolute10, join as join52, resolve as resolve31 } from "node:path";
+import { basename as basename10, delimiter, dirname as dirname23, isAbsolute as isAbsolute11, join as join52, resolve as resolve31 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -50403,7 +52453,7 @@ ${line}
 }
 function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
-  if (argv1 && isAbsolute10(argv1)) {
+  if (argv1 && isAbsolute11(argv1)) {
     const dir = dirname23(argv1);
     if (existsSync42(join52(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
@@ -50444,8 +52494,7 @@ ${line}
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
 init_routes();
-import { createHash as createHash18 } from "node:crypto";
-import { existsSync as existsSync43, mkdirSync as mkdirSync32, readFileSync as readFileSync40, writeFileSync as writeFileSync28 } from "node:fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync32, writeFileSync as writeFileSync28 } from "node:fs";
 import { dirname as dirname24, join as join53 } from "node:path";
 var ADMITTED_GUIDE_BINDINGS = Object.freeze({
   "anthropic/claude-fable-5.1": { harness: "claude", provider: "anthropic", model: "fable" },
@@ -50790,13 +52839,12 @@ var WRITER_ROLE_PATTERN = /(writer|implementer|scaffold|backend|frontend|sdk-int
 function isWriterRole(roleSlug) {
   return WRITER_ROLE_PATTERN.test(roleSlug);
 }
-function agentDocument(roleSlug, stage, binding) {
+function agentDocument(roleSlug, stage) {
   const writer = isWriterRole(roleSlug);
   return {
     schema: "kxm.agent.v1",
     purpose: `${stage.domain} (workflow-guide ${stage.title}; candidate verification is the operator's responsibility)`,
-    harness: binding.harness,
-    model: { provider: binding.provider, model: binding.model },
+    role: roleSlug,
     tools: { preset: writer ? "workspace-writer" : "read-only" },
     defaultRepositoryAccess: writer ? "none" : "read",
     repositories: { control: writer ? "write" : "read" },
@@ -50827,19 +52875,62 @@ function workflowDocument(workflow) {
     steps
   };
 }
+var GUIDE_PI_EVIDENCE_SOURCE = "plans/evidence/route-guide-qwen-pi.md";
+var GUIDE_PI_EVIDENCE_SHA256 = "109f39728b251dd0565e275ae689a6e1d9b889a488d996b157d500c538115759";
+var GUIDE_PI_NOTE = {
+  harness: "pi",
+  vendor: "openrouter",
+  model: "qwen/qwen3-coder-plus",
+  reason: "Qwen has no supported native harness on this runner, and the operator admitted that exact model for guided setup.",
+  provingCommand: "pi auth check --provider openrouter"
+};
+var GUIDE_PI_EVIDENCE_NOTE = `---
+schema: "kxm.doc.v1"
+id: "RES-GUIDE-QWEN-PI"
+type: "research"
+title: "Research: guided setup Pi Qwen origin"
+project: "kxm"
+status: "approved"
+owner: "@operator"
+created: "2026-09-26"
+updated: "2026-09-26"
+authority: "evidence"
+confidence: "verified"
+summary: "Guided setup pins every Pi model origin to this note so a later project.yaml edit cannot change the hash."
+tags: ["routing", "qwen", "pi", "init-guide"]
+related: []
+details:
+  research_status: "complete"
+  target_decision_date: "2026-09-26"
+---
+
+# route-guide-qwen-pi
+
+Dated 2026-09-26. Route ids are the guided role slugs. Harness \`${GUIDE_PI_NOTE.harness}\`. Model id \`${GUIDE_PI_NOTE.model}\`. Vendor \`${GUIDE_PI_NOTE.vendor}\`. Admitted because ${GUIDE_PI_NOTE.reason} Auth was proved with \`${GUIDE_PI_NOTE.provingCommand}\`.
+`;
+function guidePiNoteMatches(binding) {
+  return binding.harness === GUIDE_PI_NOTE.harness && binding.provider === GUIDE_PI_NOTE.vendor && binding.model === GUIDE_PI_NOTE.model;
+}
 function renderGuideSetupFiles(projectRoot, plan) {
-  const projectYaml = join53(projectRoot, ".kxm", "project.yaml");
-  const projectOrigin = existsSync43(projectYaml) ? { source: ".kxm/project.yaml", sha256: createHash18("sha256").update(readFileSync40(projectYaml)).digest("hex") } : void 0;
   const files = [];
   const roleStages = /* @__PURE__ */ new Map();
   for (const workflow of plan.workflows) {
     for (const stage of workflow.stages) roleStages.set(stage.role, stage);
   }
+  let evidenceQueued = false;
   for (const [role, binding] of [...plan.agents.entries()].sort(([a], [b2]) => a.localeCompare(b2))) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     const routeId2 = role.replaceAll("_", "-");
     const writer = isWriterRole(role);
+    const piMatch = binding.harness === "pi" && guidePiNoteMatches(binding);
+    if (binding.harness === "pi" && !piMatch) {
+      files.push({
+        path: join53(projectRoot, ".kxm", "agents", `${role}.yaml`),
+        content: (0, import_yaml18.stringify)(agentDocument(role, stage))
+      });
+      continue;
+    }
     const modelDocument = {
       schema: "kxm.model.v2",
       id: routeId2,
@@ -50849,10 +52940,19 @@ function renderGuideSetupFiles(projectRoot, plan) {
       status: "admitted",
       permissions: [writer ? "edit" : "read-only"]
     };
-    if (binding.harness === "pi" && projectOrigin) modelDocument.origin = projectOrigin;
+    if (piMatch) {
+      modelDocument.origin = { source: GUIDE_PI_EVIDENCE_SOURCE, sha256: GUIDE_PI_EVIDENCE_SHA256 };
+      if (!evidenceQueued) {
+        files.push({
+          path: join53(projectRoot, GUIDE_PI_EVIDENCE_SOURCE),
+          content: GUIDE_PI_EVIDENCE_NOTE
+        });
+        evidenceQueued = true;
+      }
+    }
     files.push({
       path: join53(projectRoot, ".kxm", "agents", `${role}.yaml`),
-      content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
+      content: (0, import_yaml18.stringify)(agentDocument(role, stage))
     });
     files.push({
       path: join53(projectRoot, ".kxm", "models", `${routeId2}.yaml`),
@@ -50931,7 +53031,7 @@ init_types();
 init_repo_root();
 function cliSpawn(runtime, command, args, extra) {
   if (runtime.io.spawnSync) return runtime.io.spawnSync(command, args);
-  const result = spawnSync11(command, [...args], {
+  const result = spawnSync12(command, [...args], {
     encoding: "utf8",
     windowsHide: true,
     shell: process.platform === "win32",
@@ -50978,7 +53078,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync44(step.path) ? createHash19("sha256").update(readFileSync41(step.path)).digest("hex") : "missing";
+          const actual = existsSync44(step.path) ? createHash19("sha256").update(readFileSync40(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -51261,7 +53361,7 @@ async function cmdValidate(runtime, fileFlag) {
     return 1;
   }
   try {
-    const raw = file ? readFileSync41(file, "utf8") : inline;
+    const raw = file ? readFileSync40(file, "utf8") : inline;
     if (explicitFile && file && !raw.trimStart().startsWith("[")) {
       const value = parseRestrictedYaml2(raw, file);
       const issues = new KxmSchemaRegistry().validate("workflow", value, file);
@@ -51511,7 +53611,7 @@ async function maybeOfferCompletionInstall(runtime) {
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
     if (rcFile && existsSync44(rcFile)) {
       try {
-        if (readFileSync41(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync40(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }