@kontextmind/kxm 0.7.128 → 0.7.131

package/plugins/kxm/dist/runtime.js

@@ -15636,21 +15636,9 @@ function coreTemplate(projectId, projectName, variant) {
   ]);
   if (variant === "v4-registry") {
     const coordinator = files.get(".kxm/agents/coordinator.yaml");
-    if (coordinator) {
-      files.set(".kxm/agents/coordinator.yaml", {
-        ...coordinator,
-        harness: "claude",
-        model: { provider: "anthropic", model: "fable" }
-      });
-    }
+    if (coordinator) files.set(".kxm/agents/coordinator.yaml", { ...coordinator, role: "planner" });
     const implementer = files.get(".kxm/agents/implementer.yaml");
-    if (implementer) {
-      files.set(".kxm/agents/implementer.yaml", {
-        ...implementer,
-        harness: "grok",
-        model: { provider: "xai", model: "grok-4.6" }
-      });
-    }
+    if (implementer) files.set(".kxm/agents/implementer.yaml", { ...implementer, role: "writer" });
     const workflow = files.get(".kxm/workflows/default.yaml");
     if (workflow) {
       const limits = { ...workflow.limits };
@@ -17486,7 +17474,7 @@ function readTemplateProvenance(registry, root) {
   }
   return value;
 }
-function listNamedResources(registry, root, directory, logicalDirectory, kind, replacedId) {
+function listNamedResources(registry, root, directory, logicalDirectory, kind, replacedId, collected) {
   const resources = /* @__PURE__ */ new Map();
   if (!existsSync3(directory)) return resources;
   const stat = lstatSync(directory);
@@ -17525,7 +17513,10 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind, r
       else throw error;
     }
   }
-  if (issues.length > 0) throw new KxmConfigError(issues);
+  if (issues.length > 0) {
+    if (collected) collected.push(...issues);
+    else throw new KxmConfigError(issues);
+  }
   return resources;
 }
 function valuesOf(object, field) {
@@ -17789,6 +17780,9 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
     for (const repositoryId of Object.keys(objectValue(step.repositories) ?? {})) {
       if (!repositories.has(repositoryId)) issues.push(issue3("reference", "repository_unknown", file, `${stepId} references unknown repository ${repositoryId}`));
     }
+    if ((kind === "agent" || kind === "moa") && step.model !== void 0) {
+      issues.push(issue3("semantic", "producer_route_unsupported", file, `${stepId} model is not honored; remove model from the step`));
+    }
     selectorCandidates(step.model, models, file, `${stepId}.model`, issues);
     const assignment = objectValue(step.assignments);
     const declaredAgents = assignment ? names(assignment.allowedAgents) : [];
@@ -17971,7 +17965,7 @@ function validateModelReferences(models, issues) {
   };
   for (const id of models.keys()) walk(id, []);
 }
-function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, writerRole) {
+function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, roles = /* @__PURE__ */ new Map()) {
   const issues = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate) => Boolean(candidate));
   const repositoryIds = /* @__PURE__ */ new Set();
@@ -18012,84 +18006,84 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   const defaultHarness = stringValue(project.value.defaultHarness) ?? DEFAULT_HARNESS;
   if (!harnesses.has(defaultHarness)) issues.push(issue3("reference", "harness_unknown", project.logicalPath, `defaultHarness ${defaultHarness} is not registered`));
   for (const agent of agents.values()) {
+    if (agent.value.model !== void 0 || agent.value.harness !== void 0) {
+      issues.push(issue3("semantic", "retired_agent_routing_fields", agent.logicalPath, "routing resolves from role; remove model and harness"));
+    }
     validateToolPolicy(agent, objectValue(agent.value.tools), "tools", issues);
     const executor = stringValue(agent.value.executor);
     if (executor && !executors.has(executor)) issues.push(issue3("reference", "executor_unknown", agent.logicalPath, `executor ${executor} is not registered`));
-    const harness = stringValue(agent.value.harness) ?? defaultHarness;
-    if (!harnesses.has(harness)) issues.push(issue3("reference", "harness_unknown", agent.logicalPath, `harness ${harness} is not registered`));
     const preset = stringValue(objectValue(agent.value.tools)?.preset);
     if (preset && !presets.has(preset)) issues.push(issue3("reference", "tool_preset_unknown", agent.logicalPath, `tool preset ${preset} is not registered`));
     for (const repositoryId of Object.keys(objectValue(agent.value.repositories) ?? {})) {
       if (!repositoryIds.has(repositoryId)) issues.push(issue3("reference", "repository_unknown", agent.logicalPath, `references unknown repository ${repositoryId}`));
     }
-    const candidates = selectorCandidates(agent.value.model, models, agent.logicalPath, "model", issues);
-    const declaredHarness = stringValue(agent.value.harness);
-    if (declaredHarness && harnesses.has(declaredHarness)) {
-      for (const candidate of candidates) {
-        const candidateProvider = stringValue(candidate.value.provider);
-        const candidateModel = stringValue(candidate.value.model);
-        const validation = validateHarnessModelPair(declaredHarness, { provider: candidateProvider, model: candidateModel });
-        if (!validation.valid) {
-          issues.push(issue3("semantic", validation.issue ?? "harness_unhosted_model", agent.logicalPath, validation.message ?? `harness ${declaredHarness} cannot host model ${candidateModel ?? candidate.logicalPath}`));
-        }
-      }
-    }
   }
   validateModelReferences(models, issues);
   const defaultWorkflow = stringValue(project.value.defaultWorkflow) ?? "default";
   if (!workflows.has(defaultWorkflow)) issues.push(issue3("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
+  if (projectRoot && existsSync3(join2(projectRoot, ".kxm", "roster.yaml"))) {
+    issues.push(issue3("semantic", "retired_roster_file", ".kxm/roster.yaml", "create the role and model files and delete roster.yaml"));
+  }
+  if (projectRoot && existsSync3(join2(projectRoot, ".kxm", "roles"))) {
+    issues.push(...developerRolePolicyIssues(projectRoot));
+  }
   if (projectRoot) {
-    const writerRolePath = join2(projectRoot, ".kxm", "roles", "writer.yaml");
-    const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if ((writerRole !== void 0 || existsSync3(writerRolePath)) && implementerAgent) {
+    issues.push(...rosterModelIssues(projectRoot, roles));
+    issues.push(...originHashIssues(projectRoot, models));
+  }
+  return sortIssues3(issues);
+}
+function rosterModelIssues(projectRoot, roles) {
+  const issues = [];
+  for (const role of roles.values()) {
+    for (const entry of valuesOf(role.value, "roster")) {
+      const route = stringValue(objectValue(entry)?.route);
+      if (!route) continue;
+      const logical = `.kxm/models/${route}.yaml`;
+      const file = join2(projectRoot, ".kxm", "models", `${route}.yaml`);
+      let harness;
       try {
-        const rawRole = parseRestrictedYaml2(writerRole ?? readFileSync(writerRolePath, "utf8"));
-        const roleObj = objectValue(rawRole);
-        const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
-        const enabledRosterModels = rosterEntries.flatMap((entry) => {
-          const direct = stringValue(entry.model);
-          const route = stringValue(entry.route);
-          const named = direct ? [direct] : [];
-          if (route) {
-            const modelFile = join2(projectRoot, ".kxm", "models", `${route}.yaml`);
-            if (existsSync3(modelFile)) {
-              try {
-                const modelDoc = objectValue(parseRestrictedYaml2(readFileSync(modelFile, "utf8"), modelFile));
-                const model = modelDoc ? stringValue(modelDoc.model) : void 0;
-                const vendor = modelDoc ? stringValue(modelDoc.vendor) : void 0;
-                const harness = modelDoc ? stringValue(modelDoc.harness) : void 0;
-                if (model) named.push(model);
-                if (vendor && model) named.push(`${vendor}/${model}`);
-                if (harness && model) named.push(`${harness}/${model}`);
-              } catch {
-              }
-            }
-          }
-          return named;
-        });
-        const agentModelObj = objectValue(implementerAgent.value.model);
-        const agentModelStr = stringValue(implementerAgent.value.model);
-        const agentProvider = agentModelObj ? stringValue(agentModelObj.provider) : void 0;
-        const agentModel = agentModelObj ? stringValue(agentModelObj.model) : agentModelStr;
-        const canonicalAgentModel = agentProvider && agentModel ? `${agentProvider}/${agentModel}` : agentModel;
-        if (enabledRosterModels.length > 0 && canonicalAgentModel) {
-          const matches = enabledRosterModels.some((rm) => rm === canonicalAgentModel || rm === agentModel || rm.endsWith(`/${agentModel}`));
-          if (!matches) {
-            issues.push(issue3("semantic", "role_roster_conflicts_with_agent", ".kxm/roles/writer.yaml", `role roster in .kxm/roles/writer.yaml does not include agent model ${canonicalAgentModel} from ${implementerAgent.logicalPath}`));
-          }
-        }
-      } catch (error) {
-        if (error instanceof KxmConfigError) {
-          issues.push(...error.issues);
-        }
+        if (existsSync3(file)) harness = stringValue(parseRestrictedYaml2(readFileSync(file, "utf8"), logical).harness);
+      } catch {
+        harness = void 0;
+      }
+      if (!harness) {
+        issues.push(issue3("semantic", "roster_model_unreadable", role.logicalPath, `roster route ${route} does not resolve to a readable ${logical} carrying harness`));
       }
     }
   }
-  if (projectRoot && existsSync3(join2(projectRoot, ".kxm", "roster.yaml"))) {
-    issues.push(...developerRolePolicyIssues(projectRoot));
+  return issues;
+}
+function originHashIssues(projectRoot, models) {
+  const issues = [];
+  for (const model of models.values()) {
+    const origin = objectValue(model.value.origin);
+    const source = origin ? stringValue(origin.source) : void 0;
+    const digest2 = origin ? stringValue(origin.sha256) : void 0;
+    if (!source || !digest2) continue;
+    const file = resolve(projectRoot, source);
+    const escaped = relative(projectRoot, file);
+    if (isAbsolute(source) || escaped.startsWith("..") || isAbsolute(escaped)) {
+      issues.push(issue3("semantic", "origin_evidence_missing", model.logicalPath, `missing evidence bytes for ${source}`));
+      continue;
+    }
+    let actual;
+    try {
+      actual = createHash3("sha256").update(readFileSync(file, "utf8"), "utf8").digest("hex");
+    } catch (error) {
+      const code = error.code;
+      if (code === "ENOENT" || code === "EACCES" || code === "EPERM" || code === "EISDIR") {
+        issues.push(issue3("semantic", "origin_evidence_missing", model.logicalPath, `missing evidence bytes for ${source}`));
+        continue;
+      }
+      throw error;
+    }
+    if (actual !== digest2) {
+      issues.push(issue3("semantic", "origin_hash_mismatch", model.logicalPath, "origin evidence hash does not match supplied bytes"));
+    }
   }
-  return sortIssues3(issues);
+  return issues;
 }
 function developerCeilings() {
   const script = join2(findKxmRepoRoot(import.meta.url), "scripts", "harness-run.mjs");
@@ -18118,6 +18112,7 @@ function developerCeilings() {
   }
 }
 function developerRolePolicyIssues(projectRoot) {
+  if (resolve(projectRoot) !== findKxmRepoRoot(import.meta.url)) return [];
   const rolesDir = join2(projectRoot, ".kxm", "roles");
   const modelsDir = join2(projectRoot, ".kxm", "models");
   const roles = {};
@@ -18138,6 +18133,7 @@ function developerRolePolicyIssues(projectRoot) {
           parseIssues.push(...error.issues);
           continue;
         }
+        throw error;
       }
     }
   };
@@ -18152,7 +18148,7 @@ function developerRolePolicyIssues(projectRoot) {
   }
   const ceilings = developerCeilings();
   if (!ceilings.ok) {
-    return [...parseIssues, issue3("semantic", "developer_ceilings_unavailable", ".kxm/roster.yaml", `developer ceilings could not be loaded: ${ceilings.detail}`)];
+    return [...parseIssues, issue3("semantic", "developer_ceilings_unavailable", ".kxm/models", `developer ceilings could not be loaded: ${ceilings.detail}`)];
   }
   const result = validatePolicyDraft({ models, roles, evidence }, {
     ceilings: ceilings.ROUTES,
@@ -18241,7 +18237,8 @@ function loadProjectBundle(projectRoot, options, candidate) {
   }
   if (earlyIssues.length > 0) throw new KxmConfigError(earlyIssues);
   const agents = listNamedResources(registry, root, join2(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join2(root, ".kxm", "models"), ".kxm/models", "model");
+  const modelIssues = [];
+  const models = listNamedResources(registry, root, join2(root, ".kxm", "models"), ".kxm/models", "model", void 0, modelIssues);
   const roles = listNamedResources(registry, root, join2(root, ".kxm", "roles"), ".kxm/roles", "role", writerRole === void 0 ? void 0 : "writer");
   if (writerRole !== void 0) {
     const logicalPath = ".kxm/roles/writer.yaml";
@@ -18368,8 +18365,8 @@ function loadProjectBundle(projectRoot, options, candidate) {
       }
     }
   }
-  if (loadIssues.length > 0) throw new KxmConfigError(loadIssues);
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, writerRole);
+  if (loadIssues.length > 0) throw new KxmConfigError([...loadIssues, ...modelIssues]);
+  const issues = [...modelIssues, ...validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, roles)];
   if (issues.length > 0) throw new KxmConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...roles.values(), ...workflows.values(), ...environments, ...gateRegistry ? [gateRegistry] : []].sort((left, right) => compareCodeUnits4(left.logicalPath, right.logicalPath));
   return {
@@ -18414,9 +18411,10 @@ function legacyConfigFilesAt(root) {
 }
 
 // plugins/kxm/src/runtime-store.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash7, randomUUID } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync3, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
 
 // plugins/kxm/src/sqlite.ts
 import { existsSync as existsSync4 } from "node:fs";
@@ -18934,22 +18932,25 @@ function ensureWalJournalMode(database, file, description, timeoutMs = 5e3) {
     Atomics.wait(sleeper, 0, 0, 10);
   }
 }
+function assertDatabaseFile(file, description) {
+  checkedParent(file, description);
+  const stat = lstatSync2(file, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
+    }
+  }
+  for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
+    const info = lstatSync2(sidecar, { throwIfNoEntry: false });
+    if (info?.isSymbolicLink()) {
+      throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
+    }
+  }
+}
 function openDatabase(file, description, spec) {
   const isMemory = file === ":memory:";
   if (!isMemory) {
-    checkedParent(file, description);
-    const stat = lstatSync2(file, { throwIfNoEntry: false });
-    if (stat) {
-      if (stat.isSymbolicLink() || !stat.isFile()) {
-        throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
-      }
-    }
-    for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
-      const info = lstatSync2(sidecar, { throwIfNoEntry: false });
-      if (info?.isSymbolicLink()) {
-        throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
-      }
-    }
+    assertDatabaseFile(file, description);
   }
   const database = new DatabaseSync(file);
   let transaction = false;
@@ -18978,7 +18979,7 @@ function openDatabase(file, description, spec) {
       throw databaseError(
         "runtime_schema_outdated",
         file,
-        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for registry/event stores); \`kxm init\` is project-only and rebuilds no database \u2014 upgrading old state in place is deliberately unsupported`
+        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for event stores). The Runtime registry copy from schema 1 to 2 is the one exception. \`kxm init\` is project-only and rebuilds no database. Upgrading any other old state in place is deliberately unsupported`
       );
     }
     if (spec.tables) {
@@ -19216,7 +19217,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
 }
 var KXM_BACKUP_CEILINGS = {
   "hub-store": 5,
-  registry: 1,
+  registry: 2,
   "binding-store": 1,
   events: 7
 };
@@ -19582,10 +19583,10 @@ function projectRuntimeOwnsRun(projectRoot, runId, env) {
     database.close();
   }
 }
-var KXM_REGISTRY_SCHEMA_VERSION = 1;
+var KXM_REGISTRY_SCHEMA_VERSION = 2;
 var REGISTRY_TABLES = {
   supervisor: ["singleton_id", "runtime_id", "pid", "port", "token_hash", "started_at", "heartbeat_at", "state"],
-  projects: ["project_id", "project_root", "project_key", "home_runtime_id", "config_revision", "registered_at"]
+  projects: ["project_id", "project_root", "project_key", "home_runtime_id", "config_revision", "registered_at", "lane_of"]
 };
 var REGISTRY_SCHEMA = `
 CREATE TABLE supervisor (
@@ -19599,14 +19600,117 @@ CREATE TABLE supervisor (
   state TEXT NOT NULL
 ) STRICT;
 CREATE TABLE projects (
-  project_id TEXT PRIMARY KEY,
+  project_key TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
   project_root TEXT NOT NULL,
-  project_key TEXT NOT NULL UNIQUE,
   home_runtime_id TEXT NOT NULL,
   config_revision TEXT,
-  registered_at TEXT NOT NULL
+  registered_at TEXT NOT NULL,
+  lane_of TEXT
 ) STRICT;
+CREATE INDEX projects_by_project_id ON projects (project_id);
 `;
+var PROJECT_COLUMNS = "project_id, project_root, project_key, home_runtime_id, config_revision, registered_at, lane_of";
+function registrationFromRow(row) {
+  return {
+    projectId: row.project_id,
+    projectRoot: row.project_root,
+    projectKey: row.project_key,
+    homeRuntimeId: row.home_runtime_id,
+    ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
+    ...row.lane_of !== null ? { laneOf: row.lane_of } : {},
+    registeredAt: row.registered_at
+  };
+}
+function controlRootDirectoryExists(projectRoot) {
+  const stat = statSync(projectRoot, { throwIfNoEntry: false });
+  return Boolean(stat?.isDirectory());
+}
+function gitEnv() {
+  return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
+}
+function gitCommonDirectory(projectRoot) {
+  const result = spawnSync3("git", ["-C", projectRoot, "rev-parse", "--git-common-dir"], {
+    encoding: "utf8",
+    env: gitEnv(),
+    timeout: 3e4,
+    windowsHide: true
+  });
+  if (result.status !== 0) return void 0;
+  const text = (result.stdout ?? "").trim();
+  if (!text) return void 0;
+  const absolute = isAbsolute4(text) ? text : resolve6(projectRoot, text);
+  let canonical;
+  try {
+    canonical = realpathSync3.native(absolute);
+  } catch {
+    canonical = resolve6(absolute);
+  }
+  return process.platform === "win32" ? canonical.toLocaleLowerCase("en-US") : canonical;
+}
+function isPrimaryWorktree(projectRoot, commonDir) {
+  if (commonDir === void 0) return false;
+  const dotGit = resolve6(projectRoot, ".git");
+  let canonical;
+  try {
+    canonical = realpathSync3.native(dotGit);
+  } catch {
+    canonical = resolve6(dotGit);
+  }
+  if (process.platform === "win32") canonical = canonical.toLocaleLowerCase("en-US");
+  return canonical === commonDir;
+}
+function migrateRegistryLanes(file) {
+  const stat = lstatSync3(file, { throwIfNoEntry: false });
+  if (!stat) return;
+  assertDatabaseFile(file, "runtime registry");
+  const database = new DatabaseSync(file);
+  let transaction = false;
+  try {
+    database.exec("PRAGMA busy_timeout = 5000");
+    const current = database.prepare("PRAGMA user_version").get();
+    if ((current?.user_version ?? 0) !== 1) return;
+    database.exec("BEGIN IMMEDIATE");
+    transaction = true;
+    const locked = database.prepare("PRAGMA user_version").get();
+    if ((locked?.user_version ?? 0) !== 1) {
+      database.exec("ROLLBACK");
+      transaction = false;
+      return;
+    }
+    if (!tableColumns(database, "projects").includes("lane_of")) {
+      database.exec(`
+        CREATE TABLE projects_v2 (
+          project_key TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          project_root TEXT NOT NULL,
+          home_runtime_id TEXT NOT NULL,
+          config_revision TEXT,
+          registered_at TEXT NOT NULL,
+          lane_of TEXT
+        ) STRICT;
+        INSERT INTO projects_v2 (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+        SELECT project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, NULL FROM projects;
+        DROP TABLE projects;
+        ALTER TABLE projects_v2 RENAME TO projects;
+        CREATE INDEX projects_by_project_id ON projects (project_id);
+      `);
+    }
+    database.exec("PRAGMA user_version = 2");
+    database.exec("COMMIT");
+    transaction = false;
+  } catch (error) {
+    if (transaction) {
+      try {
+        database.exec("ROLLBACK");
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    database.close();
+  }
+}
 function readKxmSupervisorRecord(database) {
   const row = database.prepare("SELECT runtime_id, pid, port, token_hash, started_at, heartbeat_at, state FROM supervisor WHERE singleton_id = 1").get();
   return row ? {
@@ -19624,6 +19728,7 @@ var KxmRuntimeRegistry = class {
   database;
   constructor(path) {
     this.path = resolve6(path);
+    migrateRegistryLanes(this.path);
     this.database = openDatabase(this.path, "runtime registry", {
       schema: REGISTRY_SCHEMA,
       version: KXM_REGISTRY_SCHEMA_VERSION,
@@ -19702,57 +19807,188 @@ var KxmRuntimeRegistry = class {
   supervisor() {
     return this.readSupervisorRow();
   }
-  /** Register or revalidate a project's home binding. Home Runtime is immutable. */
-  /** All projects registered to this Runtime, for restart recovery: the
-   * supervisor needs to reopen their contexts so pending outbox rows resume
-   * syncing and presence keeps beating. */
+  /** All projects registered to this Runtime, including lane roots, for restart
+   * recovery: the supervisor reopens their contexts so pending outbox rows
+   * resume syncing and presence keeps beating. */
   projectsForRuntime(homeRuntimeId) {
     const rows = this.database.prepare(
       "SELECT project_root, project_id FROM projects WHERE home_runtime_id = ? ORDER BY registered_at"
     ).all(homeRuntimeId);
     return rows.map((row) => ({ projectRoot: row.project_root, projectId: row.project_id }));
   }
+  /**
+   * Register or revalidate a control root. The home runtime of a live row is
+   * immutable. A second root whose git common directory matches a live row
+   * for the same project is a lane, unless the registering root is the primary
+   * worktree and the live home row is not: then the primary becomes the home
+   * row (same home runtime id) and every other live row of that repository
+   * becomes its lane. A primary never becomes a lane. A root whose directory
+   * is gone is replaced. A live root that is a different repository is
+   * `project_home_conflict`.
+   */
   registerProject(registration) {
     const projectRoot = resolve6(registration.projectRoot);
     const projectKey = projectRuntimeKey(projectRoot);
+    const candidateCommon = gitCommonDirectory(projectRoot);
+    const commonByRoot = /* @__PURE__ */ new Map();
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+      this.database.exec("BEGIN IMMEDIATE");
+      let rootsToMeasure;
+      try {
+        const byKey = this.projectRow("SELECT " + PROJECT_COLUMNS + " FROM projects WHERE project_key = ?", projectKey);
+        if (byKey) {
+          const problems = [];
+          if (byKey.project_id !== registration.projectId) problems.push(`control root is already bound to a different project id ${byKey.project_id}`);
+          if (byKey.home_runtime_id !== registration.homeRuntimeId) problems.push(`project ${registration.projectId} home runtime is immutable and cannot be rebound`);
+          if (problems.length > 0) {
+            this.database.exec("ROLLBACK");
+            throw runtimeError("project_home_conflict", ".kxm/project.yaml", problems.join("; "));
+          }
+          const result = registrationFromRow(byKey);
+          this.database.exec("COMMIT");
+          return result;
+        }
+        const rows = this.database.prepare(
+          `SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_id = ? ORDER BY registered_at`
+        ).all(registration.projectId);
+        const live = rows.filter((row) => controlRootDirectoryExists(row.project_root));
+        const dead = rows.filter((row) => !controlRootDirectoryExists(row.project_root));
+        const unknown = live.filter((row) => !commonByRoot.has(row.project_root));
+        if (unknown.length > 0) {
+          rootsToMeasure = unknown.map((row) => row.project_root);
+          this.database.exec("ROLLBACK");
+        } else if (live.length > 0) {
+          const anchor = live.find((row) => {
+            const dir = commonByRoot.get(row.project_root);
+            return candidateCommon !== void 0 && dir === candidateCommon;
+          });
+          if (!anchor) {
+            this.database.exec("ROLLBACK");
+            throw runtimeError(
+              "project_home_conflict",
+              ".kxm/project.yaml",
+              `project ${registration.projectId} is already bound to a different control root`
+            );
+          }
+          if (live.some((row) => row.home_runtime_id !== registration.homeRuntimeId)) {
+            this.database.exec("ROLLBACK");
+            throw runtimeError(
+              "project_home_conflict",
+              ".kxm/project.yaml",
+              `project ${registration.projectId} home runtime is immutable and cannot be rebound`
+            );
+          }
+          const sameRepo = live.filter((row) => commonByRoot.get(row.project_root) === candidateCommon);
+          const home = sameRepo.find((row) => row.lane_of === null);
+          const registeringIsPrimary = isPrimaryWorktree(projectRoot, candidateCommon);
+          const homeIsPrimary = home !== void 0 && isPrimaryWorktree(home.project_root, commonByRoot.get(home.project_root));
+          if (registeringIsPrimary && !homeIsPrimary) {
+            this.insertHome(registration, projectRoot, projectKey);
+            for (const row of sameRepo) {
+              this.database.prepare("UPDATE projects SET lane_of = ? WHERE project_key = ?").run(projectKey, row.project_key);
+            }
+            this.database.exec("COMMIT");
+            registration.logger?.({
+              event: "project_home_promoted",
+              projectId: registration.projectId,
+              projectRoot,
+              homeRuntimeId: registration.homeRuntimeId,
+              previousHomeRoot: home?.project_root ?? null,
+              previousHomeKey: home?.project_key ?? null
+            });
+            return this.insertedRegistration(registration, projectRoot, projectKey);
+          }
+          if (registeringIsPrimary) {
+            this.database.exec("ROLLBACK");
+            throw runtimeError(
+              "project_home_conflict",
+              ".kxm/project.yaml",
+              `project ${registration.projectId} primary checkout is already the home row`
+            );
+          }
+          const laneOf = anchor.lane_of ?? anchor.project_key;
+          this.database.prepare(`
+            INSERT INTO projects (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+          `).run(projectKey, registration.projectId, projectRoot, registration.homeRuntimeId, registration.configRevision ?? null, registration.now, laneOf);
+          const result = this.insertedRegistration(registration, projectRoot, projectKey, laneOf);
+          this.database.exec("COMMIT");
+          return result;
+        } else if (dead.length > 0) {
+          const replaced = dead[0];
+          if (dead.some((row) => row.home_runtime_id !== registration.homeRuntimeId)) {
+            this.database.exec("ROLLBACK");
+            throw runtimeError(
+              "project_home_conflict",
+              ".kxm/project.yaml",
+              `project ${registration.projectId} home runtime is immutable and cannot be rebound`
+            );
+          }
+          this.database.prepare("DELETE FROM projects WHERE project_id = ?").run(registration.projectId);
+          this.insertHome(registration, projectRoot, projectKey);
+          this.database.exec("COMMIT");
+          registration.logger?.({
+            event: "project_registration_replaced",
+            projectId: registration.projectId,
+            projectRoot,
+            replacedRoot: replaced.project_root,
+            replacedCount: dead.length,
+            replacedHomeRuntimeId: replaced.home_runtime_id,
+            replacedProjectKey: replaced.project_key
+          });
+          return this.insertedRegistration(registration, projectRoot, projectKey);
+        } else {
+          this.insertHome(registration, projectRoot, projectKey);
+          this.database.exec("COMMIT");
+          return this.insertedRegistration(registration, projectRoot, projectKey);
+        }
+      } catch (error) {
+        try {
+          this.database.exec("ROLLBACK");
+        } catch {
+        }
+        throw error;
+      }
+      for (const root of rootsToMeasure ?? []) {
+        commonByRoot.set(root, gitCommonDirectory(root));
+      }
+    }
+    throw runtimeError(
+      "runtime_registry_busy",
+      projectRoot,
+      `project ${registration.projectId} registration could not be rechecked`
+    );
+  }
+  /** Remove one control root. Returns false when that root was not registered. */
+  unregisterProject(projectRoot) {
     this.database.exec("BEGIN IMMEDIATE");
     try {
-      const byId = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_id = ?").get(registration.projectId);
-      const byKey = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_key = ?").get(projectKey);
-      const existing = byId ?? byKey;
-      if (existing) {
-        const problems = [];
-        if (byId && byId.project_key !== projectKey) problems.push(`project ${registration.projectId} is already bound to a different control root`);
-        if (byKey && byKey.project_id !== registration.projectId) problems.push(`control root is already bound to a different project id ${byKey.project_id}`);
-        if (existing.home_runtime_id !== registration.homeRuntimeId) problems.push(`project ${registration.projectId} home runtime is immutable and cannot be rebound`);
-        if (problems.length > 0) {
-          this.database.exec("ROLLBACK");
-          throw runtimeError("project_home_conflict", ".kxm/project.yaml", problems.join("; "));
-        }
-        const result = {
-          projectId: existing.project_id,
-          projectRoot: existing.project_root,
-          projectKey: existing.project_key,
-          homeRuntimeId: existing.home_runtime_id,
-          ...existing.config_revision !== null ? { configRevision: existing.config_revision } : {},
-          registeredAt: existing.registered_at
-        };
-        this.database.exec("COMMIT");
-        return result;
+      const removed = this.deleteRegisteredRoot(projectRoot);
+      this.database.exec("COMMIT");
+      return removed;
+    } catch (error) {
+      try {
+        this.database.exec("ROLLBACK");
+      } catch {
       }
-      this.database.prepare(`
-        INSERT INTO projects (project_id, project_root, project_key, home_runtime_id, config_revision, registered_at)
-        VALUES (?, ?, ?, ?, ?, ?)
-      `).run(registration.projectId, projectRoot, projectKey, registration.homeRuntimeId, registration.configRevision ?? null, registration.now);
+      throw error;
+    }
+  }
+  /**
+   * Delete the row only when `supervisorIsLive` is false for the supervisor
+   * row read inside this write transaction. A live supervisor keeps the row;
+   * the caller uses the supervisor route instead of editing the file.
+   */
+  unregisterProjectIfIdle(projectRoot, supervisorIsLive) {
+    this.database.exec("BEGIN IMMEDIATE");
+    try {
+      if (supervisorIsLive(this.readSupervisorRow())) {
+        this.database.exec("ROLLBACK");
+        return "supervisor_live";
+      }
+      const removed = this.deleteRegisteredRoot(projectRoot);
       this.database.exec("COMMIT");
-      return {
-        projectId: registration.projectId,
-        projectRoot,
-        projectKey,
-        homeRuntimeId: registration.homeRuntimeId,
-        ...registration.configRevision !== void 0 ? { configRevision: registration.configRevision } : {},
-        registeredAt: registration.now
-      };
+      return removed ? "removed" : "absent";
     } catch (error) {
       try {
         this.database.exec("ROLLBACK");
@@ -19761,28 +19997,65 @@ var KxmRuntimeRegistry = class {
       throw error;
     }
   }
+  /** How many other rows share this home root's project. Zero when this root is a lane or missing. */
+  homeLaneCount(projectRoot) {
+    const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectRuntimeKey(resolve6(projectRoot)));
+    if (!row || row.lane_of !== null) return 0;
+    const count = this.database.prepare(
+      "SELECT COUNT(*) AS total FROM projects WHERE project_id = ? AND project_key != ?"
+    ).get(row.project_id, row.project_key);
+    return Number(count?.total ?? 0);
+  }
+  /** Caller holds the write transaction. Does not commit. */
+  deleteRegisteredRoot(projectRoot) {
+    const projectKey = projectRuntimeKey(resolve6(projectRoot));
+    const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectKey);
+    if (!row) return false;
+    this.database.prepare("DELETE FROM projects WHERE project_key = ?").run(projectKey);
+    if (row.lane_of === null) {
+      const successor = this.database.prepare(
+        "SELECT project_key FROM projects WHERE project_id = ? ORDER BY registered_at LIMIT 1"
+      ).get(row.project_id);
+      if (successor) {
+        this.database.prepare("UPDATE projects SET lane_of = NULL WHERE project_key = ?").run(successor.project_key);
+        this.database.prepare(
+          "UPDATE projects SET lane_of = ? WHERE project_id = ? AND project_key != ? AND (lane_of IS NULL OR lane_of = ?)"
+        ).run(successor.project_key, row.project_id, successor.project_key, projectKey);
+      }
+    }
+    return true;
+  }
+  /** The home row for a project id, or the earliest row when every row is a lane. */
   project(projectId) {
-    const row = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_id = ?").get(projectId);
-    return row ? {
-      projectId: row.project_id,
-      projectRoot: row.project_root,
-      projectKey: row.project_key,
-      homeRuntimeId: row.home_runtime_id,
-      ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
-      registeredAt: row.registered_at
-    } : void 0;
+    const row = this.projectRow(
+      `SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_id = ? ORDER BY CASE WHEN lane_of IS NULL THEN 0 ELSE 1 END, registered_at LIMIT 1`,
+      projectId
+    );
+    return row ? registrationFromRow(row) : void 0;
   }
   projectByRoot(projectRoot) {
-    const key = projectRuntimeKey(projectRoot);
-    const row = this.database.prepare("SELECT project_id, project_root, project_key, home_runtime_id, config_revision, registered_at FROM projects WHERE project_key = ?").get(key);
-    return row ? {
-      projectId: row.project_id,
-      projectRoot: row.project_root,
-      projectKey: row.project_key,
-      homeRuntimeId: row.home_runtime_id,
-      ...row.config_revision !== null ? { configRevision: row.config_revision } : {},
-      registeredAt: row.registered_at
-    } : void 0;
+    const row = this.projectRow(`SELECT ${PROJECT_COLUMNS} FROM projects WHERE project_key = ?`, projectRuntimeKey(projectRoot));
+    return row ? registrationFromRow(row) : void 0;
+  }
+  projectRow(sql, parameter) {
+    return this.database.prepare(sql).get(parameter);
+  }
+  insertHome(registration, projectRoot, projectKey) {
+    this.database.prepare(`
+      INSERT INTO projects (project_key, project_id, project_root, home_runtime_id, config_revision, registered_at, lane_of)
+      VALUES (?, ?, ?, ?, ?, ?, NULL)
+    `).run(projectKey, registration.projectId, projectRoot, registration.homeRuntimeId, registration.configRevision ?? null, registration.now);
+  }
+  insertedRegistration(registration, projectRoot, projectKey, laneOf) {
+    return {
+      projectId: registration.projectId,
+      projectRoot,
+      projectKey,
+      homeRuntimeId: registration.homeRuntimeId,
+      ...registration.configRevision !== void 0 ? { configRevision: registration.configRevision } : {},
+      ...laneOf !== void 0 ? { laneOf } : {},
+      registeredAt: registration.now
+    };
   }
 };
 var KXM_RUN_EVENT_SCHEMA = "kxm.run-event.v1";
@@ -24228,7 +24501,8 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectRoot: bundle.projectRoot,
       homeRuntimeId: options.homeRuntimeId,
       configRevision: bundle.configRevision,
-      now: options.now ?? (/* @__PURE__ */ new Date()).toISOString()
+      now: options.now ?? (/* @__PURE__ */ new Date()).toISOString(),
+      ...options.logger ? { logger: options.logger } : {}
     });
     const eventStore = new KxmRunEventStore(join7(paths.projectsDir, registration.projectKey, "run-events.db"));
     registerKxmRuntimeHandle(eventStore.path);
@@ -24582,7 +24856,7 @@ import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash16, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { chmodSync as chmodSync2, existsSync as existsSync16, lstatSync as lstatSync6, mkdirSync as mkdirSync9, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
 import { createServer } from "node:http";
-import { dirname as dirname11, isAbsolute as isAbsolute7, join as join18 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute8, join as join18 } from "node:path";
 
 // plugins/kxm/src/oneshot-evidence.ts
 import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
@@ -24737,7 +25011,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
@@ -24890,7 +25164,7 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync8(join9(rootOrPath, ".kxm", "prices.yaml")) ? join9(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join9(rootOrPath, "prices.yaml")) ? join9(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  const candidatePath = existsSync8(join9(rootOrPath, ".kxm", "prices.yaml")) ? join9(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join9(rootOrPath, "prices.yaml")) ? join9(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync2(rootOrPath).isFile() ? rootOrPath : void 0;
   if (!candidatePath || !existsSync8(candidatePath)) {
     return void 0;
   }
@@ -24929,14 +25203,14 @@ var import_yaml4 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/routes.ts
 var RETIRED_POLICY = ".kxm/producers.yaml";
-var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
+var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [] });
 function loadRoutePolicy(root) {
   if (existsSync9(join10(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
   const path = join10(root, ".kxm", "routes.yaml");
   if (!existsSync9(path)) return empty();
   const value = (0, import_yaml6.parse)(readFileSync7(path, "utf8"));
   if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
-  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x) => typeof x === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x) => typeof x === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [] };
 }
 function listRoleBindings(root) {
   const dir = join10(root, ".kxm", "roles");
@@ -24949,15 +25223,11 @@ function listRoleBindings(root) {
   }
   return result;
 }
-function isRouteAdmitted(root, modelId) {
-  const policy = loadRoutePolicy(root);
-  return policy.admitted.includes(modelId) && !policy.disabled.includes(modelId);
-}
 
 // plugins/kxm/src/worktree-witness.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function gitText(cwd, args) {
-  const result = spawnSync3("git", ["-C", cwd, ...args], {
+  const result = spawnSync4("git", ["-C", cwd, ...args], {
     encoding: "utf8",
     windowsHide: true,
     timeout: 15e3
@@ -25270,7 +25540,7 @@ function pruneContextPacket(packet, tokenBudget) {
 }
 
 // plugins/kxm/src/dispatch-context.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { readdirSync as readdirSync8 } from "node:fs";
 import { extname as extname3, join as join13 } from "node:path";
 
@@ -26033,7 +26303,7 @@ function loadAuthoredMemory(repoRoot) {
 // plugins/kxm/src/skills.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync7, readFileSync as readFileSync9, renameSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync7, readFileSync as readFileSync9, renameSync, rmSync, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname7, join as join12 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
@@ -26413,7 +26683,7 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync7(dir).filter((entry) => statSync2(join12(dir, entry)).isDirectory()).sort();
+  return readdirSync7(dir).filter((entry) => statSync3(join12(dir, entry)).isDirectory()).sort();
 }
 
 // plugins/kxm/src/dispatch-context.ts
@@ -26474,7 +26744,7 @@ function gitEnvironment2() {
   return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
 }
 function committedGateGap(projectRoot) {
-  const result = spawnSync4("git", [
+  const result = spawnSync5("git", [
     "--no-optional-locks",
     "-C",
     projectRoot,
@@ -26616,11 +26886,11 @@ function assembleDispatchContext(sources, input) {
 import { join as join14 } from "node:path";
 
 // plugins/kxm/src/artifacts-exist.ts
-import { lstatSync as lstatSync5, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve8 } from "node:path";
+import { lstatSync as lstatSync5, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve8 } from "node:path";
 function staysUnder(root, candidate) {
   const child = relative4(root, candidate);
-  return child === "" || !isAbsolute4(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  return child === "" || !isAbsolute5(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function verifyArtifactExists(rootInput, pathInput) {
   const lexicalRoot = resolve8(rootInput);
@@ -26631,12 +26901,12 @@ function verifyArtifactExists(rootInput, pathInput) {
   let realRoot;
   let realPath;
   try {
-    realRoot = realpathSync3(lexicalRoot);
+    realRoot = realpathSync4(lexicalRoot);
   } catch {
     return { ok: false, error: "artifact_unreadable", path: lexicalPath };
   }
   try {
-    realPath = realpathSync3(lexicalPath);
+    realPath = realpathSync4(lexicalPath);
   } catch {
     return { ok: false, error: "artifact_missing", path: lexicalPath };
   }
@@ -26648,7 +26918,7 @@ function verifyArtifactExists(rootInput, pathInput) {
     if (link.isSymbolicLink()) {
       return { ok: false, error: "artifact_outside_workspace_assets", path: lexicalPath };
     }
-    const artifact = statSync3(realPath);
+    const artifact = statSync4(realPath);
     if (!artifact.isFile()) return { ok: false, error: "artifact_not_file", path: lexicalPath };
     if (artifact.size < 1) return { ok: false, error: "artifact_empty", path: lexicalPath };
     return { ok: true, path: realPath, bytes: artifact.size };
@@ -28541,25 +28811,18 @@ function commitCommandUncertainty(context, prepared, token, reason, observation,
   }
 }
 var kxmPanelDispatchSeams = {};
-function selectorsNamedByRoutes(projectRoot, routeIds) {
-  const selectors = /* @__PURE__ */ new Set();
-  for (const routeId2 of routeIds) {
-    const file = join15(projectRoot, ".kxm", "models", `${routeId2}.yaml`);
-    if (!existsSync12(file)) continue;
-    let parsed;
-    try {
-      parsed = (0, import_yaml9.parse)(readFileSync10(file, "utf8"));
-    } catch {
-      continue;
-    }
-    const model = typeof parsed.model === "string" ? parsed.model : "";
-    const vendor = typeof parsed.vendor === "string" ? parsed.vendor : "";
-    const harness = typeof parsed.harness === "string" ? parsed.harness : "";
-    if (model) selectors.add(model);
-    if (vendor && model) selectors.add(`${vendor}/${model}`);
-    if (harness && model) selectors.add(`${harness}/${model}`);
+function readYamlFile(file) {
+  return readModelDocument(file);
+}
+function readModelDocument(file) {
+  if (!existsSync12(file)) return void 0;
+  try {
+    const parsed = (0, import_yaml9.parse)(readFileSync10(file, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
   }
-  return [...selectors];
 }
 function unreconciledPanelAttemptId(state) {
   const current = state.currentStep;
@@ -28576,82 +28839,118 @@ function unreconciledPanelAttemptId(state) {
   return void 0;
 }
 function resolveProducerRoute(projectRoot, step, agentId) {
-  let agentModel;
-  const agentFile = join15(projectRoot, ".kxm", "agents", `${agentId}.yaml`);
-  if (existsSync12(agentFile)) {
-    try {
-      const parsed = (0, import_yaml9.parse)(readFileSync10(agentFile, "utf8"));
-      if (typeof parsed?.model === "string") {
-        agentModel = parsed.model;
-      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
-        const declared = parsed.model;
-        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
-        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
-        if (providerOk && modelOk) {
-          agentModel = `${declared.provider}/${declared.model}`;
-        } else {
-          return {
-            error: {
-              reason: "step_unsupported",
-              field: "model",
-              detail: "producer_route_unsupported: invalid model declaration"
-            }
-          };
-        }
-      }
-    } catch {
-    }
-  }
-  let selector = typeof step.model === "string" ? step.model : agentModel;
-  if (!selector) {
-    if (agentId === "implementer") {
-      selector = "xai/grok-4.6";
-    }
-  }
-  if (!selector) {
+  if ((step.kind === "agent" || step.kind === "moa") && step.model !== void 0) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: "producer_route_unsupported: agent or step has no model declared"
+        detail: "producer_route_unsupported: agent step model is not honored"
       }
     };
   }
-  const slash = selector.indexOf("/");
-  if (slash <= 0 || slash === selector.length - 1) {
+  const agent = readYamlFile(join15(projectRoot, ".kxm", "agents", `${agentId}.yaml`));
+  const role = typeof agent?.role === "string" ? agent.role : "";
+  if (!role) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: `producer_route_unsupported: invalid selector '${selector}'`
+        detail: "producer_route_unsupported: agent has no role"
       }
     };
   }
-  if (!isRouteAdmitted(projectRoot, selector)) {
+  const roleDoc = readYamlFile(join15(projectRoot, ".kxm", "roles", `${role}.yaml`));
+  const roster = Array.isArray(roleDoc?.roster) ? roleDoc.roster : void 0;
+  if (!roster) {
     return {
       error: {
         reason: "step_unsupported",
         field: "model",
-        detail: `producer_route_unsupported: model '${selector}' is not admitted`
+        detail: `producer_route_unsupported: role '${role}' has no roster`
       }
     };
   }
-  const role = agentId === "implementer" ? "writer" : agentId;
-  const roleBindings = listRoleBindings(projectRoot);
-  const roster = roleBindings[role];
-  const rosterSelectors = roster ? selectorsNamedByRoutes(projectRoot, roster) : void 0;
-  if (rosterSelectors && !rosterSelectors.includes(selector)) {
+  const policy = loadRoutePolicy(projectRoot);
+  for (const entry of roster) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const record2 = entry;
+    if (typeof record2.route !== "string" || record2.route.length === 0) continue;
+    const modelPath = join15(projectRoot, ".kxm", "models", `${record2.route}.yaml`);
+    const doc = readModelDocument(modelPath);
+    if (!doc) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: model file '.kxm/models/${record2.route}.yaml' is missing or unreadable`
+        }
+      };
+    }
+    if (doc.status !== "admitted") continue;
+    const modelName = typeof doc.model === "string" ? doc.model : "";
+    const vendor = typeof doc.vendor === "string" ? doc.vendor : "";
+    const harness = typeof doc.harness === "string" ? doc.harness : "";
+    if (!modelName || !vendor || !harness) continue;
+    const candidates = [modelName, `${vendor}/${modelName}`, `${harness}/${modelName}`];
+    const admittedSelector = candidates.find((candidate) => policy.admitted.includes(candidate));
+    const disabledSelector = candidates.find((candidate) => policy.disabled.includes(candidate));
+    if (!admittedSelector && disabledSelector) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: first admitted route '${record2.route}' for role '${role}' is disabled`
+        }
+      };
+    }
+    const selector = admittedSelector ?? (modelName.includes("/") ? modelName : `${vendor}/${modelName}`);
+    if (policy.disabled.includes(selector)) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: first admitted route '${record2.route}' for role '${role}' is disabled`
+        }
+      };
+    }
+    if (!policy.admitted.includes(selector)) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: model '${selector}' is not admitted`
+        }
+      };
+    }
+    const slash = selector.indexOf("/");
+    if (slash <= 0 || slash === selector.length - 1) {
+      return {
+        error: {
+          reason: "step_unsupported",
+          field: "model",
+          detail: `producer_route_unsupported: invalid selector '${selector}'`
+        }
+      };
+    }
+    const permissions = Array.isArray(doc.permissions) ? doc.permissions.filter((item) => typeof item === "string") : [];
     return {
-      error: {
-        reason: "step_unsupported",
-        field: "model",
-        detail: `producer_route_unsupported: model '${selector}' not in role '${role}' roster`
-      }
+      provider: selector.slice(0, slash),
+      model: selector.slice(slash + 1),
+      selector,
+      harness,
+      routeId: record2.route,
+      role,
+      permissions,
+      ...typeof record2.effort === "string" ? { effort: record2.effort } : {}
     };
   }
-  const provider = selector.slice(0, slash);
-  const model = selector.slice(slash + 1);
-  return { provider, model, selector };
+  return {
+    error: {
+      reason: "step_unsupported",
+      field: "model",
+      detail: `producer_route_unsupported: role '${role}' has no admitted route`
+    }
+  };
 }
 function projectAgentStepTimeoutMs(context, run) {
   return loadKxmRunPlanEnvelope(context.eventStore, run).projectLimits.agentStepTimeoutMs ?? KXM_DEFAULT_AGENT_STEP_TIMEOUT_MS;
@@ -28869,8 +29168,7 @@ function prepareDispatch(context, runId, producerId, dispatchSources) {
     const writeRefusal = unsupportedLiveWrite(
       context.projectRoot,
       step,
-      agentId,
-      resolvedRoute.selector,
+      resolvedRoute,
       loadKxmRunPlanEnvelope(context.eventStore, run).projectLimits.maxConcurrentRuns
     );
     if (writeRefusal) return { kind: "return", state, handoff: { ...writeRefusal, stepId } };
@@ -28899,7 +29197,7 @@ function prepareDispatch(context, runId, producerId, dispatchSources) {
   for (const event of events) context.eventStore.appendEvent(event);
   const entered = foldStoredKxmRun(context, run);
   persistKxmRunState(context, runId, entered, events[events.length - 1].sequence);
-  const first = birthMember(context, {
+  const firstBirth = birthMember(context, {
     run,
     plan,
     step,
@@ -28910,6 +29208,10 @@ function prepareDispatch(context, runId, producerId, dispatchSources) {
     resolvedRoute,
     dispatchSources
   });
+  if ("handoff" in firstBirth) {
+    return { kind: "return", state: entered, handoff: firstBirth.handoff };
+  }
+  const first = firstBirth;
   return {
     kind: "panel",
     panel: {
@@ -28972,9 +29274,10 @@ function birthMember(context, input) {
   let resolvedRoute = input.resolvedRoute;
   if (!resolvedRoute && input.producerId && input.producerId !== "driver-simulated") {
     const routeResult = resolveProducerRoute(context.projectRoot, input.step, agentId);
-    if (!("error" in routeResult)) {
-      resolvedRoute = routeResult;
+    if ("error" in routeResult) {
+      return { handoff: { ...routeResult.error, stepId: input.stepId } };
     }
+    resolvedRoute = routeResult;
   }
   const dispatchContext = assembleDispatchContext(input.dispatchSources, {
     projectId: run.projectId,
@@ -29081,11 +29384,11 @@ function birthMember(context, input) {
       prompt: input.step.instructions ? `${input.step.instructions}
 
 ${generatedPrompt}` : generatedPrompt,
-      thinking: input.stepAttempt <= 1 ? "low" : "medium",
       permission: Object.values(input.step.repositories).some((access) => access === "write") ? "edit" : "read-only",
       ...(input.step.kind === "agent" || input.step.kind === "moa") && input.step.timeoutMs !== void 0 ? { timeoutMs: input.step.timeoutMs } : {},
       contextPacket,
-      ...resolvedRoute ? { provider: resolvedRoute.provider, model: resolvedRoute.model } : {}
+      ...resolvedRoute?.effort !== void 0 ? { thinking: resolvedRoute.effort } : {},
+      ...resolvedRoute ? { harness: resolvedRoute.harness, provider: resolvedRoute.provider, model: resolvedRoute.model } : {}
     },
     controller,
     state: next
@@ -29230,13 +29533,14 @@ async function drivePanel(context, panel, producer) {
     })();
     pending.set(member.attemptId, work);
   };
+  let routeHandoff;
   const tryBirth = () => {
-    if (stopBirths) return void 0;
+    if (stopBirths || routeHandoff) return void 0;
     return context.eventStore.transaction(() => {
       const run = requireRun(context, runId);
       const state = foldStoredKxmRun(context, run);
       if (!birthAllowed(state, panel.step)) return void 0;
-      return birthMember(context, {
+      const born = birthMember(context, {
         run,
         plan: panel.plan,
         step: panel.step,
@@ -29245,6 +29549,11 @@ async function drivePanel(context, panel, producer) {
         producerId: producer.id,
         dispatchSources: panel.dispatchSources
       });
+      if ("handoff" in born) {
+        routeHandoff = born.handoff;
+        return void 0;
+      }
+      return born;
     });
   };
   const settleInvoked = (member, produced) => {
@@ -29288,6 +29597,10 @@ async function drivePanel(context, panel, producer) {
       while (!stopBirths && !settlementFailed) {
         try {
           const next = tryBirth();
+          if (routeHandoff) {
+            stopBirths = true;
+            break;
+          }
           if (!next) break;
           launch(next);
         } catch {
@@ -29298,6 +29611,13 @@ async function drivePanel(context, panel, producer) {
           return unreconciledHandoff(state, panel.stepId);
         }
       }
+      if (routeHandoff) {
+        const handoff = routeHandoff;
+        abortOwned();
+        await drainPendingInvoked();
+        const state = foldStoredKxmRun(context, requireRun(context, runId));
+        return { state, handoff };
+      }
       if (pending.size === 0) break;
       const finished = await Promise.race(pending.values());
       pending.delete(finished.attemptId);
@@ -29861,25 +30181,7 @@ function unsupportedStep(plan, step, producerId) {
   }
   return void 0;
 }
-function readYamlRecord(path) {
-  if (!existsSync12(path)) return void 0;
-  try {
-    const parsed = (0, import_yaml9.parse)(readFileSync10(path, "utf8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
-  } catch {
-    return void 0;
-  }
-  return void 0;
-}
-function agentHarness(projectRoot, agentId) {
-  const harness = readYamlRecord(join15(projectRoot, ".kxm", "agents", `${agentId}.yaml`))?.harness;
-  return typeof harness === "string" && harness.length > 0 ? harness : void 0;
-}
-function projectDefaultHarness(projectRoot) {
-  const harness = readYamlRecord(join15(projectRoot, ".kxm", "project.yaml"))?.defaultHarness;
-  return typeof harness === "string" && harness.length > 0 ? harness : "pi";
-}
-function unsupportedLiveWrite(projectRoot, step, agentId, selector, maxConcurrentRuns) {
+function unsupportedLiveWrite(projectRoot, step, route, maxConcurrentRuns) {
   if (!Object.values(step.repositories).some((access) => access === "write")) return void 0;
   if (step.assignments.maximum !== 1) {
     return {
@@ -29895,42 +30197,23 @@ function unsupportedLiveWrite(projectRoot, step, agentId, selector, maxConcurren
       detail: "live write steps require limits.maxConcurrentRuns of 1; concurrent runs share one checkout"
     };
   }
-  const harness = agentHarness(projectRoot, agentId) ?? projectDefaultHarness(projectRoot);
-  if (!oneShotWriterArgs(harness)) {
+  if (!oneShotWriterArgs(route.harness)) {
     return {
       reason: "step_unsupported",
       field: "repositories",
-      detail: `live write steps require an audited writer profile; ${harness} has none`
-    };
-  }
-  const rosterPath = join15(projectRoot, ".kxm", "roster.yaml");
-  if (!existsSync12(rosterPath)) return void 0;
-  const roster = readYamlRecord(rosterPath);
-  if (!roster || roster.schema !== "kxm.developer-roster.v1") {
-    return { reason: "step_unsupported", field: "model", detail: "live write steps require a readable kxm.developer-roster.v1" };
-  }
-  const routes = roster.routes;
-  const lineup = roster.lineup;
-  const writerIds = lineup && typeof lineup === "object" && !Array.isArray(lineup) ? lineup.writer : void 0;
-  if (!routes || typeof routes !== "object" || Array.isArray(routes) || !Array.isArray(writerIds)) {
-    return { reason: "step_unsupported", field: "model", detail: "developer roster has no writer lineup" };
-  }
-  const allowed = writerIds.some((id) => {
-    if (typeof id !== "string") return false;
-    const route = routes[id];
-    if (!route || typeof route !== "object" || Array.isArray(route)) return false;
-    const record2 = route;
-    if (record2.harness !== harness || record2.status !== "admitted") return false;
-    if (!Array.isArray(record2.permissions) || !record2.permissions.includes("edit")) return false;
-    const model = typeof record2.model === "string" ? record2.model : "";
-    const vendor = typeof record2.vendor === "string" ? record2.vendor : "";
-    return model === selector || vendor.length > 0 && `${vendor}/${model}` === selector;
-  });
-  if (!allowed) {
+      detail: `live write steps require an audited writer profile; ${route.harness} has none`
+    };
+  }
+  const writerIds = listRoleBindings(projectRoot).writer;
+  if (!Array.isArray(writerIds) || writerIds.length === 0) {
+    return { reason: "step_unsupported", field: "model", detail: "writer roster has no admitted edit route" };
+  }
+  const named = writerIds.includes(route.routeId);
+  if (!named || !route.permissions.includes("edit")) {
     return {
       reason: "step_unsupported",
       field: "model",
-      detail: `live write route ${selector} on ${harness} is not on the developer roster writer lineup`
+      detail: `live write route ${route.selector} on ${route.harness} is not an admitted edit route on the writer roster`
     };
   }
   return void 0;
@@ -30367,20 +30650,11 @@ function determineOutcome(text, allowedOutcomes) {
   return "failed";
 }
 function createKxmOneShotProducer(options = {}) {
-  const defaultHarness = options.defaultHarness ?? "claude";
   const running = /* @__PURE__ */ new Map();
   let closed = false;
-  function resolveHarnessForRequest(request) {
+  function requireHarness(request) {
     if (request.harness) return request.harness;
-    if (options.resolveHarness) {
-      const resolved = options.resolveHarness(request.agentId, request.runId);
-      if (resolved) return resolved;
-    }
-    if (options.resolveModel) {
-      const resolved = options.resolveModel(request.agentId, request.runId);
-      if (resolved?.harness) return resolved.harness;
-    }
-    return defaultHarness;
+    throw new Error("producer_harness_required");
   }
   function parseModelString(spec, harness) {
     const trimmed = spec.trim();
@@ -30442,7 +30716,7 @@ function createKxmOneShotProducer(options = {}) {
   }
   async function executeRequest(request) {
     const startTime = Date.now();
-    const harness = resolveHarnessForRequest(request);
+    const harness = requireHarness(request);
     const resolved = resolveModelForRequest(request, harness);
     if (closed) throw new Error("oneshot_producer_closed");
     const cancelled = () => ({
@@ -30789,7 +31063,7 @@ var RuntimeHubClient = class {
 // plugins/kxm/src/hub-binding.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync11, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join16, resolve as resolve9 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join16, resolve as resolve9 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HubBindingError = class extends Error {
   constructor(message) {
@@ -30800,17 +31074,17 @@ var HubBindingError = class extends Error {
 function resolveUserStateRoot(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute5(explicit)) throw new HubBindingError("local_state_root_not_absolute");
+    if (!isAbsolute6(explicit)) throw new HubBindingError("local_state_root_not_absolute");
     return resolve9(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join16(homedir2(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join16(homedir2(), "AppData", "Local");
     return resolve9(base2, "KXM");
   }
   if (process.platform === "darwin") return resolve9(homedir2(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join16(homedir2(), ".local", "state");
+  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join16(homedir2(), ".local", "state");
   return resolve9(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
@@ -30861,7 +31135,7 @@ function readHubBinding(env = process.env) {
 // plugins/kxm/src/hub-env.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute6, join as join17, resolve as resolve10 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute7, join as join17, resolve as resolve10 } from "node:path";
 var HUB_ENV_SCHEMA = "kxm.hub-env.v1";
 var HubEnvError = class extends Error {
   constructor(message) {
@@ -30872,17 +31146,17 @@ var HubEnvError = class extends Error {
 function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute6(explicit)) throw new HubEnvError("local_state_root_not_absolute");
+    if (!isAbsolute7(explicit)) throw new HubEnvError("local_state_root_not_absolute");
     return resolve10(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join17(homedir3(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute7(localAppData) ? localAppData : join17(homedir3(), "AppData", "Local");
     return resolve10(base2, "KXM");
   }
   if (process.platform === "darwin") return resolve10(homedir3(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join17(homedir3(), ".local", "state");
+  const base = xdgState && isAbsolute7(xdgState) ? xdgState : join17(homedir3(), ".local", "state");
   return resolve10(base, "kxm");
 }
 function hubEnvFile(env = process.env) {
@@ -30933,7 +31207,7 @@ function resolveClientHubAuthToken(env, project) {
 }
 
 // plugins/kxm/src/logger.ts
-import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync8, renameSync as renameSync4, statSync as statSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync8, renameSync as renameSync4, statSync as statSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import { dirname as dirname10 } from "node:path";
 var LOG_LEVEL_PRIORITY = {
   debug: 10,
@@ -31004,7 +31278,7 @@ function createLogger(options) {
   let currentSize = 0;
   if (filePath && existsSync15(filePath)) {
     try {
-      currentSize = statSync4(filePath).size;
+      currentSize = statSync5(filePath).size;
     } catch {
       currentSize = 0;
     }
@@ -31151,6 +31425,24 @@ function readRecentSupervisorError(paths) {
     return void 0;
   }
 }
+var SETTLED_RUN_STATUS = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+function kxmSupervisorRecordIsLive(record2) {
+  return supervisorStatusOf(record2).running;
+}
+function unsettledRunIds(context) {
+  const ids = [];
+  for (const stored of context.eventStore.runsForProject(context.projectId, 1e4)) {
+    let status = stored.status;
+    try {
+      status = projectKxmRunReadOnly(context, stored.runId).status;
+    } catch {
+      ids.push(stored.runId);
+      continue;
+    }
+    if (!SETTLED_RUN_STATUS.has(status)) ids.push(stored.runId);
+  }
+  return ids;
+}
 function supervisorStatusOf(record2) {
   if (!record2) return { running: false };
   const heartbeatAgeMs = Date.now() - Date.parse(record2.heartbeatAt);
@@ -31499,7 +31791,7 @@ async function startKxmRuntimeSupervisorInner(paths, requestedPortOption, now, e
     }
   };
   const contextFor = (projectRoot) => {
-    if (!isAbsolute7(projectRoot)) {
+    if (!isAbsolute8(projectRoot)) {
       throw runtimeError("runtime_request_invalid", "projectRoot", "projectRoot must be an absolute path");
     }
     const key = projectRuntimeKey(projectRoot);
@@ -31565,6 +31857,62 @@ async function startKxmRuntimeSupervisorInner(paths, requestedPortOption, now, e
           sendJson(response, 200, { ok: true, projectId: context.projectId, retried, outbox: context.eventStore.outboxStatus() });
           return;
         }
+        if (request.method === "POST" && url.pathname === "/v1/projects/unregister") {
+          const body = await readJsonBody(request);
+          const projectRoot = typeof body.projectRoot === "string" ? body.projectRoot : "";
+          const force = body.force === true;
+          if (!projectRoot || !isAbsolute8(projectRoot)) {
+            sendJson(response, 400, { ok: false, error: "runtime_request_invalid", message: "projectRoot must be an absolute path" });
+            return;
+          }
+          if (!force) {
+            const key2 = projectRuntimeKey(projectRoot);
+            const existing2 = contexts.get(key2);
+            let openRunIds = [];
+            if (existing2) {
+              openRunIds = unsettledRunIds(existing2);
+            } else {
+              const registration = registry.projectByRoot(projectRoot);
+              const eventsPath = join18(paths.projectsDir, registration?.projectKey ?? projectRuntimeKey(projectRoot), "run-events.db");
+              if (registration && existsSync16(eventsPath)) {
+                const store = new KxmRunEventStore(eventsPath);
+                try {
+                  openRunIds = store.runsForProject(registration.projectId, 1e4).filter((run) => !SETTLED_RUN_STATUS.has(run.status)).map((run) => run.runId);
+                } finally {
+                  store.close();
+                }
+              }
+            }
+            if (openRunIds.length > 0) {
+              sendJson(response, 409, {
+                ok: false,
+                error: "runtime_project_busy",
+                message: `unsettled run ${openRunIds.join(", ")}`,
+                runIds: openRunIds
+              });
+              return;
+            }
+            const laneCount = registry.homeLaneCount(projectRoot);
+            if (laneCount > 0) {
+              sendJson(response, 409, {
+                ok: false,
+                error: "runtime_project_has_lanes",
+                message: `home root still has ${laneCount} lane(s)`
+              });
+              return;
+            }
+          }
+          const key = projectRuntimeKey(projectRoot);
+          const existing = contexts.get(key);
+          const unregistered = registry.unregisterProject(projectRoot);
+          if (existing) {
+            contexts.delete(key);
+            syncStatuses.delete(key);
+            closeKxmRuntimeContext(existing);
+          }
+          sendJson(response, 200, { ok: true, unregistered });
+          return;
+        }
         if (request.method === "POST" && url.pathname === "/v1/runs") {
           const body = await readJsonBody(request);
           const projectRoot = typeof body.projectRoot === "string" ? body.projectRoot : "";
@@ -31618,24 +31966,7 @@ async function startKxmRuntimeSupervisorInner(paths, requestedPortOption, now, e
             const delayMs = typeof body.delayMs === "number" && body.delayMs > 0 ? body.delayMs : 0;
             const createProducer = () => body.mode === "live" ? createKxmOneShotProducer({
               projectRoot,
-              timeoutMs: kxmProjectAdmissionLimits(bundle).agentStepTimeoutMs,
-              defaultHarness: String(bundle.project.value.defaultHarness ?? "pi"),
-              resolveHarness: (agentId) => {
-                const agent = bundle.agents.get(agentId);
-                return typeof agent?.value.harness === "string" ? agent.value.harness : void 0;
-              },
-              resolveModel: (agentId) => {
-                const agent = bundle.agents.get(agentId);
-                const model = agent?.value.model;
-                if (!model || typeof model !== "object" || Array.isArray(model)) return void 0;
-                const value = model;
-                const provider = typeof value.provider === "string" ? value.provider : void 0;
-                const modelName = typeof value.model === "string" ? value.model : void 0;
-                if (!provider || !modelName || !isRouteAdmitted(projectRoot, `${provider}/${modelName}`)) {
-                  throw new Error("producer_route_not_admitted");
-                }
-                return { provider, model: modelName };
-              }
+              timeoutMs: kxmProjectAdmissionLimits(bundle).agentStepTimeoutMs
             }) : createKxmSimulatedProducer(async () => {
               if (delayMs > 0) {
                 await new Promise((r) => setTimeout(r, delayMs));
@@ -31788,7 +32119,10 @@ async function startKxmRuntimeSupervisorInner(paths, requestedPortOption, now, e
             sendJson(response, 400, { ok: false, error: "runtime_request_invalid", message: `project ${requestedProjectId} is not the bound project ${context.projectId}` });
             return;
           }
-          const runs = context.eventStore.runsForProject(requestedProjectId, 50).map((stored) => {
+          const limitText = url.searchParams.get("limit");
+          const parsedLimit = limitText === null ? 50 : Number(limitText);
+          const limit = Number.isInteger(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 1e4) : 50;
+          const runs = context.eventStore.runsForProject(requestedProjectId, limit).map((stored) => {
             try {
               return projectKxmRunReadOnly(context, stored.runId);
             } catch (error) {
@@ -33679,8 +34013,8 @@ ${divider}
 }
 
 // plugins/kxm/src/ssh-remote.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync16, readdirSync as readdirSync9, rmSync as rmSync5, statSync as statSync5 } from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync16, readdirSync as readdirSync9, rmSync as rmSync5, statSync as statSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join22, resolve as resolve12 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
@@ -33755,7 +34089,7 @@ function parseSshConfig(configPath) {
     return [];
   }
 }
-function resolveSshHostG(host, execFn = spawnSync5) {
+function resolveSshHostG(host, execFn = spawnSync6) {
   try {
     const result = execFn("ssh", ["-G", host], { encoding: "utf-8" });
     if (result.status !== 0 || !result.stdout) {
@@ -33821,7 +34155,7 @@ function buildSshArgs(options) {
   args.push(options.host);
   return args;
 }
-function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync5) {
+function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync6) {
   const resolvedDir = ensureSocketDir(socketDir);
   const controlPath = join22(resolvedDir, "%C");
   try {
@@ -33833,7 +34167,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
     return false;
   }
 }
-function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync5) {
+function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync6) {
   const resolvedDir = ensureSocketDir(socketDir);
   const controlPath = join22(resolvedDir, "%C");
   try {
@@ -33853,7 +34187,7 @@ function pruneSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
     for (const entry of entries) {
       const fullPath = join22(resolvedDir, entry);
       try {
-        const stat = statSync5(fullPath);
+        const stat = statSync6(fullPath);
         if (stat.isSocket()) {
           rmSync5(fullPath, { force: true });
           removed++;
@@ -33867,7 +34201,7 @@ function pruneSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
 }
 function executeSshRun(params) {
   const startTime = Date.now();
-  const execSyncFn = params.execFn ?? spawnSync5;
+  const execSyncFn = params.execFn ?? spawnSync6;
   if (params.action === "info") {
     if (params.host) {
       const hostInfo = resolveSshHostG(params.host, execSyncFn);
@@ -34314,6 +34648,7 @@ export {
   acceptKxmRun,
   applyRestorePlan,
   assertClosedGateObservation,
+  assertDatabaseFile,
   assertKxmConfigError,
   attachKxmSupervisor,
   backupDatabaseFile,
@@ -34381,6 +34716,7 @@ export {
   kxmRunRevisionDrift,
   kxmRuntimePaths,
   kxmRuntimeRequest,
+  kxmSupervisorRecordIsLive,
   kxmSupervisorStatus,
   kxmSupervisorTokenFile,
   kxmToolPolicyRevision,