@kynver-app/runtime 0.1.108 → 0.1.116

package/dist/cli.js

@@ -1,22 +1,13 @@
 #!/usr/bin/env node
-
-// src/cli.ts
-import { mkdirSync as mkdirSync10, realpathSync } from "node:fs";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-
-// src/config.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir4, totalmem } from "node:os";
-import path8 from "node:path";
-
-// src/default-repo-discovery.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-import { fileURLToPath } from "node:url";
-
-// src/git.ts
-import { spawnSync } from "node:child_process";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/util.ts
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -125,42 +116,13 @@ function latestIso(values) {
 function secsAgo(ms) {
   return Math.max(0, Math.round((Date.now() - ms) / 1e3));
 }
+var init_util = __esm({
+  "src/util.ts"() {
+    "use strict";
+  }
+});
 
 // src/worker-env.ts
-var FORBIDDEN_WORKER_ENV_KEYS = [
-  "ANTHROPIC_API_KEY",
-  "ANALYST_API_KEY",
-  "RECRUITER_API_KEY",
-  "AUTH_SECRET",
-  "NEXTAUTH_SECRET",
-  "DATABASE_URL",
-  "PRODUCTION_DATABASE_URL",
-  "KYNVER_PRODUCTION_DATABASE_URL",
-  "REDIS_URL",
-  "GOOGLE_CLIENT_SECRET",
-  "GITHUB_CLIENT_SECRET",
-  "KYNVER_API_KEY",
-  "KYNVER_SERVICE_SECRET",
-  "KYNVER_RUNTIME_SECRET",
-  "KYNVER_CRON_SECRET",
-  "OPENCLAW_CRON_SECRET",
-  "QSTASH_TOKEN",
-  "QSTASH_CURRENT_SIGNING_KEY",
-  "QSTASH_NEXT_SIGNING_KEY",
-  "TOOL_SECRETS_KEK",
-  "TOOL_EXECUTOR_DISPATCH_SECRET",
-  "CLOUDFLARE_API_TOKEN",
-  "STRIPE_SECRET_KEY",
-  "STRIPE_WEBHOOK_SECRET",
-  "STRIPE_IDENTITY_WEBHOOK_SECRET",
-  "VOYAGE_API_KEY",
-  "PERPLEXITY_API_KEY",
-  "FRED_API_KEY",
-  "FMP_API_KEY",
-  "CURSOR_API_KEY"
-];
-var FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
-var FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
 function isForbiddenWorkerEnvKey(key) {
   if (FORBIDDEN_KEY_SET.has(key)) return true;
   return FORBIDDEN_SUFFIXES.some((suffix) => key.endsWith(suffix));
@@ -172,10 +134,55 @@ function scrubWorkerEnv(env) {
   }
   return next;
 }
+var FORBIDDEN_WORKER_ENV_KEYS, FORBIDDEN_KEY_SET, FORBIDDEN_SUFFIXES;
+var init_worker_env = __esm({
+  "src/worker-env.ts"() {
+    "use strict";
+    FORBIDDEN_WORKER_ENV_KEYS = [
+      "ANTHROPIC_API_KEY",
+      "ANALYST_API_KEY",
+      "RECRUITER_API_KEY",
+      "AUTH_SECRET",
+      "NEXTAUTH_SECRET",
+      "DATABASE_URL",
+      "PRODUCTION_DATABASE_URL",
+      "KYNVER_PRODUCTION_DATABASE_URL",
+      "REDIS_URL",
+      "GOOGLE_CLIENT_SECRET",
+      "GITHUB_CLIENT_SECRET",
+      "KYNVER_API_KEY",
+      "KYNVER_SERVICE_SECRET",
+      "KYNVER_RUNTIME_SECRET",
+      "KYNVER_CRON_SECRET",
+      "OPENCLAW_CRON_SECRET",
+      "QSTASH_TOKEN",
+      "QSTASH_CURRENT_SIGNING_KEY",
+      "QSTASH_NEXT_SIGNING_KEY",
+      "TOOL_SECRETS_KEK",
+      "TOOL_EXECUTOR_DISPATCH_SECRET",
+      "CLOUDFLARE_API_TOKEN",
+      "STRIPE_SECRET_KEY",
+      "STRIPE_WEBHOOK_SECRET",
+      "STRIPE_IDENTITY_WEBHOOK_SECRET",
+      "VOYAGE_API_KEY",
+      "PERPLEXITY_API_KEY",
+      "FRED_API_KEY",
+      "FMP_API_KEY",
+      "CURSOR_API_KEY"
+    ];
+    FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
+    FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
+  }
+});
 
 // src/git.ts
+import { spawnSync } from "node:child_process";
 function git(cwd, args, options = {}) {
-  const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+  const res = spawnSync(
+    "git",
+    args,
+    hiddenSpawnOptions({ cwd, encoding: "utf8" })
+  );
   if (res.status !== 0 && !options.allowFailure) {
     const message = `git ${args.join(" ")} failed: ${res.stderr || res.stdout}`;
     if (options.throwError) throw new Error(message);
@@ -191,7 +198,11 @@ function gitStatusShort(worktreePath) {
 }
 function gitCapture(cwd, args) {
   try {
-    const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+    const res = spawnSync(
+      "git",
+      args,
+      hiddenSpawnOptions({ cwd, encoding: "utf8" })
+    );
     return {
       status: res.status,
       stdout: res.stdout || "",
@@ -289,6 +300,13 @@ function unknownAncestry(base, error, head = null) {
     error
   };
 }
+var init_git = __esm({
+  "src/git.ts"() {
+    "use strict";
+    init_util();
+    init_worker_env();
+  }
+});
 
 // src/path-values.ts
 import { homedir } from "node:os";
@@ -318,15 +336,17 @@ function redactHomePath(value) {
 function displayUserPath(value) {
   return redactHomePath(value);
 }
+var init_path_values = __esm({
+  "src/path-values.ts"() {
+    "use strict";
+  }
+});
 
 // src/default-repo-discovery.ts
-var WELL_KNOWN_REPO_DIRS = [
-  "Kynver",
-  "repos/Kynver",
-  "repos/kynver-source-main",
-  "code/Kynver",
-  "projects/Kynver"
-];
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+import { fileURLToPath } from "node:url";
 function readPackageName(repoRoot) {
   const pkgPath = path3.join(repoRoot, "package.json");
   if (!existsSync2(pkgPath)) return null;
@@ -391,6 +411,21 @@ function discoverDefaultRepoCandidates(opts) {
 function discoverDefaultRepo(opts) {
   return discoverDefaultRepoCandidates(opts)[0] ?? null;
 }
+var WELL_KNOWN_REPO_DIRS;
+var init_default_repo_discovery = __esm({
+  "src/default-repo-discovery.ts"() {
+    "use strict";
+    init_git();
+    init_path_values();
+    WELL_KNOWN_REPO_DIRS = [
+      "Kynver",
+      "repos/Kynver",
+      "repos/kynver-source-main",
+      "code/Kynver",
+      "projects/Kynver"
+    ];
+  }
+});
 
 // src/box-identity.ts
 function normalizeWorkerPoolBoxKind(raw) {
@@ -440,9 +475,11 @@ function resolveBoxIdentity(env = process.env, config = {}) {
 function resolveBoxKindFromConfig(config = {}, env = process.env) {
   return resolveBoxIdentity(env, config).boxKind;
 }
-
-// src/resource-gate.ts
-import os2 from "node:os";
+var init_box_identity = __esm({
+  "src/box-identity.ts"() {
+    "use strict";
+  }
+});
 
 // src/bounded-build/meminfo.ts
 import { readFileSync as readFileSync3 } from "node:fs";
@@ -463,18 +500,14 @@ function readMemAvailableBytes(meminfoText) {
   }
   return os.freemem();
 }
-
-// src/resource-gate.ts
-import path7 from "node:path";
-
-// src/disk-gate.ts
-import { statfsSync as statfsSync2 } from "node:fs";
+var init_meminfo = __esm({
+  "src/bounded-build/meminfo.ts"() {
+    "use strict";
+  }
+});
 
 // src/wsl-host.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4, statfsSync } from "node:fs";
-var DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
-var DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
-var DEFAULT_WSL_HOST_MOUNT = "/mnt/c";
 function isWslHost() {
   if (process.platform !== "linux") return false;
   for (const probe of ["/proc/sys/kernel/osrelease", "/proc/version"]) {
@@ -490,23 +523,23 @@ function isWslHost() {
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path71 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path73 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path71);
+    stats = statfs(path73);
   } catch (error) {
     return {
       ok: false,
-      path: path71,
+      path: path73,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path71}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path73}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -520,11 +553,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path71} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path73} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path71,
+    path: path73,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -537,19 +570,25 @@ function observeWslHostDisk(options = {}) {
 function summarizeWslRecoverySteps() {
   return "Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP%); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers. Full runbook: docs/runbooks/wsl-disk-pressure.md.";
 }
+var DEFAULT_WSL_HOST_WARN_FREE_BYTES, DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES, DEFAULT_WSL_HOST_MOUNT;
+var init_wsl_host = __esm({
+  "src/wsl-host.ts"() {
+    "use strict";
+    DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
+    DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
+    DEFAULT_WSL_HOST_MOUNT = "/mnt/c";
+  }
+});
 
 // src/disk-gate.ts
-var DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
-var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
-var DEFAULT_MAX_USED_PERCENT = 80;
-var DEFAULT_HARD_MAX_USED_PERCENT = 90;
+import { statfsSync as statfsSync2 } from "node:fs";
 function observeRunnerDiskGate(input = {}) {
-  const path71 = input.diskPath?.trim() || "/";
+  const path73 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path71);
+  const stats = statfsSync2(path73);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -572,7 +611,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path71,
+    path: path73,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -584,17 +623,22 @@ function observeRunnerDiskGate(input = {}) {
     wslHost
   };
 }
-
-// src/run-store.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import path5 from "node:path";
+var DEFAULT_WARN_FREE_BYTES, DEFAULT_CRITICAL_FREE_BYTES, DEFAULT_MAX_USED_PERCENT, DEFAULT_HARD_MAX_USED_PERCENT;
+var init_disk_gate = __esm({
+  "src/disk-gate.ts"() {
+    "use strict";
+    init_wsl_host();
+    DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
+    DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
+    DEFAULT_MAX_USED_PERCENT = 80;
+    DEFAULT_HARD_MAX_USED_PERCENT = 90;
+  }
+});
 
 // src/paths.ts
 import { existsSync as existsSync4 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import path4 from "node:path";
-var LEGACY_ROOT = path4.join(homedir3(), ".openclaw", "harness");
-var HARNESS_LAYOUT_DIR_NAMES = /* @__PURE__ */ new Set(["runs", "worktrees"]);
 function normalizeHarnessRoot(root) {
   let resolved = path4.resolve(resolveUserPath(root.trim()));
   while (HARNESS_LAYOUT_DIR_NAMES.has(path4.basename(resolved))) {
@@ -629,8 +673,21 @@ function getHarnessPaths() {
 function runDir(runsDir, id) {
   return path4.join(runsDir, safeSlug(id));
 }
+var LEGACY_ROOT, HARNESS_LAYOUT_DIR_NAMES;
+var init_paths = __esm({
+  "src/paths.ts"() {
+    "use strict";
+    init_config();
+    init_path_values();
+    init_util();
+    LEGACY_ROOT = path4.join(homedir3(), ".openclaw", "harness");
+    HARNESS_LAYOUT_DIR_NAMES = /* @__PURE__ */ new Set(["runs", "worktrees"]);
+  }
+});
 
 // src/run-store.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import path5 from "node:path";
 function getPaths() {
   return getHarnessPaths();
 }
@@ -688,6 +745,13 @@ function runDirectory(id) {
 function runDirectoryAt(harnessRoot, id) {
   return runDir(harnessRunsDir(harnessRoot), safeSlug(id));
 }
+var init_run_store = __esm({
+  "src/run-store.ts"() {
+    "use strict";
+    init_paths();
+    init_util();
+  }
+});
 
 // src/run-worker-index.ts
 import { existsSync as existsSync6, readdirSync as readdirSync3 } from "node:fs";
@@ -705,12 +769,13 @@ function listRunWorkerNames(run) {
   }
   return [...names];
 }
-
-// src/harness-worker-active.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-
-// src/heartbeat.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+var init_run_worker_index = __esm({
+  "src/run-worker-index.ts"() {
+    "use strict";
+    init_run_store();
+    init_util();
+  }
+});
 
 // src/heartbeat-final-result.ts
 function tryParseJsonObject(text) {
@@ -761,9 +826,14 @@ function terminalFinalResultFromHeartbeatRow(row) {
   if (embedded) return embedded;
   return summary;
 }
+var init_heartbeat_final_result = __esm({
+  "src/heartbeat-final-result.ts"() {
+    "use strict";
+  }
+});
 
 // src/heartbeat.ts
-var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
 function isTerminalHeartbeatPhase(phase) {
   return phase === "complete";
 }
@@ -826,29 +896,17 @@ function parseHeartbeat(file) {
   }
   return result;
 }
-
-// src/stream.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+var HEARTBEAT_FUTURE_SKEW_MS;
+var init_heartbeat = __esm({
+  "src/heartbeat.ts"() {
+    "use strict";
+    init_heartbeat_final_result();
+    init_util();
+    HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+  }
+});
 
 // src/repo-search.ts
-var RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
-var RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
-  "-e",
-  "--regexp",
-  "-f",
-  "--file",
-  "-m",
-  "--max-count",
-  "-A",
-  "--after-context",
-  "-B",
-  "--before-context",
-  "-C",
-  "--context",
-  "-g",
-  "--glob",
-  "--iglob"
-]);
 function binaryName(token) {
   if (!token) return null;
   const base = token.split("/").pop() ?? token;
@@ -1047,11 +1105,32 @@ function diagnoseRepoSearchFailure(input) {
   }
   return null;
 }
+var RG_BINARIES, RG_OPTS_WITH_VALUE;
+var init_repo_search = __esm({
+  "src/repo-search.ts"() {
+    "use strict";
+    RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
+    RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
+      "-e",
+      "--regexp",
+      "-f",
+      "--file",
+      "-m",
+      "--max-count",
+      "-A",
+      "--after-context",
+      "-B",
+      "--before-context",
+      "-C",
+      "--context",
+      "-g",
+      "--glob",
+      "--iglob"
+    ]);
+  }
+});
 
 // src/shell-command-outcome.ts
-var NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
-var RG_CMD_RE = /\b(rg|ripgrep)\b/i;
-var RG_REAL_ERROR_RE = /\b(error|invalid|unknown|panic|not found)\b/i;
 function tidy(text, max = 200) {
   const one = text.replace(/\s+/g, " ").trim();
   return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
@@ -1255,8 +1334,19 @@ function classifyShellCommandOutcome(input) {
     summary: `command failed (exit ${input.exitCode}): ${tail}`
   };
 }
+var NPM_AUDIT_RE, RG_CMD_RE, RG_REAL_ERROR_RE;
+var init_shell_command_outcome = __esm({
+  "src/shell-command-outcome.ts"() {
+    "use strict";
+    init_repo_search();
+    NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
+    RG_CMD_RE = /\b(rg|ripgrep)\b/i;
+    RG_REAL_ERROR_RE = /\b(error|invalid|unknown|panic|not found)\b/i;
+  }
+});
 
 // src/stream.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 function eventTimestampIso(event) {
   const tsMs = event.timestamp_ms;
   return event.timestamp || event.ts || (tsMs ? new Date(tsMs).toISOString() : void 0);
@@ -1422,38 +1512,15 @@ function summarizeEvent(event) {
   }
   return void 0;
 }
+var init_stream = __esm({
+  "src/stream.ts"() {
+    "use strict";
+    init_shell_command_outcome();
+    init_util();
+  }
+});
 
 // src/exit-classify.ts
-var FAILURE_PATTERNS = [
-  {
-    test: /\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /model preflight failed/i,
-    label: "model/provider preflight failed"
-  },
-  {
-    test: /\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,
-    label: "provider CLI is missing or not on PATH"
-  },
-  {
-    test: /\bfailed to spawn\b/i,
-    label: "provider failed to spawn the worker process"
-  },
-  {
-    test: /\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,
-    label: "provider authentication failed"
-  }
-];
 function tidy2(errorText, max = 240) {
   const oneLine2 = errorText.replace(/\s+/g, " ").trim();
   return oneLine2.length > max ? `${oneLine2.slice(0, max - 1)}\u2026` : oneLine2;
@@ -1468,6 +1535,42 @@ function classifyExitFailure(errorText) {
   }
   return null;
 }
+var FAILURE_PATTERNS;
+var init_exit_classify = __esm({
+  "src/exit-classify.ts"() {
+    "use strict";
+    FAILURE_PATTERNS = [
+      {
+        test: /\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /model preflight failed/i,
+        label: "model/provider preflight failed"
+      },
+      {
+        test: /\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,
+        label: "provider CLI is missing or not on PATH"
+      },
+      {
+        test: /\bfailed to spawn\b/i,
+        label: "provider failed to spawn the worker process"
+      },
+      {
+        test: /\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,
+        label: "provider authentication failed"
+      }
+    ];
+  }
+});
 
 // src/exited-salvage.ts
 function trimOrNull(value) {
@@ -1526,6 +1629,11 @@ function assessExitedWorkerSalvage(input) {
     attentionReason: buildAttentionReason(kind, uncommittedCount, headCommit)
   };
 }
+var init_exited_salvage = __esm({
+  "src/exited-salvage.ts"() {
+    "use strict";
+  }
+});
 
 // src/landing-gate.ts
 function trimOrNull2(value) {
@@ -1571,6 +1679,11 @@ function landingAttentionReason(verdict) {
   if (!verdict.blocked) return void 0;
   return verdict.detail ?? verdict.reason ?? "dirty_worktree_no_pr";
 }
+var init_landing_gate = __esm({
+  "src/landing-gate.ts"() {
+    "use strict";
+  }
+});
 
 // src/worker-final-result-embed.ts
 function tryParseJsonObject2(text) {
@@ -1620,6 +1733,11 @@ function extractEmbeddedWorkerFinalResultRecord(value) {
   }
   return best;
 }
+var init_worker_final_result_embed = __esm({
+  "src/worker-final-result-embed.ts"() {
+    "use strict";
+  }
+});
 
 // src/landing-contract-gate.ts
 function trimOrNull3(value) {
@@ -1779,10 +1897,14 @@ function landingContractAttentionReason(verdict) {
   if (!verdict.blocked) return void 0;
   return verdict.detail ?? verdict.reason;
 }
+var init_landing_contract_gate = __esm({
+  "src/landing-contract-gate.ts"() {
+    "use strict";
+    init_worker_final_result_embed();
+  }
+});
 
 // src/status.ts
-var NO_START_MS = 18e4;
-var STALE_MS = 6e5;
 function computeAttention(input) {
   const now = Date.now();
   if (input.completionBlocker && !isSkippedTerminalCompletionBlocker(input.completionBlocker)) {
@@ -1974,7 +2096,15 @@ function computeWorkerStatus(worker, options = {}) {
     changedFiles,
     gitAncestry,
     instructionPolicyFingerprint: worker.instructionPolicyFingerprint ?? null,
-    instructionPolicyEvidence: worker.instructionPolicyEvidence ?? null
+    instructionPolicyEvidence: worker.instructionPolicyEvidence ?? null,
+    model: worker.model ?? worker.orchestrationAudit?.model ?? null,
+    provider: worker.orchestrationAudit?.provider ?? null,
+    boxKind: worker.boxKind ?? null,
+    boxId: worker.boxId ?? null,
+    runtimeId: worker.runtimeId ?? null,
+    personaSlug: worker.personaSlug ?? null,
+    dispatched: worker.dispatched ?? null,
+    localOnly: worker.localOnly ?? null
   };
 }
 function isFinishedWorkerStatus(status) {
@@ -1996,8 +2126,26 @@ function deriveRunStatus(fallback, workers) {
   if (workers.some((w) => w.status === "running")) return "running";
   return fallback;
 }
+var NO_START_MS, STALE_MS;
+var init_status = __esm({
+  "src/status.ts"() {
+    "use strict";
+    init_heartbeat();
+    init_stream();
+    init_exit_classify();
+    init_exited_salvage();
+    init_git();
+    init_landing_gate();
+    init_landing_contract_gate();
+    init_worker_final_result_embed();
+    init_util();
+    NO_START_MS = 18e4;
+    STALE_MS = 6e5;
+  }
+});
 
 // src/harness-worker-active.ts
+import { readFileSync as readFileSync7 } from "node:fs";
 function pidCommandLine(pid) {
   if (!pid || process.platform !== "linux") return null;
   try {
@@ -2023,12 +2171,16 @@ function isActiveHarnessWorker(worker) {
   if (status.alive && !workerProcessMatchesRecord(worker)) return false;
   return status.alive && !status.finalResult && status.attention.state !== "done";
 }
+var init_harness_worker_active = __esm({
+  "src/harness-worker-active.ts"() {
+    "use strict";
+    init_status();
+  }
+});
 
 // src/resource-gate.ts
-var DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
-var DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
-var DEFAULT_MEM_UTILIZATION = 0.85;
-var AUTO_MAX_WORKERS_CEILING = 64;
+import os2 from "node:os";
+import path7 from "node:path";
 function positiveInt(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -2134,6 +2286,25 @@ function observeRunnerResourceGate(input) {
     ...diskGate ? { diskGate } : {}
   };
 }
+var DEFAULT_PER_WORKER_MEM_BYTES, DEFAULT_MEM_RESERVE_BYTES, DEFAULT_MEM_UTILIZATION, AUTO_MAX_WORKERS_CEILING;
+var init_resource_gate = __esm({
+  "src/resource-gate.ts"() {
+    "use strict";
+    init_meminfo();
+    init_config();
+    init_box_identity();
+    init_worker_cap_source();
+    init_disk_gate();
+    init_run_store();
+    init_run_worker_index();
+    init_harness_worker_active();
+    init_util();
+    DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+    DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+    DEFAULT_MEM_UTILIZATION = 0.85;
+    AUTO_MAX_WORKERS_CEILING = 64;
+  }
+});
 
 // src/worker-cap-source.ts
 function positiveInt2(value, fallback) {
@@ -2205,12 +2376,113 @@ function recommendSetupWorkerCap(input = {}) {
     diskFreeBytes: input.diskFreeBytes ?? null
   };
 }
+var init_worker_cap_source = __esm({
+  "src/worker-cap-source.ts"() {
+    "use strict";
+    init_resource_gate();
+  }
+});
 
-// src/config.ts
+// src/device-login.ts
+var device_login_exports = {};
+__export(device_login_exports, {
+  runDeviceLogin: () => runDeviceLogin
+});
 import os3 from "node:os";
-var CONFIG_DIR = path8.join(homedir4(), ".kynver");
-var CONFIG_FILE = path8.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path8.join(CONFIG_DIR, "credentials");
+function resolveDeviceBaseUrl(args) {
+  const raw = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || (typeof args.baseUrl === "string" ? args.baseUrl : void 0) || process.env.KYNVER_API_URL || loadUserConfig().apiBaseUrl;
+  return raw ? trimTrailingSlash(String(raw)) : void 0;
+}
+async function sleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runDeviceLogin(args) {
+  const base = resolveDeviceBaseUrl(args);
+  if (!base) {
+    console.error(
+      "kynver login (device flow) requires a Kynver URL \u2014 pass --api-base-url https://your-kynver-site, set KYNVER_API_URL, or run `kynver setup` first."
+    );
+    return { ok: false };
+  }
+  const clientName = `${os3.hostname()} (${os3.platform()})`;
+  let start;
+  try {
+    const res = await fetch(`${base}/api/auth/device/code`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientName })
+    });
+    if (!res.ok) {
+      console.error(`Could not start device authorization (${res.status}).`);
+      return { ok: false };
+    }
+    start = await res.json();
+  } catch (err) {
+    console.error(`Could not reach ${base}: ${err.message}`);
+    return { ok: false };
+  }
+  const verifyUrl = start.verification_uri_complete || start.verification_uri;
+  console.log("");
+  console.log("  Authorize this machine:");
+  console.log(`    1. Open: ${verifyUrl}`);
+  console.log(`    2. Confirm the code: ${start.user_code}`);
+  console.log("");
+  console.log("  Waiting for approval\u2026");
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let intervalMs = Math.max(1, start.interval) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let body;
+    try {
+      const res = await fetch(`${base}/api/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_code: start.device_code })
+      });
+      body = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    switch (body.status) {
+      case "approved":
+        if (body.api_key) {
+          saveApiKey(body.api_key);
+          console.log("  Approved \u2014 this machine is now linked to your Kynver account.");
+          return { ok: true, apiKey: body.api_key };
+        }
+        return { ok: false };
+      case "slow_down":
+        intervalMs += 2e3;
+        break;
+      case "authorization_pending":
+        if (typeof body.interval === "number") intervalMs = Math.max(intervalMs, body.interval * 1e3);
+        break;
+      case "access_denied":
+        console.error("  Request was denied in the browser.");
+        return { ok: false };
+      case "expired_token":
+        console.error("  The code expired before it was approved. Run `kynver login` again.");
+        return { ok: false };
+      default:
+        break;
+    }
+  }
+  console.error("  Timed out waiting for approval. Run `kynver login` again.");
+  return { ok: false };
+}
+var init_device_login = __esm({
+  "src/device-login.ts"() {
+    "use strict";
+    init_config();
+    init_util();
+  }
+});
+
+// src/config.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir4, totalmem } from "node:os";
+import path8 from "node:path";
+import os4 from "node:os";
 function loadUserConfig() {
   if (!existsSync9(CONFIG_FILE)) return {};
   try {
@@ -2249,8 +2521,6 @@ function inferSetupFields(existing, args) {
     ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
   };
 }
-var SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
-var SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
 function resolveSetupWorkerConfig(existing, args, totalMemBytes = totalmem()) {
   const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
   const explicitBoxKindArg = typeof args.boxKind === "string" ? args.boxKind : typeof args["box-kind"] === "string" ? String(args["box-kind"]) : void 0;
@@ -2471,7 +2741,7 @@ async function runSetup(args) {
     diskPath: typeof args.diskPath === "string" ? args.diskPath : "/"
   });
   const capRecommendation = recommendSetupWorkerCap({
-    totalMemBytes: os3.totalmem(),
+    totalMemBytes: os4.totalmem(),
     diskPath: diskGate.path,
     diskGateOk: diskGate.ok,
     diskFreeBytes: diskGate.freeBytes,
@@ -2520,10 +2790,104 @@ async function runSetup(args) {
 }
 async function runLogin(args) {
   const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
-  if (!apiKey) failConfig("kynver login requires --api-key or KYNVER_API_KEY");
-  saveApiKey(apiKey);
+  if (apiKey) {
+    saveApiKey(apiKey);
+    console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
+    return;
+  }
+  const { runDeviceLogin: runDeviceLogin2 } = await Promise.resolve().then(() => (init_device_login(), device_login_exports));
+  const result = await runDeviceLogin2(args);
+  if (!result.ok) process.exit(1);
   console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
 }
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, SETUP_PER_WORKER_MEM_BYTES, SETUP_MEM_RESERVE_BYTES;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_default_repo_discovery();
+    init_path_values();
+    init_util();
+    init_box_identity();
+    init_worker_cap_source();
+    init_disk_gate();
+    CONFIG_DIR = path8.join(homedir4(), ".kynver");
+    CONFIG_FILE = path8.join(CONFIG_DIR, "config.json");
+    CREDENTIALS_FILE = path8.join(CONFIG_DIR, "credentials");
+    SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+    SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+  }
+});
+
+// src/cli.ts
+init_config();
+import { mkdirSync as mkdirSync11, realpathSync } from "node:fs";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+
+// src/bootstrap.ts
+init_config();
+init_util();
+init_device_login();
+import os5 from "node:os";
+function resolveBootstrapBaseUrl(args) {
+  const raw = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || (typeof args.baseUrl === "string" ? args.baseUrl : void 0) || process.env.KYNVER_API_URL || loadUserConfig().apiBaseUrl;
+  return raw ? trimTrailingSlash(String(raw)) : void 0;
+}
+async function fetchPrimaryAgentOs(base, apiKey) {
+  const res = await fetch(`${base}/api/agent-os`, {
+    headers: { Authorization: `Bearer ${apiKey}` }
+  });
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => null);
+  if (!body?.primarySlug) return null;
+  const match = body.items?.find((it) => it.slug === body.primarySlug);
+  if (match?.id && match.slug) return { id: match.id, slug: match.slug };
+  return { id: "", slug: body.primarySlug };
+}
+async function runBootstrap(args) {
+  const base = resolveBootstrapBaseUrl(args);
+  if (!base) {
+    console.error(
+      "kynver bootstrap requires a Kynver URL \u2014 pass --api-base-url https://your-kynver-site or set KYNVER_API_URL."
+    );
+    process.exit(1);
+  }
+  if (!loadApiKey()) {
+    if (typeof args.apiKey === "string") {
+      saveApiKey(args.apiKey);
+    } else {
+      const login = await runDeviceLogin({ ...args, apiBaseUrl: base });
+      if (!login.ok) process.exit(1);
+    }
+  }
+  const apiKey = loadApiKey();
+  if (!apiKey) {
+    console.error("No API key after login \u2014 aborting.");
+    process.exit(1);
+  }
+  const primary = await fetchPrimaryAgentOs(base, apiKey);
+  if (!primary) {
+    console.error(
+      "Could not resolve your AgentOS workspace from the account. Confirm this account has AgentOS access, then retry."
+    );
+    process.exit(1);
+  }
+  const setupArgs = {
+    ...args,
+    apiBaseUrl: base,
+    agentOsSlug: primary.slug,
+    ...primary.id ? { agentOsId: primary.id } : {},
+    // Best-effort repo discovery unless the caller pinned one.
+    ...typeof args.repo === "string" ? {} : { discoverRepo: true }
+  };
+  await runSetup(setupArgs);
+  console.log("");
+  console.log(`  Bootstrap complete \u2014 ${os5.hostname()} is linked to workspace "${primary.slug}".`);
+  console.log("  Next: run autonomous work with `kynver daemon --run <RUN_ID> --agent-os-id <AOS_ID> --execute`");
+  console.log("  (create a run first with `kynver run create --repo /path/to/repo`).");
+}
+
+// src/dispatch.ts
+init_config();
 
 // src/callback-headers.ts
 function buildHarnessCallbackHeaders(secret) {
@@ -2547,6 +2911,7 @@ function buildHarnessCallbackHeaders(secret) {
 }
 
 // src/callbacks.ts
+init_config();
 function callbackTimeoutMs() {
   const parsed = Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);
   if (Number.isFinite(parsed) && parsed > 0) return Math.floor(parsed);
@@ -2760,6 +3125,12 @@ function resolveDispatchNextLaneFilter(raw) {
   return normalizeDispatchNextLaneFilter(raw) ?? "any";
 }
 
+// src/dispatch.ts
+init_disk_gate();
+init_resource_gate();
+init_run_store();
+init_run_store();
+
 // src/model-routing-task-enrich.ts
 function taskString(task, key) {
   const v = task[key];
@@ -2809,6 +3180,9 @@ function enrichTaskForModelRouting(task) {
   return { ...task, roleLane };
 }
 
+// src/model-routing.ts
+init_config();
+
 // src/worker-provider-policy.ts
 var DEFAULT_WORKER_PROVIDER = "cursor";
 var CLAUDE_FAMILY = /* @__PURE__ */ new Set(["claude", "opus", "anthropic"]);
@@ -3472,6 +3846,8 @@ function resolveOrchestrationRouting(input) {
 }
 
 // src/providers/claude.ts
+init_worker_env();
+init_util();
 import { closeSync, openSync } from "node:fs";
 import { spawn } from "node:child_process";
 
@@ -3609,13 +3985,17 @@ var claudeProvider = {
 };
 
 // src/providers/codex.ts
+init_worker_env();
+init_util();
 import { closeSync as closeSync3, existsSync as existsSync15, openSync as openSync3 } from "node:fs";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/providers/hermes-codex.ts
+init_worker_env();
+init_util();
 import { closeSync as closeSync2, openSync as openSync2 } from "node:fs";
 import { spawn as spawn2 } from "node:child_process";
-var HERMES_OPENAI_CODEX_DEFAULT_MODEL = "gpt-5.4";
+var HERMES_OPENAI_CODEX_DEFAULT_MODEL = process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim() || "gpt-5.4";
 function hermesWorkerEnv() {
   return scrubWorkerEnv({
     ...process.env,
@@ -3683,7 +4063,10 @@ var hermesCodexProvider = {
 };
 
 // src/providers/codex.ts
-var CODEX_DEFAULT_MODEL = "gpt-5.4";
+function resolveCodexDefaultModel() {
+  return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim() || "gpt-5.4";
+}
+var CODEX_DEFAULT_MODEL = resolveCodexDefaultModel();
 function resolveCodexBin() {
   return process.env.KYNVER_CODEX_BIN?.trim() || process.env.CODEX_BIN?.trim() || "codex";
 }
@@ -3935,7 +4318,11 @@ function readHarnessRetryLimits() {
 }
 
 // src/lease-renewal.ts
+init_config();
 import path14 from "node:path";
+init_run_store();
+init_status();
+init_util();
 
 // src/harness-lease-owner.ts
 var HARNESS_LEASE_PREFIX = "kynver-harness:";
@@ -3971,12 +4358,14 @@ function resolveHarnessLeaseOwnerForRenewal(input) {
 }
 
 // src/runner-identity.ts
-import os5 from "node:os";
+import os7 from "node:os";
 
 // src/box-resource-snapshot-shared.ts
-import os4 from "node:os";
+init_box_identity();
+init_box_identity();
+import os6 from "node:os";
 function defaultBoxId(boxKind, hostLabel) {
-  const host = (hostLabel ?? os4.hostname()).trim().toLowerCase().replace(/\s+/g, "-") || "unknown-host";
+  const host = (hostLabel ?? os6.hostname()).trim().toLowerCase().replace(/\s+/g, "-") || "unknown-host";
   return `${boxKind}:${host}`;
 }
 
@@ -3987,10 +4376,10 @@ function trimOrNull5(value) {
 }
 function resolveRunnerPresencePayload(input = {}) {
   const env = input.env ?? process.env;
-  const runnerId = trimOrNull5(env.KYNVER_RUNTIME_ID) ?? trimOrNull5(env.OPENCLAW_RUNTIME_ID) ?? trimOrNull5(env.HOSTNAME) ?? os5.hostname();
+  const runnerId = trimOrNull5(env.KYNVER_RUNTIME_ID) ?? trimOrNull5(env.OPENCLAW_RUNTIME_ID) ?? trimOrNull5(env.HOSTNAME) ?? os7.hostname();
   return {
     runnerId,
-    hostname: trimOrNull5(env.HOSTNAME) ?? os5.hostname(),
+    hostname: trimOrNull5(env.HOSTNAME) ?? os7.hostname(),
     profile: trimOrNull5(env.KYNVER_RUNNER_PROFILE) ?? trimOrNull5(env.OPENCLAW_RUNNER_PROFILE),
     harnessRepo: trimOrNull5(env.KYNVER_HARNESS_REPO) ?? trimOrNull5(env.KYNVER_DEFAULT_REPO),
     runId: input.runId ?? null
@@ -4075,6 +4464,9 @@ function hasLiveWorkerForTask(runId, taskId) {
 }
 
 // src/supervisor.ts
+init_git();
+init_run_store();
+init_run_store();
 import { existsSync as existsSync19, mkdirSync as mkdirSync4 } from "node:fs";
 import path21 from "node:path";
 
@@ -4224,10 +4616,18 @@ function buildPrompt(input) {
   ].join("\n");
 }
 
+// src/supervisor.ts
+init_util();
+
+// src/providers/registry.ts
+init_config();
+
 // src/providers/cursor.ts
+init_util();
+init_worker_env();
 import { closeSync as closeSync4, existsSync as existsSync17, mkdirSync as mkdirSync3, openSync as openSync4, statSync as statSync4, unlinkSync } from "node:fs";
 import { spawn as spawn4 } from "node:child_process";
-import os6 from "node:os";
+import os8 from "node:os";
 import path16 from "node:path";
 
 // src/providers/cursor-windows.ts
@@ -4338,7 +4738,7 @@ function positiveIntEnv(name, fallback) {
   return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : fallback;
 }
 function cursorStartLockPath() {
-  const root = process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim() || path16.join(os6.homedir(), ".kynver", "locks");
+  const root = process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim() || path16.join(os8.homedir(), ".kynver", "locks");
   mkdirSync3(root, { recursive: true });
   return path16.join(root, "cursor-agent-start.lock");
 }
@@ -4464,12 +4864,14 @@ function resolveWorkerProvider(name) {
 }
 
 // src/auto-complete.ts
+init_util();
 import { spawn as spawn5 } from "node:child_process";
 import { existsSync as existsSync18, openSync as openSync5, closeSync as closeSync5 } from "node:fs";
 import path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/completion-ack.ts
+init_run_store();
 function hasCompletionAck(worker) {
   return Boolean(worker.completionReportedAt?.trim());
 }
@@ -4497,7 +4899,12 @@ function hasTerminalCompletionAck(worker) {
   return hasCompletionAck(worker) && !shouldReplayHarnessCompletion(worker);
 }
 
+// src/auto-complete.ts
+init_run_store();
+init_status();
+
 // src/worker-ops.ts
+init_config();
 import path19 from "node:path";
 
 // src/completion-response.ts
@@ -4539,6 +4946,10 @@ function completionPostSucceeded(summary) {
   return summary.taskAdvanced;
 }
 
+// src/worker-ops.ts
+init_run_store();
+init_exited_salvage();
+
 // src/harness-expert-review.ts
 var EXPERT_LANE_REVIEW_REF = "expert-lane-pr-review:";
 var PLAN_REVIEW_EXECUTOR_REF = "plan-review-task";
@@ -4706,6 +5117,7 @@ function normalizeOwnerRepo(value) {
 }
 
 // src/pr-handoff/pr-handoff-gh.ts
+init_git();
 function capture(bin, cwd, args) {
   try {
     const res = spawnSync3(bin, args, { cwd, encoding: "utf8" });
@@ -5076,6 +5488,10 @@ function ensurePrReadyHandoff(input, exec = defaultPrHandoffExec) {
   };
 }
 
+// src/worker-ops.ts
+init_status();
+init_stream();
+
 // src/material-worktree-changes.ts
 function materialWorktreeChanges(changedFiles) {
   return changedFiles.filter((line) => {
@@ -5118,8 +5534,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path71 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path71);
+    const path73 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path73);
   });
 }
 
@@ -5204,6 +5620,9 @@ function assessWorktreeCompletionHandoff(input) {
 }
 
 // src/worker-lifecycle.ts
+init_run_store();
+init_status();
+init_util();
 import path17 from "node:path";
 var TASK_LEFT_RUNNING = /* @__PURE__ */ new Set([
   "awaiting_review",
@@ -5295,7 +5714,11 @@ function syncCompletionAcknowledgedFromOperatorTick(runId, operatorTick) {
   return synced;
 }
 
+// src/worker-ops.ts
+init_util();
+
 // src/validate.ts
+init_util();
 import path18 from "node:path";
 var RUN_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
 var WORKER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
@@ -5648,32 +6071,98 @@ function workerStatus(args) {
   writeJson(path19.join(worker.workerDir, "last-status.json"), status);
   console.log(JSON.stringify(status, null, 2));
 }
+function buildWorkerListDrilldownCommands(runId) {
+  return {
+    full: `kynver worker list --run ${runId} --full`,
+    blocked: `kynver worker list --run ${runId} --blocked`,
+    running: `kynver worker list --run ${runId} --running`,
+    task: `kynver worker list --run ${runId} --task <task-id>`,
+    worker: `kynver worker list --run ${runId} --worker <worker>`,
+    runFull: `kynver run status --run ${runId} --full`,
+    workerFull: `kynver worker status --run ${runId} --name <worker>`,
+    workerTail: `kynver worker tail --run ${runId} --name <worker> --lines 80`
+  };
+}
+function asOptionalArg(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : void 0;
+}
+function activeWorkerFilters(args) {
+  const filters = {};
+  if (args.blocked === true || args.blocked === "true") filters.blocked = true;
+  if (args.running === true || args.running === "true") filters.running = true;
+  const task = asOptionalArg(args.task ?? args.taskId);
+  if (task) filters.task = task;
+  const worker = asOptionalArg(args.worker ?? args.name);
+  if (worker) filters.worker = worker;
+  const status = asOptionalArg(args.status);
+  if (status) filters.status = status;
+  return filters;
+}
+function workerMatchesFilters(worker, filters) {
+  if (filters.blocked) {
+    const attention = typeof worker.attention === "string" ? worker.attention : "";
+    const status = typeof worker.status === "string" ? worker.status : "";
+    if (!(attention === "blocked" || attention === "needs_attention" || attention === "stale" || status === "blocked")) {
+      return false;
+    }
+  }
+  if (filters.running) {
+    if (!(worker.status === "running" && worker.attention !== "blocked" && worker.attention !== "needs_attention")) {
+      return false;
+    }
+  }
+  if (typeof filters.task === "string" && worker.taskId !== filters.task) return false;
+  if (typeof filters.worker === "string" && worker.worker !== filters.worker) return false;
+  if (typeof filters.status === "string" && worker.status !== filters.status) return false;
+  return true;
+}
+function applyWorkerFilters(board, args) {
+  const filters = activeWorkerFilters(args);
+  if (Object.keys(filters).length === 0) return board;
+  const workers = board.workers.filter((worker) => workerMatchesFilters(worker, filters));
+  const filtered = {
+    ...board,
+    workerCount: workers.length,
+    needsAttention: workers.filter((w) => w.attention && w.attention !== "ok" && w.attention !== "done").map((w) => w.worker),
+    workers,
+    activeFilters: filters
+  };
+  if (board.summary) {
+    filtered.summary = {
+      statusCounts: countBy(workers, "status"),
+      attentionCounts: countBy(workers, "attention"),
+      lifecycleCounts: countBy(workers, "lifecycleStage")
+    };
+  }
+  if (board.controller) filtered.controller = buildControllerSummary(workers);
+  return filtered;
+}
 function workerList(args) {
   const runId = resolveRunTargetArg(args);
-  const explicitCompact = args.compact === true || args.compact === "true";
   const explicitFull = args.full === true || args.full === "true";
-  const run = loadRun(runId);
-  const workerCount = Object.keys(run.workers || {}).length;
-  const compact = explicitCompact || !explicitFull && workerCount > 100;
-  const board = compact ? buildCompactRunBoard(runId) : buildRunBoard(runId);
-  const autoCompact = compact && !explicitCompact;
-  const outputWorkers = autoCompact ? board.workers.filter((worker) => worker.attention && worker.attention !== "done" && worker.attention !== "ok") : board.workers;
+  const board = applyWorkerFilters(explicitFull ? buildRunBoard(runId) : buildCompactRunBoard(runId), args);
+  const outputWorkers = board.workers;
   console.log(
     JSON.stringify(
       {
         runId: board.runId,
         status: board.status,
+        projection: explicitFull ? "full" : "compact",
         workerCount: board.workerCount,
-        ...autoCompact ? {
-          compact: true,
-          compactReason: "large-worker-board",
-          omittedWorkerCount: board.workers.length - outputWorkers.length,
-          fullCommand: `kynver worker list --run ${runId} --json --full`,
-          compactCommand: `kynver worker list --run ${runId} --json --compact`
+        ...board.activeFilters ? { activeFilters: board.activeFilters } : {},
+        ...!explicitFull ? {
+          resultContract: {
+            projection: "compact",
+            rawWorkerPayloadsOmitted: true,
+            deepDetailAvailableVia: ["--full", "worker status", "worker tail", "run status --full"]
+          },
+          drilldownCommands: buildWorkerListDrilldownCommands(runId)
         } : {},
         needsAttention: board.needsAttention,
-        ...compact && "summary" in board ? { summary: board.summary } : {},
-        ...compact && "controller" in board ? { controller: board.controller } : {},
+        ..."summary" in board ? { summary: board.summary } : {},
+        ..."controller" in board ? { controller: board.controller } : {},
         workers: outputWorkers
       },
       null,
@@ -5941,9 +6430,33 @@ async function publishHarnessBoardSnapshot(args, source) {
     authRefreshFailure: res.authRefreshFailure
   };
 }
+function buildRunStatusDrilldownCommands(runId) {
+  return {
+    full: `kynver run status --run ${runId} --full`,
+    blocked: `kynver status --run ${runId} --blocked`,
+    running: `kynver status --run ${runId} --running`,
+    task: `kynver status --run ${runId} --task <task-id>`,
+    worker: `kynver status --run ${runId} --worker <worker>`,
+    workersFull: `kynver worker list --run ${runId} --full`,
+    workerFull: `kynver worker status --run ${runId} --name <worker>`,
+    workerTail: `kynver worker tail --run ${runId} --name <worker> --lines 80`,
+    monitorTick: `kynver monitor status --run ${runId} --tick`
+  };
+}
 function runStatus(args) {
-  const compact = args.compact === true || args.compact === "true";
-  const board = compact ? buildCompactRunBoard(resolveRunTargetArg(args)) : buildRunBoard(resolveRunTargetArg(args));
+  const runId = resolveRunTargetArg(args);
+  const explicitFull = args.full === true || args.full === "true";
+  const board = applyWorkerFilters(explicitFull ? buildRunBoard(runId) : buildCompactRunBoard(runId), args);
+  board.projection = explicitFull ? "full" : "compact";
+  if (!explicitFull) {
+    board.resultContract = {
+      projection: "compact",
+      rawWorkerPayloadsOmitted: true,
+      omittedWorkerFields: ["finalResult", "changedFiles", "gitAncestry", "completionResponse", "stdout/stderr tails"],
+      deepDetailAvailableVia: ["--full", "worker status", "worker tail", "monitor status --tick"]
+    };
+    board.drilldownCommands = buildRunStatusDrilldownCommands(runId);
+  }
   console.log(JSON.stringify(board, null, 2));
 }
 function tailWorker(args) {
@@ -5978,6 +6491,7 @@ function stopWorker(args) {
 }
 
 // src/auto-complete.ts
+init_util();
 var DEFAULT_POLL_MS = 5e3;
 var DEFAULT_MAX_TOTAL_MS = 6 * 60 * 60 * 1e3;
 var DEFAULT_COMPLETE_ATTEMPTS = 3;
@@ -6162,6 +6676,7 @@ function spawnCompletionSidecar(opts) {
 }
 
 // src/repair-target-worktree.ts
+init_git();
 function addWorktreeForRepairBranch(repo, worktreePath, branch) {
   git(repo, ["fetch", "origin", branch, "--prune"], { allowFailure: true });
   const remoteRef = `origin/${branch}`;
@@ -6175,6 +6690,8 @@ function addWorktreeForRepairBranch(repo, worktreePath, branch) {
 }
 
 // src/supervisor.ts
+init_box_identity();
+init_config();
 function spawnWorkerProcess(run, opts) {
   const rawName = typeof opts.name === "string" ? opts.name.trim() : "";
   if (!rawName || rawName === "undefined" || rawName === "null") {
@@ -6268,6 +6785,10 @@ function spawnWorkerProcess(run, opts) {
     else process.env.KYNVER_HARNESS_AGENT_OS_ID = prevHarnessAgentOsId;
   }
   const model = resolveModelFallback(started.model, launchModel, provider.defaultModel);
+  const config = loadUserConfig();
+  const boxIdentity = resolveBoxIdentity(process.env, config);
+  const runtimeId = resolveRunnerPresencePayload().runnerId;
+  const boxId = defaultBoxId(boxIdentity.boxKind);
   const worker = {
     name,
     runId: run.id,
@@ -6303,6 +6824,9 @@ function spawnWorkerProcess(run, opts) {
     ...opts.taskPrUrl ? { taskPrUrl: String(opts.taskPrUrl) } : {},
     ...opts.repairTargetPrUrl ? { repairTargetPrUrl: String(opts.repairTargetPrUrl) } : {},
     ...opts.repairTargetBranch ? { repairTargetBranch: String(opts.repairTargetBranch) } : {},
+    boxKind: boxIdentity.boxKind,
+    boxId,
+    runtimeId,
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveWorker(run.id, worker);
@@ -6401,6 +6925,9 @@ async function startWorker(args) {
 }
 
 // src/active-harness-workers.ts
+init_run_store();
+init_harness_worker_active();
+init_util();
 import path22 from "node:path";
 function workerWriteSetFields(worker) {
   const ownedPaths = Array.isArray(worker.ownedPaths) ? worker.ownedPaths.filter((p) => typeof p === "string") : [];
@@ -6433,6 +6960,9 @@ function collectRunActiveHarnessWorkers(runId) {
   return out;
 }
 
+// src/dispatch.ts
+init_util();
+
 // src/plan-persist/body-hash.ts
 import { createHash as createHash2 } from "node:crypto";
 function hashPlanBody(body) {
@@ -6446,6 +6976,9 @@ function hashSummary(summary) {
   return createHash2("sha256").update(trimmed, "utf8").digest("hex");
 }
 
+// src/plan-persist/agentos-api.ts
+init_config();
+
 // src/plan-persist/errors.ts
 var PlanPersistError = class extends Error {
   kind;
@@ -7081,6 +7614,10 @@ var READY_MERGE_STATES = /* @__PURE__ */ new Set(["CLEAN", "HAS_HOOKS"]);
 function repoArgs(repo) {
   return repo?.trim() ? ["--repo", repo.trim()] : [];
 }
+function repoFromPrUrl(prUrl) {
+  const m = /github\.com\/([^/]+)\/([^/]+)\/pull\/\d+/i.exec(prUrl.trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
 function ghJson(exec, cwd, args) {
   const res = exec.gh(cwd, args);
   if (res.status !== 0) {
@@ -7106,11 +7643,11 @@ function classifyChecks(statusCheckRollup) {
       continue;
     }
     if (state && SUCCESSFUL_CHECK_CONCLUSIONS.has(state)) continue;
-    if (state && state !== "PENDING") {
+    if (state && state !== "PENDING" && state !== "EXPECTED") {
       failed.push(`${checkName(check3)}=${state}`);
       continue;
     }
-    if (state === "PENDING") {
+    if (state === "PENDING" || state === "EXPECTED") {
       pending.push(`${checkName(check3)}=${state}`);
       continue;
     }
@@ -7136,14 +7673,21 @@ var STRUCTURED_SECTION_RE = /^##\s*(test\s*plan|verification|test\s*evidence|ver
 var LOCAL_VERIFICATION_RE = /typecheck|npm run (test|build|typecheck)|vitest|tsc\b|verify-pr-local|local verify|local-verify|tests? (pass|green)|build green|node --test/i;
 var DOCS_TITLE_RE = /^docs[(:]/i;
 var DOCS_BODY_RE = /docs[- ]only|documentation only|no[- ]code change|no code changes|low[- ]risk|plan tracker only|markdown only/i;
-function assertVerificationEvidence(pr) {
-  const title = typeof pr.title === "string" ? pr.title : "";
-  const body = typeof pr.body === "string" ? pr.body : "";
+function runtimeVerificationEvidenceSufficient(input) {
+  const title = typeof input.title === "string" ? input.title.trim() : "";
+  const body = typeof input.body === "string" ? input.body.trim() : "";
   const docsLowRisk = DOCS_TITLE_RE.test(title) || DOCS_BODY_RE.test(body);
   const structuredSection = STRUCTURED_SECTION_RE.test(body);
   const localVerification = LOCAL_VERIFICATION_RE.test(body);
-  const vercelOk = vercelCheckSuccess(pr.statusCheckRollup);
-  if (docsLowRisk || structuredSection || localVerification || vercelOk) return;
+  return docsLowRisk || structuredSection || localVerification || input.vercelCheckSuccess === true;
+}
+function assertVerificationEvidence(pr) {
+  const sufficient = runtimeVerificationEvidenceSufficient({
+    title: pr.title,
+    body: pr.body,
+    vercelCheckSuccess: vercelCheckSuccess(pr.statusCheckRollup)
+  });
+  if (sufficient) return;
   throw new Error(
     `PR #${pr.number} lacks landing verification evidence \u2014 add ## Test plan / ## Verification with local commands, Vercel preview, or docs/no-code rationale`
   );
@@ -7244,6 +7788,14 @@ async function executeLandPrMerge(input) {
       "mergeCommit"
     ].join(",")
   ]);
+  if (before.state === "MERGED" || before.mergedAt) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "skipped",
+      mergeCommit: before.mergeCommit?.oid ?? null,
+      reason: `PR #${before.number} is already merged \u2014 land_pr no-op (redelivery)`
+    };
+  }
   const notReadyReason = landingReadinessError(before);
   if (notReadyReason) {
     if (input.skipNotReady) {
@@ -7275,40 +7827,56 @@ async function executeLandPrMerge(input) {
     "--squash"
   ]);
   if (mergeRes.status !== 0) {
+    const raced = viewMergedState(exec, cwd, target, input.repo);
+    if (raced) {
+      return {
+        prUrl: raced.url || before.url || prTarget,
+        outcome: "skipped",
+        mergeCommit: raced.mergeCommit?.oid ?? null,
+        reason: `PR #${before.number} is already merged \u2014 merged by another lane during land_pr (race)`
+      };
+    }
     return {
       prUrl: before.url || prTarget,
       outcome: "blocked",
       reason: mergeRes.stderr || mergeRes.stdout || "gh pr merge failed"
     };
   }
-  const after = ghJson(exec, cwd, [
-    "pr",
-    "view",
-    target,
-    ...repoArgs(input.repo),
-    "--json",
-    "number,url,mergedAt,mergeCommit,state"
-  ]);
-  if (after.state !== "MERGED" && !after.mergedAt) {
-    return {
-      prUrl: after.url || before.url || prTarget,
-      outcome: "blocked",
-      reason: `PR #${after.number} did not verify as merged after gh pr merge`
-    };
+  let after = viewMergedState(exec, cwd, target, input.repo);
+  if (!after) {
+    after = viewMergedState(exec, cwd, target, input.repo);
+  }
+  try {
+    const repo = resolveRepo(exec, cwd, input.repo);
+    deleteRemoteBranch(exec, cwd, repo, before.headRefName);
+    removeBranchWorktrees(cwd, before.headRefName);
+  } catch {
   }
-  const repo = resolveRepo(exec, cwd, input.repo);
-  deleteRemoteBranch(exec, cwd, repo, before.headRefName);
-  removeBranchWorktrees(cwd, before.headRefName);
-  const mergeCommit = after.mergeCommit?.oid ?? null;
   return {
-    prUrl: after.url || before.url || prTarget,
+    prUrl: after?.url || before.url || prTarget,
     outcome: "merged",
-    mergeCommit,
-    reason: `Daemon land_pr merged PR #${after.number}`
+    mergeCommit: after?.mergeCommit?.oid ?? null,
+    reason: `Daemon land_pr merged PR #${before.number}${after ? "" : " (post-merge view unavailable \u2014 merge verified by gh exit 0)"}`
   };
 }
+function viewMergedState(exec, cwd, target, repo) {
+  try {
+    const view = ghJson(exec, cwd, [
+      "pr",
+      "view",
+      target,
+      ...repoArgs(repo),
+      "--json",
+      "number,url,mergedAt,mergeCommit,state"
+    ]);
+    return view.state === "MERGED" || view.mergedAt ? view : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/landing/land-pr-completion-post.ts
+init_config();
 async function postLandPrHarnessCompletion(input) {
   const secret = await resolveCallbackSecretWithMint(input.secret, input.agentOsId, {
     baseUrl: input.baseUrl
@@ -7593,12 +8161,25 @@ async function dispatchRun(args) {
     async function runLandPrClaimed(decision) {
       const task = decision.task;
       const taskId = String(task.id);
+      if (exactTargetMode && !exactTargetIds.has(taskId)) {
+        return abortClaimedSpawn(
+          task,
+          "exact_target_mismatch: dispatch-next returned a different task than requested",
+          {
+            requestedTargetTaskIds: [...exactTargetIds]
+          }
+        );
+      }
       const prUrl = task.prUrl ? String(task.prUrl) : "";
       if (!prUrl) {
         return abortClaimedSpawn(task, "land_pr task missing prUrl");
       }
       try {
-        const report = await executeLandPrMerge({ prUrl, cwd: process.cwd() });
+        const report = await executeLandPrMerge({
+          prUrl,
+          repo: repoFromPrUrl(prUrl),
+          cwd: run.repo
+        });
         const post = await postLandPrHarnessCompletion({
           baseUrl: base,
           secret,
@@ -7625,6 +8206,27 @@ async function dispatchRun(args) {
         return abortClaimedSpawn(task, error.message);
       }
     }
+    async function releaseDuplicateLocalClaim(task) {
+      const error = "duplicate_dispatch_prevented: live local worker already owns this task";
+      const release = await releaseDispatchClaimAfterSpawnFailure({
+        baseUrl: base,
+        secret,
+        agentOsId,
+        taskId: String(task.id),
+        leaseOwner,
+        failureDetail: error
+      });
+      outcomes.push({
+        taskId: task.id,
+        started: false,
+        error,
+        alreadyRunning: true,
+        nonFatal: true,
+        released: release.released,
+        releaseResponse: release.releaseResponse
+      });
+      return false;
+    }
     async function spawnClaimed(decision) {
       const task = decision.task;
       const harnessContext = readHarnessWorkerContext(decision);
@@ -7646,10 +8248,7 @@ async function dispatchRun(args) {
         );
       }
       if (hasLiveWorkerForTask(run.id, taskId)) {
-        return abortClaimedSpawn(
-          task,
-          "duplicate_dispatch_prevented: live local worker already owns this task"
-        );
+        return releaseDuplicateLocalClaim(task);
       }
       const attempt = Number(task.attempt) || 1;
       if (attempt > retryLimits.maxTaskAttempts) {
@@ -7819,11 +8418,12 @@ async function dispatchRun(args) {
       diskGate: result.diskGate,
       resourceGate: result.resourceGate
     };
+    const fatalOutcome = (outcome) => !outcome.started && outcome.nonFatal !== true;
     if (pipeline) {
-      return { ok: !outcomes.some((o) => !o.started), ...summary };
+      return { ok: !outcomes.some(fatalOutcome), ...summary };
     }
     console.log(JSON.stringify(summary, null, 2));
-    if (outcomes.some((o) => !o.started)) process.exit(1);
+    if (outcomes.some(fatalOutcome)) process.exit(1);
   } catch (error) {
     if (pipeline) return { ok: false, error: error.message };
     console.error(`run dispatch failed: ${error.message}`);
@@ -7831,8 +8431,15 @@ async function dispatchRun(args) {
   }
 }
 
+// src/cli.ts
+init_run_store();
+
 // src/sweep.ts
+init_config();
 import path26 from "node:path";
+init_run_store();
+init_status();
+init_util();
 async function sweepRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
@@ -7893,10 +8500,14 @@ async function sweepRun(args) {
 }
 
 // src/worktree.ts
+init_git();
+init_run_store();
 import { existsSync as existsSync25, mkdirSync as mkdirSync6 } from "node:fs";
 import path35 from "node:path";
 
 // src/run-list.ts
+init_run_store();
+init_run_worker_index();
 import { existsSync as existsSync24, readFileSync as readFileSync11 } from "node:fs";
 import path34 from "node:path";
 
@@ -7904,6 +8515,10 @@ import path34 from "node:path";
 import path33 from "node:path";
 
 // src/finalize.ts
+init_run_store();
+init_run_worker_index();
+init_status();
+init_util();
 import path27 from "node:path";
 var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([
   "running",
@@ -7961,11 +8576,21 @@ function finalizeStaleRuns() {
   return finalized;
 }
 
+// src/stale-reconcile.ts
+init_run_store();
+init_run_worker_index();
+init_status();
+init_util();
+
 // src/worker-metadata-reconcile.ts
+init_heartbeat();
+init_stream();
 import { existsSync as existsSync23, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync2, rmSync } from "node:fs";
 import path31 from "node:path";
 
 // src/worker-metadata-paths.ts
+init_paths();
+init_util();
 import path28 from "node:path";
 var NESTED_RUNS = `${path28.sep}runs${path28.sep}runs${path28.sep}`;
 function hasNestedRunsSegment(filePath) {
@@ -8013,6 +8638,9 @@ import { existsSync as existsSync22, readdirSync as readdirSync6, statSync as st
 import path30 from "node:path";
 
 // src/default-repo.ts
+init_config();
+init_default_repo_discovery();
+init_path_values();
 import path29 from "node:path";
 function expandConfiguredRepo(value) {
   return path29.resolve(resolveUserPath(value.trim()));
@@ -8063,6 +8691,10 @@ function formatResolvedDefaultRepo(resolved) {
 }
 
 // src/run-metadata-retention.ts
+init_heartbeat();
+init_paths();
+init_run_store();
+init_util();
 var RUN_METADATA_ACTIVE_SIGNAL_MS = 15 * 60 * 1e3;
 function isHarnessRunMetadataPath(targetPath, harnessRoot) {
   const resolved = path30.resolve(targetPath);
@@ -8203,6 +8835,8 @@ function collectFilesystemLiveRunKeys(harnessRoot, now = Date.now()) {
 }
 
 // src/worker-metadata-reconcile.ts
+init_run_store();
+init_util();
 function materializeSymlinkedRunDir(harnessRoot, runId) {
   const canonical = canonicalRunDir(harnessRoot, runId);
   let stat;
@@ -8485,6 +9119,12 @@ function reconcileWorkerMetadata() {
 }
 
 // src/local-pr-attention-reconcile.ts
+init_heartbeat();
+init_worker_final_result_embed();
+init_status();
+init_run_store();
+init_run_worker_index();
+init_util();
 import { execFileSync } from "node:child_process";
 import path32 from "node:path";
 function normalizePrUrl3(url) {
@@ -8811,6 +9451,8 @@ function reconcileRunsCli() {
 }
 
 // src/run-list.ts
+init_status();
+init_util();
 function heartbeatByteLength(heartbeatPath) {
   if (!heartbeatPath || !existsSync24(heartbeatPath)) return 0;
   try {
@@ -8926,6 +9568,7 @@ function listRunsCli() {
 }
 
 // src/worktree.ts
+init_util();
 function resolveCreateRunRepo(args) {
   const explicit = typeof args.repo === "string" ? args.repo.trim() : "";
   if (explicit) return explicit;
@@ -8965,6 +9608,8 @@ function failExists(message) {
 }
 
 // src/discard-disposable.ts
+init_run_store();
+init_status();
 import { existsSync as existsSync26, rmSync as rmSync2 } from "node:fs";
 import path36 from "node:path";
 function normalizeRelativePath2(value) {
@@ -9018,8 +9663,14 @@ function discardDisposableCli(args) {
   if (!result.ok) process.exit(1);
 }
 
+// src/daemon.ts
+init_config();
+
 // src/daemon-box-identity.ts
-import os7 from "node:os";
+init_config();
+init_box_identity();
+init_worker_cap_source();
+import os9 from "node:os";
 function emitDaemonIdentityMessage(level, message) {
   console.error(JSON.stringify({ event: "daemon_identity", level, message }));
 }
@@ -9027,7 +9678,7 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
   const box = resolveBoxIdentity(env, config);
   const cap = resolveWorkerCap({
     config,
-    totalMemBytes: os7.totalmem(),
+    totalMemBytes: os9.totalmem(),
     env
   });
   const warnings = [...box.warnings];
@@ -9057,11 +9708,71 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
   };
 }
 
-// src/cron/cron-env.ts
-import { existsSync as existsSync27 } from "node:fs";
+// src/daemon-heartbeat.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import path37 from "node:path";
-function envFlag(name, defaultValue) {
+function daemonHeartbeatPath(agentOsId) {
+  const safe = agentOsId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return path37.join(homedir11(), ".kynver", `daemon-heartbeat-${safe}.json`);
+}
+function writeDaemonHeartbeat(input) {
+  try {
+    const file = daemonHeartbeatPath(input.agentOsId);
+    mkdirSync7(path37.dirname(file), { recursive: true });
+    const beat = {
+      observedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+      pid: process.pid,
+      runId: input.runId,
+      agentOsId: input.agentOsId
+    };
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync4(tmp, JSON.stringify(beat), "utf8");
+    renameSync3(tmp, file);
+  } catch {
+  }
+}
+function readDaemonHeartbeat(agentOsId) {
+  try {
+    const raw = readFileSync12(daemonHeartbeatPath(agentOsId), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.observedAt !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isDaemonHeartbeatStale(beat, stallMs, nowMs = Date.now()) {
+  if (!beat) return false;
+  const observed = Date.parse(beat.observedAt);
+  if (Number.isNaN(observed)) return true;
+  return nowMs - observed > stallMs;
+}
+
+// src/daemon-platform-guard.ts
+function envFlag(name) {
+  const raw = process.env[name]?.trim().toLowerCase();
+  return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+function assertNativeDaemonAllowed() {
+  if (process.platform !== "win32") return;
+  if (envFlag("KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS")) return;
+  console.error(
+    JSON.stringify({
+      event: "daemon_start_blocked",
+      reason: "native_windows_console_flash",
+      remedy: "Run the daemon inside WSL: .\\scripts\\start-tier2-wsl.ps1 \u2014 or set KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS=1 to override (flashes visible consoles)."
+    })
+  );
+  process.exit(1);
+}
+
+// src/cron/cron-env.ts
+init_config();
+import { existsSync as existsSync27 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import path38 from "node:path";
+function envFlag2(name, defaultValue) {
   const raw = process.env[name]?.trim().toLowerCase();
   if (!raw) return defaultValue;
   if (raw === "0" || raw === "false" || raw === "no" || raw === "off") return false;
@@ -9076,7 +9787,7 @@ function envInt(name, fallback, min = 1) {
 function defaultKynverCronStorePath() {
   const explicit = process.env.KYNVER_CRON_STORE_PATH?.trim() || process.env.OPENCLAW_CRON_STORE_PATH?.trim();
   if (explicit) return explicit;
-  return path37.join(homedir11(), ".kynver", "agent-os-cron.json");
+  return path38.join(homedir12(), ".kynver", "agent-os-cron.json");
 }
 function defaultKynverCronStatePath(storePath = defaultKynverCronStorePath()) {
   const explicit = process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();
@@ -9097,14 +9808,14 @@ function resolveKynverCronEnv() {
   const secret = resolveKynverCronSecret();
   const credsReady = Boolean(fireBaseUrl && secret);
   const storeExists = existsSync27(storePath);
-  const defaultEnabled = credsReady && (storeExists || envFlag("KYNVER_CRON_TICK_FORCE", false));
+  const defaultEnabled = credsReady && (storeExists || envFlag2("KYNVER_CRON_TICK_FORCE", false));
   return {
     storePath,
     statePath,
     lockPath: `${statePath}.lock`,
     fireBaseUrl,
     secret,
-    tickEnabled: envFlag("KYNVER_CRON_TICK_ENABLED", defaultEnabled),
+    tickEnabled: envFlag2("KYNVER_CRON_TICK_ENABLED", defaultEnabled),
     tickIntervalMs: envInt("KYNVER_CRON_TICK_INTERVAL_MS", 6e4, 5e3),
     missedRunPolicy: process.env.KYNVER_CRON_MISSED_RUN_POLICY?.trim().toLowerCase() === "skip" ? "skip" : "catch_up",
     maxCatchUpPerTick: envInt("KYNVER_CRON_MAX_CATCH_UP_PER_TICK", 3, 0),
@@ -9149,12 +9860,13 @@ async function fireKynverCronJob(input) {
 }
 
 // src/cron/cron-lock.ts
-import { closeSync as closeSync6, existsSync as existsSync28, openSync as openSync6, readFileSync as readFileSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
+init_util();
+import { closeSync as closeSync6, existsSync as existsSync28, openSync as openSync6, readFileSync as readFileSync13, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
 var STALE_LOCK_MS = 10 * 6e4;
 function readLockInfo(lockPath) {
   if (!existsSync28(lockPath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync12(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync13(lockPath, "utf8"));
     if (typeof parsed.pid === "number" && typeof parsed.at === "string") return parsed;
   } catch {
     return null;
@@ -9185,7 +9897,7 @@ function tryAcquireCronTickLock(lockPath) {
   }
   try {
     const fd = openSync6(lockPath, "wx");
-    writeFileSync4(
+    writeFileSync5(
       fd,
       JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }),
       "utf8"
@@ -9318,7 +10030,7 @@ async function loadCronJobs(storePath = defaultKynverCronStorePath()) {
 // src/cron/cron-tick-state.ts
 import { randomBytes } from "node:crypto";
 import { promises as fs2 } from "node:fs";
-import path38 from "node:path";
+import path39 from "node:path";
 var EMPTY = { version: 1, jobs: {} };
 async function readFileIfExists2(filePath) {
   try {
@@ -9345,7 +10057,7 @@ async function loadCronTickState(statePath) {
   return parseCronTickState(raw);
 }
 async function writeStateAtomic(statePath, state) {
-  await fs2.mkdir(path38.dirname(statePath), { recursive: true });
+  await fs2.mkdir(path39.dirname(statePath), { recursive: true });
   const suffix = randomBytes(6).toString("hex");
   const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}-${suffix}`;
   await fs2.writeFile(tmp, `${JSON.stringify(state, null, 2)}
@@ -9521,8 +10233,12 @@ async function runKynverCronTick(opts = {}) {
   }
 }
 
+// src/daemon.ts
+init_util();
+
 // src/pipeline-tick.ts
-import path56 from "node:path";
+import path58 from "node:path";
+init_config();
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -9652,11 +10368,16 @@ function resolvePipelineMaxStarts(resourceGate, operatorTick) {
   };
 }
 
+// src/pipeline-tick.ts
+init_resource_gate();
+
 // src/box-resource-snapshot.ts
-import os8 from "node:os";
+init_config();
+init_box_identity();
+import os10 from "node:os";
 function buildBoxResourceSnapshotFromGate(gate, input = {}) {
   const boxKind = (input.boxKind ?? resolveBoxKindFromConfig(loadUserConfig())).trim().toLowerCase() || "forge";
-  const hostLabel = input.hostLabel ?? os8.hostname();
+  const hostLabel = input.hostLabel ?? os10.hostname();
   const boxId = input.boxId ?? defaultBoxId(boxKind, hostLabel);
   return {
     boxId,
@@ -9677,10 +10398,20 @@ function buildBoxResourceSnapshotFromGate(gate, input = {}) {
   };
 }
 
+// src/pipeline-tick.ts
+init_run_store();
+init_exited_salvage();
+init_status();
+init_util();
+
 // src/plan-progress-daemon-sync.ts
-import path39 from "node:path";
+init_status();
+init_run_store();
+init_util();
+import path40 from "node:path";
 
 // src/plan-progress-sync.ts
+init_config();
 async function syncPlanProgress(args) {
   const base = resolveBaseUrl(args.baseUrl);
   const secret = await resolveCallbackSecretWithMint(args.secret, args.agentOsId, { baseUrl: base });
@@ -9702,7 +10433,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path39.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path40.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -9730,6 +10461,8 @@ async function syncActiveWorkerPlanProgress(runId, args) {
 }
 
 // src/workspace-runtime-config.ts
+init_config();
+init_box_identity();
 function shouldApplyWorkspaceRuntimePreferences(env = process.env) {
   const config = loadUserConfig();
   return resolveBoxKindFromConfig(config, env) !== "forge";
@@ -9758,11 +10491,21 @@ async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
   }
 }
 
+// src/pipeline-tick.ts
+init_config();
+init_box_identity();
+
 // src/cleanup.ts
-import path53 from "node:path";
+init_paths();
+import path54 from "node:path";
 
 // src/cleanup-guards.ts
-import path40 from "node:path";
+init_landing_gate();
+import path41 from "node:path";
+
+// src/cleanup-index-status.ts
+init_git();
+init_status();
 
 // src/cleanup-build-cache-paths.ts
 var HARNESS_BUILD_CACHE_RELATIVE_PATHS = [
@@ -9791,23 +10534,6 @@ function materialWorktreeChanges2(changedFiles) {
   });
 }
 
-// src/cleanup-index-status.ts
-function indexedWorktreeStatus(entry) {
-  if (!entry.status) {
-    entry.status = computeWorkerStatus(entry.worker, {
-      base: entry.run.base,
-      baseCommit: entry.run.baseCommit
-    });
-  }
-  return entry.status;
-}
-function indexedWorktreeHasMaterialChanges(entry) {
-  if (entry.status) {
-    return materialWorktreeChanges2(entry.status.changedFiles).length > 0;
-  }
-  return materialWorktreeChanges2(gitStatusShort(entry.worktreePath)).length > 0;
-}
-
 // src/cleanup-worktree-salvage.ts
 function prUrlFromFinalResult(finalResult) {
   if (typeof finalResult === "string") {
@@ -9834,7 +10560,93 @@ function isPrOrUnmergedWork(status) {
   return false;
 }
 
+// src/cleanup-index-status.ts
+init_util();
+function indexedWorktreeStatus(entry) {
+  if (!entry.status) {
+    entry.status = computeWorkerStatus(entry.worker, {
+      base: entry.run.base,
+      baseCommit: entry.run.baseCommit
+    });
+  }
+  return entry.status;
+}
+function indexedWorktreeHasMaterialChanges(entry, gitStatusCache) {
+  if (entry.status) {
+    return materialWorktreeChanges2(entry.status.changedFiles).length > 0;
+  }
+  const porcelain = gitStatusCache ? gitStatusCache.porcelain(entry.worktreePath) : gitStatusShort(entry.worktreePath);
+  return materialWorktreeChanges2(porcelain).length > 0;
+}
+function finalResultFromWorkerJson(entry) {
+  const snapshot = entry.worker.completionSnapshot?.finalResult;
+  if (snapshot !== void 0 && snapshot !== null) return snapshot;
+  if (entry.worker.taskPrUrl) {
+    return { prUrl: entry.worker.taskPrUrl };
+  }
+  return null;
+}
+function resolveWorktreeGuardStatus(entry, ctx) {
+  if (entry.status) return entry.status;
+  const worker = entry.worker;
+  const completionAcknowledged = typeof worker.completionReportedAt === "string" && worker.completionReportedAt.trim().length > 0;
+  const workerJsonTerminal = Boolean(worker.status && ["done", "exited", "blocked", "failed", "abandoned"].includes(worker.status)) || completionAcknowledged;
+  const finalResult = finalResultFromWorkerJson(entry);
+  if (workerJsonTerminal && !isPidAlive(worker.pid)) {
+    const changedFiles = ctx?.gitStatusCache ? ctx.gitStatusCache.porcelain(entry.worktreePath) : gitStatusShort(entry.worktreePath);
+    const baseLabel = entry.run.baseCommit?.trim() || entry.run.base?.trim() || "origin/main";
+    const ahead = ctx?.gitRevCache?.countAheadOfMain(entry.worktreePath, baseLabel);
+    const gitAncestry = ahead === 0 ? {
+      checked: true,
+      base: baseLabel,
+      relation: "synced"
+    } : computeGitAncestry(entry.worktreePath, {
+      base: entry.run.base,
+      baseCommit: entry.run.baseCommit
+    });
+    const status = {
+      runId: entry.runId,
+      worker: entry.workerName,
+      pid: worker.pid,
+      alive: false,
+      status: worker.status ?? (completionAcknowledged ? "done" : "exited"),
+      attention: { state: completionAcknowledged ? "done" : "stale" },
+      branch: worker.branch,
+      worktreePath: entry.worktreePath,
+      ownedPaths: worker.ownedPaths,
+      stdoutBytes: 0,
+      stderrBytes: 0,
+      heartbeatBytes: 0,
+      firstEventAt: null,
+      lastEventAt: null,
+      lastActivityAt: worker.completionReportedAt ?? null,
+      currentTool: null,
+      heartbeatCount: 0,
+      lastHeartbeatAt: null,
+      lastHeartbeatPhase: null,
+      lastHeartbeatSummary: null,
+      heartbeatBlocker: null,
+      changedFiles,
+      gitAncestry,
+      finalResult,
+      completionBlocker: typeof worker.completionBlocker === "string" ? worker.completionBlocker.trim() || null : null,
+      prUrl: worker.repairTargetPrUrl ?? worker.taskPrUrl ?? prUrlFromFinalResult(finalResult)
+    };
+    entry.status = status;
+    return status;
+  }
+  return indexedWorktreeStatus(entry);
+}
+
+// src/cleanup-guards.ts
+init_status();
+
+// src/cleanup-run-liveness.ts
+init_status();
+
 // src/cleanup-completion-blocker.ts
+init_landing_gate();
+init_status();
 function completionBlockerBlocksWorktreeRemoval(indexed, status) {
   const blocker = typeof indexed.worker.completionBlocker === "string" ? indexed.worker.completionBlocker.trim() : "";
   if (!blocker) return false;
@@ -9854,13 +10666,29 @@ function completionBlockerBlocksWorktreeRemoval(indexed, status) {
 }
 
 // src/cleanup-run-liveness.ts
+init_util();
+var TERMINAL_WORKER_JSON_STATUSES = /* @__PURE__ */ new Set([
+  "done",
+  "exited",
+  "blocked",
+  "failed",
+  "abandoned"
+]);
 function deriveRunTerminal(indexed, ctx) {
   if (ctx) return ctx.runTerminalCache.derive(indexed.run);
   return deriveTerminalRunStatus(indexed.run);
 }
 function isWorkerProcessLive(indexed) {
   if (isPidAlive(indexed.worker.pid)) return true;
-  if (!indexed.worker.pid) return indexedWorktreeStatus(indexed).alive;
+  if (typeof indexed.worker.completionReportedAt === "string" && indexed.worker.completionReportedAt.trim().length > 0) {
+    return false;
+  }
+  const workerStatus2 = indexed.worker.status;
+  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2)) return false;
+  if (!indexed.worker.pid) {
+    if (workerStatus2 !== "running") return false;
+    return indexedWorktreeStatus(indexed).alive;
+  }
   return false;
 }
 function isRunStaleActive(indexed, ctx) {
@@ -9869,6 +10697,10 @@ function isRunStaleActive(indexed, ctx) {
 }
 function runBlocksWorktreeRemoval(indexed, ctx) {
   if (isWorkerProcessLive(indexed)) return true;
+  const workerStatus2 = indexed.worker.status;
+  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2) && !indexed.worker.completionBlocker) {
+    return false;
+  }
   const status = indexedWorktreeStatus(indexed);
   if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return true;
   if (isFinishedWorkerStatus(status)) return false;
@@ -9887,7 +10719,7 @@ function effectiveWorktreeAgeMs(input) {
   if (input.liveness && isRunStaleActive(indexed, input.liveness)) {
     return terminalWorktreesAgeMs;
   }
-  if (input.liveness && isFinishedWorkerStatus(indexedWorktreeStatus(indexed)) && !isWorkerProcessLive(indexed)) {
+  if (input.liveness && isFinishedWorkerStatus(resolveWorktreeGuardStatus(indexed, input.liveness)) && !isWorkerProcessLive(indexed)) {
     return terminalWorktreesAgeMs;
   }
   return worktreesAgeMs;
@@ -9901,8 +10733,13 @@ function skipWorktreeRemoval(input) {
   const ageThresholdMs = effectiveWorktreeAgeMs(input);
   if (worktreesAgeMs <= 0 && !includeOrphans && ageThresholdMs <= 0) return "worktrees_disabled";
   if (ageThresholdMs > 0 && ageMs < ageThresholdMs) return "below_age_threshold";
-  const status = indexedWorktreeStatus(indexed);
   if (isWorkerProcessLive(indexed)) return "active_worker";
+  if (indexedWorktreeHasMaterialChanges(indexed, input.liveness?.gitStatusCache)) {
+    return "dirty_worktree";
+  }
+  const ahead = input.liveness?.gitRevCache?.countAheadOfMain(input.worktreePath);
+  if (ahead !== null && ahead !== void 0 && ahead > 0) return "pr_or_unmerged_commits";
+  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
   if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return "completion_blocked";
   if (runBlocksWorktreeRemoval(indexed, input.liveness)) return "run_still_active";
   if (!isFinishedWorkerStatus(status)) return "run_still_active";
@@ -9931,9 +10768,11 @@ function skipWorktreeRemoval(input) {
 function skipDependencyCacheRemoval(input) {
   const { indexed, nodeModulesAgeMs, ageMs, worktreePath, activeWorktreePaths, diskPressure } = input;
   if (!diskPressure && ageMs < nodeModulesAgeMs) return "below_age_threshold";
-  if (activeWorktreePaths.has(path40.resolve(worktreePath))) return "active_worker";
+  if (activeWorktreePaths.has(path41.resolve(worktreePath))) return "active_worker";
   if (indexed && isWorkerProcessLive(indexed)) return "active_worker";
-  if (indexed && indexedWorktreeHasMaterialChanges(indexed)) return "dirty_worktree";
+  if (indexed && indexedWorktreeHasMaterialChanges(indexed, input.gitStatusCache)) {
+    return "dirty_worktree";
+  }
   return null;
 }
 function skipBuildCacheRemoval(input) {
@@ -9958,11 +10797,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path71, reason, detail) => {
-    const key = `${path71}\0${reason}`;
+  const push = (path73, reason, detail) => {
+    const key = `${path73}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path71, reason, ...detail ? { detail } : {} });
+    out.push({ path: path73, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -9978,11 +10817,14 @@ function collectPreservedLivePaths(actions, skips) {
 
 // src/cleanup-run-directory.ts
 import { existsSync as existsSync30, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
-import path42 from "node:path";
+import path43 from "node:path";
 
 // src/cleanup-active-worktrees.ts
+init_run_store();
+init_paths();
 import { existsSync as existsSync29, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
+init_util();
 function workerHasRecentHarnessActivity(worker, now) {
   const paths = [worker.heartbeatPath, worker.stdoutPath, worker.stderrPath];
   for (const target of paths) {
@@ -10008,11 +10850,11 @@ function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
       let runHasLive = false;
       for (const name of Object.keys(run.workers || {})) {
         const worker = readJson(
-          path41.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
+          path42.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
           void 0
         );
         if (!worker?.worktreePath) continue;
-        const worktreePath = path41.resolve(worker.worktreePath);
+        const worktreePath = path42.resolve(worker.worktreePath);
         if (!isActiveHarnessWorker2(worker, now)) continue;
         runHasLive = true;
         activeWorktreePaths.add(worktreePath);
@@ -10031,6 +10873,7 @@ function isWorktreeOnLiveRun(worktreePath, harnessRoot, runId, liveRunKeys) {
 }
 
 // src/cleanup-run-directory.ts
+init_util();
 function pathAgeMs(target, now) {
   try {
     const mtime = statSync7(target).mtimeMs;
@@ -10040,7 +10883,7 @@ function pathAgeMs(target, now) {
   }
 }
 function loadRunStatus(harnessRoot, runId) {
-  const runPath = path42.join(harnessRoot, "runs", runId, "run.json");
+  const runPath = path43.join(harnessRoot, "runs", runId, "run.json");
   if (!existsSync30(runPath)) return null;
   return readJson(runPath, null);
 }
@@ -10078,7 +10921,7 @@ function scanStaleRunDirectoryCandidates(opts) {
     if (!runEntry.isDirectory()) continue;
     const runId = runEntry.name;
     if (opts.runIdFilter && runId !== opts.runIdFilter) continue;
-    const runPath = path42.join(opts.worktreesDir, runId);
+    const runPath = path43.join(opts.worktreesDir, runId);
     if (!runDirectoryIsEmpty(runPath)) continue;
     candidates.push({
       kind: "remove_run_directory",
@@ -10093,12 +10936,13 @@ function scanStaleRunDirectoryCandidates(opts) {
 }
 
 // src/cleanup-execute.ts
+init_git();
 import { existsSync as existsSync33, rmSync as rmSync4 } from "node:fs";
 
 // src/cleanup-dir-size.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync31, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 var DEFAULT_DU_TIMEOUT_MS = 2500;
 function directorySizeBytesDu(root, timeoutMs = DEFAULT_DU_TIMEOUT_MS) {
   if (!existsSync31(root)) return 0;
@@ -10132,7 +10976,7 @@ function directorySizeBytes(root, maxEntries = 5e4) {
     }
     for (const name of entries) {
       if (seen++ > maxEntries) return null;
-      const full = path43.join(current, name);
+      const full = path44.join(current, name);
       let st;
       try {
         st = statSync8(full);
@@ -10148,6 +10992,7 @@ function directorySizeBytes(root, maxEntries = 5e4) {
 
 // src/cleanup-remove-path.ts
 import { existsSync as existsSync32, rmSync as rmSync3 } from "node:fs";
+init_paths();
 
 // src/cleanup-path-ownership.ts
 import { lstatSync as lstatSync2, readdirSync as readdirSync11 } from "node:fs";
@@ -10183,20 +11028,20 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
 
 // src/cleanup-privileged-remove.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import path45 from "node:path";
+import path46 from "node:path";
 
 // src/cleanup-harness-path-validate.ts
-import path44 from "node:path";
+import path45 from "node:path";
 function isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, cacheDirName) {
-  const resolved = path44.resolve(targetPath);
-  const suffix = `${path44.sep}${cacheDirName}`;
+  const resolved = path45.resolve(targetPath);
+  const suffix = `${path45.sep}${cacheDirName}`;
   const cachePath = resolved.endsWith(suffix) ? resolved : null;
   if (!cachePath) return "path_outside_harness";
-  const rel = path44.relative(worktreesDir, cachePath);
-  if (rel.startsWith("..") || path44.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path44.sep);
+  const rel = path45.relative(worktreesDir, cachePath);
+  if (rel.startsWith("..") || path45.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path45.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== cacheDirName) return "path_outside_harness";
-  if (!resolved.startsWith(path44.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path45.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
@@ -10206,16 +11051,16 @@ function isHarnessNextCachePath(targetPath, harnessRoot, worktreesDir) {
   return isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, ".next");
 }
 function isHarnessBuildCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path44.resolve(targetPath);
-  const relToWt = path44.relative(worktreesDir, resolved);
-  if (relToWt.startsWith("..") || path44.isAbsolute(relToWt)) return "path_outside_harness";
-  const parts = relToWt.split(path44.sep);
+  const resolved = path45.resolve(targetPath);
+  const relToWt = path45.relative(worktreesDir, resolved);
+  if (relToWt.startsWith("..") || path45.isAbsolute(relToWt)) return "path_outside_harness";
+  const parts = relToWt.split(path45.sep);
   if (parts.length < 3) return "path_outside_harness";
-  if (!resolved.startsWith(path44.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path45.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessGeneratedCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path44.resolve(targetPath);
+  const resolved = path45.resolve(targetPath);
   return isHarnessNodeModulesPath(resolved, harnessRoot, worktreesDir) === null || isHarnessNextCachePath(resolved, harnessRoot, worktreesDir) === null || isHarnessBuildCachePath(resolved, harnessRoot, worktreesDir) === null;
 }
 
@@ -10249,12 +11094,12 @@ function tryPrivilegedReclaimHarnessCache(targetPath, harnessRoot, worktreesDir)
     "chown",
     "-R",
     `${effectiveUid}:${effectiveGid}`,
-    path45.resolve(targetPath)
+    path46.resolve(targetPath)
   ]);
   if (chown.ok) {
     return { ok: true, method: "chown_then_rm" };
   }
-  const rm = runSudoNonInteractive(["rm", "-rf", path45.resolve(targetPath)]);
+  const rm = runSudoNonInteractive(["rm", "-rf", path46.resolve(targetPath)]);
   if (rm.ok) {
     return { ok: true, method: "sudo_rm" };
   }
@@ -10456,7 +11301,7 @@ function removeWorktree(candidate, execute) {
 
 // src/cleanup-scan.ts
 import { existsSync as existsSync34, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 function pathAgeMs2(target, now) {
   try {
     const mtime = statSync9(target).mtimeMs;
@@ -10466,16 +11311,16 @@ function pathAgeMs2(target, now) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = path46.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path46.isAbsolute(rel);
+  const rel = path47.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path47.isAbsolute(rel);
 }
 function collectBuildCacheForWorktree(worktreePath, opts, seen, meta) {
   const out = [];
   for (const rel of HARNESS_BUILD_CACHE_RELATIVE_PATHS) {
     if (rel === ".next") continue;
-    const target = path46.join(worktreePath, rel);
+    const target = path47.join(worktreePath, rel);
     if (!existsSync34(target)) continue;
-    const resolved = path46.resolve(target);
+    const resolved = path47.resolve(target);
     if (seen.has(resolved)) continue;
     if (!isPathInside(resolved, opts.harnessRoot)) continue;
     seen.add(resolved);
@@ -10507,10 +11352,10 @@ function scanBuildCacheCandidates(opts) {
   if (!opts.includeOrphans || !existsSync34(opts.worktreesDir)) return candidates;
   for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path46.join(opts.worktreesDir, runEntry.name);
+    const runPath = path47.join(opts.worktreesDir, runEntry.name);
     for (const workerEntry of readdirSync12(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path46.join(runPath, workerEntry.name);
+      const worktreePath = path47.join(runPath, workerEntry.name);
       candidates.push(
         ...collectBuildCacheForWorktree(worktreePath, opts, seen, {
           runId: runEntry.name,
@@ -10548,12 +11393,12 @@ function scanWorktreeCandidates(opts) {
   if (!orphanEnabled || !existsSync34(opts.worktreesDir)) return candidates;
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path46.resolve(entry.worktreePath));
+    indexedPaths.add(path47.resolve(entry.worktreePath));
   }
   for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path46.join(opts.worktreesDir, runEntry.name);
+    const runPath = path47.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
       workerEntries = readdirSync12(runPath, { withFileTypes: true });
@@ -10562,7 +11407,7 @@ function scanWorktreeCandidates(opts) {
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path46.resolve(path46.join(runPath, workerEntry.name));
+      const worktreePath = path47.resolve(path47.join(runPath, workerEntry.name));
       if (seen.has(worktreePath)) continue;
       if (indexedPaths.has(worktreePath)) continue;
       if (!isPathInside(worktreePath, opts.harnessRoot)) continue;
@@ -10582,7 +11427,7 @@ function scanWorktreeCandidates(opts) {
 
 // src/cleanup-dependency-scan.ts
 import { existsSync as existsSync35, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import path47 from "node:path";
+import path48 from "node:path";
 var DEPENDENCY_CACHE_DIRS = [
   { dirName: "node_modules", kind: "remove_node_modules" },
   { dirName: ".next", kind: "remove_next_cache" }
@@ -10596,12 +11441,12 @@ function pathAgeMs3(target, now) {
   }
 }
 function isPathInside2(child, parent) {
-  const rel = path47.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path47.isAbsolute(rel);
+  const rel = path48.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path48.isAbsolute(rel);
 }
 function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
   if (!existsSync35(targetPath)) return;
-  const resolved = path47.resolve(targetPath);
+  const resolved = path48.resolve(targetPath);
   if (seen.has(resolved)) return;
   if (!isPathInside2(resolved, opts.harnessRoot)) return;
   seen.add(resolved);
@@ -10618,7 +11463,7 @@ function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
 }
 function scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, meta) {
   for (const entry of DEPENDENCY_CACHE_DIRS) {
-    pushCandidate2(candidates, seen, opts, path47.join(worktreePath, entry.dirName), entry.kind, meta);
+    pushCandidate2(candidates, seen, opts, path48.join(worktreePath, entry.dirName), entry.kind, meta);
   }
 }
 function scanDependencyCacheCandidates(opts) {
@@ -10636,7 +11481,7 @@ function scanDependencyCacheCandidates(opts) {
   for (const runEntry of readdirSync13(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path47.join(opts.worktreesDir, runEntry.name);
+    const runPath = path48.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
       workerEntries = readdirSync13(runPath, { withFileTypes: true });
@@ -10645,7 +11490,7 @@ function scanDependencyCacheCandidates(opts) {
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path47.join(runPath, workerEntry.name);
+      const worktreePath = path48.join(runPath, workerEntry.name);
       scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, {
         runId: runEntry.name,
         worker: workerEntry.name
@@ -10656,8 +11501,9 @@ function scanDependencyCacheCandidates(opts) {
 }
 
 // src/cleanup-duplicate-worktrees.ts
+init_git();
 import { existsSync as existsSync36, statSync as statSync11 } from "node:fs";
-import path48 from "node:path";
+import path49 from "node:path";
 function pathAgeMs4(target, now) {
   try {
     const mtime = statSync11(target).mtimeMs;
@@ -10687,8 +11533,8 @@ function parseWorktreePorcelain(output) {
   return records;
 }
 function isUnderWorktreesDir(worktreePath, worktreesDir) {
-  const rel = path48.relative(path48.resolve(worktreesDir), path48.resolve(worktreePath));
-  return rel !== "" && !rel.startsWith("..") && !path48.isAbsolute(rel);
+  const rel = path49.relative(path49.resolve(worktreesDir), path49.resolve(worktreePath));
+  return rel !== "" && !rel.startsWith("..") && !path49.isAbsolute(rel);
 }
 function isCleanWorktree(worktreePath, repoRoot) {
   try {
@@ -10704,11 +11550,11 @@ function scanDuplicateWorktreeCandidates(opts) {
   if (!opts.includeOrphans || !existsSync36(opts.worktreesDir)) return [];
   const repos = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    if (entry.run.repo) repos.add(path48.resolve(entry.run.repo));
+    if (entry.run.repo) repos.add(path49.resolve(entry.run.repo));
   }
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path48.resolve(entry.worktreePath));
+    indexedPaths.add(path49.resolve(entry.worktreePath));
   }
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -10721,15 +11567,15 @@ function scanDuplicateWorktreeCandidates(opts) {
     }
     const worktrees = parseWorktreePorcelain(porcelain);
     for (const wt of worktrees) {
-      const resolved = path48.resolve(wt.path);
-      if (resolved === path48.resolve(repoRoot)) continue;
+      const resolved = path49.resolve(wt.path);
+      if (resolved === path49.resolve(repoRoot)) continue;
       if (!isUnderWorktreesDir(resolved, opts.worktreesDir)) continue;
       if (indexedPaths.has(resolved)) continue;
       if (seen.has(resolved)) continue;
       if (!existsSync36(resolved)) continue;
       if (!isCleanWorktree(resolved, repoRoot)) continue;
-      const rel = path48.relative(opts.worktreesDir, resolved);
-      const parts = rel.split(path48.sep);
+      const rel = path49.relative(opts.worktreesDir, resolved);
+      const parts = rel.split(path49.sep);
       const runId = parts[0];
       const worker = parts[1] ?? "unknown";
       seen.add(resolved);
@@ -10748,12 +11594,14 @@ function scanDuplicateWorktreeCandidates(opts) {
 }
 
 // src/cleanup-worktree-index.ts
-import path49 from "node:path";
+init_run_store();
+init_util();
+import path50 from "node:path";
 function buildWorktreeIndexAt(harnessRoot) {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecordsForHarnessRoot(harnessRoot)) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path49.join(
+      const workerPath = path50.join(
         runDirectoryAt(harnessRoot, run.id),
         "workers",
         safeSlug(name),
@@ -10761,9 +11609,9 @@ function buildWorktreeIndexAt(harnessRoot) {
       );
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
-      index.set(path49.resolve(worker.worktreePath), {
+      index.set(path50.resolve(worker.worktreePath), {
         harnessRoot,
-        worktreePath: path49.resolve(worker.worktreePath),
+        worktreePath: path50.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -10775,7 +11623,7 @@ function buildWorktreeIndexAt(harnessRoot) {
 }
 
 // src/cleanup-retention-config.ts
-function envFlag2(name) {
+function envFlag3(name) {
   const v = process.env[name];
   return v === "1" || v === "true" || v === "yes";
 }
@@ -10786,17 +11634,17 @@ function envMs(name, fallback) {
   return Number.isFinite(n) && n >= 0 ? n : fallback;
 }
 function resolveHarnessRetention(options = {}) {
-  const execute = options.execute === true || options.execute !== false && envFlag2("KYNVER_CLEANUP_EXECUTE");
-  const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag2("KYNVER_CLEANUP_SKIP_FINALIZE");
+  const execute = options.execute === true || options.execute !== false && envFlag3("KYNVER_CLEANUP_EXECUTE");
+  const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag3("KYNVER_CLEANUP_SKIP_FINALIZE");
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? envMs("KYNVER_CLEANUP_NODE_MODULES_AGE_MS", DEFAULT_NODE_MODULES_AGE_MS);
   const worktreesAgeMs = options.worktreesAgeMs ?? envMs("KYNVER_CLEANUP_WORKTREES_AGE_MS", 0);
   const terminalWorktreesAgeMs = options.terminalWorktreesAgeMs ?? envMs("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS", DEFAULT_TERMINAL_WORKTREES_AGE_MS);
   const runDirectoriesAgeMs = options.runDirectoriesAgeMs ?? envMs("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS", DEFAULT_RUN_DIRECTORIES_AGE_MS);
   const maxActionsPerSweep = options.maxActionsPerSweep ?? envMs("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP", DEFAULT_MAX_ACTIONS_PER_SWEEP);
-  const includeOrphans = options.includeOrphans === true || envFlag2("KYNVER_CLEANUP_INCLUDE_ORPHANS");
-  const scopeAll = envFlag2("KYNVER_CLEANUP_SCOPE_ALL") || process.env.KYNVER_CLEANUP_SCOPE === "all";
+  const includeOrphans = options.includeOrphans === true || envFlag3("KYNVER_CLEANUP_INCLUDE_ORPHANS");
+  const scopeAll = envFlag3("KYNVER_CLEANUP_SCOPE_ALL") || process.env.KYNVER_CLEANUP_SCOPE === "all";
   const runIdFilter = scopeAll ? options.runIdFilter : options.runIdFilter ?? (process.env.KYNVER_CLEANUP_RUN_ID || void 0);
-  const accountBytes = options.accountBytes !== false && !envFlag2("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING");
+  const accountBytes = options.accountBytes !== false && !envFlag3("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING");
   const storageCapEnv = envMs("KYNVER_CLEANUP_STORAGE_ENTRY_CAP", 2e3);
   const storagePerRunEntryCap = options.storagePerRunEntryCap !== void 0 ? options.storagePerRunEntryCap : accountBytes ? storageCapEnv > 0 ? storageCapEnv : null : null;
   const byteCapEnv = envMs("KYNVER_CLEANUP_BYTE_ENTRY_CAP", 2e3);
@@ -10832,15 +11680,16 @@ function resolvePipelineHarnessRetention(runId) {
 }
 
 // src/cleanup-orphan-safety.ts
+init_git();
 import { existsSync as existsSync37, statSync as statSync12 } from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 var DEFAULT_HEARTBEAT_FRESH_MS = 30 * 60 * 1e3;
 function assessOrphanWorktreeSafety(input) {
   const now = input.now ?? Date.now();
   const heartbeatFreshMs = input.heartbeatFreshMs ?? DEFAULT_HEARTBEAT_FRESH_MS;
   if (!existsSync37(input.worktreePath)) return null;
   if (input.runId && input.workerName) {
-    const heartbeatPath = path50.join(
+    const heartbeatPath = path51.join(
       input.harnessRoot,
       "runs",
       input.runId,
@@ -10854,7 +11703,7 @@ function assessOrphanWorktreeSafety(input) {
     } catch {
     }
   }
-  const gitDir = path50.join(input.worktreePath, ".git");
+  const gitDir = path51.join(input.worktreePath, ".git");
   if (!existsSync37(gitDir)) return null;
   const porcelain = gitCapture(input.worktreePath, ["status", "--porcelain"]);
   if (porcelain.status !== 0) return "pr_or_unmerged_commits";
@@ -10884,8 +11733,9 @@ function assessOrphanWorktreeSafety(input) {
 }
 
 // src/harness-storage-snapshot.ts
+init_paths();
 import { existsSync as existsSync38, readdirSync as readdirSync14, statSync as statSync13 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 function harnessStorageSnapshot(opts = {}) {
   const harnessRoot = normalizeHarnessRoot(opts.harnessRoot ?? resolveHarnessRoot());
   const worktreesDir = harnessWorktreesDir(harnessRoot);
@@ -10923,7 +11773,7 @@ function harnessStorageSnapshot(opts = {}) {
   for (const runEntry of entries) {
     if (!runEntry.isDirectory()) continue;
     runCount += 1;
-    const runPath = path51.join(worktreesDir, runEntry.name);
+    const runPath = path52.join(worktreesDir, runEntry.name);
     try {
       const st = statSync13(runPath);
       oldestMs = oldestMs === null ? st.mtimeMs : Math.min(oldestMs, st.mtimeMs);
@@ -10958,12 +11808,13 @@ function harnessStorageSnapshot(opts = {}) {
 }
 
 // src/cleanup-harness-roots.ts
+init_paths();
 import { existsSync as existsSync39 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import path52 from "node:path";
+import { homedir as homedir13 } from "node:os";
+import path53 from "node:path";
 var WELL_KNOWN_HARNESS_SCAN_ROOTS = [
   "/var/tmp/kynver-harness",
-  path52.join(homedir12(), ".openclaw", "harness")
+  path53.join(homedir13(), ".openclaw", "harness")
 ];
 function addRoot(seen, roots, candidate) {
   if (!candidate?.trim()) return;
@@ -10985,7 +11836,7 @@ function resolveHarnessScanRoots(options = {}) {
   for (const candidate of extra ?? []) addRoot(seen, roots, candidate);
   if (shouldScanWellKnownRoots(options)) {
     for (const candidate of WELL_KNOWN_HARNESS_SCAN_ROOTS) {
-      const resolved = path52.resolve(candidate);
+      const resolved = path53.resolve(candidate);
       if (!seen.has(resolved) && existsSync39(resolved)) addRoot(seen, roots, resolved);
     }
   }
@@ -10993,7 +11844,8 @@ function resolveHarnessScanRoots(options = {}) {
 }
 
 // src/cleanup-disk-pressure.ts
-function envFlag3(name) {
+init_disk_gate();
+function envFlag4(name) {
   const v = process.env[name];
   return v === "1" || v === "true" || v === "yes";
 }
@@ -11016,7 +11868,7 @@ function observeCleanupDiskPressure(input = {}) {
 }
 function applyDiskPressureToRetention(retention, pressure) {
   if (!pressure.pressured) return retention;
-  const executeOnPressure = retention.execute || !envFlag3("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");
+  const executeOnPressure = retention.execute || !envFlag4("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");
   return {
     ...retention,
     execute: executeOnPressure,
@@ -11041,6 +11893,39 @@ function emitCleanupProgress(phase, detail) {
   console.error(`[kynver cleanup] ${phase}${suffix}`);
 }
 
+// src/cleanup-git-rev-cache.ts
+init_git();
+var CleanupGitRevCache = class {
+  aheadOfMain = /* @__PURE__ */ new Map();
+  countAheadOfMain(worktreePath, base = "origin/main") {
+    const key = `${worktreePath}\0${base}`;
+    if (this.aheadOfMain.has(key)) return this.aheadOfMain.get(key) ?? null;
+    const result = gitCapture(worktreePath, ["rev-list", "--count", `${base}..HEAD`]);
+    if (result.status !== 0) {
+      this.aheadOfMain.set(key, null);
+      return null;
+    }
+    const count = Number(result.stdout.trim());
+    const parsed = Number.isFinite(count) ? count : null;
+    this.aheadOfMain.set(key, parsed);
+    return parsed;
+  }
+};
+
+// src/cleanup-git-status-cache.ts
+init_git();
+var CleanupGitStatusCache = class {
+  cache = /* @__PURE__ */ new Map();
+  porcelain(worktreePath) {
+    const resolved = worktreePath;
+    const cached = this.cache.get(resolved);
+    if (cached !== void 0) return cached;
+    const lines = gitStatusShort(resolved);
+    this.cache.set(resolved, lines);
+    return lines;
+  }
+};
+
 // src/cleanup-run-terminal-cache.ts
 var CleanupRunTerminalCache = class {
   cache = /* @__PURE__ */ new Map();
@@ -11140,9 +12025,9 @@ function mergeWorktreeIndexes(scanRoots) {
 }
 function worktreePathForCandidate(candidate, worktreesDir) {
   if (candidate.runId && candidate.worker) {
-    return path53.join(worktreesDir, candidate.runId, candidate.worker);
+    return path54.join(worktreesDir, candidate.runId, candidate.worker);
   }
-  return path53.resolve(candidate.path, "..");
+  return path54.resolve(candidate.path, "..");
 }
 function runHarnessCleanup(options = {}) {
   let retention = resolveHarnessRetention(options);
@@ -11158,7 +12043,11 @@ function runHarnessCleanup(options = {}) {
   emitCleanupProgress("index", "building worktree index");
   const index = mergeWorktreeIndexes(paths.scanRoots);
   emitCleanupProgress("index", `${index.size} indexed worktree(s)`);
-  const liveness = { runTerminalCache: new CleanupRunTerminalCache() };
+  const liveness = {
+    runTerminalCache: new CleanupRunTerminalCache(),
+    gitStatusCache: new CleanupGitStatusCache(),
+    gitRevCache: new CleanupGitRevCache()
+  };
   const skips = [];
   const actions = [];
   const processedPaths = /* @__PURE__ */ new Set();
@@ -11167,7 +12056,7 @@ function runHarnessCleanup(options = {}) {
   for (const harnessRoot of paths.scanRoots) {
     if (atSweepCap()) break;
     emitCleanupProgress("root", harnessRoot);
-    const worktreesDir = path53.join(harnessRoot, "worktrees");
+    const worktreesDir = path54.join(harnessRoot, "worktrees");
     const scanOpts = {
       harnessRoot,
       worktreesDir,
@@ -11178,9 +12067,16 @@ function runHarnessCleanup(options = {}) {
       index,
       now: paths.now
     };
-    for (const raw of scanDependencyCacheCandidates(scanOpts)) {
+    const dependencyCandidates = scanDependencyCacheCandidates(scanOpts);
+    emitCleanupProgress("dependency", `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}`);
+    let dependencyProcessed = 0;
+    for (const raw of dependencyCandidates) {
       if (atSweepCap()) break;
-      const resolved = path53.resolve(raw.path);
+      dependencyProcessed += 1;
+      if (dependencyProcessed % 50 === 0) {
+        emitCleanupProgress("dependency", `${dependencyProcessed}/${dependencyCandidates.length} evaluated`);
+      }
+      const resolved = path54.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -11191,7 +12087,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path53.resolve(worktreePath)) ?? null;
+      const indexed = index.get(path54.resolve(worktreePath)) ?? null;
       const guardReason = skipDependencyCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -11199,7 +12095,8 @@ function runHarnessCleanup(options = {}) {
         ageMs: candidate.ageMs,
         worktreePath,
         activeWorktreePaths: activeGuards.activeWorktreePaths,
-        diskPressure: retention.diskPressure
+        diskPressure: retention.diskPressure,
+        gitStatusCache: liveness.gitStatusCache
       });
       if (guardReason) {
         recordSkip(skips, candidate.path, guardReason);
@@ -11215,7 +12112,7 @@ function runHarnessCleanup(options = {}) {
     }
     for (const raw of scanBuildCacheCandidates(scanOpts)) {
       if (atSweepCap()) break;
-      const resolved = path53.resolve(raw.path);
+      const resolved = path54.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -11226,7 +12123,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path53.resolve(worktreePath)) ?? null;
+      const indexed = index.get(path54.resolve(worktreePath)) ?? null;
       const guardReason = skipBuildCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -11234,7 +12131,8 @@ function runHarnessCleanup(options = {}) {
         ageMs: candidate.ageMs,
         worktreePath,
         activeWorktreePaths: activeGuards.activeWorktreePaths,
-        diskPressure: retention.diskPressure
+        diskPressure: retention.diskPressure,
+        gitStatusCache: liveness.gitStatusCache
       });
       if (guardReason) {
         recordSkip(skips, candidate.path, guardReason);
@@ -11254,13 +12152,18 @@ function runHarnessCleanup(options = {}) {
     ];
     emitCleanupProgress("worktrees", `${worktreeCandidates.length} candidate(s) at ${harnessRoot}`);
     const worktreeSeen = /* @__PURE__ */ new Set();
+    let worktreeProcessed = 0;
     for (const raw of worktreeCandidates) {
       if (atSweepCap()) break;
-      const resolved = path53.resolve(raw.path);
+      worktreeProcessed += 1;
+      if (worktreeProcessed % 50 === 0) {
+        emitCleanupProgress("worktrees", `${worktreeProcessed}/${worktreeCandidates.length} evaluated`);
+      }
+      const resolved = path54.resolve(raw.path);
       if (worktreeSeen.has(resolved)) continue;
       worktreeSeen.add(resolved);
       const candidate = { ...raw, path: resolved };
-      const indexed = index.get(path53.resolve(candidate.path)) ?? null;
+      const indexed = index.get(path54.resolve(candidate.path)) ?? null;
       const orphanSafety = indexed ? null : assessOrphanWorktreeSafety({
         worktreePath: candidate.path,
         harnessRoot,
@@ -11270,7 +12173,7 @@ function runHarnessCleanup(options = {}) {
       });
       const guardSkip = skipWorktreeRemoval({
         indexed,
-        worktreePath: path53.resolve(candidate.path),
+        worktreePath: path54.resolve(candidate.path),
         includeOrphans: retention.includeOrphans,
         worktreesAgeMs: retention.worktreesAgeMs,
         terminalWorktreesAgeMs: retention.terminalWorktreesAgeMs,
@@ -11302,11 +12205,11 @@ function runHarnessCleanup(options = {}) {
         now: paths.now
       })) {
         if (atSweepCap()) break;
-        const resolved = path53.resolve(raw.path);
+        const resolved = path54.resolve(raw.path);
         if (processedPaths.has(resolved)) continue;
         processedPaths.add(resolved);
         const candidate = { ...raw, path: resolved };
-        const runId = candidate.runId ?? path53.basename(resolved);
+        const runId = candidate.runId ?? path54.basename(resolved);
         const dirSkip = skipRunDirectoryRemoval({
           harnessRoot,
           runId,
@@ -11441,12 +12344,13 @@ function isPipelineCleanupEnabled() {
 
 // src/installed-package-versions.ts
 import { readFile } from "node:fs/promises";
-import { homedir as homedir13 } from "node:os";
-import path55 from "node:path";
+import { homedir as homedir14 } from "node:os";
+import path56 from "node:path";
 
 // src/memory-cost-package-version-guard.ts
-import { existsSync as existsSync40, readFileSync as readFileSync13 } from "node:fs";
-import path54 from "node:path";
+init_default_repo_discovery();
+import { existsSync as existsSync40, readFileSync as readFileSync14 } from "node:fs";
+import path55 from "node:path";
 var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
   "@kynver-app/runtime": "0.1.83",
   "@kynver-app/openclaw-agent-os": "0.1.43",
@@ -11497,7 +12401,7 @@ function maxSemver(versions) {
 }
 function readPackageJsonVersion(packageJsonPath) {
   try {
-    const parsed = JSON.parse(readFileSync13(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync14(packageJsonPath, "utf8"));
     return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
   } catch {
     return null;
@@ -11508,8 +12412,8 @@ function resolveRepoRoot(cwd, explicitRepoRoot) {
     (value) => Boolean(value?.trim())
   );
   for (const candidate of candidates) {
-    const resolved = path54.resolve(candidate);
-    if (existsSync40(path54.join(resolved, "packages/kynver-runtime/package.json")) && existsSync40(path54.join(resolved, "package.json"))) {
+    const resolved = path55.resolve(candidate);
+    if (existsSync40(path55.join(resolved, "packages/kynver-runtime/package.json")) && existsSync40(path55.join(resolved, "package.json"))) {
       return resolved;
     }
   }
@@ -11522,7 +12426,7 @@ function probeRepoPackageVersions(input = {}) {
   if (!repoRoot) return {};
   const out = {};
   for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
-    const packageJsonPath = path54.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
+    const packageJsonPath = path55.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
     const version = readPackageJsonVersion(packageJsonPath);
     if (!version) continue;
     out[packageName] = { version, source: "repo", path: packageJsonPath };
@@ -11641,13 +12545,13 @@ function unique(values) {
   return [...new Set(values.filter((value) => Boolean(value)))];
 }
 function moduleRoots() {
-  const home = homedir13();
-  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path55.join(home, ".openclaw", "npm");
-  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path55.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path55.join(home, ".npm-global", "lib", "node_modules"));
+  const home = homedir14();
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path56.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path56.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path56.join(home, ".npm-global", "lib", "node_modules"));
   return unique([
-    path55.join(openClawPrefix, "lib", "node_modules"),
-    path55.join(openClawPrefix, "node_modules"),
-    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path55.join(npmGlobalRoot, "lib", "node_modules")
+    path56.join(openClawPrefix, "lib", "node_modules"),
+    path56.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path56.join(npmGlobalRoot, "lib", "node_modules")
   ]);
 }
 async function readVersion(packageJsonPath) {
@@ -11663,7 +12567,7 @@ function installedPackageJsonCandidates(packageName) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const root of roots) {
-    const candidate = path55.join(root, packageName, "package.json");
+    const candidate = path56.join(root, packageName, "package.json");
     if (seen.has(candidate)) continue;
     seen.add(candidate);
     out.push(candidate);
@@ -11688,13 +12592,355 @@ async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new
   return out;
 }
 
+// src/provider-evidence/exec.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+var DEFAULT_CLI_TIMEOUT_MS = 1e4;
+var MAX_CLI_BUFFER_BYTES = 4 * 1024 * 1024;
+var defaultCliRunner = (cmd, args, opts) => {
+  try {
+    const result = spawnSync7(cmd, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: opts?.timeoutMs ?? DEFAULT_CLI_TIMEOUT_MS,
+      maxBuffer: MAX_CLI_BUFFER_BYTES
+    });
+    return {
+      ok: result.status === 0,
+      stdout: typeof result.stdout === "string" ? result.stdout : "",
+      stderr: typeof result.stderr === "string" ? result.stderr : ""
+    };
+  } catch (err) {
+    return { ok: false, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+};
+function runCliJson(run, cmd, args) {
+  const result = run(cmd, args);
+  if (!result.ok || !result.stdout.trim()) return null;
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    return null;
+  }
+}
+
+// src/provider-evidence/types.ts
+function providerEvidenceKey(provider, kind, subject) {
+  return `${provider} ${kind} ${subject}`;
+}
+function parseCommitEvidenceSubject(subject) {
+  const at = subject.lastIndexOf("@");
+  if (at <= 0 || at === subject.length - 1) return null;
+  const repo = subject.slice(0, at);
+  const sha = subject.slice(at + 1);
+  if (!/^[^/\s]+\/[^/\s]+$/.test(repo) || !/^[0-9a-f]{7,40}$/i.test(sha)) return null;
+  return { repo, sha };
+}
+function parsePrUrlSubject(subject) {
+  const m = subject.trim().match(/[/:]([^/]+\/[^/]+)\/(?:pull|pulls|merge_requests|pull-requests)\/(\d+)/i);
+  if (!m) return null;
+  const number = Number(m[2]);
+  if (!Number.isFinite(number) || number <= 0) return null;
+  return { repo: m[1], number };
+}
+
+// src/provider-evidence/recipes-github.ts
+var MAX_BODY_CHARS = 8e3;
+var MAX_STATUS_ROWS = 30;
+var MAX_CHECK_RUNS = 100;
+var MAX_CHANGED_FILES = 400;
+function githubCliAvailable(run) {
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) return true;
+  return run("gh", ["auth", "token"]).ok;
+}
+function asRecord4(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function pickStatusRows(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((raw) => asRecord4(raw)).filter((row) => row !== null).slice(0, MAX_STATUS_ROWS).map((row) => ({
+    context: row.context ?? null,
+    state: row.state ?? null,
+    target_url: row.target_url ?? null,
+    description: row.description ?? null
+  }));
+}
+function fetchCombinedStatus(run, repo, sha) {
+  const status = runCliJson(run, "gh", [
+    "api",
+    `repos/${repo}/commits/${sha}/status`
+  ]);
+  if (!status) return null;
+  return { state: status.state ?? null, statuses: pickStatusRows(status.statuses) };
+}
+var githubPrSnapshotRecipe = {
+  provider: "github",
+  kind: "pr_snapshot",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parsePrUrlSubject(subject);
+    if (!parsed) return null;
+    const pull = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}/pulls/${parsed.number}`
+    ]);
+    if (!pull) return null;
+    const head = asRecord4(pull.head);
+    const headSha = typeof head?.sha === "string" ? head.sha : null;
+    const user = asRecord4(pull.user);
+    const headRepoOwner = asRecord4(asRecord4(head?.repo)?.owner);
+    const body = typeof pull.body === "string" ? pull.body.slice(0, MAX_BODY_CHARS) : null;
+    let checkRuns = [];
+    let combinedStatus = {
+      state: null,
+      statuses: []
+    };
+    if (headSha) {
+      const runs = runCliJson(run, "gh", [
+        "api",
+        `repos/${parsed.repo}/commits/${headSha}/check-runs?per_page=100`
+      ]);
+      if (Array.isArray(runs?.check_runs)) {
+        checkRuns = runs.check_runs.map((raw) => asRecord4(raw)).filter((row) => row !== null).slice(0, MAX_CHECK_RUNS).map((row) => ({
+          name: row.name ?? null,
+          status: row.status ?? null,
+          conclusion: row.conclusion ?? null
+        }));
+      }
+      combinedStatus = fetchCombinedStatus(run, parsed.repo, headSha) ?? combinedStatus;
+    }
+    const filesResult = run("gh", [
+      "api",
+      "--paginate",
+      `repos/${parsed.repo}/pulls/${parsed.number}/files?per_page=100`,
+      "--jq",
+      ".[].filename"
+    ]);
+    const changedFiles = filesResult.ok ? filesResult.stdout.split("\n").map((line) => line.trim()).filter(Boolean).slice(0, MAX_CHANGED_FILES) : [];
+    return {
+      pull: {
+        html_url: pull.html_url ?? null,
+        title: pull.title ?? null,
+        body,
+        user: { login: user?.login ?? null },
+        state: pull.state ?? null,
+        draft: pull.draft ?? null,
+        merged: pull.merged ?? null,
+        merged_at: pull.merged_at ?? null,
+        merge_commit_sha: pull.merge_commit_sha ?? null,
+        mergeable: pull.mergeable ?? null,
+        mergeable_state: pull.mergeable_state ?? null,
+        head: {
+          sha: headSha,
+          ref: head?.ref ?? null,
+          repo: { owner: { login: headRepoOwner?.login ?? null } }
+        }
+      },
+      checkRuns,
+      combinedStatus,
+      changedFiles
+    };
+  }
+};
+var githubCommitStatusRecipe = {
+  provider: "github",
+  kind: "commit_status",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    return fetchCombinedStatus(run, parsed.repo, parsed.sha);
+  }
+};
+var githubBranchReachabilityRecipe = {
+  provider: "github",
+  kind: "branch_reachability",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    const repoMeta = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}`
+    ]);
+    const defaultBranch = typeof repoMeta?.default_branch === "string" && repoMeta.default_branch.trim() ? repoMeta.default_branch.trim() : null;
+    if (!defaultBranch) return null;
+    const compare = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}/compare/${encodeURIComponent(defaultBranch)}...${parsed.sha}`
+    ]);
+    if (!compare) return null;
+    const compareStatus = typeof compare.status === "string" ? compare.status : null;
+    return {
+      defaultBranch,
+      compareStatus,
+      reachable: compareStatus === "identical" || compareStatus === "behind"
+    };
+  }
+};
+
+// src/provider-evidence/recipes-vercel.ts
+var MAX_DEPLOYMENT_ROWS = 5;
+var STATE_PATTERN = /\b(READY|ERROR|BUILDING|QUEUED|CANCELED|INITIALIZING)\b/i;
+var URL_PATTERN = /https:\/\/[^\s]+/;
+var vercelDeploymentStatusRecipe = {
+  provider: "vercel",
+  kind: "deployment_status",
+  version: "1",
+  isAvailable(run) {
+    return run("vercel", ["whoami"]).ok;
+  },
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    const result = run("vercel", [
+      "list",
+      "--prod",
+      "--meta",
+      `githubCommitSha=${parsed.sha}`
+    ]);
+    if (!result.ok) return null;
+    const deployments = [];
+    for (const line of result.stdout.split("\n")) {
+      const url = line.match(URL_PATTERN)?.[0];
+      if (!url) continue;
+      const state = line.match(STATE_PATTERN)?.[1]?.toUpperCase() ?? null;
+      deployments.push({ url, state });
+      if (deployments.length >= MAX_DEPLOYMENT_ROWS) break;
+    }
+    return { found: deployments.length > 0, deployments };
+  }
+};
+
+// src/provider-evidence/registry.ts
+var _recipes = [];
+function registerEvidenceCollector(recipe) {
+  if (_recipes.some((r) => r.provider === recipe.provider && r.kind === recipe.kind)) return;
+  _recipes.push(recipe);
+}
+function getEvidenceCollector(provider, kind) {
+  return _recipes.find((r) => r.provider === provider && r.kind === kind) ?? null;
+}
+function registerDefaultEvidenceCollectors() {
+  registerEvidenceCollector(githubPrSnapshotRecipe);
+  registerEvidenceCollector(githubCommitStatusRecipe);
+  registerEvidenceCollector(githubBranchReachabilityRecipe);
+  registerEvidenceCollector(vercelDeploymentStatusRecipe);
+}
+
+// src/provider-evidence/collect.ts
+var DEFAULT_MAX_SUBJECTS_PER_TICK = 8;
+var DEFAULT_DEADLINE_MS = 25e3;
+function collectProviderEvidence(wanted, opts = {}) {
+  registerDefaultEvidenceCollectors();
+  const run = opts.run ?? defaultCliRunner;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const maxSubjects = opts.maxSubjects ?? DEFAULT_MAX_SUBJECTS_PER_TICK;
+  const deadline = Date.now() + (opts.deadlineMs ?? DEFAULT_DEADLINE_MS);
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = wanted.filter((w) => {
+    const key = providerEvidenceKey(w.provider, w.kind, w.subject);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  const offset = deduped.length > 0 ? Math.floor(now().getTime() / 6e4) % deduped.length : 0;
+  const rotated = deduped.map((_, i) => deduped[(offset + i) % deduped.length]);
+  const window = rotated.slice(0, maxSubjects);
+  const summary = {
+    attempted: 0,
+    collected: 0,
+    items: [],
+    skipped: []
+  };
+  const availability = /* @__PURE__ */ new Map();
+  for (const item of window) {
+    if (Date.now() > deadline) {
+      summary.skipped.push({ ...item, reason: "budget_exhausted" });
+      continue;
+    }
+    const recipe = getEvidenceCollector(item.provider, item.kind);
+    if (!recipe) {
+      summary.skipped.push({ ...item, reason: "no_recipe" });
+      continue;
+    }
+    const availKey = `${recipe.provider} ${recipe.kind}`;
+    let available = availability.get(availKey);
+    if (available === void 0) {
+      available = recipe.isAvailable(run);
+      availability.set(availKey, available);
+    }
+    if (!available) {
+      summary.skipped.push({ ...item, reason: "provider_unavailable" });
+      continue;
+    }
+    summary.attempted += 1;
+    const payload = recipe.collect(item.subject, run);
+    if (payload === null || payload === void 0) {
+      summary.skipped.push({ ...item, reason: "collect_failed" });
+      continue;
+    }
+    summary.collected += 1;
+    summary.items.push({
+      provider: item.provider,
+      kind: item.kind,
+      subject: item.subject,
+      payload,
+      observedAt: now().toISOString(),
+      collectorVersion: recipe.version
+    });
+  }
+  return summary;
+}
+
+// src/provider-evidence/wanted-store.ts
+init_run_store();
+init_util();
+import path57 from "node:path";
+var WANTED_FILE = "provider-evidence-wanted.json";
+function wantedFilePath(runId) {
+  return path57.join(runDirectory(runId), WANTED_FILE);
+}
+function parseWantedItems(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const raw of value) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const row = raw;
+    const provider = typeof row.provider === "string" ? row.provider.trim() : "";
+    const kind = typeof row.kind === "string" ? row.kind.trim() : "";
+    const subject = typeof row.subject === "string" ? row.subject.trim() : "";
+    if (!provider || !kind || !subject) continue;
+    out.push({ provider, kind, subject });
+  }
+  return out;
+}
+function loadPersistedProviderEvidenceWanted(runId) {
+  const persisted = readJson(wantedFilePath(runId), null);
+  return parseWantedItems(persisted?.wanted);
+}
+function persistProviderEvidenceWanted(runId, wanted) {
+  writeJson(wantedFilePath(runId), {
+    savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    wanted
+  });
+}
+function extractProviderEvidenceWanted(tickResponse) {
+  if (!tickResponse || typeof tickResponse !== "object" || Array.isArray(tickResponse)) return null;
+  const wanted = tickResponse.providerEvidenceWanted;
+  if (!Array.isArray(wanted)) return null;
+  return parseWantedItems(wanted);
+}
+
 // src/pipeline-tick.ts
 async function completeFinishedWorkers(runId, args) {
   const run = loadRun(runId);
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path56.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path58.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -11727,6 +12973,13 @@ async function postOperatorTick(agentOsId, runId, resourceGate, args, harnessCle
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/operator/tick`;
   const packageVersions = await collectInstalledPackageVersions();
   const activeHarnessWorkers = collectRunActiveHarnessWorkers(runId);
+  let evidenceCollection = null;
+  try {
+    const evidenceWanted = loadPersistedProviderEvidenceWanted(runId);
+    evidenceCollection = evidenceWanted.length > 0 ? collectProviderEvidence(evidenceWanted) : null;
+  } catch {
+    evidenceCollection = null;
+  }
   const res = await postJson(url, secret, {
     agentOsId,
     runId,
@@ -11741,9 +12994,27 @@ async function postOperatorTick(agentOsId, runId, resourceGate, args, harnessCle
     ...harnessCleanup ? { harnessCleanup } : {},
     runnerPresence: resolveRunnerPresencePayload({ runId }),
     activeHarnessWorkers,
-    ...harnessCleanup ? { harnessCleanup } : {}
+    ...evidenceCollection && evidenceCollection.items.length > 0 ? { providerEvidence: evidenceCollection.items } : {}
   });
-  return { ok: res.ok, httpStatus: res.status, response: res.response };
+  const nextWanted = extractProviderEvidenceWanted(res.response);
+  if (nextWanted) {
+    try {
+      persistProviderEvidenceWanted(runId, nextWanted);
+    } catch {
+    }
+  }
+  return {
+    ok: res.ok,
+    httpStatus: res.status,
+    response: res.response,
+    ...evidenceCollection ? {
+      providerEvidence: {
+        attempted: evidenceCollection.attempted,
+        collected: evidenceCollection.collected,
+        skipped: evidenceCollection.skipped.length
+      }
+    } : {}
+  };
 }
 async function runPipelineTick(args) {
   const runId = String(required(String(args.run || ""), "--run"));
@@ -11851,6 +13122,7 @@ async function awaitDaemonBackoff(ms, isStopping) {
   }
 }
 async function runDaemon(args) {
+  assertNativeDaemonAllowed();
   const runId = String(required(String(args.run || ""), "--run"));
   const agentOsId = String(required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id"));
   const execute = args.execute !== false && args.execute !== "false";
@@ -11890,6 +13162,7 @@ async function runDaemon(args) {
   const cronEnv = resolveKynverCronEnv();
   while (!stopping) {
     try {
+      writeDaemonHeartbeat({ agentOsId, runId });
       if (cronEnv.tickEnabled) {
         const cronTick = await runKynverCronTick({
           env: cronEnv,
@@ -11916,8 +13189,140 @@ async function runDaemon(args) {
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
+// src/daemon-keeper.ts
+init_config();
+import { spawn as spawn6 } from "node:child_process";
+init_util();
+var DEFAULT_STALL_MS = 15 * 6e4;
+var STARTUP_GRACE_MS = 2 * 6e4;
+var KILL_GRACE_MS = 1e4;
+var BACKOFF_BASE_MS = 5e3;
+var BACKOFF_CAP_MS = 5 * 6e4;
+var HEALTHY_RESET_MS = 30 * 6e4;
+var POLL_MS = 5e3;
+function resolveKeeperStallMs(flag, env = process.env) {
+  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
+  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
+  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
+  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
+  return DEFAULT_STALL_MS;
+}
+function shouldRunDaemonKeeper(args, env = process.env) {
+  if (args.keeperChild === true || args.keeperChild === "true") return false;
+  if (args.noSupervise === true || args.noSupervise === "true") return false;
+  if (args.supervised === "false") return false;
+  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
+  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
+    return false;
+  }
+  return true;
+}
+function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
+  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
+  return Math.min(base * 2 ** exp, cap);
+}
+function keeperRunWasHealthy(startedAtMs, endedAtMs, healthyMs = HEALTHY_RESET_MS) {
+  return endedAtMs - startedAtMs >= healthyMs;
+}
+function keeperLog(event, detail = {}) {
+  console.error(JSON.stringify({ event: `daemon_keeper_${event}`, ...detail }));
+}
+function buildKeeperChildArgv(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--supervised" || arg === "--no-supervise" || arg === "--keeper-child") continue;
+    if (arg === "--stall-ms") {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("--")) i += 1;
+      continue;
+    }
+    if (arg.startsWith("--stall-ms=") || arg.startsWith("--supervised=")) continue;
+    out.push(arg);
+  }
+  out.push("--keeper-child");
+  return out;
+}
+async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
+  const agentOsId = String(
+    required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id")
+  );
+  const stallMs = resolveKeeperStallMs(args.stallMs);
+  const childArgv = buildKeeperChildArgv(rawArgv);
+  const cliEntry = process.argv[1];
+  let stopping = false;
+  let child = null;
+  let consecutiveFailures = 0;
+  const stop = (signal) => {
+    stopping = true;
+    keeperLog("stop", { signal });
+    if (child?.pid) child.kill(signal);
+  };
+  process.on("SIGINT", () => stop("SIGINT"));
+  process.on("SIGTERM", () => stop("SIGTERM"));
+  keeperLog("start", { agentOsId, stallMs, childArgv });
+  while (!stopping) {
+    const startedAt = Date.now();
+    let exited = false;
+    let exitCode = null;
+    let exitSignal = null;
+    child = spawn6(process.execPath, [cliEntry, ...childArgv], {
+      stdio: "inherit",
+      env: process.env
+    });
+    keeperLog("child_spawned", { pid: child.pid ?? null });
+    child.on("exit", (code, signal) => {
+      exited = true;
+      exitCode = code;
+      exitSignal = signal;
+    });
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+      if (exited || stopping) break;
+      if (Date.now() - startedAt < STARTUP_GRACE_MS) continue;
+      const beat = readDaemonHeartbeat(agentOsId);
+      const ownBeat = beat && beat.pid === child.pid ? beat : null;
+      if (ownBeat && isDaemonHeartbeatStale(ownBeat, stallMs)) {
+        keeperLog("stall_detected", {
+          pid: child.pid ?? null,
+          lastBeatAt: ownBeat.observedAt,
+          stallMs
+        });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+      if (!ownBeat && Date.now() - startedAt > stallMs + STARTUP_GRACE_MS) {
+        keeperLog("no_heartbeat_detected", { pid: child.pid ?? null, stallMs });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+    }
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+    }
+    if (stopping) break;
+    const endedAt = Date.now();
+    if (keeperRunWasHealthy(startedAt, endedAt)) consecutiveFailures = 0;
+    consecutiveFailures += 1;
+    const backoff = nextKeeperBackoffMs(consecutiveFailures);
+    keeperLog("child_exited", {
+      code: exitCode,
+      signal: exitSignal,
+      uptimeMs: endedAt - startedAt,
+      consecutiveFailures,
+      respawnInMs: backoff
+    });
+    await sleepMsAsync(backoff);
+  }
+  keeperLog("stopped", { agentOsId });
+}
+
 // src/plan-progress.ts
-import path60 from "node:path";
+init_config();
+import path62 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -11926,6 +13331,9 @@ var DEFAULT_NODE_OLD_SPACE_SIZE_MB = 1024;
 var DEFAULT_SYSTEMD_MEMORY_MAX = "1.5G";
 var DEFAULT_SYSTEMD_MEMORY_SWAP_MAX = "2G";
 
+// src/bounded-build/index.ts
+init_meminfo();
+
 // src/bounded-build/node-options.ts
 var MAX_OLD_SPACE_RE = /--max-old-space-size=(\d+)/;
 function parsePositiveInt(value, fallback) {
@@ -11955,7 +13363,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -11966,7 +13374,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync7("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync8("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -11990,7 +13398,9 @@ function buildSystemdRunArgv(opts) {
 }
 
 // src/bounded-build/admission.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+init_config();
+import { spawnSync as spawnSync9 } from "node:child_process";
+init_meminfo();
 function positiveInt4(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -12026,7 +13436,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync8(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -12047,33 +13457,34 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
+init_util();
 import {
   closeSync as closeSync7,
   existsSync as existsSync41,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync7,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import path58 from "node:path";
+import path60 from "node:path";
 
 // src/heavy-verification/paths.ts
-import { mkdirSync as mkdirSync7 } from "node:fs";
-import path57 from "node:path";
+import { mkdirSync as mkdirSync8 } from "node:fs";
+import path59 from "node:path";
 function resolveHeavyVerificationRoot() {
-  return path57.join(resolveKynverStateRoot(), "heavy-verification");
+  return path59.join(resolveKynverStateRoot(), "heavy-verification");
 }
 function heavyVerificationSlotsDir() {
-  return path57.join(resolveHeavyVerificationRoot(), "slots");
+  return path59.join(resolveHeavyVerificationRoot(), "slots");
 }
 function ensureHeavyVerificationDirs() {
   const dir = heavyVerificationSlotsDir();
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   return dir;
 }
 
@@ -12098,12 +13509,12 @@ function indexedSlotId(index) {
   return `slot-${index}`;
 }
 function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
-  return path58.join(slotsDir, `${slotId}.json`);
+  return path60.join(slotsDir, `${slotId}.json`);
 }
 function readSlotRecord(filePath) {
   if (!existsSync41(filePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync14(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync15(filePath, "utf8"));
     if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
       return parsed;
     }
@@ -12128,7 +13539,7 @@ function reclaimStaleSlot(filePath, staleMs) {
   }
 }
 function ensureSlotsDir(slotsDir) {
-  mkdirSync8(slotsDir, { recursive: true });
+  mkdirSync9(slotsDir, { recursive: true });
   return slotsDir;
 }
 function reclaimStaleHeavyVerificationSlots(opts = {}) {
@@ -12137,7 +13548,7 @@ function reclaimStaleHeavyVerificationSlots(opts = {}) {
   let reclaimed = 0;
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const filePath = path58.join(slotsDir, name);
+    const filePath = path60.join(slotsDir, name);
     const before = existsSync41(filePath);
     reclaimStaleSlot(filePath, staleMs);
     if (before && !existsSync41(filePath)) reclaimed += 1;
@@ -12151,7 +13562,7 @@ function listActiveHeavyVerificationSlots(opts = {}) {
   const active = [];
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const record = readSlotRecord(path58.join(slotsDir, name));
+    const record = readSlotRecord(path60.join(slotsDir, name));
     if (record && !slotIsStale(record, staleMs)) active.push(record);
   }
   return active;
@@ -12193,7 +13604,7 @@ function tryAcquireHeavyVerificationSlot(command, opts = {}) {
     };
     try {
       const fd = openSync7(filePath, "wx");
-      writeFileSync5(fd, JSON.stringify(record, null, 2), "utf8");
+      writeFileSync6(fd, JSON.stringify(record, null, 2), "utf8");
       closeSync7(fd);
       const activeSlots2 = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
       return {
@@ -12253,10 +13664,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -12271,11 +13682,12 @@ function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {
 }
 
 // src/harness-worktree-build-guard.ts
-import path59 from "node:path";
+init_paths();
+import path61 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path59.relative(worktreesDir, path59.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path59.isAbsolute(rel);
+  const rel = path61.relative(worktreesDir, path61.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path61.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -12299,7 +13711,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync10(argv[0], argv.slice(1), {
+  const res = spawnSync11(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -12425,6 +13837,7 @@ function runHarnessVerifyCommands(cwd, commands = DEFAULT_HARNESS_VERIFY_COMMAND
 }
 
 // src/plan-progress.ts
+init_util();
 function parseEvidenceArg(raw) {
   const idx = raw.indexOf(":");
   if (idx <= 0) throw new Error(`invalid --evidence ${raw} (expected type:value)`);
@@ -12487,7 +13900,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path60.resolve(worktree);
+  const cwd = path62.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -12536,9 +13949,10 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path61 from "node:path";
+import path63 from "node:path";
+init_util();
 function runHarnessVerifyCli(args) {
-  const cwd = path61.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path63.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -12583,7 +13997,9 @@ function runHarnessVerifyCli(args) {
 }
 
 // src/plan-persist-cli.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+init_config();
+import { readFileSync as readFileSync16 } from "node:fs";
+init_util();
 var OPERATIONS = ["create", "add_version", "update_metadata"];
 var FAILURE_KINDS = [
   "approval_guard",
@@ -12595,7 +14011,7 @@ var FAILURE_KINDS = [
 function readBodyArg(args) {
   const bodyFile = args.bodyFile ? String(args.bodyFile) : void 0;
   if (bodyFile) {
-    return { body: readFileSync15(bodyFile, "utf8"), bodyPathHint: bodyFile };
+    return { body: readFileSync16(bodyFile, "utf8"), bodyPathHint: bodyFile };
   }
   const inline = args.body ? String(args.body) : void 0;
   if (inline) return { body: inline };
@@ -12746,9 +14162,14 @@ function formatMonitorTickNotice(tick) {
 }
 
 // src/monitor/monitor.service.ts
-import path63 from "node:path";
+import path65 from "node:path";
+init_run_store();
+init_status();
+init_util();
 
 // src/monitor/monitor.classify.ts
+init_status();
+init_util();
 function classifyWorkerHealth(input) {
   const { worker, status, taskLease } = input;
   const leaseOwner = taskLease?.leaseOwner ?? null;
@@ -12798,19 +14219,21 @@ function classifyWorkerHealth(input) {
 }
 
 // src/monitor/monitor.store.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync9, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
-import path62 from "node:path";
+init_paths();
+init_util();
+import { existsSync as existsSync42, mkdirSync as mkdirSync10, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
+import path64 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path62.join(harnessRoot, "monitors");
-  mkdirSync9(dir, { recursive: true });
+  const dir = path64.join(harnessRoot, "monitors");
+  mkdirSync10(dir, { recursive: true });
   return dir;
 }
 function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path62.join(monitorsDir(), `${monitorId}.json`);
+  return path64.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -12831,7 +14254,7 @@ function listMonitorSessions() {
   for (const name of readdirSync16(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path62.join(dir, name),
+      path64.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -12851,6 +14274,7 @@ function listMonitorSessions() {
 }
 
 // src/monitor/monitor.terminal.ts
+init_status();
 function assessAutoCompleteEligibility(input) {
   const { worker, status } = input;
   const blockers = [];
@@ -12894,6 +14318,7 @@ function assessAutoCompleteEligibility(input) {
 }
 
 // src/monitor/monitor.task-lease.ts
+init_config();
 async function fetchTaskLeasesForWorkers(input) {
   const out = /* @__PURE__ */ new Map();
   const agentOsId = input.agentOsId?.trim();
@@ -12922,7 +14347,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path63.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path65.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -13092,6 +14517,7 @@ async function monitorAutoCompleteCli(args) {
 }
 
 // src/monitor/monitor-loop.ts
+init_util();
 var DEFAULT_POLL_MS2 = 5e3;
 var DEFAULT_MAX_TOTAL_MS2 = 6 * 60 * 60 * 1e3;
 async function runMonitorLoop(args) {
@@ -13127,19 +14553,21 @@ async function runMonitorLoop(args) {
 }
 
 // src/monitor/monitor-spawn.ts
-import { spawn as spawn6 } from "node:child_process";
+init_util();
+init_paths();
+import { spawn as spawn7 } from "node:child_process";
 import { closeSync as closeSync8, existsSync as existsSync43, openSync as openSync8 } from "node:fs";
-import path64 from "node:path";
+import path66 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path64.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
+  return path66.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync43(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path64.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path66.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync8(logPath, "a");
@@ -13173,7 +14601,7 @@ function spawnMonitorSidecar(opts) {
     logFd ?? "ignore"
   ];
   try {
-    const child = spawn6(
+    const child = spawn7(
       nodeExecutable,
       args,
       hiddenSpawnOptions({
@@ -13208,6 +14636,7 @@ function spawnMonitorSidecar(opts) {
 }
 
 // src/monitor/monitor-cli.ts
+init_util();
 async function startMonitorCli(args) {
   const runId = String(args.run || "");
   required(runId, "--run");
@@ -13259,7 +14688,7 @@ async function monitorTickCli(args) {
 }
 
 // src/package-version.ts
-import { existsSync as existsSync44, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync17 } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolvePackageRoot(moduleUrl) {
@@ -13274,7 +14703,7 @@ function resolvePackageRoot(moduleUrl) {
 }
 function readOwnPackageVersion(moduleUrl = import.meta.url) {
   const pkgPath = join(resolvePackageRoot(moduleUrl), "package.json");
-  const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync17(pkgPath, "utf8"));
   if (typeof pkg.version !== "string" || !pkg.version.trim()) {
     throw new Error(`Missing package.json version at ${pkgPath}`);
   }
@@ -13341,6 +14770,7 @@ function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
 }
 
 // src/run-resolve.ts
+init_util();
 function resolveHarnessRunByName(runName) {
   const name = runName.trim();
   if (!name) return null;
@@ -13365,7 +14795,11 @@ function resolveHarnessRunCli(args) {
 }
 
 // src/post-restart-unblock.ts
-import path65 from "node:path";
+init_run_store();
+init_status();
+init_util();
+init_config();
+import path67 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -13378,7 +14812,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path65.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path67.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -13490,9 +14924,11 @@ async function postRestartUnblockCli(args) {
 }
 
 // src/default-repo-cli.ts
-import path66 from "node:path";
-import { homedir as homedir14 } from "node:os";
-var CONFIG_FILE2 = path66.join(homedir14(), ".kynver", "config.json");
+init_path_values();
+init_config();
+import path68 from "node:path";
+import { homedir as homedir15 } from "node:os";
+var CONFIG_FILE2 = path68.join(homedir15(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -13573,16 +15009,19 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path68 from "node:path";
+import path70 from "node:path";
+init_path_values();
 
 // src/doctor/runtime-takeover.probes.ts
-import { accessSync, constants, existsSync as existsSync45, readFileSync as readFileSync17 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-import path67 from "node:path";
-import { spawnSync as spawnSync11 } from "node:child_process";
+init_config();
+import { accessSync, constants, existsSync as existsSync45, readFileSync as readFileSync18 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
+import path69 from "node:path";
+import { spawnSync as spawnSync12 } from "node:child_process";
+init_paths();
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync11(bin, args, { encoding: "utf8" });
+    const res = spawnSync12(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -13620,15 +15059,15 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path67.join(homedir15(), ".kynver", "config.json"),
-  credentialsFilePath: () => path67.join(homedir15(), ".kynver", "credentials"),
+  configFilePath: () => path69.join(homedir16(), ".kynver", "config.json"),
+  credentialsFilePath: () => path69.join(homedir16(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path67.join(homedir15(), ".kynver", "credentials");
+    const credPath = path69.join(homedir16(), ".kynver", "credentials");
     if (!existsSync45(credPath)) {
       return { hasApiKey: false };
     }
     try {
-      const parsed = JSON.parse(readFileSync17(credPath, "utf8"));
+      const parsed = JSON.parse(readFileSync18(credPath, "utf8"));
       return {
         hasApiKey: Boolean(parsed.apiKey?.trim()),
         runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
@@ -13658,7 +15097,7 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path67.join(homedir15(), ".openclaw", "harness"),
+  legacyOpenclawHarnessRoot: () => path69.join(homedir16(), ".openclaw", "harness"),
   pathExists: (target) => existsSync45(target),
   pathWritable: (target) => isWritable(target)
 };
@@ -13831,12 +15270,12 @@ function assessRuntimeTakeoverScheduler(env, ctx) {
     return check({
       id: "hotspot_openclaw_scheduler",
       label: "Scheduler provider (runtime daemon vs OpenClaw cron)",
-      status: "pass",
-      summary: "KYNVER_SCHEDULER_PROVIDER unset on hosted deployment; scheduler resolves to kynver-cron (Kynver-owned, not OpenClaw)",
-      remediation: "For production hosted AgentOS schedules, set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server. Dev/harness hosts may rely on kynver-cron or `kynver daemon` without OpenClaw.",
+      status: "warn",
+      summary: "Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",
+      remediation: "Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",
       details: {
         schedulerProvider: null,
-        resolvedFallback: "kynver-cron",
+        resolvedFallback: "none",
         qstashTokenPresent: false,
         hostedDeployment
       }
@@ -14065,8 +15504,8 @@ function assessVercelDeployEvidence(probes) {
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path68.join(harnessRoot, "runs");
-  const worktreesDir = path68.join(harnessRoot, "worktrees");
+  const runsDir = path70.join(harnessRoot, "runs");
+  const worktreesDir = path70.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -14242,6 +15681,7 @@ function runRuntimeTakeoverDoctorCli(args = {}) {
 }
 
 // src/command-center-contract-cli.ts
+init_config();
 async function runCommandCenterContractCli(args) {
   const config = loadUserConfig();
   const agentOsId = (args.agentOsId ? String(args.agentOsId) : config.agentOsId) || "";
@@ -14272,6 +15712,9 @@ async function runCommandCenterContractCli(args) {
   console.log(JSON.stringify(res.response, null, 2));
 }
 
+// src/scheduler-cutover-cli.ts
+init_path_values();
+
 // src/scheduler-cutover.ts
 var DEPLOYMENT_SCHEDULER_CUTOVER_STEPS = [
   "Vercel/hosted: set KYNVER_SCHEDULER_PROVIDER=qstash",
@@ -14330,9 +15773,10 @@ function applySchedulerCutoverAttestation(config) {
 }
 
 // src/scheduler-cutover-cli.ts
-import path69 from "node:path";
-import { homedir as homedir16 } from "node:os";
-var CONFIG_FILE3 = path69.join(homedir16(), ".kynver", "config.json");
+init_config();
+import path71 from "node:path";
+import { homedir as homedir17 } from "node:os";
+var CONFIG_FILE3 = path71.join(homedir17(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -14470,7 +15914,12 @@ async function runCronTickCli(args) {
 }
 
 // src/lane/landing-maintainer-tick.ts
-import os9 from "node:os";
+init_config();
+import os11 from "node:os";
+init_config();
+init_box_identity();
+init_resource_gate();
+init_util();
 
 // src/lane/lane-spec.ts
 var LANDING_MAINTAINER_LANE_SPEC = {
@@ -14482,10 +15931,10 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
-import path70 from "node:path";
+import { spawnSync as spawnSync13 } from "node:child_process";
+import path72 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
-  const script = path70.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
+  const script = path72.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
   const args = [script, String(prNumber), ...LANDING_MAINTAINER_LANE_SPEC.landScriptArgs];
   if (!execute) {
     return {
@@ -14496,7 +15945,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync12("node", args, {
+  const result = spawnSync13("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -14511,7 +15960,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
 }
 function resolveLandingMaintainerRepoRoot(args) {
   const explicit = args.repoPath ? String(args.repoPath).trim() : "";
-  if (explicit) return path70.resolve(explicit);
+  if (explicit) return path72.resolve(explicit);
   const resolved = resolveDefaultRepo();
   return resolved?.repo ?? process.cwd();
 }
@@ -14530,7 +15979,7 @@ async function runLandingMaintainerLaneTick(args) {
     ...buildBoxResourceSnapshotFromGate(resourceGate, {
       harnessRunId: runId,
       boxKind: resolveBoxKindFromConfig(loadUserConfig()),
-      hostLabel: os9.hostname()
+      hostLabel: os11.hostname()
     }),
     providerHealthy: resourceGate.ok,
     authorizedForRepair: resourceGate.ok,
@@ -14634,18 +16083,20 @@ function usage(code = 0) {
   out(
     [
       "Usage:",
-      "  kynver login --api-key KEY",
+      "  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)",
+      "  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)",
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
       "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
-      "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS]",
+      "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]",
+      "  kynver status --run RUN_ID [--blocked] [--running] [--task TASK_ID] [--worker WORKER] [--full]  # top-level compact run status",
       "  kynver run create [--repo /path/repo] [--name name] [--base origin/main]",
       "  kynver run list",
       "  kynver run resolve --name RUN_NAME",
-      "  kynver run status --run RUN_ID [--json] [--compact]",
+      "  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands",
       "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]",
       "  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",
       '  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait]',
-      "  kynver worker list --run RUN_ID [--json] [--compact] [--full]",
+      "  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands",
       "  kynver worker status --run RUN_ID --name worker",
       "  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]",
       "  kynver worker stop --run RUN_ID --name worker",
@@ -14697,8 +16148,11 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync10(runsDir, { recursive: true });
-  mkdirSync10(worktreesDir, { recursive: true });
+  mkdirSync11(runsDir, { recursive: true });
+  mkdirSync11(worktreesDir, { recursive: true });
+  if (scope === "daemon") {
+    assertNativeDaemonAllowed();
+  }
   if (shouldEnforceMemoryCostPackageGuardCli(scope, action)) {
     let repoRoot;
     const runId = args.run ? String(args.run).trim() : "";
@@ -14715,9 +16169,16 @@ async function main(argv = process.argv.slice(2)) {
     });
   }
   if (scope === "login") return void await runLogin(args);
+  if (scope === "bootstrap") return void await runBootstrap(args);
+  if (scope === "status") return runStatus(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);
   if (scope === "setup") return void await runSetup(args);
-  if (scope === "daemon") return void await runDaemon(args);
+  if (scope === "daemon") {
+    if (shouldRunDaemonKeeper(args)) {
+      return void await runDaemonKeeper(args);
+    }
+    return void await runDaemon(args);
+  }
   if (scope === "plan" && action === "progress") return void await emitPlanProgress(args);
   if (scope === "plan" && action === "verify") return void await verifyPlan(args);
   if (scope === "harness" && action === "verify") return runHarnessVerifyCli(args);