@kynver-app/runtime 0.1.93 → 0.1.99

package/dist/index.js

@@ -35,306 +35,21 @@ function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
 }
 
 // src/memory-cost-package-version-guard.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import path from "node:path";
-var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
-  "@kynver-app/runtime": "0.1.83",
-  "@kynver-app/openclaw-agent-os": "0.1.43",
-  "@kynver-app/mcp-agent-os": "0.3.34"
-};
-var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
-  MEMORY_COST_PACKAGE_MIN_VERSIONS
-);
-var DISPLAY_NAMES = {
-  "@kynver-app/runtime": "Kynver runtime",
-  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
-  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
-};
-var REPO_PACKAGE_JSON_RELATIVE = {
-  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
-  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
-  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
-};
-function parseSemverParts(version) {
-  const core = version.trim().split("-")[0]?.split("+")[0];
-  if (!core) return null;
-  const parts = core.split(".");
-  if (parts.length < 1 || parts.length > 3) return null;
-  const nums = parts.map((p) => Number.parseInt(p, 10));
-  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
-  while (nums.length < 3) nums.push(0);
-  return [nums[0], nums[1], nums[2]];
-}
-function compareSemver(a, b) {
-  const pa = parseSemverParts(a);
-  const pb = parseSemverParts(b);
-  if (!pa || !pb) return 0;
-  for (let i = 0; i < 3; i += 1) {
-    if (pa[i] > pb[i]) return 1;
-    if (pa[i] < pb[i]) return -1;
-  }
-  return 0;
-}
-function semverAtLeast(version, minimum) {
-  return compareSemver(version, minimum) >= 0;
-}
-function maxSemver(versions) {
-  let best = null;
-  for (const version of versions) {
-    if (!best || compareSemver(version, best) > 0) best = version;
-  }
-  return best;
-}
-function readPackageJsonVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch {
-    return null;
-  }
-}
-function resolveRepoRoot(cwd, explicitRepoRoot) {
-  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
-    (value) => Boolean(value?.trim())
-  );
-  for (const candidate of candidates) {
-    const resolved = path.resolve(candidate);
-    if (existsSync2(path.join(resolved, "packages/kynver-runtime/package.json")) && existsSync2(path.join(resolved, "package.json"))) {
-      return resolved;
-    }
-  }
-  return null;
-}
-function probeRepoPackageVersions(input = {}) {
-  const cwd = input.cwd ?? process.cwd();
-  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
-  if (!repoRoot) return {};
-  const out = {};
-  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
-    const packageJsonPath = path.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
-    const version = readPackageJsonVersion(packageJsonPath);
-    if (!version) continue;
-    out[packageName] = { version, source: "repo", path: packageJsonPath };
-  }
-  return out;
-}
-function repoSourceCommands(packageName) {
-  if (packageName === "@kynver-app/runtime") {
-    return ["npm run kynver:build", "npm run kynver"];
-  }
-  return [`npm run build -w ${packageName}`];
-}
-function buildRemediation(input) {
-  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
-  const lines = [];
-  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
-    lines.push(
-      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
-    );
-    lines.push("Do not publish npm packages or wait on an operator release.");
-    return lines;
-  }
-  if (effectiveVersion) {
-    lines.push(
-      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
-    );
-  } else {
-    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
-  }
-  if (packageName === "@kynver-app/runtime") {
-    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
-  }
-  if (effectiveSource === "installed" && repoVersion) {
-    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
-  }
-  return lines;
-}
-function pickEffectiveCandidate(candidates) {
-  if (candidates.length === 0) return { version: null, source: "unknown" };
-  const best = maxSemver(candidates.map((candidate) => candidate.version));
-  if (!best) return { version: null, source: "unknown" };
-  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
-  return { version: winner.version, source: winner.source };
-}
-function evaluateMemoryCostPackageVersionGuard(input = {}) {
-  const normalize2 = (value, fallbackSource) => {
-    if (!value) return null;
-    if (typeof value === "string") return { version: value, source: fallbackSource };
-    return value;
-  };
-  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
-    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
-    const candidates = [];
-    const installed = normalize2(input.installed?.[packageName], "installed");
-    const repo = normalize2(input.repo?.[packageName], "repo");
-    const self = normalize2(input.self?.[packageName], "self");
-    if (installed) candidates.push(installed);
-    if (repo) candidates.push(repo);
-    if (self) candidates.push(self);
-    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
-    const repoVersion = repo?.version ?? null;
-    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
-    const remediation = ok2 ? [] : buildRemediation({
-      packageName,
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      repoVersion
-    });
-    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
-    return {
-      packageName,
-      displayName: DISPLAY_NAMES[packageName],
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      ok: ok2,
-      summary: summary2,
-      remediation
-    };
-  });
-  const violations = packages.filter((row) => !row.ok);
-  const ok = violations.length === 0;
-  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
-  return { ok, summary, packages };
-}
-var MemoryCostPackageVersionGuardError = class extends Error {
-  result;
-  constructor(result) {
-    const lines = [
-      result.summary,
-      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
-    ];
-    super(lines.join("\n"));
-    this.name = "MemoryCostPackageVersionGuardError";
-    this.result = result;
-  }
-};
-function assertMemoryCostPackageVersionGuard(input = {}) {
-  const result = evaluateMemoryCostPackageVersionGuard(input);
-  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
-  return result;
-}
-function formatMemoryCostPackageGuardError(result) {
-  return new MemoryCostPackageVersionGuardError(result).message;
-}
-
-// src/installed-package-versions.ts
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import path2 from "node:path";
-var MANAGED_PACKAGES = [
-  "@kynver-app/runtime",
-  "@kynver-app/openclaw-agent-os",
-  "@kynver-app/mcp-agent-os"
-];
-function trim(value) {
-  const out = value?.trim();
-  return out ? out : null;
-}
-function unique(values) {
-  return [...new Set(values.filter((value) => Boolean(value)))];
-}
-function moduleRoots() {
-  const home = homedir();
-  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path2.join(home, ".openclaw", "npm");
-  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path2.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path2.join(home, ".npm-global", "lib", "node_modules"));
-  return unique([
-    path2.join(openClawPrefix, "lib", "node_modules"),
-    path2.join(openClawPrefix, "node_modules"),
-    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path2.join(npmGlobalRoot, "lib", "node_modules")
-  ]);
-}
-async function readVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch {
-    return null;
-  }
-}
-async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  const roots = moduleRoots();
-  const out = {};
-  for (const packageName of MANAGED_PACKAGES) {
-    for (const root of roots) {
-      const packageJsonPath = path2.join(root, packageName, "package.json");
-      const version = await readVersion(packageJsonPath);
-      if (!version) continue;
-      out[packageName] = { version, observedAt, path: packageJsonPath };
-      break;
-    }
-  }
-  return out;
-}
-
-// src/memory-cost-package-version-guard-enforce.ts
-function installedVersionMap(observed) {
-  const out = {};
-  for (const [packageName, row] of Object.entries(observed)) {
-    if (!row?.version) continue;
-    out[packageName] = {
-      version: row.version,
-      source: "installed",
-      path: row.path
-    };
-  }
-  return out;
-}
-async function buildMemoryCostPackageGuardInput(input = {}) {
-  const [installed, repo] = await Promise.all([
-    collectInstalledPackageVersions(),
-    Promise.resolve(probeRepoPackageVersions({ cwd: input.cwd, repoRoot: input.repoRoot }))
-  ]);
-  const self = {};
-  if (input.selfPackageName && input.selfVersion) {
-    self[input.selfPackageName] = { version: input.selfVersion, source: "self" };
-  } else {
-    self["@kynver-app/runtime"] = { version: PACKAGE_VERSION, source: "self" };
-  }
-  return {
-    installed: installedVersionMap(installed),
-    repo,
-    self
-  };
-}
-async function evaluateMemoryCostPackageGuardAtStartup(input = {}) {
-  const guardInput = await buildMemoryCostPackageGuardInput(input);
-  return evaluateMemoryCostPackageVersionGuard(guardInput);
-}
-async function enforceMemoryCostPackageGuardAtStartup(input = {}) {
-  const guardInput = await buildMemoryCostPackageGuardInput(input);
-  return assertMemoryCostPackageVersionGuard(guardInput);
-}
-function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
-  if (!scope) return false;
-  if (scope === "daemon") return true;
-  if (scope === "worker") return true;
-  if (scope === "monitor") return true;
-  if (scope === "run" && (action === "dispatch" || action === "sweep" || action === "reconcile" || action === "unblock")) {
-    return true;
-  }
-  if (scope === "cron" && action === "tick") return true;
-  return false;
-}
-
-// src/config.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir5, totalmem } from "node:os";
-import path10 from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import path4 from "node:path";
 
 // src/default-repo-discovery.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import path5 from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/git.ts
 import { spawnSync } from "node:child_process";
 
 // src/util.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, readdirSync, statSync, writeFileSync } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
 function fail(message) {
   console.error(message);
   process.exit(1);
@@ -356,14 +71,14 @@ function safeJson(line) {
 }
 function readJson(file, fallback) {
   try {
-    return JSON.parse(readFileSync3(file, "utf8"));
+    return JSON.parse(readFileSync2(file, "utf8"));
   } catch (error) {
     if (arguments.length > 1) return fallback;
     fail(`failed to read ${file}: ${error.message}`);
   }
 }
 function writeJson(file, value) {
-  mkdirSync(path3.dirname(file), { recursive: true });
+  mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
 }
@@ -394,12 +109,12 @@ function fileMtime(file) {
   }
 }
 function tailFile(file, lines) {
-  if (!existsSync3(file)) return "";
-  const data = readFileSync3(file, "utf8");
+  if (!existsSync2(file)) return "";
+  const data = readFileSync2(file, "utf8");
   return data.split("\n").slice(-lines).join("\n");
 }
 function readMaybeFile(file) {
-  return file ? readFileSync3(path3.resolve(file), "utf8") : "";
+  return file ? readFileSync2(path.resolve(file), "utf8") : "";
 }
 function sleepMs(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -571,140 +286,449 @@ function computeGitAncestry(worktreePath, baseOrOptions = "origin/main") {
       relation: "synced"
     };
   }
-  const baseIsAncestorOfHead = gitIsAncestor(worktreePath, baseSha, headSha);
-  const headIsAncestorOfBase = gitIsAncestor(worktreePath, headSha, baseSha);
-  const error = baseIsAncestorOfHead.error || headIsAncestorOfBase.error || void 0;
-  if (baseIsAncestorOfHead.isAncestor == null || headIsAncestorOfBase.isAncestor == null) {
-    return {
-      checked: false,
-      base: baseLabel,
-      head: headSha,
-      baseHead: baseSha,
-      baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
-      headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
-      relation: "unknown",
-      ...error ? { error } : {}
-    };
+  const baseIsAncestorOfHead = gitIsAncestor(worktreePath, baseSha, headSha);
+  const headIsAncestorOfBase = gitIsAncestor(worktreePath, headSha, baseSha);
+  const error = baseIsAncestorOfHead.error || headIsAncestorOfBase.error || void 0;
+  if (baseIsAncestorOfHead.isAncestor == null || headIsAncestorOfBase.isAncestor == null) {
+    return {
+      checked: false,
+      base: baseLabel,
+      head: headSha,
+      baseHead: baseSha,
+      baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
+      headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
+      relation: "unknown",
+      ...error ? { error } : {}
+    };
+  }
+  const relation = baseIsAncestorOfHead.isAncestor ? "ahead" : headIsAncestorOfBase.isAncestor ? "merged" : "diverged";
+  return {
+    checked: true,
+    base: baseLabel,
+    head: headSha,
+    baseHead: baseSha,
+    baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
+    headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
+    relation,
+    ...error ? { error } : {}
+  };
+}
+function unknownAncestry(base, error, head = null) {
+  return {
+    checked: false,
+    base,
+    head,
+    baseHead: null,
+    baseIsAncestorOfHead: null,
+    headIsAncestorOfBase: null,
+    relation: "unknown",
+    error
+  };
+}
+
+// src/path-values.ts
+import { homedir } from "node:os";
+import path2 from "node:path";
+function expandHomePath(value) {
+  if (value === "~") return homedir();
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path2.join(homedir(), value.slice(2));
+  }
+  return value;
+}
+function resolveUserPath(value) {
+  return path2.resolve(expandHomePath(value));
+}
+function redactHomePath(value) {
+  const expanded = expandHomePath(value);
+  const resolved = path2.resolve(expanded);
+  const home = path2.resolve(homedir());
+  if (resolved === home) return "~";
+  if (resolved.startsWith(`${home}${path2.sep}`)) {
+    return `~/${path2.relative(home, resolved).split(path2.sep).join("/")}`;
+  }
+  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+}
+function displayUserPath(value) {
+  return redactHomePath(value);
+}
+
+// src/default-repo-discovery.ts
+var WELL_KNOWN_REPO_DIRS = [
+  "Kynver",
+  "repos/Kynver",
+  "repos/kynver-source-main",
+  "code/Kynver",
+  "projects/Kynver"
+];
+function readPackageName(repoRoot) {
+  const pkgPath = path3.join(repoRoot, "package.json");
+  if (!existsSync3(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    return typeof pkg.name === "string" ? pkg.name.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function isKynverMonorepoRoot(repoRoot) {
+  return readPackageName(repoRoot) === "kynver";
+}
+function gitRepoRoot(startDir) {
+  const resolvedStart = path3.resolve(startDir);
+  if (!existsSync3(resolvedStart)) return null;
+  const probe = gitCapture(resolvedStart, ["rev-parse", "--show-toplevel"]);
+  if (probe.status !== 0) return null;
+  const root = probe.stdout.trim();
+  return root.length ? path3.resolve(root) : null;
+}
+function resolveRuntimePackageRoot(moduleUrl = import.meta.url) {
+  let dir = path3.dirname(fileURLToPath2(moduleUrl));
+  for (let depth = 0; depth < 8; depth += 1) {
+    const pkgPath = path3.join(dir, "package.json");
+    if (existsSync3(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+        if (pkg.name === "@kynver-app/runtime") return dir;
+      } catch {
+      }
+    }
+    const parent = path3.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function pushCandidate(seen, out, repo, source) {
+  if (!repo) return;
+  const resolved = path3.resolve(repo);
+  if (seen.has(resolved)) return;
+  if (!isKynverMonorepoRoot(resolved)) return;
+  seen.add(resolved);
+  out.push({ repo: resolved, source });
+}
+function discoverDefaultRepoCandidates(opts) {
+  const cwd = opts?.cwd ?? process.cwd();
+  const seen = /* @__PURE__ */ new Set();
+  const candidates = [];
+  pushCandidate(seen, candidates, gitRepoRoot(cwd), "cwd_git");
+  const runtimePkgRoot = resolveRuntimePackageRoot(opts?.runtimeModuleUrl ?? import.meta.url);
+  if (runtimePkgRoot) {
+    pushCandidate(seen, candidates, gitRepoRoot(runtimePkgRoot), "runtime_checkout");
+  }
+  const home = homedir2();
+  for (const rel of WELL_KNOWN_REPO_DIRS) {
+    pushCandidate(seen, candidates, resolveUserPath(path3.join(home, rel)), "well_known_path");
+  }
+  return candidates;
+}
+function discoverDefaultRepo(opts) {
+  return discoverDefaultRepoCandidates(opts)[0] ?? null;
+}
+
+// src/memory-cost-package-version-guard.ts
+var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
+  "@kynver-app/runtime": "0.1.83",
+  "@kynver-app/openclaw-agent-os": "0.1.43",
+  "@kynver-app/mcp-agent-os": "0.3.34"
+};
+var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
+  MEMORY_COST_PACKAGE_MIN_VERSIONS
+);
+var DISPLAY_NAMES = {
+  "@kynver-app/runtime": "Kynver runtime",
+  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
+  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
+};
+var REPO_PACKAGE_JSON_RELATIVE = {
+  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
+  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
+  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
+};
+function parseSemverParts(version) {
+  const core = version.trim().split("-")[0]?.split("+")[0];
+  if (!core) return null;
+  const parts = core.split(".");
+  if (parts.length < 1 || parts.length > 3) return null;
+  const nums = parts.map((p) => Number.parseInt(p, 10));
+  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
+  while (nums.length < 3) nums.push(0);
+  return [nums[0], nums[1], nums[2]];
+}
+function compareSemver(a, b) {
+  const pa = parseSemverParts(a);
+  const pb = parseSemverParts(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i += 1) {
+    if (pa[i] > pb[i]) return 1;
+    if (pa[i] < pb[i]) return -1;
+  }
+  return 0;
+}
+function semverAtLeast(version, minimum) {
+  return compareSemver(version, minimum) >= 0;
+}
+function maxSemver(versions) {
+  let best = null;
+  for (const version of versions) {
+    if (!best || compareSemver(version, best) > 0) best = version;
+  }
+  return best;
+}
+function readPackageJsonVersion(packageJsonPath) {
+  try {
+    const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function resolveRepoRoot(cwd, explicitRepoRoot) {
+  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
+    (value) => Boolean(value?.trim())
+  );
+  for (const candidate of candidates) {
+    const resolved = path4.resolve(candidate);
+    if (existsSync4(path4.join(resolved, "packages/kynver-runtime/package.json")) && existsSync4(path4.join(resolved, "package.json"))) {
+      return resolved;
+    }
+  }
+  const discovered = discoverDefaultRepo({ cwd });
+  return discovered?.repo ?? null;
+}
+function probeRepoPackageVersions(input = {}) {
+  const cwd = input.cwd ?? process.cwd();
+  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
+  if (!repoRoot) return {};
+  const out = {};
+  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
+    const packageJsonPath = path4.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
+    const version = readPackageJsonVersion(packageJsonPath);
+    if (!version) continue;
+    out[packageName] = { version, source: "repo", path: packageJsonPath };
+  }
+  return out;
+}
+function repoSourceCommands(packageName) {
+  if (packageName === "@kynver-app/runtime") {
+    return ["npm run kynver:build", "npm run kynver"];
+  }
+  return [`npm run build -w ${packageName}`];
+}
+function buildRemediation(input) {
+  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
+  const lines = [];
+  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
+    lines.push(
+      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
+    );
+    lines.push("Do not publish npm packages or wait on an operator release.");
+    return lines;
+  }
+  if (effectiveVersion) {
+    lines.push(
+      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
+    );
+  } else {
+    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
+  }
+  if (packageName === "@kynver-app/runtime") {
+    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
+  }
+  if (effectiveSource === "installed" && repoVersion) {
+    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
   }
-  const relation = baseIsAncestorOfHead.isAncestor ? "ahead" : headIsAncestorOfBase.isAncestor ? "merged" : "diverged";
-  return {
-    checked: true,
-    base: baseLabel,
-    head: headSha,
-    baseHead: baseSha,
-    baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
-    headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
-    relation,
-    ...error ? { error } : {}
-  };
+  return lines;
 }
-function unknownAncestry(base, error, head = null) {
-  return {
-    checked: false,
-    base,
-    head,
-    baseHead: null,
-    baseIsAncestorOfHead: null,
-    headIsAncestorOfBase: null,
-    relation: "unknown",
-    error
+function pickEffectiveCandidate(candidates) {
+  if (candidates.length === 0) return { version: null, source: "unknown" };
+  const best = maxSemver(candidates.map((candidate) => candidate.version));
+  if (!best) return { version: null, source: "unknown" };
+  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
+  return { version: winner.version, source: winner.source };
+}
+function evaluateMemoryCostPackageVersionGuard(input = {}) {
+  const normalize2 = (value, fallbackSource) => {
+    if (!value) return null;
+    if (typeof value === "string") return { version: value, source: fallbackSource };
+    return value;
   };
+  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
+    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
+    const candidates = [];
+    const installed = normalize2(input.installed?.[packageName], "installed");
+    const repo = normalize2(input.repo?.[packageName], "repo");
+    const self = normalize2(input.self?.[packageName], "self");
+    if (installed) candidates.push(installed);
+    if (repo) candidates.push(repo);
+    if (self) candidates.push(self);
+    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
+    const repoVersion = repo?.version ?? null;
+    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
+    const remediation = ok2 ? [] : buildRemediation({
+      packageName,
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      repoVersion
+    });
+    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
+    return {
+      packageName,
+      displayName: DISPLAY_NAMES[packageName],
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      ok: ok2,
+      summary: summary2,
+      remediation
+    };
+  });
+  const violations = packages.filter((row) => !row.ok);
+  const ok = violations.length === 0;
+  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
+  return { ok, summary, packages };
 }
-
-// src/path-values.ts
-import { homedir as homedir2 } from "node:os";
-import path4 from "node:path";
-function expandHomePath(value) {
-  if (value === "~") return homedir2();
-  if (value.startsWith("~/") || value.startsWith("~\\")) {
-    return path4.join(homedir2(), value.slice(2));
+var MemoryCostPackageVersionGuardError = class extends Error {
+  result;
+  constructor(result) {
+    const lines = [
+      result.summary,
+      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
+    ];
+    super(lines.join("\n"));
+    this.name = "MemoryCostPackageVersionGuardError";
+    this.result = result;
   }
-  return value;
+};
+function assertMemoryCostPackageVersionGuard(input = {}) {
+  const result = evaluateMemoryCostPackageVersionGuard(input);
+  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
+  return result;
 }
-function resolveUserPath(value) {
-  return path4.resolve(expandHomePath(value));
+function formatMemoryCostPackageGuardError(result) {
+  return new MemoryCostPackageVersionGuardError(result).message;
 }
-function redactHomePath(value) {
-  const expanded = expandHomePath(value);
-  const resolved = path4.resolve(expanded);
-  const home = path4.resolve(homedir2());
-  if (resolved === home) return "~";
-  if (resolved.startsWith(`${home}${path4.sep}`)) {
-    return `~/${path4.relative(home, resolved).split(path4.sep).join("/")}`;
-  }
-  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+
+// src/installed-package-versions.ts
+import { readFile } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path5 from "node:path";
+var MANAGED_PACKAGES = [
+  "@kynver-app/runtime",
+  "@kynver-app/openclaw-agent-os",
+  "@kynver-app/mcp-agent-os"
+];
+function trim(value) {
+  const out = value?.trim();
+  return out ? out : null;
 }
-function displayUserPath(value) {
-  return redactHomePath(value);
+function unique(values) {
+  return [...new Set(values.filter((value) => Boolean(value)))];
 }
-
-// src/default-repo-discovery.ts
-var WELL_KNOWN_REPO_DIRS = ["Kynver", "repos/Kynver", "code/Kynver", "projects/Kynver"];
-function readPackageName(repoRoot) {
-  const pkgPath = path5.join(repoRoot, "package.json");
-  if (!existsSync4(pkgPath)) return null;
+function moduleRoots() {
+  const home = homedir3();
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path5.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path5.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path5.join(home, ".npm-global", "lib", "node_modules"));
+  return unique([
+    path5.join(openClawPrefix, "lib", "node_modules"),
+    path5.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path5.join(npmGlobalRoot, "lib", "node_modules")
+  ]);
+}
+async function readVersion(packageJsonPath) {
   try {
-    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-    return typeof pkg.name === "string" ? pkg.name.trim() : null;
+    const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
   } catch {
     return null;
   }
 }
-function isKynverMonorepoRoot(repoRoot) {
-  return readPackageName(repoRoot) === "kynver";
-}
-function gitRepoRoot(startDir) {
-  const resolvedStart = path5.resolve(startDir);
-  if (!existsSync4(resolvedStart)) return null;
-  const probe = gitCapture(resolvedStart, ["rev-parse", "--show-toplevel"]);
-  if (probe.status !== 0) return null;
-  const root = probe.stdout.trim();
-  return root.length ? path5.resolve(root) : null;
+function installedPackageJsonCandidates(packageName) {
+  const roots = moduleRoots();
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const root of roots) {
+    const candidate = path5.join(root, packageName, "package.json");
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    out.push(candidate);
+  }
+  return out;
 }
-function resolveRuntimePackageRoot(moduleUrl = import.meta.url) {
-  let dir = path5.dirname(fileURLToPath2(moduleUrl));
-  for (let depth = 0; depth < 8; depth += 1) {
-    const pkgPath = path5.join(dir, "package.json");
-    if (existsSync4(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
-        if (pkg.name === "@kynver-app/runtime") return dir;
-      } catch {
+async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const out = {};
+  for (const packageName of MANAGED_PACKAGES) {
+    let best = null;
+    for (const packageJsonPath of installedPackageJsonCandidates(packageName)) {
+      const version = await readVersion(packageJsonPath);
+      if (!version) continue;
+      if (!best || compareSemver(version, best.version) > 0) {
+        best = { version, path: packageJsonPath };
       }
     }
-    const parent = path5.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+    if (best) {
+      out[packageName] = { version: best.version, observedAt, path: best.path };
+    }
   }
-  return null;
-}
-function pushCandidate(seen, out, repo, source) {
-  if (!repo) return;
-  const resolved = path5.resolve(repo);
-  if (seen.has(resolved)) return;
-  if (!isKynverMonorepoRoot(resolved)) return;
-  seen.add(resolved);
-  out.push({ repo: resolved, source });
+  return out;
 }
-function discoverDefaultRepoCandidates(opts) {
-  const cwd = opts?.cwd ?? process.cwd();
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [];
-  pushCandidate(seen, candidates, gitRepoRoot(cwd), "cwd_git");
-  const runtimePkgRoot = resolveRuntimePackageRoot(opts?.runtimeModuleUrl ?? import.meta.url);
-  if (runtimePkgRoot) {
-    pushCandidate(seen, candidates, gitRepoRoot(runtimePkgRoot), "runtime_checkout");
+
+// src/memory-cost-package-version-guard-enforce.ts
+function installedVersionMap(observed) {
+  const out = {};
+  for (const [packageName, row] of Object.entries(observed)) {
+    if (!row?.version) continue;
+    out[packageName] = {
+      version: row.version,
+      source: "installed",
+      path: row.path
+    };
   }
-  const home = homedir3();
-  for (const rel of WELL_KNOWN_REPO_DIRS) {
-    pushCandidate(seen, candidates, resolveUserPath(path5.join(home, rel)), "well_known_path");
+  return out;
+}
+async function buildMemoryCostPackageGuardInput(input = {}) {
+  const [installed, repo] = await Promise.all([
+    collectInstalledPackageVersions(),
+    Promise.resolve(probeRepoPackageVersions({ cwd: input.cwd, repoRoot: input.repoRoot }))
+  ]);
+  const self = {};
+  const runtimeSelfVersion = input.selfPackageName === "@kynver-app/runtime" && input.selfVersion ? input.selfVersion : PACKAGE_VERSION;
+  self["@kynver-app/runtime"] = { version: runtimeSelfVersion, source: "self" };
+  if (input.selfPackageName && input.selfVersion && input.selfPackageName !== "@kynver-app/runtime") {
+    self[input.selfPackageName] = { version: input.selfVersion, source: "self" };
   }
-  return candidates;
+  return {
+    installed: installedVersionMap(installed),
+    repo,
+    self
+  };
 }
-function discoverDefaultRepo(opts) {
-  return discoverDefaultRepoCandidates(opts)[0] ?? null;
+async function evaluateMemoryCostPackageGuardAtStartup(input = {}) {
+  const guardInput = await buildMemoryCostPackageGuardInput(input);
+  return evaluateMemoryCostPackageVersionGuard(guardInput);
+}
+async function enforceMemoryCostPackageGuardAtStartup(input = {}) {
+  const guardInput = await buildMemoryCostPackageGuardInput(input);
+  return assertMemoryCostPackageVersionGuard(guardInput);
+}
+function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
+  if (!scope) return false;
+  if (scope === "daemon") return true;
+  if (scope === "worker") return true;
+  if (scope === "monitor") return true;
+  if (scope === "run" && (action === "dispatch" || action === "sweep" || action === "reconcile" || action === "unblock")) {
+    return true;
+  }
+  if (scope === "cron" && action === "tick") return true;
+  return false;
 }
 
+// src/config.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir5, totalmem } from "node:os";
+import path10 from "node:path";
+
 // src/box-identity.ts
 function normalizeWorkerPoolBoxKind(raw) {
   const kind = (raw ?? "").trim().toLowerCase();
@@ -779,6 +803,7 @@ function readMemAvailableBytes(meminfoText) {
 
 // src/resource-gate.ts
 import path9 from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // src/disk-gate.ts
 import { statfsSync as statfsSync2 } from "node:fs";
@@ -803,23 +828,23 @@ function isWslHost() {
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path69 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path71 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path69);
+    stats = statfs(path71);
   } catch (error) {
     return {
       ok: false,
-      path: path69,
+      path: path71,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path69}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path71}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -833,11 +858,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path69} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path71} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path69,
+    path: path71,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -857,12 +882,12 @@ var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
 var DEFAULT_MAX_USED_PERCENT = 80;
 var DEFAULT_HARD_MAX_USED_PERCENT = 90;
 function observeRunnerDiskGate(input = {}) {
-  const path69 = input.diskPath?.trim() || "/";
+  const path71 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path69);
+  const stats = statfsSync2(path71);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -885,7 +910,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path69,
+    path: path71,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -2312,11 +2337,29 @@ function computeAutoMaxWorkers(totalMemBytes, opts = {}) {
 function readAvailableMemBytes() {
   return readMemAvailableBytes();
 }
+function pidCommandLine(pid) {
+  if (!pid || process.platform !== "linux") return null;
+  try {
+    return readFileSync9(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
+  } catch {
+    return null;
+  }
+}
+function workerProcessMatchesRecord(worker) {
+  if (!worker.pid || process.platform !== "linux") return true;
+  const cmdline = pidCommandLine(worker.pid);
+  if (!cmdline) return false;
+  const probes = [worker.worktreePath, worker.workerDir, worker.heartbeatPath].filter(
+    (value) => typeof value === "string" && value.trim().length > 0
+  );
+  return probes.some((probe) => cmdline.includes(probe));
+}
 function isActiveHarnessWorker(worker) {
   if (typeof worker.completionBlocker === "string" && worker.completionBlocker.trim()) {
     return false;
   }
   const status = computeWorkerStatus(worker);
+  if (status.alive && !workerProcessMatchesRecord(worker)) return false;
   return status.alive && !status.finalResult && status.attention.state !== "done";
 }
 function countActiveWorkersForRun(run) {
@@ -2467,7 +2510,7 @@ var CREDENTIALS_FILE = path10.join(CONFIG_DIR, "credentials");
 function loadUserConfig() {
   if (!existsSync11(CONFIG_FILE)) return {};
   try {
-    return JSON.parse(readFileSync9(CONFIG_FILE, "utf8"));
+    return JSON.parse(readFileSync10(CONFIG_FILE, "utf8"));
   } catch {
     return {};
   }
@@ -2544,7 +2587,7 @@ function resolveSetupWorkerConfig(existing, args, totalMemBytes = totalmem()) {
 function loadCredentialsFile() {
   if (!existsSync11(CREDENTIALS_FILE)) return {};
   try {
-    return JSON.parse(readFileSync9(CREDENTIALS_FILE, "utf8"));
+    return JSON.parse(readFileSync10(CREDENTIALS_FILE, "utf8"));
   } catch {
     return {};
   }
@@ -2821,15 +2864,30 @@ async function withTimeout(fn) {
     clearTimeout(timeout);
   }
 }
+function callbackFetchError(error) {
+  return {
+    ok: false,
+    status: 0,
+    response: {
+      error: error instanceof Error ? error.message : String(error),
+      timeoutMs: callbackTimeoutMs()
+    }
+  };
+}
 async function postJson(url, secret, body) {
-  const res = await withTimeout(
-    (signal) => fetch(url, {
-      method: "POST",
-      headers: buildHarnessCallbackHeaders(secret),
-      body: JSON.stringify(body),
-      signal
-    })
-  );
+  let res;
+  try {
+    res = await withTimeout(
+      (signal) => fetch(url, {
+        method: "POST",
+        headers: buildHarnessCallbackHeaders(secret),
+        body: JSON.stringify(body),
+        signal
+      })
+    );
+  } catch (error) {
+    return callbackFetchError(error);
+  }
   let response = null;
   try {
     response = await res.json();
@@ -2847,13 +2905,18 @@ async function postJsonWithCredentialRefresh(url, secret, body, opts) {
   return { ...retry, refreshedAuth: true };
 }
 async function getJson(url, secret) {
-  const res = await withTimeout(
-    (signal) => fetch(url, {
-      method: "GET",
-      headers: buildHarnessCallbackHeaders(secret),
-      signal
-    })
-  );
+  let res;
+  try {
+    res = await withTimeout(
+      (signal) => fetch(url, {
+        method: "GET",
+        headers: buildHarnessCallbackHeaders(secret),
+        signal
+      })
+    );
+  } catch (error) {
+    return callbackFetchError(error);
+  }
   let response = null;
   try {
     response = await res.json();
@@ -2863,41 +2926,6 @@ async function getJson(url, secret) {
   return { ok: res.ok, status: res.status, response };
 }
 
-// src/dispatch-lane-normalization.ts
-function trimLower(value) {
-  return (value ?? "").trim().toLowerCase();
-}
-function roleLaneToDispatchLane(roleLane) {
-  switch (trimLower(roleLane)) {
-    case "implementer":
-    case "repair_implementer":
-    case "plan_author":
-    case "runtime_verifier":
-      return "implementation";
-    case "plan_reviewer":
-    case "report_reviewer":
-    case "deep_reviewer":
-      return "review";
-    default:
-      return null;
-  }
-}
-function normalizeDispatchNextLaneFilter(raw) {
-  const key = trimLower(raw);
-  if (!key) return void 0;
-  if (key === "implementation" || key === "review" || key === "landing" || key === "any") {
-    return key;
-  }
-  const mapped = roleLaneToDispatchLane(key);
-  if (mapped) return mapped;
-  if (key === "implement" || key === "repair" || key === "coding") return "implementation";
-  if (key === "land" || key === "merge") return "landing";
-  return void 0;
-}
-function resolveDispatchNextLaneFilter(raw) {
-  return normalizeDispatchNextLaneFilter(raw) ?? "any";
-}
-
 // src/worker-persona-catalog.ts
 var WORKER_PERSONA_CATALOG = [
   {
@@ -3012,6 +3040,41 @@ function workerPersonaLandingSlugs() {
   );
 }
 
+// src/dispatch-lane-normalization.ts
+function trimLower(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function roleLaneToDispatchLane(roleLane) {
+  switch (trimLower(roleLane)) {
+    case "implementer":
+    case "repair_implementer":
+    case "plan_author":
+    case "runtime_verifier":
+      return "implementation";
+    case "plan_reviewer":
+    case "report_reviewer":
+    case "deep_reviewer":
+      return "review";
+    default:
+      return null;
+  }
+}
+function normalizeDispatchNextLaneFilter(raw) {
+  const key = trimLower(raw);
+  if (!key) return void 0;
+  if (key === "implementation" || key === "review" || key === "landing" || key === "any") {
+    return key;
+  }
+  const mapped = roleLaneToDispatchLane(key);
+  if (mapped) return mapped;
+  if (key === "implement" || key === "repair" || key === "coding") return "implementation";
+  if (key === "land" || key === "merge") return "landing";
+  return void 0;
+}
+function resolveDispatchNextLaneFilter(raw) {
+  return normalizeDispatchNextLaneFilter(raw) ?? "any";
+}
+
 // src/model-routing-task-enrich.ts
 function taskString(task, key) {
   const v = task[key];
@@ -3479,7 +3542,7 @@ function probeCursorOAuthBinding(nowIso = (/* @__PURE__ */ new Date()).toISOStri
 }
 
 // src/orchestration-providers/hermes-cli-adapter.ts
-import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
 import path15 from "node:path";
 var PROFILE_ENV_KEYS = [
@@ -3495,7 +3558,7 @@ function hermesProfileEnvPath() {
 }
 function profileEnvKeyPresence(envPath) {
   try {
-    const text = readFileSync10(envPath, "utf8");
+    const text = readFileSync11(envPath, "utf8");
     const present = [];
     for (const key of PROFILE_ENV_KEYS) {
       const re = new RegExp(`^${key}=`, "m");
@@ -4438,14 +4501,15 @@ function buildPrompt(input) {
     input.planId ? `Active planId: ${input.planId}${input.taskId ? ` \xB7 taskId: ${input.taskId}` : ""}` : "No planId on this worker \u2014 still emit progress when you touch plan-scoped work."
   ];
   const mergeGateLines = compact ? [
-    "Merge-gate cost control: do not use Vercel previews/builds for PR verification. Run `node scripts/agent-os-pr-merge-gate.mjs --pr <url> --agent-os-id <id>` (or `verify-pr-local.mjs --from-pr` + POST pr-merge-gate/refresh) before any GitHub Actions run; request merge-gate only via refresh then POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra)."
+    "Merge-gate cost control: do not use Vercel previews/builds for PR verification. Run `node scripts/agent-os-pr-merge-gate.mjs --pr <url> --agent-os-id <id>` (or `verify-pr-local.mjs --from-pr` + POST pr-merge-gate/refresh) before any GitHub Actions run; request merge-gate only via refresh then POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra). Per-PR Vercel preview builds are off by default \u2014 production deploy runs via release batch after merge."
   ] : [
     "GitHub Actions merge-gate cost control (Kynver/Hermes PRs):",
     "- Prefer local cached package verification (`node scripts/verify-pr-local.mjs --emit-json`) before GitHub Actions. Do not use Vercel previews/builds as PR evidence.",
     "- Do not push empty commits to re-trigger CI. One budgeted merge-gate Actions run per PR candidate (head SHA) unless a human approves extra.",
     "- Record evidence: POST `/api/agent-os/by-id/<agentOsId>/pr-merge-gate/refresh` with prUrl + local payloads.",
     "- Request the final Actions run only when local verification is green: POST `.../pr-merge-gate/request-run` (applies `merge-gate` label).",
-    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator."
+    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator.",
+    "- After merge, landed PRs accumulate into a release batch; run batch verification then manual Vercel production deploy from Command Center (release train). PR landing completes with: verification complete, awaiting release batch/deploy."
   ];
   const planArtifactLines = compact ? [
     "Plan artifacts: when authoring/revising docs/superpowers/plans/, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in the harness worktree."
@@ -4468,7 +4532,7 @@ function buildPrompt(input) {
     "Completion handoff (required): before you stop, ensure the harness records a final result \u2014 summarize outcome in your last message and append a heartbeat line with phase `complete`. If you leave uncommitted changes or committed work without a PR, the orchestrator blocks completion until a GitHub PR exists (or you discard/commit cleanly). One-off helper scripts must be removed (`kynver worker discard-disposable --path <file>`) or committed before completion \u2014 maintenance/board-drain workers are not exempt. Exiting with only dirty files and no PR routes to salvage review, not production review.",
     "PR-ready handoff: for substantial implementation work, commit, push, and open a GitHub PR (draft OK) on your branch before finishing \u2014 or rely on the harness to run `gh pr create` at completion when `gh` is authenticated.",
     "Expert review / production-review workers (Dalton/Lorentz, plan-review-task, scheduledJob reviewer children): do NOT open new implementation PRs \u2014 review the parent task's existing PR and record reviewVerdict in finalResult; landing-contract targetPrReconciliation does not apply.",
-    "Worker resource guard: do not run full monorepo verification (`npm run typecheck`, `npm run build`, or equivalent) from this worker lane unless an operator explicitly requests it. Use targeted checks for touched paths and rely on CI/operator lanes for heavy gates.",
+    "Worker resource guard: do not run full monorepo verification (`npm run typecheck`, `npm run build`, or equivalent) from this worker lane unless an operator explicitly requests it. Use targeted checks for touched paths and rely on CI/operator lanes for heavy gates. When heavy verification is required, route through `node scripts/verify-pr-local.mjs` or `kynver harness verify` \u2014 they acquire the global heavy-verification lease so parallel workers do not launch simultaneous typechecks.",
     "npm publish boundary: do not run `npm publish`, do not republish `@kynver-app/*` packages, and do not block on an operator to publish. When you need newer runtime code than npm, use this repo checkout (`npm run kynver:build`, `npm run kynver`) and record evidence: packages/kynver-runtime/package.json version + git ref in your completion report.",
     "If verification fails (including OOM), append a heartbeat line immediately with the last command, failure reason, dirty-file status, commit/PR handoff state, and next action so recovery does not require log spelunking.",
     "Landing-wrapper cleanup on a git ref: use `node scripts/agent-os-land-pr-cleanup-verify.mjs --ref origin/main` (JSON, exit 0). Do not use `git show <ref>:scripts/agent-os-land-pr.mjs | rg \u2026` \u2014 ripgrep exit 1 when markers are absent is reported as a failed command in Telegram/status tooling.",
@@ -5344,8 +5408,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path69 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path69);
+    const path71 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path71);
   });
 }
 
@@ -6653,7 +6717,7 @@ function collectRunActiveHarnessWorkers(runId) {
       path24.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
-    if (!worker?.taskId || !isPidAlive(worker.pid)) continue;
+    if (!worker?.taskId || !workerProcessMatchesRecord(worker)) continue;
     out.push({
       runId: run.id,
       workerName: name,
@@ -6892,7 +6956,7 @@ function isTmpOnlyPath(filePath) {
 // src/plan-persist/outbox-store.ts
 import {
   existsSync as existsSync23,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   renameSync,
   readdirSync as readdirSync5,
   writeFileSync as writeFileSync3,
@@ -6920,7 +6984,7 @@ function findOutboxByIdempotencyKey(key) {
 function readOutboxItem(jsonPath) {
   if (!existsSync23(jsonPath)) return null;
   try {
-    return JSON.parse(readFileSync11(jsonPath, "utf8"));
+    return JSON.parse(readFileSync12(jsonPath, "utf8"));
   } catch {
     return null;
   }
@@ -6928,7 +6992,7 @@ function readOutboxItem(jsonPath) {
 function readOutboxBody(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
   const bodyFile = path26.join(outboxDir, item.bodyPath);
-  return readFileSync11(bodyFile, "utf8");
+  return readFileSync12(bodyFile, "utf8");
 }
 function writeOutboxItem(input, opts) {
   const { outboxDir } = ensurePlanOutboxDirs();
@@ -7410,7 +7474,7 @@ async function dispatchRun(args) {
       runnerPresence,
       harnessBoardSnapshot: buildRunBoard(run.id),
       ...args.lane ? { lane: resolveDispatchNextLaneFilter(String(args.lane)) } : {},
-      executor: args.executor ? String(args.executor) : "harness",
+      ...args.executor ? { executor: String(args.executor) } : {},
       ...args.diskPath ? { diskPath: String(args.diskPath) } : {},
       ...args.targetTaskId ? { targetTaskId: String(args.targetTaskId) } : {},
       ...!args.targetTaskId && args.targetTaskIds ? {
@@ -8238,7 +8302,7 @@ import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "node:fs";
 import path37 from "node:path";
 
 // src/run-list.ts
-import { existsSync as existsSync28, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync28, readFileSync as readFileSync15 } from "node:fs";
 import path36 from "node:path";
 
 // src/stale-reconcile.ts
@@ -9009,7 +9073,7 @@ function reconcileRunsCli() {
 function heartbeatByteLength(heartbeatPath) {
   if (!heartbeatPath || !existsSync28(heartbeatPath)) return 0;
   try {
-    return readFileSync14(heartbeatPath, "utf8").trim().length;
+    return readFileSync15(heartbeatPath, "utf8").trim().length;
   } catch {
     return 0;
   }
@@ -9519,11 +9583,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path69, reason, detail) => {
-    const key = `${path69}\0${reason}`;
+  const push = (path71, reason, detail) => {
+    const key = `${path71}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path69, reason, ...detail ? { detail } : {} });
+    out.push({ path: path71, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -10874,7 +10938,7 @@ function isPipelineCleanupEnabled() {
 }
 
 // src/cli.ts
-import { mkdirSync as mkdirSync8, realpathSync } from "node:fs";
+import { mkdirSync as mkdirSync10, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/discard-disposable.ts
@@ -11062,12 +11126,12 @@ async function fireKynverCronJob(input) {
 }
 
 // src/cron/cron-lock.ts
-import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync15, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync16, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
 var STALE_LOCK_MS = 10 * 6e4;
 function readLockInfo(lockPath) {
   if (!existsSync43(lockPath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync15(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync16(lockPath, "utf8"));
     if (typeof parsed.pid === "number" && typeof parsed.at === "string") return parsed;
   } catch {
     return null;
@@ -11856,17 +11920,17 @@ async function runDaemon(args) {
         idleStreak = 0;
       }
       const backoff = idleStreak >= MAX_IDLE_STREAK ? IDLE_INTERVAL_MS : intervalMs;
-      sleepMs(backoff);
+      await sleepMs(backoff);
     } catch (error) {
       console.error(JSON.stringify({ event: "daemon_tick_error", error: error.message }));
-      sleepMs(intervalMs);
+      await sleepMs(intervalMs);
     }
   }
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
 // src/plan-progress.ts
-import path59 from "node:path";
+import path61 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -11996,14 +12060,235 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
+import { spawnSync as spawnSync9 } from "node:child_process";
+
+// src/heavy-verification/slot.ts
+import {
+  closeSync as closeSync7,
+  existsSync as existsSync44,
+  mkdirSync as mkdirSync8,
+  openSync as openSync7,
+  readdirSync as readdirSync15,
+  readFileSync as readFileSync17,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import path59 from "node:path";
+
+// src/heavy-verification/paths.ts
+import { mkdirSync as mkdirSync7 } from "node:fs";
+import path58 from "node:path";
+function resolveHeavyVerificationRoot() {
+  return path58.join(resolveKynverStateRoot(), "heavy-verification");
+}
+function heavyVerificationSlotsDir() {
+  return path58.join(resolveHeavyVerificationRoot(), "slots");
+}
+function ensureHeavyVerificationDirs() {
+  const dir = heavyVerificationSlotsDir();
+  mkdirSync7(dir, { recursive: true });
+  return dir;
+}
+
+// src/heavy-verification/slot.ts
+var DEFAULT_HEAVY_VERIFICATION_STALE_MS = 2 * 60 * 6e4;
+var DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT = 1;
+function positiveInt5(value, fallback) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.floor(n);
+}
+function isHeavyVerificationGateSkipped() {
+  const v = process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+function resolveHeavyVerificationMaxConcurrent() {
+  const env = process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;
+  if (env) return positiveInt5(env, DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT);
+  return DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT;
+}
+function indexedSlotId(index) {
+  return `slot-${index}`;
+}
+function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
+  return path59.join(slotsDir, `${slotId}.json`);
+}
+function readSlotRecord(filePath) {
+  if (!existsSync44(filePath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync17(filePath, "utf8"));
+    if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
+      return parsed;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function slotIsStale(record3, staleMs = DEFAULT_HEAVY_VERIFICATION_STALE_MS) {
+  if (!record3) return true;
+  if (!isPidAlive(record3.pid)) return true;
+  const atMs = Date.parse(record3.acquiredAt);
+  if (Number.isNaN(atMs)) return true;
+  return Date.now() - atMs > staleMs;
+}
+function reclaimStaleSlot(filePath, staleMs) {
+  const record3 = readSlotRecord(filePath);
+  if (!slotIsStale(record3, staleMs)) return;
+  try {
+    unlinkSync4(filePath);
+  } catch {
+  }
+}
+function ensureSlotsDir(slotsDir) {
+  mkdirSync8(slotsDir, { recursive: true });
+  return slotsDir;
+}
+function reclaimStaleHeavyVerificationSlots(opts = {}) {
+  const slotsDir = ensureSlotsDir(opts.slotsDir ?? ensureHeavyVerificationDirs());
+  const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
+  let reclaimed = 0;
+  for (const name of readdirSync15(slotsDir)) {
+    if (!name.endsWith(".json")) continue;
+    const filePath = path59.join(slotsDir, name);
+    const before = existsSync44(filePath);
+    reclaimStaleSlot(filePath, staleMs);
+    if (before && !existsSync44(filePath)) reclaimed += 1;
+  }
+  return reclaimed;
+}
+function listActiveHeavyVerificationSlots(opts = {}) {
+  const slotsDir = opts.slotsDir ?? ensureHeavyVerificationDirs();
+  const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
+  reclaimStaleHeavyVerificationSlots({ slotsDir, staleMs });
+  const active = [];
+  for (const name of readdirSync15(slotsDir)) {
+    if (!name.endsWith(".json")) continue;
+    const record3 = readSlotRecord(path59.join(slotsDir, name));
+    if (record3 && !slotIsStale(record3, staleMs)) active.push(record3);
+  }
+  return active;
+}
+function countActiveHeavyVerificationSlots(opts = {}) {
+  return listActiveHeavyVerificationSlots(opts).length;
+}
+function tryAcquireHeavyVerificationSlot(command, opts = {}) {
+  if (isHeavyVerificationGateSkipped()) {
+    return {
+      admitted: true,
+      slotId: null,
+      activeSlots: 0,
+      maxSlots: resolveHeavyVerificationMaxConcurrent(),
+      reason: null
+    };
+  }
+  const slotsDir = opts.slotsDir ?? ensureHeavyVerificationDirs();
+  const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
+  const maxSlots = opts.maxSlots ?? resolveHeavyVerificationMaxConcurrent();
+  reclaimStaleHeavyVerificationSlots({ slotsDir, staleMs });
+  for (let index = 0; index < maxSlots; index += 1) {
+    const slotId = indexedSlotId(index);
+    const filePath = slotFilePath(slotId, slotsDir);
+    const existing = readSlotRecord(filePath);
+    if (existing && slotIsStale(existing, staleMs)) {
+      try {
+        unlinkSync4(filePath);
+      } catch {
+      }
+    } else if (existing && !slotIsStale(existing, staleMs)) {
+      continue;
+    }
+    const record3 = {
+      slotId,
+      pid: process.pid,
+      acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+      command
+    };
+    try {
+      const fd = openSync7(filePath, "wx");
+      writeFileSync5(fd, JSON.stringify(record3, null, 2), "utf8");
+      closeSync7(fd);
+      const activeSlots2 = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
+      return {
+        admitted: true,
+        slotId,
+        activeSlots: activeSlots2,
+        maxSlots,
+        reason: null
+      };
+    } catch (err) {
+      if (err.code === "EEXIST") {
+        continue;
+      }
+      throw err;
+    }
+  }
+  const activeSlots = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
+  return {
+    admitted: false,
+    slotId: null,
+    activeSlots,
+    maxSlots,
+    reason: `heavy verification at capacity (${activeSlots}/${maxSlots} slots)`
+  };
+}
+function releaseHeavyVerificationSlot(slotId, opts = {}) {
+  if (!slotId) return;
+  const filePath = slotFilePath(slotId, opts.slotsDir ?? heavyVerificationSlotsDir());
+  try {
+    unlinkSync4(filePath);
+  } catch {
+  }
+}
+function assessHeavyVerificationGate(command, opts = {}) {
+  if (isHeavyVerificationGateSkipped()) {
+    return {
+      admitted: true,
+      slotId: null,
+      activeSlots: 0,
+      maxSlots: resolveHeavyVerificationMaxConcurrent(),
+      reason: null
+    };
+  }
+  const slotsDir = opts.slotsDir ?? ensureHeavyVerificationDirs();
+  const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
+  const maxSlots = opts.maxSlots ?? resolveHeavyVerificationMaxConcurrent();
+  reclaimStaleHeavyVerificationSlots({ slotsDir, staleMs });
+  const activeSlots = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
+  const admitted = activeSlots < maxSlots;
+  return {
+    admitted,
+    slotId: null,
+    activeSlots,
+    maxSlots,
+    reason: admitted ? null : `heavy verification at capacity (${activeSlots}/${maxSlots} slots); waiting for ${command}`
+  };
+}
+
+// src/heavy-verification/gate.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
+function sleepMs3(ms) {
+  if (ms <= 0) return;
+  spawnSync8(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+    stdio: "ignore"
+  });
+}
+function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {}) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  let verdict = tryAcquireHeavyVerificationSlot(command, opts);
+  while (!verdict.admitted && Date.now() < deadline) {
+    sleepMs3(Math.min(pollMs, deadline - Date.now()));
+    verdict = tryAcquireHeavyVerificationSlot(command, opts);
+  }
+  return verdict;
+}
 
 // src/harness-worktree-build-guard.ts
-import path58 from "node:path";
+import path60 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path58.relative(worktreesDir, path58.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path58.isAbsolute(rel);
+  const rel = path60.relative(worktreesDir, path60.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path60.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -12027,7 +12312,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync8(argv[0], argv.slice(1), {
+  const res = spawnSync9(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -12043,8 +12328,25 @@ function runSpawn(argv, opts) {
 }
 function runBoundedBuildCheck(input) {
   const waitMs = input.waitForAdmissionMs ?? 6e5;
+  const verificationGate = waitMs > 0 ? waitForHeavyVerificationSlot(input.command, waitMs) : tryAcquireOrAssessVerificationGate(input.command);
+  if (!verificationGate.admitted) {
+    return {
+      ok: false,
+      exitCode: 1,
+      stdout: "",
+      stderr: verificationGate.reason ?? "heavy verification gate denied",
+      admitted: false,
+      wrappedWithSystemd: false,
+      nodeOptionsFlag: formatNodeOptionsFlag(),
+      admission: assessBuildAdmission(),
+      verificationGate,
+      command: input.command
+    };
+  }
+  const slotId = verificationGate.slotId;
   const admission = waitMs > 0 ? waitForBuildAdmission(waitMs) : assessBuildAdmission();
   if (!admission.admitted) {
+    releaseHeavyVerificationSlot(slotId);
     return {
       ok: false,
       exitCode: 1,
@@ -12054,11 +12356,13 @@ function runBoundedBuildCheck(input) {
       wrappedWithSystemd: false,
       nodeOptionsFlag: formatNodeOptionsFlag(),
       admission,
+      verificationGate,
       command: input.command
     };
   }
   const worktreeGuard = assessHarnessWorktreeBuildGuard(input.cwd);
   if (!worktreeGuard.ok) {
+    releaseHeavyVerificationSlot(slotId);
     return {
       ok: false,
       exitCode: 1,
@@ -12068,6 +12372,7 @@ function runBoundedBuildCheck(input) {
       wrappedWithSystemd: false,
       nodeOptionsFlag: formatNodeOptionsFlag(),
       admission,
+      verificationGate,
       command: input.command
     };
   }
@@ -12100,12 +12405,19 @@ function runBoundedBuildCheck(input) {
       wrappedWithSystemd: useSystemd,
       nodeOptionsFlag,
       admission,
+      verificationGate,
       command: input.command
     };
   } finally {
     registerBuildEnd();
+    releaseHeavyVerificationSlot(slotId);
   }
 }
+function tryAcquireOrAssessVerificationGate(command) {
+  const acquired = waitForHeavyVerificationSlot(command, 0);
+  if (acquired.admitted) return acquired;
+  return { ...assessHeavyVerificationGate(command), slotId: null };
+}
 
 // src/harness-verify.ts
 var DEFAULT_HARNESS_VERIFY_COMMANDS = ["npm run typecheck", "npm run test"];
@@ -12188,7 +12500,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path59.resolve(worktree);
+  const cwd = path61.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -12237,9 +12549,9 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path60 from "node:path";
+import path62 from "node:path";
 function runHarnessVerifyCli(args) {
-  const cwd = path60.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path62.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -12267,6 +12579,7 @@ function runHarnessVerifyCli(args) {
       wrappedWithSystemd: s.result.wrappedWithSystemd,
       nodeOptionsFlag: s.result.nodeOptionsFlag,
       admission: s.result.admission,
+      verificationGate: s.result.verificationGate,
       stderr: s.result.stderr.slice(0, 4e3)
     }))
   };
@@ -12283,7 +12596,7 @@ function runHarnessVerifyCli(args) {
 }
 
 // src/plan-persist-cli.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 var OPERATIONS = ["create", "add_version", "update_metadata"];
 var FAILURE_KINDS = [
   "approval_guard",
@@ -12295,7 +12608,7 @@ var FAILURE_KINDS = [
 function readBodyArg(args) {
   const bodyFile = args.bodyFile ? String(args.bodyFile) : void 0;
   if (bodyFile) {
-    return { body: readFileSync16(bodyFile, "utf8"), bodyPathHint: bodyFile };
+    return { body: readFileSync18(bodyFile, "utf8"), bodyPathHint: bodyFile };
   }
   const inline = args.body ? String(args.body) : void 0;
   if (inline) return { body: inline };
@@ -12675,7 +12988,7 @@ ${text.slice(0, 800)}`,
 }
 
 // src/monitor/monitor.service.ts
-import path62 from "node:path";
+import path64 from "node:path";
 
 // src/monitor/monitor.classify.ts
 function classifyWorkerHealth(input) {
@@ -12727,19 +13040,19 @@ function classifyWorkerHealth(input) {
 }
 
 // src/monitor/monitor.store.ts
-import { existsSync as existsSync44, mkdirSync as mkdirSync7, readdirSync as readdirSync15, unlinkSync as unlinkSync4 } from "node:fs";
-import path61 from "node:path";
+import { existsSync as existsSync45, mkdirSync as mkdirSync9, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
+import path63 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path61.join(harnessRoot, "monitors");
-  mkdirSync7(dir, { recursive: true });
+  const dir = path63.join(harnessRoot, "monitors");
+  mkdirSync9(dir, { recursive: true });
   return dir;
 }
 function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path61.join(monitorsDir(), `${monitorId}.json`);
+  return path63.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -12749,18 +13062,18 @@ function saveMonitorSession(session) {
 }
 function deleteMonitorSession(monitorId) {
   const file = monitorPath(monitorId);
-  if (!existsSync44(file)) return false;
-  unlinkSync4(file);
+  if (!existsSync45(file)) return false;
+  unlinkSync5(file);
   return true;
 }
 function listMonitorSessions() {
   const dir = monitorsDir();
-  if (!existsSync44(dir)) return [];
+  if (!existsSync45(dir)) return [];
   const entries = [];
-  for (const name of readdirSync15(dir)) {
+  for (const name of readdirSync16(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path61.join(dir, name),
+      path63.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -12851,7 +13164,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path62.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path64.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -13057,21 +13370,21 @@ async function runMonitorLoop(args) {
 
 // src/monitor/monitor-spawn.ts
 import { spawn as spawn6 } from "node:child_process";
-import { closeSync as closeSync7, existsSync as existsSync45, openSync as openSync7 } from "node:fs";
-import path63 from "node:path";
+import { closeSync as closeSync8, existsSync as existsSync46, openSync as openSync8 } from "node:fs";
+import path65 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path63.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
+  return path65.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
-  if (!existsSync45(cliPath)) return void 0;
+  if (!existsSync46(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path63.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path65.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
-    logFd = openSync7(logPath, "a");
+    logFd = openSync8(logPath, "a");
   } catch {
     logFd = void 0;
   }
@@ -13111,7 +13424,7 @@ function spawnMonitorSidecar(opts) {
         env: process.env
       })
     );
-    if (logFd !== void 0) closeSync7(logFd);
+    if (logFd !== void 0) closeSync8(logFd);
     child.unref();
     const session = {
       monitorId,
@@ -13128,7 +13441,7 @@ function spawnMonitorSidecar(opts) {
   } catch {
     if (logFd !== void 0) {
       try {
-        closeSync7(logFd);
+        closeSync8(logFd);
       } catch {
       }
     }
@@ -13188,7 +13501,7 @@ async function monitorTickCli(args) {
 }
 
 // src/post-restart-unblock.ts
-import path64 from "node:path";
+import path66 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -13201,7 +13514,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path64.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path66.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -13313,9 +13626,9 @@ async function postRestartUnblockCli(args) {
 }
 
 // src/default-repo-cli.ts
-import path65 from "node:path";
+import path67 from "node:path";
 import { homedir as homedir15 } from "node:os";
-var CONFIG_FILE2 = path65.join(homedir15(), ".kynver", "config.json");
+var CONFIG_FILE2 = path67.join(homedir15(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -13396,16 +13709,16 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path67 from "node:path";
+import path69 from "node:path";
 
 // src/doctor/runtime-takeover.probes.ts
-import { accessSync, constants, existsSync as existsSync46, readFileSync as readFileSync17 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
-import path66 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import path68 from "node:path";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync9(bin, args, { encoding: "utf8" });
+    const res = spawnSync10(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -13430,7 +13743,7 @@ function tokenPrefix(token) {
   return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
 }
 function isWritable(target) {
-  if (!existsSync46(target)) return false;
+  if (!existsSync47(target)) return false;
   try {
     accessSync(target, constants.W_OK);
     return true;
@@ -13443,15 +13756,15 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path66.join(homedir16(), ".kynver", "config.json"),
-  credentialsFilePath: () => path66.join(homedir16(), ".kynver", "credentials"),
+  configFilePath: () => path68.join(homedir16(), ".kynver", "config.json"),
+  credentialsFilePath: () => path68.join(homedir16(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path66.join(homedir16(), ".kynver", "credentials");
-    if (!existsSync46(credPath)) {
+    const credPath = path68.join(homedir16(), ".kynver", "credentials");
+    if (!existsSync47(credPath)) {
       return { hasApiKey: false };
     }
     try {
-      const parsed = JSON.parse(readFileSync17(credPath, "utf8"));
+      const parsed = JSON.parse(readFileSync19(credPath, "utf8"));
       return {
         hasApiKey: Boolean(parsed.apiKey?.trim()),
         runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
@@ -13481,11 +13794,9 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path66.join(homedir16(), ".openclaw", "harness"),
-  pathExists: (target) => existsSync46(target),
-  pathWritable: (target) => isWritable(target),
-  vercelVersion: () => captureCommand("vercel", ["--version"]),
-  vercelWhoami: () => captureCommand("vercel", ["whoami"])
+  legacyOpenclawHarnessRoot: () => path68.join(homedir16(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync47(target),
+  pathWritable: (target) => isWritable(target)
 };
 
 // src/doctor/runtime-takeover-scheduler.ts
@@ -13852,37 +14163,46 @@ function assessRunnerToken(probes) {
   ];
   return { id: "runner_token", label: "Runner token readiness", checks };
 }
-function assessVercelCli(probes) {
-  const version = probes.vercelVersion();
-  const whoami = probes.vercelWhoami();
-  const installed = version.ok;
+function assessVercelDeployEvidence(probes) {
+  const globalCli = probes.commandOnPath("vercel");
+  const cliInstalled = globalCli.ok;
+  const githubToken = Boolean(
+    process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()
+  );
+  const vercelToken = Boolean(process.env.VERCEL_TOKEN?.trim());
   return {
-    id: "vercel_cli",
-    label: "Vercel CLI",
+    id: "vercel_deploy_evidence",
+    label: "Vercel deploy evidence",
     checks: [
       check2({
-        id: "vercel_installed",
-        label: "Vercel CLI installed",
-        status: installed ? "pass" : "warn",
-        summary: installed ? version.stdout || "vercel CLI found" : version.error ?? "vercel not found on PATH",
-        remediation: installed ? void 0 : "Install Vercel CLI (`npm i -g vercel`) for deploy evidence and env pulls.",
-        details: { stderr: version.stderr || null }
+        id: "vercel_global_cli_absent",
+        label: "Global Vercel CLI not installed",
+        status: cliInstalled ? "warn" : "pass",
+        summary: cliInstalled ? `Global Vercel CLI found (${globalCli.stdout || "on PATH"}) \u2014 uninstall after operator approval` : "No global Vercel CLI on PATH",
+        remediation: cliInstalled ? "Uninstall global Vercel CLI (`npm uninstall -g vercel`) \u2014 use GitHub commit status or scoped VERCEL_TOKEN + REST API instead." : void 0,
+        details: { path: cliInstalled ? globalCli.stdout || null : null }
+      }),
+      check2({
+        id: "github_token_for_vercel_status",
+        label: "GitHub token for Vercel status",
+        status: githubToken ? "pass" : "warn",
+        summary: githubToken ? "GITHUB_TOKEN/GH_TOKEN present for GitHub Vercel StatusContext evidence" : "No GITHUB_TOKEN \u2014 merge-gate Vercel evidence requires GitHub commit status API",
+        remediation: githubToken ? void 0 : "Export GITHUB_TOKEN (or GH_TOKEN) for PR head commit status lookups."
       }),
       check2({
-        id: "vercel_authenticated",
-        label: "Vercel CLI authenticated",
-        status: !installed ? "warn" : whoami.ok ? "pass" : "warn",
-        summary: !installed ? "Skipped \u2014 Vercel CLI not installed" : whoami.ok ? `Authenticated as ${whoami.stdout}` : whoami.stderr || whoami.error || "Not logged in",
-        remediation: installed && !whoami.ok ? "Run `vercel login` and link the Kynver project if needed." : void 0,
-        details: { account: whoami.ok ? whoami.stdout : null }
+        id: "vercel_api_token_optional",
+        label: "Vercel API token (optional fallback)",
+        status: vercelToken ? "pass" : "warn",
+        summary: vercelToken ? "VERCEL_TOKEN configured for optional REST API deployment lookup" : "VERCEL_TOKEN unset \u2014 GitHub status is the default path; API fallback disabled",
+        remediation: vercelToken ? void 0 : "Set ephemeral/scoped VERCEL_TOKEN only when GitHub status is insufficient; avoid persistent ~/.vercel auth on runner hosts."
       })
     ]
   };
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path67.join(harnessRoot, "runs");
-  const worktreesDir = path67.join(harnessRoot, "worktrees");
+  const runsDir = path69.join(harnessRoot, "runs");
+  const worktreesDir = path69.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -14013,7 +14333,7 @@ function assessRuntimeTakeoverReadiness(probes = defaultRuntimeTakeoverProbes) {
     assessCliPackage(probes),
     assessUserConfig(probes),
     assessRunnerToken(probes),
-    assessVercelCli(probes),
+    assessVercelDeployEvidence(probes),
     assessHarnessDirs(probes),
     assessCallbackAuth(probes),
     assessOpenclawHotspots(probes)
@@ -14146,9 +14466,9 @@ function applySchedulerCutoverAttestation(config) {
 }
 
 // src/scheduler-cutover-cli.ts
-import path68 from "node:path";
+import path70 from "node:path";
 import { homedir as homedir17 } from "node:os";
-var CONFIG_FILE3 = path68.join(homedir17(), ".kynver", "config.json");
+var CONFIG_FILE3 = path70.join(homedir17(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -14360,10 +14680,22 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync8(runsDir, { recursive: true });
-  mkdirSync8(worktreesDir, { recursive: true });
+  mkdirSync10(runsDir, { recursive: true });
+  mkdirSync10(worktreesDir, { recursive: true });
   if (shouldEnforceMemoryCostPackageGuardCli(scope, action)) {
-    await enforceMemoryCostPackageGuardAtStartup();
+    let repoRoot;
+    const runId = args.run ? String(args.run).trim() : "";
+    if (runId) {
+      try {
+        repoRoot = loadRun(runId).repo;
+      } catch {
+        repoRoot = void 0;
+      }
+    }
+    await enforceMemoryCostPackageGuardAtStartup({
+      repoRoot,
+      cwd: repoRoot
+    });
   }
   if (scope === "login") return void await runLogin(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);
@@ -14435,6 +14767,76 @@ if (isCliEntry) {
   });
 }
 
+// src/vercel/vercel-api.ts
+var VERCEL_API = "https://api.vercel.com";
+function resolveToken(explicit) {
+  const trimmed = explicit?.trim();
+  if (trimmed) return trimmed;
+  return process.env.VERCEL_TOKEN?.trim() || null;
+}
+function mapReadyState(state) {
+  return (state ?? "").trim().toUpperCase();
+}
+function previewUrlFromDeployment(url) {
+  if (typeof url !== "string" || !url.trim()) return null;
+  const trimmed = url.trim();
+  return trimmed.startsWith("http") ? trimmed : `https://${trimmed}`;
+}
+async function fetchVercelDeploymentStatus(deploymentIdOrUrl, options = {}) {
+  const target = deploymentIdOrUrl.trim();
+  if (!target) {
+    return { ok: false, readyState: null, previewUrl: null, error: "missing deployment id or URL" };
+  }
+  const token = resolveToken(options.token);
+  if (!token) {
+    return {
+      ok: false,
+      readyState: null,
+      previewUrl: null,
+      error: "VERCEL_TOKEN not configured"
+    };
+  }
+  const teamId = options.teamId?.trim() || process.env.VERCEL_TEAM_ID?.trim();
+  const teamQuery = teamId ? `?teamId=${encodeURIComponent(teamId)}` : "";
+  const fetchImpl = options.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(`${VERCEL_API}/v13/deployments/${encodeURIComponent(target)}${teamQuery}`, {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      return {
+        ok: false,
+        readyState: null,
+        previewUrl: null,
+        error: `Vercel API ${res.status}: ${body.slice(0, 200)}`
+      };
+    }
+    const data = await res.json();
+    const readyState = mapReadyState(data.readyState ?? data.state);
+    return {
+      ok: true,
+      readyState: readyState || null,
+      previewUrl: previewUrlFromDeployment(data.url),
+      error: null
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      readyState: null,
+      previewUrl: null,
+      error: err instanceof Error ? err.message : "Vercel API fetch failed"
+    };
+  }
+}
+function mapVercelReadyStateToEvidenceStatus(readyState, githubPending) {
+  const state = mapReadyState(readyState);
+  if (state === "READY") return "ready";
+  if (state === "ERROR" || state === "CANCELED") return "error";
+  if (state === "BUILDING" || state === "QUEUED" || state === "INITIALIZING") return "building";
+  return githubPending ? "building" : "error";
+}
+
 // src/vercel/vercel-url.ts
 var VERCEL_HOST_RE = /(^|\.)vercel\.app$/i;
 var DPL_ID_RE = /^dpl_[a-z0-9]+$/i;
@@ -14565,8 +14967,6 @@ function pickVercelStatusContext(statuses) {
 }
 
 // src/vercel/vercel-evidence.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
-var DEFAULT_INSPECT_WAIT_SECONDS = 120;
 function mapGitHubStateToEvidence(state) {
   if (state === "success") return "ready";
   if (state === "pending") return "building";
@@ -14589,7 +14989,7 @@ function resolveVercelInspectTarget(rawUrl) {
     return {
       target: null,
       classified,
-      reason: classified.deploymentId ? "dashboard deployment id is not CLI-inspectable; trust GitHub Vercel status" : "dashboard URL is not valid for vercel inspect"
+      reason: classified.deploymentId ? "dashboard deployment id is not API-inspectable; trust GitHub Vercel status" : "dashboard URL is not valid for Vercel API lookup"
     };
   }
   return { target: null, classified, reason: "unrecognized Vercel URL" };
@@ -14620,55 +15020,16 @@ function evidenceFromGitHubVercelStatus(statuses, options = {}) {
     summary: evidenceSummary([
       `GitHub ${row.context}=${row.state}`,
       row.description ?? "",
-      row.dashboardUrl ? "dashboard target_url (inspect skipped)" : ""
+      row.dashboardUrl ? "dashboard target_url (API lookup skipped)" : ""
     ]),
     observedAt,
     inspectSkipped: true,
-    inspectReason: row.dashboardUrl && row.state === "success" ? "trusted_github_status_dashboard_url" : row.dashboardUrl ? "dashboard_url_not_inspectable" : "github_status_only",
+    inspectReason: row.dashboardUrl && row.state === "success" ? "trusted_github_status_dashboard_url" : row.dashboardUrl ? "dashboard_url_not_api_inspectable" : "github_status_only",
     githubState: row.state,
     vercelContext: row.context
   };
 }
-function defaultRunVercelInspect(target, waitSeconds) {
-  if (!isInspectableVercelTarget(target)) {
-    return {
-      ok: false,
-      exitCode: 1,
-      stdout: "",
-      stderr: "",
-      error: "refusing vercel inspect on non-inspectable target (dashboard URLs use GitHub status)"
-    };
-  }
-  const args = ["inspect", target, "--wait", String(waitSeconds)];
-  const result = spawnSync10("vercel", args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (result.error) {
-    return {
-      ok: false,
-      exitCode: result.status,
-      stdout: "",
-      stderr: "",
-      error: result.error.message
-    };
-  }
-  return {
-    ok: result.status === 0,
-    exitCode: result.status ?? 1,
-    stdout: (result.stdout ?? "").trim(),
-    stderr: (result.stderr ?? "").trim(),
-    error: null
-  };
-}
-function parseInspectReady(stdout, stderr) {
-  const blob = `${stdout}
-${stderr}`.toLowerCase();
-  if (/\b(status|state)\s*[:=]\s*(ready|completed)\b/.test(blob)) return true;
-  if (/\bready\b/.test(blob) && !/\bnot ready\b/.test(blob)) return true;
-  return false;
-}
-function collectVercelEvidence(input) {
+async function collectVercelEvidence(input) {
   const observedAt = input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const base = evidenceFromGitHubVercelStatus(input.statuses ?? [], { observedAt });
   const row = pickVercelStatusContext(input.statuses ?? []);
@@ -14684,7 +15045,7 @@ function collectVercelEvidence(input) {
     return {
       ...base,
       inspectSkipped: true,
-      inspectReason: "inspect_disabled"
+      inspectReason: "api_lookup_disabled"
     };
   }
   const { target, reason } = resolveVercelInspectTarget(row.targetUrl);
@@ -14692,39 +15053,37 @@ function collectVercelEvidence(input) {
     return {
       ...base,
       inspectSkipped: true,
-      inspectReason: reason ?? "not_inspectable",
+      inspectReason: reason ?? "not_api_inspectable",
       summary: evidenceSummary([
         base.summary ?? "",
-        reason ?? "skipped vercel inspect"
+        reason ?? "skipped Vercel API lookup"
       ])
     };
   }
-  const waitSeconds = input.waitSeconds ?? DEFAULT_INSPECT_WAIT_SECONDS;
-  const runInspect = input.runInspect ?? defaultRunVercelInspect;
-  const inspected = runInspect(target, waitSeconds);
+  const runLookup = input.runInspect ?? fetchVercelDeploymentStatus;
+  const lookedUp = await runLookup(target);
   const observed = (/* @__PURE__ */ new Date()).toISOString();
-  if (inspected.error?.includes("ENOENT")) {
+  if (!lookedUp.ok && lookedUp.error?.includes("VERCEL_TOKEN")) {
     return {
       status: "unavailable",
       previewUrl: base.previewUrl,
       deploymentUrl: base.deploymentUrl,
-      summary: "vercel CLI not found on PATH",
+      summary: "VERCEL_TOKEN not configured for API fallback",
       observedAt: observed,
       inspectSkipped: true,
-      inspectReason: "vercel_cli_missing",
+      inspectReason: "vercel_token_missing",
       githubState: row.state,
       vercelContext: row.context
     };
   }
-  if (!inspected.ok) {
-    const detail = [inspected.stderr, inspected.stdout, inspected.error].filter(Boolean).join("\n").trim().slice(0, 500);
+  if (!lookedUp.ok) {
     return {
       status: row.state === "pending" ? "building" : "error",
       previewUrl: base.previewUrl,
       deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
       summary: evidenceSummary([
-        `vercel inspect ${target} failed (exit ${inspected.exitCode ?? "?"})`,
-        detail
+        `Vercel API lookup ${target} failed`,
+        lookedUp.error ?? ""
       ]),
       observedAt: observed,
       inspectSkipped: false,
@@ -14733,12 +15092,19 @@ function collectVercelEvidence(input) {
       vercelContext: row.context
     };
   }
-  const ready = parseInspectReady(inspected.stdout, inspected.stderr);
+  const mapped = mapVercelReadyStateToEvidenceStatus(
+    lookedUp.readyState,
+    row.state === "pending"
+  );
+  const previewUrl = lookedUp.previewUrl ?? (target.startsWith("http") ? target : base.previewUrl);
   return {
-    status: ready ? "ready" : row.state === "pending" ? "building" : "error",
-    previewUrl: target.startsWith("http") ? target : base.previewUrl,
-    deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
-    summary: ready ? `vercel inspect ${target} ready` : `vercel inspect ${target} completed without ready signal`,
+    status: mapped,
+    previewUrl,
+    deploymentUrl: previewUrl ?? base.deploymentUrl,
+    summary: evidenceSummary([
+      `Vercel API ${target}=${lookedUp.readyState ?? "unknown"}`,
+      mapped === "ready" ? "preview ready" : ""
+    ]),
     observedAt: observed,
     inspectSkipped: false,
     inspectReason: null,
@@ -14750,6 +15116,7 @@ export {
   CODEX_DEFAULT_MODEL,
   DEFAULT_DISPATCH_LEASE_MS,
   DEFAULT_HARNESS_VERIFY_COMMANDS,
+  DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT,
   DEFAULT_MAX_ACTIONS_PER_SWEEP,
   DEFAULT_NODE_MODULES_AGE_MS,
   DEFAULT_RUN_DIRECTORIES_AGE_MS,
@@ -14778,6 +15145,7 @@ export {
   assessAutoCompleteEligibility,
   assessBuildAdmission,
   assessExitedWorkerSalvage,
+  assessHeavyVerificationGate,
   assessOrphanWorktreeSafety,
   assessPrHandoffRequirement,
   assessWorkerLanding,
@@ -14811,6 +15179,7 @@ export {
   completeWorker,
   computeAttention,
   computeWorkerStatus,
+  countActiveHeavyVerificationSlots,
   createRun,
   defaultBoxId,
   deriveRunStatus,
@@ -14864,6 +15233,7 @@ export {
   isForbiddenWorkerEnvKey,
   isGeneratedHarnessPath,
   isHarnessRunMetadataPath,
+  isHeavyVerificationGateSkipped,
   isInspectableVercelTarget,
   isKnownWorkerPersonaSlug,
   isKynverMonorepoRoot,
@@ -14878,6 +15248,7 @@ export {
   isWslHost,
   joinHarnessNotice,
   landingContractAttentionReason,
+  listActiveHeavyVerificationSlots,
   listForbiddenWorkerEnvKeys,
   listMonitors,
   listOrchestrationProviderCapabilities,
@@ -14917,12 +15288,14 @@ export {
   providerCapableForRisk,
   readMemAvailableBytes,
   readProductionDbKeysFromEnvFile,
+  reclaimStaleHeavyVerificationSlots,
   reconcileRunsCli,
   reconcileStaleWorkers,
   reconcileWorkerMetadata,
   reconcileWorkerMetadataCli,
   redactHarness,
   redactProviderErrorText,
+  releaseHeavyVerificationSlot,
   remediateDefaultRepo,
   repairMissingRunMetadata,
   repairNestedRunsPath,
@@ -14934,6 +15307,7 @@ export {
   resolveConfiguredWorkerProvider,
   resolveDefaultRepo,
   resolveHarnessRoot,
+  resolveHeavyVerificationMaxConcurrent,
   resolveOpenAiCodexRetryBudget,
   resolveOrchestrationPolicyMode,
   resolveOrchestrationRouting,
@@ -14971,12 +15345,14 @@ export {
   tailWorker,
   taskAllowsClaudeWorker,
   terminalFinalResultFromHeartbeat,
+  tryAcquireHeavyVerificationSlot,
   usage,
   validateOwnedPaths,
   validateRepo,
   validateRunId,
   validateTailLines,
   validateWorkerName,
+  waitForHeavyVerificationSlot,
   workerDirHasActiveRetentionSignals,
   workerPersonaLandingSlugs,
   workerPersonaReviewSlugs,