@legioncodeinc/honeycomb 0.1.7 → 0.1.9

package/daemon/index.js

@@ -7369,7 +7369,7 @@ var require_dist = __commonJS({
 // dist/src/shared/constants.js
 var DAEMON_PORT = 3850;
 var DAEMON_HOST = "127.0.0.1";
-var HONEYCOMB_VERSION = true ? "0.1.7" : "0.0.0-dev";
+var HONEYCOMB_VERSION = true ? "0.1.9" : "0.0.0-dev";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -22440,7 +22440,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve6) => setTimeout(resolve6));
+            await new Promise((resolve7) => setTimeout(resolve7));
             maxReadCount = 3;
             continue;
           }
@@ -22593,7 +22593,7 @@ async function startDaemon(daemon) {
   let server;
   let boundPort = daemon.config.port;
   try {
-    server = await new Promise((resolve6, reject) => {
+    server = await new Promise((resolve7, reject) => {
       let handle;
       try {
         handle = serve({
@@ -22602,7 +22602,7 @@ async function startDaemon(daemon) {
           port: daemon.config.port
         }, (info) => {
           boundPort = info.port;
-          resolve6(handle);
+          resolve7(handle);
         });
         handle.on?.("error", (err) => reject(err));
       } catch (err) {
@@ -22617,13 +22617,13 @@ async function startDaemon(daemon) {
   return {
     address: { host: daemon.config.host, port: boundPort },
     async close() {
-      await new Promise((resolve6, reject) => {
+      await new Promise((resolve7, reject) => {
         server.close((err) => {
           if (err) {
             reject(err instanceof Error ? err : new Error(String(err)));
             return;
           }
-          resolve6();
+          resolve7();
         });
       });
       await daemon.stopServices();
@@ -25673,6 +25673,28 @@ var SESSIONS_COLUMNS = Object.freeze([
   { name: "plugin_version", sql: "TEXT NOT NULL DEFAULT ''" },
   { name: "agent_id", sql: "TEXT NOT NULL DEFAULT 'default'" },
   { name: "visibility", sql: "TEXT NOT NULL DEFAULT 'global'" },
+  // ── PRD-060a (a-AC-3 / a-AC-6): per-turn token + cache usage ──────────────────
+  // Additive columns, healed in via the SAME `ALTER TABLE ADD COLUMN` path the rest
+  // of the catalog uses (the heal engine iterates THIS array; nothing else to wire).
+  //
+  // ZERO vs NULL (a-AC-1 / a-AC-6, the open-question ruling): these four counts are
+  // NULLABLE BIGINT with NO `DEFAULT 0`. The distinction is load-bearing — a genuine
+  // `cache_read_input_tokens = 0` (a real measurement: nothing read from cache) must
+  // stay DISTINCT from "no usage data" (the count was never produced). A `DEFAULT 0`
+  // would collapse "absent" into "measured zero", which a-AC-6 forbids, so absent is
+  // encoded as SQL NULL and a measured zero as the integer 0. Nullable columns are
+  // exempt from the NOT-NULL-needs-a-DEFAULT load guard (NULL is their implicit
+  // default), so `ALTER TABLE ADD COLUMN … BIGINT` heals cleanly onto a populated
+  // legacy table: existing rows read back NULL = "token data absent" (a-AC-4).
+  { name: "input_tokens", sql: "BIGINT" },
+  { name: "output_tokens", sql: "BIGINT" },
+  { name: "cache_read_input_tokens", sql: "BIGINT" },
+  { name: "cache_creation_input_tokens", sql: "BIGINT" },
+  // The capture-source discriminant (a-AC-7): every Claude-Code row carries
+  // `source_tool = 'claude-code'`, so 060b/060e can render a "Claude Code only"
+  // partial state. NOT NULL DEFAULT '' (a discriminant always present; '' = unknown
+  // source) — heal-safe on a populated table because the empty string backfills.
+  { name: "source_tool", sql: "TEXT NOT NULL DEFAULT ''" },
   { name: "creation_date", sql: "TEXT NOT NULL DEFAULT ''" },
   { name: "last_update_date", sql: "TEXT NOT NULL DEFAULT ''" }
 ]);
@@ -25939,6 +25961,52 @@ var ROUTER_HISTORY_COLUMNS = Object.freeze([
   { name: "workspace_id", sql: "TEXT NOT NULL DEFAULT ''" },
   { name: "created_at", sql: "TEXT NOT NULL DEFAULT ''" }
 ]);
+var ROI_METRICS_COLUMNS = Object.freeze([
+  { name: "id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "session_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "org_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "workspace_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "agent_id", sql: "TEXT NOT NULL DEFAULT 'default'" },
+  { name: "project_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "team_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  // GATED: '' until a verified backend-token claim populates it (f-AC-6/f-AC-7).
+  { name: "user_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "input_tokens", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "output_tokens", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "cache_read_tokens", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "cache_creation_tokens", sql: "BIGINT NOT NULL DEFAULT 0" },
+  // MEASURED / MODELED / GROSS / INFRA money — BIGINT integer cents, never FLOAT (f-AC-4).
+  { name: "measured_cache_savings_cents", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "modeled_savings_cents", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "modeled_assumption_ref", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "gross_cost_cents", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "infra_cost_cents", sql: "BIGINT NOT NULL DEFAULT 0" },
+  // cost_basis ∈ {measured, allocated, none}; allocation_method '' unless allocated (f-AC-5).
+  { name: "cost_basis", sql: "TEXT NOT NULL DEFAULT 'none'" },
+  { name: "allocation_method", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "price_ref", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "period_start", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "period_end", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "created_at", sql: "TEXT NOT NULL DEFAULT ''" }
+]);
+var ROI_COST_BASES = Object.freeze(["measured", "allocated", "none"]);
+var TEAMS_COLUMNS = Object.freeze([
+  { name: "id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "team_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "team_name", sql: "TEXT NOT NULL DEFAULT ''" },
+  // 'agent' rows work today; 'user' rows inert until user_id verified.
+  { name: "member_type", sql: "TEXT NOT NULL DEFAULT 'agent'" },
+  { name: "member_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "role", sql: "TEXT NOT NULL DEFAULT 'member'" },
+  { name: "active", sql: "BIGINT NOT NULL DEFAULT 1" },
+  { name: "org_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "workspace_id", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "version", sql: "BIGINT NOT NULL DEFAULT 0" },
+  { name: "created_at", sql: "TEXT NOT NULL DEFAULT ''" },
+  { name: "updated_at", sql: "TEXT NOT NULL DEFAULT ''" }
+]);
+var TEAM_MEMBER_TYPES = Object.freeze(["agent", "user"]);
+var TEAM_ACTIVE = 1;
 var TENANCY_TABLES = defineGroup([
   {
     name: "agents",
@@ -25977,6 +26045,25 @@ var TENANCY_TABLES = defineGroup([
     pattern: "append-only",
     embeddingColumns: [],
     scope: "tenant"
+  },
+  {
+    // PRD-060f (f-AC-1/f-AC-2): the shared spend ledger. APPEND-ONLY — one
+    // immutable row per session, a re-price APPENDs a new row (new price_ref),
+    // NEVER an in-place UPDATE; the canonical row is MAX(created_at) per session.
+    name: "roi_metrics",
+    columns: ROI_METRICS_COLUMNS,
+    pattern: "append-only",
+    embeddingColumns: [],
+    scope: "tenant"
+  },
+  {
+    // PRD-060f (f-AC-8): the roster. VERSION-BUMPED — one row per (team, member),
+    // an edit APPENDs version N+1, read ORDER BY version DESC (same as api_keys).
+    name: "teams",
+    columns: TEAMS_COLUMNS,
+    pattern: "version-bumped",
+    embeddingColumns: [],
+    scope: "tenant"
   }
 ]);
 function buildApiKeyLookupByIdSql(id) {
@@ -27740,8 +27827,9 @@ function createEmbedSupervisor(deps = {}) {
   const cfg = resolveConfig2(deps.config);
   const spawnChild = deps.spawnChild ?? defaultSpawnChild(env);
   const probeHealth = deps.probeHealth ?? defaultProbeHealth(env);
-  const disabled = !resolveEmbedClientOptions(env).enabled;
+  let enabled = deps.enabled ?? resolveEmbedClientOptions(env).enabled;
   let started = false;
+  let lifecycleStarted = false;
   let stopping = false;
   let child = null;
   let live = false;
@@ -27812,7 +27900,7 @@ function createEmbedSupervisor(deps = {}) {
       return;
     await spawnAndWatch();
   }
-  return {
+  const api = {
     get live() {
       return live;
     },
@@ -27820,16 +27908,17 @@ function createEmbedSupervisor(deps = {}) {
       return warm;
     },
     get disabled() {
-      return disabled;
+      return !enabled;
     },
     get restarts() {
       return restarts;
     },
     async start() {
+      lifecycleStarted = true;
       if (started)
         return;
       started = true;
-      if (disabled) {
+      if (!enabled) {
         logger.event("embed.disabled");
         return;
       }
@@ -27871,12 +27960,29 @@ function createEmbedSupervisor(deps = {}) {
       live = false;
       warm = false;
       restarts = 0;
-      if (disabled || stopping)
+      if (!enabled || stopping)
         return;
       logger.event("embed.manual_restart");
       await spawnAndWatch();
+    },
+    async setEnabled(want) {
+      enabled = want;
+      if (want) {
+        logger.event("embed.enabled");
+        if (!lifecycleStarted)
+          return;
+        if (child === null) {
+          started = false;
+          await api.start();
+        }
+      } else {
+        logger.event("embed.disabled_live");
+        if (child !== null)
+          await api.stop();
+      }
     }
   };
+  return api;
 }
 var noopEmbedSupervisor = {
   live: false,
@@ -27888,6 +27994,8 @@ var noopEmbedSupervisor = {
   stop() {
   },
   async restart() {
+  },
+  async setEnabled() {
   }
 };
 
@@ -27896,7 +28004,9 @@ function buildHealthDetail(inputs) {
   const reasons = {
     storage: inputs.status === "ok" ? "reachable" : "unreachable",
     embeddings: inputs.embeddingsEnabled ? "on" : "off",
-    schema: inputs.schemaMissingTable === true ? "missing_table" : "ok"
+    schema: inputs.schemaMissingTable === true ? "missing_table" : "ok",
+    // PRD-063b / b-AC-7: read the supplied Portkey state verbatim (no probe). Omitted → `off`.
+    portkey: inputs.portkey ?? "off"
   };
   return { status: inputs.status, reasons };
 }
@@ -27931,6 +28041,10 @@ var ROUTE_GROUPS = Object.freeze([
   { path: "/api/org", protect: true, session: false },
   { path: "/api/workspace", protect: true, session: false },
   { path: "/api/diagnostics", protect: true, session: false },
+  // The dashboard imperative-actions surface (logout / embeddings / restart / uninstall). Protected
+  // (inherits auth/RBAC) AND additionally local-mode + origin/CSRF gated inside the handlers
+  // (`dashboard/actions-api.ts`), since these are credential/process/lifecycle actions.
+  { path: "/api/actions", protect: true, session: false },
   { path: "/api/pipeline", protect: true, session: false },
   { path: "/api/repair", protect: true, session: false },
   { path: "/api/inference", protect: true, session: false },
@@ -28068,7 +28182,7 @@ function coarsePipelineStatus(storage) {
 }
 
 // dist/src/daemon/runtime/assemble.js
-import { mkdirSync as mkdirSync20, readFileSync as readFileSync22, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "node:fs";
+import { mkdirSync as mkdirSync20, mkdtempSync, readFileSync as readFileSync22, rmSync as rmSync10, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { join as join32 } from "node:path";
 
@@ -28496,7 +28610,7 @@ function buildAllowedProperties(input) {
 }
 var systemTelemetryClock = () => (/* @__PURE__ */ new Date()).toISOString();
 var DEFAULT_EMIT_TIMEOUT_MS = 2e3;
-var HONEYCOMB_VERSION2 = true ? "0.1.7" : "0.0.0-dev";
+var HONEYCOMB_VERSION2 = true ? "0.1.9" : "0.0.0-dev";
 async function emitTelemetry(event, opts, deps = {}) {
   const env = deps.env ?? process.env;
   const key = deps.posthogKey ?? POSTHOG_KEY;
@@ -28566,7 +28680,7 @@ async function postCapture(event, properties, distinctId, key, deps) {
 }
 
 // dist/src/daemon/runtime/auth/deeplake-issuer.js
-var realSleeper = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var realSleeper = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var DEEPLAKE_CLIENT_HEADER = "X-Deeplake-Client";
 var DEEPLAKE_ORG_HEADER = "X-Activeloop-Org-Id";
 var DEEPLAKE_CLIENT_VALUE = "honeycomb";
@@ -29094,7 +29208,7 @@ function resolveRequestScope(input) {
 
 // dist/src/daemon/runtime/auth/device-flow.js
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-var realSleeper2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var realSleeper2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var DEFAULT_MAX_POLLS2 = 900;
 function reporterOf(deps) {
   return deps.reporter ?? { prompt: (line) => console.log(line) };
@@ -29876,7 +29990,7 @@ function recursEnough(pairs) {
 }
 var systemGateSpawner = {
   run(spec, prompt, timeoutMs) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const child = spawn2(spec.command, [...spec.args], { shell: false, windowsHide: true });
       let stdout = "";
       let settled = false;
@@ -29900,7 +30014,7 @@ var systemGateSpawner = {
       child.on("error", (err) => finish(() => reject(err)));
       child.on("close", (code) => {
         if (code === 0)
-          finish(() => resolve6(stdout));
+          finish(() => resolve7(stdout));
         else
           finish(() => reject(new Error(`skillify gate CLI exited with code ${code ?? "null"}`)));
       });
@@ -30004,7 +30118,7 @@ function uniqueSessionIds(pairs) {
   return out;
 }
 function withTimeout(promise2, timeoutMs, message) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled)
@@ -30017,7 +30131,7 @@ function withTimeout(promise2, timeoutMs, message) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve6(v);
+      resolve7(v);
     }, (e) => {
       if (settled)
         return;
@@ -30392,7 +30506,7 @@ function buildSummaryPrompt(session, events) {
 }
 var systemSummarySpawner = {
   run(spec, prompt, timeoutMs) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const child = spawn3(spec.command, [...spec.args], {
         shell: false,
         windowsHide: true,
@@ -30428,7 +30542,7 @@ var systemSummarySpawner = {
       child.on("error", (err) => finish(() => reject(err)));
       child.on("close", (code) => {
         if (code === 0)
-          finish(() => resolve6(stdout));
+          finish(() => resolve7(stdout));
         else
           finish(() => reject(new Error(`summary gate CLI exited with code ${code ?? "null"}`)));
       });
@@ -30449,7 +30563,7 @@ function createHostSummaryGenCli(spec, spawner = systemSummarySpawner, timeoutMs
 }
 var systemSleeper = {
   sleep(ms) {
-    return new Promise((resolve6) => setTimeout(resolve6, ms));
+    return new Promise((resolve7) => setTimeout(resolve7, ms));
   }
 };
 async function runSummaryWorker(trigger, session, deps) {
@@ -31071,6 +31185,17 @@ function createSummaryJobWorker(deps) {
 
 // dist/src/daemon/runtime/capture/event-contract.js
 var nonEmpty = external_exports.string().trim().min(1);
+var tokenCount = external_exports.number().int().nonnegative();
+var TurnUsageSchema = external_exports.object({
+  /** `input_tokens` — prompt tokens billed for this turn. */
+  input: tokenCount.optional(),
+  /** `output_tokens` — completion tokens billed for this turn. */
+  output: tokenCount.optional(),
+  /** `cache_read_input_tokens` — tokens served from the prompt cache (a real 0 ≠ absent). */
+  cacheRead: tokenCount.optional(),
+  /** `cache_creation_input_tokens` — tokens written into the prompt cache. */
+  cacheCreation: tokenCount.optional()
+}).optional().transform((u) => u !== void 0 && (u.input !== void 0 || u.output !== void 0 || u.cacheRead !== void 0 || u.cacheCreation !== void 0) ? u : void 0);
 var UserMessageEventSchema = external_exports.object({
   kind: external_exports.literal("user_message"),
   text: external_exports.string()
@@ -31083,7 +31208,9 @@ var ToolCallEventSchema = external_exports.object({
 });
 var AssistantMessageEventSchema = external_exports.object({
   kind: external_exports.literal("assistant_message"),
-  text: external_exports.string()
+  text: external_exports.string(),
+  /** PRD-060a: optional per-turn token + cache counts; absent when unavailable. */
+  usage: TurnUsageSchema
 });
 var CaptureEventSchema = external_exports.discriminatedUnion("kind", [
   UserMessageEventSchema,
@@ -31503,7 +31630,7 @@ var CaptureRouteHandler = class {
    */
   buildRow(id, event, meta3, nowIso10, projectId) {
     const message = this.config.envelopeBudgetBytes > 0 ? budgetedStringify(event, meta3, this.config.envelopeBudgetBytes) : JSON.stringify({ event, metadata: meta3 });
-    return [
+    const row = [
       ["id", val.str(id)],
       ["path", val.str(meta3.path)],
       ["filename", val.str(meta3.hookEventName)],
@@ -31517,9 +31644,17 @@ var CaptureRouteHandler = class {
       ["project_id", val.str(projectId)],
       ["plugin_version", val.str(meta3.pluginVersion)],
       ["agent_id", val.str(meta3.agentId)],
+      // PRD-060a (a-AC-7): the capture-source discriminant. `metadata.agent` is the
+      // canonical harness token the shim stamps (`claude-code` for the reference
+      // shim), so every Claude-Code-captured row carries `source_tool='claude-code'`.
+      ["source_tool", val.str(meta3.agent)],
       ["creation_date", val.str(nowIso10)],
       ["last_update_date", val.str(nowIso10)]
     ];
+    for (const [col, value] of usageColumns(event)) {
+      row.push([col, val.num(value)]);
+    }
+    return row;
   }
   /**
    * Resolve the capture row's `project_id` from the session cwd (PRD-049b 49b-AC-1 / 49b-AC-3).
@@ -31662,6 +31797,21 @@ function embedTextFor(event) {
       return [event.tool, serialize(event.input), serialize(event.response)].filter((s) => s.length > 0).join("\n");
   }
 }
+function usageColumns(event) {
+  if (event.kind !== "assistant_message" || event.usage === void 0)
+    return [];
+  const u = event.usage;
+  const cols = [];
+  if (u.input !== void 0)
+    cols.push(["input_tokens", u.input]);
+  if (u.output !== void 0)
+    cols.push(["output_tokens", u.output]);
+  if (u.cacheRead !== void 0)
+    cols.push(["cache_read_input_tokens", u.cacheRead]);
+  if (u.cacheCreation !== void 0)
+    cols.push(["cache_creation_input_tokens", u.cacheCreation]);
+  return cols;
+}
 function groupRowsByScope(batch) {
   const byKey = /* @__PURE__ */ new Map();
   for (const item of batch) {
@@ -33656,6 +33806,11 @@ async function runGraphBuild(identity, scope, options) {
     push: push.kind
   };
 }
+async function buildCodebaseGraphSnapshot(scope, options) {
+  const workspaceDir = options.workspaceDir ?? process.cwd();
+  const identity = options.identity ?? resolveSnapshotIdentity(workspaceDir, scope);
+  return runGraphBuild(identity, scope, options);
+}
 function mountGraphApi(daemon, options) {
   const group = daemon.group(GRAPH_GROUP);
   if (group === void 0)
@@ -35259,6 +35414,37 @@ function mountSkillPropagationApi(daemon, options) {
   }
 }
 
+// dist/src/dashboard/contracts.js
+var EMPTY_DASHBOARD_DATA = Object.freeze({
+  kpis: { memoryCount: 0, sessionCount: 0, turnCount: 0, estimatedSavings: 0, teamSkillCount: 0 },
+  sessions: { sessions: [] },
+  settings: { orgId: "", orgName: "", workspace: "", settings: {} },
+  graph: { built: false, nodes: [], edges: [] },
+  rules: { rules: [] },
+  skillSync: { skills: [] }
+});
+var EMPTY_ROI_VIEW = Object.freeze({
+  savings: {
+    status: "absent",
+    measuredCents: 0,
+    modeledCents: 0,
+    assumption: { kind: "", assumptionText: "", signedOff: false },
+    blendedCentsPerMtok: null
+  },
+  infra: { status: "absent", cents: 0, costBasis: "none" },
+  pollination: { status: "absent", cents: 0, lines: [] },
+  net: { status: "absent", computed: false, netCents: 0, modeled: true, costBasis: "none" },
+  rollups: [],
+  perUserAvailable: false,
+  scopedAcrossDevices: false,
+  ratesAsOf: ""
+});
+var EMPTY_ROI_TREND = Object.freeze({
+  status: "absent",
+  series: [],
+  startedAt: ""
+});
+
 // dist/src/daemon/runtime/dashboard/installed-assets.js
 import { homedir as homedir11 } from "node:os";
 import { join as join16 } from "node:path";
@@ -35417,6 +35603,548 @@ function sanitizeName(name) {
   return name.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 
+// dist/src/daemon/runtime/dashboard/roi-rates.js
+var ANTHROPIC_CACHE_READ_MULTIPLIER = 0.1;
+var ANTHROPIC_CACHE_WRITE_MULTIPLIER = 1.25;
+function anthropicCacheRate(inputCentsPerMtok, multiplier) {
+  return Math.round(inputCentsPerMtok * multiplier);
+}
+var RATES_AS_OF = "2026-06-26";
+var RATE_TABLE = Object.freeze([
+  Object.freeze({
+    provider: "anthropic",
+    model: "claude-sonnet-4-6",
+    input_cents_per_mtok: 300,
+    output_cents_per_mtok: 1500,
+    cache_read_cents_per_mtok: anthropicCacheRate(300, ANTHROPIC_CACHE_READ_MULTIPLIER),
+    cache_write_cents_per_mtok: anthropicCacheRate(300, ANTHROPIC_CACHE_WRITE_MULTIPLIER)
+  }),
+  Object.freeze({
+    provider: "anthropic",
+    model: "claude-opus-4-8",
+    input_cents_per_mtok: 1500,
+    output_cents_per_mtok: 7500,
+    cache_read_cents_per_mtok: anthropicCacheRate(1500, ANTHROPIC_CACHE_READ_MULTIPLIER),
+    cache_write_cents_per_mtok: anthropicCacheRate(1500, ANTHROPIC_CACHE_WRITE_MULTIPLIER)
+  }),
+  // Finding (haiku-rate): the skillify gate runs `claude-haiku-4-5` (roi-pollination.ts
+  // SKILLIFY_HAIKU_MODEL). Without its own row, `priceHaikuTokens` fell back to the Sonnet default and
+  // MIS-priced Honeycomb's own-inference cost. Anthropic Haiku per-Mtok: $1 in / $5 out; the cache
+  // columns are derived from input via the SAME 0.1x / 1.25x multipliers (the invariant a test asserts).
+  Object.freeze({
+    provider: "anthropic",
+    model: "claude-haiku-4-5",
+    input_cents_per_mtok: 100,
+    output_cents_per_mtok: 500,
+    cache_read_cents_per_mtok: anthropicCacheRate(100, ANTHROPIC_CACHE_READ_MULTIPLIER),
+    cache_write_cents_per_mtok: anthropicCacheRate(100, ANTHROPIC_CACHE_WRITE_MULTIPLIER)
+  })
+]);
+var DEFAULT_RATE_PROVIDER = "anthropic";
+var DEFAULT_RATE_MODEL = "claude-sonnet-4-6";
+function rateRowFor(provider, model) {
+  return RATE_TABLE.find((r) => r.provider === provider && r.model === model);
+}
+function defaultRateRow() {
+  const row = rateRowFor(DEFAULT_RATE_PROVIDER, DEFAULT_RATE_MODEL);
+  if (row === void 0) {
+    throw new Error("roi-rates: the default rate row must exist in RATE_TABLE");
+  }
+  return row;
+}
+function resolveRate(provider, model) {
+  if (provider === void 0 || model === void 0 || provider.length === 0 || model.length === 0) {
+    return defaultRateRow();
+  }
+  return rateRowFor(provider, model) ?? defaultRateRow();
+}
+
+// dist/src/daemon/runtime/dashboard/roi-savings.js
+function measured(value) {
+  return { tag: "measured", value };
+}
+function modeled(value, assumption) {
+  return { tag: "modeled", value, assumption };
+}
+function tokensAtRate(tokens, centsPerMtok) {
+  return Math.round(tokens * centsPerMtok / 1e6);
+}
+function measuredCacheSavings(turns) {
+  let savingsCents = 0;
+  let measuredTurns = 0;
+  for (const turn of turns) {
+    if (turn.cache_read_input_tokens === null)
+      continue;
+    measuredTurns += 1;
+    const rate = resolveRate(turn.provider, turn.model);
+    const deltaCentsPerMtok = rate.input_cents_per_mtok - rate.cache_read_cents_per_mtok;
+    savingsCents += tokensAtRate(turn.cache_read_input_tokens, deltaCentsPerMtok);
+  }
+  const totalTurns = turns.length;
+  const status = totalTurns === 0 || measuredTurns === 0 ? "absent" : measuredTurns < totalTurns ? "partial" : "measured";
+  return measured({ savingsCents, measuredTurns, totalTurns, status });
+}
+function blendedCentsPerMtok(turns) {
+  let totalCents = 0;
+  let totalTokens = 0;
+  for (const turn of turns) {
+    const rate = resolveRate(turn.provider, turn.model);
+    if (turn.input_tokens !== null) {
+      totalCents += tokensAtRate(turn.input_tokens, rate.input_cents_per_mtok);
+      totalTokens += turn.input_tokens;
+    }
+    if (turn.output_tokens !== null) {
+      totalCents += tokensAtRate(turn.output_tokens, rate.output_cents_per_mtok);
+      totalTokens += turn.output_tokens;
+    }
+    if (turn.cache_read_input_tokens !== null) {
+      totalCents += tokensAtRate(turn.cache_read_input_tokens, rate.cache_read_cents_per_mtok);
+      totalTokens += turn.cache_read_input_tokens;
+    }
+    if (turn.cache_creation_input_tokens !== null) {
+      totalCents += tokensAtRate(turn.cache_creation_input_tokens, rate.cache_write_cents_per_mtok);
+      totalTokens += turn.cache_creation_input_tokens;
+    }
+  }
+  if (totalTokens === 0)
+    return null;
+  return Math.round(totalCents / totalTokens * 1e6);
+}
+var MEMORY_INJECTION_ASSUMPTION = Object.freeze({
+  kind: "turns-saved-per-session",
+  turnsSavedPerSession: 2,
+  avgTokensPerSavedTurn: 4e3,
+  includesOutputTokens: false,
+  signedOff: false,
+  assumptionText: "PLACEHOLDER (pending operator sign-off): estimates that injecting memory saves ~2 turns of re-explaining per session, at ~4,000 input tokens per saved turn, priced at the session's input rate. Output-token savings are NOT yet claimed. This is a model, not a billed figure."
+});
+function modeledMemoryInjectionSavings(sessions, rate = resolveRate(void 0, void 0), assumption = MEMORY_INJECTION_ASSUMPTION) {
+  const savedTokens = Math.max(0, sessions) * assumption.turnsSavedPerSession * assumption.avgTokensPerSavedTurn;
+  let estimatedCents = tokensAtRate(savedTokens, rate.input_cents_per_mtok);
+  if (assumption.includesOutputTokens) {
+    estimatedCents += tokensAtRate(savedTokens, rate.output_cents_per_mtok);
+  }
+  return modeled({ estimatedCents, sessions: Math.max(0, sessions) }, assumption);
+}
+
+// dist/src/daemon/runtime/dashboard/roi-billing.js
+var realSleeper3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var systemBillingClock = {
+  now() {
+    return Date.now();
+  }
+};
+var DEFAULT_MAX_RETRIES2 = 3;
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_TTL_MS2 = 5 * 6e4;
+var DEEPLAKE_CLIENT_HEADER2 = "X-Deeplake-Client";
+var DEEPLAKE_ORG_HEADER2 = "X-Activeloop-Org-Id";
+var DEEPLAKE_CLIENT_VALUE2 = "honeycomb";
+var centsField = external_exports.number().int().catch(0);
+var numberField = external_exports.number().catch(0);
+var ComputeTierSchema = external_exports.object({
+  tier: external_exports.string().catch(""),
+  hours: numberField,
+  cost_cents: centsField,
+  unit_price_cents: centsField
+});
+var BillingComparisonSchema = external_exports.object({
+  compute_cost_previous: centsField,
+  total_cost_previous: centsField,
+  delta_pct: numberField
+});
+var BillingComputeSchema = external_exports.object({
+  total_cost_cents: centsField,
+  total_pod_hours: numberField,
+  by_tier: external_exports.array(ComputeTierSchema).catch([])
+});
+var BillingSummarySchema = external_exports.object({
+  balance_cents: centsField,
+  period_start: external_exports.string().catch(""),
+  period_end: external_exports.string().catch(""),
+  total_cost_cents: centsField,
+  storage_cost_cents: centsField,
+  transfer_cost_cents: centsField,
+  projected_end_of_period_cents: centsField,
+  compute: BillingComputeSchema,
+  comparison: BillingComparisonSchema
+});
+var SESSION_TYPES = ["query", "embedding", "ingestion"];
+var SessionTypeSchema = external_exports.enum(SESSION_TYPES);
+var ComputeSessionSchema = external_exports.object({
+  session_type: SessionTypeSchema,
+  gpu_hours: numberField,
+  gpu_units: numberField,
+  price_cents_per_gpu_hour: centsField,
+  // Finding (billing-zero): keep `total_cost_cents` OPTIONAL/nullish so a MISSING field (absent on the
+  // wire) stays `undefined` and is distinguishable from a legitimate explicit `0` (a free session). The
+  // `.catch(undefined)` keeps a present-but-malformed value from throwing while NOT collapsing it to 0
+  // -- `buildSessionTypeBreakdown` derives a cost ONLY when the field is truly absent, never over an
+  // explicit 0 (which would overwrite a legitimately-free session with gpu_hours x price).
+  total_cost_cents: centsField.optional().nullable().catch(void 0)
+});
+var ComputeUsageSchema = external_exports.object({
+  total_cost_cents: centsField,
+  total_gpu_hours: numberField,
+  sessions: external_exports.array(ComputeSessionSchema).catch([])
+});
+function sessionTypeTotalCents(lines) {
+  return lines.reduce((sum, line) => sum + line.cost_cents, 0);
+}
+function isRetryable2(status) {
+  return status === 429 || status >= 500 && status <= 599;
+}
+function billingHeaders(creds) {
+  const headers = {
+    Authorization: `Bearer ${creds.token}`,
+    "Content-Type": "application/json",
+    [DEEPLAKE_CLIENT_HEADER2]: DEEPLAKE_CLIENT_VALUE2
+  };
+  if (creds.orgId.length > 0)
+    headers[DEEPLAKE_ORG_HEADER2] = creds.orgId;
+  return headers;
+}
+function resolveBillingApiUrl(creds) {
+  const base = creds.apiUrl !== void 0 && creds.apiUrl.length > 0 ? creds.apiUrl : DEFAULT_DEEPLAKE_API_URL;
+  return base.replace(/\/+$/, "");
+}
+function buildSessionTypeBreakdown(usage) {
+  return usage.sessions.map((s) => {
+    const derived = Math.round(s.gpu_hours * s.price_cents_per_gpu_hour);
+    const cost_cents = s.total_cost_cents !== void 0 && s.total_cost_cents !== null ? s.total_cost_cents : derived;
+    return {
+      session_type: s.session_type,
+      gpu_hours: s.gpu_hours,
+      price_cents_per_gpu_hour: s.price_cents_per_gpu_hour,
+      cost_cents
+    };
+  });
+}
+function createInfraCostReadModel(options = {}) {
+  const doFetch = options.fetch ?? globalThis.fetch;
+  const sleep2 = options.sleep ?? realSleeper3;
+  const clock = options.clock ?? systemBillingClock;
+  const dir = options.dir;
+  const loadCreds = options.creds ?? (() => loadDiskCredentials(dir));
+  const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES2;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS2;
+  let cached3;
+  async function getJson(apiUrl, path4, headers) {
+    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+      try {
+        const resp = await doFetch(`${apiUrl}${path4}`, { method: "GET", headers, signal: controller.signal });
+        if (resp.ok) {
+          return await resp.json().catch(() => null);
+        }
+        if (isRetryable2(resp.status) && attempt < maxRetries) {
+          clearTimeout(timer);
+          await sleep2(250 * 2 ** attempt);
+          continue;
+        }
+        return null;
+      } catch {
+        if (attempt < maxRetries) {
+          clearTimeout(timer);
+          await sleep2(250 * 2 ** attempt);
+          continue;
+        }
+        return null;
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+    return null;
+  }
+  function parseOrMissing(raw2, schema) {
+    if (raw2 === null || raw2 === void 0)
+      return void 0;
+    const result = schema.safeParse(raw2);
+    return result.success ? result.data : void 0;
+  }
+  async function fetchSnapshot() {
+    const creds = loadCreds();
+    if (creds === null || creds.token.length === 0) {
+      return { status: "unauthenticated", missing: [], sessionTypes: [], fetchedAt: clock.now() };
+    }
+    const apiUrl = resolveBillingApiUrl(creds);
+    const headers = billingHeaders(creds);
+    const [summaryRaw, computeRaw] = await Promise.all([
+      getJson(apiUrl, "/billing/summary", headers),
+      getJson(apiUrl, "/billing/usage/compute", headers)
+    ]);
+    const summary = parseOrMissing(summaryRaw, BillingSummarySchema);
+    const compute = parseOrMissing(computeRaw, ComputeUsageSchema);
+    const missing = [];
+    if (summary === void 0)
+      missing.push("/billing/summary");
+    if (compute === void 0)
+      missing.push("/billing/usage/compute");
+    const okCount = (summary !== void 0 ? 1 : 0) + (compute !== void 0 ? 1 : 0);
+    const status = okCount === 0 ? "unreachable" : okCount === 2 ? "ok" : "partial";
+    const sessionTypes = compute !== void 0 ? buildSessionTypeBreakdown(compute) : [];
+    return {
+      status,
+      missing,
+      ...summary !== void 0 ? { summary } : {},
+      ...compute !== void 0 ? { compute } : {},
+      sessionTypes,
+      fetchedAt: clock.now()
+    };
+  }
+  return {
+    async read() {
+      const now = clock.now();
+      if (cached3 !== void 0 && now - cached3.fetchedAt < ttlMs) {
+        return cached3;
+      }
+      const snapshot = await fetchSnapshot();
+      cached3 = snapshot;
+      return snapshot;
+    },
+    invalidate() {
+      cached3 = void 0;
+    }
+  };
+}
+
+// dist/src/daemon/runtime/dashboard/roi-pollination.js
+var SKILLIFY_PROVIDER = "anthropic";
+var SKILLIFY_HAIKU_MODEL = "claude-haiku-4-5";
+function tokensAtRate2(tokens, centsPerMtok) {
+  return Math.round(tokens * centsPerMtok / 1e6);
+}
+function priceHaikuTokens(snapshot) {
+  if (snapshot.perModel !== void 0 && snapshot.perModel.length > 0) {
+    return snapshot.perModel.reduce((sum, b) => sum + priceBucket(b), 0);
+  }
+  const rate = resolveRate(SKILLIFY_PROVIDER, snapshot.model ?? SKILLIFY_HAIKU_MODEL);
+  return tokensAtRate2(snapshot.inputTokens, rate.input_cents_per_mtok) + tokensAtRate2(snapshot.outputTokens, rate.output_cents_per_mtok) + tokensAtRate2(snapshot.cacheReadInputTokens, rate.cache_read_cents_per_mtok) + tokensAtRate2(snapshot.cacheCreationInputTokens, rate.cache_write_cents_per_mtok);
+}
+function priceBucket(b) {
+  const rate = resolveRate(SKILLIFY_PROVIDER, b.model.length > 0 ? b.model : SKILLIFY_HAIKU_MODEL);
+  return tokensAtRate2(b.inputTokens, rate.input_cents_per_mtok) + tokensAtRate2(b.outputTokens, rate.output_cents_per_mtok) + tokensAtRate2(b.cacheReadInputTokens, rate.cache_read_cents_per_mtok) + tokensAtRate2(b.cacheCreationInputTokens, rate.cache_write_cents_per_mtok);
+}
+function composeHaikuContribution(snapshot) {
+  const buckets = snapshot.perModel;
+  const model = buckets !== void 0 && buckets.length > 1 ? "mixed" : buckets !== void 0 && buckets.length === 1 ? buckets[0].model : snapshot.model ?? SKILLIFY_HAIKU_MODEL;
+  if (snapshot.recorded === 0) {
+    return {
+      status: "absent",
+      cents: 0,
+      recorded: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      cacheReadInputTokens: 0,
+      cacheCreationInputTokens: 0,
+      model
+    };
+  }
+  return {
+    status: "measured",
+    cents: priceHaikuTokens(snapshot),
+    recorded: snapshot.recorded,
+    inputTokens: snapshot.inputTokens,
+    outputTokens: snapshot.outputTokens,
+    cacheReadInputTokens: snapshot.cacheReadInputTokens,
+    cacheCreationInputTokens: snapshot.cacheCreationInputTokens,
+    model
+  };
+}
+function emptyPerType() {
+  return { query: 0, embedding: 0, ingestion: 0 };
+}
+function composeDeeplakeContribution(infra) {
+  const perTypeCents = emptyPerType();
+  for (const line of infra.sessionTypes) {
+    perTypeCents[line.session_type] += line.cost_cents;
+  }
+  return {
+    status: infra.status,
+    cents: sessionTypeTotalCents(infra.sessionTypes),
+    bySessionType: infra.sessionTypes,
+    perTypeCents
+  };
+}
+var STATUS_SEVERITY = Object.freeze({
+  unauthenticated: 0,
+  // worst — no credentials, no figure.
+  unreachable: 1,
+  // billing could not be read.
+  absent: 2,
+  // Haiku has no data yet.
+  partial: 3,
+  // billing partially read.
+  measured: 4,
+  // Haiku ok (a real token figure).
+  ok: 5
+  // best — billing fully read.
+});
+function worstPollinationStatus(haiku, deeplake) {
+  if (haiku === "measured" && deeplake === "ok")
+    return "ok";
+  const haikuStatus = haiku;
+  const deeplakeStatus = deeplake;
+  return STATUS_SEVERITY[haikuStatus] <= STATUS_SEVERITY[deeplakeStatus] ? haikuStatus : deeplakeStatus;
+}
+function composePollinationCost(usage, infra) {
+  const haiku = composeHaikuContribution(usage.snapshot());
+  const deeplake = composeDeeplakeContribution(infra);
+  return {
+    pollinationCents: haiku.cents + deeplake.cents,
+    status: worstPollinationStatus(haiku.status, deeplake.status),
+    haiku,
+    deeplake
+  };
+}
+
+// dist/src/daemon/runtime/dashboard/roi-skillify-meter.js
+function emptySnapshot() {
+  return {
+    recorded: 0,
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheReadInputTokens: 0,
+    cacheCreationInputTokens: 0
+  };
+}
+function snapshotSource(snapshot) {
+  return { snapshot: () => snapshot };
+}
+var emptyUsageSource = snapshotSource(emptySnapshot());
+
+// dist/src/daemon/runtime/recall/scope-clause.js
+var PROJECT_ID_COLUMN = "project_id";
+var PROJECT_ID_UNSET = "";
+var CROSS_PROJECT_ADMITTED = Object.freeze(["user", "workspace"]);
+var SCOPE_READ_POLICIES = Object.freeze(["isolated", "shared", "group"]);
+function asReadPolicy(raw2) {
+  return SCOPE_READ_POLICIES.includes(raw2) ? raw2 : null;
+}
+function buildProjectScopeClause(input) {
+  const projectColumn = input.projectColumn ?? PROJECT_ID_COLUMN;
+  const rawId = input.projectId ?? "";
+  const isInbox = rawId.trim() === "" || rawId === UNSORTED_PROJECT_ID;
+  const bound = input.bound ?? !isInbox;
+  const col = sqlIdent(projectColumn);
+  const primaryId = bound ? rawId : UNSORTED_PROJECT_ID;
+  const admitted = primaryId === PROJECT_ID_UNSET ? [PROJECT_ID_UNSET] : [primaryId, PROJECT_ID_UNSET];
+  const disjuncts = admitted.map((id) => `${col} = ${sLiteral(id)}`);
+  const values = [...admitted];
+  if (input.promotionColumn !== void 0 && input.promotionColumn !== "") {
+    const promoCol = sqlIdent(input.promotionColumn);
+    for (const reach of CROSS_PROJECT_ADMITTED) {
+      disjuncts.push(`${promoCol} = ${sLiteral(reach)}`);
+      values.push(reach);
+    }
+  }
+  const sql = `(${disjuncts.join(" OR ")})`;
+  return { sql, values, bound };
+}
+function buildProjectScopeConjunct(input) {
+  return ` AND ${buildProjectScopeClause(input).sql}`;
+}
+
+// dist/src/daemon/runtime/dashboard/roi-ledger.js
+var BACKEND_TOKEN_SOURCE = "backend-token";
+function resolveGatedUserId(verifiedClaim) {
+  if (verifiedClaim !== void 0 && verifiedClaim.source === BACKEND_TOKEN_SOURCE) {
+    return verifiedClaim.userId;
+  }
+  return "";
+}
+async function resolveTeamId(client, scope, agentId) {
+  const tbl = sqlIdent("teams");
+  const memberType = sqlIdent("member_type");
+  const memberId = sqlIdent("member_id");
+  const activeCol = sqlIdent("active");
+  const versionCol = sqlIdent("version");
+  const sql = `SELECT team_id FROM "${tbl}" AS t WHERE ${memberType} = ${sLiteral("agent")} AND ${memberId} = ${sLiteral(agentId)} AND ${activeCol} = ${TEAM_ACTIVE} AND ${versionCol} = (SELECT MAX(${versionCol}) FROM "${tbl}" AS u WHERE u.${memberType} = ${sLiteral("agent")} AND u.${memberId} = ${sLiteral(agentId)}) LIMIT 1`;
+  let res;
+  try {
+    res = await client.query(sql, scope);
+  } catch {
+    return "";
+  }
+  if (!isOk(res) || res.rows.length === 0)
+    return "";
+  const raw2 = res.rows[0].team_id;
+  return typeof raw2 === "string" ? raw2 : "";
+}
+function toInt(n) {
+  if (n === void 0 || !Number.isFinite(n))
+    return 0;
+  return Math.trunc(n);
+}
+function asCostBasis(raw2) {
+  return raw2 !== void 0 && ROI_COST_BASES.includes(raw2) ? raw2 : "none";
+}
+async function appendRoiMetric(client, scope, input) {
+  const agentId = input.agentId.trim() === "" ? "default" : input.agentId;
+  const teamId = await resolveTeamId(client, scope, agentId);
+  const userId = resolveGatedUserId(input.verifiedClaim);
+  const costBasis = asCostBasis(input.costBasis);
+  const row = [
+    ["id", val.str(input.id)],
+    ["session_id", val.str(input.sessionId)],
+    ["org_id", val.str(scope.org)],
+    ["workspace_id", val.str(scope.workspace ?? "")],
+    ["agent_id", val.str(agentId)],
+    ["project_id", val.str(input.projectId ?? "")],
+    ["team_id", val.str(teamId)],
+    ["user_id", val.str(userId)],
+    ["input_tokens", val.num(toInt(input.inputTokens))],
+    ["output_tokens", val.num(toInt(input.outputTokens))],
+    ["cache_read_tokens", val.num(toInt(input.cacheReadTokens))],
+    ["cache_creation_tokens", val.num(toInt(input.cacheCreationTokens))],
+    ["measured_cache_savings_cents", val.num(toInt(input.measuredCacheSavingsCents))],
+    ["modeled_savings_cents", val.num(toInt(input.modeledSavingsCents))],
+    ["modeled_assumption_ref", val.str(input.modeledAssumptionRef ?? "")],
+    ["gross_cost_cents", val.num(toInt(input.grossCostCents))],
+    ["infra_cost_cents", val.num(toInt(input.infraCostCents))],
+    ["cost_basis", val.str(costBasis)],
+    ["allocation_method", val.str(input.allocationMethod ?? "")],
+    ["price_ref", val.str(input.priceRef ?? "")],
+    ["period_start", val.str(input.periodStart ?? "")],
+    ["period_end", val.str(input.periodEnd ?? "")],
+    ["created_at", val.str(input.createdAt)]
+  ];
+  const result = await appendOnlyInsert(client, healTargetFor("roi_metrics"), scope, row);
+  return { result, teamId, userId };
+}
+function buildRoiReadScopeSql(input, tableAlias) {
+  const agentCol = tableAlias !== void 0 ? `${sqlIdent(tableAlias)}.${sqlIdent("agent_id")}` : sqlIdent("agent_id");
+  const ownSql = `${agentCol} = ${sLiteral(input.agentId)}`;
+  const noRows = `(${sLiteral("1")} = ${sLiteral("0")})`;
+  const policy = asReadPolicy(input.readPolicy);
+  if (input.agentId.trim() === "" || policy === null || policy === "isolated") {
+    const ownClause = input.agentId.trim() === "" ? noRows : ownSql;
+    return { sql: `(${ownClause})`, policyApplied: "isolated" };
+  }
+  if (policy === "shared") {
+    return { sql: `(${sLiteral("1")} = ${sLiteral("1")})`, policyApplied: "shared" };
+  }
+  return { sql: `(${ownSql})`, policyApplied: "group" };
+}
+async function readRoiMetrics(client, scope, input) {
+  const tbl = sqlIdent("roi_metrics");
+  const { sql: scopeSql } = buildRoiReadScopeSql(input, "m");
+  const projectClause = input.projectId !== void 0 && input.projectId.trim() !== "" ? ` AND ${sqlIdent("m")}.${sqlIdent("project_id")} = ${sLiteral(input.projectId.trim())}` : "";
+  const sql = `SELECT m.* FROM "${tbl}" AS m WHERE ${scopeSql}${projectClause} AND NOT EXISTS (SELECT 1 FROM "${tbl}" AS n WHERE n.session_id = m.session_id AND (n.created_at > m.created_at OR (n.created_at = m.created_at AND n.id > m.id)))`;
+  let res;
+  try {
+    res = await client.query(sql, scope);
+  } catch (err) {
+    return { status: "shared-ledger-absent", reason: err instanceof Error ? err.message : "query threw" };
+  }
+  if (!isOk(res)) {
+    return { status: "shared-ledger-absent", reason: res.kind === "query_error" ? res.message : res.kind };
+  }
+  return { status: "ok", rows: res.rows };
+}
+
 // dist/src/daemon/runtime/dashboard/api.js
 var DASHBOARD_GROUPS = Object.freeze({
   /**
@@ -35461,7 +36189,14 @@ var DASHBOARD_GROUPS = Object.freeze({
    * READ-ONLY filesystem walk; tenancy-independent (no org header required). PRD-036b calls
    * the underlying `scanInstalledAssets` IN-PROCESS, not over this HTTP surface.
    */
-  installedAssets: "/api/diagnostics"
+  installedAssets: "/api/diagnostics",
+  /**
+   * ROI composite read-model (PRD-060e) — served off the diagnostics group at `/roi` + `/roi/trend`
+   * (full paths `/api/diagnostics/roi` + `/api/diagnostics/roi/trend`). Local-mode-only loopback like
+   * every other dashboard view-model; attached under the already-mounted, protected diagnostics group
+   * (no new group, no `server.ts` edit). The page is a PURE function of the `RoiView` this returns.
+   */
+  roi: "/api/diagnostics"
 });
 function toNum2(value) {
   const n = typeof value === "number" ? value : Number(value ?? 0);
@@ -35475,30 +36210,35 @@ async function selectRows2(storage, sql, scope) {
   return isOk(result) ? result.rows : [];
 }
 var CHARS_PER_TOKEN2 = 4;
-async function fetchKpisView(storage, scope) {
+async function fetchKpiCounts(storage, scope, projectId) {
   const memTbl = sqlIdent("memories");
   const sessTbl = sqlIdent("sessions");
-  const [memRows, sessRows, savingsRows, teamSkillRows] = await Promise.all([
-    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${memTbl}"`, scope),
-    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${sessTbl}"`, scope),
-    selectRows2(storage, buildEstimatedSavingsSql(), scope),
+  const projClause = projectWhereClause(projectId);
+  const [memRows, sessRows, teamSkillRows] = await Promise.all([
+    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${memTbl}"${projClause}`, scope),
+    selectRows2(storage, `SELECT COUNT(*) AS n FROM "${sessTbl}"${projClause}`, scope),
     selectRows2(storage, buildTeamSkillCountSql(), scope)
   ]);
   const sessionCount = toNum2(sessRows[0]?.n);
-  const estimatedSavings = Math.floor(toNum2(savingsRows[0]?.chars) / CHARS_PER_TOKEN2);
   return {
     memoryCount: toNum2(memRows[0]?.n),
     // 035a: same value, two names — `sessionCount` kept (additive), `turnCount` is what the UI reads.
     sessionCount,
     turnCount: sessionCount,
-    estimatedSavings,
     teamSkillCount: toNum2(teamSkillRows[0]?.n)
   };
 }
-function buildEstimatedSavingsSql() {
+async function fetchEstimatedSavings(storage, scope, projectId) {
+  const savingsRows = await selectRows2(storage, buildEstimatedSavingsSql(projectId), scope);
+  return Math.floor(toNum2(savingsRows[0]?.chars) / CHARS_PER_TOKEN2);
+}
+function buildEstimatedSavingsSql(projectId) {
   const tbl = sqlIdent("memories");
   const col = sqlIdent("content");
-  return `SELECT SUM(LENGTH(${col})) AS chars FROM "${tbl}"`;
+  return `SELECT SUM(LENGTH(${col})) AS chars FROM "${tbl}"${projectWhereClause(projectId)}`;
+}
+function projectWhereClause(projectId) {
+  return projectId !== void 0 && projectId !== "" ? ` WHERE ${sqlIdent("project_id")} = ${sLiteral(projectId)}` : "";
 }
 function buildTeamSkillCountSql() {
   const tbl = sqlIdent(SYNCED_ASSETS_TABLE);
@@ -35645,28 +36385,210 @@ async function fetchSkillSyncView(storage, scope, scan = scanInstalledAssets) {
   }
   return { skills: [...merged.values()] };
 }
+var DEFAULT_ROI_READ_POLICY = "shared";
+function roiSectionStatusFor(status) {
+  if (status === "measured")
+    return "ok";
+  return status;
+}
+function tokenCountOrNull(value) {
+  if (value === null || value === void 0)
+    return null;
+  const n = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(n) ? Math.trunc(n) : null;
+}
+function rowToCapturedTurn(r) {
+  const sourceTool = toStr2(r.source_tool);
+  return {
+    input_tokens: tokenCountOrNull(r.input_tokens),
+    output_tokens: tokenCountOrNull(r.output_tokens),
+    cache_read_input_tokens: tokenCountOrNull(r.cache_read_input_tokens),
+    cache_creation_input_tokens: tokenCountOrNull(r.cache_creation_input_tokens),
+    ...sourceTool !== "" ? { sourceTool } : {}
+  };
+}
+var ROI_SESSIONS_LIMIT = 5e3;
+async function readCapturedTurns(storage, scope, projectId) {
+  const tbl = sqlIdent("sessions");
+  const dateCol = sqlIdent("creation_date");
+  const idCol = sqlIdent("id");
+  const projClause = projectWhereClause(projectId);
+  const sql = `SELECT ${sqlIdent("input_tokens")}, ${sqlIdent("output_tokens")}, ${sqlIdent("cache_read_input_tokens")}, ${sqlIdent("cache_creation_input_tokens")}, ${sqlIdent("source_tool")} FROM "${tbl}"${projClause} ORDER BY ${dateCol} DESC, ${idCol} DESC LIMIT ${ROI_SESSIONS_LIMIT}`;
+  const rows = await selectRows2(storage, sql, scope);
+  return rows.map(rowToCapturedTurn);
+}
+var ROLLUP_DIMENSIONS = Object.freeze([
+  { dimension: "org", column: "org_id" },
+  { dimension: "team", column: "team_id" },
+  { dimension: "agent", column: "agent_id" },
+  { dimension: "project", column: "project_id" }
+]);
+function asCostBasisTag(raw2) {
+  const s = toStr2(raw2);
+  return s === "measured" || s === "allocated" || s === "none" ? s : "none";
+}
+function computeRollups(rows) {
+  return ROLLUP_DIMENSIONS.map(({ dimension, column }) => {
+    const groups = /* @__PURE__ */ new Map();
+    const allBases = /* @__PURE__ */ new Set();
+    for (const r of rows) {
+      const key = toStr2(r[column]);
+      const measured2 = toNum2(r.measured_cache_savings_cents);
+      const modeled2 = toNum2(r.modeled_savings_cents);
+      const infra = toNum2(r.infra_cost_cents);
+      const gross = toNum2(r.gross_cost_cents);
+      const basis = asCostBasisTag(r.cost_basis);
+      allBases.add(basis);
+      const g = groups.get(key) ?? { measured: 0, net: 0, infra: 0, sessions: 0, bases: /* @__PURE__ */ new Set() };
+      g.measured += measured2;
+      g.net += measured2 + modeled2 - (infra + gross);
+      g.infra += infra;
+      g.sessions += 1;
+      g.bases.add(basis);
+      groups.set(key, g);
+    }
+    const rollupRows = [...groups.entries()].map(([key, g]) => ({
+      key,
+      label: key,
+      measuredSavingsCents: g.measured,
+      netCents: g.net,
+      infraCostCents: g.infra,
+      // A row whose own group mixes bases is flagged `allocated` (the more-cautious tag); a single
+      // basis carries through verbatim, so a measured-only row stays `measured`.
+      costBasis: g.bases.size > 1 ? "allocated" : [...g.bases][0] ?? "none",
+      sessions: g.sessions
+    }));
+    return { dimension, rows: rollupRows, mixedBasis: allBases.size > 1 };
+  });
+}
+async function fetchRoiView(storage, scope, options = {}) {
+  const agentId = options.agentId !== void 0 && options.agentId.trim() !== "" ? options.agentId.trim() : "";
+  const readPolicy = options.readPolicy ?? DEFAULT_ROI_READ_POLICY;
+  const infraModel = options.infra ?? createInfraCostReadModel();
+  const usage = options.usage ?? emptyUsageSource;
+  const projectId = options.projectId !== void 0 && options.projectId.trim() !== "" ? options.projectId.trim() : void 0;
+  try {
+    const [turns, infra, ledger] = await Promise.all([
+      readCapturedTurns(storage, scope, projectId),
+      infraModel.read(),
+      readRoiMetrics(storage, scope, { agentId, readPolicy, ...projectId !== void 0 ? { projectId } : {} })
+    ]);
+    return assembleRoiView({ turns, infra, usage, ledger, readPolicy });
+  } catch {
+    return EMPTY_ROI_VIEW;
+  }
+}
+function assembleRoiView(input) {
+  const { turns, infra, usage, ledger, readPolicy } = input;
+  const measured2 = measuredCacheSavings(turns);
+  const modeled2 = modeledMemoryInjectionSavings(turns.length);
+  const blended = blendedCentsPerMtok(turns);
+  const captureStatus = measured2.value.status;
+  const savingsStatus = captureStatus === "measured" ? "ok" : captureStatus;
+  const savings = {
+    status: savingsStatus,
+    measuredCents: measured2.value.savingsCents,
+    modeledCents: modeled2.value.estimatedCents,
+    assumption: {
+      kind: modeled2.assumption.kind,
+      assumptionText: modeled2.assumption.assumptionText,
+      signedOff: modeled2.assumption.signedOff
+    },
+    blendedCentsPerMtok: blended
+  };
+  const infraStatus = roiSectionStatusFor(infra.status);
+  const infraCents = infra.summary !== void 0 ? infra.summary.total_cost_cents : 0;
+  const infraSection = {
+    status: infraStatus,
+    cents: infraCents,
+    // Org/workspace infra read from billing is a MEASURED fact when present; otherwise no line.
+    costBasis: infra.status === "ok" || infra.status === "partial" ? "measured" : "none"
+  };
+  const pollination = composePollinationCost(usage, infra);
+  const pollinationLines = [
+    { label: "haiku-skillify", cents: pollination.haiku.cents },
+    ...pollination.deeplake.bySessionType.map((s) => ({ label: `deeplake-${s.session_type}`, cents: s.cost_cents }))
+  ];
+  const pollinationSection = {
+    status: roiSectionStatusFor(pollination.status),
+    cents: pollination.pollinationCents,
+    lines: pollinationLines
+  };
+  const savingsPresent = savingsStatus === "ok";
+  const infraConfident = infraStatus === "ok";
+  const pollinationConfident = pollinationSection.status === "ok";
+  const netComputable = savingsPresent && infraConfident && pollinationConfident;
+  let netSection;
+  if (netComputable) {
+    const netCents = measured2.value.savingsCents + modeled2.value.estimatedCents - (infraCents + pollination.pollinationCents);
+    netSection = {
+      status: "ok",
+      computed: true,
+      netCents,
+      modeled: true,
+      // the net folds a modeled term → ALWAYS `est.` (e-AC-3 net-hero inheritance).
+      costBasis: infraSection.costBasis
+    };
+  } else {
+    const reason = !savingsPresent ? savingsStatus : !infraConfident ? infraStatus : pollinationSection.status;
+    netSection = { status: reason, computed: false, netCents: 0, modeled: true, costBasis: "none" };
+  }
+  const ledgerRows = ledger.status === "ok" ? ledger.rows : [];
+  const rollups = computeRollups(ledgerRows);
+  return {
+    savings,
+    infra: infraSection,
+    pollination: pollinationSection,
+    net: netSection,
+    rollups,
+    // PER-USER GATE (e-AC-14): there is no verified backend user-claim today, so per-user is NEVER
+    // available — the page shows the "per-user requires verified login" empty state, never a $0/name.
+    perUserAvailable: false,
+    // ACROSS-DEVICE (e-AC-12): a `shared` read returned workspace-wide rows (across devices); an
+    // `isolated` read returned only this machine's. The page captions the scope from this.
+    scopedAcrossDevices: readPolicy === "shared",
+    ratesAsOf: RATES_AS_OF
+  };
+}
+async function fetchRoiTrendView(storage, scope, _range, _options = {}) {
+  void storage;
+  void scope;
+  return EMPTY_ROI_TREND;
+}
 var NO_ORG_BODY4 = { error: "bad_request", reason: "x-honeycomb-org header is required" };
 function mountDashboardApi(daemon, options) {
   const storage = options.storage;
   const resolveScope5 = (c) => resolveScopeOrLocalDefault(c, daemon.config.mode, options.defaultScope);
   const kpis = daemon.group(DASHBOARD_GROUPS.kpis);
   if (kpis !== void 0) {
+    const countsCache = createTtlViewCache(DIAG_TTL_MS);
+    const savingsCache = createTtlViewCache(SAVINGS_TTL_MS);
     kpis.get("/kpis", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchKpisView(storage, scope));
+      const project = resolveRequestProject(c, scope);
+      const projectId = project.degraded ? void 0 : project.projectId;
+      const key = scopeCacheKey(scope, projectId);
+      const [counts, estimatedSavings] = await Promise.all([
+        countsCache(key, () => fetchKpiCounts(storage, scope, projectId)),
+        savingsCache(key, () => fetchEstimatedSavings(storage, scope, projectId))
+      ]);
+      return c.json({ ...counts, estimatedSavings });
     });
   }
   const sessions = daemon.group(DASHBOARD_GROUPS.sessions);
   if (sessions !== void 0) {
+    const sessionsCache = createTtlViewCache(DIAG_TTL_MS);
     sessions.get("/sessions", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
+      const cursorRaw = c.req.query("cursor");
       const limit = resolveSessionsLimit(c.req.query("limit"));
-      const before = decodeSessionsCursor(c.req.query("cursor"));
-      return c.json(await fetchSessionsView(storage, scope, before !== void 0 ? { limit, before } : { limit }));
+      const before = decodeSessionsCursor(cursorRaw);
+      const key = scopeCacheKey(scope, String(limit), cursorRaw);
+      return c.json(await sessionsCache(key, () => fetchSessionsView(storage, scope, before !== void 0 ? { limit, before } : { limit })));
     });
   }
   const settings = daemon.group(DASHBOARD_GROUPS.settings);
@@ -35689,20 +36611,22 @@ function mountDashboardApi(daemon, options) {
   }
   const rules = daemon.group(DASHBOARD_GROUPS.rules);
   if (rules !== void 0) {
+    const rulesCache = createTtlViewCache(DIAG_TTL_MS);
     rules.get("/rules", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchRulesView(storage, scope));
+      return c.json(await rulesCache(scopeCacheKey(scope), () => fetchRulesView(storage, scope)));
     });
   }
   const skills = daemon.group(DASHBOARD_GROUPS.skills);
   if (skills !== void 0) {
+    const skillsCache = createTtlViewCache(DIAG_TTL_MS);
     skills.get("/skills", async (c) => {
       const scope = resolveScope5(c);
       if (scope === null)
         return c.json(NO_ORG_BODY4, 400);
-      return c.json(await fetchSkillSyncView(storage, scope));
+      return c.json(await skillsCache(scopeCacheKey(scope), () => fetchSkillSyncView(storage, scope)));
     });
   }
   const installedAssets = daemon.group(DASHBOARD_GROUPS.installedAssets);
@@ -35712,6 +36636,34 @@ function mountDashboardApi(daemon, options) {
       return c.json(await inventoryCache());
     });
   }
+  const roi = daemon.group(DASHBOARD_GROUPS.roi);
+  if (roi !== void 0) {
+    const roiOptions = (c, scope) => {
+      const project = resolveRequestProject(c, scope);
+      return {
+        ...options.roiInfra !== void 0 ? { infra: options.roiInfra } : {},
+        ...options.roiUsage !== void 0 ? { usage: options.roiUsage } : {},
+        readPolicy: resolveRoiReadPolicy(c.req.query("policy")),
+        ...!project.degraded ? { projectId: project.projectId } : {}
+      };
+    };
+    roi.get("/roi", async (c) => {
+      const scope = resolveScope5(c);
+      if (scope === null)
+        return c.json(NO_ORG_BODY4, 400);
+      return c.json(await fetchRoiView(storage, scope, roiOptions(c, scope)));
+    });
+    roi.get("/roi/trend", async (c) => {
+      const scope = resolveScope5(c);
+      if (scope === null)
+        return c.json(NO_ORG_BODY4, 400);
+      const range = c.req.query("range") ?? "";
+      return c.json(await fetchRoiTrendView(storage, scope, range, roiOptions(c, scope)));
+    });
+  }
+}
+function resolveRoiReadPolicy(raw2) {
+  return raw2 === "isolated" || raw2 === "shared" || raw2 === "group" ? raw2 : DEFAULT_ROI_READ_POLICY;
 }
 var INSTALLED_ASSETS_TTL_MS = 5e3;
 function createInventoryCache() {
@@ -35725,72 +36677,601 @@ function createInventoryCache() {
     return value;
   };
 }
+var DIAG_TTL_MS = 1e4;
+var SAVINGS_TTL_MS = 6e4;
+var CACHE_MAX_KEYS = 64;
+function scopeCacheKey(scope, ...extra) {
+  return [scope.org, scope.workspace ?? "", ...extra.map((e) => e ?? "")].join("\0");
+}
+function createTtlViewCache(ttlMs) {
+  const cache = /* @__PURE__ */ new Map();
+  return async (key, compute) => {
+    const now = Date.now();
+    const hit = cache.get(key);
+    if (hit !== void 0 && now - hit.at < ttlMs)
+      return hit.value;
+    const value = await compute();
+    if (cache.size >= CACHE_MAX_KEYS && !cache.has(key))
+      cache.clear();
+    cache.set(key, { value, at: now });
+    return value;
+  };
+}
 
-// dist/src/hooks/shared/contracts.js
-var LOGICAL_EVENTS = [
-  "session-start",
-  "user_message",
-  "pre-tool-use",
-  "tool_call",
-  "assistant_message",
-  "session-end"
-];
-var HookSessionMetaSchema = external_exports.object({
-  sessionId: external_exports.string().trim().min(1),
-  path: external_exports.string().optional(),
-  cwd: external_exports.string().optional(),
-  permissionMode: external_exports.string().optional(),
-  hookEventName: external_exports.string().optional(),
-  agentId: external_exports.string().optional(),
-  agent: external_exports.string().optional()
-});
-var HookInputSchema = external_exports.object({
-  event: external_exports.enum(LOGICAL_EVENTS),
-  meta: HookSessionMetaSchema,
-  data: external_exports.unknown().optional(),
-  messageEmbedding: external_exports.array(external_exports.number()).optional(),
-  runtimePath: external_exports.enum(["plugin", "legacy"])
-});
+// dist/src/daemon/runtime/dashboard/actions-api.js
+import { spawn as spawn4 } from "node:child_process";
+import { rmSync as rmSync5 } from "node:fs";
+import { dirname as dirname12, resolve as resolve5 } from "node:path";
 
-// dist/src/daemon-client/vfs/classify.js
-var GOAL_STATUS_TOKENS = ["opened", "in_progress", "closed"];
-var GOAL_STATUS_SET = new Set(GOAL_STATUS_TOKENS);
-function toMountRelative(path4) {
-  const trimmed = path4.replace(/^\/+/, "");
-  const marker = "/memory/";
-  const last = trimmed.lastIndexOf(marker);
-  if (last >= 0)
-    return trimmed.slice(last + marker.length);
-  if (trimmed.startsWith("memory/"))
-    return trimmed.slice("memory/".length);
-  return trimmed;
+// dist/src/daemon/runtime/secrets/api.js
+function localDefaultScopeResolver(mode, defaultScope) {
+  return {
+    resolve(c) {
+      const fromHeader = headerScopeResolver.resolve(c);
+      if (fromHeader !== null)
+        return fromHeader;
+      if (mode === "local" && defaultScope !== void 0) {
+        return { org: defaultScope.org, workspace: defaultScope.workspace ?? "default" };
+      }
+      return null;
+    }
+  };
 }
-function segmentsOf(rel) {
-  return rel.split("/").filter((s) => s !== "");
+var headerScopeResolver = {
+  resolve(c) {
+    const org = c.req.header("x-honeycomb-org");
+    if (org === void 0 || org.length === 0)
+      return null;
+    const workspace = c.req.header("x-honeycomb-workspace");
+    const agentId = c.req.header("x-honeycomb-agent");
+    const ws = workspace !== void 0 && workspace.length > 0 ? workspace : "default";
+    return agentId !== void 0 && agentId.length > 0 ? { org, workspace: ws, agentId } : { org, workspace: ws };
+  }
+};
+function mountSecretsApi(group, deps) {
+  const scope = deps.scope ?? headerScopeResolver;
+  const store = deps.store;
+  const runner = deps.execRunner;
+  if (runner !== void 0) {
+    group.post("/exec", async (c) => {
+      const sc = scope.resolve(c);
+      if (sc === null)
+        return badTenancy(c);
+      const request = await readExecRequest(c, sc);
+      if (request === null) {
+        return c.json({ error: "bad_request", reason: "exec body must carry a command" }, 400);
+      }
+      const res = runner.submit(request);
+      if (!res.ok) {
+        if (res.reason === "queue_full") {
+          return c.json({ error: "queue_full", reason: "exec pool and queue are at capacity" }, 429);
+        }
+        return c.json({ error: "bad_request", reason: "invalid exec request" }, 400);
+      }
+      return c.json({ ok: true, jobId: res.jobId, status: "queued" }, 202);
+    });
+    group.get("/exec/:jobId", (c) => {
+      const sc = scope.resolve(c);
+      if (sc === null)
+        return badTenancy(c);
+      const jobId = c.req.param("jobId");
+      const view = runner.getStatus(jobId, sc);
+      if (view === null) {
+        return c.json({ error: "not_found", reason: "no such exec job" }, 404);
+      }
+      return c.json(view);
+    });
+    group.all("/bitwarden/*", (c) => c.json({ error: "use_exec", reason: "reference a Bitwarden item via exec vaultRefs; values are never returned" }, 400));
+    group.all("/1password/*", (c) => c.json({ error: "use_exec", reason: "reference a 1Password item via exec vaultRefs; values are never returned" }, 400));
+  } else {
+    group.post("/exec", (c) => notImplementedRoute(c, "POST /api/secrets/exec (secret_exec)"));
+    group.get("/exec/:jobId", (c) => notImplementedRoute(c, "GET /api/secrets/exec/:jobId (exec status)"));
+    group.all("/bitwarden/*", (c) => notImplementedRoute(c, "Bitwarden vault provider"));
+    group.all("/1password/*", (c) => notImplementedRoute(c, "1Password vault provider"));
+  }
+  group.get("/", (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const names = store.listSecretNames(sc);
+    return c.json({ names });
+  });
+  group.post("/:name", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const name = c.req.param("name");
+    const value = await readValue(c);
+    if (value === null) {
+      return c.json({ error: "bad_request", reason: "request body must carry a string value" }, 400);
+    }
+    const res = await store.setSecret(name, value, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_name") {
+        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
+      }
+      return c.json({ error: "store_failed", reason: "could not store the secret" }, 502);
+    }
+    return c.json({ ok: true, name }, 201);
+  });
+  group.delete("/:name", (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy(c);
+    const name = c.req.param("name");
+    const res = store.deleteSecret(name, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_name") {
+        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
+      }
+      if (res.reason === "not_found") {
+        return c.json({ error: "not_found", reason: "no such secret" }, 404);
+      }
+      return c.json({ error: "delete_failed", reason: "could not delete the secret" }, 502);
+    }
+    return c.json({ ok: true, name });
+  });
 }
-function isGoalShape(segs) {
-  if (segs.length !== 4)
+function badTenancy(c) {
+  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
+}
+async function readValue(c) {
+  const contentType = c.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    try {
+      const body = await c.req.json();
+      if (typeof body === "object" && body !== null) {
+        const v = body.value;
+        if (typeof v === "string" && v.length > 0)
+          return v;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  const text = await c.req.text();
+  return text.length > 0 ? text : null;
+}
+function notImplementedRoute(c, what) {
+  return c.json({ error: "not_implemented", reason: `${what} is implemented in PRD-012b` }, 501);
+}
+async function readExecRequest(c, scope) {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return null;
+  }
+  if (typeof body !== "object" || body === null)
+    return null;
+  const b = body;
+  const command = b.command;
+  if (typeof command !== "string" || command.length === 0)
+    return null;
+  const args = Array.isArray(b.args) ? b.args.filter((a) => typeof a === "string") : [];
+  const secretNames = Array.isArray(b.secretNames) ? b.secretNames.filter((n) => typeof n === "string") : [];
+  const vaultRefs = {};
+  if (typeof b.vaultRefs === "object" && b.vaultRefs !== null) {
+    for (const [k, v] of Object.entries(b.vaultRefs)) {
+      if (typeof v === "string")
+        vaultRefs[k] = v;
+    }
+  }
+  const timeoutMs = typeof b.timeoutMs === "number" ? b.timeoutMs : void 0;
+  return { command, args, secretNames, vaultRefs, scope, timeoutMs };
+}
+
+// dist/src/daemon/runtime/vault/catalog.js
+var PROVIDER_CATALOG = Object.freeze([
+  Object.freeze({
+    id: "anthropic",
+    label: "Anthropic",
+    models: Object.freeze(["claude-sonnet-4-6", "claude-opus-4-8"]),
+    openEnded: false
+  }),
+  Object.freeze({
+    id: "openai",
+    label: "OpenAI",
+    models: Object.freeze(["gpt-4o", "gpt-4o-mini", "gpt-4.1"]),
+    openEnded: false
+  }),
+  Object.freeze({
+    id: "openrouter",
+    label: "OpenRouter",
+    // Suggestions only — OpenRouter accepts a free-form `vendor/model` id (passthrough).
+    models: Object.freeze(["anthropic/claude-sonnet-4.6", "openai/gpt-4o"]),
+    openEnded: true
+  }),
+  Object.freeze({
+    // PRD-063a: Portkey is a GATEWAY, not a model vendor — its `portkey.config` id is
+    // free-form (a config or virtual-key id copied from the Portkey dashboard), so it is
+    // `openEnded: true` like OpenRouter and carries NO curated model list of its own.
+    id: "portkey",
+    label: "Portkey",
+    models: Object.freeze([]),
+    openEnded: true
+  })
+]);
+function providerEntry(provider) {
+  return PROVIDER_CATALOG.find((p) => p.id === provider);
+}
+function isValidProviderModel(provider, model) {
+  const entry = providerEntry(provider);
+  if (entry === void 0)
     return false;
-  const [head, owner, status, file2] = segs;
-  if (head !== "goal")
+  if (typeof model !== "string" || model.length === 0)
     return false;
-  if (owner === "")
+  if (entry.openEnded)
+    return true;
+  return entry.models.includes(model);
+}
+function catalogView() {
+  return PROVIDER_CATALOG;
+}
+
+// dist/src/daemon/runtime/secrets/contracts.js
+import { homedir as homedir12, hostname as hostname3, userInfo } from "node:os";
+var SECRET_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var MAX_SECRET_NAME_LENGTH = 128;
+function isValidSecretName(value) {
+  if (typeof value !== "string")
     return false;
-  if (!GOAL_STATUS_SET.has(status))
+  if (value.length === 0 || value.length > MAX_SECRET_NAME_LENGTH)
     return false;
-  return isMdFileWithStem(file2);
+  if (value === "." || value === "..")
+    return false;
+  if (value.includes("/") || value.includes("\\") || value.includes("\0"))
+    return false;
+  return SECRET_NAME_PATTERN.test(value);
 }
-function isKpiShape(segs) {
-  if (segs.length !== 3)
+function asSecretName(value) {
+  return isValidSecretName(value) ? value : null;
+}
+function isSecretRecord(value) {
+  if (typeof value !== "object" || value === null)
     return false;
-  const [head, goalId, file2] = segs;
-  if (head !== "kpi")
+  const r = value;
+  if (typeof r.nonce !== "string" || typeof r.ciphertext !== "string" || typeof r.createdAt !== "string") {
     return false;
-  if (goalId === "")
+  }
+  const scope = r.scope;
+  if (typeof scope !== "object" || scope === null)
     return false;
-  return isMdFileWithStem(file2);
+  const s = scope;
+  if (typeof s.org !== "string" || typeof s.workspace !== "string")
+    return false;
+  if (s.agentId !== void 0 && typeof s.agentId !== "string")
+    return false;
+  return true;
 }
-function isMdFileWithStem(file2) {
+var MACHINE_KEY_DIR_NAME = ".honeycomb";
+var MACHINE_KEY_FILE_NAME = ".machine-key";
+function hostnameUserFallbackId() {
+  let user = "";
+  try {
+    user = userInfo().username;
+  } catch {
+    user = "";
+  }
+  return `host:${hostname3()}|user:${user}|home:${homedir12()}`;
+}
+
+// dist/src/daemon/runtime/vault/contracts.js
+function asRecordClass(value) {
+  return isValidSecretName(value) ? value : null;
+}
+
+// dist/src/daemon/runtime/vault/registry.js
+var SECRET_CLASS = "secret";
+var SETTING_CLASS = "setting";
+var SecretValueSchema = external_exports.string().min(1);
+var SettingValueSchema = external_exports.union([external_exports.string(), external_exports.number().finite(), external_exports.boolean()]);
+var SECRET_DESCRIPTOR = Object.freeze({
+  id: SECRET_CLASS,
+  posture: "internal-only",
+  schema: SecretValueSchema
+});
+var SETTING_DESCRIPTOR = Object.freeze({
+  id: SETTING_CLASS,
+  posture: "daemon-readable",
+  schema: SettingValueSchema
+});
+var VaultRegistry = class {
+  table;
+  constructor(descriptors) {
+    this.table = /* @__PURE__ */ new Map();
+    for (const d of descriptors)
+      this.table.set(d.id, d);
+  }
+  /**
+   * Register a new record class (D-7). Validates the id is traversal-proof (a class is an
+   * on-disk segment) and that the posture is one the store understands, then adds the
+   * descriptor. Re-registering an existing id REPLACES it (so a test can swap a throwaway
+   * class); registering the built-in `secret`/`setting` ids is allowed but discouraged —
+   * their posture must not be loosened. Returns the registry for chaining.
+   *
+   * Throws on an invalid (traversal-unsafe) class id — that is a programming error, not a
+   * runtime input, so it fails loud rather than silently dropping the class.
+   */
+  registerClass(descriptor) {
+    const safe = asRecordClass(descriptor.id);
+    if (safe === null) {
+      throw new Error(`vault.registerClass: invalid (traversal-unsafe) class id`);
+    }
+    this.table.set(descriptor.id, descriptor);
+    return this;
+  }
+  /** Whether a class id is registered. */
+  has(klass) {
+    return this.table.has(klass);
+  }
+  /** The registered class ids (sorted), for diagnostics — never values. */
+  classIds() {
+    return [...this.table.keys()].sort();
+  }
+  /**
+   * Resolve a class's descriptor for a WRITE, validating the value against the class
+   * schema (zod-at-boundary). Returns `unknown_class` for an unregistered class or
+   * `invalid_value` when the value fails the schema — both fail-closed (nothing is
+   * written). On success the descriptor (with the validated value available via the
+   * caller's re-parse) is returned.
+   */
+  resolveForWrite(klass, value) {
+    const descriptor = this.table.get(klass);
+    if (descriptor === void 0)
+      return { ok: false, reason: "unknown_class" };
+    const parsed = descriptor.schema.safeParse(value);
+    if (!parsed.success)
+      return { ok: false, reason: "invalid_value" };
+    return { ok: true, descriptor };
+  }
+  /**
+   * The POSTURE GATE (a-AC-2). Resolve a class's descriptor for a READ that intends to
+   * RETURN the value to a surface (the `getSetting` path). REJECTS a class whose posture
+   * is `internal-only` with `not_readable` — so a `secret` can NEVER be read back through
+   * the daemon-readable accessor. An unknown class is `unknown_class`. This is the single
+   * point where the secret-vs-setting security boundary is enforced, as data.
+   */
+  assertReadable(klass) {
+    const descriptor = this.table.get(klass);
+    if (descriptor === void 0)
+      return { ok: false, reason: "unknown_class" };
+    if (descriptor.posture !== "daemon-readable")
+      return { ok: false, reason: "not_readable" };
+    return { ok: true, descriptor };
+  }
+  /** Resolve a descriptor with no value/posture check (internal callers that already gate). */
+  descriptorOf(klass) {
+    return this.table.get(klass);
+  }
+};
+function createVaultRegistry(extra = []) {
+  return new VaultRegistry([SECRET_DESCRIPTOR, SETTING_DESCRIPTOR, ...extra]);
+}
+
+// dist/src/daemon/runtime/vault/api.js
+var SETTINGS_GROUP = "/api/settings";
+var EMBEDDINGS_ENABLED_KEY = "embeddings.enabled";
+var KNOWN_SETTING_KEYS = [
+  "activeProvider",
+  "activeModel",
+  "pollinating.enabled",
+  EMBEDDINGS_ENABLED_KEY,
+  "recallMode",
+  "portkey.enabled",
+  "portkey.config",
+  "portkey.fallbackToProvider"
+];
+var RECALL_MODES = ["keyword", "semantic", "hybrid"];
+function isValidRecallMode(value) {
+  return RECALL_MODES.includes(value);
+}
+var DASHBOARD_PREF_PREFIX = "dashboard.";
+function isKnownSettingKey(key) {
+  if (KNOWN_SETTING_KEYS.includes(key))
+    return true;
+  return key.startsWith(DASHBOARD_PREF_PREFIX) && key.length > DASHBOARD_PREF_PREFIX.length;
+}
+function mountSettingsGroup(group, deps) {
+  const scope = deps.scope ?? headerScopeResolver;
+  const store = deps.store;
+  group.get("/", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const keys = store.listSettingKeys(sc);
+    const settings = {};
+    for (const key of keys) {
+      const res = await store.getSetting(key, sc);
+      if (res.ok)
+        settings[key] = res.value;
+    }
+    return c.json({ settings, catalog: catalogView() });
+  });
+  group.get("/:key", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const key = c.req.param("key");
+    if (!isKnownSettingKey(key)) {
+      return c.json({ error: "not_found", reason: "no such setting" }, 404);
+    }
+    const res = await store.getSetting(key, sc);
+    if (!res.ok) {
+      if (res.reason === "not_found")
+        return c.json({ error: "not_found", reason: "no such setting" }, 404);
+      if (res.reason === "not_readable")
+        return c.json({ error: "not_found", reason: "no such setting" }, 404);
+      return c.json({ error: "read_failed", reason: "could not read the setting" }, 502);
+    }
+    return c.json({ key, value: res.value });
+  });
+  group.post("/:key", async (c) => {
+    const sc = scope.resolve(c);
+    if (sc === null)
+      return badTenancy2(c);
+    const key = c.req.param("key");
+    if (!isKnownSettingKey(key)) {
+      return c.json({ error: "bad_request", reason: "unknown setting key" }, 400);
+    }
+    const value = await readSettingValue(c);
+    if (value === null) {
+      return c.json({ error: "bad_request", reason: "request body must carry a scalar value" }, 400);
+    }
+    const semanticError = await validateSettingSemantics(store, sc, key, value);
+    if (semanticError !== null) {
+      return c.json({ error: "bad_request", reason: semanticError }, 400);
+    }
+    const res = await store.setSetting(key, value, sc);
+    if (!res.ok) {
+      if (res.reason === "invalid_value") {
+        return c.json({ error: "bad_request", reason: "invalid setting value" }, 400);
+      }
+      if (res.reason === "not_readable" || res.reason === "unknown_class") {
+        return c.json({ error: "bad_request", reason: "setting class is not writable" }, 400);
+      }
+      return c.json({ error: "store_failed", reason: "could not store the setting" }, 502);
+    }
+    return c.json({ ok: true, key, value }, 201);
+  });
+}
+function mountSettingsApi(daemon, deps) {
+  const group = daemon.group(SETTINGS_GROUP);
+  if (group === void 0)
+    return;
+  mountSettingsGroup(group, deps);
+}
+function badTenancy2(c) {
+  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
+}
+async function readSettingValue(c) {
+  const contentType = c.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    try {
+      const body = await c.req.json();
+      if (typeof body === "object" && body !== null) {
+        const v = body.value;
+        const parsed = SettingValueSchema.safeParse(v);
+        return parsed.success ? parsed.data : null;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  const text = await c.req.text();
+  return text.length > 0 ? text : null;
+}
+async function validateSettingSemantics(store, scope, key, value) {
+  if (key === "activeProvider") {
+    if (providerEntry(String(value)) === void 0)
+      return "unknown provider";
+    return null;
+  }
+  if (key === "activeModel") {
+    const provRes = await store.getSetting("activeProvider", scope);
+    const provider = provRes.ok ? String(provRes.value) : "";
+    if (provider.length === 0)
+      return "set activeProvider before activeModel";
+    if (!isValidProviderModel(provider, String(value)))
+      return "model not in provider catalog";
+    return null;
+  }
+  if (key === "recallMode") {
+    if (!isValidRecallMode(String(value)))
+      return "recallMode must be keyword, semantic, or hybrid";
+    return null;
+  }
+  if (key === "portkey.enabled" || key === "portkey.fallbackToProvider") {
+    if (typeof value !== "boolean")
+      return `${key} must be a boolean`;
+    return null;
+  }
+  if (key === "portkey.config") {
+    if (typeof value !== "string")
+      return "portkey.config must be a string";
+    if (/[\u0000-\u001F\u007F]/.test(value))
+      return "portkey.config must not contain control characters";
+    const enabledRes = await store.getSetting("portkey.enabled", scope);
+    const enabled = enabledRes.ok && enabledRes.value === true;
+    if (enabled && value.length === 0)
+      return "portkey.config must be non-empty when portkey.enabled is true";
+    return null;
+  }
+  return null;
+}
+
+// dist/src/daemon/runtime/dashboard/harness-detect.js
+import { existsSync as existsSync12 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
+import { join as join20 } from "node:path";
+
+// dist/src/hooks/shared/contracts.js
+var LOGICAL_EVENTS = [
+  "session-start",
+  "user_message",
+  "pre-tool-use",
+  "tool_call",
+  "assistant_message",
+  "session-end"
+];
+var HookSessionMetaSchema = external_exports.object({
+  sessionId: external_exports.string().trim().min(1),
+  path: external_exports.string().optional(),
+  cwd: external_exports.string().optional(),
+  permissionMode: external_exports.string().optional(),
+  hookEventName: external_exports.string().optional(),
+  agentId: external_exports.string().optional(),
+  agent: external_exports.string().optional()
+});
+var HookInputSchema = external_exports.object({
+  event: external_exports.enum(LOGICAL_EVENTS),
+  meta: HookSessionMetaSchema,
+  data: external_exports.unknown().optional(),
+  messageEmbedding: external_exports.array(external_exports.number()).optional(),
+  runtimePath: external_exports.enum(["plugin", "legacy"])
+});
+
+// dist/src/daemon-client/vfs/classify.js
+var GOAL_STATUS_TOKENS = ["opened", "in_progress", "closed"];
+var GOAL_STATUS_SET = new Set(GOAL_STATUS_TOKENS);
+function toMountRelative(path4) {
+  const trimmed = path4.replace(/^\/+/, "");
+  const marker = "/memory/";
+  const last = trimmed.lastIndexOf(marker);
+  if (last >= 0)
+    return trimmed.slice(last + marker.length);
+  if (trimmed.startsWith("memory/"))
+    return trimmed.slice("memory/".length);
+  return trimmed;
+}
+function segmentsOf(rel) {
+  return rel.split("/").filter((s) => s !== "");
+}
+function isGoalShape(segs) {
+  if (segs.length !== 4)
+    return false;
+  const [head, owner, status, file2] = segs;
+  if (head !== "goal")
+    return false;
+  if (owner === "")
+    return false;
+  if (!GOAL_STATUS_SET.has(status))
+    return false;
+  return isMdFileWithStem(file2);
+}
+function isKpiShape(segs) {
+  if (segs.length !== 3)
+    return false;
+  const [head, goalId, file2] = segs;
+  if (head !== "kpi")
+    return false;
+  if (goalId === "")
+    return false;
+  return isMdFileWithStem(file2);
+}
+function isMdFileWithStem(file2) {
   return file2.endsWith(".md") && file2.length > ".md".length;
 }
 function classifyPath(path4) {
@@ -35829,7 +37310,7 @@ var HEALTH_DIMENSION_WIRABLE = Object.freeze({
 
 // dist/src/notifications/state.js
 import { closeSync as closeSync3, existsSync as existsSync10, mkdirSync as mkdirSync11, openSync as openSync3, readFileSync as readFileSync13, renameSync as renameSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { join as join17 } from "node:path";
 
 // dist/src/daemon/runtime/assets/contracts.js
@@ -35853,7 +37334,7 @@ var audienceMatches = (asset, ctx) => {
 
 // dist/src/daemon-client/assets/install.js
 import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync14, renameSync as renameSync7, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir14 } from "node:os";
 import { dirname as dirname10, join as join18, resolve as resolve4 } from "node:path";
 var HARNESS_SKILL_DIRS = Object.freeze({
   claude_code: join18(".claude", "skills"),
@@ -35873,38 +37354,52 @@ var HARNESS_AGENT_DIRS = Object.freeze({
 });
 
 // dist/src/commands/contracts.js
+var VERB_GROUPS = Object.freeze([
+  { key: "memory", label: "Memory & recall" },
+  { key: "knowledge", label: "Knowledge & skills" },
+  { key: "agents", label: "Agents, routing & config" },
+  { key: "account", label: "Account & workspaces" },
+  { key: "system", label: "Setup & system" }
+]);
 var VERB_TABLE = Object.freeze([
-  { verb: "setup", cls: "local", summary: "detect assistants, wire hooks, bring up the daemon" },
-  { verb: "install", cls: "local", summary: "bring up the daemon (health-gated) + open the dashboard (PRD-050a)" },
-  { verb: "status", cls: "local", summary: "daemon connectivity + login + D1\u2013D5 environment health" },
-  { verb: "daemon", cls: "local", summary: "start | stop | status the loopback daemon (3850)" },
-  { verb: "dashboard", cls: "local", summary: "launch the daemon-served dashboard (020b)" },
-  { verb: "telemetry", cls: "local", summary: "show exactly what adoption telemetry has been / would be sent (--show, PRD-050e)" },
-  { verb: "pollinate", cls: "storage", summary: "trigger a pollinating consolidation pass on the daemon (009/026)" },
-  { verb: "maintenance", cls: "storage", summary: "run version-history compaction over version-bumped tables (030)" },
-  { verb: "remember", cls: "storage", summary: "write a memory through the daemon (--type fact|convention|preference|decision|gotcha|reference)" },
-  { verb: "recall", cls: "storage", summary: "recall memories through the daemon" },
-  { verb: "memory", cls: "storage", summary: "lifecycle: conflicts (list/resolve), stale-refs (list), inspect <id> --lifecycle (058d)" },
-  { verb: "agent", cls: "storage", summary: "run an agent turn through the daemon" },
-  { verb: "ontology", cls: "storage", summary: "inspect/propose ontology changes through the daemon" },
-  { verb: "secret", cls: "storage", summary: "manage named secrets through the daemon" },
-  { verb: "settings", cls: "storage", summary: "get/set/list vault settings + provider\u2192model selector through the daemon" },
-  { verb: "asset", cls: "storage", summary: "register/promote/demote/style skills+agents through the tier\xD7style lattice (033)" },
-  { verb: "skill", cls: "storage", summary: "skillify scope/pull/unpull/force/promote through the daemon (promote = cross-project, 049c)" },
-  { verb: "skillify", cls: "storage", summary: "pull team skills from the daemon (016c)" },
-  { verb: "hook", cls: "local", summary: "inspect/wire harness hooks" },
-  { verb: "route", cls: "storage", summary: "manage inference routes through the daemon" },
-  { verb: "sources", cls: "storage", summary: "connect/index/purge sources through the daemon" },
-  { verb: "graph", cls: "storage", summary: "build/query the codebase graph through the daemon" },
-  { verb: "goal", cls: "storage", summary: "manage goals/KPIs through the daemon" },
-  { verb: "whoami", cls: "auth", summary: "show the authenticated user, org, and workspace (GET /me)" },
-  { verb: "org", cls: "auth", summary: "list/switch org (passthrough to the auth dispatcher)" },
-  { verb: "workspace", cls: "auth", summary: "list/switch/use workspace (passthrough to the auth dispatcher)" },
-  { verb: "workspaces", cls: "auth", summary: "list workspaces in the active org (alias of `workspace list`)" },
-  { verb: "project", cls: "auth", summary: "list/bind/use projects + show the resolved per-folder scope (049d)" },
-  { verb: "sessions", cls: "storage", summary: "list/prune captured sessions through the daemon" },
-  { verb: "uninstall", cls: "local", summary: "reverse only Honeycomb's changes" },
-  { verb: "update", cls: "local", summary: "self-update the CLI, daemon, and bundles" }
+  // Memory & recall — the product's core write/read/lifecycle surface.
+  { verb: "remember", cls: "storage", group: "memory", summary: "write a memory through the daemon (--type fact|convention|preference|decision|gotcha|reference)" },
+  { verb: "recall", cls: "storage", group: "memory", summary: "recall memories through the daemon" },
+  { verb: "memory", cls: "storage", group: "memory", summary: "lifecycle: conflicts (list/resolve), stale-refs (list), inspect <id> --lifecycle (058d)" },
+  { verb: "sessions", cls: "storage", group: "memory", summary: "list/prune captured sessions through the daemon" },
+  { verb: "pollinate", cls: "storage", group: "memory", summary: "trigger a pollinating consolidation pass on the daemon (009/026)" },
+  { verb: "maintenance", cls: "storage", group: "memory", summary: "run version-history compaction over version-bumped tables (030)" },
+  // Knowledge & skills — skills, assets, ontology, the codebase graph, and goals.
+  { verb: "skill", cls: "storage", group: "knowledge", summary: "skillify scope/pull/unpull/force/promote through the daemon (promote = cross-project, 049c)" },
+  { verb: "skillify", cls: "storage", group: "knowledge", summary: "pull team skills from the daemon (016c)" },
+  { verb: "asset", cls: "storage", group: "knowledge", summary: "register/promote/demote/style skills+agents through the tier\xD7style lattice (033)" },
+  { verb: "ontology", cls: "storage", group: "knowledge", summary: "inspect/propose ontology changes through the daemon" },
+  { verb: "graph", cls: "storage", group: "knowledge", summary: "build/query the codebase graph through the daemon" },
+  { verb: "sources", cls: "storage", group: "knowledge", summary: "connect/index/purge sources through the daemon" },
+  { verb: "goal", cls: "storage", group: "knowledge", summary: "manage goals/KPIs through the daemon" },
+  // Agents, routing & config — agent turns, inference routes, secrets, and vault settings.
+  { verb: "agent", cls: "storage", group: "agents", summary: "run an agent turn through the daemon" },
+  { verb: "route", cls: "storage", group: "agents", summary: "manage inference routes through the daemon" },
+  { verb: "secret", cls: "storage", group: "agents", summary: "manage named secrets through the daemon" },
+  { verb: "settings", cls: "storage", group: "agents", summary: "get/set/list vault settings + provider\u2192model selector through the daemon" },
+  // Account & workspaces — auth, identity, and the org/workspace/project scope surface.
+  { verb: "login", cls: "auth", group: "account", summary: "authenticate via device flow, or --token <key> for headless (023)" },
+  { verb: "logout", cls: "auth", group: "account", summary: "remove the shared credentials and sign out (023)" },
+  { verb: "whoami", cls: "auth", group: "account", summary: "show the authenticated user, org, and workspace (GET /me)" },
+  { verb: "org", cls: "auth", group: "account", summary: "list/switch org (passthrough to the auth dispatcher)" },
+  { verb: "workspace", cls: "auth", group: "account", summary: "list/switch/use workspace (passthrough to the auth dispatcher)" },
+  { verb: "workspaces", cls: "auth", group: "account", summary: "list workspaces in the active org (alias of `workspace list`)" },
+  { verb: "project", cls: "auth", group: "account", summary: "list/bind/use projects + show the resolved per-folder scope (049d)" },
+  // Setup & system — install/onboard, daemon lifecycle, dashboard, hooks, telemetry, update.
+  { verb: "setup", cls: "local", group: "system", summary: "detect assistants, wire hooks, bring up the daemon" },
+  { verb: "install", cls: "local", group: "system", summary: "bring up the daemon (health-gated) + open the dashboard (PRD-050a)" },
+  { verb: "status", cls: "local", group: "system", summary: "daemon connectivity + login + D1\u2013D5 environment health" },
+  { verb: "daemon", cls: "local", group: "system", summary: "start | stop | status the loopback daemon (3850)" },
+  { verb: "dashboard", cls: "local", group: "system", summary: "launch the daemon-served dashboard (020b)" },
+  { verb: "hook", cls: "local", group: "system", summary: "inspect/wire harness hooks" },
+  { verb: "telemetry", cls: "local", group: "system", summary: "show exactly what adoption telemetry has been / would be sent (--show, PRD-050e)" },
+  { verb: "update", cls: "local", group: "system", summary: "self-update the CLI, daemon, and bundles" },
+  { verb: "uninstall", cls: "local", group: "system", summary: "reverse only Honeycomb's changes" }
 ]);
 var DEFAULT_GLOBAL_FLAGS = Object.freeze({
   help: false,
@@ -35916,7 +37411,7 @@ var DEFAULT_GLOBAL_FLAGS = Object.freeze({
 // dist/src/daemon/runtime/assets/device.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "node:fs";
-import { homedir as homedir14, hostname as hostname3 } from "node:os";
+import { homedir as homedir15, hostname as hostname4 } from "node:os";
 import { dirname as dirname11, join as join19 } from "node:path";
 
 // dist/src/hooks/normalize.js
@@ -36007,8 +37502,61 @@ function nestedString(raw2, a, b) {
 function userMessageData(text) {
   return { kind: "user_message", text };
 }
-function assistantMessageData(text) {
-  return { kind: "assistant_message", text };
+function assistantMessageData(text, usage) {
+  const normalized = usage !== void 0 ? compactUsage(usage) : void 0;
+  return {
+    kind: "assistant_message",
+    text,
+    ...normalized !== void 0 ? { usage: normalized } : {}
+  };
+}
+function compactUsage(usage) {
+  const out = {};
+  if (isCount(usage.input))
+    out.input = usage.input;
+  if (isCount(usage.output))
+    out.output = usage.output;
+  if (isCount(usage.cacheRead))
+    out.cacheRead = usage.cacheRead;
+  if (isCount(usage.cacheCreation))
+    out.cacheCreation = usage.cacheCreation;
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function isCount(n) {
+  return typeof n === "number" && Number.isInteger(n) && n >= 0;
+}
+function extractTurnUsage(raw2) {
+  const block = usageBlock(raw2);
+  if (block === void 0)
+    return void 0;
+  const usage = {
+    ...readCount(block, "input_tokens") !== void 0 ? { input: readCount(block, "input_tokens") } : {},
+    ...readCount(block, "output_tokens") !== void 0 ? { output: readCount(block, "output_tokens") } : {},
+    ...readCount(block, "cache_read_input_tokens") !== void 0 ? { cacheRead: readCount(block, "cache_read_input_tokens") } : {},
+    ...readCount(block, "cache_creation_input_tokens") !== void 0 ? { cacheCreation: readCount(block, "cache_creation_input_tokens") } : {}
+  };
+  return compactUsage(usage);
+}
+function usageBlock(raw2) {
+  const top = nested(raw2, "usage");
+  if (top !== null && typeof top === "object")
+    return top;
+  const inner = nestedRecord(nested(raw2, "message"), "usage");
+  return inner;
+}
+function nestedRecord(obj, key) {
+  if (obj !== null && typeof obj === "object") {
+    const value = obj[key];
+    if (value !== null && typeof value === "object")
+      return value;
+  }
+  return void 0;
+}
+function readCount(block, key) {
+  const value = block[key];
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0)
+    return void 0;
+  return value;
 }
 function toolCallData(tool, input, response) {
   return { kind: "tool_call", tool, input, response };
@@ -36058,7 +37606,7 @@ function claudeCodeExtractData(raw2, logical) {
     case "tool_call":
       return toolCallData(pickString(raw2, "tool_name", "tool"), nested(raw2, "tool_input"), nested(raw2, "tool_response"));
     case "assistant_message":
-      return assistantMessageData(pickString(raw2, "text", "message"));
+      return assistantMessageData(pickString(raw2, "text", "message"), extractTurnUsage(raw2));
     case "session-end":
       return sessionEndData(pickString(raw2, "reason") || "Stop");
     default:
@@ -36388,6 +37936,200 @@ function capabilitiesFor(name) {
   return HARNESS_CAPABILITIES[name];
 }
 
+// dist/src/daemon/runtime/dashboard/harness-detect.js
+var HARNESS_MARKERS = [
+  {
+    name: "claude-code",
+    // src/connectors/claude-code.ts: configPath() = ~/.claude/settings.json; pluginRoot = ~/.claude/plugins/honeycomb.
+    paths: (h) => [join20(h, ".claude", "settings.json"), join20(h, ".claude", "plugins", "honeycomb")]
+  },
+  {
+    name: "cursor",
+    // src/connectors/cursor.ts: configPath() = ~/.cursor/hooks.json; pluginRoot = ~/.cursor/honeycomb.
+    paths: (h) => [join20(h, ".cursor", "hooks.json"), join20(h, ".cursor", "honeycomb")]
+  },
+  {
+    name: "codex",
+    // hivemind-v1/src/cli/install-codex.ts: HOOKS_PATH = ~/.codex/hooks.json; PLUGIN_DIR = ~/.codex/hivemind.
+    paths: (h) => [join20(h, ".codex", "hooks.json"), join20(h, ".codex", "hivemind")]
+  },
+  {
+    name: "hermes",
+    // hivemind-v1/src/cli/install-hermes.ts: CONFIG_PATH = ~/.hermes/config.yaml; HIVEMIND_DIR = ~/.hermes/hivemind.
+    paths: (h) => [join20(h, ".hermes", "config.yaml"), join20(h, ".hermes", "hivemind")]
+  },
+  {
+    name: "pi",
+    // hivemind-v1/src/cli/install-pi.ts: AGENTS_MD = ~/.pi/agent/AGENTS.md; EXTENSION_PATH = ~/.pi/agent/extensions/hivemind.ts.
+    paths: (h) => [
+      join20(h, ".pi", "agent", "extensions", "hivemind.ts"),
+      join20(h, ".pi", "agent", "AGENTS.md")
+    ]
+  },
+  {
+    name: "openclaw",
+    // hivemind-v1/src/cli/install-openclaw.ts: PLUGIN_DIR = ~/.openclaw/extensions/hivemind.
+    paths: (h) => [join20(h, ".openclaw", "extensions", "hivemind")]
+  }
+];
+function markerExists(path4) {
+  try {
+    return existsSync12(path4);
+  } catch {
+    return false;
+  }
+}
+function detectInstalledHarnesses(homeDir = homedir16(), _cwd = process.cwd()) {
+  const canonical = new Set(CANONICAL_HARNESS_IDS);
+  const installed = /* @__PURE__ */ new Set();
+  for (const marker of HARNESS_MARKERS) {
+    if (!canonical.has(marker.name))
+      continue;
+    if (marker.paths(homeDir).some(markerExists))
+      installed.add(marker.name);
+  }
+  return installed;
+}
+
+// dist/src/daemon/runtime/dashboard/actions-api.js
+var ACTIONS_GROUP = "/api/actions";
+var RESTART_SHUTDOWN_DELAY_MS = 100;
+function isLoopbackOrigin(origin) {
+  try {
+    const host = new URL(origin).hostname;
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function actionGuard(c, mode) {
+  if (mode !== "local") {
+    return c.json({ error: "forbidden", reason: "actions are available in local mode only" }, 403);
+  }
+  const site = c.req.header("sec-fetch-site");
+  if (site === "cross-site" || site === "same-site") {
+    return c.json({ error: "forbidden", reason: "cross-origin request rejected" }, 403);
+  }
+  const origin = c.req.header("origin");
+  if (origin !== void 0 && origin !== "" && !isLoopbackOrigin(origin)) {
+    return c.json({ error: "forbidden", reason: "untrusted origin" }, 403);
+  }
+  const session = c.req.header("x-honeycomb-session");
+  if (session === void 0 || session.trim() === "") {
+    return c.json({ error: "forbidden", reason: "missing dashboard session header" }, 403);
+  }
+  return null;
+}
+async function readEnabled(c) {
+  try {
+    const body = await c.req.json();
+    if (typeof body === "object" && body !== null) {
+      const v = body.enabled;
+      if (typeof v === "boolean")
+        return v;
+      if (v === "true" || v === 1)
+        return true;
+      if (v === "false" || v === 0)
+        return false;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function defaultRemoveCredentials() {
+  for (const path4 of [credentialsPath(), legacyCredentialsPath()]) {
+    try {
+      rmSync5(path4, { force: true });
+    } catch {
+    }
+  }
+}
+function defaultShutdown() {
+  try {
+    process.kill(process.pid, "SIGTERM");
+  } catch {
+  }
+}
+function defaultSpawnRestart() {
+  const entry = process.argv[1];
+  if (entry === void 0 || entry === "")
+    return;
+  const helper = resolve5(dirname12(entry), "restart-helper.js");
+  const child = spawn4(process.execPath, [helper], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env, HONEYCOMB_RESTART_ENTRY: entry, HONEYCOMB_RESTART_PORT: String(DAEMON_PORT) }
+  });
+  child.unref();
+}
+function defaultUninstall() {
+  const harnesses = [...detectInstalledHarnesses()];
+  return {
+    ok: true,
+    harnesses,
+    removed: false,
+    command: "honeycomb uninstall",
+    note: "Run `honeycomb uninstall` in your terminal to remove Honeycomb's hooks from your coding assistants. It reverses only Honeycomb's changes; your DeepLake login is left intact (use Log out for that)."
+  };
+}
+function mountActionsGroup(group, mode, options) {
+  const embed = options.embed;
+  const store = options.store;
+  const removeCredentials = options.removeCredentials ?? defaultRemoveCredentials;
+  const shutdown = options.shutdown ?? defaultShutdown;
+  const spawnRestart = options.spawnRestart ?? defaultSpawnRestart;
+  const uninstall = options.uninstall ?? defaultUninstall;
+  const settingsScope = localDefaultScopeResolver(mode, options.defaultScope);
+  group.post("/logout", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    removeCredentials();
+    return c.json({ ok: true });
+  });
+  group.post("/embeddings", async (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    const enabled = await readEnabled(c);
+    if (enabled === null) {
+      return c.json({ error: "bad_request", reason: "body must carry { enabled: boolean }" }, 400);
+    }
+    if (store !== void 0) {
+      const sc = settingsScope.resolve(c);
+      if (sc !== null) {
+        try {
+          await store.setSetting(EMBEDDINGS_ENABLED_KEY, enabled, sc);
+        } catch {
+        }
+      }
+    }
+    await embed.setEnabled(enabled);
+    return c.json({ ok: true, enabled });
+  });
+  group.post("/restart", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    spawnRestart();
+    setTimeout(() => shutdown(), RESTART_SHUTDOWN_DELAY_MS);
+    return c.json({ ok: true, restarting: true });
+  });
+  group.post("/uninstall", (c) => {
+    const denied = actionGuard(c, mode);
+    if (denied)
+      return denied;
+    return c.json(uninstall());
+  });
+}
+function mountActionsApi(daemon, options) {
+  const group = daemon.group(ACTIONS_GROUP);
+  if (group === void 0)
+    return;
+  mountActionsGroup(group, daemon.config.mode, options);
+}
+
 // dist/src/daemon/runtime/dashboard/harness-api.js
 var HARNESS_GROUP = "/api/diagnostics";
 var HARNESS_PATH = "/harnesses";
@@ -36917,25 +38659,25 @@ async function tableAbsent(probe, table) {
 }
 
 // dist/src/daemon/runtime/dashboard/asset-install-target.js
-import { existsSync as existsSync12, mkdirSync as mkdirSync14, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-import { join as join20 } from "node:path";
-var SKILLS_SUBDIR = join20(".claude", "skills");
-var AGENTS_SUBDIR = join20(".claude", "agents");
+import { existsSync as existsSync13, mkdirSync as mkdirSync14, readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
+import { join as join21 } from "node:path";
+var SKILLS_SUBDIR = join21(".claude", "skills");
+var AGENTS_SUBDIR = join21(".claude", "agents");
 var SKILL_FILE3 = "SKILL.md";
 function createFsAssetInstallTarget(dirs = {}) {
   const projectDir = dirs.projectDir ?? process.cwd();
-  const globalDir = dirs.globalDir ?? homedir15();
+  const globalDir = dirs.globalDir ?? homedir17();
   const rootFor = (install) => install === "global" ? globalDir : projectDir;
   const pathFor = (assetType, install, name) => {
     const root = rootFor(install);
     const segment = sanitizeSegment3(name);
     if (assetType === "agent") {
-      const dir2 = join20(root, AGENTS_SUBDIR);
-      return { dir: dir2, file: join20(dir2, `${segment}.md`) };
+      const dir2 = join21(root, AGENTS_SUBDIR);
+      return { dir: dir2, file: join21(dir2, `${segment}.md`) };
     }
-    const dir = join20(root, SKILLS_SUBDIR, segment);
-    return { dir, file: join20(dir, SKILL_FILE3) };
+    const dir = join21(root, SKILLS_SUBDIR, segment);
+    return { dir, file: join21(dir, SKILL_FILE3) };
   };
   return {
     async write(assetType, install, name, body) {
@@ -36951,7 +38693,7 @@ function createFsAssetInstallTarget(dirs = {}) {
     async read(assetType, install, name) {
       try {
         const { file: file2 } = pathFor(assetType, install, name);
-        if (!existsSync12(file2))
+        if (!existsSync13(file2))
           return null;
         return readFileSync16(file2, "utf-8");
       } catch {
@@ -36962,14 +38704,14 @@ function createFsAssetInstallTarget(dirs = {}) {
       try {
         const { dir, file: file2 } = pathFor(assetType, install, name);
         if (assetType === "agent") {
-          if (!existsSync12(file2))
+          if (!existsSync13(file2))
             return false;
-          rmSync5(file2, { force: true });
+          rmSync6(file2, { force: true });
           return true;
         }
-        if (!existsSync12(dir))
+        if (!existsSync13(dir))
           return false;
-        rmSync5(dir, { recursive: true, force: true });
+        rmSync6(dir, { recursive: true, force: true });
         return true;
       } catch {
         return false;
@@ -36977,7 +38719,7 @@ function createFsAssetInstallTarget(dirs = {}) {
     },
     exists(assetType, install, name) {
       try {
-        return existsSync12(pathFor(assetType, install, name).file);
+        return existsSync13(pathFor(assetType, install, name).file);
       } catch {
         return false;
       }
@@ -37355,67 +39097,9 @@ function pickAssetType(value) {
   return typeof value === "string" && SYNCED_ASSET_TYPES.includes(value) ? value : null;
 }
 
-// dist/src/daemon/runtime/dashboard/harness-detect.js
-import { existsSync as existsSync13 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
-import { join as join21 } from "node:path";
-var HARNESS_MARKERS = [
-  {
-    name: "claude-code",
-    // src/connectors/claude-code.ts: configPath() = ~/.claude/settings.json; pluginRoot = ~/.claude/plugins/honeycomb.
-    paths: (h) => [join21(h, ".claude", "settings.json"), join21(h, ".claude", "plugins", "honeycomb")]
-  },
-  {
-    name: "cursor",
-    // src/connectors/cursor.ts: configPath() = ~/.cursor/hooks.json; pluginRoot = ~/.cursor/honeycomb.
-    paths: (h) => [join21(h, ".cursor", "hooks.json"), join21(h, ".cursor", "honeycomb")]
-  },
-  {
-    name: "codex",
-    // hivemind-v1/src/cli/install-codex.ts: HOOKS_PATH = ~/.codex/hooks.json; PLUGIN_DIR = ~/.codex/hivemind.
-    paths: (h) => [join21(h, ".codex", "hooks.json"), join21(h, ".codex", "hivemind")]
-  },
-  {
-    name: "hermes",
-    // hivemind-v1/src/cli/install-hermes.ts: CONFIG_PATH = ~/.hermes/config.yaml; HIVEMIND_DIR = ~/.hermes/hivemind.
-    paths: (h) => [join21(h, ".hermes", "config.yaml"), join21(h, ".hermes", "hivemind")]
-  },
-  {
-    name: "pi",
-    // hivemind-v1/src/cli/install-pi.ts: AGENTS_MD = ~/.pi/agent/AGENTS.md; EXTENSION_PATH = ~/.pi/agent/extensions/hivemind.ts.
-    paths: (h) => [
-      join21(h, ".pi", "agent", "extensions", "hivemind.ts"),
-      join21(h, ".pi", "agent", "AGENTS.md")
-    ]
-  },
-  {
-    name: "openclaw",
-    // hivemind-v1/src/cli/install-openclaw.ts: PLUGIN_DIR = ~/.openclaw/extensions/hivemind.
-    paths: (h) => [join21(h, ".openclaw", "extensions", "hivemind")]
-  }
-];
-function markerExists(path4) {
-  try {
-    return existsSync13(path4);
-  } catch {
-    return false;
-  }
-}
-function detectInstalledHarnesses(homeDir = homedir16(), _cwd = process.cwd()) {
-  const canonical = new Set(CANONICAL_HARNESS_IDS);
-  const installed = /* @__PURE__ */ new Set();
-  for (const marker of HARNESS_MARKERS) {
-    if (!canonical.has(marker.name))
-      continue;
-    if (marker.paths(homeDir).some(markerExists))
-      installed.add(marker.name);
-  }
-  return installed;
-}
-
 // dist/src/daemon/runtime/dashboard/web-assets.js
 import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname12, join as join22 } from "node:path";
+import { dirname as dirname13, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var CSS_FILES = ["tokens/fonts.css", "tokens/colors.css", "tokens/typography.css", "tokens/spacing.css", "tokens/base.css"];
 var LOGO_FILE = "logos/honeycomb-memory-cluster.svg";
@@ -37440,7 +39124,7 @@ var DASHBOARD_APP_BUNDLE = "dashboard-app.js";
 function resolveAssetsDir(startUrl = import.meta.url) {
   let dir;
   try {
-    dir = dirname12(fileURLToPath2(startUrl));
+    dir = dirname13(fileURLToPath2(startUrl));
   } catch {
     return null;
   }
@@ -37448,7 +39132,7 @@ function resolveAssetsDir(startUrl = import.meta.url) {
     const candidate = join22(dir, "assets");
     if (existsSync14(join22(candidate, "styles.css")))
       return candidate;
-    const parent = dirname12(dir);
+    const parent = dirname13(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -37457,7 +39141,7 @@ function resolveAssetsDir(startUrl = import.meta.url) {
 }
 function resolveBundleDir(startUrl = import.meta.url) {
   try {
-    return dirname12(fileURLToPath2(startUrl));
+    return dirname13(fileURLToPath2(startUrl));
   } catch {
     return null;
   }
@@ -37569,24 +39253,27 @@ function mountDashboardHost(daemon, options = {}) {
   if (root === void 0)
     return;
   const assets = options.assets ?? createWebAssets();
-  root.get(DASHBOARD_HOST_PATH, (c) => c.html(renderShell()));
+  root.get(DASHBOARD_HOST_PATH, (c) => {
+    c.header("cache-control", "no-cache");
+    return c.html(renderShell());
+  });
   root.get(DASHBOARD_APP_PATH, (c) => {
     const asset = assets.appJs();
     if (asset === null)
       return c.text("dashboard bundle not built", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_CSS_PATH, (c) => {
     const asset = assets.css();
     if (asset === null)
       return c.text("dashboard styles unavailable", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_LOGO_PATH, (c) => {
     const asset = assets.logo();
     if (asset === null)
       return c.text("dashboard logo unavailable", 404);
-    return c.body(asset.body, 200, { "content-type": asset.contentType });
+    return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "no-cache" });
   });
   root.get(DASHBOARD_FONT_PATH, (c) => {
     const asset = assets.font(c.req.param("name"));
@@ -37635,8 +39322,8 @@ function mountSetupLogin(daemon, options = {}) {
     };
     let rejectGrant = () => {
     };
-    const grantReady = new Promise((resolve6, reject) => {
-      resolveGrant = resolve6;
+    const grantReady = new Promise((resolve7, reject) => {
+      resolveGrant = resolve7;
       rejectGrant = reject;
     });
     const deps = {
@@ -37667,7 +39354,7 @@ function mountSetupLogin(daemon, options = {}) {
 
 // dist/src/daemon/runtime/dashboard/setup-state.js
 import { existsSync as existsSync15 } from "node:fs";
-import { homedir as homedir17 } from "node:os";
+import { homedir as homedir18 } from "node:os";
 import { join as join23 } from "node:path";
 var SETUP_STATE_PATH = "/setup/state";
 var SETUP_STATE_GROUP = "/";
@@ -37690,7 +39377,7 @@ function derivePriorTool(recorded, hivemindDirPresent) {
   return hivemindDirPresent ? { hivemind: "present" } : recorded;
 }
 function resolveSetupState(deps = {}) {
-  const home = deps.homeDir ?? homedir17();
+  const home = deps.homeDir ?? homedir18();
   const env = deps.env ?? process.env;
   const onboarding = loadOnboarding(deps.onboardingDir);
   const legacyCredentialsDir = deps.legacyCredentialsDir ?? join23(home, LEGACY_CREDENTIALS_DIR_NAME);
@@ -37725,8 +39412,8 @@ function mountSetupStateApi(daemon, deps = {}) {
 
 // dist/src/daemon/runtime/onboarding/hivemind-uninstall.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { cpSync, existsSync as existsSync16, rmSync as rmSync6 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { cpSync, existsSync as existsSync16, rmSync as rmSync7 } from "node:fs";
+import { homedir as homedir19 } from "node:os";
 import { join as join24 } from "node:path";
 var HIVEMIND_DIR_NAME2 = ".hivemind";
 var HIVEMIND_NPM_PACKAGE = "@deeplake/hivemind";
@@ -37748,7 +39435,7 @@ function hivemindBackupPath(home, iso) {
   return join24(home, `${HIVEMIND_BACKUP_PREFIX}${safe}`);
 }
 function backupAndUninstallHivemind(deps = {}) {
-  const home = deps.homeDir ?? homedir18();
+  const home = deps.homeDir ?? homedir19();
   const npmRemove = deps.npmRemove ?? defaultNpmGlobalRemover;
   const dir = hivemindDirPath(home);
   let npmRemoved = false;
@@ -37764,7 +39451,7 @@ function backupAndUninstallHivemind(deps = {}) {
   const backupPath = hivemindBackupPath(home, iso);
   cpSync(dir, backupPath, { recursive: true });
   try {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync7(dir, { recursive: true, force: true });
     return { removed: true, backupPath, npmRemoved };
   } catch {
     return { removed: false, backupPath, npmRemoved };
@@ -37773,9 +39460,9 @@ function backupAndUninstallHivemind(deps = {}) {
 function restoreHivemindBackup(backupPath, deps = {}) {
   if (backupPath.length === 0 || !existsSync16(backupPath))
     return false;
-  const home = deps.homeDir ?? homedir18();
+  const home = deps.homeDir ?? homedir19();
   const dir = hivemindDirPath(home);
-  rmSync6(dir, { recursive: true, force: true });
+  rmSync7(dir, { recursive: true, force: true });
   cpSync(backupPath, dir, { recursive: true });
   return true;
 }
@@ -38595,8 +40282,8 @@ function resolveProjectsScope(c, defaultScope) {
 
 // dist/src/daemon/runtime/projects/onboarding-api.js
 import { existsSync as existsSync17, readdirSync as readdirSync3, realpathSync, statSync as statSync2 } from "node:fs";
-import { homedir as homedir19 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join25, resolve as resolve5, sep as sep3 } from "node:path";
+import { homedir as homedir20 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join25, resolve as resolve6, sep as sep3 } from "node:path";
 var ONBOARDING_GROUP = "/api/diagnostics";
 var FS_BROWSE_PATH = "/fs/browse";
 var PROJECTS_BIND_PATH = "/projects/bind";
@@ -38624,19 +40311,19 @@ function suggestProjectId(absPath, readRemote) {
         return repo;
     }
   }
-  const segs = resolve5(absPath).split(sep3).filter((s) => s.length > 0);
+  const segs = resolve6(absPath).split(sep3).filter((s) => s.length > 0);
   const base = segs[segs.length - 1];
   return base ?? "";
 }
 function canonicalize(absPath) {
-  let head = resolve5(absPath);
+  let head = resolve6(absPath);
   const tail = [];
   for (; ; ) {
     try {
       const real = realpathSync(head);
       return stripTrailingSep(tail.length > 0 ? join25(real, ...tail.reverse()) : real);
     } catch {
-      const parent = resolve5(head, "..");
+      const parent = resolve6(head, "..");
       if (parent === head)
         return stripTrailingSep(head);
       const segmentStart = parent.endsWith(sep3) ? parent.length : parent.length + sep3.length;
@@ -38663,7 +40350,7 @@ function parentWithinRoot(dir, root) {
   const normalizedRoot = root;
   if (dir === normalizedRoot)
     return null;
-  const parent = canonicalize(resolve5(dir, ".."));
+  const parent = canonicalize(resolve6(dir, ".."));
   return parent === normalizedRoot || parent.startsWith(normalizedRoot + sep3) ? parent : normalizedRoot;
 }
 function listChildDirs(dir) {
@@ -38701,7 +40388,7 @@ function mountOnboardingApi(daemon, options) {
   if (group === void 0)
     return;
   const mode = daemon.config.mode;
-  const root = canonicalize(options.browseRoot ?? homedir19());
+  const root = canonicalize(options.browseRoot ?? homedir20());
   const readRemote = options.readRemote ?? defaultGitRemoteReader;
   const notLocal = () => mode !== "local";
   group.get(FS_BROWSE_PATH, (c) => {
@@ -38793,7 +40480,7 @@ function resolveBindPath(path4) {
   const trimmed = path4.trim();
   if (trimmed.length === 0 || !isAbsolute2(trimmed))
     return null;
-  return resolve5(trimmed);
+  return resolve6(trimmed);
 }
 function rejectBind(path4, reason) {
   return { bound: false, path: path4, projectId: "", error: reason };
@@ -38822,9 +40509,9 @@ function remoteFor(absPath, readRemote) {
   return raw2 !== null ? canonicalizeRemote(raw2) : "";
 }
 function removeBinding(absPath, options) {
-  const normalized = stripTrailingSep(resolve5(absPath));
+  const normalized = stripTrailingSep(resolve6(absPath));
   const loaded = loadProjectsCache(options.projectsDir);
-  const kept = loaded.bindings.filter((b) => stripTrailingSep(resolve5(b.path)) !== normalized);
+  const kept = loaded.bindings.filter((b) => stripTrailingSep(resolve6(b.path)) !== normalized);
   if (kept.length === loaded.bindings.length) {
     return { unbound: false, path: normalized };
   }
@@ -39381,35 +41068,6 @@ async function readBody4(c) {
   }
 }
 
-// dist/src/daemon/runtime/recall/scope-clause.js
-var PROJECT_ID_COLUMN = "project_id";
-var PROJECT_ID_UNSET = "";
-var CROSS_PROJECT_ADMITTED = Object.freeze(["user", "workspace"]);
-var SCOPE_READ_POLICIES = Object.freeze(["isolated", "shared", "group"]);
-function buildProjectScopeClause(input) {
-  const projectColumn = input.projectColumn ?? PROJECT_ID_COLUMN;
-  const rawId = input.projectId ?? "";
-  const isInbox = rawId.trim() === "" || rawId === UNSORTED_PROJECT_ID;
-  const bound = input.bound ?? !isInbox;
-  const col = sqlIdent(projectColumn);
-  const primaryId = bound ? rawId : UNSORTED_PROJECT_ID;
-  const admitted = primaryId === PROJECT_ID_UNSET ? [PROJECT_ID_UNSET] : [primaryId, PROJECT_ID_UNSET];
-  const disjuncts = admitted.map((id) => `${col} = ${sLiteral(id)}`);
-  const values = [...admitted];
-  if (input.promotionColumn !== void 0 && input.promotionColumn !== "") {
-    const promoCol = sqlIdent(input.promotionColumn);
-    for (const reach of CROSS_PROJECT_ADMITTED) {
-      disjuncts.push(`${promoCol} = ${sLiteral(reach)}`);
-      values.push(reach);
-    }
-  }
-  const sql = `(${disjuncts.join(" OR ")})`;
-  return { sql, values, bound };
-}
-function buildProjectScopeConjunct(input) {
-  return ` AND ${buildProjectScopeClause(input).sql}`;
-}
-
 // dist/src/daemon/runtime/memories/reads.js
 var DEFAULT_LIST_LIMIT = 50;
 var MAX_LIST_LIMIT = 500;
@@ -40459,7 +42117,7 @@ function recordKey(record2) {
 // dist/src/daemon/runtime/notifications/api.js
 var NOTIFICATIONS_GROUP = "/api/diagnostics";
 var NOTIFICATIONS_PATH = "/notifications";
-var headerScopeResolver = {
+var headerScopeResolver2 = {
   resolve(c) {
     const org = c.req.header("x-honeycomb-org");
     if (org === void 0 || org.length === 0)
@@ -40503,7 +42161,7 @@ function mountNotificationsApi(daemon, options) {
   if (group === void 0)
     return;
   const table = options.table ?? "notifications";
-  const scopeResolver = options.scope ?? headerScopeResolver;
+  const scopeResolver = options.scope ?? headerScopeResolver2;
   group.get(NOTIFICATIONS_PATH, async (c) => {
     const scope = scopeResolver.resolve(c);
     if (scope === null) {
@@ -40689,6 +42347,8 @@ var DEFAULT_TRAVERSAL_MIN_EDGE_WEIGHT = 0.3;
 var DEFAULT_TRAVERSAL_TIMEOUT_MS = 500;
 var DEFAULT_RERANKER = "none";
 var DEFAULT_RERANKER_TIMEOUT_MS = 300;
+var DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS = 1e3;
+var DEFAULT_RERANKER_COHERE_MODEL = "rerank-v3.5";
 var DEFAULT_RERANKER_WINDOW = 50;
 var DEFAULT_DEDUP_ENABLED = true;
 var DEFAULT_DEDUP_SIMILARITY_THRESHOLD = 0.9;
@@ -40707,7 +42367,7 @@ var DEFAULT_RESOLUTION_BOOST = 1.25;
 var DEFAULT_REHEARSAL_BOOST = 1.1;
 var DEFAULT_REHEARSAL_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_MIN_INJECTION_SCORE = 0.6;
-var RERANKER_STRATEGIES = Object.freeze(["embedding-cosine", "llm", "none"]);
+var RERANKER_STRATEGIES = Object.freeze(["embedding-cosine", "llm", "cohere", "none"]);
 var BoolFlag3 = external_exports.preprocess((raw2) => {
   if (typeof raw2 === "boolean")
     return raw2;
@@ -40762,12 +42422,26 @@ var TraversalConfigSchema = external_exports.object({
   timeoutMs: ClampedInt4(DEFAULT_TRAVERSAL_TIMEOUT_MS, 1).default(DEFAULT_TRAVERSAL_TIMEOUT_MS)
 });
 var RerankerConfigSchema = external_exports.object({
-  /** The reranker strategy (D-4). */
+  /** The reranker strategy (D-4 + PRD-063c). */
   strategy: external_exports.enum(RERANKER_STRATEGIES).default(DEFAULT_RERANKER),
-  /** Reranker timeout in ms; on timeout keep the original order (d-AC-2 / b-AC-2). */
+  /** Reranker timeout in ms; on timeout keep the original order (d-AC-2 / b-AC-2). LOCAL-cosine budget. */
   timeoutMs: ClampedInt4(DEFAULT_RERANKER_TIMEOUT_MS, 1).default(DEFAULT_RERANKER_TIMEOUT_MS),
+  /**
+   * The PROVIDER-rerank timeout in ms (PRD-063c / c-AC-3): the budget for the `cohere` outbound
+   * Portkey round-trip, larger than the local-cosine {@link timeoutMs} because it crosses the
+   * network. A `cohere` call that exceeds it FAILS SOFT to the RRF order. Defaults to
+   * {@link DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS} (1000ms); the local-cosine path never reads it.
+   */
+  providerTimeoutMs: ClampedInt4(DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS, 1).default(DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS),
   /** Rerank window N: how many fused top-N candidates to re-score (PRD-047b). */
-  window: ClampedInt4(DEFAULT_RERANKER_WINDOW, 1).default(DEFAULT_RERANKER_WINDOW)
+  window: ClampedInt4(DEFAULT_RERANKER_WINDOW, 1).default(DEFAULT_RERANKER_WINDOW),
+  /**
+   * The Cohere rerank `model` id sent to Portkey when the strategy is `cohere` (PRD-063c / c-D-1).
+   * Defaults to {@link DEFAULT_RERANKER_COHERE_MODEL}; the operator may override it (or configure
+   * the model inside Portkey). A non-string env value falls back to the default. Only the `cohere`
+   * strategy reads it.
+   */
+  cohereModel: external_exports.string().min(1).catch(DEFAULT_RERANKER_COHERE_MODEL).default(DEFAULT_RERANKER_COHERE_MODEL)
 });
 var DedupConfigSchema = external_exports.object({
   /** Whether semantic near-duplicate dedup runs; ON by default (PRD-047c / c-AC-3). */
@@ -40867,7 +42541,9 @@ function envRecallConfigProvider(env = process.env) {
         reranker: {
           strategy: env.HONEYCOMB_RECALL_RERANKER,
           timeoutMs: env.HONEYCOMB_RECALL_RERANKER_TIMEOUT_MS,
-          window: env.HONEYCOMB_RECALL_RERANKER_WINDOW
+          providerTimeoutMs: env.HONEYCOMB_RECALL_RERANKER_PROVIDER_TIMEOUT_MS,
+          window: env.HONEYCOMB_RECALL_RERANKER_WINDOW,
+          cohereModel: env.HONEYCOMB_RECALL_RERANKER_COHERE_MODEL
         },
         dampening: {
           gravity: env.HONEYCOMB_RECALL_DAMPENING_GRAVITY,
@@ -40936,10 +42612,10 @@ var Semaphore = class {
       this.held += 1;
       return Promise.resolve();
     }
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       this.waiters.push(() => {
         this.held += 1;
-        resolve6();
+        resolve7();
       });
     });
   }
@@ -41442,9 +43118,16 @@ async function fetchCandidateEmbeddings(candidates, request, deps) {
 }
 async function rerankHits(hits, queryVector, config2, request, deps) {
   const rrfOrder = [...hits];
+  if (hits.length === 0)
+    return rrfOrder;
+  if (config2.strategy === "cohere") {
+    if (deps.cohereRerank === void 0)
+      return rrfOrder;
+    return rerankWithCohere(rrfOrder, config2, request, deps, deps.cohereRerank);
+  }
   if (config2.strategy !== "embedding-cosine")
     return rrfOrder;
-  if (hits.length === 0)
+  if (queryVector === null)
     return rrfOrder;
   const now = deps.now ?? Date.now;
   const start = now();
@@ -41475,6 +43158,56 @@ async function rerankHits(hits, queryVector, config2, request, deps) {
     return rrfOrder;
   }
 }
+async function rerankWithCohere(rrfOrder, config2, request, deps, seam) {
+  const baseOrder = [...rrfOrder];
+  const now = deps.now ?? Date.now;
+  const start = now();
+  const window = Math.max(1, Math.trunc(config2.window));
+  const head = baseOrder.slice(0, window);
+  const tail = baseOrder.slice(window);
+  const documents = head.map((h) => h.text);
+  try {
+    const timeoutMs = Math.max(1, Math.trunc(config2.providerTimeoutMs));
+    const TIMED_OUT = /* @__PURE__ */ Symbol("rerank-timeout");
+    let timer;
+    const timeout = new Promise((resolve7) => {
+      timer = setTimeout(() => resolve7(TIMED_OUT), timeoutMs);
+    });
+    let outcome;
+    try {
+      outcome = await Promise.race([seam.rerank(request.query, documents, head.length), timeout]);
+    } finally {
+      if (timer !== void 0)
+        clearTimeout(timer);
+    }
+    if (outcome === TIMED_OUT || outcome.ok === false)
+      return baseOrder;
+    const scoreByIndex = /* @__PURE__ */ new Map();
+    for (const r of outcome.results) {
+      if (r.index >= 0 && r.index < head.length && !scoreByIndex.has(r.index)) {
+        scoreByIndex.set(r.index, r.relevanceScore);
+      }
+    }
+    const scoredSlots = [];
+    for (let i = 0; i < head.length; i++) {
+      if (scoreByIndex.has(i))
+        scoredSlots.push(i);
+    }
+    const orderedByScore = scoredSlots.map((index) => ({ index, score: scoreByIndex.get(index) })).sort((a, b) => {
+      if (b.score !== a.score)
+        return b.score - a.score;
+      return a.index - b.index;
+    });
+    const reorderedHead = head.slice();
+    scoredSlots.forEach((slot, i) => {
+      reorderedHead[slot] = head[orderedByScore[i].index];
+    });
+    void start;
+    return [...reorderedHead, ...tail];
+  } catch {
+    return baseOrder;
+  }
+}
 function provenanceRank(source) {
   if (source === "memories")
     return 0;
@@ -41641,661 +43374,214 @@ function applyRecencyActivation(hits, byClass, activationExponent, nowMs, stalen
     return activated.map(({ hit, activation, staleFields }) => ({ ...hit, ...staleFields, freshnessScore: activation }));
   }
   activated.sort((a, b) => {
-    if (b.score !== a.score)
-      return b.score - a.score;
-    return a.index - b.index;
-  });
-  return activated.map(({ hit, activation, score, staleFields }) => ({ ...hit, ...staleFields, score, freshnessScore: activation }));
-}
-async function applyActrActivation(hits, source, byClass, activationExponent, nowMs, scope, staleness) {
-  const exponent = Math.max(0, Number.isFinite(activationExponent) ? activationExponent : DEFAULT_RECENCY_ACTIVATION_EXPONENT);
-  const params = source.params ?? DEFAULT_ACTR_PARAMS;
-  let inputs;
-  try {
-    inputs = await source.load(hits, scope);
-  } catch {
-    return applyRecencyActivation(hits, byClass, activationExponent, nowMs, staleness);
-  }
-  const computed = hits.map((hit, index) => {
-    const key = fusionKey(hit.source, hit.id);
-    const input = inputs.get(key);
-    if (input === void 0) {
-      const halfLife = halfLifeForSource(hit.source, byClass);
-      const lastReinforcedAt = hit.lastReinforcedAt;
-      const a2 = recencyActivation(refTimestampMs(hit.createdAt, lastReinforcedAt), nowMs, halfLife);
-      return { hit, index, activation: a2, accessCount: void 0 };
-    }
-    const a = actrActivation(input.history, nowMs, params);
-    return { hit, index, activation: a, accessCount: input.accessCount };
-  });
-  const adjusted = computed.map((c) => {
-    const stale = stalenessContribution(c.hit, staleness);
-    const orderingWeight = (exponent === 1 ? c.activation : Math.pow(c.activation, exponent)) * stale.factor;
-    return { ...c, staleFields: stale.fields, orderingWeight, score: c.hit.score * orderingWeight };
-  });
-  const stamp = (c) => ({
-    ...c.hit,
-    ...c.staleFields,
-    score: c.score,
-    freshnessScore: c.activation,
-    // the swap: A_actr behind the SAME field 058a used (PRD-058e).
-    activation: c.activation,
-    ...c.accessCount !== void 0 ? { accessCount: c.accessCount } : {}
-  });
-  const anyPenalty = adjusted.some((c) => c.orderingWeight < 1);
-  if (!anyPenalty) {
-    return adjusted.map(stamp);
-  }
-  const ordered = [...adjusted].sort((a, b) => {
-    if (b.score !== a.score)
-      return b.score - a.score;
-    return a.index - b.index;
-  });
-  return ordered.map(stamp);
-}
-function buildConfidenceFetchSql(ids) {
-  const tbl = sqlIdent("memories");
-  const idCol = sqlIdent("id");
-  const confCol = sqlIdent("confidence");
-  const inList = ids.map((id) => sLiteral(id)).join(", ");
-  return `SELECT ${idCol} AS id, ${confCol} AS confidence FROM "${tbl}" WHERE ${idCol} IN (${inList})`;
-}
-async function applyCalibrationStage(hits, model, request, deps) {
-  const memoryIds = hits.filter((h) => h.source === "memories" && h.id !== "").map((h) => h.id);
-  if (memoryIds.length === 0)
-    return [...hits];
-  let confById = /* @__PURE__ */ new Map();
-  try {
-    const rows = await runArm(buildConfidenceFetchSql(memoryIds), request, deps);
-    for (const row of rows) {
-      const id = cell(row.id);
-      if (id === "")
-        continue;
-      const f = typeof row.confidence === "number" ? row.confidence : Number(row.confidence);
-      if (Number.isFinite(f))
-        confById.set(id, f);
-    }
-  } catch {
-    return [...hits];
-  }
-  return hits.map((hit) => {
-    if (hit.source !== "memories")
-      return hit;
-    const f = confById.get(hit.id);
-    if (f === void 0)
-      return hit;
-    const c = applyCalibration(model, f);
-    return { ...hit, rawConfidence: f, calibratedConfidence: c };
-  });
-}
-async function recordRecallAccessEvents(hits, deps) {
-  const record2 = deps.recordRecallAccess;
-  if (record2 === void 0)
-    return;
-  const ids = hits.filter((h) => h.source === "memories" && h.id !== "").map((h) => h.id);
-  await Promise.all(ids.map(async (id) => {
-    try {
-      await record2(id);
-    } catch {
-    }
-  }));
-}
-var CHARS_PER_TOKEN3 = 4;
-function estimateTokenCount(text) {
-  const trimmedLen = text.trim().length;
-  if (trimmedLen === 0)
-    return 1;
-  return Math.max(1, Math.ceil(trimmedLen / CHARS_PER_TOKEN3));
-}
-function selectWithinTokenBudget(hits, tokenBudget, lambda, embByKey) {
-  if (hits.length === 0)
-    return [];
-  const budget = Math.max(1, Math.trunc(tokenBudget));
-  const lam = Math.min(1, Math.max(0, lambda));
-  const pool = hits.map((hit) => ({
-    hit,
-    rel: hit.score,
-    cost: estimateTokenCount(hit.text),
-    vec: embByKey.get(fusionKey(hit.source, hit.id))
-  }));
-  const selected = [];
-  const remaining = new Set(pool);
-  const seed = pool[0];
-  selected.push(seed);
-  remaining.delete(seed);
-  let used = seed.cost;
-  while (remaining.size > 0) {
-    let best = null;
-    let bestMmr = -Infinity;
-    for (const cand of remaining) {
-      if (used + cand.cost > budget)
-        continue;
-      let maxSim = 0;
-      for (const s of selected) {
-        if (cand.vec === void 0 || s.vec === void 0)
-          continue;
-        const cos = cosineSimilarity(cand.vec, s.vec);
-        if (cos !== null && cos > maxSim)
-          maxSim = cos;
-      }
-      const mmr = lam * cand.rel - (1 - lam) * maxSim;
-      if (mmr > bestMmr) {
-        bestMmr = mmr;
-        best = cand;
-      }
-    }
-    if (best === null)
-      break;
-    selected.push(best);
-    remaining.delete(best);
-    used += best.cost;
-  }
-  return selected.map((s) => s.hit);
-}
-async function recallMemories(request, deps) {
-  const term = request.query.trim();
-  const limit = resolveRecallLimit(request.limit);
-  if (term === "") {
-    return { hits: [], sources: [], degraded: true };
-  }
-  const keywordOnly = deps.recallMode === "keyword";
-  const projectClause = projectConjunctFor(request);
-  const [semanticRun, memoriesRows, memoryRows, sessionsRows] = await Promise.all([
-    keywordOnly ? Promise.resolve(null) : runSemanticArms(request, deps, limit),
-    runArm(buildMemoriesArmSql(term, limit, projectClause), request, deps),
-    runArm(buildMemoryArmSql(term, limit, projectClause), request, deps),
-    runArm(buildSessionsArmSql(term, limit, projectClause), request, deps)
-  ]);
-  const degraded = keywordOnly ? false : semanticRun === null;
-  const arms = [
-    ...semanticRun?.arms ?? [],
-    rowsToRankedArm(memoriesRows),
-    rowsToRankedArm(memoryRows),
-    rowsToRankedArm(sessionsRows)
-  ];
-  const { hits, sources } = fuseHits(arms, limit);
-  const rerankerConfig = deps.reranker ?? { strategy: DEFAULT_RERANKER, timeoutMs: DEFAULT_RERANKER_TIMEOUT_MS, window: DEFAULT_RERANKER_WINDOW };
-  const ranked = semanticRun === null || rerankerConfig.strategy === "none" ? (
-    // No query vector to rerank against, or RRF-only requested → keep the fused order.
-    hits
-  ) : await rerankHits(hits, semanticRun.queryVector, rerankerConfig, request, deps);
-  const dedupConfig = deps.dedup ?? { enabled: DEFAULT_DEDUP_ENABLED, similarityThreshold: DEFAULT_DEDUP_SIMILARITY_THRESHOLD };
-  const deduped = await dedupHits(ranked, dedupConfig, request, deps);
-  const dedupedSources = deduped.length === ranked.length ? sources : [...new Set(deduped.map((h) => h.source))];
-  const byClass = deps.recency?.halfLifeDaysByClass;
-  const activationExponent = deps.recency?.activationExponent ?? DEFAULT_RECENCY_ACTIVATION_EXPONENT;
-  const nowMs = (deps.now ?? Date.now)();
-  const staleness = await resolveStaleness(deduped, deps, request.scope);
-  const activated = deps.activationSource !== void 0 ? await applyActrActivation(deduped, deps.activationSource, byClass, activationExponent, nowMs, request.scope, staleness) : applyRecencyActivation(deduped, byClass, activationExponent, nowMs, staleness);
-  const calibrated = deps.calibration !== void 0 ? await applyCalibrationStage(activated, deps.calibration, request, deps) : activated;
-  const dampened = await applyConflictGate(calibrated, deps, request.scope);
-  const budget = request.tokenBudget;
-  if (typeof budget !== "number" || !Number.isFinite(budget) || budget <= 0) {
-    await recordRecallAccessEvents(dampened, deps);
-    return { hits: dampened, sources: dedupedSources, degraded };
-  }
-  try {
-    const lambda = deps.contextAssembly?.mmrLambda ?? DEFAULT_MMR_LAMBDA;
-    const embByKey = await fetchCandidateEmbeddings(dampened, request, deps);
-    const assembled = selectWithinTokenBudget(dampened, budget, lambda, embByKey);
-    const assembledSources = assembled.length === dampened.length ? dedupedSources : [...new Set(assembled.map((h) => h.source))];
-    await recordRecallAccessEvents(assembled, deps);
-    return { hits: assembled, sources: assembledSources, degraded };
-  } catch {
-    await recordRecallAccessEvents(dampened, deps);
-    return { hits: dampened, sources: dedupedSources, degraded };
-  }
-}
-
-// dist/src/daemon/runtime/secrets/api.js
-var headerScopeResolver2 = {
-  resolve(c) {
-    const org = c.req.header("x-honeycomb-org");
-    if (org === void 0 || org.length === 0)
-      return null;
-    const workspace = c.req.header("x-honeycomb-workspace");
-    const agentId = c.req.header("x-honeycomb-agent");
-    const ws = workspace !== void 0 && workspace.length > 0 ? workspace : "default";
-    return agentId !== void 0 && agentId.length > 0 ? { org, workspace: ws, agentId } : { org, workspace: ws };
-  }
-};
-function mountSecretsApi(group, deps) {
-  const scope = deps.scope ?? headerScopeResolver2;
-  const store = deps.store;
-  const runner = deps.execRunner;
-  if (runner !== void 0) {
-    group.post("/exec", async (c) => {
-      const sc = scope.resolve(c);
-      if (sc === null)
-        return badTenancy(c);
-      const request = await readExecRequest(c, sc);
-      if (request === null) {
-        return c.json({ error: "bad_request", reason: "exec body must carry a command" }, 400);
-      }
-      const res = runner.submit(request);
-      if (!res.ok) {
-        if (res.reason === "queue_full") {
-          return c.json({ error: "queue_full", reason: "exec pool and queue are at capacity" }, 429);
-        }
-        return c.json({ error: "bad_request", reason: "invalid exec request" }, 400);
-      }
-      return c.json({ ok: true, jobId: res.jobId, status: "queued" }, 202);
-    });
-    group.get("/exec/:jobId", (c) => {
-      const sc = scope.resolve(c);
-      if (sc === null)
-        return badTenancy(c);
-      const jobId = c.req.param("jobId");
-      const view = runner.getStatus(jobId, sc);
-      if (view === null) {
-        return c.json({ error: "not_found", reason: "no such exec job" }, 404);
-      }
-      return c.json(view);
-    });
-    group.all("/bitwarden/*", (c) => c.json({ error: "use_exec", reason: "reference a Bitwarden item via exec vaultRefs; values are never returned" }, 400));
-    group.all("/1password/*", (c) => c.json({ error: "use_exec", reason: "reference a 1Password item via exec vaultRefs; values are never returned" }, 400));
-  } else {
-    group.post("/exec", (c) => notImplementedRoute(c, "POST /api/secrets/exec (secret_exec)"));
-    group.get("/exec/:jobId", (c) => notImplementedRoute(c, "GET /api/secrets/exec/:jobId (exec status)"));
-    group.all("/bitwarden/*", (c) => notImplementedRoute(c, "Bitwarden vault provider"));
-    group.all("/1password/*", (c) => notImplementedRoute(c, "1Password vault provider"));
-  }
-  group.get("/", (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const names = store.listSecretNames(sc);
-    return c.json({ names });
-  });
-  group.post("/:name", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const name = c.req.param("name");
-    const value = await readValue(c);
-    if (value === null) {
-      return c.json({ error: "bad_request", reason: "request body must carry a string value" }, 400);
-    }
-    const res = await store.setSecret(name, value, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_name") {
-        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
-      }
-      return c.json({ error: "store_failed", reason: "could not store the secret" }, 502);
-    }
-    return c.json({ ok: true, name }, 201);
-  });
-  group.delete("/:name", (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy(c);
-    const name = c.req.param("name");
-    const res = store.deleteSecret(name, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_name") {
-        return c.json({ error: "bad_request", reason: "invalid secret name" }, 400);
-      }
-      if (res.reason === "not_found") {
-        return c.json({ error: "not_found", reason: "no such secret" }, 404);
-      }
-      return c.json({ error: "delete_failed", reason: "could not delete the secret" }, 502);
-    }
-    return c.json({ ok: true, name });
-  });
-}
-function badTenancy(c) {
-  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
-}
-async function readValue(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    try {
-      const body = await c.req.json();
-      if (typeof body === "object" && body !== null) {
-        const v = body.value;
-        if (typeof v === "string" && v.length > 0)
-          return v;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-  const text = await c.req.text();
-  return text.length > 0 ? text : null;
-}
-function notImplementedRoute(c, what) {
-  return c.json({ error: "not_implemented", reason: `${what} is implemented in PRD-012b` }, 501);
-}
-async function readExecRequest(c, scope) {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return null;
-  }
-  if (typeof body !== "object" || body === null)
-    return null;
-  const b = body;
-  const command = b.command;
-  if (typeof command !== "string" || command.length === 0)
-    return null;
-  const args = Array.isArray(b.args) ? b.args.filter((a) => typeof a === "string") : [];
-  const secretNames = Array.isArray(b.secretNames) ? b.secretNames.filter((n) => typeof n === "string") : [];
-  const vaultRefs = {};
-  if (typeof b.vaultRefs === "object" && b.vaultRefs !== null) {
-    for (const [k, v] of Object.entries(b.vaultRefs)) {
-      if (typeof v === "string")
-        vaultRefs[k] = v;
-    }
-  }
-  const timeoutMs = typeof b.timeoutMs === "number" ? b.timeoutMs : void 0;
-  return { command, args, secretNames, vaultRefs, scope, timeoutMs };
-}
-
-// dist/src/daemon/runtime/vault/catalog.js
-var PROVIDER_CATALOG = Object.freeze([
-  Object.freeze({
-    id: "anthropic",
-    label: "Anthropic",
-    models: Object.freeze(["claude-sonnet-4-6", "claude-opus-4-8"]),
-    openEnded: false
-  }),
-  Object.freeze({
-    id: "openai",
-    label: "OpenAI",
-    models: Object.freeze(["gpt-4o", "gpt-4o-mini", "gpt-4.1"]),
-    openEnded: false
-  }),
-  Object.freeze({
-    id: "openrouter",
-    label: "OpenRouter",
-    // Suggestions only — OpenRouter accepts a free-form `vendor/model` id (passthrough).
-    models: Object.freeze(["anthropic/claude-sonnet-4.6", "openai/gpt-4o"]),
-    openEnded: true
-  })
-]);
-function providerEntry(provider) {
-  return PROVIDER_CATALOG.find((p) => p.id === provider);
-}
-function isValidProviderModel(provider, model) {
-  const entry = providerEntry(provider);
-  if (entry === void 0)
-    return false;
-  if (typeof model !== "string" || model.length === 0)
-    return false;
-  if (entry.openEnded)
-    return true;
-  return entry.models.includes(model);
-}
-function catalogView() {
-  return PROVIDER_CATALOG;
-}
-
-// dist/src/daemon/runtime/secrets/contracts.js
-import { homedir as homedir20, hostname as hostname4, userInfo } from "node:os";
-var SECRET_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
-var MAX_SECRET_NAME_LENGTH = 128;
-function isValidSecretName(value) {
-  if (typeof value !== "string")
-    return false;
-  if (value.length === 0 || value.length > MAX_SECRET_NAME_LENGTH)
-    return false;
-  if (value === "." || value === "..")
-    return false;
-  if (value.includes("/") || value.includes("\\") || value.includes("\0"))
-    return false;
-  return SECRET_NAME_PATTERN.test(value);
-}
-function asSecretName(value) {
-  return isValidSecretName(value) ? value : null;
-}
-function isSecretRecord(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const r = value;
-  if (typeof r.nonce !== "string" || typeof r.ciphertext !== "string" || typeof r.createdAt !== "string") {
-    return false;
-  }
-  const scope = r.scope;
-  if (typeof scope !== "object" || scope === null)
-    return false;
-  const s = scope;
-  if (typeof s.org !== "string" || typeof s.workspace !== "string")
-    return false;
-  if (s.agentId !== void 0 && typeof s.agentId !== "string")
-    return false;
-  return true;
-}
-var MACHINE_KEY_DIR_NAME = ".honeycomb";
-var MACHINE_KEY_FILE_NAME = ".machine-key";
-function hostnameUserFallbackId() {
-  let user = "";
-  try {
-    user = userInfo().username;
-  } catch {
-    user = "";
-  }
-  return `host:${hostname4()}|user:${user}|home:${homedir20()}`;
-}
-
-// dist/src/daemon/runtime/vault/contracts.js
-function asRecordClass(value) {
-  return isValidSecretName(value) ? value : null;
-}
-
-// dist/src/daemon/runtime/vault/registry.js
-var SECRET_CLASS = "secret";
-var SETTING_CLASS = "setting";
-var SecretValueSchema = external_exports.string().min(1);
-var SettingValueSchema = external_exports.union([external_exports.string(), external_exports.number().finite(), external_exports.boolean()]);
-var SECRET_DESCRIPTOR = Object.freeze({
-  id: SECRET_CLASS,
-  posture: "internal-only",
-  schema: SecretValueSchema
-});
-var SETTING_DESCRIPTOR = Object.freeze({
-  id: SETTING_CLASS,
-  posture: "daemon-readable",
-  schema: SettingValueSchema
-});
-var VaultRegistry = class {
-  table;
-  constructor(descriptors) {
-    this.table = /* @__PURE__ */ new Map();
-    for (const d of descriptors)
-      this.table.set(d.id, d);
-  }
-  /**
-   * Register a new record class (D-7). Validates the id is traversal-proof (a class is an
-   * on-disk segment) and that the posture is one the store understands, then adds the
-   * descriptor. Re-registering an existing id REPLACES it (so a test can swap a throwaway
-   * class); registering the built-in `secret`/`setting` ids is allowed but discouraged —
-   * their posture must not be loosened. Returns the registry for chaining.
-   *
-   * Throws on an invalid (traversal-unsafe) class id — that is a programming error, not a
-   * runtime input, so it fails loud rather than silently dropping the class.
-   */
-  registerClass(descriptor) {
-    const safe = asRecordClass(descriptor.id);
-    if (safe === null) {
-      throw new Error(`vault.registerClass: invalid (traversal-unsafe) class id`);
-    }
-    this.table.set(descriptor.id, descriptor);
-    return this;
-  }
-  /** Whether a class id is registered. */
-  has(klass) {
-    return this.table.has(klass);
-  }
-  /** The registered class ids (sorted), for diagnostics — never values. */
-  classIds() {
-    return [...this.table.keys()].sort();
-  }
-  /**
-   * Resolve a class's descriptor for a WRITE, validating the value against the class
-   * schema (zod-at-boundary). Returns `unknown_class` for an unregistered class or
-   * `invalid_value` when the value fails the schema — both fail-closed (nothing is
-   * written). On success the descriptor (with the validated value available via the
-   * caller's re-parse) is returned.
-   */
-  resolveForWrite(klass, value) {
-    const descriptor = this.table.get(klass);
-    if (descriptor === void 0)
-      return { ok: false, reason: "unknown_class" };
-    const parsed = descriptor.schema.safeParse(value);
-    if (!parsed.success)
-      return { ok: false, reason: "invalid_value" };
-    return { ok: true, descriptor };
-  }
-  /**
-   * The POSTURE GATE (a-AC-2). Resolve a class's descriptor for a READ that intends to
-   * RETURN the value to a surface (the `getSetting` path). REJECTS a class whose posture
-   * is `internal-only` with `not_readable` — so a `secret` can NEVER be read back through
-   * the daemon-readable accessor. An unknown class is `unknown_class`. This is the single
-   * point where the secret-vs-setting security boundary is enforced, as data.
-   */
-  assertReadable(klass) {
-    const descriptor = this.table.get(klass);
-    if (descriptor === void 0)
-      return { ok: false, reason: "unknown_class" };
-    if (descriptor.posture !== "daemon-readable")
-      return { ok: false, reason: "not_readable" };
-    return { ok: true, descriptor };
-  }
-  /** Resolve a descriptor with no value/posture check (internal callers that already gate). */
-  descriptorOf(klass) {
-    return this.table.get(klass);
-  }
-};
-function createVaultRegistry(extra = []) {
-  return new VaultRegistry([SECRET_DESCRIPTOR, SETTING_DESCRIPTOR, ...extra]);
-}
-
-// dist/src/daemon/runtime/vault/api.js
-var SETTINGS_GROUP = "/api/settings";
-var KNOWN_SETTING_KEYS = ["activeProvider", "activeModel", "pollinating.enabled", "recallMode"];
-var RECALL_MODES = ["keyword", "semantic", "hybrid"];
-function isValidRecallMode(value) {
-  return RECALL_MODES.includes(value);
-}
-var DASHBOARD_PREF_PREFIX = "dashboard.";
-function isKnownSettingKey(key) {
-  if (KNOWN_SETTING_KEYS.includes(key))
-    return true;
-  return key.startsWith(DASHBOARD_PREF_PREFIX) && key.length > DASHBOARD_PREF_PREFIX.length;
-}
-function mountSettingsGroup(group, deps) {
-  const scope = deps.scope ?? headerScopeResolver2;
-  const store = deps.store;
-  group.get("/", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const keys = store.listSettingKeys(sc);
-    const settings = {};
-    for (const key of keys) {
-      const res = await store.getSetting(key, sc);
-      if (res.ok)
-        settings[key] = res.value;
-    }
-    return c.json({ settings, catalog: catalogView() });
+    if (b.score !== a.score)
+      return b.score - a.score;
+    return a.index - b.index;
   });
-  group.get("/:key", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const key = c.req.param("key");
-    if (!isKnownSettingKey(key)) {
-      return c.json({ error: "not_found", reason: "no such setting" }, 404);
-    }
-    const res = await store.getSetting(key, sc);
-    if (!res.ok) {
-      if (res.reason === "not_found")
-        return c.json({ error: "not_found", reason: "no such setting" }, 404);
-      if (res.reason === "not_readable")
-        return c.json({ error: "not_found", reason: "no such setting" }, 404);
-      return c.json({ error: "read_failed", reason: "could not read the setting" }, 502);
+  return activated.map(({ hit, activation, score, staleFields }) => ({ ...hit, ...staleFields, score, freshnessScore: activation }));
+}
+async function applyActrActivation(hits, source, byClass, activationExponent, nowMs, scope, staleness) {
+  const exponent = Math.max(0, Number.isFinite(activationExponent) ? activationExponent : DEFAULT_RECENCY_ACTIVATION_EXPONENT);
+  const params = source.params ?? DEFAULT_ACTR_PARAMS;
+  let inputs;
+  try {
+    inputs = await source.load(hits, scope);
+  } catch {
+    return applyRecencyActivation(hits, byClass, activationExponent, nowMs, staleness);
+  }
+  const computed = hits.map((hit, index) => {
+    const key = fusionKey(hit.source, hit.id);
+    const input = inputs.get(key);
+    if (input === void 0) {
+      const halfLife = halfLifeForSource(hit.source, byClass);
+      const lastReinforcedAt = hit.lastReinforcedAt;
+      const a2 = recencyActivation(refTimestampMs(hit.createdAt, lastReinforcedAt), nowMs, halfLife);
+      return { hit, index, activation: a2, accessCount: void 0 };
     }
-    return c.json({ key, value: res.value });
+    const a = actrActivation(input.history, nowMs, params);
+    return { hit, index, activation: a, accessCount: input.accessCount };
   });
-  group.post("/:key", async (c) => {
-    const sc = scope.resolve(c);
-    if (sc === null)
-      return badTenancy2(c);
-    const key = c.req.param("key");
-    if (!isKnownSettingKey(key)) {
-      return c.json({ error: "bad_request", reason: "unknown setting key" }, 400);
-    }
-    const value = await readSettingValue(c);
-    if (value === null) {
-      return c.json({ error: "bad_request", reason: "request body must carry a scalar value" }, 400);
-    }
-    const semanticError = await validateSettingSemantics(store, sc, key, value);
-    if (semanticError !== null) {
-      return c.json({ error: "bad_request", reason: semanticError }, 400);
-    }
-    const res = await store.setSetting(key, value, sc);
-    if (!res.ok) {
-      if (res.reason === "invalid_value") {
-        return c.json({ error: "bad_request", reason: "invalid setting value" }, 400);
-      }
-      if (res.reason === "not_readable" || res.reason === "unknown_class") {
-        return c.json({ error: "bad_request", reason: "setting class is not writable" }, 400);
-      }
-      return c.json({ error: "store_failed", reason: "could not store the setting" }, 502);
+  const adjusted = computed.map((c) => {
+    const stale = stalenessContribution(c.hit, staleness);
+    const orderingWeight = (exponent === 1 ? c.activation : Math.pow(c.activation, exponent)) * stale.factor;
+    return { ...c, staleFields: stale.fields, orderingWeight, score: c.hit.score * orderingWeight };
+  });
+  const stamp = (c) => ({
+    ...c.hit,
+    ...c.staleFields,
+    score: c.score,
+    freshnessScore: c.activation,
+    // the swap: A_actr behind the SAME field 058a used (PRD-058e).
+    activation: c.activation,
+    ...c.accessCount !== void 0 ? { accessCount: c.accessCount } : {}
+  });
+  const anyPenalty = adjusted.some((c) => c.orderingWeight < 1);
+  if (!anyPenalty) {
+    return adjusted.map(stamp);
+  }
+  const ordered = [...adjusted].sort((a, b) => {
+    if (b.score !== a.score)
+      return b.score - a.score;
+    return a.index - b.index;
+  });
+  return ordered.map(stamp);
+}
+function buildConfidenceFetchSql(ids) {
+  const tbl = sqlIdent("memories");
+  const idCol = sqlIdent("id");
+  const confCol = sqlIdent("confidence");
+  const inList = ids.map((id) => sLiteral(id)).join(", ");
+  return `SELECT ${idCol} AS id, ${confCol} AS confidence FROM "${tbl}" WHERE ${idCol} IN (${inList})`;
+}
+async function applyCalibrationStage(hits, model, request, deps) {
+  const memoryIds = hits.filter((h) => h.source === "memories" && h.id !== "").map((h) => h.id);
+  if (memoryIds.length === 0)
+    return [...hits];
+  let confById = /* @__PURE__ */ new Map();
+  try {
+    const rows = await runArm(buildConfidenceFetchSql(memoryIds), request, deps);
+    for (const row of rows) {
+      const id = cell(row.id);
+      if (id === "")
+        continue;
+      const f = typeof row.confidence === "number" ? row.confidence : Number(row.confidence);
+      if (Number.isFinite(f))
+        confById.set(id, f);
     }
-    return c.json({ ok: true, key, value }, 201);
+  } catch {
+    return [...hits];
+  }
+  return hits.map((hit) => {
+    if (hit.source !== "memories")
+      return hit;
+    const f = confById.get(hit.id);
+    if (f === void 0)
+      return hit;
+    const c = applyCalibration(model, f);
+    return { ...hit, rawConfidence: f, calibratedConfidence: c };
   });
 }
-function mountSettingsApi(daemon, deps) {
-  const group = daemon.group(SETTINGS_GROUP);
-  if (group === void 0)
+async function recordRecallAccessEvents(hits, deps) {
+  const record2 = deps.recordRecallAccess;
+  if (record2 === void 0)
     return;
-  mountSettingsGroup(group, deps);
+  const ids = hits.filter((h) => h.source === "memories" && h.id !== "").map((h) => h.id);
+  await Promise.all(ids.map(async (id) => {
+    try {
+      await record2(id);
+    } catch {
+    }
+  }));
 }
-function badTenancy2(c) {
-  return c.json({ error: "bad_request", reason: "x-honeycomb-org header is required" }, 400);
+var CHARS_PER_TOKEN3 = 4;
+function estimateTokenCount(text) {
+  const trimmedLen = text.trim().length;
+  if (trimmedLen === 0)
+    return 1;
+  return Math.max(1, Math.ceil(trimmedLen / CHARS_PER_TOKEN3));
 }
-async function readSettingValue(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    try {
-      const body = await c.req.json();
-      if (typeof body === "object" && body !== null) {
-        const v = body.value;
-        const parsed = SettingValueSchema.safeParse(v);
-        return parsed.success ? parsed.data : null;
+function selectWithinTokenBudget(hits, tokenBudget, lambda, embByKey) {
+  if (hits.length === 0)
+    return [];
+  const budget = Math.max(1, Math.trunc(tokenBudget));
+  const lam = Math.min(1, Math.max(0, lambda));
+  const pool = hits.map((hit) => ({
+    hit,
+    rel: hit.score,
+    cost: estimateTokenCount(hit.text),
+    vec: embByKey.get(fusionKey(hit.source, hit.id))
+  }));
+  const selected = [];
+  const remaining = new Set(pool);
+  const seed = pool[0];
+  selected.push(seed);
+  remaining.delete(seed);
+  let used = seed.cost;
+  while (remaining.size > 0) {
+    let best = null;
+    let bestMmr = -Infinity;
+    for (const cand of remaining) {
+      if (used + cand.cost > budget)
+        continue;
+      let maxSim = 0;
+      for (const s of selected) {
+        if (cand.vec === void 0 || s.vec === void 0)
+          continue;
+        const cos = cosineSimilarity(cand.vec, s.vec);
+        if (cos !== null && cos > maxSim)
+          maxSim = cos;
+      }
+      const mmr = lam * cand.rel - (1 - lam) * maxSim;
+      if (mmr > bestMmr) {
+        bestMmr = mmr;
+        best = cand;
       }
-      return null;
-    } catch {
-      return null;
     }
+    if (best === null)
+      break;
+    selected.push(best);
+    remaining.delete(best);
+    used += best.cost;
   }
-  const text = await c.req.text();
-  return text.length > 0 ? text : null;
+  return selected.map((s) => s.hit);
 }
-async function validateSettingSemantics(store, scope, key, value) {
-  if (key === "activeProvider") {
-    if (providerEntry(String(value)) === void 0)
-      return "unknown provider";
-    return null;
+async function recallMemories(request, deps) {
+  const term = request.query.trim();
+  const limit = resolveRecallLimit(request.limit);
+  if (term === "") {
+    return { hits: [], sources: [], degraded: true };
   }
-  if (key === "activeModel") {
-    const provRes = await store.getSetting("activeProvider", scope);
-    const provider = provRes.ok ? String(provRes.value) : "";
-    if (provider.length === 0)
-      return "set activeProvider before activeModel";
-    if (!isValidProviderModel(provider, String(value)))
-      return "model not in provider catalog";
-    return null;
+  const keywordOnly = deps.recallMode === "keyword";
+  const projectClause = projectConjunctFor(request);
+  const [semanticRun, memoriesRows, memoryRows, sessionsRows] = await Promise.all([
+    keywordOnly ? Promise.resolve(null) : runSemanticArms(request, deps, limit),
+    runArm(buildMemoriesArmSql(term, limit, projectClause), request, deps),
+    runArm(buildMemoryArmSql(term, limit, projectClause), request, deps),
+    runArm(buildSessionsArmSql(term, limit, projectClause), request, deps)
+  ]);
+  const degraded = keywordOnly ? false : semanticRun === null;
+  const arms = [
+    ...semanticRun?.arms ?? [],
+    rowsToRankedArm(memoriesRows),
+    rowsToRankedArm(memoryRows),
+    rowsToRankedArm(sessionsRows)
+  ];
+  const { hits, sources } = fuseHits(arms, limit);
+  const rerankerConfig = deps.reranker ?? {
+    strategy: DEFAULT_RERANKER,
+    timeoutMs: DEFAULT_RERANKER_TIMEOUT_MS,
+    providerTimeoutMs: DEFAULT_RERANKER_PROVIDER_TIMEOUT_MS,
+    window: DEFAULT_RERANKER_WINDOW,
+    cohereModel: DEFAULT_RERANKER_COHERE_MODEL
+  };
+  const skipRerank = rerankerConfig.strategy === "none" || rerankerConfig.strategy !== "cohere" && semanticRun === null;
+  const ranked = skipRerank ? hits : await rerankHits(hits, semanticRun?.queryVector ?? null, rerankerConfig, request, deps);
+  const dedupConfig = deps.dedup ?? { enabled: DEFAULT_DEDUP_ENABLED, similarityThreshold: DEFAULT_DEDUP_SIMILARITY_THRESHOLD };
+  const deduped = await dedupHits(ranked, dedupConfig, request, deps);
+  const dedupedSources = deduped.length === ranked.length ? sources : [...new Set(deduped.map((h) => h.source))];
+  const byClass = deps.recency?.halfLifeDaysByClass;
+  const activationExponent = deps.recency?.activationExponent ?? DEFAULT_RECENCY_ACTIVATION_EXPONENT;
+  const nowMs = (deps.now ?? Date.now)();
+  const staleness = await resolveStaleness(deduped, deps, request.scope);
+  const activated = deps.activationSource !== void 0 ? await applyActrActivation(deduped, deps.activationSource, byClass, activationExponent, nowMs, request.scope, staleness) : applyRecencyActivation(deduped, byClass, activationExponent, nowMs, staleness);
+  const calibrated = deps.calibration !== void 0 ? await applyCalibrationStage(activated, deps.calibration, request, deps) : activated;
+  const dampened = await applyConflictGate(calibrated, deps, request.scope);
+  const budget = request.tokenBudget;
+  if (typeof budget !== "number" || !Number.isFinite(budget) || budget <= 0) {
+    await recordRecallAccessEvents(dampened, deps);
+    return { hits: dampened, sources: dedupedSources, degraded };
   }
-  if (key === "recallMode") {
-    if (!isValidRecallMode(String(value)))
-      return "recallMode must be keyword, semantic, or hybrid";
-    return null;
+  try {
+    const lambda = deps.contextAssembly?.mmrLambda ?? DEFAULT_MMR_LAMBDA;
+    const embByKey = await fetchCandidateEmbeddings(dampened, request, deps);
+    const assembled = selectWithinTokenBudget(dampened, budget, lambda, embByKey);
+    const assembledSources = assembled.length === dampened.length ? dedupedSources : [...new Set(assembled.map((h) => h.source))];
+    await recordRecallAccessEvents(assembled, deps);
+    return { hits: assembled, sources: assembledSources, degraded };
+  } catch {
+    await recordRecallAccessEvents(dampened, deps);
+    return { hits: dampened, sources: dedupedSources, degraded };
   }
-  return null;
 }
 
 // dist/src/daemon/runtime/memories/calibration-store.js
@@ -43335,7 +44621,13 @@ function mountMemoriesApi(daemon, options) {
       // PRD-058a: the per-request recency override (per-class half-lives + activation exponent).
       ...recency !== void 0 ? { recency } : {},
       // PRD-058b: the κ gate's conflict-suppression seam (drops the κ = ρ open-conflict loser).
-      ...options.conflictSuppression !== void 0 ? { conflictSuppression: options.conflictSuppression } : {}
+      ...options.conflictSuppression !== void 0 ? { conflictSuppression: options.conflictSuppression } : {},
+      // PRD-063c: the operator-selected reranker config + the Cohere-via-Portkey seam. The
+      // `cohere` strategy activates ONLY when BOTH are present (the strategy is `cohere` AND the
+      // gateway-on seam is wired); otherwise the engine keeps the RRF order / runs the local
+      // cosine path — byte-identical to today (c-AC-4).
+      ...options.reranker !== void 0 ? { reranker: options.reranker } : {},
+      ...options.cohereRerank !== void 0 ? { cohereRerank: options.cohereRerank } : {}
     });
     logDegradedRecall(options.logger, result);
     logProjectScopeDegraded(options.logger, project);
@@ -44803,7 +46095,7 @@ var DISCOVERY_POLLS = 20;
 var DISCOVERY_POLL_DELAY_MS = 400;
 var DISCOVERY_STABLE_BREAK = 4;
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function nowIso7() {
   return (/* @__PURE__ */ new Date()).toISOString();
@@ -46041,7 +47333,7 @@ function guardedLookup(allowLoopback) {
 }
 function requestOnce(url2, timeoutMs, maxBytes, allowLoopback) {
   const requestFn = url2.protocol === "https:" ? httpsRequest : httpRequest;
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const req = requestFn(url2, {
       method: "GET",
       headers: { "user-agent": USER_AGENT, accept: "*/*" },
@@ -46068,7 +47360,7 @@ function requestOnce(url2, timeoutMs, maxBytes, allowLoopback) {
         if (aborted2)
           return;
         const location = res.headers.location;
-        resolve6({
+        resolve7({
           status: res.statusCode ?? 0,
           location: typeof location === "string" ? location : void 0,
           contentType: typeof res.headers["content-type"] === "string" ? res.headers["content-type"] : "",
@@ -47242,7 +48534,7 @@ function buildSourcesApiDeps(options) {
 // dist/src/daemon/runtime/secrets/store.js
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync16, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync7, statSync as statSync3, writeFileSync as writeFileSync13 } from "node:fs";
+import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync16, readdirSync as readdirSync4, readFileSync as readFileSync18, rmSync as rmSync8, statSync as statSync3, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
 import { join as join27 } from "node:path";
 
@@ -48114,7 +49406,7 @@ var SecretsStore = class {
       return { ok: false, reason: "not_found" };
     }
     try {
-      rmSync7(file2);
+      rmSync8(file2);
       this.audit("deleted", scope, "ok", safe);
       return { ok: true };
     } catch {
@@ -48235,7 +49527,7 @@ function stripRefWrapper(ref) {
 }
 
 // dist/src/daemon/runtime/vault/store.js
-import { appendFileSync as appendFileSync2, existsSync as existsSync19, mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync19, mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync19, rmSync as rmSync9, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join28 } from "node:path";
 var VAULT_DIR_NAME = ".vault";
 var VAULT_AUDIT_FILE_NAME = "vault-audit.ndjson";
@@ -48409,7 +49701,7 @@ var VaultStore = class {
       return { ok: false, reason: "not_found" };
     }
     try {
-      rmSync8(file2);
+      rmSync9(file2);
       this.audit(safeClass, "deleted", scope, "ok", safe);
       return { ok: true };
     } catch {
@@ -49344,12 +50636,64 @@ var RouterModelClient = class {
 var ANTHROPIC_MESSAGES_URL = "https://api.anthropic.com/v1/messages";
 var ANTHROPIC_VERSION = "2023-06-01";
 var DEFAULT_MAX_TOKENS = 4096;
+var noopUsageSink = {
+  record() {
+  }
+};
+function usageReportingTransport(post, usageSink) {
+  function reportUsage(usage) {
+    try {
+      usageSink.record(usage);
+    } catch {
+    }
+  }
+  return {
+    async execute(call) {
+      const { output, usage } = await post(call);
+      reportUsage(usage);
+      return { output };
+    },
+    stream(call) {
+      async function* gen() {
+        const { output, usage } = await post(call);
+        reportUsage(usage);
+        yield { delta: output };
+      }
+      return gen();
+    }
+  };
+}
+function safeJsonParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
 var AnthropicContentBlockSchema = external_exports.object({
   type: external_exports.string(),
   text: external_exports.string().optional()
 });
+var AnthropicUsageSchema = external_exports.object({
+  input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  output_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  cache_read_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  cache_creation_input_tokens: external_exports.number().int().nonnegative().catch(0).default(0)
+});
+var ZERO_USAGE = {
+  input_tokens: 0,
+  output_tokens: 0,
+  cache_read_input_tokens: 0,
+  cache_creation_input_tokens: 0
+};
 var AnthropicMessagesResponseSchema = external_exports.object({
-  content: external_exports.array(AnthropicContentBlockSchema).default([])
+  content: external_exports.array(AnthropicContentBlockSchema).default([]),
+  // Finding (usage-failsoft): `.default(ZERO_USAGE)` only covers `usage === undefined`. A response with
+  // `usage: null` or a malformed `usage` object would FAIL the object parse and -- because this field is
+  // part of the whole-response schema -- bubble up to a 502 that DROPS an otherwise-valid completion.
+  // `.catch(ZERO_USAGE)` makes ANY invalid value (null, a string, a malformed object) fall back to
+  // zero-usage so a valid completion is NEVER dropped over its (side-channel) usage block.
+  usage: AnthropicUsageSchema.default(ZERO_USAGE).catch(ZERO_USAGE)
 });
 function toAnthropicBody(call, defaultMaxTokens) {
   const systemParts = [];
@@ -49377,6 +50721,7 @@ function createAnthropicTransport(deps = {}) {
   const doFetch = deps.fetch ?? globalThis.fetch;
   const url2 = deps.baseUrl ?? ANTHROPIC_MESSAGES_URL;
   const defaultMaxTokens = deps.defaultMaxTokens ?? DEFAULT_MAX_TOKENS;
+  const usageSink = deps.usageSink ?? noopUsageSink;
   async function post(call) {
     const body = toAnthropicBody(call, defaultMaxTokens);
     let res;
@@ -49397,36 +50742,130 @@ function createAnthropicTransport(deps = {}) {
     if (!res.ok) {
       throw new ProviderError(res.status, `anthropic transport: provider returned status ${res.status}`);
     }
-    const raw2 = await res.text().then((t) => safeJson2(t));
+    const raw2 = await res.text().then((t) => safeJsonParse(t));
     const parsed = AnthropicMessagesResponseSchema.safeParse(raw2);
     if (!parsed.success) {
       throw new ProviderError(502, "anthropic transport: malformed provider response");
     }
-    return joinContentText(parsed.data.content);
+    const u = parsed.data.usage;
+    const usage = {
+      model: call.target.model,
+      workload: call.request.workload,
+      inputTokens: u.input_tokens,
+      outputTokens: u.output_tokens,
+      cacheReadInputTokens: u.cache_read_input_tokens,
+      cacheCreationInputTokens: u.cache_creation_input_tokens
+    };
+    return { output: joinContentText(parsed.data.content), usage };
   }
+  return usageReportingTransport(post, usageSink);
+}
+
+// dist/src/daemon/runtime/inference/transport-portkey.js
+var PORTKEY_BASE_URL = "https://api.portkey.ai/v1";
+var PORTKEY_CHAT_COMPLETIONS_URL = `${PORTKEY_BASE_URL}/chat/completions`;
+var PORTKEY_RERANK_URL = `${PORTKEY_BASE_URL}/rerank`;
+var PORTKEY_API_KEY_HEADER = "x-portkey-api-key";
+var PORTKEY_CONFIG_HEADER = "x-portkey-config";
+function buildPortkeyHeaders(apiKey, configId) {
   return {
-    async execute(call) {
-      const output = await post(call);
-      return { output };
-    },
-    stream(call) {
-      async function* gen() {
-        const output = await post(call);
-        yield { delta: output };
-      }
-      return gen();
-    }
+    [PORTKEY_API_KEY_HEADER]: apiKey,
+    [PORTKEY_CONFIG_HEADER]: configId,
+    "content-type": "application/json"
   };
 }
-function safeJson2(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return void 0;
+var PORTKEY_DEFAULT_MAX_TOKENS = 4096;
+var PortkeyChoiceSchema = external_exports.object({
+  message: external_exports.object({ content: external_exports.string().nullable().optional() }).optional()
+});
+var PortkeyUsageSchema = external_exports.object({
+  prompt_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  completion_tokens: external_exports.number().int().nonnegative().catch(0).default(0),
+  prompt_tokens_details: external_exports.object({ cached_tokens: external_exports.number().int().nonnegative().catch(0).default(0) }).partial().optional()
+});
+var ZERO_PORTKEY_USAGE = { prompt_tokens: 0, completion_tokens: 0 };
+var PortkeyChatResponseSchema = external_exports.object({
+  choices: external_exports.array(PortkeyChoiceSchema).default([]),
+  // As with the Anthropic transport's usage block: `.catch()` so ANY invalid `usage` value
+  // (null, a string, a malformed object) falls back to zero-usage and a VALID completion is
+  // never dropped over its (side-channel) usage block.
+  usage: PortkeyUsageSchema.default(ZERO_PORTKEY_USAGE).catch(ZERO_PORTKEY_USAGE)
+});
+function toPortkeyBody(call, defaultMaxTokens) {
+  return {
+    model: call.target.model,
+    max_tokens: call.request.maxTokens ?? defaultMaxTokens,
+    messages: call.request.messages.map((m) => ({ role: m.role, content: m.content }))
+  };
+}
+function joinChoiceText(choices) {
+  return choices.map((c) => c.message?.content).filter((t) => typeof t === "string").join("");
+}
+function createPortkeyTransport(deps) {
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  const url2 = deps.baseUrl ?? PORTKEY_CHAT_COMPLETIONS_URL;
+  const defaultMaxTokens = deps.defaultMaxTokens ?? PORTKEY_DEFAULT_MAX_TOKENS;
+  const usageSink = deps.usageSink ?? noopUsageSink;
+  const configId = deps.config;
+  const onTransportError = deps.onTransportError;
+  function reportTransportError(statusCode) {
+    if (onTransportError === void 0)
+      return;
+    try {
+      onTransportError(statusCode);
+    } catch {
+    }
+  }
+  async function post(call) {
+    const body = toPortkeyBody(call, defaultMaxTokens);
+    let res;
+    try {
+      res = await doFetch(url2, {
+        method: "POST",
+        headers: buildPortkeyHeaders(call.apiKey, configId),
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      reportTransportError(503);
+      const detail = err instanceof Error ? err.name : "network error";
+      throw new ProviderError(503, `portkey transport: request failed (${detail})`);
+    }
+    if (!res.ok) {
+      reportTransportError(res.status);
+      throw new ProviderError(res.status, `portkey transport: gateway returned status ${res.status}`);
+    }
+    const raw2 = await res.text().then((t) => safeJsonParse(t));
+    const parsed = PortkeyChatResponseSchema.safeParse(raw2);
+    if (!parsed.success) {
+      throw new ProviderError(502, "portkey transport: malformed gateway response");
+    }
+    const u = parsed.data.usage;
+    const usage = {
+      model: call.target.model,
+      workload: call.request.workload,
+      inputTokens: u.prompt_tokens,
+      outputTokens: u.completion_tokens,
+      cacheReadInputTokens: u.prompt_tokens_details?.cached_tokens ?? 0,
+      // Portkey's OpenAI-shaped usage has no cache-WRITE field; surface 0 (never fabricate).
+      cacheCreationInputTokens: 0
+    };
+    return { output: joinChoiceText(parsed.data.choices), usage };
   }
+  return usageReportingTransport(post, usageSink);
 }
 
 // dist/src/daemon/runtime/inference/model-client-factory.js
+var PORTKEY_API_KEY_REF = "${PORTKEY_API_KEY}";
+var PORTKEY_API_KEY_NAME = "PORTKEY_API_KEY";
+var PORTKEY_ACCOUNT_ID = "portkey-gateway";
+var PORTKEY_TARGET_ID = "portkey-target";
+var PORTKEY_POLICY_ID = "portkey-default";
+var PortkeyUnconfiguredError = class extends Error {
+  constructor() {
+    super("portkey: enabled but PORTKEY_API_KEY is not set (fail-closed; set the key or disable portkey.enabled)");
+    this.name = "PortkeyUnconfiguredError";
+  }
+};
 async function resolveConfig3(source) {
   if (typeof source === "string") {
     return loadInferenceConfigFromYaml(source);
@@ -49444,7 +50883,7 @@ function applyProviderModelOverride(config2, override) {
     workloads: config2.workloads
   };
 }
-async function buildInferenceModelClient(deps) {
+async function buildProviderPathClient(deps) {
   let config2;
   try {
     config2 = await resolveConfig3(deps.config);
@@ -49456,7 +50895,7 @@ async function buildInferenceModelClient(deps) {
   }
   const effectiveConfig = deps.providerModelOverride !== void 0 ? applyProviderModelOverride(config2, deps.providerModelOverride) : config2;
   const secrets = createSecretResolver(deps.secretsStore, deps.scope);
-  const transport = createAnthropicTransport();
+  const transport = createAnthropicTransport(deps.usageSink !== void 0 ? { usageSink: deps.usageSink } : {});
   const router = createInferenceRouter({
     config: effectiveConfig,
     transport,
@@ -49465,6 +50904,161 @@ async function buildInferenceModelClient(deps) {
   });
   return new RouterModelClient(router);
 }
+async function buildInferenceModelClient(deps) {
+  const { client } = await buildInferenceModelClientWithStatus(deps);
+  return client;
+}
+async function buildInferenceModelClientWithStatus(deps) {
+  const portkey = deps.portkey;
+  if (portkey === void 0 || !portkey.enabled) {
+    return { client: await buildProviderPathClient(deps), portkeyStatus: "off" };
+  }
+  try {
+    const client = await resolvePortkeyClient(deps, portkey);
+    return { client, portkeyStatus: "ok" };
+  } catch (err) {
+    if (err instanceof PortkeyUnconfiguredError) {
+      return { client: noopModelClient, portkeyStatus: "unconfigured" };
+    }
+    return { client: noopModelClient, portkeyStatus: "unconfigured" };
+  }
+}
+async function resolvePortkeyClient(deps, portkey) {
+  const names = deps.secretsStore.listSecretNames(deps.scope);
+  if (!names.includes(PORTKEY_API_KEY_NAME)) {
+    throw new PortkeyUnconfiguredError();
+  }
+  const secrets = createSecretResolver(deps.secretsStore, deps.scope);
+  const transport = createPortkeyTransport({
+    config: portkey.config,
+    ...deps.usageSink !== void 0 ? { usageSink: deps.usageSink } : {},
+    ...deps.onPortkeyUnreachable !== void 0 ? { onTransportError: deps.onPortkeyUnreachable } : {}
+  });
+  const router = createInferenceRouter({
+    config: buildPortkeyConfig(portkey.model),
+    transport,
+    secrets,
+    history: deps.history ?? noopRoutingHistoryStore
+  });
+  const portkeyClient = new RouterModelClient(router);
+  if (!portkey.fallbackToProvider) {
+    return portkeyClient;
+  }
+  const providerClient = await buildProviderPathClient(deps);
+  return new PortkeyFallbackModelClient(portkeyClient, providerClient);
+}
+function buildPortkeyConfig(model) {
+  return {
+    accounts: [{ id: PORTKEY_ACCOUNT_ID, provider: "portkey", apiKeyRef: PORTKEY_API_KEY_REF }],
+    targets: [
+      {
+        id: PORTKEY_TARGET_ID,
+        accountRef: PORTKEY_ACCOUNT_ID,
+        model,
+        privacyTier: "public",
+        capabilities: ["chat"],
+        contextWindow: 1e6
+      }
+    ],
+    policies: [{ id: PORTKEY_POLICY_ID, mode: "strict", chain: [PORTKEY_TARGET_ID] }],
+    workloads: [
+      { name: "memory_extraction", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" },
+      { name: "memory_decision", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" },
+      { name: "memory_pollinating", policyRef: PORTKEY_POLICY_ID, requiredCapabilities: ["chat"], minPrivacyTier: "public" }
+    ]
+  };
+}
+var PortkeyFallbackModelClient = class {
+  portkey;
+  provider;
+  constructor(portkey, provider) {
+    this.portkey = portkey;
+    this.provider = provider;
+  }
+  async complete(a, b) {
+    try {
+      return typeof a === "string" ? await this.portkey.complete(a, b) : await this.portkey.complete(a);
+    } catch (err) {
+      void err;
+      return typeof a === "string" ? this.provider.complete(a, b) : this.provider.complete(a);
+    }
+  }
+};
+
+// dist/src/daemon/runtime/recall/rerank-portkey.js
+var RERANK_FAILED = Object.freeze({ ok: false });
+var RerankResultSchema = external_exports.object({
+  index: external_exports.number().int().nonnegative(),
+  relevance_score: external_exports.number()
+});
+var RerankResponseSchema = external_exports.object({
+  results: external_exports.array(RerankResultSchema)
+});
+function createPortkeyRerankClient(deps) {
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  const url2 = deps.baseUrl ?? PORTKEY_RERANK_URL;
+  const configId = deps.config;
+  const onTransportError = deps.onTransportError;
+  function reportTransportError(statusCode) {
+    if (onTransportError === void 0)
+      return;
+    try {
+      onTransportError(statusCode);
+    } catch {
+    }
+  }
+  return {
+    async rerank(apiKey, request) {
+      const body = {
+        model: request.model,
+        query: request.query,
+        documents: request.documents,
+        top_n: request.topN
+      };
+      let res;
+      try {
+        res = await doFetch(url2, {
+          method: "POST",
+          // SAME auth pair as the chat transport (c-D-2); the key lives only in the header (c-AC-2).
+          headers: buildPortkeyHeaders(apiKey, configId),
+          body: JSON.stringify(body)
+        });
+      } catch {
+        reportTransportError(503);
+        return RERANK_FAILED;
+      }
+      if (!res.ok) {
+        reportTransportError(res.status);
+        return RERANK_FAILED;
+      }
+      const text = await res.text().catch(() => "");
+      const parsed = RerankResponseSchema.safeParse(safeJsonParse(text));
+      if (!parsed.success) {
+        process.stderr.write("honeycomb: portkey rerank returned an unusable 2xx body; failing soft to RRF order\n");
+        return RERANK_FAILED;
+      }
+      const results = parsed.data.results.filter((r) => r.index < request.documents.length).map((r) => ({ index: r.index, relevanceScore: r.relevance_score }));
+      return { ok: true, results };
+    }
+  };
+}
+function buildCohereRerankSeam(deps) {
+  return {
+    async rerank(query, documents, topN) {
+      let apiKey;
+      try {
+        apiKey = await deps.secrets.resolve(deps.apiKeyRef);
+      } catch {
+        return { ok: false };
+      }
+      try {
+        return await deps.client.rerank(apiKey, { model: deps.model, query, documents, topN });
+      } catch {
+        return RERANK_FAILED;
+      }
+    }
+  };
+}
 
 // dist/src/daemon/runtime/services/poll-backoff.js
 var DEFAULT_POLL_BACKOFF_FLOOR_MS = 1e3;
@@ -51416,7 +53010,7 @@ function sanitizeSegment4(name) {
 // dist/src/daemon/runtime/skillify/watermark.js
 import { mkdirSync as mkdirSync19, readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir23 } from "node:os";
-import { dirname as dirname13, join as join30 } from "node:path";
+import { dirname as dirname14, join as join30 } from "node:path";
 function defaultWatermarkBaseDir() {
   return join30(homedir23(), ".honeycomb", "state", "skillify");
 }
@@ -51442,7 +53036,7 @@ function createWatermarkStore(baseDir = defaultWatermarkBaseDir()) {
       const next = current === null ? oldest : earlier(current, oldest);
       const file2 = { watermark: next, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
       const path4 = fileFor(projectKey);
-      mkdirSync19(dirname13(path4), { recursive: true });
+      mkdirSync19(dirname14(path4), { recursive: true });
       writeFileSync16(path4, JSON.stringify(file2, null, 2), "utf-8");
       return next;
     }
@@ -51470,6 +53064,95 @@ function sanitizeSegment5(projectKey) {
   return cleaned === "" ? "default" : cleaned;
 }
 
+// dist/src/daemon/runtime/dashboard/roi-session-writer.js
+import { randomUUID as randomUUID7 } from "node:crypto";
+var SESSION_TURNS_LIMIT = 2e3;
+function tokenCountOrNull2(value) {
+  if (value === null || value === void 0)
+    return null;
+  const n = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(n) ? Math.trunc(n) : null;
+}
+function rowToCapturedTurn2(r) {
+  const sourceTool = typeof r.source_tool === "string" ? r.source_tool : "";
+  return {
+    input_tokens: tokenCountOrNull2(r.input_tokens),
+    output_tokens: tokenCountOrNull2(r.output_tokens),
+    cache_read_input_tokens: tokenCountOrNull2(r.cache_read_input_tokens),
+    cache_creation_input_tokens: tokenCountOrNull2(r.cache_creation_input_tokens),
+    ...sourceTool !== "" ? { sourceTool } : {}
+  };
+}
+async function readSessionTurns(storage, scope, path4) {
+  const tbl = sqlIdent("sessions");
+  const pathCol = sqlIdent("path");
+  const sql = `SELECT ${sqlIdent("input_tokens")}, ${sqlIdent("output_tokens")}, ${sqlIdent("cache_read_input_tokens")}, ${sqlIdent("cache_creation_input_tokens")}, ${sqlIdent("source_tool")} FROM "${tbl}" WHERE ${pathCol} = ${sLiteral(path4)} LIMIT ${SESSION_TURNS_LIMIT}`;
+  let result;
+  try {
+    result = await storage.query(sql, scope);
+  } catch {
+    return [];
+  }
+  return isOk(result) ? result.rows.map(rowToCapturedTurn2) : [];
+}
+function createRoiSessionWriter(deps) {
+  const clock = deps.clock ?? { now: () => Date.now() };
+  return {
+    async writeForSession(input) {
+      try {
+        if (input.path.trim() === "") {
+          deps.logger?.event("roi.write.skipped", { reason: "blank path", sessionId: input.sessionId });
+          return;
+        }
+        const turns = await readSessionTurns(deps.storage, deps.scope, input.path);
+        const measured2 = measuredCacheSavings(turns);
+        const modeled2 = modeledMemoryInjectionSavings(1);
+        let inputTokens = 0;
+        let outputTokens = 0;
+        let cacheReadTokens = 0;
+        let cacheCreationTokens = 0;
+        for (const t of turns) {
+          inputTokens += t.input_tokens ?? 0;
+          outputTokens += t.output_tokens ?? 0;
+          cacheReadTokens += t.cache_read_input_tokens ?? 0;
+          cacheCreationTokens += t.cache_creation_input_tokens ?? 0;
+        }
+        const createdAt = new Date(clock.now()).toISOString();
+        const { teamId, userId } = await appendRoiMetric(deps.storage, deps.scope, {
+          id: randomUUID7(),
+          sessionId: input.sessionId,
+          agentId: input.agentId,
+          ...input.projectId !== void 0 ? { projectId: input.projectId } : {},
+          inputTokens,
+          outputTokens,
+          cacheReadTokens,
+          cacheCreationTokens,
+          measuredCacheSavingsCents: measured2.value.savingsCents,
+          modeledSavingsCents: modeled2.value.estimatedCents,
+          modeledAssumptionRef: modeled2.assumption.kind,
+          grossCostCents: 0,
+          infraCostCents: 0,
+          costBasis: "none",
+          allocationMethod: "",
+          createdAt
+        });
+        deps.logger?.event("roi.write.appended", {
+          sessionId: input.sessionId,
+          measuredCents: measured2.value.savingsCents,
+          teamId,
+          // user_id is gated to '' today — surface that it stayed gated (never a leaked identity).
+          userGated: userId === ""
+        });
+      } catch (err) {
+        deps.logger?.event("roi.write.failed", {
+          sessionId: input.sessionId,
+          reason: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+  };
+}
+
 // dist/src/daemon/runtime/skillify/worker.js
 var SKILLIFY_JOB_KIND = "skillify";
 var DEFAULT_POLL_INTERVAL_MS4 = 1e3;
@@ -51512,6 +53195,8 @@ var SkillifyJobWorkerImpl = class {
   gateOverride;
   fetcherOverride;
   storeOverride;
+  /** PRD-060e/060f — the per-session ROI writer fired once at completion (fail-soft). */
+  roiWriter;
   handle;
   /** Guards against overlapping `runOnce` invocations on the poll loop. */
   running = false;
@@ -51537,6 +53222,7 @@ var SkillifyJobWorkerImpl = class {
     this.gateOverride = deps.gateOverride;
     this.fetcherOverride = deps.fetcherOverride;
     this.storeOverride = deps.storeOverride;
+    this.roiWriter = deps.roiWriter ?? createRoiSessionWriter({ storage: this.storage, scope: this.scope });
   }
   async runOnce() {
     let leased;
@@ -51577,6 +53263,19 @@ var SkillifyJobWorkerImpl = class {
       const outcome = await writeSkill(result.outcome.verdict, { store, install, author: this.author, projectId }, result.outcome.minedSessionIds, "global");
       const sessionDates = result.outcome.pairs.map((p) => p.sessionDate);
       this.watermarkStore.advance(projectKey, sessionDates);
+      try {
+        await this.roiWriter.writeForSession({
+          sessionId: payload.sessionId,
+          path: payload.path,
+          agentId: this.author,
+          projectId
+        });
+      } catch (roiErr) {
+        this.logger?.event("skillify.worker.roi_write_failed", {
+          id: job.id,
+          reason: roiErr instanceof Error ? roiErr.message : String(roiErr)
+        });
+      }
       await this.queue.complete(job.id);
       this.logger?.event("skillify.worker.completed", {
         id: job.id,
@@ -51735,8 +53434,8 @@ var TransportError = class extends Error {
       this.status = status;
   }
 };
-var DEEPLAKE_CLIENT_HEADER2 = "X-Deeplake-Client";
-var DEEPLAKE_ORG_HEADER2 = "X-Activeloop-Org-Id";
+var DEEPLAKE_CLIENT_HEADER3 = "X-Deeplake-Client";
+var DEEPLAKE_ORG_HEADER3 = "X-Activeloop-Org-Id";
 var HttpDeepLakeTransport = class {
   endpoint;
   token;
@@ -51752,8 +53451,8 @@ var HttpDeepLakeTransport = class {
         headers: {
           Authorization: `Bearer ${this.token}`,
           "Content-Type": "application/json",
-          [DEEPLAKE_ORG_HEADER2]: req.org,
-          [DEEPLAKE_CLIENT_HEADER2]: "honeycomb"
+          [DEEPLAKE_ORG_HEADER3]: req.org,
+          [DEEPLAKE_CLIENT_HEADER3]: "honeycomb"
         },
         signal: req.signal,
         body: JSON.stringify({ query: req.sql })
@@ -52098,6 +53797,7 @@ var AGENT_CONFIG_FILE_NAME = "agent.yaml";
 var LOCK_FILE_NAME = "daemon.lock";
 var PID_FILE_NAME = "daemon.pid";
 var DEFAULT_HEALTH_PROBE_INTERVAL_MS = 15e3;
+var DEFAULT_GRAPH_BUILD_INTERVAL_MS = 60 * 60 * 1e3;
 var defaultSeamFns = {
   attachHooks: attachHooksHandlers,
   mountDashboard: mountDashboardApi,
@@ -52175,7 +53875,7 @@ function readPidFile(path4) {
 function releaseSingleInstanceLock(runtimeDir) {
   for (const name of [LOCK_FILE_NAME, PID_FILE_NAME]) {
     try {
-      rmSync9(join32(runtimeDir, name), { force: true });
+      rmSync10(join32(runtimeDir, name), { force: true });
     } catch {
     }
   }
@@ -52198,7 +53898,7 @@ function authForMode(mode, storage, scope) {
   }
   return { authenticator: composeAuthenticator(storage, scope), policy: defaultDenyPolicy };
 }
-function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDetail, workspaceDir, installedHarnesses, logStore, seams = defaultSeamFns, vault) {
+function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDetail, workspaceDir, installedHarnesses, logStore, seams = defaultSeamFns, vault, rerankerDeps) {
   const captureHandler = seams.attachHooks(daemon, {
     storage,
     queue: daemon.services.queue,
@@ -52243,7 +53943,12 @@ function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDeta
     embed: embed.client,
     logger: daemon.logger,
     conflictSuppression,
-    ...vault !== void 0 ? { vault } : {}
+    ...vault !== void 0 ? { vault } : {},
+    // PRD-063c: the operator-selected reranker config + the late-bound Cohere-via-Portkey seam.
+    // The `cohere` strategy only does anything when BOTH the strategy is `cohere` (env) AND the
+    // gateway is ON (the seam's inner transport is wired in `start()`); otherwise RRF / local
+    // cosine, byte-identical to today (c-AC-4). Absent rerankerDeps (a unit mount) → engine default.
+    ...rerankerDeps !== void 0 ? { reranker: rerankerDeps.reranker, cohereRerank: rerankerDeps.cohereRerank } : {}
   });
   if (seams.mountConflicts !== void 0) {
     seams.mountConflicts(daemon, { storage, defaultScope });
@@ -52255,7 +53960,7 @@ function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDeta
     seams.mountMemoriesPrime(daemon, { storage, defaultScope });
   }
   seams.mountVfs(daemon, { storage, defaultScope });
-  seams.mountProductData(daemon, resolveProductDataDeps(storage, defaultScope, daemon.services.queue, embed.client));
+  seams.mountProductData(daemon, resolveProductDataDeps(storage, defaultScope, daemon.services.queue, embed.client, daemon.config.mode));
   seams.mountPollinate(daemon, { storage, defaultScope, enqueuer: daemon.services.queue });
   try {
     seams.mountProjectsSync(daemon, { storage, defaultScope });
@@ -52326,10 +54031,14 @@ function assembleSeams(daemon, storage, defaultScope, orgName, embed, healthDeta
   }
   return captureHandler;
 }
-function resolveProductDataDeps(storage, defaultScope, queue, embed) {
-  const baseDir = process.env.HONEYCOMB_WORKSPACE ?? process.cwd();
+function resolveProductDataDeps(storage, defaultScope, queue, embed, mode) {
+  const baseDir = resolveWorkspaceBaseDir();
   const secrets = {
-    store: new SecretsStore({ baseDir, machineKey: createMachineKeyProvider() })
+    store: new SecretsStore({ baseDir, machineKey: createMachineKeyProvider() }),
+    // PRD-022 local-mode default: the dashboard's `GET /api/secrets` (names-only) carries no
+    // `x-honeycomb-org` header, so resolve the daemon's single local tenant instead of 400ing.
+    // Team/hybrid stay fail-closed (a missing org still 400s) — cross-tenant access is rejected.
+    scope: localDefaultScopeResolver(mode, defaultScope)
   };
   let sources;
   try {
@@ -52347,8 +54056,35 @@ function resolveProductDataDeps(storage, defaultScope, queue, embed) {
     defaultScope
   };
 }
+var workspaceBaseDirMemo;
 function resolveWorkspaceBaseDir() {
-  return process.env.HONEYCOMB_WORKSPACE ?? process.cwd();
+  if (workspaceBaseDirMemo !== void 0)
+    return workspaceBaseDirMemo;
+  const fromEnv = process.env.HONEYCOMB_WORKSPACE;
+  const candidate = fromEnv !== void 0 && fromEnv.length > 0 ? fromEnv : process.cwd();
+  if (isWritableDir(candidate)) {
+    workspaceBaseDirMemo = candidate;
+    return candidate;
+  }
+  const fallback = join32(homedir25(), ".honeycomb");
+  process.stderr.write(`honeycomb: workspace "${candidate}" is not writable; using "${fallback}" for filesystem state (secrets, logs, agent.yaml)
+`);
+  try {
+    mkdirSync20(fallback, { recursive: true, mode: DIR_MODE });
+  } catch {
+  }
+  workspaceBaseDirMemo = fallback;
+  return fallback;
+}
+function isWritableDir(dir) {
+  try {
+    mkdirSync20(dir, { recursive: true });
+    const probe = mkdtempSync(join32(dir, ".honeycomb-write-test-"));
+    rmSync10(probe, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
 }
 function resolveAgentConfigPath(options) {
   return options.agentConfigPath ?? join32(resolveWorkspaceBaseDir(), AGENT_CONFIG_FILE_NAME);
@@ -52359,6 +54095,9 @@ function secretScopeFromQueryScope(scope) {
 var VAULT_PROVIDER_KEY = "activeProvider";
 var VAULT_MODEL_KEY = "activeModel";
 var VAULT_POLLINATING_ENABLED_KEY = "pollinating.enabled";
+var VAULT_PORTKEY_ENABLED_KEY = "portkey.enabled";
+var VAULT_PORTKEY_CONFIG_KEY = "portkey.config";
+var VAULT_PORTKEY_FALLBACK_KEY = "portkey.fallbackToProvider";
 function catalogTrustedTableProbe() {
   const names = CATALOG.map((t) => t.name);
   return { tables: () => Promise.resolve(names) };
@@ -52389,6 +54128,41 @@ async function readProviderModelOverride(vault, scope) {
     return void 0;
   }
 }
+async function readPortkeySelection(vault, scope) {
+  if (vault === void 0)
+    return void 0;
+  try {
+    const enabledRes = await vault.getSetting(VAULT_PORTKEY_ENABLED_KEY, scope);
+    const enabled = enabledRes.ok && coerceSettingBool(enabledRes.value);
+    if (!enabled)
+      return void 0;
+    const configRes = await vault.getSetting(VAULT_PORTKEY_CONFIG_KEY, scope);
+    const config2 = configRes.ok ? String(configRes.value) : "";
+    if (config2.length === 0)
+      return void 0;
+    const modelRes = await vault.getSetting(VAULT_MODEL_KEY, scope);
+    const model = modelRes.ok ? String(modelRes.value) : "";
+    const fallbackRes = await vault.getSetting(VAULT_PORTKEY_FALLBACK_KEY, scope);
+    const fallbackToProvider = fallbackRes.ok && coerceSettingBool(fallbackRes.value);
+    return { enabled: true, config: config2, model, fallbackToProvider };
+  } catch {
+    return void 0;
+  }
+}
+async function resolvePortkeyAssemblyStatus(selection, scope) {
+  if (selection === void 0 || !selection.enabled)
+    return "off";
+  try {
+    const secretsStore = new SecretsStore({
+      baseDir: resolveWorkspaceBaseDir(),
+      machineKey: createMachineKeyProvider()
+    });
+    const names = secretsStore.listSecretNames(secretScopeFromQueryScope(scope));
+    return names.includes(PORTKEY_API_KEY_NAME) ? "ok" : "unconfigured";
+  } catch {
+    return "unconfigured";
+  }
+}
 async function readVaultPollinatingEnabled(vault, scope) {
   if (vault === void 0)
     return { decidedByVault: false, enabled: false };
@@ -52402,6 +54176,17 @@ async function readVaultPollinatingEnabled(vault, scope) {
     return { decidedByVault: false, enabled: false };
   }
 }
+async function readBootEmbeddingsEnabled(vault, scope) {
+  if (vault !== void 0) {
+    try {
+      const res = await vault.getSetting(EMBEDDINGS_ENABLED_KEY, scope);
+      if (res.ok)
+        return coerceSettingBool(res.value);
+    } catch {
+    }
+  }
+  return resolveEmbedClientOptions().enabled;
+}
 function coerceSettingBool(value) {
   if (typeof value === "boolean")
     return value;
@@ -52411,7 +54196,7 @@ function coerceSettingBool(value) {
     return value === "true" || value === "1";
   return false;
 }
-async function buildGatedPollinatingWorker(options, storage, scope, queue, vault, backoff) {
+async function buildGatedPollinatingWorker(options, storage, scope, queue, vault, backoff, portkeyDeps) {
   let config2;
   try {
     config2 = resolvePollinatingConfig(options.pollinatingConfigProvider);
@@ -52435,7 +54220,9 @@ async function buildGatedPollinatingWorker(options, storage, scope, queue, vault
     scope: secretScopeFromQueryScope(scope),
     secretsStore,
     config: resolveAgentConfigPath(options),
-    ...providerModelOverride !== void 0 ? { providerModelOverride } : {}
+    ...providerModelOverride !== void 0 ? { providerModelOverride } : {},
+    ...portkeyDeps?.selection !== void 0 ? { portkey: portkeyDeps.selection } : {},
+    ...portkeyDeps !== void 0 ? { onPortkeyUnreachable: portkeyDeps.onUnreachable } : {}
   });
   const trigger = createPollinatingTrigger({ storage, scope, config: config2, enqueuer: queue });
   return createPollinatingWorker({ queue, storage, scope, config: config2, model, trigger, backoff });
@@ -52459,7 +54246,7 @@ function makePipelineEntryEnqueuer(queue) {
     });
   };
 }
-async function buildPipelineWorker(options, storage, scope, queue, embed, backoff) {
+async function buildPipelineWorker(options, storage, scope, queue, embed, backoff, portkeyDeps) {
   let config2;
   try {
     config2 = resolvePipelineConfig();
@@ -52475,7 +54262,9 @@ async function buildPipelineWorker(options, storage, scope, queue, embed, backof
     model = await buildInferenceModelClient({
       scope: secretScopeFromQueryScope(scope),
       secretsStore,
-      config: resolveAgentConfigPath(options)
+      config: resolveAgentConfigPath(options),
+      ...portkeyDeps?.selection !== void 0 ? { portkey: portkeyDeps.selection } : {},
+      ...portkeyDeps !== void 0 ? { onPortkeyUnreachable: portkeyDeps.onUnreachable } : {}
     });
   } catch {
     model = noopModelClient;
@@ -52510,6 +54299,7 @@ function assembleDaemon(options = {}) {
   const tenancy = resolveDaemonTenancy(provider);
   const scope = tenancy.scope;
   const daemonOrgName = tenancy.orgName;
+  const vault = options.vault ?? (options.storage === void 0 ? buildVaultStore() : void 0);
   const services = {
     queue: createJobQueueService({ storage, scope }),
     watcher: createFileWatcherService({
@@ -52525,10 +54315,34 @@ function assembleDaemon(options = {}) {
     // fake supervisor so the hermetic assembly never spawns a real process.
     embed: options.embedSupervisor ?? createEmbedSupervisor()
   };
+  const embedSupervisor = services.embed;
+  if (embedSupervisor !== void 0 && vault !== void 0) {
+    void readBootEmbeddingsEnabled(vault, secretScopeFromQueryScope(scope)).then(async (enabled) => {
+      if (enabled !== !embedSupervisor.disabled)
+        await embedSupervisor.setEnabled(enabled);
+    }).catch((err) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`honeycomb: embeddings boot reconciliation failed (non-fatal): ${reason}
+`);
+    });
+  }
   let healthBit = "ok";
   const pipelineProbe = () => healthBit;
-  const embeddingsEnabled = options.embeddingsEnabled ?? (options.embed !== void 0 ? false : resolveEmbedClientOptions().enabled);
-  const healthDetail = () => buildHealthDetail({ status: healthBit, embeddingsEnabled });
+  const embeddingsReason = () => options.embeddingsEnabled ?? (options.embed !== void 0 ? false : embedSupervisor !== void 0 ? !embedSupervisor.disabled : resolveEmbedClientOptions().enabled);
+  let portkeyHealth = "off";
+  const recordPortkeyUnreachable = (_statusCode) => {
+    portkeyHealth = "unreachable";
+  };
+  const healthDetail = () => buildHealthDetail({ status: healthBit, embeddingsEnabled: embeddingsReason(), portkey: portkeyHealth });
+  let cohereRerankInner;
+  const cohereRerankSeam = {
+    rerank(query, documents, topN) {
+      const inner = cohereRerankInner;
+      if (inner === void 0)
+        return Promise.resolve({ ok: false });
+      return inner.rerank(query, documents, topN);
+    }
+  };
   const { authenticator, policy } = authForMode(config2.mode, storage, scope);
   const createOptions = {
     config: config2,
@@ -52543,11 +54357,19 @@ function assembleDaemon(options = {}) {
   const daemon = createDaemon(createOptions);
   const embed = options.embed ?? createEmbedAttachment({ storage });
   const installedHarnesses = options.installedHarnesses ?? (options.harnessTargets !== void 0 && options.harnessTargets.length > 0 ? new Set(options.harnessTargets.map((t) => t.name)) : options.storage === void 0 ? detectInstalledHarnesses() : /* @__PURE__ */ new Set());
-  const vault = options.vault ?? (options.storage === void 0 ? buildVaultStore() : void 0);
-  const captureHandler = assembleSeams(daemon, storage, scope, daemonOrgName, embed, healthDetail, options.workspaceDir ?? process.cwd(), installedHarnesses, logStore, options.seams ?? defaultSeamFns, vault);
+  let rerankerMountDeps;
+  try {
+    rerankerMountDeps = { reranker: resolveRecallConfig().reranker, cohereRerank: cohereRerankSeam };
+  } catch {
+    rerankerMountDeps = {
+      reranker: RecallConfigSchema.parse({}).reranker,
+      cohereRerank: cohereRerankSeam
+    };
+  }
+  const captureHandler = assembleSeams(daemon, storage, scope, daemonOrgName, embed, healthDetail, options.workspaceDir ?? process.cwd(), installedHarnesses, logStore, options.seams ?? defaultSeamFns, vault, rerankerMountDeps);
   if (vault !== void 0 && vault instanceof VaultStore) {
     try {
-      mountSettingsApi(daemon, { store: vault });
+      mountSettingsApi(daemon, { store: vault, scope: localDefaultScopeResolver(daemon.config.mode, scope) });
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       process.stderr.write(`honeycomb: settings API mount failed (non-fatal): ${reason}
@@ -52559,6 +54381,17 @@ function assembleDaemon(options = {}) {
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     process.stderr.write(`honeycomb: auth status API mount failed (non-fatal): ${reason}
+`);
+  }
+  try {
+    mountActionsApi(daemon, {
+      embed: daemon.services.embed,
+      defaultScope: scope,
+      ...vault instanceof VaultStore ? { store: vault } : {}
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`honeycomb: actions API mount failed (non-fatal): ${reason}
 `);
   }
   try {
@@ -52609,6 +54442,27 @@ function assembleDaemon(options = {}) {
       healthBit = "degraded";
     }
   }
+  const autoBuildGraph = options.storage === void 0 && config2.mode === "local";
+  let graphBuildTimer = null;
+  let graphBuildInFlight = false;
+  async function rebuildCodebaseGraph() {
+    if (graphBuildInFlight)
+      return;
+    graphBuildInFlight = true;
+    try {
+      await buildCodebaseGraphSnapshot(scope, {
+        storage,
+        defaultScope: scope,
+        workspaceDir: options.workspaceDir ?? process.cwd()
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`honeycomb: codebase graph auto-build failed (non-fatal): ${reason}
+`);
+    } finally {
+      graphBuildInFlight = false;
+    }
+  }
   let started = false;
   let locked = false;
   let pollinatingWorker = null;
@@ -52633,6 +54487,15 @@ function assembleDaemon(options = {}) {
       if (typeof probeTimer.unref === "function") {
         probeTimer.unref();
       }
+      if (autoBuildGraph) {
+        void rebuildCodebaseGraph();
+        graphBuildTimer = setInterval(() => {
+          void rebuildCodebaseGraph();
+        }, DEFAULT_GRAPH_BUILD_INTERVAL_MS);
+        if (typeof graphBuildTimer.unref === "function") {
+          graphBuildTimer.unref();
+        }
+      }
       await daemon.startServices();
       let pollBackoff;
       try {
@@ -52646,6 +54509,33 @@ function assembleDaemon(options = {}) {
       } catch {
         consolidatePoll = false;
       }
+      let portkeyWorkerDeps = { onUnreachable: recordPortkeyUnreachable };
+      try {
+        const portkeySelection = await readPortkeySelection(vault, secretScopeFromQueryScope(scope));
+        portkeyHealth = await resolvePortkeyAssemblyStatus(portkeySelection, scope);
+        portkeyWorkerDeps = {
+          ...portkeySelection !== void 0 ? { selection: portkeySelection } : {},
+          onUnreachable: recordPortkeyUnreachable
+        };
+        if (portkeySelection !== void 0) {
+          const rerankSecrets = createSecretResolver(new SecretsStore({ baseDir: resolveWorkspaceBaseDir(), machineKey: createMachineKeyProvider() }), secretScopeFromQueryScope(scope));
+          const rerankClient = createPortkeyRerankClient({
+            config: portkeySelection.config,
+            onTransportError: recordPortkeyUnreachable
+          });
+          cohereRerankInner = buildCohereRerankSeam({
+            client: rerankClient,
+            secrets: rerankSecrets,
+            apiKeyRef: PORTKEY_API_KEY_REF,
+            model: rerankerMountDeps.reranker.cohereModel
+          });
+        } else {
+          cohereRerankInner = void 0;
+        }
+      } catch {
+        portkeyHealth = "off";
+        cohereRerankInner = void 0;
+      }
       try {
         summaryWorker = buildSummaryWorker(storage, scope, daemon.services.queue, embed);
         summaryWorker.start();
@@ -52656,7 +54546,7 @@ function assembleDaemon(options = {}) {
         summaryWorker = null;
       }
       try {
-        pipelineWorker = await buildPipelineWorker(options, storage, scope, daemon.services.queue, embed, pollBackoff);
+        pipelineWorker = await buildPipelineWorker(options, storage, scope, daemon.services.queue, embed, pollBackoff, portkeyWorkerDeps);
         if (!consolidatePoll)
           pipelineWorker.start();
       } catch (err) {
@@ -52688,7 +54578,7 @@ function assembleDaemon(options = {}) {
         }
       }
       try {
-        pollinatingWorker = await buildGatedPollinatingWorker(options, storage, scope, daemon.services.queue, vault, pollBackoff);
+        pollinatingWorker = await buildGatedPollinatingWorker(options, storage, scope, daemon.services.queue, vault, pollBackoff, portkeyWorkerDeps);
         const pollinatingInjected = options.pollinatingWorker !== void 0;
         if (consolidatePoll && !pollinatingInjected) {
           const participants = [pipelineWorker, pollinatingWorker].filter((p) => p !== null);
@@ -52743,6 +54633,10 @@ function assembleDaemon(options = {}) {
         clearInterval(probeTimer);
         probeTimer = null;
       }
+      if (graphBuildTimer !== null) {
+        clearInterval(graphBuildTimer);
+        graphBuildTimer = null;
+      }
       if (started) {
         await daemon.stopServices();
         started = false;
@@ -52845,9 +54739,9 @@ export {
   CompactionConfigError,
   CompactionRefusedError,
   CompactionRetentionSchema,
-  DEEPLAKE_CLIENT_HEADER2 as DEEPLAKE_CLIENT_HEADER,
+  DEEPLAKE_CLIENT_HEADER3 as DEEPLAKE_CLIENT_HEADER,
   DEFAULT_MAX_POLLS as DEEPLAKE_DEFAULT_MAX_POLLS,
-  DEEPLAKE_ORG_HEADER2 as DEEPLAKE_ORG_HEADER,
+  DEEPLAKE_ORG_HEADER3 as DEEPLAKE_ORG_HEADER,
   DEFAULT_CONVERGE_BACKOFF_BASE_MS,
   DEFAULT_CONVERGE_BACKOFF_CAP_MS,
   DEFAULT_CONVERGE_BUDGET,