@linzumi/cli 0.0.107-beta → 0.0.109-beta

package/dist/index.js

@@ -1439,6 +1439,57 @@ function parseKandanChatAttachments(attachments) {
     ];
   });
 }
+function kandanChatAttachmentsToWire(attachments) {
+  return attachments.map((attachment) => ({
+    ...attachment.id === void 0 ? {} : { id: attachment.id },
+    ...attachment.kind === void 0 ? {} : { kind: attachment.kind },
+    ...attachment.fileName === void 0 ? {} : { file_name: attachment.fileName },
+    ...attachment.contentType === void 0 ? {} : { content_type: attachment.contentType },
+    ...attachment.sizeBytes === void 0 ? {} : { size_bytes: attachment.sizeBytes },
+    ...attachment.url === void 0 ? {} : { url: attachment.url }
+  }));
+}
+function serializeKandanChatEventForQueue(event) {
+  return {
+    seq: event.seq,
+    type: event.type,
+    ...event.actorKind === void 0 ? {} : { actor_kind: event.actorKind },
+    ...event.actorSlug === void 0 ? {} : { actor_slug: event.actorSlug },
+    ...event.actorUserId === void 0 ? {} : { actor_user_id: event.actorUserId },
+    ...event.threadId === void 0 ? {} : { thread_id: event.threadId },
+    ...event.threadTitle === void 0 ? {} : { thread_title: event.threadTitle },
+    ...event.replyToSeq === void 0 ? {} : { reply_to_seq: event.replyToSeq },
+    ...event.localRunnerEventType === void 0 ? {} : { local_runner_event_type: event.localRunnerEventType },
+    body: event.body,
+    attachments: kandanChatAttachmentsToWire(event.attachments)
+  };
+}
+function deserializeKandanChatEventFromQueue(value) {
+  const payload = objectValue(value);
+  if (payload === void 0) {
+    return void 0;
+  }
+  const seq = integerValue(payload.seq);
+  const type = stringValue(payload.type);
+  if (seq === void 0 || type === void 0) {
+    return void 0;
+  }
+  return {
+    seq,
+    type,
+    actorKind: stringValue(payload.actor_kind),
+    actorSlug: stringValue(payload.actor_slug),
+    actorUserId: integerValue(payload.actor_user_id),
+    threadId: stringValue(payload.thread_id),
+    threadTitle: stringValue(payload.thread_title),
+    replyToSeq: integerValue(payload.reply_to_seq),
+    localRunnerEventType: stringValue(payload.local_runner_event_type),
+    body: stringValue(payload.body) ?? "",
+    attachments: parseKandanChatAttachments(
+      arrayValue(payload.attachments) ?? []
+    )
+  };
+}
 function isCodexAuthoredEvent(event) {
   if (event.localRunnerEventType !== void 0) {
     return true;
@@ -3716,7 +3767,9 @@ async function connectPhoenixClient(baseUrl, token, socketFactory = (url, protoc
     controlBacklogFetchesInFlight.add(topic);
     void fetchRemainingControlBacklog(topic).catch(() => void 0).finally(() => controlBacklogFetchesInFlight.delete(topic));
   };
+  const lastRejoinReplies = /* @__PURE__ */ new Map();
   const replayJoins = async () => {
+    lastRejoinReplies.clear();
     for (const [topic, registrations] of joins) {
       const reply = await pushOnOpenSocket(
         topic,
@@ -3731,6 +3784,9 @@ async function connectPhoenixClient(baseUrl, token, socketFactory = (url, protoc
       if (!isJoinReply(reply)) {
         throw new Error(`phoenix rejoin failed for ${topic}`);
       }
+      if (isJsonObject(reply.response)) {
+        lastRejoinReplies.set(topic, reply.response);
+      }
     }
   };
   const scheduleReconnect = () => {
@@ -3832,8 +3888,9 @@ async function connectPhoenixClient(baseUrl, token, socketFactory = (url, protoc
       startHeartbeat();
       markReady();
       if (state.connectionGeneration > 1) {
+        const rejoinReplies = new Map(lastRejoinReplies);
         reconnectCallbacks.forEach((callback) => {
-          void Promise.resolve(callback()).catch(() => void 0);
+          void Promise.resolve(callback(rejoinReplies)).catch(() => void 0);
         });
       }
     } catch (error) {
@@ -6900,6 +6957,11 @@ function createSessionPipelineBuilders(host) {
           channel: wire.channelSlug,
           thread_id: wire.kandanThreadId,
           stream_key: streamKey,
+          // SEAM 2: present the held lease epoch on the turn-execution write so
+          // the server fences a stale, half-connected runner's duplicate output
+          // (validate_turn_execution_lease_epoch). Omitted when unknown (the
+          // server fence fails open on a nil epoch).
+          ...wire.leaseEpoch === void 0 ? {} : { lease_epoch: wire.leaseEpoch },
           body: entryBody(data),
           payload: {
             ...host.runnerPayload(
@@ -6946,7 +7008,14 @@ function createSessionPipelineBuilders(host) {
           seq,
           status,
           ...stringValue(data.reason) === void 0 ? {} : { reason: stringValue(data.reason) },
-          ...stringValue(data.turn_id) === void 0 ? {} : { turn_id: stringValue(data.turn_id) }
+          ...stringValue(data.turn_id) === void 0 ? {} : { turn_id: stringValue(data.turn_id) },
+          // SEAM 2 (blocker #5): echo the held lease_epoch (snake_case) on the
+          // message_state report too, not only the turn-EXECUTION write, so the
+          // server fence (validate_turn_execution_lease_epoch) sees the current
+          // epoch on the terminal report and does NOT fail open for a stale,
+          // half-connected runner. Omitted for a pre-lease/old server (nil fence
+          // fails open exactly as before).
+          ...wire.leaseEpoch === void 0 ? {} : { lease_epoch: wire.leaseEpoch }
         }
       };
     }
@@ -8772,6 +8841,9 @@ function runnerActionErrorMessage(error) {
   return userFacingBaseErrorMessage(message);
 }
 function userFacingBaseErrorMessage(message) {
+  if (message.includes("daily_token_limit_exceeded") || message.includes("free Linzumi tokens")) {
+    return "You've used all of your free Linzumi tokens for today. Your free allowance resets at midnight UTC - check back then, or email support@linzumi.com if you need more.";
+  }
   if (message === "phoenix join failed: workspace_not_found") {
     return "Linzumi could not find this workspace. The command may be stale or copied from a different signup session. Return to setup and copy the latest command.";
   }
@@ -9107,7 +9179,8 @@ function createChannelSessionPipeline(args, state, payloadContext) {
       channelSlug: session.channelSlug,
       kandanThreadId: state.kandanThreadId,
       codexThreadId: state.codexThreadId,
-      rootSeq: state.rootSeq
+      rootSeq: state.rootSeq,
+      leaseEpoch: state.kandanThreadId === void 0 ? void 0 : args.leaseEpochFor?.(state.kandanThreadId)
     }),
     runnerPayload: (eventType, codexThreadId, sourceMessageSeq, extra) => localRunnerPayload(
       args.options,
@@ -11055,6 +11128,13 @@ async function drainKandanMessageQueueOnce(args, state, payloadContext) {
     state.turn = { status: "active", turnId, queuedSeq: next.seq };
     rememberTurnReplyTarget(state, turnId, next.seq);
     args.log("codex.turn_started", { turn_id: turnId });
+    if (state.kandanThreadId !== void 0) {
+      args.options.onLiveSourceSeqAccepted?.({
+        channel: args.options.channelSession.channelSlug,
+        threadId: state.kandanThreadId,
+        sourceSeq: next.seq
+      });
+    }
     if (interruptAfterStart) {
       await recoverInterruptedCodexTurn(
         args,
@@ -19998,7 +20078,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.107-beta";
+    linzumiCliVersion = "0.0.109-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -23586,33 +23666,901 @@ var init_remoteCodexSandboxRunner = __esm({
   }
 });
 
+// src/durableInboundQueue.ts
+import {
+  closeSync as closeSync3,
+  fsyncSync,
+  mkdirSync as mkdirSync13,
+  openSync as openSync4,
+  readFileSync as readFileSync17,
+  renameSync as renameSync4,
+  writeSync as writeSync2
+} from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import { dirname as dirname14, join as join21 } from "node:path";
+import { homedir as homedir14 } from "node:os";
+function crc32Hex(bytes) {
+  let crc = 4294967295;
+  for (let i = 0; i < bytes.length; i += 1) {
+    crc ^= bytes[i];
+    for (let bit = 0; bit < 8; bit += 1) {
+      const mask = -(crc & 1);
+      crc = crc >>> 1 ^ 3988292384 & mask;
+    }
+  }
+  return ((crc ^ 4294967295) >>> 0).toString(16).padStart(8, "0");
+}
+function frameRecord(record) {
+  const json = JSON.stringify(record);
+  const bytes = Buffer.from(json, "utf8");
+  return `${bytes.length}:${crc32Hex(bytes)}:${json}
+`;
+}
+function parseFramedLine(line) {
+  const firstColon = line.indexOf(":");
+  const secondColon = line.indexOf(":", firstColon + 1);
+  if (firstColon <= 0 || secondColon <= firstColon) {
+    return void 0;
+  }
+  const declaredLen = Number.parseInt(line.slice(0, firstColon), 10);
+  const checksum = line.slice(firstColon + 1, secondColon);
+  const json = line.slice(secondColon + 1);
+  if (!Number.isInteger(declaredLen) || declaredLen <= 0) {
+    return void 0;
+  }
+  const bytes = Buffer.from(json, "utf8");
+  if (bytes.length !== declaredLen) {
+    return void 0;
+  }
+  if (crc32Hex(bytes) !== checksum) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return void 0;
+  }
+  if (!isJsonObject(parsed)) {
+    return void 0;
+  }
+  return coerceRecord(parsed);
+}
+function coerceRecord(value) {
+  const op = value.op;
+  const sourceSeq = value.sourceSeq;
+  if (typeof sourceSeq !== "number" || !Number.isInteger(sourceSeq)) {
+    return void 0;
+  }
+  if (op === "ack") {
+    return { op: "ack", sourceSeq };
+  }
+  if (op === "dead") {
+    return { op: "dead", sourceSeq };
+  }
+  if (op === "attempt") {
+    const attempts = value.attempts;
+    if (typeof attempts !== "number" || !Number.isInteger(attempts)) {
+      return void 0;
+    }
+    return { op: "attempt", sourceSeq, attempts };
+  }
+  if (op === "enqueue") {
+    const kind = value.kind === "replay" ? "replay" : "live";
+    const payload = isJsonObject(value.payload) ? value.payload : void 0;
+    const enqueuedAtMs = typeof value.enqueuedAtMs === "number" && Number.isFinite(value.enqueuedAtMs) ? value.enqueuedAtMs : void 0;
+    if (payload === void 0 || enqueuedAtMs === void 0) {
+      return void 0;
+    }
+    return { op: "enqueue", sourceSeq, kind, payload, enqueuedAtMs };
+  }
+  return void 0;
+}
+function foldQueueRecords(lines) {
+  const enqueued = /* @__PURE__ */ new Map();
+  const dead = /* @__PURE__ */ new Set();
+  let highWater;
+  let tornTail = false;
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    if (line === "") {
+      continue;
+    }
+    const record = parseFramedLine(line);
+    if (record === void 0) {
+      tornTail = true;
+      break;
+    }
+    switch (record.op) {
+      case "enqueue": {
+        highWater = highWater === void 0 ? record.sourceSeq : Math.max(highWater, record.sourceSeq);
+        if (dead.has(record.sourceSeq)) {
+          break;
+        }
+        enqueued.set(record.sourceSeq, {
+          sourceSeq: record.sourceSeq,
+          kind: record.kind,
+          payload: record.payload,
+          enqueuedAtMs: record.enqueuedAtMs,
+          attempts: 0
+        });
+        break;
+      }
+      case "ack": {
+        enqueued.delete(record.sourceSeq);
+        highWater = highWater === void 0 ? record.sourceSeq : Math.max(highWater, record.sourceSeq);
+        break;
+      }
+      case "dead": {
+        enqueued.delete(record.sourceSeq);
+        dead.add(record.sourceSeq);
+        highWater = highWater === void 0 ? record.sourceSeq : Math.max(highWater, record.sourceSeq);
+        break;
+      }
+      case "attempt": {
+        const existing = enqueued.get(record.sourceSeq);
+        if (existing !== void 0) {
+          enqueued.set(record.sourceSeq, {
+            ...existing,
+            attempts: record.attempts
+          });
+        }
+        break;
+      }
+    }
+  }
+  const entries = [...enqueued.values()].sort(
+    (a, b) => a.sourceSeq - b.sourceSeq
+  );
+  return { entries, highWaterSourceSeq: highWater, tornTail };
+}
+function shouldDeadLetter(entry, policy, nowMs) {
+  if (policy.maxAttempts > 0 && entry.attempts >= policy.maxAttempts) {
+    return true;
+  }
+  if (policy.maxAgeMs > 0 && nowMs - entry.enqueuedAtMs >= policy.maxAgeMs) {
+    return true;
+  }
+  return false;
+}
+function createDurableInboundThreadQueue(path2, log2, deps = {}) {
+  const fsyncFd = deps.fsyncFd ?? ((fd) => fsyncSync(fd));
+  const fsyncDirFd = deps.fsyncDirFd ?? ((fd) => fsyncSync(fd));
+  const folded = foldFile(path2, log2);
+  const liveEntries = /* @__PURE__ */ new Map();
+  for (const entry of folded.entries) {
+    liveEntries.set(entry.sourceSeq, entry);
+  }
+  let highWater = folded.highWaterSourceSeq;
+  let tornTail = folded.tornTail;
+  const append = (record) => {
+    try {
+      mkdirSync13(dirname14(path2), { recursive: true });
+      const fd = openSync4(path2, "a");
+      try {
+        writeSync2(fd, frameRecord(record), null, "utf8");
+        fsyncFd(fd);
+      } finally {
+        closeSync3(fd);
+      }
+    } catch (error) {
+      log2("inbound_queue.append_failed", {
+        path: path2,
+        op: record.op,
+        sourceSeq: record.sourceSeq,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  };
+  const fsyncDir = () => {
+    try {
+      const dirFd = openSync4(dirname14(path2), "r");
+      try {
+        fsyncDirFd(dirFd);
+      } finally {
+        closeSync3(dirFd);
+      }
+    } catch {
+    }
+  };
+  return {
+    enqueue: (sourceSeq, kind, payload, nowMs) => {
+      if (highWater !== void 0 && sourceSeq <= highWater) {
+        return { accepted: false, reason: "already_seen" };
+      }
+      const entry = {
+        sourceSeq,
+        kind,
+        payload,
+        enqueuedAtMs: nowMs,
+        attempts: 0
+      };
+      append({ op: "enqueue", sourceSeq, kind, payload, enqueuedAtMs: nowMs });
+      liveEntries.set(sourceSeq, entry);
+      highWater = sourceSeq;
+      return { accepted: true, entry };
+    },
+    entries: () => [...liveEntries.values()].sort((a, b) => a.sourceSeq - b.sourceSeq),
+    head: () => {
+      let head;
+      for (const entry of liveEntries.values()) {
+        if (head === void 0 || entry.sourceSeq < head.sourceSeq) {
+          head = entry;
+        }
+      }
+      return head;
+    },
+    recordAttempt: (sourceSeq) => {
+      const existing = liveEntries.get(sourceSeq);
+      if (existing === void 0) {
+        return 0;
+      }
+      const attempts = existing.attempts + 1;
+      liveEntries.set(sourceSeq, { ...existing, attempts });
+      append({ op: "attempt", sourceSeq, attempts });
+      return attempts;
+    },
+    ack: (sourceSeq) => {
+      if (!liveEntries.has(sourceSeq)) {
+        return;
+      }
+      append({ op: "ack", sourceSeq });
+      liveEntries.delete(sourceSeq);
+    },
+    deadLetter: (sourceSeq) => {
+      const entry = liveEntries.get(sourceSeq);
+      if (entry === void 0) {
+        return void 0;
+      }
+      append({ op: "dead", sourceSeq });
+      liveEntries.delete(sourceSeq);
+      log2("inbound_queue.dead_lettered", {
+        path: path2,
+        sourceSeq,
+        attempts: entry.attempts,
+        ageMs: Date.now() - entry.enqueuedAtMs
+      });
+      return entry;
+    },
+    highWaterSourceSeq: () => highWater,
+    tornTail: () => tornTail,
+    reconciledTornTail: () => {
+      tornTail = false;
+    },
+    compact: () => {
+      const records = [...liveEntries.values()].sort((a, b) => a.sourceSeq - b.sourceSeq).flatMap((entry) => {
+        const out = [
+          {
+            op: "enqueue",
+            sourceSeq: entry.sourceSeq,
+            kind: entry.kind,
+            payload: entry.payload,
+            enqueuedAtMs: entry.enqueuedAtMs
+          }
+        ];
+        if (entry.attempts > 0) {
+          out.push({
+            op: "attempt",
+            sourceSeq: entry.sourceSeq,
+            attempts: entry.attempts
+          });
+        }
+        return out;
+      });
+      if (highWater !== void 0 && !liveEntries.has(highWater)) {
+        records.push({ op: "ack", sourceSeq: highWater });
+      }
+      try {
+        mkdirSync13(dirname14(path2), { recursive: true });
+        const tmpPath = `${path2}.tmp`;
+        const tmpFd = openSync4(tmpPath, "w");
+        try {
+          writeSync2(tmpFd, records.map(frameRecord).join(""), null, "utf8");
+          fsyncFd(tmpFd);
+        } finally {
+          closeSync3(tmpFd);
+        }
+        renameSync4(tmpPath, path2);
+        fsyncDir();
+      } catch (error) {
+        log2("inbound_queue.compact_failed", {
+          path: path2,
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  };
+}
+function foldFile(path2, log2) {
+  let raw;
+  try {
+    raw = readFileSync17(path2, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return { entries: [], highWaterSourceSeq: void 0, tornTail: false };
+    }
+    log2("inbound_queue.read_failed", {
+      path: path2,
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return { entries: [], highWaterSourceSeq: void 0, tornTail: false };
+  }
+  const folded = foldQueueRecords(raw.split("\n"));
+  if (folded.tornTail) {
+    log2("inbound_queue.torn_tail_detected", {
+      path: path2,
+      liveEntries: folded.entries.length,
+      highWaterSourceSeq: folded.highWaterSourceSeq ?? null
+    });
+  }
+  return folded;
+}
+function durableInboundQueueDir() {
+  const override = process.env.LINZUMI_INBOUND_QUEUE_DIR?.trim();
+  if (override !== void 0 && override !== "") {
+    return override;
+  }
+  return join21(homedir14(), ".linzumi", "inbound-queue");
+}
+function durableInboundQueuePath(workspace, channel, threadId) {
+  const composite = `${workspace}:${channel}:${threadId}`;
+  const sanitized = composite.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  const digest = createHash6("sha256").update(composite).digest("hex").slice(0, 12);
+  const stem = sanitized === "" ? "thread" : sanitized;
+  return join21(durableInboundQueueDir(), `${stem}.${digest}.log`);
+}
+var defaultDeadLetterPolicy;
+var init_durableInboundQueue = __esm({
+  "src/durableInboundQueue.ts"() {
+    "use strict";
+    init_protocol();
+    defaultDeadLetterPolicy = {
+      maxAttempts: 8,
+      maxAgeMs: 30 * 60 * 1e3
+    };
+  }
+});
+
+// src/appliedSourceSeqWatermark.ts
+function threadSourceSeqWatermarkKey(workspace, channel, threadId) {
+  return `${workspace} ${channel} ${threadId}`;
+}
+function shouldApplySourceSeq(appliedSourceSeq, sourceSeq) {
+  return appliedSourceSeq === void 0 || sourceSeq > appliedSourceSeq;
+}
+function commitAppliedSourceSeq(store, key, sourceSeq) {
+  store.onAdvance(key, sourceSeq);
+  store.flush();
+}
+function highestProcessedSourceSeq(rows) {
+  let highest;
+  for (const row of rows) {
+    if (row.status === "processed" || row.status === "failed") {
+      highest = highest === void 0 ? row.sourceSeq : Math.max(highest, row.sourceSeq);
+    }
+  }
+  return highest;
+}
+function reconcileAppliedSourceSeq(localWatermark, serverRows) {
+  const serverHigh = highestProcessedSourceSeq(serverRows);
+  if (localWatermark === void 0) {
+    return serverHigh;
+  }
+  if (serverHigh === void 0) {
+    return localWatermark;
+  }
+  return Math.max(localWatermark, serverHigh);
+}
+function parseResumeReconcileEntries(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const entries = [];
+  for (const item of value) {
+    if (!isJsonObject(item)) {
+      continue;
+    }
+    const threadId = item.threadId;
+    if (typeof threadId !== "string") {
+      continue;
+    }
+    const rawChannelId = item.channelId;
+    const channelId = typeof rawChannelId === "string" ? rawChannelId : typeof rawChannelId === "number" ? String(rawChannelId) : "";
+    const highest = item.highestProcessedSourceSeq;
+    const leaseEpoch = item.leaseEpoch;
+    entries.push({
+      channelId,
+      threadId,
+      highestProcessedSourceSeq: typeof highest === "number" && Number.isInteger(highest) ? highest : void 0,
+      leaseEpoch: typeof leaseEpoch === "number" && Number.isInteger(leaseEpoch) ? leaseEpoch : void 0
+    });
+  }
+  return entries;
+}
+function resumeReconcileServerRows(entry) {
+  if (entry.highestProcessedSourceSeq === void 0) {
+    return [];
+  }
+  return [{ sourceSeq: entry.highestProcessedSourceSeq, status: "processed" }];
+}
+var init_appliedSourceSeqWatermark = __esm({
+  "src/appliedSourceSeqWatermark.ts"() {
+    "use strict";
+    init_protocol();
+  }
+});
+
+// src/threadReconcilerLock.ts
+function createThreadReconcilerLock() {
+  const tails = /* @__PURE__ */ new Map();
+  const depth = /* @__PURE__ */ new Map();
+  const runExclusive = (threadId, fn, deadlineMs) => {
+    const prior = tails.get(threadId) ?? Promise.resolve();
+    depth.set(threadId, (depth.get(threadId) ?? 0) + 1);
+    const run = prior.catch(() => void 0).then(() => fn());
+    let caller;
+    if (deadlineMs === void 0 || deadlineMs <= 0) {
+      caller = run;
+    } else {
+      caller = new Promise((resolve12, reject) => {
+        const timer = setTimeout(() => {
+          reject(new ReconcilerLockTimeoutError(threadId, deadlineMs));
+        }, deadlineMs);
+        timer.unref?.();
+        run.then(
+          (value) => {
+            clearTimeout(timer);
+            resolve12(value);
+          },
+          (error) => {
+            clearTimeout(timer);
+            reject(error);
+          }
+        );
+      });
+    }
+    const settled = run.then(
+      () => void 0,
+      () => void 0
+    );
+    tails.set(threadId, settled);
+    void settled.then(() => {
+      const remaining = (depth.get(threadId) ?? 1) - 1;
+      if (remaining <= 0) {
+        depth.delete(threadId);
+        if (tails.get(threadId) === settled) {
+          tails.delete(threadId);
+        }
+      } else {
+        depth.set(threadId, remaining);
+      }
+    });
+    return caller;
+  };
+  return {
+    runExclusive,
+    isBusy: (threadId) => (depth.get(threadId) ?? 0) > 0,
+    activeThreadCount: () => tails.size
+  };
+}
+var ReconcilerLockTimeoutError;
+var init_threadReconcilerLock = __esm({
+  "src/threadReconcilerLock.ts"() {
+    "use strict";
+    ReconcilerLockTimeoutError = class extends Error {
+      threadId;
+      timeoutMs;
+      constructor(threadId, timeoutMs) {
+        super(
+          `reconciler section for thread ${threadId} exceeded ${timeoutMs}ms`
+        );
+        this.name = "ReconcilerLockTimeoutError";
+        this.threadId = threadId;
+        this.timeoutMs = timeoutMs;
+      }
+    };
+  }
+});
+
+// src/runnerLifecycleGuards.ts
+async function runDrain(steps, deadlineMs, log2) {
+  let timedOut = false;
+  const deadline = new Promise((resolve12) => {
+    const timer = setTimeout(() => resolve12("timeout"), deadlineMs);
+    timer.unref?.();
+  });
+  const ordered = (async () => {
+    await steps.stopAccepting();
+    await steps.checkpointCurrentTurn();
+    await steps.flushInboundQueues();
+    await steps.flushOutbox();
+    return "done";
+  })();
+  const outcome = await Promise.race([
+    ordered.then(() => "done"),
+    deadline
+  ]);
+  if (outcome === "timeout") {
+    timedOut = true;
+    log2("runner.drain_timed_out", { deadlineMs });
+  } else {
+    log2("runner.drain_complete", {});
+  }
+  return { drained: outcome === "done", timedOut };
+}
+function installDrainOnSigterm(args) {
+  const exit = args.exit ?? ((code) => process.exit(code));
+  const signals2 = args.signals ?? ["SIGTERM", "SIGINT"];
+  let draining = false;
+  const onSignal = (signal) => {
+    if (draining) {
+      args.log("runner.drain_signal_ignored", { signal });
+      return;
+    }
+    draining = true;
+    args.log("runner.drain_started", { signal });
+    void runDrain(args.steps, args.deadlineMs, args.log).catch((error) => {
+      args.log("runner.drain_failed", {
+        message: error instanceof Error ? error.message : String(error)
+      });
+      return { drained: false, timedOut: false };
+    }).finally(() => exit(0));
+  };
+  const handlers = signals2.map((signal) => {
+    const handler = () => onSignal(signal);
+    process.on(signal, handler);
+    return { signal, handler };
+  });
+  return () => {
+    for (const { signal, handler } of handlers) {
+      process.off(signal, handler);
+    }
+  };
+}
+var init_runnerLifecycleGuards = __esm({
+  "src/runnerLifecycleGuards.ts"() {
+    "use strict";
+  }
+});
+
+// src/leaseEpochGuard.ts
+function createLeaseEpochRegistry() {
+  const epochs = /* @__PURE__ */ new Map();
+  return {
+    current: (threadId) => epochs.get(threadId),
+    adopt: (threadId, leaseEpoch) => {
+      if (!Number.isInteger(leaseEpoch)) {
+        return false;
+      }
+      const existing = epochs.get(threadId);
+      if (existing !== void 0 && leaseEpoch < existing) {
+        return false;
+      }
+      if (existing === leaseEpoch) {
+        return false;
+      }
+      epochs.set(threadId, leaseEpoch);
+      return true;
+    },
+    release: (threadId) => {
+      epochs.delete(threadId);
+    },
+    snapshot: () => [...epochs.entries()].map(([threadId, leaseEpoch]) => ({
+      threadId,
+      leaseEpoch
+    }))
+  };
+}
+function isFencedClaim(heldEpoch, controlEpoch) {
+  if (controlEpoch === void 0) {
+    return false;
+  }
+  if (heldEpoch === void 0) {
+    return false;
+  }
+  return controlEpoch < heldEpoch;
+}
+function readLeaseEpoch(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  const epoch = value.lease_epoch;
+  return typeof epoch === "number" && Number.isInteger(epoch) ? epoch : void 0;
+}
+var init_leaseEpochGuard = __esm({
+  "src/leaseEpochGuard.ts"() {
+    "use strict";
+  }
+});
+
+// src/resumeKeystone.ts
+function commitLiveAcceptedSourceSeq(args) {
+  const applied = args.store.initial(args.watermarkKey);
+  if (!shouldApplySourceSeq(applied, args.sourceSeq)) {
+    return false;
+  }
+  commitAppliedSourceSeq(args.store, args.watermarkKey, args.sourceSeq);
+  return true;
+}
+async function applyResumeDispatchOutcome(args) {
+  const policy = args.policy ?? defaultDeadLetterPolicy;
+  const nowMs = args.nowMs ?? Date.now();
+  if (args.outcome === "dispatched") {
+    commitAppliedSourceSeq(args.store, args.watermarkKey, args.sourceSeq);
+    args.queue.ack(args.sourceSeq);
+    return;
+  }
+  if (args.outcome === "ignored") {
+    args.queue.ack(args.sourceSeq);
+    return;
+  }
+  if (args.outcome === "permanent_failed") {
+    const attempts2 = findEntryAttempts(args.queue, args.sourceSeq);
+    args.queue.deadLetter(args.sourceSeq);
+    await args.onDeadLetter?.({
+      threadId: args.threadId,
+      sourceSeq: args.sourceSeq,
+      reason: "permanent",
+      attempts: attempts2,
+      alreadyPublished: true
+    });
+    return;
+  }
+  const attempts = args.queue.recordAttempt(args.sourceSeq);
+  const entry = args.queue.entries().find((candidate) => candidate.sourceSeq === args.sourceSeq);
+  if (entry !== void 0 && shouldDeadLetter(entry, policy, nowMs)) {
+    args.log("resume_keystone.dead_lettered", {
+      threadId: args.threadId,
+      sourceSeq: args.sourceSeq,
+      attempts
+    });
+    args.queue.deadLetter(args.sourceSeq);
+    await args.onDeadLetter?.({
+      threadId: args.threadId,
+      sourceSeq: args.sourceSeq,
+      reason: "exhausted",
+      attempts,
+      alreadyPublished: false
+    });
+  }
+}
+function findEntryAttempts(queue, sourceSeq) {
+  return queue.entries().find((candidate) => candidate.sourceSeq === sourceSeq)?.attempts ?? 0;
+}
+async function drainQueueHeadInOrder(args) {
+  const dispatched = [];
+  let headOutcome = "ignored";
+  let firstOutcomeRecorded = false;
+  let guard = args.queue.entries().length + 1;
+  while (guard > 0) {
+    guard -= 1;
+    const head = args.queue.head();
+    if (head === void 0) {
+      break;
+    }
+    const applied = args.store.initial(args.watermarkKey);
+    if (!shouldApplySourceSeq(applied, head.sourceSeq)) {
+      args.queue.ack(head.sourceSeq);
+      continue;
+    }
+    if (args.onlyDispatchUnattempted && args.serverRows.length === 0 && head.attempts > 0) {
+      args.log("resume_keystone.attempted_entry_withheld", {
+        threadId: args.threadId,
+        sourceSeq: head.sourceSeq,
+        attempts: head.attempts
+      });
+      args.queue.deadLetter(head.sourceSeq);
+      await args.onDeadLetter?.({
+        threadId: args.threadId,
+        sourceSeq: head.sourceSeq,
+        reason: "withheld",
+        attempts: head.attempts,
+        alreadyPublished: false
+      });
+      continue;
+    }
+    const outcome = await args.dispatch(head.sourceSeq, head.payload);
+    await applyResumeDispatchOutcome({
+      queue: args.queue,
+      store: args.store,
+      watermarkKey: args.watermarkKey,
+      sourceSeq: head.sourceSeq,
+      threadId: args.threadId,
+      outcome,
+      log: args.log,
+      policy: args.policy,
+      nowMs: args.nowMs,
+      onDeadLetter: args.onDeadLetter
+    });
+    if (!firstOutcomeRecorded) {
+      headOutcome = outcome;
+      firstOutcomeRecorded = true;
+    }
+    if (outcome === "dispatched") {
+      dispatched.push(head.sourceSeq);
+    }
+    if (outcome === "transient_failed") {
+      break;
+    }
+  }
+  return { dispatched, headOutcome };
+}
+async function receiveResumeMessage(args) {
+  args.queue.enqueue(
+    args.sourceSeq,
+    args.kind,
+    args.payload,
+    args.nowMs ?? Date.now()
+  );
+  const heldEpoch = args.leases.current(args.threadId);
+  if (isFencedClaim(heldEpoch, args.leaseEpoch)) {
+    args.log("resume_keystone.fenced", {
+      threadId: args.threadId,
+      heldLeaseEpoch: heldEpoch ?? null,
+      controlLeaseEpoch: args.leaseEpoch ?? null,
+      sourceSeq: args.sourceSeq
+    });
+    args.queue.ack(args.sourceSeq);
+    return "ignored";
+  }
+  if (args.leaseEpoch !== void 0) {
+    args.leases.adopt(args.threadId, args.leaseEpoch);
+  }
+  const serverRows = args.serverRows ?? [];
+  if (serverRows.length > 0) {
+    const localWatermark = args.store.initial(args.watermarkKey);
+    const reconciled = reconcileAppliedSourceSeq(localWatermark, serverRows);
+    if (reconciled !== void 0 && reconciled !== localWatermark) {
+      commitAppliedSourceSeq(args.store, args.watermarkKey, reconciled);
+      args.log("resume_keystone.live_miss_reconciled", {
+        threadId: args.threadId,
+        reconciledWatermark: reconciled,
+        sourceSeq: args.sourceSeq
+      });
+    }
+  }
+  const applied = args.store.initial(args.watermarkKey);
+  if (!shouldApplySourceSeq(applied, args.sourceSeq)) {
+    args.log("resume_keystone.already_applied", {
+      threadId: args.threadId,
+      sourceSeq: args.sourceSeq,
+      appliedSourceSeq: applied ?? null
+    });
+    args.queue.ack(args.sourceSeq);
+    return "ignored";
+  }
+  const deadlineMs = args.reconcilerDeadlineMs ?? defaultResumeReconcilerDeadlineMs;
+  try {
+    const result = await args.lock.runExclusive(
+      args.threadId,
+      () => drainQueueHeadInOrder({
+        queue: args.queue,
+        store: args.store,
+        watermarkKey: args.watermarkKey,
+        threadId: args.threadId,
+        serverRows,
+        dispatch: args.dispatch,
+        log: args.log,
+        nowMs: args.nowMs,
+        policy: args.policy,
+        onlyDispatchUnattempted: args.onlyDispatchUnattempted ?? false,
+        onDeadLetter: args.onDeadLetter
+      }),
+      deadlineMs
+    );
+    return result.headOutcome;
+  } catch (error) {
+    if (error instanceof ReconcilerLockTimeoutError) {
+      args.log("resume_keystone.spawn_deadline_exceeded", {
+        threadId: args.threadId,
+        sourceSeq: args.sourceSeq,
+        deadlineMs
+      });
+      return "transient_failed";
+    }
+    throw error;
+  }
+}
+async function drainResumeQueue(args) {
+  let dispatched = [];
+  const serverRows = args.serverRows ?? [];
+  const deadlineMs = args.reconcilerDeadlineMs ?? defaultResumeReconcilerDeadlineMs;
+  const runDrain2 = async () => {
+    const localWatermark = args.store.initial(args.watermarkKey);
+    const reconciled = reconcileAppliedSourceSeq(localWatermark, serverRows);
+    if (reconciled !== void 0 && reconciled !== localWatermark) {
+      commitAppliedSourceSeq(args.store, args.watermarkKey, reconciled);
+    }
+    if (args.queue.tornTail()) {
+      if (serverRows.length > 0) {
+        args.log("resume_keystone.torn_tail", {
+          threadId: args.threadId,
+          reconciledWatermark: reconciled ?? null,
+          recovery: "server_reconcile"
+        });
+        args.queue.reconciledTornTail();
+      } else {
+        args.log("resume_keystone.torn_tail_unrecoverable", {
+          threadId: args.threadId,
+          reconciledWatermark: reconciled ?? null
+        });
+        if (args.onTornTailUnrecoverable !== void 0) {
+          await args.onTornTailUnrecoverable(args.threadId);
+        }
+        args.queue.reconciledTornTail();
+      }
+    }
+    const result = await drainQueueHeadInOrder({
+      queue: args.queue,
+      store: args.store,
+      watermarkKey: args.watermarkKey,
+      threadId: args.threadId,
+      serverRows,
+      dispatch: args.dispatch,
+      log: args.log,
+      nowMs: args.nowMs,
+      policy: args.policy,
+      onlyDispatchUnattempted: args.onlyDispatchUnattempted ?? false,
+      onDeadLetter: args.onDeadLetter
+    });
+    dispatched = result.dispatched;
+  };
+  try {
+    await args.lock.runExclusive(args.threadId, runDrain2, deadlineMs);
+  } catch (error) {
+    if (error instanceof ReconcilerLockTimeoutError) {
+      args.log("resume_keystone.drain_deadline_exceeded", {
+        threadId: args.threadId,
+        deadlineMs
+      });
+      return dispatched;
+    }
+    throw error;
+  }
+  return dispatched;
+}
+var defaultResumeReconcilerDeadlineMs;
+var init_resumeKeystone = __esm({
+  "src/resumeKeystone.ts"() {
+    "use strict";
+    init_durableInboundQueue();
+    init_appliedSourceSeqWatermark();
+    init_leaseEpochGuard();
+    init_threadReconcilerLock();
+    defaultResumeReconcilerDeadlineMs = 12e4;
+  }
+});
+
 // src/runner.ts
 import { spawn as spawn9, spawnSync as spawnSync5 } from "node:child_process";
-import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash7, randomUUID as randomUUID4 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
+  closeSync as closeSync4,
   existsSync as existsSync13,
+  fsyncSync as fsyncSync2,
   lstatSync,
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync14,
   mkdtempSync as mkdtempSync4,
+  openSync as openSync5,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   realpathSync as realpathSync6,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   rmSync as rmSync5,
   statSync as statSync3,
   writeFileSync as writeFileSync12
 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir14, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir15, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
 import { createInterface } from "node:readline";
 import {
   basename as basename8,
-  dirname as dirname14,
+  dirname as dirname15,
   extname as extname2,
   isAbsolute as isAbsolute5,
-  join as join21,
+  join as join22,
   resolve as resolve8
 } from "node:path";
 async function runLocalCodexRunner(options) {
@@ -23623,7 +24571,11 @@ async function runLocalCodexRunner(options) {
     removeHandlers: void 0
   };
   const close = () => closeCleanupStack(cleanup);
-  cleanup.removeHandlers = installCleanupHandlers(close);
+  const runnerDrainHooks = {
+    stopAccepting: () => void 0,
+    flushInboundQueues: () => void 0
+  };
+  cleanup.removeHandlers = installCleanupHandlers(close, runnerDrainHooks, log2);
   log2("runner.starting", {
     runnerId: options.runnerId,
     cwd: options.cwd,
@@ -23667,7 +24619,13 @@ async function runLocalCodexRunner(options) {
         runnerId: options.runnerId
       });
     }
-    return await openLocalCodexRunner(options, log2, cleanup, close);
+    return await openLocalCodexRunner(
+      options,
+      log2,
+      cleanup,
+      close,
+      runnerDrainHooks
+    );
   } catch (error) {
     await close().catch(() => void 0);
     throw error;
@@ -23715,12 +24673,81 @@ async function runThreadCodexWorker(options) {
   await waitForThreadCodexWorkerStop(started.process);
   stop();
 }
-async function openLocalCodexRunner(options, log2, cleanup, close) {
+function codexAuthStatusFromLoginStatus(exitCode, stdout, stderr) {
+  const output = `${stdout}
+${stderr}`.toLowerCase();
+  const loggedOut = output.includes("not logged in") || output.includes("not authenticated") || output.includes("login required") || output.includes("please log in");
+  if (loggedOut) {
+    return "not_logged_in";
+  }
+  if (exitCode === 0) {
+    return "logged_in";
+  }
+  return "probe_failed";
+}
+function errorMatchesCode(error, code) {
+  return error.code === code;
+}
+function probeCodexAuthStatus(codexBin, cwd) {
+  return new Promise((resolve12) => {
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let resolved = false;
+    let timeout;
+    const resolveOnce = (status) => {
+      if (resolved) {
+        return;
+      }
+      resolved = true;
+      if (timeout !== void 0) {
+        clearTimeout(timeout);
+      }
+      resolve12(status);
+    };
+    const child = spawn9(codexBin, ["login", "status"], {
+      cwd,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    timeout = setTimeout(() => {
+      child.kill("SIGTERM");
+      resolveOnce("probe_failed");
+    }, CODEX_AUTH_STATUS_PROBE_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+    });
+    child.once("error", (error) => {
+      resolveOnce(
+        errorMatchesCode(error, "ENOENT") ? "binary_missing" : "probe_failed"
+      );
+    });
+    child.once("exit", (code) => {
+      resolveOnce(
+        codexAuthStatusFromLoginStatus(
+          code,
+          Buffer.concat(stdoutChunks).toString("utf8"),
+          Buffer.concat(stderrChunks).toString("utf8")
+        )
+      );
+    });
+  });
+}
+async function openLocalCodexRunner(options, log2, cleanup, close, runnerDrainHooks) {
   const agentProviders = availableRunnerAgentProviders(options);
   const localCodexAppServerAvailable = hasLocalCodexAppServerCapability(options);
   const dependencyStatusRef = {
     value: options.dependencyStatus
   };
+  const codexAuthStatusRef = {
+    value: await probeCodexAuthStatus(options.codexBin, options.cwd)
+  };
+  log2("runner.codex_auth_status_probed", {
+    runnerId: options.runnerId,
+    codex_auth_status: codexAuthStatusRef.value
+  });
   const refreshDependencyStatus = async () => {
     if (dependencyStatusRef.value === void 0) {
       return;
@@ -23746,6 +24773,27 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
       });
     }
   };
+  const refreshCodexAuthStatus = async () => {
+    try {
+      const refreshed = await probeCodexAuthStatus(
+        options.codexBin,
+        options.cwd
+      );
+      const previous = codexAuthStatusRef.value;
+      codexAuthStatusRef.value = refreshed;
+      log2("runner.codex_auth_status_reprobed", {
+        runnerId: options.runnerId,
+        codex_auth_status: refreshed,
+        codex_auth_status_changed: previous !== refreshed
+      });
+    } catch (error) {
+      codexAuthStatusRef.value = "probe_failed";
+      log2("runner.codex_auth_status_reprobe_failed", {
+        runnerId: options.runnerId,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  };
   const allowedForwardPorts = options.allowedForwardPorts ?? [];
   const liveForwardPorts = new Set(allowedForwardPorts);
   const managedForwardPorts = /* @__PURE__ */ new Set();
@@ -23899,6 +24947,16 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     // would silently drop it (and run against the user's personal account).
     // Old servers ignore the extra key.
     modelProviders: [...ADVERTISED_MODEL_PROVIDERS],
+    codexAuthStatus: codexAuthStatusRef.value,
+    // Launch policy from plans/2026-06-22-wafer-fallback-implementation-note.md:
+    // Wafer is globally offered by shipped Electron runners during launch, so
+    // this is intentionally an unconditional `true`. The server keeps a
+    // defensive fallback (`"wafer" in modelProviders`) for older CLIs that
+    // never advertised this key; that fallback is deliberately unreachable from
+    // current builds. If a future use case needs to disable Wafer per runner
+    // (e.g. enterprise/self-hosted credentials), make this conditional here
+    // rather than relying on the server inferring it from modelProviders.
+    waferAvailable: true,
     defaultAgentProvider: "codex",
     startInstance: allowedCwds.value.length > 0,
     durableClaudeSessionStore: true,
@@ -23947,6 +25005,124 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     runnerThreadSessionRegistryPath(options.runnerId),
     log2
   );
+  const appliedSourceSeqFileStore = createControlCursorFileStore(
+    appliedSourceSeqStorePath(options.runnerId),
+    log2,
+    // POWER-LOSS DURABLE (SEAM 1): this watermark is the SOLE fence that stops a
+    // confirmed-dispatched turn from being re-dispatched on restart, and it is
+    // paired with the fsynced durable inbound queue. fsync it on every flush so
+    // a power loss cannot lose a dispatch-confirm advance while the queue ack
+    // survived (which would double-execute the turn on reopen).
+    { fsyncOnWrite: true }
+  );
+  cleanup.actions.push(() => appliedSourceSeqFileStore.flush());
+  const appliedSourceSeqStore = {
+    initial: (key) => appliedSourceSeqFileStore.initial(key),
+    onAdvance: (key, sourceSeq) => appliedSourceSeqFileStore.onAdvance(key, sourceSeq),
+    flush: () => appliedSourceSeqFileStore.flush()
+  };
+  const commitLiveWorkerAcceptedSourceSeq = (args) => {
+    if (args.sourceSeq === void 0) {
+      return;
+    }
+    const watermarkKey = threadSourceSeqWatermarkKey(
+      inboundQueueWorkspace(),
+      args.channel,
+      args.threadId
+    );
+    const advanced = commitLiveAcceptedSourceSeq({
+      store: appliedSourceSeqStore,
+      watermarkKey,
+      sourceSeq: args.sourceSeq
+    });
+    if (advanced) {
+      log2("runner.live_worker_source_seq_committed", {
+        kandanThreadId: args.threadId,
+        channel: args.channel,
+        sourceSeq: args.sourceSeq
+      });
+    }
+    capturedLiveFollowUpEvents.delete(
+      capturedFollowUpKey(args.channel, args.threadId, args.sourceSeq)
+    );
+  };
+  const liveSourceSeqAlreadyApplied = (args) => {
+    if (args.sourceSeq === void 0) {
+      return false;
+    }
+    const watermarkKey = threadSourceSeqWatermarkKey(
+      inboundQueueWorkspace(),
+      args.channel,
+      args.threadId
+    );
+    const applied = appliedSourceSeqStore.initial(watermarkKey);
+    return !shouldApplySourceSeq(applied, args.sourceSeq);
+  };
+  const threadReconcilerLock = createThreadReconcilerLock();
+  const leaseEpochRegistry = createLeaseEpochRegistry();
+  const durableInboundQueues = /* @__PURE__ */ new Map();
+  const latestResumeReconcileByThread = /* @__PURE__ */ new Map();
+  let acceptingInbound = true;
+  const inboundQueueWorkspace = () => runnerWorkspaceSlug(options) ?? "default";
+  const resolveRunnerBoundChannel = () => options.channelSession?.channelSlug ?? threadSessionRegistry.list()[0]?.channel;
+  const durableInboundQueueFor = (channel, kandanThreadId) => {
+    const workspace = inboundQueueWorkspace();
+    const cacheKey = `${workspace}:${channel}:${kandanThreadId}`;
+    const existing = durableInboundQueues.get(cacheKey);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const queue = createDurableInboundThreadQueue(
+      durableInboundQueuePath(workspace, channel, kandanThreadId),
+      log2
+    );
+    durableInboundQueues.set(cacheKey, queue);
+    return queue;
+  };
+  const capturedLiveFollowUpEvents = /* @__PURE__ */ new Map();
+  const capturedFollowUpKey = (channel, threadId, seq2) => `${inboundQueueWorkspace()}:${channel}:${threadId}:${seq2}`;
+  const captureLiveFollowUpEvent = (channel, threadId, event) => {
+    capturedLiveFollowUpEvents.set(
+      capturedFollowUpKey(channel, threadId, event.seq),
+      event
+    );
+  };
+  const reEnqueueUndeliveredFollowUps = (args) => {
+    const queue = durableInboundQueueFor(args.channel, args.threadId);
+    for (const seq2 of args.sourceSeqs) {
+      const key = capturedFollowUpKey(args.channel, args.threadId, seq2);
+      const event = capturedLiveFollowUpEvents.get(key);
+      if (event === void 0) {
+        log2("runner.live_follow_up_recapture_missing", {
+          kandanThreadId: args.threadId,
+          channel: args.channel,
+          sourceSeq: seq2
+        });
+        continue;
+      }
+      const enqueued = queue.enqueue(
+        seq2,
+        "replay",
+        serializeKandanChatEventForQueue(event),
+        Date.now()
+      );
+      log2("runner.live_follow_up_re_enqueued_on_close", {
+        kandanThreadId: args.threadId,
+        channel: args.channel,
+        sourceSeq: seq2,
+        enqueued: enqueued.accepted
+      });
+      capturedLiveFollowUpEvents.delete(key);
+    }
+  };
+  runnerDrainHooks.stopAccepting = () => {
+    acceptingInbound = false;
+  };
+  runnerDrainHooks.flushInboundQueues = () => {
+    for (const queue of durableInboundQueues.values()) {
+      queue.compact();
+    }
+  };
   const controlEpochStore = createRunnerControlEpochStore(
     controlCursorStore,
     appliedStartTurnStore,
@@ -24788,6 +25964,8 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     codex,
     topic,
     instanceId,
+    // SEAM 2: source the held lease epoch for the stream-write fence echo.
+    leaseEpochFor: (threadId) => leaseEpochRegistry.current(threadId),
     options: {
       kandanUrl: options.kandanUrl,
       token: options.token,
@@ -24824,6 +26002,10 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
       // session is attached (the durable thread's worker fully died). Late-
       // bound to dodge the const's temporal dead zone (defined below).
       onUnroutedThreadMessage: (event) => handleUnroutedThreadMessage(event),
+      // BLOCKER B: codex live dispatch-confirm watermark commit on the main
+      // channel session too, off the same persisted authority the keystone
+      // gates on.
+      onLiveSourceSeqAccepted: commitLiveWorkerAcceptedSourceSeq,
       channelSession: options.channelSession
     },
     log: log2
@@ -25174,6 +26356,8 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
         codex: sessionCodex,
         topic,
         instanceId,
+        // SEAM 2: dynamic per-thread session also echoes the held lease epoch.
+        leaseEpochFor: (threadId) => leaseEpochRegistry.current(threadId),
         options: {
           kandanUrl: options.kandanUrl,
           token: options.token,
@@ -25188,6 +26372,11 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
           // it out of the const's temporal dead zone while still resolving the
           // live handler when an unrouted chat event actually arrives.
           onUnroutedThreadMessage: (event) => handleUnroutedThreadMessage(event),
+          // BLOCKER B: codex live dispatch-confirm watermark commit (the
+          // production-default double-exec fix). Fires from drainKandanMessageQueue
+          // when turn/start replies, off the SAME persisted authority the keystone
+          // gates on, so a codex worker-death + replay is gated 'ignored'.
+          onLiveSourceSeqAccepted: commitLiveWorkerAcceptedSourceSeq,
           pipelinePersistDir: commanderOutboxPersistDir(),
           enablePortForwardWatch: true,
           initialForwardPorts: allowedForwardPorts,
@@ -25566,7 +26755,12 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
               control,
               log2,
               onStartedThread,
-              void 0
+              void 0,
+              (id) => leaseEpochRegistry.current(id),
+              commitLiveWorkerAcceptedSourceSeq,
+              captureLiveFollowUpEvent,
+              reEnqueueUndeliveredFollowUps,
+              liveSourceSeqAlreadyApplied
             )
           );
       }
@@ -25609,6 +26803,7 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
         attachments: event.attachments,
         boundStartTimeout: true
       });
+      return "dispatched";
     } catch (error) {
       log2("runner.spawn_on_miss_failed", {
         kandanThreadId: event.threadId ?? null,
@@ -25622,6 +26817,7 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
         `could not resume the thread's coding session: ${error instanceof Error ? error.message : String(error)}`,
         record.codexThreadId
       );
+      return "transient_failed";
     }
   };
   const handleUnroutedThreadMessage = async (event) => {
@@ -25650,8 +26846,304 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     }
     const record = threadSessionRegistry.list().find((entry) => entry.kandanThreadId === kandanThreadId);
     if (record === void 0) {
-      return "ignored";
+      const boundChannel = resolveRunnerBoundChannel();
+      if (boundChannel === void 0 || !acceptingInbound) {
+        return "ignored";
+      }
+      const queue2 = durableInboundQueueFor(boundChannel, kandanThreadId);
+      const enqueued = queue2.enqueue(
+        event.seq,
+        event.localRunnerEventType === void 0 ? "live" : "replay",
+        serializeKandanChatEventForQueue(event),
+        Date.now()
+      );
+      log2("runner.spawn_on_miss_enqueued_without_local_record", {
+        kandanThreadId,
+        channel: boundChannel,
+        seq: event.seq,
+        enqueued: enqueued.accepted
+      });
+      await publishUnroutedDurableEnqueueState(boundChannel, event);
+      return "spawned";
+    }
+    const queueChannel = record.channel;
+    const watermarkKey = threadSourceSeqWatermarkKey(
+      inboundQueueWorkspace(),
+      queueChannel,
+      kandanThreadId
+    );
+    const queue = durableInboundQueueFor(queueChannel, kandanThreadId);
+    if (!acceptingInbound) {
+      const enqueued = queue.enqueue(
+        event.seq,
+        event.localRunnerEventType === void 0 ? "live" : "replay",
+        serializeKandanChatEventForQueue(event),
+        Date.now()
+      );
+      log2("runner.spawn_on_miss_drain_in_progress", {
+        kandanThreadId,
+        seq: event.seq,
+        enqueued: enqueued.accepted
+      });
+      return "spawned";
+    }
+    const outcome = await receiveResumeMessage({
+      queue,
+      store: appliedSourceSeqStore,
+      lock: threadReconcilerLock,
+      leases: leaseEpochRegistry,
+      threadId: kandanThreadId,
+      watermarkKey,
+      sourceSeq: event.seq,
+      kind: event.localRunnerEventType === void 0 ? "live" : "replay",
+      payload: serializeKandanChatEventForQueue(event),
+      leaseEpoch: readLeaseEpoch(event),
+      // Blocker #2: the keystone drains the queue HEAD in source_seq order, so
+      // the dispatch is keyed by (sourceSeq, payload) - it may run a LOWER
+      // pending seq before this arrived one. Reconstruct the event from the
+      // head's payload, exactly as the boot/rejoin drain does.
+      dispatch: async (sourceSeq, payload) => {
+        const drained = deserializeKandanChatEventFromQueue(payload);
+        if (drained === void 0) {
+          log2("runner.spawn_on_miss_bad_payload", {
+            kandanThreadId,
+            seq: sourceSeq
+          });
+          return "permanent_failed";
+        }
+        return await dispatchResumeForOwnedThread(drained, record);
+      },
+      // BLOCKER #4: pass the server's per-thread processed floor (the most-recent
+      // resume_reconcile rows) so the live-miss path reconciles
+      // highestProcessedSourceSeq into the watermark BEFORE dispatching - a
+      // completed-but-not-locally-acked turn that replays is gated 'ignored', not
+      // re-run. Empty until the server SEAM 1 half ships; then the floor is
+      // authoritative. The live-miss path leaves onlyDispatchUnattempted at its
+      // default (false): the arrived message is attempts===0 and the blind
+      // post-completion fence is owned by the boot/rejoin recovery drain, not this
+      // on-receipt path (changing it here would alter the existing live behavior).
+      serverRows: latestResumeReconcileByThread.get(kandanThreadId) ?? [],
+      // Blocker #3: surface a LOUD terminal `failed` state on any dead-letter.
+      onDeadLetter: deadLetterPublisherFor(record),
+      log: log2
+    });
+    return outcome === "ignored" ? "ignored" : "spawned";
+  };
+  const drainOwnedThreadQueue = async (record, serverRows = []) => {
+    if (!acceptingInbound) {
+      return;
+    }
+    const kandanThreadId = record.kandanThreadId;
+    const queueChannel = record.channel;
+    const watermarkKey = threadSourceSeqWatermarkKey(
+      inboundQueueWorkspace(),
+      queueChannel,
+      kandanThreadId
+    );
+    const queue = durableInboundQueueFor(queueChannel, kandanThreadId);
+    await drainResumeQueue({
+      queue,
+      store: appliedSourceSeqStore,
+      lock: threadReconcilerLock,
+      threadId: kandanThreadId,
+      watermarkKey,
+      serverRows,
+      log: log2,
+      // Until the SERVER message_state reconcile half (SEAM 1 server) ships, the
+      // drain runs with serverRows=[] in production. In that mode a post-
+      // completion-kill (turn confirmed-dispatched, then SIGKILL before the
+      // watermark flush + ack) leaves an attempted-but-unacked entry. Blindly
+      // re-dispatching it would double-execute the turn (real edits/commits), so
+      // gate the drain to UNATTEMPTED entries only: an attempted entry is dead-
+      // lettered with a loud `failed` state rather than re-run. Once serverRows
+      // is populated the reconcile fences already-run seqs and this gate is moot.
+      onlyDispatchUnattempted: serverRows.length === 0,
+      // Blocker #3: surface a LOUD terminal `failed` state on any dead-letter
+      // (exhausted retries, a withheld post-completion-kill entry, or a permanent
+      // failure) so a persistently-unbindable thread is never silently dropped.
+      onDeadLetter: deadLetterPublisherFor(record),
+      // A torn tail with no server reconcile cannot be re-derived on this branch
+      // (no server outbox/replay). Publish a loud "please resend" terminal state
+      // for the thread instead of silently dropping the lost tail.
+      onTornTailUnrecoverable: async (threadId) => {
+        const control = rehydrationReconnectControl(record);
+        await publishSpawnOnMissMessageState(
+          control,
+          "failed",
+          "a message may have been lost during an unexpected shutdown (power loss). Please resend your last message to continue this job.",
+          record.codexThreadId
+        );
+        log2("runner.inbound_torn_tail_resend_published", {
+          kandanThreadId: threadId
+        });
+      },
+      dispatch: async (sourceSeq, payload) => {
+        const event = deserializeKandanChatEventFromQueue(payload);
+        if (event === void 0) {
+          log2("runner.inbound_drain_bad_payload", {
+            kandanThreadId,
+            seq: sourceSeq
+          });
+          return "permanent_failed";
+        }
+        return await dispatchResumeForOwnedThread(event, record);
+      }
+    });
+  };
+  const drainThreadQueueAfterSpawn = async (kandanThreadId, spawnResponse) => {
+    if (spawnResponse !== void 0 && spawnResponse.ok === false) {
+      return;
+    }
+    if (!acceptingInbound) {
+      return;
+    }
+    const record = threadSessionRegistry.list().find((entry) => entry.kandanThreadId === kandanThreadId);
+    if (record === void 0) {
+      return;
+    }
+    const queue = durableInboundQueueFor(record.channel, kandanThreadId);
+    if (queue.entries().length === 0) {
+      return;
+    }
+    log2("runner.inbound_drain_after_spawn", {
+      kandanThreadId,
+      channel: record.channel,
+      pending: queue.entries().length
+    });
+    await drainOwnedThreadQueue(
+      record,
+      latestResumeReconcileByThread.get(kandanThreadId) ?? []
+    ).catch((error) => {
+      log2("runner.inbound_drain_after_spawn_failed", {
+        kandanThreadId,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    });
+  };
+  const startThreadRunnerProcessFromServerControl = async (control, cwd) => {
+    const response = await startThreadRunnerProcess(control, cwd);
+    const kandanThreadId = optionalThreadControlField(control, "threadId");
+    if (kandanThreadId !== void 0) {
+      await drainThreadQueueAfterSpawn(kandanThreadId, response);
+    }
+    return response;
+  };
+  const consumeResumeReconcile = (reconcileValue) => {
+    const byThread = /* @__PURE__ */ new Map();
+    const entries = parseResumeReconcileEntries(reconcileValue);
+    for (const entry of entries) {
+      if (entry.leaseEpoch !== void 0) {
+        const adopted = leaseEpochRegistry.adopt(entry.threadId, entry.leaseEpoch);
+        if (adopted) {
+          log2("runner.resume_reconcile_lease_adopted", {
+            kandanThreadId: entry.threadId,
+            leaseEpoch: entry.leaseEpoch
+          });
+        }
+      }
+      const rows = resumeReconcileServerRows(entry);
+      byThread.set(entry.threadId, rows);
+      latestResumeReconcileByThread.set(entry.threadId, rows);
+    }
+    if (entries.length > 0) {
+      log2("runner.resume_reconcile_consumed", { threadCount: entries.length });
+    }
+    return byThread;
+  };
+  const drainOrphanedThreadQueues = async () => {
+    const dir = durableInboundQueueDir();
+    let files;
+    try {
+      files = readdirSync4(dir).filter((name) => name.endsWith(".log"));
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        return;
+      }
+      log2("runner.inbound_orphan_scan_failed", {
+        message: error instanceof Error ? error.message : String(error)
+      });
+      return;
+    }
+    const workspace = inboundQueueWorkspace();
+    const owned = new Set(
+      threadSessionRegistry.list().map(
+        (record) => durableInboundQueuePath(
+          workspace,
+          record.channel,
+          record.kandanThreadId
+        )
+      )
+    );
+    for (const name of files) {
+      const path2 = join22(dir, name);
+      if (owned.has(path2)) {
+        continue;
+      }
+      try {
+        const queue = createDurableInboundThreadQueue(path2, log2);
+        const stranded = queue.entries();
+        if (stranded.length === 0) {
+          continue;
+        }
+        for (const entry of stranded) {
+          queue.deadLetter(entry.sourceSeq);
+        }
+        queue.compact();
+        log2("runner.inbound_orphan_dead_lettered", {
+          path: path2,
+          strandedCount: stranded.length,
+          strandedSeqs: stranded.map((e) => e.sourceSeq)
+        });
+      } catch (error) {
+        log2("runner.inbound_orphan_drain_failed", {
+          path: path2,
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
     }
+  };
+  const drainAllOwnedThreadQueues = async (reconcileByThread) => {
+    if (!acceptingInbound) {
+      return;
+    }
+    const records = threadSessionRegistry.list();
+    await Promise.all(
+      records.map(
+        (record) => drainOwnedThreadQueue(
+          record,
+          reconcileByThread?.get(record.kandanThreadId) ?? []
+        ).catch((error) => {
+          log2("runner.inbound_drain_failed", {
+            kandanThreadId: record.kandanThreadId,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        })
+      )
+    );
+    await drainOrphanedThreadQueues();
+  };
+  const bootReconcile = consumeResumeReconcile(
+    objectValue(joinResponse)?.resume_reconcile
+  );
+  const bootDrain = threadSessionRehydration.then(() => drainAllOwnedThreadQueues(bootReconcile)).catch((error) => {
+    log2("runner.inbound_boot_drain_failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+  });
+  cleanup.actions.push(() => bootDrain);
+  kandan.onReconnect((rejoinReplies) => {
+    const rejoinReply = rejoinReplies.get(topic);
+    const reconcile = consumeResumeReconcile(
+      rejoinReply === void 0 ? void 0 : rejoinReply.resume_reconcile
+    );
+    void drainAllOwnedThreadQueues(reconcile).catch((error) => {
+      log2("runner.inbound_rejoin_drain_failed", {
+        message: error instanceof Error ? error.message : String(error)
+      });
+    });
+  });
+  const dispatchResumeForOwnedThread = async (event, record) => {
+    const kandanThreadId = record.kandanThreadId;
     const baseControl = rehydrationReconnectControl(record);
     const providerBinding = threadModelProviderBindings.get(kandanThreadId);
     const reconnectControl = {
@@ -25681,7 +27173,7 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
         `could not resume the thread's coding session: working directory ${record.cwd} is not an allowed root (${cwd.reason})`,
         record.codexThreadId
       );
-      return "spawned";
+      return "permanent_failed";
     }
     const resolvedCwd = cwd.cwd;
     const inFlightSpawn = spawnOnMissInFlight.get(kandanThreadId);
@@ -25701,14 +27193,13 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
           `could not resume the thread's coding session: no live session after spawn`,
           record.codexThreadId
         );
-        return "spawned";
+        return "transient_failed";
       }
-      await replaySpawnOnMissMessageOnLiveSession(
+      return await replaySpawnOnMissMessageOnLiveSession(
         event,
         record,
         reconnectControl
       );
-      return "spawned";
     }
     log2("runner.spawn_on_miss_resuming", {
       kandanThreadId,
@@ -25729,12 +27220,11 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
       );
       if (threadStartDelegatedToSibling(startResult)) {
         spawnSettle("spawned");
-        await replaySpawnOnMissMessageOnLiveSession(
+        return await replaySpawnOnMissMessageOnLiveSession(
           event,
           record,
           reconnectControl
         );
-        return "spawned";
       }
       if (startResult === void 0 || startResult.ok === false) {
         spawnSettle("no_session");
@@ -25751,10 +27241,10 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
           `could not resume the thread's coding session: ${startError}`,
           record.codexThreadId
         );
-        return "spawned";
+        return "transient_failed";
       }
       spawnSettle("spawned");
-      return "spawned";
+      return "dispatched";
     } catch (error) {
       spawnSettle("no_session");
       log2("runner.spawn_on_miss_failed", {
@@ -25769,7 +27259,7 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
         `could not resume the thread's coding session: ${error instanceof Error ? error.message : String(error)}`,
         record.codexThreadId
       );
-      return "spawned";
+      return "transient_failed";
     } finally {
       spawnSettle("spawned");
       if (spawnOnMissInFlight.get(kandanThreadId) === spawnPromise) {
@@ -25795,6 +27285,49 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
       });
     }
   };
+  const publishUnroutedDurableEnqueueState = async (channel, event) => {
+    if (event.threadId === void 0) {
+      return;
+    }
+    const payload = {
+      workspace: inboundQueueWorkspace(),
+      channel,
+      thread_id: event.threadId,
+      instance_id: instanceId,
+      seq: event.seq,
+      status: "queued",
+      reason: "queued for durable resume"
+    };
+    try {
+      await kandan.push(topic, "message_state", payload);
+    } catch (error) {
+      log2("runner.spawn_on_miss_state_push_failed", {
+        thread_id: event.threadId,
+        status: "queued",
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  };
+  const deadLetterPublisherFor = (record) => {
+    return async ({ sourceSeq, reason, attempts, alreadyPublished }) => {
+      log2("runner.inbound_dead_lettered", {
+        kandanThreadId: record.kandanThreadId,
+        seq: sourceSeq,
+        reason,
+        attempts,
+        alreadyPublished
+      });
+      if (alreadyPublished) {
+        return;
+      }
+      await publishSpawnOnMissMessageState(
+        rehydrationReconnectControl(record),
+        "failed",
+        deadLetterFailedReason(reason),
+        record.codexThreadId
+      );
+    };
+  };
   const heartbeatPayload = () => ({
     instanceId,
     clientId,
@@ -26285,7 +27818,12 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
           control,
           log2,
           attachThreadSession,
-          shouldUseThreadProcesses(options) ? startThreadRunnerProcess : void 0
+          shouldUseThreadProcesses(options) ? startThreadRunnerProcessFromServerControl : void 0,
+          (id) => leaseEpochRegistry.current(id),
+          commitLiveWorkerAcceptedSourceSeq,
+          captureLiveFollowUpEvent,
+          reEnqueueUndeliveredFollowUps,
+          liveSourceSeqAlreadyApplied
         );
       }),
       commitStartTurnWatermark
@@ -26316,7 +27854,10 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     pendingControls,
     controlDispatcher,
     dispatchControl,
-    refreshDependencyStatus
+    async () => {
+      await refreshDependencyStatus();
+      await refreshCodexAuthStatus();
+    }
   );
   return { instanceId, codexUrl, close };
 }
@@ -26330,28 +27871,34 @@ function commanderOutboxPersistDir() {
   if (override !== void 0 && override !== "") {
     return override;
   }
-  return join21(homedir14(), ".linzumi", "commander-outbox");
+  return join22(homedir15(), ".linzumi", "commander-outbox");
+}
+function controlCursorsDir() {
+  const override = process.env.LINZUMI_CONTROL_CURSOR_DIR?.trim();
+  if (override !== void 0 && override !== "") {
+    return override;
+  }
+  return join22(homedir15(), ".linzumi", "control-cursors");
 }
 function controlCursorStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
-  const digest = createHash6("sha256").update(runnerId).digest("hex").slice(0, 8);
+  const digest = createHash7("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join21(
-    homedir14(),
-    ".linzumi",
-    "control-cursors",
-    `${stem}.${digest}.json`
-  );
+  return join22(controlCursorsDir(), `${stem}.${digest}.json`);
 }
 function appliedStartTurnStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
-  const digest = createHash6("sha256").update(runnerId).digest("hex").slice(0, 8);
+  const digest = createHash7("sha256").update(runnerId).digest("hex").slice(0, 8);
+  const stem = sanitized === "" ? "runner" : sanitized;
+  return join22(controlCursorsDir(), `${stem}.${digest}.start-turn.json`);
+}
+function appliedSourceSeqStorePath(runnerId) {
+  const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  const digest = createHash7("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join21(
-    homedir14(),
-    ".linzumi",
-    "control-cursors",
-    `${stem}.${digest}.start-turn.json`
+  return join22(
+    controlCursorsDir(),
+    `${stem}.${digest}.source-seq.json`
   );
 }
 function startTurnWatermarkKey(topic, threadId) {
@@ -26473,6 +28020,7 @@ function createConnectionStalenessTracker(log2, now = Date.now, thresholdMs = co
 }
 function createControlCursorFileStore(path2, log2, options) {
   const discardSeqsOnFirstEpochAdoption = options?.discardSeqsOnFirstEpochAdoption === true;
+  const fsyncOnWrite = options?.fsyncOnWrite === true;
   const { cursors, epoch: persistedEpoch } = readControlCursorFile(path2, log2);
   let epoch = persistedEpoch;
   let dirty = false;
@@ -26483,18 +28031,32 @@ function createControlCursorFileStore(path2, log2, options) {
     }
     dirty = false;
     try {
-      mkdirSync13(dirname14(path2), { recursive: true });
+      mkdirSync14(dirname15(path2), { recursive: true });
       const tmpPath = `${path2}.tmp`;
-      writeFileSync12(
-        tmpPath,
-        `${JSON.stringify({
-          ...epoch === void 0 ? {} : { [controlCursorEpochKey]: epoch },
-          ...Object.fromEntries(cursors)
-        })}
-`,
-        "utf8"
-      );
-      renameSync4(tmpPath, path2);
+      const contents = `${JSON.stringify({
+        ...epoch === void 0 ? {} : { [controlCursorEpochKey]: epoch },
+        ...Object.fromEntries(cursors)
+      })}
+`;
+      if (fsyncOnWrite) {
+        const fileFd = openSync5(tmpPath, "w");
+        try {
+          writeFileSync12(fileFd, contents, "utf8");
+          fsyncSync2(fileFd);
+        } finally {
+          closeSync4(fileFd);
+        }
+        renameSync5(tmpPath, path2);
+        const dirFd = openSync5(dirname15(path2), "r");
+        try {
+          fsyncSync2(dirFd);
+        } finally {
+          closeSync4(dirFd);
+        }
+      } else {
+        writeFileSync12(tmpPath, contents, "utf8");
+        renameSync5(tmpPath, path2);
+      }
     } catch (error) {
       log2("control_cursor_store.write_failed", {
         path: path2,
@@ -26593,7 +28155,7 @@ function readControlCursorFile(path2, log2) {
   const cursors = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync17(path2, "utf8");
+    raw = readFileSync18(path2, "utf8");
   } catch (error) {
     if (!isErrnoCode2(error, "ENOENT")) {
       log2("control_cursor_store.read_failed", {
@@ -26938,21 +28500,47 @@ function makeRunnerLogger(options) {
     consoleReporter
   );
 }
-function installCleanupHandlers(close) {
-  const closeAndExit = () => {
-    void close().catch(() => void 0).finally(() => process.exit(0));
-  };
+function installCleanupHandlers(close, drainHooks, log2) {
+  const uninstallDrain = installDrainOnSigterm({
+    steps: {
+      stopAccepting: () => {
+        drainHooks.stopAccepting();
+      },
+      // SCOPE NOTE (BET1, partial): checkpointing an in-flight turn on a LIVE
+      // worker (persisting enough codex turn state to resume it) is NOT
+      // implemented in this branch - that turn still relies on the server's
+      // rejoin replay. What IS durable is every durably-owned message that was
+      // ENQUEUED into the per-thread inbound queue (the respawn-window / spawn-on-
+      // miss path): flushInboundQueues fsyncs those below, and the boot/rejoin
+      // drain replays them. Left as an explicit no-op (not silently absent) so the
+      // gap is visible rather than implied-handled.
+      checkpointCurrentTurn: () => void 0,
+      flushInboundQueues: () => {
+        drainHooks.flushInboundQueues();
+      },
+      // The final flush also performs the connection teardown via close(): the
+      // cleanup stack runs after kandan.close() so no advance races the final
+      // cursor/watermark write.
+      flushOutbox: () => close().catch(() => void 0)
+    },
+    deadlineMs: runnerDrainExitDeadlineMs,
+    log: (event, fields) => log2(event, fields),
+    // SIGHUP is a drain-AND-EXIT signal too: a detached child of the Electron
+    // shell that receives a parent hangup must drain its inbound queue + cursor
+    // stores and then EXIT, never linger as a defunct lock-holder that does no
+    // work (the prior close()-without-exit handler left a zombie that stopped
+    // accepting, tore down its connection, yet never exited - stranding prior
+    // jobs and holding the runner lock). installDrainOnSigterm's handler exits
+    // after the drain (deadline-bounded), so routing SIGHUP through it fixes the
+    // orphan-zombie regression.
+    signals: ["SIGTERM", "SIGINT", "SIGHUP"]
+  });
   const closeOnExit = () => {
     void close().catch(() => void 0);
   };
-  process.once("SIGINT", closeAndExit);
-  process.once("SIGTERM", closeAndExit);
-  process.once("SIGHUP", closeAndExit);
   process.once("exit", closeOnExit);
   return () => {
-    process.off("SIGINT", closeAndExit);
-    process.off("SIGTERM", closeAndExit);
-    process.off("SIGHUP", closeAndExit);
+    uninstallDrain();
     process.off("exit", closeOnExit);
   };
 }
@@ -27255,7 +28843,7 @@ async function applyCodexUnavailableControl(kandan, topic, instanceId, control,
   }
   throw new Error(error);
 }
-async function applyControl(codex, kandan, topic, instanceId, options, agentProviders, allowedCwds, remoteCodexSandboxRunner, activeRemoteCodexExecRequests, activeClaudeCodeSessions, pendingClaudeCodeApprovals, ensureClaudeCodeForwardPortSession, disposeClaudeCodeForwardPortSession, control, log2, onStartedThread, onThreadProcessStart) {
+async function applyControl(codex, kandan, topic, instanceId, options, agentProviders, allowedCwds, remoteCodexSandboxRunner, activeRemoteCodexExecRequests, activeClaudeCodeSessions, pendingClaudeCodeApprovals, ensureClaudeCodeForwardPortSession, disposeClaudeCodeForwardPortSession, control, log2, onStartedThread, onThreadProcessStart, leaseEpochFor, onLiveSourceSeqAccepted, captureLiveFollowUpEvent, onUndeliveredFollowUpsAtClose, liveSourceSeqAlreadyApplied) {
   if (codex === void 0) {
     switch (control.type) {
       case "remote_codex_exec":
@@ -27448,6 +29036,9 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
             ensureClaudeCodeForwardPortSession,
             disposeClaudeCodeForwardPortSession,
             resumeSessionId: normalizedWorkDescription(control.resumeSessionId),
+            leaseEpochFor,
+            onLiveSourceSeqAccepted,
+            onUndeliveredFollowUpsAtClose,
             setStartupStage: (stage) => {
               startupStage = stage;
             }
@@ -27650,6 +29241,51 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
               message
             };
           }
+          const followUpThreadId = optionalThreadControlField(
+            control,
+            "threadId"
+          );
+          const followUpChannel = optionalThreadControlField(
+            control,
+            "channel"
+          );
+          if (sourceSeq !== void 0 && followUpThreadId !== void 0 && followUpChannel !== void 0) {
+            captureLiveFollowUpEvent?.(followUpChannel, followUpThreadId, {
+              seq: sourceSeq,
+              type: "thread.message",
+              actorKind: void 0,
+              actorSlug: void 0,
+              actorUserId: void 0,
+              threadId: followUpThreadId,
+              threadTitle: void 0,
+              replyToSeq: integerValue(control.rootSeq),
+              localRunnerEventType: void 0,
+              body: workDescription,
+              attachments
+            });
+          }
+          if (followUpChannel !== void 0 && followUpThreadId !== void 0 && liveSourceSeqAlreadyApplied?.({
+            channel: followUpChannel,
+            threadId: followUpThreadId,
+            sourceSeq
+          }) === true) {
+            log2("claude_code.message_duplicate_ignored", {
+              linzumi_thread_id: followUpThreadId,
+              claude_session_id: codexThreadId,
+              body_preview: claudeConsoleBodyPreview(workDescription),
+              source_seq: sourceSeq ?? null
+            });
+            return {
+              instanceId,
+              controlType: control.type,
+              agentProvider: "claude-code",
+              cwd: cwd.cwd,
+              matchedRoot: cwd.matchedRoot,
+              codexThreadId,
+              queuedInput: true,
+              duplicate: true
+            };
+          }
           try {
             const enqueueResult = activeSession.enqueueInput({
               content: contentResult.content,
@@ -27754,6 +29390,9 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
             pendingClaudeCodeApprovals,
             ensureClaudeCodeForwardPortSession,
             disposeClaudeCodeForwardPortSession,
+            leaseEpochFor,
+            onLiveSourceSeqAccepted,
+            onUndeliveredFollowUpsAtClose,
             setStartupStage: (stage) => {
               startupStage = stage;
             }
@@ -27797,6 +29436,30 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
         if (startedThreadSession === void 0 || sourceSeq === void 0) {
           throw new Error("cannot reconnect a Kandan thread without a session");
         }
+        const reconnectChannel = optionalThreadControlField(control, "channel");
+        const reconnectThreadId = optionalThreadControlField(
+          control,
+          "threadId"
+        );
+        if (reconnectChannel !== void 0 && reconnectThreadId !== void 0 && liveSourceSeqAlreadyApplied?.({
+          channel: reconnectChannel,
+          threadId: reconnectThreadId,
+          sourceSeq
+        }) === true) {
+          log2("kandan.reconnect_thread_seq_already_applied", {
+            linzumi_thread_id: reconnectThreadId,
+            codex_thread_id: codexThreadId,
+            source_seq: sourceSeq
+          });
+          return {
+            instanceId,
+            controlType: control.type,
+            cwd: cwd.cwd,
+            matchedRoot: cwd.matchedRoot,
+            codexThreadId,
+            duplicate: true
+          };
+        }
         await resumeCodexThreadForReconnect(
           codex,
           codexThreadId,
@@ -28543,11 +30206,13 @@ function claudeCodeTurnStallThresholdMs(env) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : defaultClaudeCodeTurnStallThresholdMs;
 }
 function createClaudeCodeInputQueue(input) {
+  const onSourceSeqDelivered = input.onSourceSeqDelivered;
   const pendingMessages = [
     claudeCodeUserInputMessage(input.content)
   ];
   const pendingSourceSeqs = [input.sourceSeq];
   const deferredFollowUps = [];
+  const deliveredSourceSeqs = /* @__PURE__ */ new Set();
   const waiters = [];
   const state = {
     closed: false
@@ -28563,6 +30228,10 @@ function createClaudeCodeInputQueue(input) {
   };
   const deliverNow = (message, sourceSeq) => {
     pendingSourceSeqs.push(sourceSeq);
+    if (sourceSeq !== void 0 && onSourceSeqDelivered !== void 0 && !deliveredSourceSeqs.has(sourceSeq)) {
+      deliveredSourceSeqs.add(sourceSeq);
+      onSourceSeqDelivered(sourceSeq);
+    }
     const waiter = waiters.shift();
     if (waiter === void 0) {
       pendingMessages.push(message);
@@ -28631,6 +30300,17 @@ function createClaudeCodeInputQueue(input) {
     },
     enqueue,
     enqueueSteer,
+    // BLOCKER A (don't drop deferred follow-ups on a kill): the parked,
+    // never-delivered follow-ups (a turn was in flight at close, so close()'s
+    // drain is intentionally skipped to avoid folding them into the active turn).
+    // Their watermark was NOT committed (commit fires only at deliverNow), so the
+    // runner must re-enqueue them into the DURABLE inbound queue; a kill-before-
+    // run then replays + runs them exactly once. Drains the parked list so a
+    // double-call cannot double-enqueue. Returns the un-run seqs+messages.
+    drainUndeliveredFollowUps: () => {
+      const drained = deferredFollowUps.splice(0);
+      return drained;
+    },
     completeTurn: () => {
       const completed = pendingSourceSeqs.shift();
       if (!state.closed && pendingSourceSeqs.length === 0) {
@@ -28857,7 +30537,21 @@ async function startClaudeCodeProviderInstance(args) {
   }
   const inputQueue = createClaudeCodeInputQueue({
     content: initialContentResult.content,
-    sourceSeq
+    sourceSeq,
+    // BLOCKER A: commit the persisted dedup watermark at DISPATCH (deliverNow),
+    // not at enqueue-accept. enqueueInput used to commit unconditionally right
+    // after inputQueue.enqueue, but enqueue PARKS a mid-turn follow-up in
+    // deferredFollowUps (a bare return) and a close-in-flight drops it - so a
+    // never-run seq was marked applied and its replay was gated 'ignored' (the
+    // drop). Committing only when the seq is actually delivered onto the live
+    // stream means a parked-but-unrun seq is never marked applied.
+    onSourceSeqDelivered: (deliveredSeq) => {
+      args.onLiveSourceSeqAccepted?.({
+        channel,
+        threadId,
+        sourceSeq: deliveredSeq
+      });
+    }
   });
   const developerPrompt = normalizedWorkDescription(
     args.control.developerPrompt
@@ -28966,7 +30660,8 @@ async function startClaudeCodeProviderInstance(args) {
       channelSlug: channel,
       kandanThreadId: threadId,
       codexThreadId: activeSessionId ?? args.resumeSessionId,
-      rootSeq
+      rootSeq,
+      leaseEpoch: args.leaseEpochFor?.(threadId)
     }),
     push: async (event, payload, _timeoutMs, onSent) => {
       const reply = await args.kandan.push(args.topic, event, payload, onSent);
@@ -29014,7 +30709,7 @@ async function startClaudeCodeProviderInstance(args) {
     log: args.log
   });
   const liveBashCapture = args.options.claudeCodeRunner === void 0 && claudeLiveBashCaptureEnabled(process.env) ? createClaudeCodeLiveBashCapture({
-    captureDir: join21(
+    captureDir: join22(
       tmpdir3(),
       `linzumi-claude-live-bash-${args.instanceId}`
     ),
@@ -29133,6 +30828,7 @@ async function startClaudeCodeProviderInstance(args) {
         linzumi_thread_id: threadId,
         claude_session_id: event.sessionId
       });
+      args.onLiveSourceSeqAccepted?.({ channel, threadId, sourceSeq });
       args.activeClaudeCodeSessions.set(event.sessionId, {
         abortController,
         workspace,
@@ -29341,6 +31037,15 @@ async function startClaudeCodeProviderInstance(args) {
           onTranscriptEvent
         });
       } finally {
+        const undeliveredFollowUps = inputQueue.drainUndeliveredFollowUps();
+        const undeliveredSeqs = undeliveredFollowUps.map((followUp) => followUp.sourceSeq).filter((seq) => seq !== void 0);
+        if (undeliveredSeqs.length > 0 && args.onUndeliveredFollowUpsAtClose !== void 0) {
+          args.onUndeliveredFollowUpsAtClose({
+            channel,
+            threadId,
+            sourceSeqs: undeliveredSeqs
+          });
+        }
         inputQueue.close();
         mcpAuthCleanup?.();
         liveBashCapture?.close();
@@ -29701,7 +31406,8 @@ ${developerPrompt}`,
       metadata: {
         local_codex_runner: {
           event_type: "codex_start_instructions",
-          codex_thread_id: codexThreadId
+          codex_thread_id: codexThreadId,
+          instructions_body: developerPrompt
         }
       }
     },
@@ -29864,15 +31570,15 @@ function rehydrationControlSnapshot(args) {
     ...runtimeSettings.fast === void 0 ? {} : { fast: runtimeSettings.fast }
   };
 }
-function kandanChatAttachmentsToWire(attachments) {
-  return attachments.map((attachment) => ({
-    ...attachment.id === void 0 ? {} : { id: attachment.id },
-    ...attachment.kind === void 0 ? {} : { kind: attachment.kind },
-    ...attachment.fileName === void 0 ? {} : { file_name: attachment.fileName },
-    ...attachment.contentType === void 0 ? {} : { content_type: attachment.contentType },
-    ...attachment.sizeBytes === void 0 ? {} : { size_bytes: attachment.sizeBytes },
-    ...attachment.url === void 0 ? {} : { url: attachment.url }
-  }));
+function deadLetterFailedReason(reason) {
+  switch (reason) {
+    case "exhausted":
+      return "couldn't resume this job after several attempts; please resend your last message to continue.";
+    case "withheld":
+      return "this message may have already run before an unexpected shutdown; it was not re-run to avoid duplicating work. Please resend if it did not complete.";
+    case "permanent":
+      return "couldn't resume this job's coding session.";
+  }
 }
 function rehydrationReconnectControl(record) {
   const snapshot = record.control;
@@ -30920,8 +32626,8 @@ function onboardingConversationOfficeImport(response) {
   return objectValue(metadata?.office_channel_import);
 }
 function onboardingConversationImportClientMessageId(importKey, itemKey) {
-  const importHash = createHash6("sha256").update(importKey).digest("hex");
-  const itemHash = createHash6("sha256").update(itemKey).digest("hex");
+  const importHash = createHash7("sha256").update(importKey).digest("hex");
+  const itemHash = createHash7("sha256").update(itemKey).digest("hex");
   return `onboarding-import:${importHash.slice(0, 32)}:${itemHash.slice(0, 24)}`;
 }
 async function uploadLocalConversationAttachments(args) {
@@ -31019,7 +32725,7 @@ async function localConversationAttachmentFile(candidatePath, attachment) {
       };
     }
     case "path": {
-      const path2 = isAbsolute5(attachment.path) ? attachment.path : resolve8(dirname14(candidatePath), attachment.path);
+      const path2 = isAbsolute5(attachment.path) ? attachment.path : resolve8(dirname15(candidatePath), attachment.path);
       try {
         const bytes = await readFile2(path2);
         return {
@@ -31474,9 +33180,9 @@ function mcpOwnerUsername(options) {
   return options.channelSession?.listenUser ?? identityFromAccessToken(options.token).actorUsername;
 }
 function writeEphemeralMcpAuthFile(options) {
-  const directory = mkdtempSync4(join21(tmpdir3(), "linzumi-mcp-auth-"));
+  const directory = mkdtempSync4(join22(tmpdir3(), "linzumi-mcp-auth-"));
   chmodSync2(directory, 448);
-  const path2 = join21(directory, "auth.json");
+  const path2 = join22(directory, "auth.json");
   writeCachedLocalRunnerToken({
     kandanUrl: options.kandanUrl,
     accessToken: options.token,
@@ -31552,7 +33258,7 @@ function configuredAllowedCwds(values, options = {}) {
     const absolutePath = resolve8(expandUserPath(value));
     try {
       if (options.createMissing === true) {
-        mkdirSync13(absolutePath, { recursive: true });
+        mkdirSync14(absolutePath, { recursive: true });
       }
       const realPath = realpathSync6(absolutePath);
       allowedCwds.push(
@@ -31589,7 +33295,7 @@ function allowedCwdProjects(allowedCwds) {
   });
 }
 function isGitProjectDirectory(cwd) {
-  const gitPath = join21(cwd, ".git");
+  const gitPath = join22(cwd, ".git");
   try {
     const gitPathStats = statSync3(gitPath);
     return gitPathStats.isDirectory() || gitPathStats.isFile();
@@ -31612,9 +33318,9 @@ function browseRunnerDirectory(control, options) {
         error: "not_directory"
       };
     }
-    const parent = dirname14(currentPath);
+    const parent = dirname15(currentPath);
     const entries = readdirSync4(currentPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => visibleRunnerDirectoryEntryName(entry.name)).map((entry) => {
-      const path2 = join21(currentPath, entry.name);
+      const path2 = join22(currentPath, entry.name);
       return {
         name: entry.name,
         path: path2,
@@ -31655,7 +33361,7 @@ function projectDirectoryName(name) {
 function availableProjectDirectoryName(projectsRoot, baseName, suffix = 0) {
   for (let nextSuffix = suffix; ; nextSuffix += 1) {
     const candidate = nextSuffix === 0 ? baseName : `${baseName}-${nextSuffix}`;
-    if (!projectPathExists(join21(projectsRoot, candidate))) {
+    if (!projectPathExists(join22(projectsRoot, candidate))) {
       return candidate;
     }
   }
@@ -31683,9 +33389,9 @@ function createRunnerProject(control, options, allowedCwds) {
       error: "invalid_project_template"
     };
   }
-  const projectsRoot = join21(currentHomeDirectory(), "linzumi");
+  const projectsRoot = join22(currentHomeDirectory(), "linzumi");
   const resolvedProjectDirName = template === "hello_linzumi_demo" ? availableProjectDirectoryName(projectsRoot, projectDirName) : projectDirName;
-  const projectPath = join21(projectsRoot, resolvedProjectDirName);
+  const projectPath = join22(projectsRoot, resolvedProjectDirName);
   let createdProjectPath = false;
   try {
     if (template !== "hello_linzumi_demo" && projectPathExists(projectPath)) {
@@ -31697,7 +33403,7 @@ function createRunnerProject(control, options, allowedCwds) {
         error: "project_directory_exists"
       };
     }
-    mkdirSync13(projectsRoot, { recursive: true });
+    mkdirSync14(projectsRoot, { recursive: true });
     if (template === "hello_linzumi_demo") {
       createdProjectPath = true;
       createHelloLinzumiProject({
@@ -31705,7 +33411,7 @@ function createRunnerProject(control, options, allowedCwds) {
         name: resolvedProjectDirName
       });
     } else {
-      mkdirSync13(projectPath, { recursive: false });
+      mkdirSync14(projectPath, { recursive: false });
       createdProjectPath = true;
     }
     const git = spawnSync5("git", ["init"], {
@@ -31818,7 +33524,7 @@ async function suggestRunnerTasks(control, options, allowedCwds) {
     };
   }
 }
-var THREAD_RUNNER_READY_TIMEOUT_MS, THREAD_RUNNER_REAPER_INTERVAL_MS, onboardingDiscoveryAgentStartKeys, onboardingConversationImportKeys, onboardingConversationDiscoveryReportLimit, staleStartInstanceWindowMs, connectionStaleThresholdMs, connectionUnrecoverableAfterMs, controlCursorWriteDebounceMs, controlCursorEpochKey, codexTurnTerminalNotificationMethods, claudeSessionStoreSequenceHighWater, claudeCodeLlmProxySessionHeader, onboardingConversationTitleFirstMessages, onboardingConversationTitleLastMessages, onboardingConversationTitleBodyMaxLength, onboardingConversationImportMessageMaxLength, onboardingConversationImportCandidateLimit, onboardingConversationImportProgressInterval;
+var THREAD_RUNNER_READY_TIMEOUT_MS, THREAD_RUNNER_REAPER_INTERVAL_MS, onboardingDiscoveryAgentStartKeys, onboardingConversationImportKeys, onboardingConversationDiscoveryReportLimit, CODEX_AUTH_STATUS_PROBE_TIMEOUT_MS, staleStartInstanceWindowMs, connectionStaleThresholdMs, connectionUnrecoverableAfterMs, controlCursorWriteDebounceMs, controlCursorEpochKey, codexTurnTerminalNotificationMethods, runnerDrainExitDeadlineMs, claudeSessionStoreSequenceHighWater, claudeCodeLlmProxySessionHeader, onboardingConversationTitleFirstMessages, onboardingConversationTitleLastMessages, onboardingConversationTitleBodyMaxLength, onboardingConversationImportMessageMaxLength, onboardingConversationImportCandidateLimit, onboardingConversationImportProgressInterval;
 var init_runner = __esm({
   "src/runner.ts"() {
     "use strict";
@@ -31826,6 +33532,7 @@ var init_runner = __esm({
     init_runnerThreadSessionRegistry();
     init_outboxJournal();
     init_channelSessionSupport();
+    init_channelSessionSupport();
     init_commanderAttachments();
     init_claudeCodePipeline();
     init_claudeCodePlanMirror();
@@ -31868,11 +33575,18 @@ var init_runner = __esm({
     init_signupTaskSuggestions();
     init_userFacingErrors();
     init_remoteCodexSandboxRunner();
+    init_durableInboundQueue();
+    init_appliedSourceSeqWatermark();
+    init_threadReconcilerLock();
+    init_runnerLifecycleGuards();
+    init_leaseEpochGuard();
+    init_resumeKeystone();
     THREAD_RUNNER_READY_TIMEOUT_MS = 3e4;
     THREAD_RUNNER_REAPER_INTERVAL_MS = 3e4;
     onboardingDiscoveryAgentStartKeys = /* @__PURE__ */ new Set();
     onboardingConversationImportKeys = /* @__PURE__ */ new Set();
     onboardingConversationDiscoveryReportLimit = 100;
+    CODEX_AUTH_STATUS_PROBE_TIMEOUT_MS = 3e3;
     staleStartInstanceWindowMs = 6e4;
     connectionStaleThresholdMs = 12e4;
     connectionUnrecoverableAfterMs = 10 * 60 * 1e3;
@@ -31885,6 +33599,7 @@ var init_runner = __esm({
       "turn/canceled",
       "turn/cancelled"
     ]);
+    runnerDrainExitDeadlineMs = 8e3;
     claudeSessionStoreSequenceHighWater = /* @__PURE__ */ new Map();
     claudeCodeLlmProxySessionHeader = "x-linzumi-llm-proxy-token";
     onboardingConversationTitleFirstMessages = 4;
@@ -31897,7 +33612,7 @@ var init_runner = __esm({
 });
 
 // src/kandanTls.ts
-import { existsSync as existsSync14, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync19 } from "node:fs";
 import { Agent } from "undici";
 import WsWebSocket from "ws";
 function kandanTlsTrustFromEnv() {
@@ -31911,7 +33626,7 @@ function kandanTlsTrustFromCaFile(caFile) {
   if (!existsSync14(trimmed)) {
     throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${trimmed}`);
   }
-  const ca = readFileSync18(trimmed, "utf8");
+  const ca = readFileSync19(trimmed, "utf8");
   return {
     caFile: trimmed,
     ca,
@@ -50695,7 +52410,7 @@ var init_RemoveFileError = __esm({
 
 // ../../node_modules/@inquirer/external-editor/dist/esm/index.js
 import { spawn as spawn11, spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync21, unlinkSync as unlinkSync3, writeFileSync as writeFileSync15 } from "fs";
+import { readFileSync as readFileSync22, unlinkSync as unlinkSync3, writeFileSync as writeFileSync15 } from "fs";
 import path from "node:path";
 import os from "node:os";
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -50819,7 +52534,7 @@ var init_esm5 = __esm({
       }
       readTemporaryFile() {
         try {
-          const tempFileBuffer = readFileSync21(this.tempFile);
+          const tempFileBuffer = readFileSync22(this.tempFile);
           if (tempFileBuffer.length === 0) {
             this.text = "";
           } else {
@@ -52188,17 +53903,17 @@ import { spawn as spawn12, spawnSync as spawnSync7 } from "node:child_process";
 import {
   existsSync as existsSync17,
   constants as fsConstants,
-  mkdirSync as mkdirSync16,
+  mkdirSync as mkdirSync17,
   mkdtempSync as mkdtempSync6,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync5,
   rmSync as rmSync7,
   statSync as statSync4,
   writeFileSync as writeFileSync16
 } from "node:fs";
 import { access } from "node:fs/promises";
-import { homedir as homedir17, tmpdir as tmpdir5 } from "node:os";
-import { delimiter as delimiter3, dirname as dirname18, join as join25, resolve as resolve10 } from "node:path";
+import { homedir as homedir18, tmpdir as tmpdir5 } from "node:os";
+import { delimiter as delimiter3, dirname as dirname19, join as join26, resolve as resolve10 } from "node:path";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 import { emitKeypressEvents } from "node:readline";
 function signupHelpText() {
@@ -52319,7 +54034,7 @@ function defaultSignupDraftStore(serviceUrl) {
       }
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync22(path2, "utf8"));
+        parsed = JSON.parse(readFileSync23(path2, "utf8"));
       } catch (_error) {
         return void 0;
       }
@@ -52329,7 +54044,7 @@ function defaultSignupDraftStore(serviceUrl) {
       return comparableServiceUrl(parsed.serviceUrl) === comparableServiceUrl(serviceUrl) ? parsed : void 0;
     },
     write: (draft) => {
-      mkdirSync16(dirname18(path2), { recursive: true });
+      mkdirSync17(dirname19(path2), { recursive: true });
       writeFileSync16(path2, `${JSON.stringify(draft, null, 2)}
 `, {
         encoding: "utf8",
@@ -52342,8 +54057,8 @@ function defaultSignupDraftStore(serviceUrl) {
   };
 }
 function defaultSignupDraftPath(serviceUrl) {
-  return join25(
-    dirname18(localConfigPath()),
+  return join26(
+    dirname19(localConfigPath()),
     `signup-draft.${localConfigScopeFileStem(serviceUrl)}.json`
   );
 }
@@ -52377,7 +54092,7 @@ function defaultSignupTaskCacheStore(serviceUrl) {
           }
         }
       };
-      mkdirSync16(dirname18(path2), { recursive: true });
+      mkdirSync17(dirname19(path2), { recursive: true });
       writeFileSync16(path2, `${JSON.stringify(next, null, 2)}
 `, {
         encoding: "utf8",
@@ -52387,8 +54102,8 @@ function defaultSignupTaskCacheStore(serviceUrl) {
   };
 }
 function defaultSignupTaskCachePath(serviceUrl) {
-  return join25(
-    dirname18(localConfigPath()),
+  return join26(
+    dirname19(localConfigPath()),
     `signup-task-cache.${localConfigScopeFileStem(serviceUrl)}.json`
   );
 }
@@ -52398,7 +54113,7 @@ function readSignupTaskCache(path2) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync22(path2, "utf8"));
+    parsed = JSON.parse(readFileSync23(path2, "utf8"));
   } catch (_error) {
     return { version: 1, entries: {} };
   }
@@ -54283,7 +55998,7 @@ function autocompletePathSuggestions(pathInput) {
   try {
     const showHidden = prefix.startsWith(".");
     const currentPath = directoryExists(normalizedInput) ? [normalizedInput.replace(/\/$/, "") || "/"] : [];
-    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join25(directoryPath, entry.name)).map((path2) => ({
+    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join26(directoryPath, entry.name)).map((path2) => ({
       path: path2,
       score: fuzzyPathSegmentScore(path2.split("/").at(-1) ?? path2, prefix)
     })).filter((candidate) => candidate.score !== void 0).sort((left, right) => {
@@ -54529,7 +56244,7 @@ async function runSignupPreflights(runtime) {
 function defaultPreflightRuntime() {
   return {
     cwd: process.cwd(),
-    homeDir: homedir17(),
+    homeDir: homedir18(),
     probeTool,
     readGitEmail,
     discoverCodeRoots,
@@ -54674,9 +56389,9 @@ async function suggestTasksWithCodex(projectPath, retryPolicy) {
   );
 }
 async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolicy) {
-  const tempRoot = mkdtempSync6(join25(tmpdir5(), "linzumi-signup-codex-tasks-"));
-  const schemaPath = join25(tempRoot, "task-suggestions.schema.json");
-  const outputPath = join25(tempRoot, "task-suggestions.json");
+  const tempRoot = mkdtempSync6(join26(tmpdir5(), "linzumi-signup-codex-tasks-"));
+  const schemaPath = join26(tempRoot, "task-suggestions.schema.json");
+  const outputPath = join26(tempRoot, "task-suggestions.json");
   const model = process.env.LINZUMI_SIGNUP_TASK_MODEL ?? "gpt-5.4-mini";
   const prompt = taskSuggestionPrompt2(previousResponse);
   const codexCommand = await resolveSignupCodexCommand();
@@ -54701,7 +56416,7 @@ async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolic
       ),
       retryPolicy
     );
-    return readFileSync22(outputPath, "utf8");
+    return readFileSync23(outputPath, "utf8");
   } finally {
     rmSync7(tempRoot, { recursive: true, force: true });
   }
@@ -54738,7 +56453,7 @@ function codexTaskSuggestionProcess2(args) {
 function signupCodexTaskSuggestionProcessForTest(args) {
   return codexTaskSuggestionProcess2(args);
 }
-async function resolveSignupCodexCommand(env = process.env, homeDir = homedir17(), executableExists = fileIsExecutable) {
+async function resolveSignupCodexCommand(env = process.env, homeDir = homedir18(), executableExists = fileIsExecutable) {
   const override = firstConfiguredValue([
     env.LINZUMI_SIGNUP_CODEX_BIN,
     env.LINZUMI_CODEX_BIN
@@ -54793,7 +56508,7 @@ function resolveHomePath(path2, homeDir) {
     return homeDir;
   }
   if (path2.startsWith("~/")) {
-    return join25(homeDir, path2.slice(2));
+    return join26(homeDir, path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -54806,9 +56521,9 @@ function commandLooksPathLike(command) {
 }
 function homeManagedCodexCandidates(homeDir) {
   return [
-    join25(homeDir, ".volta", "bin", "codex"),
-    join25(homeDir, ".local", "bin", "codex"),
-    join25(homeDir, "bin", "codex")
+    join26(homeDir, ".volta", "bin", "codex"),
+    join26(homeDir, ".local", "bin", "codex"),
+    join26(homeDir, "bin", "codex")
   ];
 }
 async function firstExecutablePath(paths, executableExists) {
@@ -54823,7 +56538,7 @@ function commandPathCandidates(path2) {
   if (path2 === void 0 || path2.trim() === "") {
     return [];
   }
-  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join25(entry, "codex"));
+  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join26(entry, "codex"));
 }
 async function fileIsExecutable(path2) {
   try {
@@ -55056,11 +56771,11 @@ function codexPreflightLocation(command, homeDir) {
   switch (command) {
     case "codex":
       return "on PATH";
-    case join25(homeDir, ".volta", "bin", "codex"):
+    case join26(homeDir, ".volta", "bin", "codex"):
       return "via Volta";
-    case join25(homeDir, ".local", "bin", "codex"):
+    case join26(homeDir, ".local", "bin", "codex"):
       return "via ~/.local/bin";
-    case join25(homeDir, "bin", "codex"):
+    case join26(homeDir, "bin", "codex"):
       return "via ~/bin";
     default:
       return "from configured path";
@@ -55219,7 +56934,7 @@ function probeToolWithArgs(command, args, cwd) {
 }
 async function discoverCodeRoots(homeDir) {
   const candidates = ["src", "code", "projects"].map(
-    (name) => join25(homeDir, name)
+    (name) => join26(homeDir, name)
   );
   return candidates.filter((path2) => existsSync17(path2)).flatMap((path2) => discoveredProjectNames(path2));
 }
@@ -55273,7 +56988,7 @@ function discoverProjectsFromCurrentDirectory(cwd) {
 }
 function discoverProjectsFromGuessedRoots(homeDir) {
   const guessedRoots = ["src", "code", "projects"].map(
-    (name) => join25(homeDir, name)
+    (name) => join26(homeDir, name)
   );
   const projects = guessedRoots.flatMap(
     (root) => discoverProjectsUnderRoot(root)
@@ -55325,25 +57040,25 @@ function looksLikeProject(path2) {
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json"
-  ].some((name) => existsSync17(join25(path2, name)));
+  ].some((name) => existsSync17(join26(path2, name)));
 }
 function detectProjectLanguage(path2) {
-  if (existsSync17(join25(path2, "pyproject.toml")) || existsSync17(join25(path2, "requirements.txt"))) {
+  if (existsSync17(join26(path2, "pyproject.toml")) || existsSync17(join26(path2, "requirements.txt"))) {
     return "Python";
   }
-  if (existsSync17(join25(path2, "Cargo.toml"))) {
+  if (existsSync17(join26(path2, "Cargo.toml"))) {
     return "Rust";
   }
-  if (existsSync17(join25(path2, "go.mod"))) {
+  if (existsSync17(join26(path2, "go.mod"))) {
     return "Go";
   }
-  if (existsSync17(join25(path2, "mix.exs"))) {
+  if (existsSync17(join26(path2, "mix.exs"))) {
     return "Elixir";
   }
-  if (existsSync17(join25(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
+  if (existsSync17(join26(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
     return "TypeScript";
   }
-  if (existsSync17(join25(path2, "package.json"))) {
+  if (existsSync17(join26(path2, "package.json"))) {
     return "JavaScript";
   }
   return "Project";
@@ -55351,7 +57066,7 @@ function detectProjectLanguage(path2) {
 function packageJsonMentionsTypeScript(path2) {
   try {
     const packageJson2 = JSON.parse(
-      readFileSync22(join25(path2, "package.json"), "utf8")
+      readFileSync23(join26(path2, "package.json"), "utf8")
     );
     return packageJson2.dependencies?.typescript !== void 0 || packageJson2.devDependencies?.typescript !== void 0;
   } catch {
@@ -55359,11 +57074,11 @@ function packageJsonMentionsTypeScript(path2) {
   }
 }
 function hasGitMetadata(path2) {
-  return existsSync17(join25(path2, ".git"));
+  return existsSync17(join26(path2, ".git"));
 }
 function childDirectories(root) {
   try {
-    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join25(root, entry.name));
+    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join26(root, entry.name));
   } catch {
     return [];
   }
@@ -55389,10 +57104,10 @@ function directoryExists(path2) {
 }
 function expandHomePath(path2) {
   if (path2 === "~") {
-    return homedir17();
+    return homedir18();
   }
   if (path2.startsWith("~/")) {
-    return join25(homedir17(), path2.slice(2));
+    return join26(homedir18(), path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -55483,8 +57198,8 @@ init_runner();
 init_runnerLockTakeover();
 init_claudeCodeSession();
 init_authCache();
-import { existsSync as existsSync18, readFileSync as readFileSync23, realpathSync as realpathSync7 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { existsSync as existsSync18, readFileSync as readFileSync24, realpathSync as realpathSync7 } from "node:fs";
+import { homedir as homedir19 } from "node:os";
 import { resolve as resolve11 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -55579,9 +57294,9 @@ init_kandanTls();
 init_protocol();
 init_json();
 init_defaultUrls();
-import { existsSync as existsSync15, mkdirSync as mkdirSync14, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname15, join as join22 } from "node:path";
-import { homedir as homedir15 } from "node:os";
+import { existsSync as existsSync15, mkdirSync as mkdirSync15, readFileSync as readFileSync20, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname16, join as join23 } from "node:path";
+import { homedir as homedir16 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
   stdout: process.stdout,
@@ -56289,7 +58004,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join22(homedir15(), ".linzumi", "agent-token.json");
+  return join23(homedir16(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -56298,10 +58013,10 @@ function authorizationHeaders(token) {
   return { authorization: `Bearer ${token}` };
 }
 function readOptionalTextFile(path2) {
-  return existsSync15(path2) ? readFileSync19(path2, "utf8") : void 0;
+  return existsSync15(path2) ? readFileSync20(path2, "utf8") : void 0;
 }
 function writeTextFile(path2, content) {
-  mkdirSync14(dirname15(path2), { recursive: true });
+  mkdirSync15(dirname16(path2), { recursive: true });
   writeFileSync13(path2, content);
 }
 function readStoredAgentTokenFile(path2, readTextFile = readOptionalTextFile) {
@@ -56390,26 +58105,26 @@ init_helloLinzumiProject();
 init_runnerLogger();
 import {
   existsSync as existsSync16,
-  closeSync as closeSync3,
-  mkdirSync as mkdirSync15,
-  openSync as openSync4,
-  readFileSync as readFileSync20,
+  closeSync as closeSync5,
+  mkdirSync as mkdirSync16,
+  openSync as openSync6,
+  readFileSync as readFileSync21,
   watch,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
-import { dirname as dirname16, join as join23, resolve as resolve9 } from "node:path";
+import { homedir as homedir17 } from "node:os";
+import { dirname as dirname17, join as join24, resolve as resolve9 } from "node:path";
 import { execFileSync, spawn as spawn10 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join23(homedir16(), ".linzumi", "commanders");
+  return join24(homedir17(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
-  return join23(statusDir, `${safeRunnerId(runnerId)}.json`);
+  return join24(statusDir, `${safeRunnerId(runnerId)}.json`);
 }
 function defaultCommanderLogFile(runnerId) {
-  return join23(homedir16(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
+  return join24(homedir17(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
 }
 function commanderLogIsConnected(log2) {
   return connectedMarkers.some((marker) => log2.includes(marker));
@@ -56430,10 +58145,10 @@ function startCommanderDaemon(options) {
     "--log-file",
     logFile
   ];
-  mkdirSync15(statusDir, { recursive: true });
-  mkdirSync15(dirname16(logFile), { recursive: true });
-  const out = openSync4(logFile, "a");
-  const err = openSync4(logFile, "a");
+  mkdirSync16(statusDir, { recursive: true });
+  mkdirSync16(dirname17(logFile), { recursive: true });
+  const out = openSync6(logFile, "a");
+  const err = openSync6(logFile, "a");
   writeCliAuditEvent(
     "process.spawn",
     {
@@ -56460,8 +58175,8 @@ function startCommanderDaemon(options) {
     },
     { sessionId: options.runnerId }
   );
-  closeSync3(out);
-  closeSync3(err);
+  closeSync5(out);
+  closeSync5(err);
   child.unref();
   if (child.pid === void 0) {
     throw new Error("commander daemon did not report a pid");
@@ -56486,12 +58201,12 @@ function commanderDaemonStatus(runnerId, statusDir = commanderStatusDir(), proce
   if (!existsSync16(statusFile)) {
     return { status: "missing", runnerId, statusFile };
   }
-  const record = parseRecord2(readFileSync20(statusFile, "utf8"));
+  const record = parseRecord2(readFileSync21(statusFile, "utf8"));
   return processIsRunning(record.pid) && processMatchesRecord(record, processIdentityReader) ? { status: "running", record } : { status: "stopped", record };
 }
 async function waitForCommanderDaemon(options) {
   const now = options.now ?? (() => Date.now());
-  const readTextFile = options.readTextFile ?? ((path2) => existsSync16(path2) ? readFileSync20(path2, "utf8") : void 0);
+  const readTextFile = options.readTextFile ?? ((path2) => existsSync16(path2) ? readFileSync21(path2, "utf8") : void 0);
   const statusImpl = options.statusImpl ?? commanderDaemonStatus;
   const deadline = now() + options.timeoutMs;
   while (now() <= deadline) {
@@ -69287,22 +71002,49 @@ async function resolveMcpAuth(args) {
       mode: "personal-agent-delegation"
     };
   }
-  const token = args.explicitToken ?? readCachedLocalRunnerToken(args.kandanUrl, args.authFilePath)?.accessToken;
+  const accessToken = await resolveMcpLocalRunnerToken({
+    kandanUrl: args.kandanUrl,
+    explicitToken: args.explicitToken,
+    authFilePath: args.authFilePath,
+    workspaceSlug: args.workspaceSlug,
+    channelSlug: args.channelSlug
+  });
+  return { accessToken, mode: "local-runner" };
+}
+async function resolveMcpLocalRunnerToken(args, deps = {
+  readCachedToken: readCachedLocalRunnerToken,
+  validateTokenOutcome: validateLocalRunnerTokenOutcome,
+  resolveToken: resolveLocalRunnerToken
+}) {
+  const token = args.explicitToken ?? deps.readCachedToken(args.kandanUrl, args.authFilePath)?.accessToken;
   if (token === void 0) {
     throw new Error(
       "missing Linzumi MCP token; run linzumi auth or pass --token"
     );
   }
-  const valid = await validateLocalRunnerToken({
+  const outcome = await deps.validateTokenOutcome({
     kandanUrl: args.kandanUrl,
     accessToken: token,
     workspaceSlug: args.workspaceSlug,
     channelSlug: args.channelSlug
   });
-  if (!valid) {
-    throw new Error("Linzumi MCP token was rejected by the server");
+  if (outcome === "usable") {
+    return token;
+  }
+  const _recoverable = outcome;
+  void _recoverable;
+  try {
+    return await deps.resolveToken({
+      kandanUrl: args.kandanUrl,
+      workspaceSlug: args.workspaceSlug,
+      channelSlug: args.channelSlug,
+      authFilePath: args.authFilePath
+    });
+  } catch (error) {
+    throw new Error(
+      `Linzumi MCP token was rejected by the server and re-mint failed: ${error instanceof Error ? error.message : String(error)}`
+    );
   }
-  return { accessToken: token, mode: "local-runner" };
 }
 function mcpJsonResult(value) {
   return {
@@ -69384,7 +71126,7 @@ init_userFacingErrors();
 init_version();
 import { chmodSync as chmodSync3, mkdtempSync as mkdtempSync5, rmSync as rmSync6 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { basename as basename9, dirname as dirname17, join as join24 } from "node:path";
+import { basename as basename9, dirname as dirname18, join as join25 } from "node:path";
 var configEnvKey = "LINZUMI_REMOTE_CODEX_HARNESS_CONFIG_B64";
 var remoteHarnessEnvironmentId = "linzumi-remote-codex-harness";
 async function runRemoteCodexHarnessWorkerFromEnv(env = process.env) {
@@ -69617,18 +71359,18 @@ function resolveLinzumiCliEntrypoint(entrypoint) {
     case "remote-codex-harness-worker.js":
     case "remote-codex-harness-worker.mjs":
     case "remote-codex-harness-worker.cjs":
-      return join24(dirname17(entrypoint), "linzumi.js");
+      return join25(dirname18(entrypoint), "linzumi.js");
     case "remoteCodexHarnessWorkerEntrypoint.ts":
     case "remoteCodexHarnessWorkerEntrypoint.js":
-      return join24(dirname17(entrypoint), "index.ts");
+      return join25(dirname18(entrypoint), "index.ts");
     default:
       return entrypoint;
   }
 }
 function writeEphemeralMcpAuthFile2(options) {
-  const directory = mkdtempSync5(join24(tmpdir4(), "linzumi-mcp-auth-"));
+  const directory = mkdtempSync5(join25(tmpdir4(), "linzumi-mcp-auth-"));
   chmodSync3(directory, 448);
-  const path2 = join24(directory, "auth.json");
+  const path2 = join25(directory, "auth.json");
   try {
     writeCachedLocalRunnerToken({
       kandanUrl: options.kandanUrl,
@@ -70579,7 +72321,7 @@ async function parseAgentRunnerArgs(args, deps = {
   };
 }
 function readAgentTokenTextFile(path2) {
-  return existsSync18(path2) ? readFileSync23(path2, "utf8") : void 0;
+  return existsSync18(path2) ? readFileSync24(path2, "utf8") : void 0;
 }
 function rejectAgentRunnerTargetingFlags(values) {
   const unsupportedFlags = [
@@ -70898,10 +72640,10 @@ function rejectStartTargetingFlags(values) {
 }
 function resolveUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir18();
+    return homedir19();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve11(homedir18(), pathValue.slice(2));
+    return resolve11(homedir19(), pathValue.slice(2));
   }
   return resolve11(pathValue);
 }