@m8t-stack/cli 0.2.89 → 0.2.91

package/dist/cli.js

@@ -921,8 +921,8 @@ async function mirrorBrainYaml(args) {
     Accept: "application/vnd.github+json",
     "X-GitHub-Api-Version": "2022-11-28"
   };
-  const MAX_ATTEMPTS2 = 3;
-  for (let attempt = 1; attempt <= MAX_ATTEMPTS2; attempt++) {
+  const MAX_ATTEMPTS3 = 3;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS3; attempt++) {
     const getRes = await fetch(url, { headers });
     let sha;
     let existing;
@@ -953,8 +953,8 @@ async function mirrorBrainYaml(args) {
     if (putRes.ok) return;
     const text = await putRes.text();
     const retryable = putRes.status === 409 || putRes.status === 422;
-    if (retryable && attempt < MAX_ATTEMPTS2) continue;
-    const suffix = retryable ? ` after ${MAX_ATTEMPTS2.toString()} attempts` : "";
+    if (retryable && attempt < MAX_ATTEMPTS3) continue;
+    const suffix = retryable ? ` after ${MAX_ATTEMPTS3.toString()} attempts` : "";
     throw new LocalCliError({
       code: "BRAIN_YAML_MIRROR_FAILED",
       message: `PUT .m8t/brain.yaml: HTTP ${putRes.status.toString()}${suffix}
@@ -1461,8 +1461,33 @@ var init_enable_hosted_brain = __esm({
 // src/cli.ts
 import { Builtins, Cli } from "clipanion";
 
+// src/lib/dns-shim.ts
+import dns from "dns";
+var installed = false;
+function installFoundryDnsShim() {
+  if (installed) return;
+  installed = true;
+  const origLookup = dns.lookup.bind(dns);
+  dns.lookup = (hostname, options, cb) => {
+    const opts = typeof options === "function" ? {} : options;
+    const callback = typeof options === "function" ? options : cb;
+    if (typeof hostname === "string" && hostname.endsWith("services.ai.azure.com")) {
+      dns.resolve4(hostname, (err, addrs) => {
+        if (err || !addrs?.length) {
+          origLookup(hostname, options, cb);
+          return;
+        }
+        if (opts?.all) callback(null, addrs.map((a) => ({ address: a, family: 4 })));
+        else callback(null, addrs[0], 4);
+      });
+      return;
+    }
+    origLookup(hostname, options, cb);
+  };
+}
+
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.89";
+var CLI_VERSION = "0.2.91";
 
 // src/lib/render-error.ts
 init_errors();
@@ -19667,19 +19692,20 @@ init_rbac();
 // src/lib/acs-provision.ts
 var MANAGED_DOMAIN = "AzureManagedDomain";
 async function provisionAcsEmail(args) {
-  const { client, subscriptionId, resourceGroup, name, dataLocation, onProgress } = args;
-  const acsName = `acs-${name}`;
-  const emailName = `${name}-email`;
+  const { client, subscriptionId, resourceGroup, name, dataLocation, tags, onProgress } = args;
+  const acsName = args.acsName ?? `acs-${name}`;
+  const emailName = args.emailName ?? `${name}-email`;
   onProgress?.(`creating ACS resource ${acsName}\u2026`);
   const acs = await client.communicationServices.beginCreateOrUpdateAndWait(
     resourceGroup,
     acsName,
-    { location: "global", dataLocation }
+    { location: "global", dataLocation, ...tags ? { tags } : {} }
   );
   onProgress?.(`creating Email Communication Service ${emailName}\u2026`);
   await client.emailServices.beginCreateOrUpdateAndWait(resourceGroup, emailName, {
     location: "global",
-    dataLocation
+    dataLocation,
+    ...tags ? { tags } : {}
   });
   onProgress?.("provisioning the Azure-managed domain\u2026");
   const domain = await client.domains.beginCreateOrUpdateAndWait(
@@ -19693,7 +19719,8 @@ async function provisionAcsEmail(args) {
   await client.communicationServices.beginCreateOrUpdateAndWait(resourceGroup, acsName, {
     location: "global",
     dataLocation,
-    linkedDomains: [domainResourceId]
+    linkedDomains: [domainResourceId],
+    ...tags ? { tags } : {}
   });
   const hostName = acs.hostName ?? `${acsName}.communication.azure.com`;
   const fromSenderDomain = domain.fromSenderDomain;
@@ -19706,6 +19733,515 @@ async function provisionAcsEmail(args) {
   };
 }
 
+// src/lib/acs-resolve.ts
+init_errors();
+var ACS_PLATFORM_TAG = "m8t:email";
+var ACS_PLATFORM_TAG_VALUE = "platform";
+var VERIFIED = "Verified";
+function emailFeatureFrom(acs, enabled) {
+  return { enabled, acsEndpoint: acs.endpoint, acsSender: acs.sender };
+}
+function platformSuffixFromKvUri(kvUri) {
+  const host = /^https?:\/\/([^./]+)\./i.exec(kvUri.trim())?.[1];
+  if (!host) return null;
+  return /^m8t-kv-(.+)$/i.exec(host)?.[1] ?? host;
+}
+function resourceGroupFromArmId(armId) {
+  return /\/resourceGroups\/([^/]+)/i.exec(armId)?.[1] ?? null;
+}
+function classifyGrantScope(grantScope, expectedSubscriptionId) {
+  const unusable = (reason) => ({ kind: "unusable", reason });
+  const parts = grantScope.trim().replace(/^\/+/, "").replace(/\/+$/, "").split("/");
+  if (parts.length < 2 || parts[0]?.toLowerCase() !== "subscriptions") {
+    return unusable(`'${grantScope}' is not a recognisable Azure scope`);
+  }
+  const subscriptionId = parts[1] ?? "";
+  if (subscriptionId === "") return unusable(`'${grantScope}' names no subscription`);
+  if (subscriptionId.toLowerCase() !== expectedSubscriptionId.toLowerCase()) {
+    return unusable(
+      `the Contributor scope is in subscription ${subscriptionId}, but this deploy targets ${expectedSubscriptionId} \u2014 an ACS created here would not be covered by that grant`
+    );
+  }
+  if (parts.length === 2) return { kind: "subscription", subscriptionId };
+  if (parts.length < 4 || parts[2]?.toLowerCase() !== "resourcegroups") {
+    return unusable(`'${grantScope}' is neither a subscription nor a resource-group scope`);
+  }
+  const resourceGroup = parts[3] ?? "";
+  if (resourceGroup === "") return unusable(`'${grantScope}' names no resource group`);
+  if (parts.length > 4) {
+    return unusable(
+      `the Contributor scope is a single resource (${grantScope}), so no resource group is authorised for an ACS data-plane send`
+    );
+  }
+  return { kind: "resource-group", subscriptionId, resourceGroup };
+}
+function parseDomainId(id) {
+  const m = /\/emailServices\/([^/]+)\/domains\/([^/]+)/i.exec(id);
+  if (!m?.[1] || !m[2]) return null;
+  return { emailServiceName: m[1], domainName: m[2] };
+}
+async function resolveAcs(args) {
+  const { client, stamp, subscriptionId, resourceGroup, suffix, dataLocation, onProgress } = args;
+  const recorded = stamp?.features?.email;
+  if (recorded?.acsEndpoint && recorded.acsSender) {
+    onProgress?.("using the ACS sender recorded in the platform stamp.");
+    return { source: "stamp", acs: { endpoint: recorded.acsEndpoint, sender: recorded.acsSender } };
+  }
+  onProgress?.(`looking for an existing email-capable ACS in ${resourceGroup}\u2026`);
+  const candidates = [];
+  for await (const r of client.communicationServices.listByResourceGroup(resourceGroup)) {
+    const linked = r.linkedDomains;
+    if (!linked || linked.length === 0) continue;
+    if (!r.name || !r.hostName) continue;
+    candidates.push({
+      name: r.name,
+      hostName: r.hostName,
+      linkedDomains: linked,
+      tagged: r.tags?.[ACS_PLATFORM_TAG] === ACS_PLATFORM_TAG_VALUE
+    });
+  }
+  candidates.sort((a, b) => a.tagged === b.tagged ? a.name.localeCompare(b.name) : a.tagged ? -1 : 1);
+  for (const c of candidates) {
+    const sender = await verifiedSenderFor(client, resourceGroup, c);
+    if (sender === null) continue;
+    onProgress?.(`adopting the existing ACS ${c.name} (verified managed domain).`);
+    return { source: "discovered", acsName: c.name, acs: { endpoint: `https://${c.hostName}/`, sender } };
+  }
+  if (suffix === null || suffix === "") {
+    throw new LocalCliError({
+      code: "NO_PLATFORM_SUFFIX",
+      message: "No email-capable ACS exists here and one cannot be named: this install's resource suffix could not be worked out.",
+      hint: "Pass --kv-uri <install vault uri> (or set AZURE_KEYVAULT_URI) so the ACS can be named consistently with the rest of the platform."
+    });
+  }
+  const acsName = `m8t-acs-${suffix}`;
+  const emailName = `m8t-email-${suffix}`;
+  onProgress?.(`no email-capable ACS found \u2014 provisioning ${acsName}\u2026`);
+  const provisioned = await provisionAcsEmail({
+    client,
+    subscriptionId,
+    resourceGroup,
+    name: `m8t-${suffix}`,
+    acsName,
+    emailName,
+    dataLocation,
+    tags: { [ACS_PLATFORM_TAG]: ACS_PLATFORM_TAG_VALUE },
+    onProgress
+  });
+  return { source: "provisioned", acsName, acs: { endpoint: provisioned.endpoint, sender: provisioned.sender } };
+}
+async function verifiedSenderFor(client, resourceGroup, c) {
+  for (const id of c.linkedDomains) {
+    const parsed = parseDomainId(id);
+    if (!parsed) continue;
+    try {
+      const d = await client.domains.get(resourceGroup, parsed.emailServiceName, parsed.domainName);
+      if (d.verificationStates?.domain?.status !== VERIFIED) continue;
+      if (!d.fromSenderDomain) continue;
+      return `DoNotReply@${d.fromSenderDomain}`;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/lib/platform-stamp.ts
+import { TableClient as TableClient2 } from "@azure/data-tables";
+
+// ../../packages/platform-release/dist/esm/manifest.js
+var SEVERITIES = ["critical", "recommended", "optional"];
+var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
+var COMPANION_TARGETS = [
+  "darwin-arm64",
+  "darwin-x64",
+  "win32-arm64",
+  "win32-x64"
+];
+function companionTargetFor(platform, architecture) {
+  const target = `${platform}-${architecture}`;
+  return COMPANION_TARGETS.includes(target) ? target : null;
+}
+function isObj2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateManifest(m) {
+  const errors = [];
+  if (!isObj2(m))
+    return ["manifest is not an object"];
+  if (m.schemaVersion !== 1)
+    errors.push("schemaVersion must be the integer 1");
+  const p = m.platform;
+  if (!isObj2(p)) {
+    errors.push("platform is required");
+  } else {
+    for (const f of ["version", "tag", "releasedAt", "commit", "notes", "notesUrl"]) {
+      if (typeof p[f] !== "string" || p[f].length === 0)
+        errors.push(`platform.${f} is required`);
+    }
+    if (!SEVERITIES.includes(p.severity))
+      errors.push(`platform.severity must be one of ${SEVERITIES.join("|")}`);
+    if (!(typeof p.previousVersion === "string" || p.previousVersion === null)) {
+      errors.push("platform.previousVersion must be a string or null");
+    }
+  }
+  const c = m.components;
+  if (!isObj2(c)) {
+    errors.push("components is required");
+    return errors;
+  }
+  for (const key2 of IMAGE_KEYS) {
+    const img = c[key2];
+    if (!isObj2(img)) {
+      errors.push(`components.${key2} is required`);
+      continue;
+    }
+    if (img.kind !== "image")
+      errors.push(`components.${key2}.kind must be "image"`);
+    for (const f of ["ref", "tag", "version"]) {
+      if (typeof img[f] !== "string" || img[f].length === 0)
+        errors.push(`components.${key2}.${f} is required`);
+    }
+    if (typeof img.digest !== "string" || !/^sha256:[0-9a-f]+$/.test(img.digest)) {
+      errors.push(`components.${key2}.digest must be a sha256:\u2026 digest`);
+    }
+  }
+  const cli2 = c.cli;
+  if (!isObj2(cli2) || cli2.kind !== "npm") {
+    errors.push("components.cli (kind: npm) is required");
+  } else {
+    for (const f of ["package", "version", "min", "recommended"]) {
+      if (typeof cli2[f] !== "string" || cli2[f].length === 0)
+        errors.push(`components.cli.${f} is required`);
+    }
+  }
+  const personas = c.personas;
+  if (!isObj2(personas) || !isObj2(personas.items)) {
+    errors.push("components.personas.items is required");
+  } else {
+    for (const [name, item] of Object.entries(personas.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.personas.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || typeof item.treeSha !== "string" || item.treeSha.length < 4) {
+        errors.push(`components.personas.items.${name}.treeSha is required`);
+      }
+    }
+  }
+  const seeds = c.brainSeeds;
+  if (!isObj2(seeds) || !isObj2(seeds.items)) {
+    errors.push("components.brainSeeds.items is required");
+  } else {
+    for (const [name, item] of Object.entries(seeds.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.brainSeeds.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || !isObj2(item.subtrees)) {
+        errors.push(`components.brainSeeds.items.${name}.subtrees is required`);
+      }
+    }
+  }
+  const infra = c.infra;
+  if (infra !== void 0) {
+    if (!isObj2(infra) || infra.kind !== "infra") {
+      errors.push('components.infra.kind must be "infra"');
+    }
+    if (!isObj2(infra) || typeof infra.treeSha !== "string" || infra.treeSha.length < 4) {
+      errors.push("components.infra.treeSha is required");
+    }
+  }
+  const companion = c.companion;
+  if (companion !== void 0) {
+    if (!isObj2(companion) || companion.kind !== "desktop") {
+      errors.push('components.companion.kind must be "desktop"');
+    } else {
+      for (const f of ["version", "tag"]) {
+        if (typeof companion[f] !== "string" || companion[f].length === 0) {
+          errors.push(`components.companion.${f} is required`);
+        }
+      }
+      if (!isObj2(companion.targets) || Object.keys(companion.targets).length === 0) {
+        errors.push("components.companion.targets must name at least one target");
+      } else {
+        for (const [name, target] of Object.entries(companion.targets)) {
+          if (!COMPANION_TARGETS.includes(name)) {
+            errors.push(`components.companion.targets.${name} is not a known target`);
+            continue;
+          }
+          if (!isObj2(target) || typeof target.asset !== "string" || target.asset.length === 0) {
+            errors.push(`components.companion.targets.${name}.asset is required`);
+          }
+          if (!isObj2(target) || typeof target.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(target.sha256)) {
+            errors.push(`components.companion.targets.${name}.sha256 must be a sha256 hex digest`);
+          }
+        }
+      }
+    }
+  }
+  return errors;
+}
+
+// ../../packages/platform-release/dist/esm/stamp.js
+var TABLE = "Metadata";
+var PK = "system";
+var RK = "platform";
+function isEmailFeatureUsable(f) {
+  return f?.enabled === true && typeof f.acsEndpoint === "string" && f.acsEndpoint !== "" && typeof f.acsSender === "string" && f.acsSender !== "";
+}
+function stampToEntity(s) {
+  return {
+    partitionKey: PK,
+    rowKey: RK,
+    platformVersion: s.platformVersion,
+    updatedAt: s.updatedAt,
+    lastResult: s.lastResult,
+    value: JSON.stringify(s)
+  };
+}
+function entityToStamp(e) {
+  const raw = e.value;
+  if (typeof raw !== "string")
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+// ../../packages/platform-release/dist/esm/channel-url.js
+var RELEASES_REPO = "m8t-labs/m8t-releases";
+var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
+var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
+var CANARY_POINTER_TAG = "canary";
+var CHANNEL_CANARY_URL = `${RELEASES_BASE}/download/${CANARY_POINTER_TAG}/manifest.json`;
+function platformTag(version) {
+  const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
+  return `platform-v${bare}`;
+}
+function channelUrlForVersion(version) {
+  return `${RELEASES_BASE}/download/${platformTag(version)}/manifest.json`;
+}
+function releaseAssetUrl(tag, asset) {
+  return `${RELEASES_BASE}/download/${tag}/${asset}`;
+}
+
+// ../../packages/platform-release/dist/esm/canary-version.js
+var CANARY_IDENTIFIER = "canary";
+var STABLE_CORE = String.raw`\d+\.\d+\.\d+`;
+var CANARY_SUFFIX = String.raw`-${CANARY_IDENTIFIER}\.(?:0|[1-9]\d*)`;
+var CANARY_VERSION_PATTERN = `^${STABLE_CORE}${CANARY_SUFFIX}$`;
+var PLATFORM_VERSION_PATTERN = `^${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var PLATFORM_TAG_PATTERN = `^platform-v${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var CANARY_VERSION_RE = new RegExp(CANARY_VERSION_PATTERN);
+var STABLE_CORE_RE = new RegExp(`^${STABLE_CORE}$`);
+
+// ../../packages/platform-release/dist/esm/apply-request.js
+var APPLY_REQUEST_PK = "system";
+var APPLY_REQUEST_RK = "apply-request";
+var IN_FLIGHT = ["claimed", "applying"];
+var LEASE_MS = 30 * 60 * 1e3;
+var MAX_LEASE_TAKEOVERS = 2;
+var MAX_HEALTHY_IN_FLIGHT_MS = LEASE_MS * (MAX_LEASE_TAKEOVERS + 1);
+function isInFlight(status) {
+  return IN_FLIGHT.includes(status);
+}
+var BLOCKS_NEW_INTENT = ["pending", "claimed", "applying", "awaiting-engine-update"];
+function blocksNewIntent(status) {
+  return BLOCKS_NEW_INTENT.includes(status);
+}
+function newIntent(target, provenance, nowIso) {
+  return {
+    schemaVersion: 1,
+    target,
+    provenance,
+    status: "pending",
+    phase: null,
+    claimedBy: null,
+    leaseUntil: null,
+    attempt: 0,
+    breaker: "none",
+    result: null,
+    createdAt: nowIso,
+    updatedAt: nowIso
+  };
+}
+function applyRequestToEntity(r) {
+  return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
+}
+function entityToApplyRequest(e) {
+  return JSON.parse(e.value);
+}
+
+// ../../packages/platform-release/dist/esm/update-policy.js
+var DEFAULT_POLICY_MODE = "auto-critical";
+var UPDATE_POLICY_PK = "system";
+var UPDATE_POLICY_RK = "update-policy";
+var MODES = ["notify-only", "auto-critical", "auto-all"];
+function isPolicyMode(x) {
+  return typeof x === "string" && MODES.includes(x);
+}
+function updatePolicyToEntity(p) {
+  return { partitionKey: UPDATE_POLICY_PK, rowKey: UPDATE_POLICY_RK, value: JSON.stringify(p) };
+}
+function entityToUpdatePolicy(e) {
+  return JSON.parse(e.value);
+}
+
+// ../../packages/platform-release/dist/esm/infra-params.js
+var INFRA_PARAMS_PK = "system";
+var INFRA_PARAMS_RK = "infra-params";
+function infraParamsToEntity(p) {
+  return { partitionKey: INFRA_PARAMS_PK, rowKey: INFRA_PARAMS_RK, value: JSON.stringify(p) };
+}
+function entityToInfraParams(e) {
+  return JSON.parse(e.value);
+}
+
+// src/lib/platform-storage-discovery.ts
+init_http();
+init_errors();
+var ARM3 = "https://management.azure.com";
+var ARM_SCOPE7 = "https://management.azure.com/.default";
+var STORAGE_API = "2023-05-01";
+async function discoverStampStorage(opts) {
+  const list = await authedJson({
+    credential: opts.credential,
+    scope: ARM_SCOPE7,
+    method: "GET",
+    url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
+  }) ?? {};
+  const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
+  const chosen = accounts.find((a) => a.tags?.m8t === "storage") ?? accounts.find((a) => a.tags?.["m8t:role"] === "gateway" || a.tags?.["m8t:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
+  if (!tableEndpoint || !chosen?.id || !chosen.name) {
+    throw new LocalCliError({
+      code: "PLATFORM_STAMP_STORAGE_NOT_FOUND",
+      message: `No table-capable storage account found in resource group ${opts.resourceGroup}.`,
+      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}.`
+    });
+  }
+  return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
+}
+
+// src/lib/metadata-table-write.ts
+import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
+init_errors();
+init_rbac();
+function is403(e) {
+  return e.statusCode === 403;
+}
+function is404(e) {
+  return e.statusCode === 404;
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function makeSharedKeyClient(opts) {
+  const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
+  if (!rg) return null;
+  const key2 = (await runAz(["storage", "account", "keys", "list", "--account-name", opts.accountName, "-g", rg, "--query", "[0].value", "-o", "tsv"])).trim();
+  if (!key2) return null;
+  return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
+}
+async function upsertMetadataEntity(opts) {
+  const discover = opts.discoverImpl ?? discoverStampStorage;
+  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
+  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
+  const nap = opts.sleepImpl ?? sleep2;
+  const { tableEndpoint, accountResourceId, accountName } = await discover({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup
+  });
+  const aad = makeAad(tableEndpoint, opts.credential);
+  await aad.createTable().catch(() => void 0);
+  try {
+    await aad.upsertEntity(opts.entity, "Replace");
+    return;
+  } catch (e) {
+    if (!is403(e)) throw e;
+  }
+  opts.onProgress?.(`writing the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
+  const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
+  if (shared) {
+    await shared.createTable().catch(() => void 0);
+    await shared.upsertEntity(opts.entity, "Replace");
+    return;
+  }
+  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
+  try {
+    const oid = await getCallerObjectId();
+    await grantStorageTableDataContributor({
+      credential: opts.credential,
+      subscriptionId: opts.subscriptionId,
+      scope: accountResourceId,
+      principalId: oid
+    });
+  } catch (e) {
+    throw new LocalCliError({
+      code: opts.errorCode,
+      message: `Cannot write the ${opts.label}: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
+      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
+      cause: e
+    });
+  }
+  for (let i = 0; i < 6; i++) {
+    await nap(1e4);
+    try {
+      await aad.upsertEntity(opts.entity, "Replace");
+      return;
+    } catch (e) {
+      if (!is403(e)) throw e;
+    }
+  }
+  throw new LocalCliError({
+    code: opts.errorCode,
+    message: `Cannot write the ${opts.label}: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
+    hint: opts.retryHint
+  });
+}
+
+// src/lib/platform-stamp.ts
+async function writeStamp(opts) {
+  const entity = stampToEntity(opts.stamp);
+  await upsertMetadataEntity({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup,
+    entity,
+    label: "platform stamp",
+    errorCode: "PLATFORM_STAMP_NO_ACCESS",
+    retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
+    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
+  });
+}
+async function readStampOutcome(opts) {
+  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
+  const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
+  try {
+    const row = await aad.getEntity(PK, RK);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
+  } catch (e) {
+    if (is404(e)) return { source: "absent" };
+    if (!is403(e)) return { source: "unreadable" };
+  }
+  try {
+    const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
+    if (!shared) return { source: "unreadable" };
+    const row = await shared.getEntity(PK, RK);
+    const stamp = entityToStamp(row);
+    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
+  } catch {
+    return { source: "unreadable" };
+  }
+}
+async function readStamp(opts) {
+  const result2 = await readStampOutcome(opts);
+  return result2.source === "explicit" ? result2.stamp : null;
+}
+
 // src/commands/azure-exec/deploy.ts
 import { CommunicationServiceManagementClient } from "@azure/arm-communication";
 var SIZE_PRESETS2 = {
@@ -19746,7 +20282,14 @@ var AzureExecDeployCommand = class extends M8tCommand {
   output = Option31.String("--output");
   skipQuotaCheck = Option31.Boolean("--skip-quota-check", false);
   grantAccessAdmin = Option31.Boolean("--grant-access-admin", false);
-  enableEmail = Option31.Boolean("--enable-email", false);
+  /** Deprecated no-op: outbound email is provisioned by default now. Kept for one release
+   *  so runbooks and scripts that still pass it do not hard-fail. */
+  enableEmail = Option31.Boolean("--enable-email", false, {
+    description: "Deprecated no-op \u2014 outbound email is provisioned by default. Use --no-email to opt out."
+  });
+  noEmail = Option31.Boolean("--no-email", false, {
+    description: "Deploy without outbound email. The executor renders advisor handoffs but cannot send them."
+  });
   async executeCommand() {
     if (!NAME_RE2.test(this.name)) {
       throw new LocalCliError({
@@ -19796,12 +20339,8 @@ var AzureExecDeployCommand = class extends M8tCommand {
         });
       }
     }
-    if (this.enableEmail === true && (typeof this.resourceGroup !== "string" || this.resourceGroup.length === 0)) {
-      throw new LocalCliError({
-        code: "USAGE",
-        message: "--enable-email requires --resource-group (the ACS resource lands in the Contributor-granted RG so the executor's identity can send).",
-        hint: "Pass --resource-group <rg> (the same scope the executor is granted Contributor on)."
-      });
+    if (this.enableEmail === true) {
+      warnings.add("--enable-email is a no-op now: outbound email is provisioned by default. Pass --no-email to opt out.");
     }
     const imageInput = this.image ?? DEFAULT_IMAGE2;
     const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_REGISTRY2}/${imageInput}`;
@@ -19843,20 +20382,62 @@ var AzureExecDeployCommand = class extends M8tCommand {
       privateKeyPem,
       write: (s) => this.context.stdout.write(s)
     });
+    const wantEmail = this.noEmail !== true;
     let acsEnv = {};
-    if (this.enableEmail === true && typeof this.resourceGroup === "string") {
-      const resourceGroup = this.resourceGroup;
-      onProgress?.("provisioning ACS Email (managed domain)\u2026");
-      const acsClient = new CommunicationServiceManagementClient(credential2, subscriptionId);
-      const acs = await provisionAcsEmail({
-        client: acsClient,
+    const stampRg = await this.resolvePlatformResourceGroup({ subscriptionId, interactive, warnings });
+    const scopeClass = classifyGrantScope(grantScope, subscriptionId);
+    if (wantEmail) {
+      const suffix = platformSuffixFromKvUri(kvUri);
+      const acsRg = scopeClass.kind === "resource-group" ? scopeClass.resourceGroup : scopeClass.kind === "subscription" ? stampRg : null;
+      if (scopeClass.kind === "unusable") {
+        warnings.add(`Outbound email was NOT provisioned: ${scopeClass.reason}. Re-run with --resource-group <rg> to place it explicitly.`);
+      } else if (acsRg === null || suffix === null) {
+        warnings.add(
+          "Outbound email was NOT provisioned: could not work out which resource group it belongs in. Re-run with --resource-group <rg>, or turn it on later with `m8t platform email on`."
+        );
+      } else {
+        try {
+          onProgress?.("resolving the ACS email sender\u2026");
+          const acsClient = new CommunicationServiceManagementClient(credential2, subscriptionId);
+          const resolution = await resolveAcs({
+            client: acsClient,
+            stamp: stampRg === null ? null : await this.readStampQuietly({ credential: credential2, subscriptionId, resourceGroup: stampRg }),
+            subscriptionId,
+            resourceGroup: acsRg,
+            suffix,
+            dataLocation: "United States",
+            onProgress
+          });
+          acsEnv = {
+            M8T_ACS_ENDPOINT: resolution.acs.endpoint,
+            M8T_ACS_SENDER: resolution.acs.sender,
+            M8T_EMAIL_ENABLED: "true"
+          };
+          await this.recordEmailIntent({
+            credential: credential2,
+            subscriptionId,
+            resourceGroup: stampRg,
+            feature: emailFeatureFrom(resolution.acs, true),
+            warnings,
+            onProgress
+          });
+        } catch (e) {
+          acsEnv = {};
+          warnings.add(
+            `Outbound email was NOT provisioned (${e instanceof Error ? e.message : String(e)}). The executor is deployed and usable; turn email on later with \`m8t platform email on\`.`
+          );
+        }
+      }
+    } else {
+      onProgress?.("--no-email: skipping outbound email.");
+      await this.recordEmailIntent({
+        credential: credential2,
         subscriptionId,
-        resourceGroup,
-        name: this.name,
-        dataLocation: "United States",
+        resourceGroup: stampRg,
+        feature: { enabled: false, acsEndpoint: "", acsSender: "" },
+        warnings,
         onProgress
       });
-      acsEnv = { M8T_ACS_ENDPOINT: acs.endpoint, M8T_ACS_SENDER: acs.sender };
     }
     const env = {
       MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? DEFAULT_MODEL2,
@@ -19977,6 +20558,93 @@ var AzureExecDeployCommand = class extends M8tCommand {
     );
     return 0;
   }
+  /** Resolve the PLATFORM resource group — the one holding the stamp's storage account.
+   *
+   *  Deliberately independent of the ACS resource group: they are often the same, but when
+   *  they are not, reading the stamp from the wrong one throws and would read as "no stamp".
+   *  Returns null (with a warning) rather than throwing, because a worker deploy must not
+   *  fail over the stamp. */
+  async resolvePlatformResourceGroup(opts) {
+    const disambiguator = typeof this.resourceGroup === "string" && this.resourceGroup.length > 0 ? this.resourceGroup : void 0;
+    try {
+      return resourceGroupFromArmId(
+        (await discoverGateway({
+          subscriptionId: opts.subscriptionId,
+          interactive: opts.interactive,
+          ...disambiguator !== void 0 ? { resourceGroup: disambiguator } : {}
+        })).containerAppResourceId
+      );
+    } catch (e) {
+      if (e.code === "GATEWAY_DISCOVERY_RG_NOT_FOUND" && disambiguator !== void 0) {
+        try {
+          return resourceGroupFromArmId(
+            (await discoverGateway({ subscriptionId: opts.subscriptionId, interactive: opts.interactive })).containerAppResourceId
+          );
+        } catch (retryErr) {
+          opts.warnings.add(
+            `Could not locate the platform resource group (${retryErr instanceof Error ? retryErr.message : String(retryErr)}), so the outbound-email decision could not be recorded. Run \`m8t platform email on|off\` once the platform resolves.`
+          );
+          return null;
+        }
+      }
+      opts.warnings.add(
+        `Could not locate the platform resource group (${e instanceof Error ? e.message : String(e)}), so the outbound-email decision could not be recorded. Run \`m8t platform email on|off\` once the platform resolves.`
+      );
+      return null;
+    }
+  }
+  /** Read the platform stamp, distinguishing "genuinely absent" from "unreadable".
+   *
+   *  🔴 The distinction matters: on `absent` (a fresh install) falling through to ACS
+   *  discovery is correct, but on `unreadable` we cannot know whether an ACS is already on
+   *  record, and provisioning a duplicate billable resource on a failed read would be worse
+   *  than doing nothing. `unreadable` therefore throws, and the caller's catch turns it into
+   *  a loud skip. */
+  async readStampQuietly(opts) {
+    const outcome = await readStampOutcome(opts);
+    if (outcome.source === "explicit") return outcome.stamp;
+    if (outcome.source === "absent") return null;
+    throw new Error(
+      "the platform stamp exists but could not be read, so it is not safe to decide whether an ACS is already on record"
+    );
+  }
+  /** Persist the outbound-email decision to the platform stamp.
+   *
+   *  Recording intent is the durability fix: before this, email lived only in the argv of
+   *  one command. If the stamp cannot be read or written, the deploy still succeeds — but
+   *  it WARNS, because an intent that silently failed to persist is exactly the state that
+   *  hid this outage. */
+  async recordEmailIntent(opts) {
+    const { credential: credential2, subscriptionId, resourceGroup, feature, warnings, onProgress } = opts;
+    if (resourceGroup === null) return;
+    try {
+      const current = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+      if (current === null) {
+        warnings.add(
+          `Outbound email is ${feature.enabled ? "on" : "off"} for this executor, but there is no platform stamp to record it in \u2014 a later converge will not know about it. Run \`m8t platform email on\` once the stamp exists.`
+        );
+        return;
+      }
+      const prior = current.features?.email;
+      const merged = {
+        enabled: feature.enabled,
+        acsEndpoint: feature.acsEndpoint || (prior?.acsEndpoint ?? ""),
+        acsSender: feature.acsSender || (prior?.acsSender ?? "")
+      };
+      await writeStamp({
+        credential: credential2,
+        subscriptionId,
+        resourceGroup,
+        stamp: { ...current, features: { ...current.features, email: merged } },
+        onProgress
+      });
+      onProgress?.(`recorded outbound email = ${merged.enabled ? "on" : "off"} in the platform stamp.`);
+    } catch (e) {
+      warnings.add(
+        `Could not record the outbound-email decision in the platform stamp (${e instanceof Error ? e.message : String(e)}). The executor is wired correctly, but a later converge will not know the intent.`
+      );
+    }
+  }
   resolveScope(subscriptionId) {
     if (typeof this.scope === "string" && this.scope.startsWith("/subscriptions/")) return this.scope;
     if (typeof this.resourceGroup === "string" && this.resourceGroup.length > 0) {
@@ -20144,254 +20812,6 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
 
 // src/lib/release-channel.ts
 import * as fs23 from "fs";
-
-// ../../packages/platform-release/dist/esm/manifest.js
-var SEVERITIES = ["critical", "recommended", "optional"];
-var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
-var COMPANION_TARGETS = [
-  "darwin-arm64",
-  "darwin-x64",
-  "win32-arm64",
-  "win32-x64"
-];
-function companionTargetFor(platform, architecture) {
-  const target = `${platform}-${architecture}`;
-  return COMPANION_TARGETS.includes(target) ? target : null;
-}
-function isObj2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function validateManifest(m) {
-  const errors = [];
-  if (!isObj2(m))
-    return ["manifest is not an object"];
-  if (m.schemaVersion !== 1)
-    errors.push("schemaVersion must be the integer 1");
-  const p = m.platform;
-  if (!isObj2(p)) {
-    errors.push("platform is required");
-  } else {
-    for (const f of ["version", "tag", "releasedAt", "commit", "notes", "notesUrl"]) {
-      if (typeof p[f] !== "string" || p[f].length === 0)
-        errors.push(`platform.${f} is required`);
-    }
-    if (!SEVERITIES.includes(p.severity))
-      errors.push(`platform.severity must be one of ${SEVERITIES.join("|")}`);
-    if (!(typeof p.previousVersion === "string" || p.previousVersion === null)) {
-      errors.push("platform.previousVersion must be a string or null");
-    }
-  }
-  const c = m.components;
-  if (!isObj2(c)) {
-    errors.push("components is required");
-    return errors;
-  }
-  for (const key2 of IMAGE_KEYS) {
-    const img = c[key2];
-    if (!isObj2(img)) {
-      errors.push(`components.${key2} is required`);
-      continue;
-    }
-    if (img.kind !== "image")
-      errors.push(`components.${key2}.kind must be "image"`);
-    for (const f of ["ref", "tag", "version"]) {
-      if (typeof img[f] !== "string" || img[f].length === 0)
-        errors.push(`components.${key2}.${f} is required`);
-    }
-    if (typeof img.digest !== "string" || !/^sha256:[0-9a-f]+$/.test(img.digest)) {
-      errors.push(`components.${key2}.digest must be a sha256:\u2026 digest`);
-    }
-  }
-  const cli2 = c.cli;
-  if (!isObj2(cli2) || cli2.kind !== "npm") {
-    errors.push("components.cli (kind: npm) is required");
-  } else {
-    for (const f of ["package", "version", "min", "recommended"]) {
-      if (typeof cli2[f] !== "string" || cli2[f].length === 0)
-        errors.push(`components.cli.${f} is required`);
-    }
-  }
-  const personas = c.personas;
-  if (!isObj2(personas) || !isObj2(personas.items)) {
-    errors.push("components.personas.items is required");
-  } else {
-    for (const [name, item] of Object.entries(personas.items)) {
-      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
-        errors.push(`components.personas.items.${name}.path is required`);
-      }
-      if (!isObj2(item) || typeof item.treeSha !== "string" || item.treeSha.length < 4) {
-        errors.push(`components.personas.items.${name}.treeSha is required`);
-      }
-    }
-  }
-  const seeds = c.brainSeeds;
-  if (!isObj2(seeds) || !isObj2(seeds.items)) {
-    errors.push("components.brainSeeds.items is required");
-  } else {
-    for (const [name, item] of Object.entries(seeds.items)) {
-      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
-        errors.push(`components.brainSeeds.items.${name}.path is required`);
-      }
-      if (!isObj2(item) || !isObj2(item.subtrees)) {
-        errors.push(`components.brainSeeds.items.${name}.subtrees is required`);
-      }
-    }
-  }
-  const infra = c.infra;
-  if (infra !== void 0) {
-    if (!isObj2(infra) || infra.kind !== "infra") {
-      errors.push('components.infra.kind must be "infra"');
-    }
-    if (!isObj2(infra) || typeof infra.treeSha !== "string" || infra.treeSha.length < 4) {
-      errors.push("components.infra.treeSha is required");
-    }
-  }
-  const companion = c.companion;
-  if (companion !== void 0) {
-    if (!isObj2(companion) || companion.kind !== "desktop") {
-      errors.push('components.companion.kind must be "desktop"');
-    } else {
-      for (const f of ["version", "tag"]) {
-        if (typeof companion[f] !== "string" || companion[f].length === 0) {
-          errors.push(`components.companion.${f} is required`);
-        }
-      }
-      if (!isObj2(companion.targets) || Object.keys(companion.targets).length === 0) {
-        errors.push("components.companion.targets must name at least one target");
-      } else {
-        for (const [name, target] of Object.entries(companion.targets)) {
-          if (!COMPANION_TARGETS.includes(name)) {
-            errors.push(`components.companion.targets.${name} is not a known target`);
-            continue;
-          }
-          if (!isObj2(target) || typeof target.asset !== "string" || target.asset.length === 0) {
-            errors.push(`components.companion.targets.${name}.asset is required`);
-          }
-          if (!isObj2(target) || typeof target.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(target.sha256)) {
-            errors.push(`components.companion.targets.${name}.sha256 must be a sha256 hex digest`);
-          }
-        }
-      }
-    }
-  }
-  return errors;
-}
-
-// ../../packages/platform-release/dist/esm/stamp.js
-var TABLE = "Metadata";
-var PK = "system";
-var RK = "platform";
-function stampToEntity(s) {
-  return {
-    partitionKey: PK,
-    rowKey: RK,
-    platformVersion: s.platformVersion,
-    updatedAt: s.updatedAt,
-    lastResult: s.lastResult,
-    value: JSON.stringify(s)
-  };
-}
-function entityToStamp(e) {
-  const raw = e.value;
-  if (typeof raw !== "string")
-    return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
-// ../../packages/platform-release/dist/esm/channel-url.js
-var RELEASES_REPO = "m8t-labs/m8t-releases";
-var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
-var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
-var CANARY_POINTER_TAG = "canary";
-var CHANNEL_CANARY_URL = `${RELEASES_BASE}/download/${CANARY_POINTER_TAG}/manifest.json`;
-function platformTag(version) {
-  const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
-  return `platform-v${bare}`;
-}
-function channelUrlForVersion(version) {
-  return `${RELEASES_BASE}/download/${platformTag(version)}/manifest.json`;
-}
-function releaseAssetUrl(tag, asset) {
-  return `${RELEASES_BASE}/download/${tag}/${asset}`;
-}
-
-// ../../packages/platform-release/dist/esm/canary-version.js
-var CANARY_IDENTIFIER = "canary";
-var STABLE_CORE = String.raw`\d+\.\d+\.\d+`;
-var CANARY_SUFFIX = String.raw`-${CANARY_IDENTIFIER}\.(?:0|[1-9]\d*)`;
-var CANARY_VERSION_PATTERN = `^${STABLE_CORE}${CANARY_SUFFIX}$`;
-var PLATFORM_VERSION_PATTERN = `^${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
-var PLATFORM_TAG_PATTERN = `^platform-v${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
-var CANARY_VERSION_RE = new RegExp(CANARY_VERSION_PATTERN);
-var STABLE_CORE_RE = new RegExp(`^${STABLE_CORE}$`);
-
-// ../../packages/platform-release/dist/esm/apply-request.js
-var APPLY_REQUEST_PK = "system";
-var APPLY_REQUEST_RK = "apply-request";
-var IN_FLIGHT = ["claimed", "applying"];
-var LEASE_MS = 30 * 60 * 1e3;
-var MAX_LEASE_TAKEOVERS = 2;
-var MAX_HEALTHY_IN_FLIGHT_MS = LEASE_MS * (MAX_LEASE_TAKEOVERS + 1);
-function isInFlight(status) {
-  return IN_FLIGHT.includes(status);
-}
-var BLOCKS_NEW_INTENT = ["pending", "claimed", "applying", "awaiting-engine-update"];
-function blocksNewIntent(status) {
-  return BLOCKS_NEW_INTENT.includes(status);
-}
-function newIntent(target, provenance, nowIso) {
-  return {
-    schemaVersion: 1,
-    target,
-    provenance,
-    status: "pending",
-    phase: null,
-    claimedBy: null,
-    leaseUntil: null,
-    attempt: 0,
-    breaker: "none",
-    result: null,
-    createdAt: nowIso,
-    updatedAt: nowIso
-  };
-}
-function applyRequestToEntity(r) {
-  return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
-}
-function entityToApplyRequest(e) {
-  return JSON.parse(e.value);
-}
-
-// ../../packages/platform-release/dist/esm/update-policy.js
-var DEFAULT_POLICY_MODE = "auto-critical";
-var UPDATE_POLICY_PK = "system";
-var UPDATE_POLICY_RK = "update-policy";
-var MODES = ["notify-only", "auto-critical", "auto-all"];
-function isPolicyMode(x) {
-  return typeof x === "string" && MODES.includes(x);
-}
-function updatePolicyToEntity(p) {
-  return { partitionKey: UPDATE_POLICY_PK, rowKey: UPDATE_POLICY_RK, value: JSON.stringify(p) };
-}
-function entityToUpdatePolicy(e) {
-  return JSON.parse(e.value);
-}
-
-// ../../packages/platform-release/dist/esm/infra-params.js
-var INFRA_PARAMS_PK = "system";
-var INFRA_PARAMS_RK = "infra-params";
-function infraParamsToEntity(p) {
-  return { partitionKey: INFRA_PARAMS_PK, rowKey: INFRA_PARAMS_RK, value: JSON.stringify(p) };
-}
-function entityToInfraParams(e) {
-  return JSON.parse(e.value);
-}
-
-// src/lib/release-channel.ts
 init_errors();
 function manifestSourceForVersionTag(channelUrl, version) {
   const tag = platformTag(version);
@@ -20551,153 +20971,6 @@ async function resolveReleaseContentWithAgents(manifest, opts = {}) {
   return contentDir;
 }
 
-// src/lib/platform-stamp.ts
-import { TableClient as TableClient2 } from "@azure/data-tables";
-
-// src/lib/platform-storage-discovery.ts
-init_http();
-init_errors();
-var ARM3 = "https://management.azure.com";
-var ARM_SCOPE7 = "https://management.azure.com/.default";
-var STORAGE_API = "2023-05-01";
-async function discoverStampStorage(opts) {
-  const list = await authedJson({
-    credential: opts.credential,
-    scope: ARM_SCOPE7,
-    method: "GET",
-    url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
-  }) ?? {};
-  const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
-  const chosen = accounts.find((a) => a.tags?.m8t === "storage") ?? accounts.find((a) => a.tags?.["m8t:role"] === "gateway" || a.tags?.["m8t:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
-  const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
-  if (!tableEndpoint || !chosen?.id || !chosen.name) {
-    throw new LocalCliError({
-      code: "PLATFORM_STAMP_STORAGE_NOT_FOUND",
-      message: `No table-capable storage account found in resource group ${opts.resourceGroup}.`,
-      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}.`
-    });
-  }
-  return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
-}
-
-// src/lib/metadata-table-write.ts
-import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
-init_errors();
-init_rbac();
-function is403(e) {
-  return e.statusCode === 403;
-}
-function is404(e) {
-  return e.statusCode === 404;
-}
-function sleep2(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-async function makeSharedKeyClient(opts) {
-  const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
-  if (!rg) return null;
-  const key2 = (await runAz(["storage", "account", "keys", "list", "--account-name", opts.accountName, "-g", rg, "--query", "[0].value", "-o", "tsv"])).trim();
-  if (!key2) return null;
-  return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
-}
-async function upsertMetadataEntity(opts) {
-  const discover = opts.discoverImpl ?? discoverStampStorage;
-  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
-  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
-  const nap = opts.sleepImpl ?? sleep2;
-  const { tableEndpoint, accountResourceId, accountName } = await discover({
-    credential: opts.credential,
-    subscriptionId: opts.subscriptionId,
-    resourceGroup: opts.resourceGroup
-  });
-  const aad = makeAad(tableEndpoint, opts.credential);
-  await aad.createTable().catch(() => void 0);
-  try {
-    await aad.upsertEntity(opts.entity, "Replace");
-    return;
-  } catch (e) {
-    if (!is403(e)) throw e;
-  }
-  opts.onProgress?.(`writing the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
-  const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
-  if (shared) {
-    await shared.createTable().catch(() => void 0);
-    await shared.upsertEntity(opts.entity, "Replace");
-    return;
-  }
-  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
-  try {
-    const oid = await getCallerObjectId();
-    await grantStorageTableDataContributor({
-      credential: opts.credential,
-      subscriptionId: opts.subscriptionId,
-      scope: accountResourceId,
-      principalId: oid
-    });
-  } catch (e) {
-    throw new LocalCliError({
-      code: opts.errorCode,
-      message: `Cannot write the ${opts.label}: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
-      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
-      cause: e
-    });
-  }
-  for (let i = 0; i < 6; i++) {
-    await nap(1e4);
-    try {
-      await aad.upsertEntity(opts.entity, "Replace");
-      return;
-    } catch (e) {
-      if (!is403(e)) throw e;
-    }
-  }
-  throw new LocalCliError({
-    code: opts.errorCode,
-    message: `Cannot write the ${opts.label}: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
-    hint: opts.retryHint
-  });
-}
-
-// src/lib/platform-stamp.ts
-async function writeStamp(opts) {
-  const entity = stampToEntity(opts.stamp);
-  await upsertMetadataEntity({
-    credential: opts.credential,
-    subscriptionId: opts.subscriptionId,
-    resourceGroup: opts.resourceGroup,
-    entity,
-    label: "platform stamp",
-    errorCode: "PLATFORM_STAMP_NO_ACCESS",
-    retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
-    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
-  });
-}
-async function readStampOutcome(opts) {
-  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
-  const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
-  try {
-    const row = await aad.getEntity(PK, RK);
-    const stamp = entityToStamp(row);
-    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
-  } catch (e) {
-    if (is404(e)) return { source: "absent" };
-    if (!is403(e)) return { source: "unreadable" };
-  }
-  try {
-    const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
-    if (!shared) return { source: "unreadable" };
-    const row = await shared.getEntity(PK, RK);
-    const stamp = entityToStamp(row);
-    return stamp ? { source: "explicit", stamp } : { source: "unreadable" };
-  } catch {
-    return { source: "unreadable" };
-  }
-}
-async function readStamp(opts) {
-  const result2 = await readStampOutcome(opts);
-  return result2.source === "explicit" ? result2.stamp : null;
-}
-
 // src/lib/platform-converge.ts
 init_esm();
 import * as fs26 from "fs";
@@ -21115,6 +21388,9 @@ async function applyPlan(plan, deps, ctx) {
       stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       await deps.writeStamp(stamp);
     }
+    if (deps.reconcileEmail) {
+      await deps.reconcileEmail();
+    }
     await deps.healthGate(ctx, applied);
     stamp.lastResult = "success";
     delete stamp.lastError;
@@ -21594,6 +21870,73 @@ import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/ident
 // src/lib/platform-converge-cli.ts
 import * as path31 from "path";
 
+// src/lib/executor-email-env.ts
+init_foundry_agent_get();
+init_foundry_agent_version();
+var EMAIL_ENV_KEYS = ["M8T_ACS_ENDPOINT", "M8T_ACS_SENDER", "M8T_EMAIL_ENABLED"];
+var FOUNDRY_HOSTED_HEADER = { "Foundry-Features": "HostedAgents=V1Preview" };
+function applyEmailEnv(def, feature) {
+  const live = def.environment_variables ?? {};
+  const carried = Object.fromEntries(
+    Object.entries(live).filter(([k]) => !EMAIL_ENV_KEYS.includes(k))
+  );
+  if (feature !== null && isEmailFeatureUsable(feature)) {
+    return {
+      ...def,
+      environment_variables: {
+        ...carried,
+        M8T_ACS_ENDPOINT: feature.acsEndpoint,
+        M8T_ACS_SENDER: feature.acsSender,
+        M8T_EMAIL_ENABLED: "true"
+      }
+    };
+  }
+  return { ...def, environment_variables: carried };
+}
+async function reconcileExecutorEmailEnv(args) {
+  const { credential: credential2, projectEndpoint, agentName, feature, onProgress } = args;
+  let current;
+  try {
+    current = await getAgentVersion({ credential: credential2, projectEndpoint, agentName });
+  } catch (e) {
+    const code = e.code;
+    if (code === "AGENT_NOT_FOUND") return { changed: false, absent: true };
+    return { changed: false, absent: false, unreadable: e instanceof Error ? e.message : String(e) };
+  }
+  const next = applyEmailEnv(current.definition, feature);
+  const before = current.definition.environment_variables ?? {};
+  const after = next.environment_variables;
+  if (EMAIL_ENV_KEYS.every((k) => before[k] === after[k])) {
+    return { changed: false, absent: false };
+  }
+  onProgress?.(`reconciling outbound-email env on ${agentName}\u2026`);
+  const version = await createAgentVersion({
+    credential: credential2,
+    projectEndpoint,
+    agentName,
+    definition: next,
+    // Carry the live metadata through unchanged: it holds the a2a card and brain markers,
+    // and dropping those has bitten this repo before.
+    metadata: current.metadata ?? {},
+    extraHeaders: FOUNDRY_HOSTED_HEADER
+  });
+  return { changed: true, absent: false, version };
+}
+var EXECUTOR_PERSONA = "azure-executor";
+var EXECUTOR_AGENT_FALLBACK = "ezra-executor";
+async function resolveExecutorAgentName(args) {
+  if (typeof args.override === "string" && args.override.length > 0) {
+    return { agentName: args.override, provenance: "override" };
+  }
+  try {
+    const agents = await listM8tAgents({ credential: args.credential, projectEndpoint: args.projectEndpoint });
+    const hit = agents.find((a) => a.metadata.persona === EXECUTOR_PERSONA);
+    if (hit) return { agentName: hit.name, provenance: "discovered" };
+  } catch {
+  }
+  return { agentName: EXECUTOR_AGENT_FALLBACK, provenance: "fallback" };
+}
+
 // src/lib/platform-infra-params.ts
 import { TableClient as TableClient3 } from "@azure/data-tables";
 async function openInfraParamsTable(opts) {
@@ -22071,6 +22414,37 @@ async function buildConvergeDeps(args) {
     async applyGateway(a, ctx) {
       return applyGatewayImage(a, ctx, args.gatewayResourceId);
     },
+    async reconcileEmail() {
+      const dir2 = HOSTED_AGENT_PERSONA_DIR.azureExecutor;
+      const agentName = dir2 ? discovered[dir2] : void 0;
+      if (!agentName) return;
+      const outcome = await readStampOutcome({
+        credential: args.credential,
+        subscriptionId: args.subscriptionId,
+        resourceGroup: args.resourceGroup
+      }).catch(() => ({ source: "unreadable" }));
+      if (outcome.source === "unreadable") {
+        warn("skipped the outbound-email reconcile: the platform stamp could not be read, so the recorded intent is unknown.");
+        return;
+      }
+      const feature = outcome.source === "explicit" ? outcome.stamp.features?.email ?? null : null;
+      try {
+        const r = await reconcileExecutorEmailEnv({
+          credential: args.credential,
+          projectEndpoint: args.project.endpoint,
+          agentName,
+          feature,
+          onProgress: args.onProgress
+        });
+        if (r.unreadable !== void 0) {
+          warn(`could not read ${agentName} to reconcile outbound email (${r.unreadable}) \u2014 left untouched.`);
+        } else if (r.changed) {
+          args.onProgress?.(`outbound-email env reconciled on ${agentName} (version ${r.version ?? "?"}).`);
+        }
+      } catch (e) {
+        warn(`could not reconcile outbound-email env on ${agentName}: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    },
     async applyInfra(a, ctx) {
       const target = infraTargetSha(ctx.manifest, args.tree);
       if (a.reason !== "forced") return applyInfraDeploy(a, ctx, target);
@@ -22335,6 +22709,27 @@ var PlatformUpdateCommand = class extends M8tCommand {
       return 0;
     }
     if (plan.actions.length === 0) {
+      if (only === void 0 || only === "azureExecutor") {
+        try {
+          const noDriftDeps = await buildConvergeDeps({
+            credential: credential2,
+            subscriptionId,
+            resourceGroup,
+            contentDir,
+            manifest,
+            tree,
+            project,
+            gatewayResourceId: gw.containerAppResourceId,
+            gatewayUrl: gw.gatewayUrl,
+            suffix,
+            onProgress,
+            onWarn
+          });
+          if (noDriftDeps.reconcileEmail) await noDriftDeps.reconcileEmail();
+        } catch (e) {
+          onWarn(`could not reconcile outbound email: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
       if (mode === "json") this.context.stdout.write(renderJson({ ...plan, applied: false }) + "\n");
       else log(colors.success("already up to date \u2713"));
       return 0;
@@ -22741,9 +23136,9 @@ async function readBreaker(client) {
 
 // src/commands/platform/converge.ts
 init_errors();
-function isForwardTarget(target, installed) {
-  if (!installed) return true;
-  return comparePlatformVersion(target, installed) >= 0;
+function isForwardTarget(target, installed2) {
+  if (!installed2) return true;
+  return comparePlatformVersion(target, installed2) >= 0;
 }
 async function failIfStillInFlight(client, now, error, opts = {}) {
   const cur = await readApplyRequest(client);
@@ -22812,15 +23207,15 @@ var PlatformConvergeCommand = class extends M8tCommand {
       subscriptionId: ctx.subscriptionId,
       resourceGroup: ctx.resourceGroup
     });
-    const installed = stamp ? stamp.platformVersion : null;
-    if (!isForwardTarget(claimed.target, installed)) {
+    const installed2 = stamp ? stamp.platformVersion : null;
+    if (!isForwardTarget(claimed.target, installed2)) {
       await patchApplyRequest(client, (r) => ({
         ...r,
         status: "failed",
-        result: { appliedVersion: null, error: `refused downgrade ${installed ?? "(none)"} \u2192 ${claimed.target}` },
+        result: { appliedVersion: null, error: `refused downgrade ${installed2 ?? "(none)"} \u2192 ${claimed.target}` },
         updatedAt: now()
       }));
-      log(`refused: target ${claimed.target} is a downgrade from installed ${installed ?? "(none)"}.`);
+      log(`refused: target ${claimed.target} is a downgrade from installed ${installed2 ?? "(none)"}.`);
       return 1;
     }
     const manifest = await fetchManifest(targetManifestSource(ctx, claimed.target));
@@ -23669,46 +24064,222 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/enable-auto-update.ts
+// src/commands/platform/email.ts
 import { Command as Command42, Option as Option39 } from "clipanion";
-import { confirm as confirm6 } from "@inquirer/prompts";
 import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
+import { CommunicationServiceManagementClient as CommunicationServiceManagementClient2 } from "@azure/arm-communication";
+init_errors();
+var PlatformEmailCommand = class extends M8tCommand {
+  static paths = [["platform", "email"]];
+  static usage = Command42.Usage({
+    description: "Turn outbound email (advisor handoffs) on or off for this install.",
+    details: "`on` resolves the ACS sender (reusing an existing one, provisioning only if there is none), records the decision in the platform stamp, and reconciles the executor's environment. `off` records the decision and strips the executor's email wiring, leaving the ACS resource in place so turning it back on is a flag flip. Idempotent \u2014 re-running either direction is safe, and no new agent version is posted when nothing changes.",
+    examples: [
+      ["Turn outbound email on", "m8t platform email on"],
+      ["Turn it off (a shared, public-facing deployment should stay off)", "m8t platform email off"]
+    ]
+  });
+  state = Option39.String({ required: true, name: "on|off" });
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group", {
+    description: "m8t resource group, to disambiguate in a multi-deployment subscription."
+  });
+  agent = Option39.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
+  kvUri = Option39.String("--kv-uri", {
+    description: "Install's Key Vault URI. Only needed if no ACS is on record yet and one must be provisioned."
+  });
+  endpoint = Option39.String("--endpoint", {
+    description: "Foundry project endpoint, to disambiguate a subscription holding several."
+  });
+  output = Option39.String("--output");
+  async executeCommand() {
+    const wanted = this.state.trim().toLowerCase();
+    if (wanted !== "on" && wanted !== "off") {
+      throw new LocalCliError({
+        code: "USAGE",
+        message: `Expected 'on' or 'off', got '${this.state}'.`,
+        hint: "Run `m8t platform email on` or `m8t platform email off`."
+      });
+    }
+    const enable = wanted === "on";
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
+`) : void 0;
+    const ctx = await resolveGatewayContext({
+      interactive: mode !== "json",
+      subscriptionId: this.subscription,
+      resourceGroup: this.resourceGroup
+    });
+    const { resourceGroup } = parseContainerAppResourceId(ctx.containerAppResourceId);
+    const subscriptionId = ctx.subscriptionId;
+    const credential2 = new DefaultAzureCredential22();
+    const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+    if (stamp === null) {
+      throw new LocalCliError({
+        code: "NO_PLATFORM_STAMP",
+        message: `No platform stamp found in ${resourceGroup} \u2014 there is nowhere to record the decision.`,
+        hint: "This command needs an install written by the current CLI. Check you are pointed at the right deployment with `m8t status`."
+      });
+    }
+    let feature;
+    if (enable) {
+      const suffix = this.resolveSuffix();
+      const resolution = await resolveAcs({
+        client: new CommunicationServiceManagementClient2(credential2, subscriptionId),
+        stamp,
+        subscriptionId,
+        resourceGroup,
+        suffix,
+        dataLocation: "United States",
+        onProgress
+      });
+      onProgress?.(`sender: ${resolution.acs.sender} (${resolution.source}).`);
+      feature = emailFeatureFrom(resolution.acs, true);
+    } else {
+      const prior = stamp.features?.email;
+      feature = { enabled: false, acsEndpoint: prior?.acsEndpoint ?? "", acsSender: prior?.acsSender ?? "" };
+    }
+    await writeStamp({
+      credential: credential2,
+      subscriptionId,
+      resourceGroup,
+      stamp: { ...stamp, features: { ...stamp.features, email: feature } },
+      onProgress
+    });
+    const project = await resolveFoundryProject({
+      credential: credential2,
+      subscriptionId,
+      interactive: mode !== "json",
+      ...typeof this.endpoint === "string" && this.endpoint.length > 0 ? { endpoint: this.endpoint } : {},
+      ...typeof this.resourceGroup === "string" && this.resourceGroup.length > 0 ? { resourceGroup: this.resourceGroup } : {}
+    });
+    const { agentName, provenance } = await resolveExecutorAgentName({
+      credential: credential2,
+      projectEndpoint: project.endpoint,
+      ...typeof this.agent === "string" && this.agent.length > 0 ? { override: this.agent } : {}
+    });
+    const reconciled = await reconcileExecutorEmailEnv({
+      credential: credential2,
+      projectEndpoint: project.endpoint,
+      agentName,
+      feature,
+      onProgress
+    });
+    if (mode === "json") {
+      this.context.stdout.write(
+        renderJson({
+          email: enable ? "on" : "off",
+          resourceGroup,
+          acsEndpoint: feature.acsEndpoint,
+          acsSender: feature.acsSender,
+          executor: agentName,
+          executorNameProvenance: provenance,
+          executorReconciled: reconciled.changed,
+          executorAbsent: reconciled.absent,
+          ...reconciled.unreadable !== void 0 ? { executorUnreadable: reconciled.unreadable } : {},
+          ...reconciled.version !== void 0 ? { executorVersion: reconciled.version } : {}
+        }) + "\n"
+      );
+      return reconciled.unreadable === void 0 ? 0 : 1;
+    }
+    this.context.stdout.write(
+      renderKeyValueBlock([
+        { key: "outbound email", value: enable ? "on" : "off" },
+        { key: "resource group", value: resourceGroup },
+        { key: "sender", value: feature.acsSender === "" ? "(none on record)" : feature.acsSender },
+        {
+          key: "executor",
+          // 🔴 `unreadable` MUST be its own branch. Falling through to "already correct" would
+          // have this command — the one an operator runs to FIX email — affirmatively claim
+          // success while having changed nothing, which is the exact conflation of broken with
+          // fine that this whole change exists to eliminate.
+          value: reconciled.unreadable !== void 0 ? `${agentName} (could NOT be read: ${reconciled.unreadable} \u2014 wiring NOT reconciled)` : reconciled.absent ? `${agentName} (not deployed \u2014 nothing to reconcile)` : reconciled.changed ? `${agentName} \u2192 version ${reconciled.version ?? "?"}` : `${agentName} (already correct)`
+        }
+      ]) + "\n"
+    );
+    if (reconciled.absent) {
+      this.context.stdout.write(
+        `  ${colors.hint("note:")} no executor is deployed here, so nothing can send yet. The decision is recorded and will apply when one is deployed.
+`
+      );
+    }
+    if (provenance === "fallback" && reconciled.absent) {
+      this.context.stdout.write(
+        `  ${colors.hint("note:")} '${agentName}' is a fallback name \u2014 the executor could not be discovered by persona. If yours is named differently, re-run with --agent <name>.
+`
+      );
+    }
+    if (reconciled.unreadable !== void 0) {
+      this.context.stdout.write(
+        colors.error(
+          `the decision is recorded, but ${agentName} was NOT reconciled \u2014 it exists and could not be read. Nothing about sending has changed yet; fix access and re-run.`
+        ) + "\n"
+      );
+      return 1;
+    }
+    this.context.stdout.write(
+      colors.success(enable ? "outbound email is on \u2713" : "outbound email is off \u2713") + "\n"
+    );
+    return 0;
+  }
+  /** The install's resource suffix, or null when it cannot be worked out.
+   *
+   *  Returns null rather than throwing: it is only needed if `resolveAcs` reaches its
+   *  provisioning leg, and failing the whole command over a missing AZURE_KEYVAULT_URI would
+   *  break the flip on every install that already has an ACS on record. */
+  resolveSuffix() {
+    try {
+      const explicit = typeof this.kvUri === "string" && this.kvUri.length > 0 ? this.kvUri : void 0;
+      return platformSuffixFromKvUri(discoverKvUri(process.env, explicit));
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/commands/platform/enable-auto-update.ts
+import { Command as Command43, Option as Option40 } from "clipanion";
+import { confirm as confirm6 } from "@inquirer/prompts";
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option39.String("--subscription");
-  resourceGroup = Option39.String("--resource-group", {
+  subscription = Option40.String("--subscription");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option39.String("--suffix", {
+  suffix = Option40.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option39.String("--installer-image", {
+  installerImage = Option40.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option39.String("--update-cron", {
+  updateCron = Option40.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option39.String("--channel-url", {
+  channelUrl = Option40.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option39.String("--location", {
+  location = Option40.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option39.String("--foundry-tracing", {
+  foundryTracing = Option40.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option39.String("--endpoint", {
+  endpoint = Option40.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option39.Boolean("--yes", false);
-  output = Option39.String("--output");
+  yes = Option40.Boolean("--yes", false);
+  output = Option40.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23727,7 +24298,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential22();
+    const credential2 = new DefaultAzureCredential23();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -23845,7 +24416,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_esm();
@@ -24393,15 +24964,15 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option40.String("--subscription");
-  resourceGroup = Option40.String("--resource-group", "rg-m8t-stack");
-  location = Option40.String("--location", "eastus");
-  suffix = Option40.String("--suffix", "");
-  imageRef = Option40.String("--image-ref", DEFAULT_IMAGE_REF);
+  subscription = Option41.String("--subscription");
+  resourceGroup = Option41.String("--resource-group", "rg-m8t-stack");
+  location = Option41.String("--location", "eastus");
+  suffix = Option41.String("--suffix", "");
+  imageRef = Option41.String("--image-ref", DEFAULT_IMAGE_REF);
   // Gateway-only override. Empty ⇒ the gateway uses --image-ref, which is the
   // from-zero case. It exists because the gateway and the voice relay do NOT
   // always run the same image: a converge preserves a BYOC gateway on its own
@@ -24409,28 +24980,28 @@ var DeployCommand = class extends M8tCommand {
   // (`--what-if`) that can only express one image therefore reports the other
   // app as drift on every single run, forever — which is exactly what the
   // infra-drift gate did from 2026-08-11.
-  gatewayImageRef = Option40.String("--gateway-image-ref", "");
-  acrPullIdentity = Option40.String("--acrpull-identity");
-  acrResourceId = Option40.String("--acr-resource-id");
-  foundryEndpoint = Option40.String("--foundry-endpoint");
-  foundryResourceId = Option40.String("--foundry-resource-id");
-  foundryTracing = Option40.String("--foundry-tracing");
+  gatewayImageRef = Option41.String("--gateway-image-ref", "");
+  acrPullIdentity = Option41.String("--acrpull-identity");
+  acrResourceId = Option41.String("--acr-resource-id");
+  foundryEndpoint = Option41.String("--foundry-endpoint");
+  foundryResourceId = Option41.String("--foundry-resource-id");
+  foundryTracing = Option41.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option40.String("--client-id");
-  whatIf = Option40.Boolean("--what-if", false);
+  clientId = Option41.String("--client-id");
+  whatIf = Option41.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option40.Boolean("--redact", false);
-  output = Option40.String("--output");
+  redact = Option41.Boolean("--redact", false);
+  output = Option41.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option40.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option41.String("--assign-subscription-roles");
   /**
    * The installer image the updater Container-Apps Job runs.
    *
@@ -24441,23 +25012,23 @@ var DeployCommand = class extends M8tCommand {
    * than that — the comparison proposes REMOVING an updater job that exists and
    * should, and reports it as drift on every single run.
    */
-  installerImage = Option40.String("--installer-image");
+  installerImage = Option41.String("--installer-image");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option40.String("--gateway-cpu");
-  gatewayMemory = Option40.String("--gateway-memory");
-  refereeEnabled = Option40.String("--referee-enabled");
-  refereeBrainRepos = Option40.String("--referee-brain-repos");
-  refereeFeedRepo = Option40.String("--referee-feed-repo");
-  refereeInstallationId = Option40.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option40.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option40.String("--exam-kv-uri");
-  examLaWorkspaceId = Option40.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option40.String("--brain-eval-deployment");
-  brainAppLogin = Option40.String("--brain-app-login");
-  refereeCheckpointDir = Option40.String("--referee-checkpoint-dir");
-  examApiBase = Option40.String("--exam-api-base");
+  gatewayCpu = Option41.String("--gateway-cpu");
+  gatewayMemory = Option41.String("--gateway-memory");
+  refereeEnabled = Option41.String("--referee-enabled");
+  refereeBrainRepos = Option41.String("--referee-brain-repos");
+  refereeFeedRepo = Option41.String("--referee-feed-repo");
+  refereeInstallationId = Option41.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option41.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option41.String("--exam-kv-uri");
+  examLaWorkspaceId = Option41.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option41.String("--brain-eval-deployment");
+  brainAppLogin = Option41.String("--brain-app-login");
+  refereeCheckpointDir = Option41.String("--referee-checkpoint-dir");
+  examApiBase = Option41.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24640,7 +25211,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -24665,14 +25236,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option41.String();
-  skillsDir = Option41.String("--skills-dir");
-  noJudge = Option41.Boolean("--no-judge", false);
-  deployment = Option41.String("--deployment");
-  output = Option41.String("--output");
+  candidate = Option42.String();
+  skillsDir = Option42.String("--skills-dir");
+  noJudge = Option42.Boolean("--no-judge", false);
+  deployment = Option42.String("--deployment");
+  output = Option42.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -24731,7 +25302,7 @@ var EvalSkillCommand = class extends M8tCommand {
 import { spawnSync as spawnSync5 } from "child_process";
 import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
 import { join as join30 } from "path";
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -24961,24 +25532,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option42.String();
-  arms = Option42.String("--arms");
-  taskSet = Option42.String("--task-set");
-  examType = Option42.String("--exam-type");
-  skill = Option42.String("--skill");
-  reps = Option42.String("-n,--reps");
-  probes = Option42.String("--probes");
-  pool = Option42.String("--pool");
-  out = Option42.String("--out");
-  dryRun = Option42.Boolean("--dry-run", false);
-  keepArms = Option42.Boolean("--keep-arms", false);
-  allowStub = Option42.Boolean("--allow-stub", false);
-  deployment = Option42.String("--deployment");
-  output = Option42.String("--output");
-  observeWaitS = Option42.String("--observe-wait-s");
+  worker = Option43.String();
+  arms = Option43.String("--arms");
+  taskSet = Option43.String("--task-set");
+  examType = Option43.String("--exam-type");
+  skill = Option43.String("--skill");
+  reps = Option43.String("-n,--reps");
+  probes = Option43.String("--probes");
+  pool = Option43.String("--pool");
+  out = Option43.String("--out");
+  dryRun = Option43.Boolean("--dry-run", false);
+  keepArms = Option43.Boolean("--keep-arms", false);
+  allowStub = Option43.Boolean("--allow-stub", false);
+  deployment = Option43.String("--deployment");
+  output = Option43.String("--output");
+  observeWaitS = Option43.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -25093,10 +25664,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -25104,8 +25675,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option43.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option43.Boolean("--verbose", false);
+  output = Option44.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option44.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -25136,18 +25707,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option44.String("--output");
-  verbose = Option44.Boolean("--verbose", false);
-  subscription = Option44.String("--subscription", {
+  output = Option45.String("--output");
+  verbose = Option45.Boolean("--verbose", false);
+  subscription = Option45.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option44.String("--resource-group", {
+  resourceGroup = Option45.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25212,7 +25783,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -25277,10 +25848,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option45.String("--output");
+  output = Option46.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25318,8 +25889,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import { Command as Command50, Option as Option47 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 import * as fs30 from "fs";
 import * as os12 from "os";
 import * as path33 from "path";
@@ -25523,6 +26094,43 @@ function checkLegacyStateDir(probe) {
     remediation: "review ~/.m8t-stack for anything you still need, then remove it"
   };
 }
+function checkOutboundEmail(probe) {
+  const name = "outbound email";
+  const intended = probe.stampFeature?.enabled === true;
+  if (!intended) {
+    return {
+      name,
+      status: "INFO",
+      detail: "off \u2014 advisor handoffs render but do not send",
+      remediation: "m8t platform email on"
+    };
+  }
+  if (probe.executorEnv === null) {
+    return {
+      name,
+      status: "WARN",
+      detail: `enabled in the stamp, but no ${probe.executorName} is deployed \u2014 nothing can send`,
+      remediation: `m8t azure-exec deploy ${probe.executorName} --resource-group <rg> --brain <owner/repo>`
+    };
+  }
+  const endpoint = probe.executorEnv.M8T_ACS_ENDPOINT ?? "";
+  const sender = probe.executorEnv.M8T_ACS_SENDER ?? "";
+  const flag = probe.executorEnv.M8T_EMAIL_ENABLED ?? "";
+  if (endpoint !== "" && sender !== "" && flag !== "") {
+    return { name, status: "PASS", detail: `on \u2014 sending as ${sender}` };
+  }
+  const missing = [
+    ...flag === "" ? ["M8T_EMAIL_ENABLED"] : [],
+    ...endpoint === "" ? ["M8T_ACS_ENDPOINT"] : [],
+    ...sender === "" ? ["M8T_ACS_SENDER"] : []
+  ];
+  return {
+    name,
+    status: "FAIL",
+    detail: `MISCONFIGURED \u2014 the stamp says email is on, but ${probe.executorName} is missing ${missing.join(", ")}. Ezra will refuse to send and report a platform bug.`,
+    remediation: "m8t platform email on"
+  };
+}
 
 // src/commands/doctor.ts
 init_foundry_agent_get();
@@ -25829,12 +26437,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option46.String("--output");
-  agent = Option46.String("--agent");
-  resourceGroup = Option46.String("--resource-group", {
+  output = Option47.String("--output");
+  agent = Option47.String("--agent");
+  resourceGroup = Option47.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25907,7 +26515,7 @@ var DoctorCommand = class extends M8tCommand {
       let kvStatus = 0;
       if (kv) {
         try {
-          const token = await new DefaultAzureCredential23().getToken("https://vault.azure.net/.default");
+          const token = await new DefaultAzureCredential24().getToken("https://vault.azure.net/.default");
           const res = await fetch(`${kv.uri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`, {
             headers: { Authorization: `Bearer ${token.token}` }
           });
@@ -25924,10 +26532,64 @@ var DoctorCommand = class extends M8tCommand {
       const region = foundryAccountId ? await resolveAccountLocation(foundryAccountId) : null;
       const usages = region ? await listModelQuota(region) : [];
       emit(checkModelQuota(deployments, usages));
+      checking("outbound email");
+      try {
+        const credential2 = new DefaultAzureCredential24();
+        const outcome = platformRg && platformSub ? await readStampOutcome({ credential: credential2, subscriptionId: platformSub, resourceGroup: platformRg }).catch(
+          () => ({ source: "unreadable" })
+        ) : { source: "unreadable" };
+        if (outcome.source === "unreadable") {
+          emit({
+            name: "outbound email",
+            status: "INFO",
+            detail: "could not read the recorded intent (platform stamp unreadable) \u2014 state unknown, not necessarily off"
+          });
+        } else {
+          const { agentName: executorName } = await resolveExecutorAgentName({
+            credential: credential2,
+            projectEndpoint: foundry.projectEndpoint
+          });
+          const stamp = outcome.source === "explicit" ? outcome.stamp : null;
+          let executorEnv = null;
+          let executorUnreadable = null;
+          try {
+            const cur = await getAgentVersion({
+              credential: credential2,
+              projectEndpoint: foundry.projectEndpoint,
+              agentName: executorName
+            });
+            executorEnv = cur.definition.environment_variables ?? {};
+          } catch (err) {
+            if (err.code === "AGENT_NOT_FOUND") executorEnv = null;
+            else executorUnreadable = err instanceof Error ? err.message : String(err);
+          }
+          if (executorUnreadable !== null) {
+            emit({
+              name: "outbound email",
+              status: "INFO",
+              detail: `could not read ${executorName} (${executorUnreadable}) \u2014 wiring unknown`
+            });
+          } else {
+            emit(
+              checkOutboundEmail({
+                stampFeature: stamp?.features?.email ?? null,
+                executorEnv,
+                executorName
+              })
+            );
+          }
+        }
+      } catch (e) {
+        emit({
+          name: "outbound email",
+          status: "INFO",
+          detail: `could not check: ${e instanceof Error ? e.message : String(e)}`
+        });
+      }
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential23();
+          const credential2 = new DefaultAzureCredential24();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -25970,11 +26632,11 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
-import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
 
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
@@ -26086,7 +26748,7 @@ function buildPrereqDeps(opts = {}) {
     probeRedirectUri,
     fixFoundryAccess,
     fixKeyVaultAccess,
-    credential: () => credentialSingleton2 ??= new DefaultAzureCredential24()
+    credential: () => credentialSingleton2 ??= new DefaultAzureCredential25()
   };
 }
 
@@ -26676,7 +27338,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -26687,15 +27349,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option47.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option47.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option47.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option47.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option47.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option47.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option47.String("--subscription");
-  resourceGroup = Option47.String("--resource-group");
-  output = Option47.String("--output");
+  fix = Option48.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option48.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option48.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option48.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option48.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option48.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option48.String("--subscription");
+  resourceGroup = Option48.String("--resource-group");
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -26751,7 +27413,7 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs31 from "fs/promises";
@@ -26891,14 +27553,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option48.String({ required: false });
-  subscription = Option48.String("--subscription");
-  list = Option48.Boolean("--list", false);
-  as = Option48.String("--as");
-  output = Option48.String("--output");
+  profile = Option49.String({ required: false });
+  subscription = Option49.String("--subscription");
+  list = Option49.Boolean("--list", false);
+  as = Option49.String("--as");
+  output = Option49.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26955,7 +27617,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -27001,14 +27663,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option49.String({ required: false });
-  print = Option49.Boolean("--print", false);
-  output = Option49.String("--output");
-  resourceGroup = Option49.String("--resource-group", {
+  target = Option50.String({ required: false });
+  print = Option50.Boolean("--print", false);
+  output = Option50.String("--output");
+  resourceGroup = Option50.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -27052,7 +27714,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -29346,28 +30008,28 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option50.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option51.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option50.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option50.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option50.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option50.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option50.Boolean("--show-transcripts", false, {
+  live = Option51.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option51.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option51.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option51.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option51.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option50.String("--subscription");
-  endpoint = Option50.String("--endpoint");
-  storageAccount = Option50.String("--storage-account", {
+  subscription = Option51.String("--subscription");
+  endpoint = Option51.String("--endpoint");
+  storageAccount = Option51.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
-  output = Option50.String("--output");
+  output = Option51.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -29718,7 +30380,7 @@ function defaultDeps(overrides) {
 
 // src/commands/conversations/sweep.ts
 import { createHash as createHash4 } from "crypto";
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient8 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient4 } from "@azure/ai-projects";
@@ -29844,7 +30506,7 @@ function defaultDeps2() {
 }
 var ConversationsSweepCommand = class extends M8tCommand {
   static paths = [["conversations", "sweep"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     category: "Conversations",
     description: "Delete expired public-visitor conversations (dry run by default)",
     details: `
@@ -29860,22 +30522,22 @@ var ConversationsSweepCommand = class extends M8tCommand {
       ["Delete, capped at 50", "m8t conversations sweep --delete --max 50"]
     ]
   });
-  doDelete = Option51.Boolean("--delete", false, {
+  doDelete = Option52.Boolean("--delete", false, {
     description: "Perform deletions (without this flag the command only reports)"
   });
-  principal = Option51.String("--principal", {
+  principal = Option52.String("--principal", {
     description: "Service-principal oid whose end-user keys are known-ephemeral (required with --delete; a dry run without it reports candidates grouped by principal)"
   });
-  max = Option51.String("--max", "200", { description: "Maximum deletions per run" });
-  graceDays = Option51.String("--grace-days", "14", {
+  max = Option52.String("--max", "200", { description: "Maximum deletions per run" });
+  graceDays = Option52.String("--grace-days", "14", {
     description: "Days past the 30-day key life before a conversation is eligible"
   });
-  lookbackDays = Option51.String("--lookback-days", "180", {
+  lookbackDays = Option52.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"
   });
-  subscription = Option51.String("--subscription", { description: "Azure subscription id override" });
-  endpoint = Option51.String("--endpoint", { description: "Foundry project endpoint override" });
-  storageAccount = Option51.String("--storage-account", {
+  subscription = Option52.String("--subscription", { description: "Azure subscription id override" });
+  endpoint = Option52.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option52.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
   deps = defaultDeps2();
@@ -30003,7 +30665,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/create.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -30241,7 +30903,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -30250,16 +30912,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option52.String("--resource-group");
-  location = Option52.String("--location");
-  account = Option52.String("--account");
-  project = Option52.String("--project", "m8t");
-  model = Option52.String("--model", "gpt-4.1-mini");
-  modelVersion = Option52.String("--model-version", "2025-04-14");
-  capacity = Option52.String("--capacity", "50");
-  subscription = Option52.String("--subscription");
-  skipQuotaCheck = Option52.Boolean("--skip-quota-check", false);
-  output = Option52.String("--output");
+  resourceGroup = Option53.String("--resource-group");
+  location = Option53.String("--location");
+  account = Option53.String("--account");
+  project = Option53.String("--project", "m8t");
+  model = Option53.String("--model", "gpt-4.1-mini");
+  modelVersion = Option53.String("--model-version", "2025-04-14");
+  capacity = Option53.String("--capacity", "50");
+  subscription = Option53.String("--subscription");
+  skipQuotaCheck = Option53.Boolean("--skip-quota-check", false);
+  output = Option53.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -30331,22 +30993,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential3 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option53.String("--endpoint");
-  consecutive = Option53.String("--consecutive", "3");
-  attempts = Option53.String("--attempts", "60");
-  interval = Option53.String("--interval", "5");
-  subscription = Option53.String("--subscription");
-  output = Option53.String("--output");
+  endpoint = Option54.String("--endpoint");
+  consecutive = Option54.String("--consecutive", "3");
+  attempts = Option54.String("--attempts", "60");
+  interval = Option54.String("--interval", "5");
+  subscription = Option54.String("--subscription");
+  output = Option54.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -30380,7 +31042,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -30432,7 +31094,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -30441,9 +31103,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option54.String("--client-id");
-  subscription = Option54.String("--subscription");
-  location = Option54.String("--location", {
+  clientId = Option55.String("--client-id");
+  subscription = Option55.String("--subscription");
+  location = Option55.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -30543,7 +31205,7 @@ ${colors.error("  " + why)}
 import * as fs34 from "fs";
 import * as os15 from "os";
 import * as path37 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -30913,7 +31575,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -30924,26 +31586,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option55.String("--location");
-  resourceGroup = Option55.String("--resource-group");
-  clientId = Option55.String("--client-id");
-  subscription = Option55.String("--subscription");
-  installerTag = Option55.String("--installer-tag");
+  location = Option56.String("--location");
+  resourceGroup = Option56.String("--resource-group");
+  clientId = Option56.String("--client-id");
+  subscription = Option56.String("--subscription");
+  installerTag = Option56.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option55.String("--installer-image");
-  gatewayImageRef = Option55.String("--gateway-image-ref");
-  githubAppCreds = Option55.String("--github-app-creds");
-  contactEmail = Option55.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option55.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option56.String("--installer-image");
+  gatewayImageRef = Option56.String("--gateway-image-ref");
+  githubAppCreds = Option56.String("--github-app-creds");
+  contactEmail = Option56.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option56.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option55.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option55.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option55.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option56.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option56.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option56.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -31104,7 +31766,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -31130,6 +31792,7 @@ async function getAciState(opts) {
 }
 
 // src/lib/bootstrap-finalize.ts
+init_errors();
 import * as fs39 from "fs/promises";
 import * as os20 from "os";
 import * as path44 from "path";
@@ -32046,10 +32709,10 @@ var DEFAULT_WORKERS = [
   { name: "ezra", label: "Ezra - Azure Expert", brain: "ezra-brain" }
 ];
 function renderInstallSummary(args) {
-  const open3 = args.webappUrl ? `${args.webappUrl}        (or run: m8t open)` : "run: m8t open";
+  const open4 = args.webappUrl ? `${args.webappUrl}        (or run: m8t open)` : "run: m8t open";
   const lines = [
     "\u2705 Your m8t platform is ready to use.",
-    `   Open it:  ${open3}`,
+    `   Open it:  ${open4}`,
     ""
   ];
   if (args.brainOrg) {
@@ -32073,10 +32736,10 @@ function renderInstallSummary(args) {
 
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
-import * as fs37 from "fs/promises";
-import * as path41 from "path";
+import * as fs38 from "fs/promises";
+import * as path42 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
-import { execFile, spawn as spawn7 } from "child_process";
+import { execFile as execFile2, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
 import { createHash as createHash7 } from "crypto";
@@ -32354,6 +33017,265 @@ async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   await verifyArtifactPayload(targetRoot, manifest);
 }
 
+// src/lib/companion-download.ts
+import { createHash as createHash8 } from "crypto";
+import { execFile } from "child_process";
+import { createReadStream } from "fs";
+import * as fs37 from "fs/promises";
+import * as os18 from "os";
+import * as path41 from "path";
+init_errors();
+var MAX_ASSET_BYTES = 512 * 1024 * 1024;
+var MAX_ATTEMPTS2 = 3;
+var BACKOFF_MS = [1e3, 3e3];
+function megabytes(bytes) {
+  return `${Math.round(bytes / 1e6).toString()} MB`;
+}
+function extractArchive(archive, into) {
+  return new Promise((resolve6, reject) => {
+    execFile("tar", ["-xzf", archive, "-C", into], { windowsHide: true }, (error) => {
+      if (error) reject(new Error(`Could not unpack the companion build: ${error.message}`));
+      else resolve6();
+    });
+  });
+}
+function companionDownloadDirectory(homeDirectory) {
+  return path41.join(homeDirectory, ".m8t", "companion", "downloads");
+}
+function companionAssetFor(component, platform = process.platform, architecture = process.arch) {
+  const target = companionTargetFor(platform, architecture);
+  if (target === null) return null;
+  const pinned = component.targets[target];
+  return pinned ? { target, asset: pinned.asset, sha256: pinned.sha256 } : null;
+}
+function tooLarge(asset) {
+  return new LocalCliError({
+    code: "COMPANION_ASSET_TOO_LARGE",
+    message: `${asset} is larger than this command will accept.`
+  });
+}
+function parseContentRange(value) {
+  const matched = /^bytes (\d+)-(\d+)\/(\d+|\*)$/u.exec((value ?? "").trim());
+  if (!matched?.[1] || !matched[3]) return null;
+  return {
+    start: Number(matched[1]),
+    total: matched[3] === "*" ? null : Number(matched[3])
+  };
+}
+function declaredLength(response) {
+  const raw = response.headers.get("content-length");
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+async function usableBytes(partial) {
+  const status = await fs37.lstat(partial).catch(() => null);
+  if (status === null) return 0;
+  if (!status.isFile()) {
+    await fs37.rm(partial, { recursive: true, force: true }).catch(() => void 0);
+    if (await fs37.lstat(partial).then(() => true, () => false)) {
+      throw new LocalCliError({
+        code: "COMPANION_DOWNLOAD_PATH_OCCUPIED",
+        message: `${partial} is not a file and could not be cleared.`,
+        hint: "Something that is not a download is sitting where the companion build goes. Remove it, then run this again."
+      });
+    }
+    return 0;
+  }
+  return status.size;
+}
+async function sweepForeignPartials(directory, keep) {
+  const entries = await fs37.readdir(directory).catch(() => []);
+  await Promise.all(
+    entries.filter((name) => name.endsWith(".part") && name !== keep).map((name) => fs37.rm(path41.join(directory, name), { recursive: true, force: true }))
+  );
+}
+function sha256File3(filePath) {
+  return new Promise((resolve6, reject) => {
+    const hash = createHash8("sha256");
+    const stream = createReadStream(filePath);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => {
+      resolve6(hash.digest("hex"));
+    });
+  });
+}
+async function transferToDisk(input) {
+  let lastError;
+  for (let attempt = 0; attempt < MAX_ATTEMPTS2; attempt++) {
+    let existing = await usableBytes(input.partial);
+    if (existing > input.maxAssetBytes) {
+      await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+      existing = 0;
+    }
+    let received = existing;
+    let answered = false;
+    try {
+      const controller = new AbortController();
+      const response = await input.fetchImpl(input.url, {
+        signal: controller.signal,
+        ...existing > 0 ? { headers: { Range: `bytes=${existing.toString()}-` } } : {}
+      });
+      answered = true;
+      if (response.status === 416) {
+        await response.body?.cancel().catch(() => void 0);
+        if (existing > 0 && await sha256File3(input.partial).catch(() => null) === input.expectedDigest) {
+          return;
+        }
+        await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+        lastError = new Error("the interrupted download no longer fits the published asset");
+        continue;
+      }
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => void 0);
+        const failed = new LocalCliError({
+          code: "COMPANION_ASSET_FETCH_FAILED",
+          message: `GET ${input.url} returned HTTP ${response.status.toString()}.`,
+          hint: "The release the platform is pinned to should carry this file. Try again, or run 'm8t companion repair' once the network is back."
+        });
+        if (response.status < 500) throw failed;
+        lastError = failed;
+        if (attempt + 1 < MAX_ATTEMPTS2) {
+          input.onEvent({ kind: "retrying", received: existing, attempt: attempt + 1, cause: "server-error" });
+          await input.delay(BACKOFF_MS[Math.min(attempt, BACKOFF_MS.length - 1)]);
+        }
+        continue;
+      }
+      let offset;
+      let total;
+      if (response.status === 206) {
+        const range = parseContentRange(response.headers.get("content-range"));
+        if (range?.start !== existing) {
+          await response.body?.cancel().catch(() => void 0);
+          await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+          lastError = new Error("the server answered a different range than the one requested");
+          continue;
+        }
+        offset = existing;
+        total = range.total;
+      } else {
+        offset = 0;
+        total = declaredLength(response);
+      }
+      const declaredBody = declaredLength(response);
+      if (total !== null && total > input.maxAssetBytes || declaredBody !== null && declaredBody > input.maxAssetBytes) {
+        await response.body?.cancel().catch(() => void 0);
+        await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+        throw tooLarge(input.asset);
+      }
+      if (offset > 0) input.onEvent({ kind: "resumed", received: offset, total });
+      received = offset;
+      const body = response.body;
+      if (body === null) throw new Error("the response carried no body");
+      const handle = await fs37.open(input.partial, offset > 0 ? "a" : "w", 384);
+      try {
+        for await (const chunk of body) {
+          received += chunk.byteLength;
+          if (received > input.maxAssetBytes) {
+            controller.abort();
+            throw tooLarge(input.asset);
+          }
+          await handle.write(chunk);
+          input.onEvent({ kind: "progress", received, total });
+        }
+      } finally {
+        await handle.close();
+      }
+      if (total !== null && received < total) {
+        throw new Error(
+          `the transfer stopped at ${received.toString()} of ${total.toString()} bytes`
+        );
+      }
+      return;
+    } catch (error) {
+      if (error instanceof LocalCliError) {
+        if (error.code === "COMPANION_ASSET_TOO_LARGE") {
+          await fs37.rm(input.partial, { force: true }).catch(() => void 0);
+        }
+        throw error;
+      }
+      lastError = error;
+      if (attempt + 1 < MAX_ATTEMPTS2) {
+        input.onEvent({
+          kind: "retrying",
+          received,
+          attempt: attempt + 1,
+          cause: answered ? "dropped" : "not-connected"
+        });
+        await input.delay(BACKOFF_MS[Math.min(attempt, BACKOFF_MS.length - 1)]);
+      }
+    }
+  }
+  const kept = await fs37.lstat(input.partial).then(
+    (status) => status.isFile() ? status.size : 0,
+    () => 0
+  );
+  const keptLabel = megabytes(kept);
+  throw new LocalCliError({
+    code: "COMPANION_DOWNLOAD_INCOMPLETE",
+    message: "The companion build could not be downloaded.",
+    ...keptLabel === "0 MB" ? {} : { hint: `The ${keptLabel} already downloaded is kept. Run it again to carry on from there.` },
+    cause: lastError
+  });
+}
+async function downloadCompanionArtifact(component, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const architecture = deps.architecture ?? process.arch;
+  const pinned = companionAssetFor(component, platform, architecture);
+  if (pinned === null) {
+    throw new LocalCliError({
+      code: "COMPANION_NO_BUILD_FOR_HOST",
+      message: `Release ${component.version} carries no desktop companion for ${platform}-${architecture}.`,
+      hint: "The companions are built for macOS and Windows on arm64 and x64."
+    });
+  }
+  const url = releaseAssetUrl(component.tag, pinned.asset);
+  const directory = deps.downloadDirectory ?? companionDownloadDirectory(os18.homedir());
+  const partialName = `${pinned.sha256}.part`;
+  const partial = path41.join(directory, partialName);
+  await fs37.mkdir(directory, { recursive: true, mode: 448 });
+  await sweepForeignPartials(directory, partialName);
+  await transferToDisk({
+    url,
+    asset: pinned.asset,
+    partial,
+    fetchImpl: deps.fetchImpl ?? fetch,
+    onEvent: deps.onEvent ?? (() => void 0),
+    delay: deps.delay ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms))),
+    maxAssetBytes: deps.maxAssetBytes ?? MAX_ASSET_BYTES,
+    expectedDigest: pinned.sha256
+  });
+  const digest = await sha256File3(partial);
+  if (digest !== pinned.sha256) {
+    await fs37.rm(partial, { force: true }).catch(() => void 0);
+    throw new LocalCliError({
+      code: "COMPANION_ASSET_DIGEST_MISMATCH",
+      message: `${pinned.asset} does not match the digest the release pins for it.`,
+      hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
+    });
+  }
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs37.mkdtemp(path41.join(os18.tmpdir(), "m8t-companion-"))))();
+  const dispose = async () => {
+    await fs37.rm(root, { recursive: true, force: true }).catch(() => void 0);
+  };
+  try {
+    const unpacked = path41.join(root, "unpacked");
+    await fs37.mkdir(unpacked, { recursive: false, mode: 448 });
+    await (deps.extract ?? extractArchive)(partial, unpacked);
+    return {
+      version: component.version,
+      artifactManifestPath: path41.join(unpacked, "artifact-v1.json"),
+      dispose
+    };
+  } catch (error) {
+    await dispose();
+    throw error;
+  } finally {
+    await fs37.rm(partial, { force: true }).catch(() => void 0);
+  }
+}
+
 // src/lib/companion-install.ts
 function xmlEscape(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
@@ -32366,7 +33288,7 @@ function commandError(error, message) {
 }
 function execFileAsync(file2, args) {
   return new Promise((resolve6, reject) => {
-    execFile(file2, [...args], { windowsHide: true }, (error) => {
+    execFile2(file2, [...args], { windowsHide: true }, (error) => {
       if (error) reject(commandError(error, "Login-item command failed"));
       else resolve6();
     });
@@ -32374,7 +33296,7 @@ function execFileAsync(file2, args) {
 }
 function execFileOutput(file2, args) {
   return new Promise((resolve6, reject) => {
-    execFile(
+    execFile2(
       file2,
       [...args],
       { windowsHide: true },
@@ -32387,17 +33309,17 @@ function execFileOutput(file2, args) {
 }
 async function setCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const launchAgents = path41.join(input.homeDirectory, "Library", "LaunchAgents");
-    const registration = path41.join(
+    const launchAgents = path42.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path42.join(
       launchAgents,
       "com.m8t.companion.plist"
     );
     await assertNotSymlink(registration, "Start-at-login registration");
     if (!input.enabled) {
-      await fs37.rm(registration, { force: true });
+      await fs38.rm(registration, { force: true });
       return;
     }
-    await fs37.mkdir(launchAgents, { recursive: true, mode: 448 });
+    await fs38.mkdir(launchAgents, { recursive: true, mode: 448 });
     const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
     await atomicWriteText(registration, plist, 384);
     return;
@@ -32449,7 +33371,7 @@ async function setCompanionStartAtLogin(input) {
 }
 async function getCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const registration = path41.join(
+    const registration = path42.join(
       input.homeDirectory,
       "Library",
       "LaunchAgents",
@@ -32511,26 +33433,29 @@ function assertSupported(options) {
 }
 function companionInstallPaths(options) {
   assertSupported(options);
-  const companionState = path41.join(
+  const companionState = path42.join(
     options.homeDirectory,
     ".m8t",
     "companion"
   );
-  const targetRoot = options.platform === "darwin" ? path41.join(
+  const targetRoot = options.platform === "darwin" ? path42.join(
     options.homeDirectory,
     "Applications",
     "m8t Companion.app"
-  ) : path41.join(
-    options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local"),
+  ) : path42.join(
+    options.localAppData ?? path42.join(options.homeDirectory, "AppData", "Local"),
     "m8t",
     "companion",
     "app"
   );
   return {
     targetRoot,
-    installManifest: path41.join(companionState, "install-v1.json"),
-    runtimeBinding: path41.join(companionState, "runtime-v1.json"),
-    preferences: path41.join(companionState, "preferences-v1.json")
+    installManifest: path42.join(companionState, "install-v1.json"),
+    runtimeBinding: path42.join(companionState, "runtime-v1.json"),
+    preferences: path42.join(companionState, "preferences-v1.json"),
+    // Asked of the downloader rather than rebuilt here. Two modules computing
+    // one path is how an uninstall comes to sweep a directory nothing writes.
+    downloads: companionDownloadDirectory(options.homeDirectory)
   };
 }
 function exactKeys2(value, keys) {
@@ -32541,7 +33466,7 @@ function parseInstallManifest(value) {
     throw new Error("Install manifest schema is invalid");
   }
   const record = value;
-  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path41.isAbsolute(record.ownedTargetRoot)) {
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path42.isAbsolute(record.ownedTargetRoot)) {
     throw new Error("Install manifest schema is invalid");
   }
   return record;
@@ -32551,7 +33476,7 @@ function parseRuntimeBinding(value, platform) {
     throw new Error("Runtime binding schema is invalid");
   }
   const record = value;
-  const paths = platform === "win32" ? path41.win32 : path41.posix;
+  const paths = platform === "win32" ? path42.win32 : path42.posix;
   if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
     throw new Error("Runtime binding schema is invalid");
   }
@@ -32576,7 +33501,7 @@ function validateGatewayOrigin(value) {
 }
 async function assertNotSymlink(filePath, kind) {
   try {
-    if ((await fs37.lstat(filePath)).isSymbolicLink()) {
+    if ((await fs38.lstat(filePath)).isSymbolicLink()) {
       throw new Error(`${kind} is a symbolic link`);
     }
   } catch (error) {
@@ -32585,20 +33510,20 @@ async function assertNotSymlink(filePath, kind) {
   }
 }
 async function assertOwnedDirectoryChain(anchor, targetDirectory) {
-  const relative4 = path41.relative(anchor, targetDirectory);
-  if (relative4 === ".." || relative4.startsWith(`..${path41.sep}`) || path41.isAbsolute(relative4)) {
+  const relative4 = path42.relative(anchor, targetDirectory);
+  if (relative4 === ".." || relative4.startsWith(`..${path42.sep}`) || path42.isAbsolute(relative4)) {
     throw new Error("Companion owned directory escapes its trusted anchor");
   }
-  const segments = relative4.split(path41.sep).filter(Boolean);
+  const segments = relative4.split(path42.sep).filter(Boolean);
   let current = anchor;
-  const anchorStatus = await fs37.lstat(anchor);
+  const anchorStatus = await fs38.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
-    current = path41.join(current, segment);
+    current = path42.join(current, segment);
     try {
-      const status = await fs37.lstat(current);
+      const status = await fs38.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
         throw new Error("Companion owned directory contains a symbolic link");
       }
@@ -32611,19 +33536,19 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
 async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(
     options.homeDirectory,
-    path41.dirname(paths.installManifest)
+    path42.dirname(paths.installManifest)
   );
-  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
-  await assertOwnedDirectoryChain(targetAnchor, path41.dirname(paths.targetRoot));
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path42.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path42.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
-  const before = await fs37.lstat(filePath);
+  const before = await fs38.lstat(filePath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Companion state file is not a regular file");
   }
   let handle;
   try {
-    handle = await fs37.open(
+    handle = await fs38.open(
       filePath,
       constants2.O_RDONLY | constants2.O_NOFOLLOW
     );
@@ -32646,27 +33571,27 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs37.mkdir(path41.dirname(filePath), {
+  await fs38.mkdir(path42.dirname(filePath), {
     recursive: true,
     mode: 448
   });
   const temporary = `${filePath}.${randomUUID3()}.tmp`;
   try {
-    await fs37.writeFile(temporary, contents, {
+    await fs38.writeFile(temporary, contents, {
       mode,
       flag: "wx"
     });
-    await fs37.rename(temporary, filePath);
-    await fs37.chmod(filePath, mode).catch(() => void 0);
+    await fs38.rename(temporary, filePath);
+    await fs38.chmod(filePath, mode).catch(() => void 0);
   } finally {
-    await fs37.rm(temporary, { force: true }).catch(() => void 0);
+    await fs38.rm(temporary, { force: true }).catch(() => void 0);
   }
 }
 async function realRegularFile(filePath, executable) {
-  const real = await fs37.realpath(filePath);
-  const stat5 = await fs37.stat(real);
+  const real = await fs38.realpath(filePath);
+  const stat5 = await fs38.stat(real);
   if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
-  await fs37.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  await fs38.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
 function defaultLaunch(executable) {
@@ -32682,7 +33607,7 @@ async function companionIsRunning(platform, executable) {
   if (platform !== "win32") return false;
   let handle;
   try {
-    handle = await fs37.open(executable, "r+");
+    handle = await fs38.open(executable, "r+");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return false;
@@ -32727,17 +33652,17 @@ async function statusCompanion(options) {
       reason: error instanceof Error ? error.message : "Unsafe owned directory"
     };
   }
-  let installed;
+  let installed2;
   try {
-    installed = await readInstalled(options);
+    installed2 = await readInstalled(options);
   } catch (error) {
     return {
       state: "needs-repair",
       reason: error instanceof Error ? error.message : "Invalid install manifest"
     };
   }
-  if (!installed) return { state: "not-installed" };
-  const { paths, install } = installed;
+  if (!installed2) return { state: "not-installed" };
+  const { paths, install } = installed2;
   if (install.platform !== options.platform || install.architecture !== options.architecture || install.ownedTargetRoot !== paths.targetRoot) {
     return {
       state: "needs-repair",
@@ -32763,7 +33688,7 @@ async function statusCompanion(options) {
       realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
       realRegularFile(runtime.cliEntry, false)
     ]);
-    const executable = path41.join(
+    const executable = path42.join(
       paths.targetRoot,
       ...install.entryRelativePath.split("/")
     );
@@ -32796,7 +33721,7 @@ async function snapshotFile(filePath) {
 }
 async function restoreFile(filePath, bytes) {
   if (bytes === null) {
-    await fs37.rm(filePath, { force: true });
+    await fs38.rm(filePath, { force: true });
   } else {
     await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
   }
@@ -32811,8 +33736,8 @@ async function converge(options, force) {
   if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
     throw new Error("Companion artifact does not match this OS and architecture");
   }
-  const payloadRoot = path41.join(
-    path41.dirname(options.artifactManifestPath),
+  const payloadRoot = path42.join(
+    path42.dirname(options.artifactManifestPath),
     "payload"
   );
   await verifyArtifactSource(payloadRoot, artifactManifest);
@@ -32832,7 +33757,7 @@ async function converge(options, force) {
   if (priorInstalled) {
     await assertCompanionNotRunning(
       options,
-      path41.join(
+      path42.join(
         priorInstalled.paths.targetRoot,
         ...priorInstalled.install.entryRelativePath.split("/")
       )
@@ -32840,7 +33765,7 @@ async function converge(options, force) {
   }
   if (current.state === "not-installed") {
     try {
-      await fs37.lstat(paths.targetRoot);
+      await fs38.lstat(paths.targetRoot);
       throw new Error(
         "The fixed companion target exists without an owned install manifest"
       );
@@ -32851,7 +33776,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs37.mkdir(path41.dirname(paths.targetRoot), {
+  await fs38.mkdir(path42.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -32868,12 +33793,12 @@ async function converge(options, force) {
   try {
     await copy(payloadRoot, stage, artifactManifest);
     try {
-      await fs37.rename(paths.targetRoot, backup);
+      await fs38.rename(paths.targetRoot, backup);
       movedPrior = true;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    await fs37.rename(stage, paths.targetRoot);
+    await fs38.rename(stage, paths.targetRoot);
     installedStage = true;
     const nodeExecutable = await realRegularFile(
       options.nodeExecutable,
@@ -32915,7 +33840,7 @@ async function converge(options, force) {
       await readClosedJson(paths.runtimeBinding),
       options.platform
     );
-    const executable = path41.join(
+    const executable = path42.join(
       paths.targetRoot,
       ...artifactManifest.entryRelativePath.split("/")
     );
@@ -32925,7 +33850,7 @@ async function converge(options, force) {
       platform: options.platform,
       executable: ownedExecutable
     }));
-    priorLoginExecutable = priorInstalled ? path41.join(
+    priorLoginExecutable = priorInstalled ? path42.join(
       priorInstalled.paths.targetRoot,
       ...priorInstalled.install.entryRelativePath.split("/")
     ) : executable;
@@ -32936,7 +33861,7 @@ async function converge(options, force) {
     );
     loginChanged = true;
     await (options.launch ?? defaultLaunch)(executable);
-    await fs37.rm(backup, { recursive: true, force: true });
+    await fs38.rm(backup, { recursive: true, force: true });
     return {
       state: "installed",
       version: artifactManifest.version,
@@ -32950,15 +33875,15 @@ async function converge(options, force) {
         () => void 0
       );
     }
-    await fs37.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    await fs38.rm(stage, { recursive: true, force: true }).catch(() => void 0);
     if (installedStage) {
-      await fs37.rm(paths.targetRoot, {
+      await fs38.rm(paths.targetRoot, {
         recursive: true,
         force: true
       }).catch(() => void 0);
     }
     if (movedPrior) {
-      await fs37.rename(backup, paths.targetRoot).catch(() => void 0);
+      await fs38.rename(backup, paths.targetRoot).catch(() => void 0);
     }
     await Promise.all([
       restoreFile(paths.installManifest, snapshots[0]),
@@ -32978,32 +33903,36 @@ async function uninstallCompanion(options) {
   assertSupported(options);
   const expectedPaths = companionInstallPaths(options);
   await assertOwnedParents(options, expectedPaths);
-  const installed = await readInstalled(options);
-  if (!installed) return { state: "not-installed" };
-  const { paths, install } = installed;
+  const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
+    await fs38.rm(ownedPath, { recursive, force: true });
+  });
+  const installed2 = await readInstalled(options);
+  if (!installed2) {
+    await remove(expectedPaths.downloads, true);
+    return { state: "not-installed" };
+  }
+  const { paths, install } = installed2;
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
-  const executable = path41.join(
+  const executable = path42.join(
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
   await assertCompanionNotRunning(options, executable);
   await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
-  const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
-    await fs37.rm(ownedPath, { recursive, force: true });
-  });
   await remove(paths.targetRoot, true);
   await remove(paths.installManifest, false);
   await remove(paths.runtimeBinding, false);
   await remove(paths.preferences, false);
+  await remove(paths.downloads, true);
   return { state: "not-installed" };
 }
 
 // src/commands/companion/install.ts
 import * as os19 from "os";
 import * as path43 from "path";
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -33017,84 +33946,55 @@ async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps =
   };
 }
 
-// src/lib/companion-download.ts
-import { createHash as createHash8 } from "crypto";
-import { execFile as execFile2 } from "child_process";
-import * as fs38 from "fs/promises";
-import * as os18 from "os";
-import * as path42 from "path";
-init_errors();
-var MAX_ASSET_BYTES = 512 * 1024 * 1024;
-function extractArchive(archive, into) {
-  return new Promise((resolve6, reject) => {
-    execFile2("tar", ["-xzf", archive, "-C", into], { windowsHide: true }, (error) => {
-      if (error) reject(new Error(`Could not unpack the companion build: ${error.message}`));
-      else resolve6();
-    });
-  });
-}
-function companionAssetFor(component, platform = process.platform, architecture = process.arch) {
-  const target = companionTargetFor(platform, architecture);
-  if (target === null) return null;
-  const pinned = component.targets[target];
-  return pinned ? { target, asset: pinned.asset, sha256: pinned.sha256 } : null;
-}
-async function downloadCompanionArtifact(component, deps = {}) {
-  const platform = deps.platform ?? process.platform;
-  const architecture = deps.architecture ?? process.arch;
-  const pinned = companionAssetFor(component, platform, architecture);
-  if (pinned === null) {
-    throw new LocalCliError({
-      code: "COMPANION_NO_BUILD_FOR_HOST",
-      message: `Release ${component.version} carries no desktop companion for ${platform}-${architecture}.`,
-      hint: "The companions are built for macOS and Windows on arm64 and x64."
-    });
-  }
-  const url = releaseAssetUrl(component.tag, pinned.asset);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const response = await fetchImpl(url);
-  if (!response.ok) {
-    throw new LocalCliError({
-      code: "COMPANION_ASSET_FETCH_FAILED",
-      message: `GET ${url} returned HTTP ${response.status.toString()}.`,
-      hint: "The release the platform is pinned to should carry this file. Try again, or run 'm8t companion repair' once the network is back."
-    });
-  }
-  const bytes = Buffer.from(await response.arrayBuffer());
-  if (bytes.byteLength > MAX_ASSET_BYTES) {
-    throw new LocalCliError({
-      code: "COMPANION_ASSET_TOO_LARGE",
-      message: `${pinned.asset} is larger than this command will accept.`
-    });
-  }
-  const digest = createHash8("sha256").update(bytes).digest("hex");
-  if (digest !== pinned.sha256) {
-    throw new LocalCliError({
-      code: "COMPANION_ASSET_DIGEST_MISMATCH",
-      message: `${pinned.asset} does not match the digest the release pins for it.`,
-      hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
-    });
-  }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs38.mkdtemp(path42.join(os18.tmpdir(), "m8t-companion-"))))();
-  const dispose = async () => {
-    await fs38.rm(root, { recursive: true, force: true }).catch(() => void 0);
+// src/lib/companion-download-progress.ts
+var STEP_FRACTION = 0.25;
+var INTERVAL_MS = 3e4;
+function downloadProgressLines(options) {
+  const now = options.now ?? Date.now;
+  let lastStep = 0;
+  let lastReceived = 0;
+  let lastEmitAt = null;
+  const emit = (line2) => {
+    lastEmitAt = now();
+    options.write(line2);
+  };
+  return (event) => {
+    if (event.kind === "retrying") {
+      emit(
+        event.cause === "not-connected" ? "  Couldn't connect \u2014 retrying.\n" : event.cause === "server-error" ? "  The download service answered with an error \u2014 retrying.\n" : `  The connection dropped at ${megabytes(event.received)} \u2014 retrying.
+`
+      );
+      return;
+    }
+    if (event.kind === "resumed") {
+      if (event.total !== null && event.total > 0) {
+        lastStep = Math.floor(event.received / event.total / STEP_FRACTION);
+      }
+      lastReceived = event.received;
+      emit(`  Resuming an interrupted download from ${megabytes(event.received)}.
+`);
+      return;
+    }
+    lastEmitAt ??= now();
+    if (event.received < lastReceived) lastStep = 0;
+    lastReceived = event.received;
+    const total = event.total !== null && event.total > 0 ? event.total : null;
+    if (total === null) {
+      if (now() - lastEmitAt < INTERVAL_MS) return;
+      emit(`  ${megabytes(event.received)} downloaded.
+`);
+      return;
+    }
+    const fraction = event.received / total;
+    if (fraction >= 1) return;
+    const step = Math.floor(fraction / STEP_FRACTION);
+    if (step <= lastStep && now() - lastEmitAt < INTERVAL_MS) return;
+    lastStep = step;
+    emit(
+      `  ${Math.floor(fraction * 100).toString()}% \xB7 ${megabytes(event.received)} of ${megabytes(total)}
+`
+    );
   };
-  try {
-    const archive = path42.join(root, pinned.asset);
-    await fs38.writeFile(archive, bytes, { mode: 384 });
-    const unpacked = path42.join(root, "unpacked");
-    await fs38.mkdir(unpacked, { recursive: false, mode: 448 });
-    await (deps.extract ?? extractArchive)(archive, unpacked);
-    await fs38.rm(archive, { force: true });
-    return {
-      version: component.version,
-      artifactManifestPath: path42.join(unpacked, "artifact-v1.json"),
-      dispose
-    };
-  } catch (error) {
-    await dispose();
-    throw error;
-  }
 }
 
 // src/commands/companion/install.ts
@@ -33115,7 +34015,7 @@ function defaultLocalCompanionInstallOptions() {
   };
 }
 async function convergeCompanionFromChannel(converge2, options = {}) {
-  const { from: stagedDirectory, resourceGroup, platformVersion } = options;
+  const { from: stagedDirectory, resourceGroup, platformVersion, onDownloadEvent } = options;
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
@@ -33125,7 +34025,9 @@ async function convergeCompanionFromChannel(converge2, options = {}) {
       platformVersion !== void 0 ? { channel: true, version: platformTag(platformVersion) } : { url: CHANNEL_LATEST_URL }
     );
     if (release === null) return { state: "not-released" };
-    const build = await downloadCompanionArtifact(release.component);
+    const build = await downloadCompanionArtifact(release.component, {
+      ...onDownloadEvent !== void 0 ? { onEvent: onDownloadEvent } : {}
+    });
     artifactManifestPath = build.artifactManifestPath;
     dispose = build.dispose;
   }
@@ -33161,7 +34063,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -33171,18 +34073,20 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option56.String("--from", {
+  from = Option57.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option56.String("--resource-group", {
+  resourceGroup = Option57.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
+    const stdout = this.context.stdout;
     return runCompanionInstallCommand(
-      this.context.stdout,
+      stdout,
       () => convergeCompanionFromChannel(installCompanion, {
         ...this.from !== void 0 ? { from: this.from } : {},
-        ...this.resourceGroup !== void 0 ? { resourceGroup: this.resourceGroup } : {}
+        ...this.resourceGroup !== void 0 ? { resourceGroup: this.resourceGroup } : {},
+        onDownloadEvent: downloadProgressLines({ write: (line2) => stdout.write(line2) })
       })
     );
   }
@@ -33202,7 +34106,7 @@ async function looksLikeCheckout(dir2) {
     return false;
   }
 }
-var defaultDeps3 = {
+var defaultFinalizeDeps = Object.freeze({
   discoverGateway,
   writeConfig,
   ensureGatewayRedirectUri,
@@ -33210,12 +34114,13 @@ var defaultDeps3 = {
   reactiveSeed: reactiveSeedOnInstallComplete,
   companionsSupportHost,
   companionStatus: () => statusCompanion(defaultLocalCompanionInstallOptions()),
-  convergeCompanion: (platformVersion) => convergeCompanionFromChannel(installCompanion, {
-    ...platformVersion !== void 0 ? { platformVersion } : {}
+  convergeCompanion: (platformVersion, onDownloadEvent) => convergeCompanionFromChannel(installCompanion, {
+    ...platformVersion !== void 0 ? { platformVersion } : {},
+    ...onDownloadEvent !== void 0 ? { onDownloadEvent } : {}
   }),
   homedir: () => os20.homedir()
-};
-async function finalizeInstall(args, deps = defaultDeps3) {
+});
+async function finalizeInstall(args, deps = defaultFinalizeDeps) {
   const markerDir = path44.join(deps.homedir(), ".m8t");
   const markerPath = path44.join(markerDir, "repo-root");
   const cwd = process.cwd();
@@ -33353,7 +34258,10 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 `
     );
     try {
-      const companion = await deps.convergeCompanion(pinned);
+      const companion = await deps.convergeCompanion(
+        pinned,
+        downloadProgressLines({ write: args.stdout })
+      );
       if (companion.state === "installed") {
         args.stdout("Desktop companions installed - they are at the edge of your screen.\n\n");
       } else if (companion.state === "not-released") {
@@ -33369,7 +34277,7 @@ They arrive with a platform release \u2014 run: m8t platform update
         );
       }
     } catch (e) {
-      const reason = e instanceof Error ? e.message : String(e);
+      const reason = e instanceof LocalCliError && e.code === "COMPANION_DOWNLOAD_INCOMPLETE" && e.hint !== void 0 ? e.hint : e instanceof Error ? e.message : String(e);
       args.stdout(
         `Platform installation succeeded, but the desktop companions need repair.
 Run: m8t companion repair
@@ -33390,7 +34298,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -33399,12 +34307,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option57.Boolean("--watch", false);
-  output = Option57.String("--output");
-  repoRoot = Option57.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option57.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option57.String("--subscription");
-  resourceGroup = Option57.String("--resource-group");
+  watch = Option58.Boolean("--watch", false);
+  output = Option58.String("--output");
+  repoRoot = Option58.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option58.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option58.String("--subscription");
+  resourceGroup = Option58.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -33537,7 +34445,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command62, Option as Option59 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -33631,7 +34539,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command61.Usage({
+  static usage = Command62.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -33641,9 +34549,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option58.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option58.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option58.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option59.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option59.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option59.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -33737,7 +34645,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import { Command as Command62, Option as Option59 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 
 // src/lib/bootstrap-ui.ts
 import * as fs40 from "fs";
@@ -33812,7 +34720,7 @@ function renderDeprecationNotice() {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command62.Usage({
+  static usage = Command63.Usage({
     description: "DEPRECATED \u2014 does nothing. Use `m8t bootstrap profile` instead.",
     details: [
       "The local onboarding chat has been retired. Your details are collected by",
@@ -33832,14 +34740,14 @@ var BootstrapUiCommand = class extends M8tCommand {
   // Accepted and ignored, deliberately: removing them would turn an old script's
   // harmless no-op into an "unknown option" failure mid-install. CLI-rewrite: drop
   // the whole surface when the rewrite lands.
-  repoRoot = Option59.String("--repo-root", { description: "Ignored (deprecated)." });
-  port = Option59.String("--port", "3000", { description: "Ignored (deprecated)." });
-  endpoint = Option59.String("--endpoint", { description: "Ignored (deprecated)." });
-  prepOnly = Option59.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
-  skipInstall = Option59.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
-  foreground = Option59.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
-  voice = Option59.Boolean("--voice", false, { description: "Ignored (deprecated)." });
-  stop = Option59.Boolean("--stop", false, {
+  repoRoot = Option60.String("--repo-root", { description: "Ignored (deprecated)." });
+  port = Option60.String("--port", "3000", { description: "Ignored (deprecated)." });
+  endpoint = Option60.String("--endpoint", { description: "Ignored (deprecated)." });
+  prepOnly = Option60.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
+  skipInstall = Option60.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
+  foreground = Option60.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
+  voice = Option60.Boolean("--voice", false, { description: "Ignored (deprecated)." });
+  stop = Option60.Boolean("--stop", false, {
     description: "Shut down a local chat UI left running by an earlier version of this command."
   });
   // Not `async`: there is nothing left to await. Everything this command used to
@@ -33861,7 +34769,7 @@ var BootstrapUiCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/profile.ts
 import * as readline3 from "readline/promises";
-import { Command as Command63, Option as Option60 } from "clipanion";
+import { Command as Command64, Option as Option61 } from "clipanion";
 
 // src/lib/profile-collect.ts
 init_errors();
@@ -34018,9 +34926,9 @@ async function openChatInvite(deps = {}) {
   if (!invite.ok) return CHAT_UNAVAILABLE_LINE;
   const print = deps.print === true;
   if (!print) {
-    const open3 = deps.open ?? tryOpenUrl;
+    const open4 = deps.open ?? tryOpenUrl;
     try {
-      await open3(invite.url);
+      await open4(invite.url);
     } catch {
     }
   }
@@ -34030,7 +34938,7 @@ async function openChatInvite(deps = {}) {
 // src/commands/bootstrap/profile.ts
 var BootstrapProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "profile"]];
-  static usage = Command63.Usage({
+  static usage = Command64.Usage({
     description: "Confirm your email + your Microsoft startup advisor, and open Ezra to talk to while the install runs.",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Records the two",
@@ -34050,12 +34958,12 @@ var BootstrapProfileCommand = class extends M8tCommand {
       ["Skip the browser hand-off", "$0 bootstrap profile --founder-email you@example.com --print"]
     ]
   });
-  founderEmail = Option60.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
-  advisorName = Option60.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
-  advisorEmail = Option60.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
-  noAdvisor = Option60.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
-  noChat = Option60.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
-  print = Option60.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
+  founderEmail = Option61.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
+  advisorName = Option61.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
+  advisorEmail = Option61.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
+  noAdvisor = Option61.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
+  noChat = Option61.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
+  print = Option61.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
   async executeCommand() {
     const stdin = this.context.stdin;
     const stdout = this.context.stdout;
@@ -34148,10 +35056,10 @@ var BootstrapProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command64.Usage({
+  static usage = Command65.Usage({
     description: "Seed your advisors' brains with how to reach you, from what you confirmed at `m8t bootstrap profile`.",
     details: [
       "Renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines)",
@@ -34168,11 +35076,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Seed now (idempotent)", "$0 bootstrap seed-profile"]
     ]
   });
-  endpoint = Option61.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option61.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option61.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option61.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option61.String("--github-app-creds");
+  endpoint = Option62.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option62.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option62.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option62.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option62.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -34260,7 +35168,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs41 from "fs";
 import * as os22 from "os";
 import * as path46 from "path";
-import { Command as Command65, Option as Option62 } from "clipanion";
+import { Command as Command66, Option as Option63 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -34342,7 +35250,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command65.Usage({
+  static usage = Command66.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -34350,11 +35258,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option62.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option62.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option62.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option62.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option62.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option63.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option63.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option63.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option63.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option63.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -34404,7 +35312,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command66, Option as Option63 } from "clipanion";
+import { Command as Command67, Option as Option64 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -35166,9 +36074,9 @@ async function rosterCompanions(sink, deps = {}) {
       controller.signal
     );
     const now = (deps.now ?? Date.now)();
-    const installed = await (deps.installEpoch ?? readInstallEpoch)();
+    const installed2 = await (deps.installEpoch ?? readInstallEpoch)();
     const activeSince = new Date(
-      installed === null || installed > now ? now : installed
+      installed2 === null || installed2 > now ? now : installed2
     ).toISOString();
     const PRESENTABLE = [
       { personaKey: "startup-advisor", displayName: "Stacey", portraitKey: "stacey" },
@@ -35591,11 +36499,11 @@ async function fetchConversationTurns(request, sink, deps, decode) {
 
 // src/lib/companion-update-check.ts
 async function checkCompanionUpdate(options, deps = {}) {
-  const installed = await statusCompanion(options).then((state) => state.state === "installed" ? state.version : null).catch(() => null);
+  const installed2 = await statusCompanion(options).then((state) => state.state === "installed" ? state.version : null).catch(() => null);
   const release = await (deps.readRelease ?? readCompanionRelease)().catch(() => null);
   return {
     type: "update",
-    installed,
+    installed: installed2,
     available: release?.component.version ?? null,
     severity: release === null ? null : release.severity
   };
@@ -35787,7 +36695,7 @@ async function runCompanionBridgeServe(stdin, stdout, stderr, deps = {}) {
 }
 
 // src/commands/companion/bridge.ts
-var defaultDeps4 = {
+var defaultDeps3 = {
   roster: rosterCompanions,
   send: sendCompanionMessage,
   converse: converseCompanionMessage,
@@ -35825,7 +36733,7 @@ function exitFor(terminal) {
   }
   return 2;
 }
-async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps4) {
+async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps3) {
   let request;
   try {
     request = parseRequestLine(await readSingleRequest(stdin));
@@ -35860,14 +36768,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps4) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command66 {
+var CompanionBridgeCommand = class extends Command67 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option63.Boolean("--serve", false);
+  serve = Option64.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -35885,7 +36793,7 @@ var CompanionBridgeCommand = class extends Command66 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command67 } from "clipanion";
+import { Command as Command68 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -35957,7 +36865,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command67.Usage({
+  static usage = Command68.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -35971,7 +36879,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command68, Option as Option64 } from "clipanion";
+import { Command as Command69, Option as Option65 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -35990,24 +36898,28 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command68.Usage({
+  static usage = Command69.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option64.String("--resource-group", {
+  resourceGroup = Option65.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
+    const stdout = this.context.stdout;
     return runCompanionRepairCommand(
-      this.context.stdout,
+      stdout,
       () => convergeCompanionFromChannel(repairCompanion, {
-        ...this.resourceGroup !== void 0 ? { resourceGroup: this.resourceGroup } : {}
+        ...this.resourceGroup !== void 0 ? { resourceGroup: this.resourceGroup } : {},
+        // Repair is the command a founder reaches for after an interrupted
+        // install, so it is the one most likely to pick up a partial download.
+        onDownloadEvent: downloadProgressLines({ write: (line2) => stdout.write(line2) })
       })
     );
   }
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command69 } from "clipanion";
+import { Command as Command70 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -36019,7 +36931,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command69.Usage({
+  static usage = Command70.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -36032,6 +36944,7 @@ var CompanionUninstallCommand = class extends M8tCommand {
 };
 
 // src/cli.ts
+installFoundryDnsShim();
 var cli = new Cli({
   binaryName: "m8t",
   binaryLabel: "m8t CLI \u2014 manage m8t deployments",
@@ -36081,6 +36994,7 @@ cli.register(PlatformRequestUpdateCommand);
 cli.register(PlatformSeedStampCommand);
 cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);
+cli.register(PlatformEmailCommand);
 cli.register(PlatformEnableAutoUpdateCommand);
 cli.register(DeployCommand);
 cli.register(AgentDeployAdvisorCommand);