@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.3

package/dist/commands/agent-share.js

@@ -6,7 +6,11 @@
  * (W6.2 — the share offer never auto-posts).
  *
  * Gated by MNEMOM_AGENT_SHARE=1 (not experimental-registry; off by default, so default CLI
- * behaviour is unchanged). Everything outside the process is injected:
+ * behaviour is unchanged), EXCEPT when the CLI targets the test cell (MNEMOM_RING=test, or API
+ * and website both resolving to api-az-test.mnemom.ai / test.mnemom.ai): there it is on without
+ * the flag. The test target is detected once, by `isTestCellTarget` (agent-share-test-issuer.ts),
+ * and reaches the command as `deps.targetsTestCell`. Prod and every other ring stay gated.
+ * Everything outside the process is injected:
  *   - `source`   lists candidate lines from the user's signed statements,
  *   - `issuer`   returns the SIGNED AAP-ShareCard/v1 for the chosen lines (the CLI never holds
  *                a signing key),
@@ -15,9 +19,10 @@
  * identifying fields, and re-checks the returned card for the same.
  */
 import { createInterface } from "node:readline/promises";
-import { getWebsiteUrl } from "../lib/config.js";
+import { getShareWebsiteUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 import { aipLineRenderer, aipLineScreen } from "./agent-share-render.js";
+import { isTestSignedKeyId } from "./agent-share-test-issuer.js";
 export const AGENT_SHARE_ENV = "MNEMOM_AGENT_SHARE";
 export function agentShareEnabled(env = process.env) {
     return env[AGENT_SHARE_ENV] === "1";
@@ -117,7 +122,7 @@ function checkIssuedCard(card, chosen) {
     return null;
 }
 export async function agentShareCommand(flags, deps, env = process.env) {
-    if (!agentShareEnabled(env)) {
+    if (!agentShareEnabled(env) && deps.targetsTestCell?.() !== true) {
         deps.err(fmt.error("unknown command 'share' for 'mnemom agent'"));
         return 1;
     }
@@ -218,6 +223,11 @@ export async function agentShareCommand(flags, deps, env = process.env) {
         deps.err(fmt.error(`Refusing to share: ${problem}.`));
         return 1;
     }
+    // A test-signed card (aip test key id) may only leave a test-cell run; never a prod/www one.
+    if (isTestSignedKeyId(card.signing_key_id) && deps.targetsTestCell?.() !== true) {
+        deps.err(fmt.error("Refusing to share: the card is test-signed but this is not the test cell."));
+        return 1;
+    }
     // The renderer is the gate: nothing is linked unless aip renders the card (verified, lint clean).
     let rendered;
     try {
@@ -266,7 +276,7 @@ export const liveAgentShareDeps = {
         }
     },
     isTTY: () => Boolean(process.stdin.isTTY),
-    websiteBase: getWebsiteUrl,
+    websiteBase: getShareWebsiteUrl,
     out: (line) => console.log(line),
     err: (line) => console.error(line),
 };

package/dist/commands/agent.d.ts

@@ -33,6 +33,7 @@ import { type ExperimentalId } from "../lib/experimental.js";
 import { conductReceiptFor, type ReceiptLaunch } from "../lib/conduct-receipt.js";
 import { type GovernanceOptIn } from "./agent-setup.js";
 import { type CcSettingsView, type ContextProfile, type LaunchShape, type SealedContractEnvelope } from "../lib/agent.js";
+import type { LauncherKey } from "../vendor/shared/durable-contract/fixlines.js";
 export interface AgentOptions {
     goal?: string;
     requirement?: string[];
@@ -60,6 +61,14 @@ export interface AgentOptions {
     /** launcher.toml `agent_id`: the pin when no `--agent` is given (selectLaunchAgent). */
     agentId?: string;
     conversationId?: string;
+    /**
+     * Durable launch (EXPERIMENTAL `durable`, BACKBONE C1): set only while the gate is on. Absent,
+     * the launch is exactly today's (C17).
+     */
+    durable?: {
+        launcherKey: LauncherKey;
+        newSession: boolean;
+    };
     cli?: string;
     remoteControl?: boolean;
     server?: boolean;
@@ -298,6 +307,8 @@ export declare function promptForCliPath(cliOpt: string | undefined, env: NodeJS
  * Does the resolved coding-agent CLI advertise the `--remote-control` startup
  * flag (Claude Code >= 2.1.269)? Determined by scanning its `--help`. Best-effort:
  * a spawn failure or timeout reads as "no". Only the claude adapter wires RC.
+ * One launch asks this more than once (the shape choice, then the lock's RC naming), so the answer
+ * for an unchanged binary is remembered and `--help` runs once per process (BACKBONE l.150).
  */
 export declare function cliSupportsRemoteControl(bin: string): boolean;
 /** The result of checking whether Remote Control can run here. */
@@ -334,6 +345,7 @@ export declare function proxyWanted(o: {
     turnHeader: boolean;
     receipt: boolean;
     commitReport: boolean;
+    fedStatusline?: boolean;
 }): boolean;
 /**
  * Whether the proxy captures the gateway's record state: the conduct receipt reads it at exit,
@@ -360,8 +372,6 @@ export declare function prepareStatuslineFeed(o: {
     statusline: boolean;
     orgId?: string;
     version: string;
-    goalMode: boolean;
-    env: NodeJS.ProcessEnv;
     childEnv: NodeJS.ProcessEnv;
     files?: () => {
         feedFile: string;
@@ -380,10 +390,11 @@ export declare function recordOrgWanted(o: {
 }): boolean;
 /**
  * Whether this launch feeds the status line measured model cost and μ (W1.4): prerelease
- * builds only (stable stays "mnemom", decision 14), and only when the turn proxy runs, since
- * the proxy is what learns the gateway's lineage key for the session.
+ * builds only (stable stays "mnemom", decision 14). Not tied to goal mode: the base-URL proxy
+ * runs for a fed launch (proxyWanted) and records the lineage key whatever the goal mode, and
+ * since A-W-016 a -next.N launch has no goal by default.
  */
-export declare function fedStatuslineWanted(version: string, goalMode: boolean, env: NodeJS.ProcessEnv): boolean;
+export declare function fedStatuslineWanted(version: string): boolean;
 /**
  * Add 127.0.0.1 and localhost to BOTH NO_PROXY and no_proxy (proxy clients disagree on which one
  * wins, and some read only the lowercase one), keeping whatever each already listed.
@@ -397,6 +408,8 @@ export declare function exemptLoopbackFromProxy(env: NodeJS.ProcessEnv): void;
 export declare function sayConductReceipt(launch: ReceiptLaunch, trigger?: "exit" | "park", receipt?: typeof conductReceiptFor): Promise<void>;
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export declare function turnProxyWanted(env: NodeJS.ProcessEnv): boolean;
+/** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */
+export declare const BU_HTTP_DOOR_ENV = "MNEMOM_AGENT_BU_HTTP_DOOR";
 /** Test seams for startBaseUrlProxy (every real caller omits them). */
 export interface BaseUrlProxyOptions {
     /** The proxy script (default: the bundled base-url-proxy.mjs beside rc-proxy.mjs). */

package/dist/commands/agent.js

@@ -39,8 +39,10 @@ import { ALLOW_AUTOCOMPACT_OFF_ENV, dropAutocompactOffEnv, hasOwnSettingsFlag, m
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
 import { recordOrgFor } from "../lib/record-org.js";
+import { httpDoorAllowed } from "../durable/test-mode.mjs";
 import { defaultSessionKeyDeps, mintSessionGatewayKey, revokeSessionGatewayKey, startSessionKeyRenewal, } from "../lib/session-key.js";
-import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { clearLaunching, liveLaunchingDeps, markLaunching } from "../lib/durable/launching.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
@@ -57,6 +59,9 @@ import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 import { appendPluginDirsEnv, applyPluginEnv, pluginEnabled, pluginPlanLine, resolvePluginDir, } from "../lib/claude-plugin.js";
 import { CLI_VERSION } from "../version.js";
+import { attachToSeat, launchRow, locksAtCreate, planDurableLaunch, preReadRegistry, trackedNoTtyLine, } from "../lib/durable/launch.js";
+import { liveDurableApi, liveHomeFacts, livePlanDeps, liveRegistryReads, liveSeatDeps, lockInsteadOfSpawn, createLockedInsteadOfSpawn, liveParentAfterChildEnded, registerDurableSession, saveTtyMode, } from "../lib/durable/live.js";
+import { mayBeHandover } from "../lib/durable/handover.js";
 import { fetchTierIndex, profileMayMisfit, profileTierWarning, resolveTier, tierLaunchModel, } from "../lib/model-tier.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
 const CODE_STORE = LAUNCHER_STORE_PATH;
@@ -175,8 +180,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     liftPassthroughName(options.passthrough ?? []);
     // ── session name + goal ── (a bare `mnemom agent` in a terminal asks for the name;
     // goal alignment is resolved upstream: --goal seals a contract, implicit alignment
-    // is on by default while the `implicit` experimental feature is on, and on a `next`
-    // build for every launch but `-p` (T16).
+    // is on by default only while the `implicit` experimental feature is on.
     const session = await resolveSessionSetup({
         scenario: scenarioArg,
         goal: options.goal,
@@ -187,8 +191,24 @@ export async function agentCommand(scenarioArg, options = {}) {
         askYesNo: (q, d) => askYesNo(q, d),
     });
     const scenario = session.scenario;
+    // ── durable (gate on only): read the registry FIRST, before any other API call, so a registry
+    // that is down refuses with session_registry_unavailable within REGISTRY_TIMEOUT_MS and nothing
+    // is minted, spawned or written (C01-R18). The plan below decides from these rows; a caller not
+    // signed in yet (401) is read again by the plan after sign-in.
+    // A server-shape launch hosts many Claude Code sessions and pins none: it is never registered
+    // (legacy), so neither the read nor the plan runs for it.
     const env = process.env;
     let shape = resolveLaunchShape({ remoteControl: options.remoteControl, server: options.server }, env);
+    const durableLaunch = Boolean(options.durable && scenario) && shape !== "server";
+    // Until the session registers, a lock by this name answers first_turn_pending, not "no session".
+    if (durableLaunch && scenario && !options.dryRun) {
+        const ld = liveLaunchingDeps(MNEMOM_DIR);
+        markLaunching(scenario, process.pid, ld);
+        process.on("exit", () => clearLaunching(scenario, ld));
+    }
+    const durableRows = durableLaunch && scenario && !options.dryRun
+        ? await preReadRegistry(liveRegistryReads(liveDurableApi()), scenario)
+        : undefined;
     const shapeExplicit = launchPreferenceExplicit({ remoteControl: options.remoteControl, server: options.server }, env);
     // How Claude Code authenticates: an Anthropic key (default) or the user's claude.ai
     // subscription login (Team/Enterprise; lib/subscription-login.ts).
@@ -260,7 +280,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     const cellNote = isProdGateway(env) ? "us-2/prod" : `custom (${gatewayHost})`;
     // ── the bundled Claude Code plugin (lib/claude-plugin) ── resolved up front so the dry-run plan
     // and the launch log print the same line. Only Claude Code proper takes `--plugin-dir`.
-    const pluginWanted = pluginEnabled(options.plugin, env);
+    const pluginWanted = pluginEnabled(options.plugin, env, options.durable !== undefined);
     const bundledPluginDir = pluginWanted ? resolvePluginDir() : null;
     const pluginFor = (cliName) => cliName !== "claude" && pluginWanted
         ? { dir: null, line: `off (${cliName} is not Claude Code)` }
@@ -519,20 +539,82 @@ export async function agentCommand(scenarioArg, options = {}) {
     // so the goal the gateway inferred there is still the one it steers by. Resolved here, after
     // sign-in and the agent refresh, because a resume needs the org, agent and gateway host to
     // match the earlier launch.
-    const continuation = await resolveLaunchContinuation({
-        session: scenario,
-        orgId: account.orgId,
-        agent,
-        gatewayHost,
-        explicit: options.conversationId,
-        implicit: goalAlignmentMode(envelope, goalMode) === "implicit",
-        passthrough: options.passthrough ?? [],
-        interactive: isInteractive(),
-        records: () => readSessionRecords({ dir: MNEMOM_DIR }),
-        askYesNo: (q, d) => askYesNo(q, d),
-        ccSessionExists: (id) => ccSessionTranscriptExists(id, process.env),
-    });
+    // ── durable (gate on only) ── the server registry decides continue / new / attach before the
+    // local ledger does (C01-R01); a registry-backed plan replaces the ledger continuation.
+    let durablePlan = null;
+    // The launcher key of a durable plan: durablePlan is only ever set under options.durable.
+    let durableKey = "off";
+    if (options.durable && scenario && durableLaunch) {
+        durableKey = options.durable.launcherKey;
+        const plan = await planDurableLaunch({
+            name: scenario,
+            newFlag: options.durable.newSession,
+            launcherKey: options.durable.launcherKey,
+            passthrough: options.passthrough ?? [],
+            goalGiven: Boolean(options.goal?.trim()),
+            explicitAgentId: pin ? servedAgentId : null,
+            interactive: isInteractive(),
+            home: await liveHomeFacts(),
+            rows: durableRows,
+            explicitConversationId: options.conversationId ?? null,
+        }, livePlanDeps(servedAgentId, (id) => ccSessionTranscriptExists(id, process.env), (q, d) => askYesNo(q, d)));
+        if (plan.kind === "attach") {
+            process.exitCode = await attachToSeat(plan.row, scenario, [], liveSeatDeps(options.durable.launcherKey));
+            return;
+        }
+        if (plan.kind === "spawn")
+            durablePlan = plan;
+    }
+    const continuation = durablePlan
+        ? {
+            conversationId: durablePlan.conversationId,
+            resumeCcSessionId: durablePlan.resumeCcSessionId,
+        }
+        : await resolveLaunchContinuation({
+            session: scenario,
+            orgId: account.orgId,
+            agent,
+            gatewayHost,
+            explicit: options.conversationId,
+            implicit: goalAlignmentMode(envelope, goalMode) === "implicit",
+            passthrough: options.passthrough ?? [],
+            interactive: isInteractive(),
+            records: () => readSessionRecords({ dir: MNEMOM_DIR }),
+            askYesNo: (q, d) => askYesNo(q, d),
+            ccSessionExists: (id) => ccSessionTranscriptExists(id, process.env),
+        });
     const conversationId = continuation.conversationId;
+    // The registered row of a durable launch: its child's SIGKILL may be a handover (C02-R26 step 7).
+    let durableRow = null;
+    if (durablePlan) {
+        options = {
+            ...options,
+            passthrough: durablePlan.newCcSessionId
+                ? [...durablePlan.passthrough, "--session-id", durablePlan.newCcSessionId]
+                : durablePlan.passthrough,
+        };
+        // Under `always` / ask-yes the launch locks instead of spawning (C02-R23 c, e). A new CC session
+        // is created locked in one request and attached (ruling A, widening B5a to every agent): no
+        // attended claude runs first. A continued one registers and locks its row. A lock refusal prints
+        // the refusal and its fix and exits 1 for every agent (C02-R24 for a durable-only one): a launch
+        // that locks never falls back to an attended spawn, except on an api without migration 06a
+        // (create-and-lock answers null): it registers tracked and spawns as before ruling A.
+        const atCreate = locksAtCreate(durablePlan);
+        const created = atCreate
+            ? await createLockedInsteadOfSpawn(durablePlan, scenario, servedAgentId, durableKey, { model: options.model, effort: options.effort, trimMcp: options.trimMcp }, durablePlan.durableOnly)
+            : null;
+        if (created !== null) {
+            process.exitCode = created;
+            return;
+        }
+        const row = await registerDurableSession(durablePlan, scenario, servedAgentId);
+        clearLaunching(scenario, liveLaunchingDeps(MNEMOM_DIR));
+        durableRow = launchRow(row, durablePlan);
+        if (durablePlan.lock && !atCreate) {
+            process.exitCode = await lockInsteadOfSpawn(row, scenario, durableKey, durablePlan.durableOnly);
+            return;
+        }
+    }
     // A relaunch that continues an earlier conversation resumes that Claude Code session, so the
     // same CC session id keeps owning the conversation's main goal on the gateway (a fresh
     // --session-id would land on a new, empty m.<sha16> thread). The server shape hosts many
@@ -704,6 +786,7 @@ export async function agentCommand(scenarioArg, options = {}) {
                 goalMode,
                 scenario,
                 launcherVersion: CLI_VERSION,
+                ...(options.durable ? { durable: true } : {}),
                 // The mod re-runs this CLI (`agent show --json`, `agent goal show --json`) for the live
                 // goal state; execArgv keeps a `tsx`/`--import` dev launch runnable the same way.
                 launcherExec: process.argv[1]
@@ -765,8 +848,8 @@ export async function agentCommand(scenarioArg, options = {}) {
         // Record keys the lineage under the served agent's org, not the account org (lib/record-org).
         const recordOrgId = recordOrgWanted({
             receipt: experimental.includes("record"),
-            commitReport: cli.name === "claude" && commitReportEnabled(process.env[COMMIT_REPORT_ENV], CLI_VERSION),
-            fedStatusline: cli.name === "claude" && fedStatuslineWanted(CLI_VERSION, Boolean(goalMode), process.env),
+            commitReport: cli.name === "claude" && commitReportEnabled(process.env[COMMIT_REPORT_ENV]),
+            fedStatusline: cli.name === "claude" && fedStatuslineWanted(CLI_VERSION),
         }) && account.orgId
             ? await readServedOrg(account.orgId).then((o) => {
                 if (o.fallback)
@@ -803,13 +886,22 @@ export async function agentCommand(scenarioArg, options = {}) {
             }),
             knownCcSessionId: cc.id ?? continuedCcSessionId,
             plugin,
+            ...(durableRow && options.durable
+                ? {
+                    durableHandover: {
+                        row: durableRow,
+                        name: scenario,
+                        launcherKey: options.durable.launcherKey,
+                    },
+                }
+                : {}),
             receipt: experimental.includes("record")
                 ? { orgId: recordOrgId, agentId: servedAgentId }
                 : undefined,
             orgId: recordOrgId,
             commitReport: cli.name === "claude" &&
                 Boolean(account.orgId) &&
-                commitReportEnabled(process.env[COMMIT_REPORT_ENV], CLI_VERSION),
+                commitReportEnabled(process.env[COMMIT_REPORT_ENV]),
         });
         return; // launchTerminal exits the process
     }
@@ -918,6 +1010,18 @@ export function resumeHintLine(ctx) {
     return (`Resume with: ${resumeCommand(ctx)}` +
         "  (keeps it governed; `claude --resume` runs outside Mnemom)");
 }
+/** Print trackedNoTtyLine's warning, if any, just before an interactive tracked spawn. */
+function warnNoTty(ctx) {
+    const line = trackedNoTtyLine({
+        name: ctx.scenario,
+        gateOn: ctx.options.durable !== undefined,
+        stdinIsTTY: Boolean(process.stdin.isTTY),
+        cliName: ctx.cli.name,
+        passthrough: ctx.options.passthrough ?? [],
+    });
+    if (line !== null)
+        console.error(line);
+}
 /** An interactive Claude Code session — not `-p` / `--print`, which has nothing to resume into. */
 function wantsResumeHint(cli, args) {
     return cli.name === "claude" && !args.includes("-p") && !args.includes("--print");
@@ -1249,20 +1353,39 @@ function commandExists(cmd) {
     });
     return res.status === 0;
 }
+/** Probe answers per binary, keyed by path, size and mtime: a replaced binary is probed again. */
+const rcProbeMemo = new Map();
 /**
  * Does the resolved coding-agent CLI advertise the `--remote-control` startup
  * flag (Claude Code >= 2.1.269)? Determined by scanning its `--help`. Best-effort:
  * a spawn failure or timeout reads as "no". Only the claude adapter wires RC.
+ * One launch asks this more than once (the shape choice, then the lock's RC naming), so the answer
+ * for an unchanged binary is remembered and `--help` runs once per process (BACKBONE l.150).
  */
 export function cliSupportsRemoteControl(bin) {
+    let key = null;
+    try {
+        const st = statSync(bin);
+        key = `${bin}\0${st.size}\0${st.mtimeMs}`;
+    }
+    catch {
+        // unstatable (e.g. a bare command name): probe every time, as before
+    }
+    const known = key === null ? undefined : rcProbeMemo.get(key);
+    if (known !== undefined)
+        return known;
+    let ok;
     try {
         const res = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10_000 });
         const text = `${res.stdout ?? ""}${res.stderr ?? ""}`;
-        return /--remote-control/.test(text);
+        ok = /--remote-control/.test(text);
     }
     catch {
-        return false;
+        ok = false;
     }
+    if (key !== null)
+        rcProbeMemo.set(key, ok);
+    return ok;
 }
 /**
  * Can we launch the DEFAULT Remote-Control-in-terminal shape on this machine?
@@ -1313,30 +1436,14 @@ function launchTerminal(ctx) {
         handoffMcpConfigPath: ctx.handoffMcpConfigPath,
         pluginDir: ctx.plugin?.dir,
     });
-    // Claude Code logged in via claude.ai (OAuth) PREEMPTS ANTHROPIC_API_KEY, so
-    // it is force-unset; the real key rides in ANTHROPIC_CUSTOM_HEADERS and
-    // ANTHROPIC_AUTH_TOKEN is a fixed non-secret placeholder.
-    //
-    // A subscription launch (no Anthropic key) sets NO auth token: Claude Code then sends its
-    // own claude.ai login to the gateway (lib/subscription-login.ts).
-    let childEnv;
+    // The api-key arm (key in ANTHROPIC_CUSTOM_HEADERS, placeholder auth token, ANTHROPIC_API_KEY
+    // unset) or the subscription arm (Claude Code's own claude.ai login), shared with durable seats
+    // (lib/subscription-login.ts launchChildEnv). MNE-8245 defense-in-depth: the owner's own Mnemom
+    // credential must never ride through to the session just because it happened to sit in the
+    // CLI's OWN process env — the session's only Mnemom credential is the minted key already
+    // spliced into `headers` above (ctx.mnemomKey).
+    const childEnv = launchChildEnv(process.env, ctx.door, headers, ctx.anthropicKey);
     let feed = null;
-    if (ctx.anthropicKey) {
-        childEnv = { ...process.env };
-        delete childEnv.ANTHROPIC_API_KEY;
-        childEnv.ANTHROPIC_BASE_URL = ctx.door;
-        childEnv.ANTHROPIC_AUTH_TOKEN = "mnemom-gateway";
-        childEnv.ANTHROPIC_CUSTOM_HEADERS = headers;
-    }
-    else {
-        childEnv = subscriptionChildEnv(process.env, ctx.door, headers);
-    }
-    // MNE-8245 defense-in-depth: the owner's own Mnemom credential must never ride
-    // through to the session just because it happened to sit in the CLI's OWN
-    // process env (a shell MNEMOM_API_KEY / MNEMOM_TOKEN export, or a leftover
-    // MNEMOM_AGENT_MNEMOM_KEY) — the session's only Mnemom credential is the
-    // minted key already spliced into `headers` above (ctx.mnemomKey).
-    stripOwnerCredentialEnv(childEnv);
     // Both auth arms point ANTHROPIC_BASE_URL at the gateway door, which makes Claude Code turn
     // tool search off and inline every tool schema on every request — unless told otherwise.
     applyToolSearchDefault(childEnv);
@@ -1346,10 +1453,9 @@ function launchTerminal(ctx) {
     const sessionName = passthroughName(ctx.options.passthrough ?? []) ?? sessionDisplayName(ctx.agent, ctx.scenario);
     childEnv[SESSION_NAME_ENV] = sessionName;
     // Exact compaction signal for the gateway (x-claude-code-request-class: compaction), on every
-    // terminal launch — interactive and `-p` passthrough alike; a user's own value wins. The
-    // user's CLAUDE_AUTOCOMPACT_PCT_OVERRIDE / CLAUDE_CODE_AUTO_COMPACT_WINDOW ride through
-    // untouched in the copied env (USER_AUTOCOMPACT_ENV).
-    applyGatewayHintHeaders(childEnv);
+    // terminal launch — interactive and `-p` passthrough alike; a user's own value wins: set by
+    // launchChildEnv above (shared with durable seats). The user's CLAUDE_AUTOCOMPACT_PCT_OVERRIDE /
+    // CLAUDE_CODE_AUTO_COMPACT_WINDOW ride through untouched in the copied env (USER_AUTOCOMPACT_ENV).
     if (ctx.options.slack)
         args.push(...slackChannelArgs(sessionName));
     // The status-bar segment (lib/statusline.ts). Claude Code only; the user's own
@@ -1369,8 +1475,6 @@ function launchTerminal(ctx) {
             statusline: sl !== null,
             orgId: ctx.orgId,
             version: CLI_VERSION,
-            goalMode: Boolean(ctx.goalMode),
-            env: process.env,
             childEnv,
         });
         // Autocompact guard (lib/autocompact-guard.ts): one --settings carries every layer. The
@@ -1394,7 +1498,9 @@ function launchTerminal(ctx) {
     }
     let recordStatePath;
     const run = () => {
+        const savedTty = ctx.durableHandover ? saveTtyMode() : null;
         const launchedSec = Math.floor(Date.now() / 1000);
+        warnNoTty(ctx);
         const child = spawn(ctx.cli.bin, args, { stdio: "inherit", env: childEnv });
         // W1.8: report the session's commits while it runs; no record state (no proxy) → no reports.
         const commits = ctx.commitReport && ctx.orgId && recordStatePath
@@ -1416,6 +1522,14 @@ function launchTerminal(ctx) {
                 if (ctx.sessionKeyId) {
                     await revokeSessionGatewayKey(defaultSessionKeyDeps(say), ctx.sessionKeyId);
                 }
+                // A lock handover SIGKILLs the frozen claude once the daemon's seat runs the conversation:
+                // attach to it instead of dying with the child (C02-R26 step 7). Never relaunches claude.
+                const h = ctx.durableHandover;
+                if (mayBeHandover(h !== undefined, signal) && h) {
+                    const attached = await liveParentAfterChildEnded(h.row, h.name, h.launcherKey, savedTty);
+                    if (attached !== null)
+                        process.exit(attached);
+                }
                 if (signal) {
                     process.kill(process.pid, signal);
                     return;
@@ -1447,6 +1561,7 @@ function launchTerminal(ctx) {
         turnHeader,
         receipt: Boolean(ctx.receipt),
         commitReport: Boolean(ctx.commitReport),
+        fedStatusline: feed !== null,
     })) {
         run();
         return;
@@ -1479,7 +1594,7 @@ export function launchSettingsExtra(o) {
  * commit reporting (W1.8) all need it; commit reporting reads the lineage key it records.
  */
 export function proxyWanted(o) {
-    return o.turnHeader || o.receipt || o.commitReport;
+    return o.turnHeader || o.receipt || o.commitReport || Boolean(o.fedStatusline);
 }
 /**
  * Whether the proxy captures the gateway's record state: the conduct receipt reads it at exit,
@@ -1506,7 +1621,7 @@ export function onBaseUrlProxyReady(baseUrl, recordStateFile, childEnv, feed, st
  * segment off, no billing org, or {@link fedStatuslineWanted} false.
  */
 export function prepareStatuslineFeed(o) {
-    if (!o.statusline || !o.orgId || !fedStatuslineWanted(o.version, o.goalMode, o.env))
+    if (!o.statusline || !o.orgId || !fedStatuslineWanted(o.version))
         return null;
     const feed = (o.files ?? fedStatuslineFiles)();
     o.childEnv[FEED_ENV] = feed.feedFile;
@@ -1521,11 +1636,12 @@ export function recordOrgWanted(o) {
 }
 /**
  * Whether this launch feeds the status line measured model cost and μ (W1.4): prerelease
- * builds only (stable stays "mnemom", decision 14), and only when the turn proxy runs, since
- * the proxy is what learns the gateway's lineage key for the session.
+ * builds only (stable stays "mnemom", decision 14). Not tied to goal mode: the base-URL proxy
+ * runs for a fed launch (proxyWanted) and records the lineage key whatever the goal mode, and
+ * since A-W-016 a -next.N launch has no goal by default.
  */
-export function fedStatuslineWanted(version, goalMode, env) {
-    return isPrerelease(version) && goalMode && turnProxyWanted(env);
+export function fedStatuslineWanted(version) {
+    return isPrerelease(version);
 }
 /** A private per-session dir holding the feed (launcher → bin). */
 function fedStatuslineFiles() {
@@ -1562,6 +1678,8 @@ export function turnProxyWanted(env) {
     const raw = (env.MNEMOM_AGENT_TURN_HEADER ?? "").trim().toLowerCase();
     return !["0", "off", "false", "no"].includes(raw);
 }
+/** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */
+export const BU_HTTP_DOOR_ENV = "MNEMOM_AGENT_BU_HTTP_DOOR";
 /**
  * Start base-url-proxy.mjs in front of `door`; calls `done` exactly once with its
  * `http://127.0.0.1:<port>` base URL, or with null (after a one-line warning) when it does not
@@ -1587,6 +1705,13 @@ export function startBaseUrlProxy(door, done, opts = {}) {
     };
     // MNE-8245 defense-in-depth: the proxy reads none of the owner's own Mnemom credential vars.
     stripOwnerCredentialEnv(proxyEnv);
+    // C17-R16 T3: the proxy never reads TEST_MODE itself (one test-mode module per repo), so the seam
+    // decision is made here and handed over as a non-secret flag; an inherited flag never passes.
+    // httpDoorAllowed answers true for any https door, so the flag is set for an http door only.
+    if (/^http:/i.test(door) && httpDoorAllowed(door, process.env))
+        proxyEnv.MNEMOM_AGENT_BU_HTTP_DOOR = "1";
+    else
+        delete proxyEnv.MNEMOM_AGENT_BU_HTTP_DOOR;
     const proxy = spawn(opts.node ?? process.execPath, [script], {
         env: proxyEnv,
         stdio: ["ignore", "pipe", "ignore"],
@@ -1779,8 +1904,9 @@ function launchRemoteControl(ctx) {
     let stdoutBuf = "";
     const start = Date.now();
     const tryStart = () => {
-        // Cleanup already ran (a refusal, or the exit fallback reaped the proxy): stop polling, so a
-        // proxy killed by a signal (exitCode stays null) never reaches the 15s refusal afterwards.
+        // Torn down already (a refusal, the sync exit fallback, or an awaited onExit() from the proxy's
+        // error / stdin paths): stop polling, so a proxy killed by a signal (exitCode stays null) never
+        // reaches the 15s refusal and no later arm can call process.exit(1) a second time.
         if (stopped)
             return;
         const m = stdoutBuf.match(/^READY (\d+) (.+)$/m);
@@ -1978,6 +2104,7 @@ function spawnRcCli(ctx) {
         if (ctx.options.slack)
             args.push(...slackChannelArgs(rcName));
         say(`mnemom agent: remote-control: interactive session in THIS terminal with Remote Control on (session name '${rcName}'); it also appears under Remote Control at claude.ai/code and in the Claude app. Exit the CLI to stop everything.`);
+        warnNoTty(ctx);
     }
     const child = spawn(ctx.cli.bin, args, { stdio: "inherit", env: childEnv });
     child.on("error", (err) => {

package/dist/commands/durable-doctor.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The durable lines of `mnemom agent doctor` (BACKBONE C1 "doctor (MFA, branch protection)";
+ * C02-R19): for each of the caller's open sessions, the MFA and branch-protection verdicts lock would
+ * compute at that moment, with the same probes and codes. The API computes them (S1 lock.ts steps
+ * `mfa` and `protection`); the doctor only renders. Read-only: one GET per session, never a POST.
+ *
+ * Not frozen by S1 (A2 owns it; gaps/c1-doctor-lock-preflight.md):
+ *   GET /v1/agent/sessions/{cid}/lock?agent_id=&dry_run=true
+ *     200 {mfa, repos: [{repo, verdict | protected | reason, pushable?}]}  (read defensively), or the
+ *     lock refusal envelope of the first failing step (403 durable_lock_mfa_required, 409
+ *     durable_lock_branch_unprotected {refusals}, 503 durable_precondition_unavailable, ...).
+ * A route that is absent (404/405) prints one info line; nothing here is ever a MISS, so the doctor's
+ * exit status keeps meaning "launch-ready".
+ */
+import { type ApiAnswer, type RegistryRow } from "../lib/durable/api.js";
+export interface DoctorApi {
+    listSessions(filter: {
+        name?: string;
+        agentId?: string;
+    }): Promise<RegistryRow[]>;
+    lockPreflight(cid: string, agentId: string): Promise<ApiAnswer>;
+}
+export interface DoctorLine {
+    mark: "ok" | "warn" | "info";
+    text: string;
+    hint?: string;
+}
+export type RepoState = "protected" | "unprotected" | "unsupported_host" | "unknown";
+export type PreflightVerdict = {
+    kind: "verdict";
+    mfa: "ok" | "missing" | "unknown";
+    repos: Array<{
+        repo: string;
+        state: RepoState;
+    }>;
+} | {
+    kind: "absent";
+} | {
+    kind: "unavailable";
+    detail: string;
+} | {
+    kind: "earlier";
+    code: string;
+};
+/** At most this many open sessions are checked (one GET each). */
+export declare const DOCTOR_SESSION_CAP = 5;
+/** Read a preflight answer into the verdict the doctor prints. */
+export declare function preflightVerdict(a: ApiAnswer): PreflightVerdict;
+/** The doctor's durable lines: one block per open session (newest first as listed), capped. */
+export declare function durableDoctorLines(api: DoctorApi): Promise<DoctorLine[]>;