@mutmutco/cli 2.56.0 → 2.58.0

package/dist/main.cjs

@@ -4769,7 +4769,7 @@ async function correlateRun(deps, args) {
       "--limit",
       "10",
       "--json",
-      args.mode === "dispatch" ? "databaseId,url,event,createdAt" : "databaseId,url,event,createdAt,status,conclusion,headSha"
+      args.mode === "dispatch" ? "databaseId,url,event,createdAt,displayTitle" : "databaseId,url,event,createdAt,status,conclusion,headSha"
     ];
     let rows;
     try {
@@ -4779,24 +4779,27 @@ async function correlateRun(deps, args) {
       if (args.mode === "workflow") lastError = new Error(`could not list ${args.workflow} runs`);
       continue;
     }
-    const match = rows.filter((r) => {
+    const candidates = rows.filter((r) => {
       if (typeof r.databaseId !== "number") return false;
       if (args.mode === "dispatch") return r.event === "workflow_dispatch";
       return r.event === args.event && r.headSha === args.headSha;
-    }).map((r) => ({ row: r, created: Date.parse(r.createdAt ?? "") })).filter((c) => Number.isFinite(c.created) && c.created >= threshold).sort((a, b) => b.created - a.created)[0];
+    }).map((r) => ({ row: r, created: Date.parse(r.createdAt ?? "") })).filter((c) => Number.isFinite(c.created) && c.created >= threshold).sort((a, b) => b.created - a.created);
+    const tokens2 = args.mode === "dispatch" ? args.titleIncludes : void 0;
+    const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => tokens2.every((t) => (c.row.displayTitle ?? "").includes(t))) : void 0;
+    const match = titleMatch ?? candidates[0];
     if (match) return { runId: match.row.databaseId, runUrl: match.row.url };
   }
   if (args.mode === "workflow" && !parsedAnyResponse && lastError) throw lastError;
   return {};
 }
-function correlateTenantRun(deps, since) {
-  return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch" });
+function correlateTenantRun(deps, since, titleIncludes) {
+  return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch", titleIncludes });
 }
 function correlatePublishRun(deps, since) {
   return correlateRun(deps, { workflow: "tenant-publish.yml", since, mode: "dispatch" });
 }
-function correlateControlRun(deps, since) {
-  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch" });
+function correlateControlRun(deps, since, titleIncludes) {
+  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
 }
 async function correlateWorkflowRun(deps, args) {
   return correlateRun(deps, { ...args, mode: "workflow" });
@@ -4927,6 +4930,7 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
   const sleep = resolveSleep(deps);
   let lastStatus = "not checked";
   let lastError;
+  const everObserved = /* @__PURE__ */ new Set();
   for (let attempt = 0; attempt < TRAIN_CHECK_ATTEMPTS; attempt++) {
     if (attempt > 0) await sleep(TRAIN_CHECK_DELAY_MS);
     let checkRuns;
@@ -4945,6 +4949,9 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
       lastError = e.message || String(e);
       continue;
     }
+    for (const c of required) {
+      if (checkRuns.some((r) => r.name === c) || statuses.some((s) => s.context === c)) everObserved.add(c);
+    }
     const states = required.map((c) => [c, resolveContextState(c, checkRuns, statuses)]);
     lastStatus = states.map(([c, s]) => `${c}=${s}`).join(", ");
     const failed = states.filter(([, s]) => s === "failed").map(([c]) => c);
@@ -4955,8 +4962,11 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required) {
       return `required checks passed: ${required.join(", ")}`;
     }
   }
+  const waitedMin = Math.round((TRAIN_CHECK_ATTEMPTS - 1) * TRAIN_CHECK_DELAY_MS / 6e4);
+  const neverMaterialized = required.filter((c) => !everObserved.has(c));
+  const neverNote = neverMaterialized.length ? ` Never materialized on ${sha} (no check-run or commit status ever appeared \u2014 the workflow that produces them was likely not triggered by the tag event): ${neverMaterialized.join(", ")}.` : "";
   throw new Error(
-    `timed out waiting for required train checks on ${sha}: ${lastError ? `last error: ${lastError}` : lastStatus}`
+    `timed out after ~${waitedMin}m (${TRAIN_CHECK_ATTEMPTS} attempts) waiting for required train checks on ${sha}.${neverNote} Last observed: ${lastError ? `error: ${lastError}` : lastStatus}`
   );
 }
 function partialTrainRecoveryError(cause, input) {
@@ -5104,7 +5114,7 @@ async function dispatchDeploy(deps, ctx, stage2, ref, model, watch, autoRunSince
         deployStatus: "failure"
       };
     }
-    const { runId, runUrl } = await correlateTenantRun(deps, since);
+    const { runId, runUrl } = await correlateTenantRun(deps, since, [ctx.slug, stage2]);
     const deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
     return { note: `dispatched tenant-deploy.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage2})`, runId, runUrl, deployStatus };
   }
@@ -5528,7 +5538,7 @@ async function runTenantControl(deps, options) {
       note: transport ? `tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
     };
   }
-  const { runId, runUrl } = await correlateControlRun(deps, since);
+  const { runId, runUrl } = await correlateControlRun(deps, since, [stage2, action]);
   const conclusion = watch ? await watchTenantRun(deps, runId) : "pending";
   const result = { ...base, dispatched: true, runId, runUrl, conclusion, note: "" };
   if (action === "retire") {
@@ -5540,6 +5550,7 @@ async function runTenantControl(deps, options) {
       result.serviceState = parseStatusSnippet(output).serviceState;
     } else {
       result.secrets = parseVerifySecrets(output);
+      result.secretsRaw = output;
     }
   }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
@@ -5594,7 +5605,7 @@ async function restoreDirtyOrgSpineToHead(deps, options = {}) {
 }
 
 // src/index.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 
 // src/cli-shared.ts
 var import_promises = require("node:fs/promises");
@@ -6289,6 +6300,23 @@ async function hubAuthToken(deps) {
   return (await hubAuthSession(deps))?.token;
 }
 
+// src/continuity-access.ts
+var CONTINUITY_OWNER_LOGIN = "jervaise";
+function continuityAllowedForLogin(login) {
+  return login?.trim().toLowerCase() === CONTINUITY_OWNER_LOGIN;
+}
+async function firstLogin(source, read) {
+  const login = (await read?.().catch(() => void 0))?.trim();
+  if (!login) return null;
+  return { allowed: continuityAllowedForLogin(login), login, source };
+}
+async function resolveContinuityAccess(deps) {
+  return await firstLogin("hub-session", deps.hubLogin) ?? await firstLogin("github", deps.ghLogin) ?? { allowed: false, source: "unknown" };
+}
+function formatContinuityAccessDenied(kind) {
+  return `${kind}: continuity is restricted to ${CONTINUITY_OWNER_LOGIN}`;
+}
+
 // src/stdin-inject.ts
 var import_node_fs6 = require("node:fs");
 var injectedStdin;
@@ -6363,6 +6391,22 @@ async function hubHeaders(extra = {}) {
   const base = { ...clientVersionHeaders(), ...extra };
   return t ? { ...base, Authorization: `Bearer ${t}` } : base;
 }
+async function continuityAccess() {
+  const cfg = await loadConfig();
+  return resolveContinuityAccess({
+    hubLogin: async () => (await hubAuthSession({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken }))?.login,
+    ghLogin: githubLogin
+  });
+}
+async function requireContinuityAccess(kind, opts = {}, io) {
+  const access2 = await continuityAccess();
+  if (access2.allowed) return true;
+  if (!opts.quiet) {
+    (io ?? consoleIo).err(formatContinuityAccessDenied(kind));
+    process.exitCode = 1;
+  }
+  return false;
+}
 var CONFIG_FILE = ".mmi/config.json";
 async function loadConfig() {
   let file = {};
@@ -6434,6 +6478,7 @@ async function postCaptureOnce(sagaApiUrl, body) {
   }
 }
 async function postCapture(capture, quiet = false) {
+  if (!await requireContinuityAccess("saga", { quiet })) return;
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
     if (!quiet) console.error("mmi-cli saga: Hub API URL not configured");
@@ -6456,6 +6501,7 @@ function spawnSagaFlush() {
 }
 async function maybeSpawnHeadUpdate() {
   try {
+    if (!await requireContinuityAccess("saga", { quiet: true })) return;
     const gateKey = await sagaKey(await loadConfig());
     const tsPath = headTsPath(gateKey);
     if (!headGateDue(tsPath)) return;
@@ -6558,7 +6604,6 @@ function parseHookInput(stdin) {
 }
 
 // src/saga-health.ts
-var MEMORY_STALE_DAYS = 14;
 var SESSION_START_LIVENESS = { attempts: 1, timeoutMs: 3e3 };
 function buildHealth(i) {
   const problems = [];
@@ -6571,9 +6616,6 @@ function buildHealth(i) {
   if (i.reachable && i.authorized === false) problems.push("saga backend rejected authenticated state access");
   if (!i.key.sessionId || i.key.sessionId === "-") problems.push("unsafe session id");
   const warnings = [];
-  if (i.memoryAgeDays !== void 0 && i.memoryAgeDays > MEMORY_STALE_DAYS) {
-    warnings.push(`PROJECT MEMORY is ${Math.round(i.memoryAgeDays)}d stale \u2014 the saga-keeper may have stalled`);
-  }
   const safeToWrite = problems.length === 0;
   return {
     ok: safeToWrite,
@@ -6588,8 +6630,7 @@ function buildHealth(i) {
     key: i.key,
     source: i.source,
     problems,
-    warnings,
-    memoryAgeDays: i.memoryAgeDays
+    warnings
   };
 }
 function healthBanner(report) {
@@ -7662,6 +7703,7 @@ async function collectWaveStatus(deps) {
 
 // src/saga-commands.ts
 async function runNote(summary, o) {
+  if (!await requireContinuityAccess("saga")) return;
   const [sha, key] = await Promise.all([gitOut(["rev-parse", "--short", "HEAD"]), sagaKey(await loadConfig())]);
   const capture = buildNoteCapture(summary, o, (0, import_node_crypto3.randomUUID)(), { sha: sha || void 0, branch: key.branch });
   await postCapture(capture);
@@ -7675,6 +7717,10 @@ function resolveSummary(summary, o) {
   });
 }
 async function runSagaFlush(o, io = consoleIo) {
+  if (!await requireContinuityAccess("saga", { quiet: o.run }, io)) {
+    if (o.json) io.log(JSON.stringify({ flushed: 0, dropped: 0, remaining: 0, restricted: true }));
+    return;
+  }
   if (o.run) {
     try {
       const cfg2 = await loadConfig();
@@ -7698,6 +7744,7 @@ async function runSagaFlush(o, io = consoleIo) {
   io.log(`saga flush: rolled forward ${result.flushed}, dropped ${result.dropped.length}, ${result.remaining} still pending`);
 }
 async function runSagaShow(opts, io = consoleIo) {
+  if (!await requireContinuityAccess("saga", { quiet: opts.quiet }, io)) return;
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
     if (opts.quiet) return;
@@ -7746,20 +7793,11 @@ async function probeSagaAccess(url, key) {
     return false;
   }
 }
-async function fetchMemoryAge(url, project2) {
-  try {
-    const qs = new URLSearchParams({ project: project2 }).toString();
-    const res = await fetch(`${url}/saga/memory-age?${qs}`, { headers: await hubHeaders(), signal: AbortSignal.timeout(8e3) });
-    if (!res.ok) return void 0;
-    const body = await res.json();
-    if (!body.updatedAt) return void 0;
-    const ms = Date.now() - Date.parse(body.updatedAt);
-    return Number.isFinite(ms) && ms >= 0 ? ms / 864e5 : void 0;
-  } catch {
-    return void 0;
-  }
-}
 async function runSagaHealth(o, io = consoleIo) {
+  if (!await requireContinuityAccess("saga", { quiet: o.quiet || o.banner }, io)) {
+    if (o.json) io.log(JSON.stringify({ ok: false, restricted: true, problems: ["continuity is restricted to jervaise"], warnings: [] }));
+    return;
+  }
   const cfg = await loadConfig();
   const session = resolveSessionId();
   const key = await sagaKey(cfg, session);
@@ -7770,7 +7808,6 @@ async function runSagaHealth(o, io = consoleIo) {
     cfg.sagaApiUrl ? probeBackend(cfg.sagaApiUrl, livenessOpts) : Promise.resolve({ reachable: false })
   ]);
   const authorized = o.banner ? void 0 : cfg.sagaApiUrl && liveness.reachable ? await probeSagaAccess(cfg.sagaApiUrl, key) : void 0;
-  const memoryAgeDays = o.banner ? void 0 : cfg.sagaApiUrl && liveness.reachable ? await fetchMemoryAge(cfg.sagaApiUrl, key.project) : void 0;
   const report = buildHealth({
     key,
     source,
@@ -7780,8 +7817,7 @@ async function runSagaHealth(o, io = consoleIo) {
     livenessMessage: liveness.message,
     authorized,
     sagaApiUrl: cfg.sagaApiUrl,
-    pendingNotes: readPending().length,
-    memoryAgeDays
+    pendingNotes: readPending().length
   });
   if (o.json) return io.log(JSON.stringify(report));
   if (o.banner) {
@@ -7798,6 +7834,7 @@ async function runSagaHealth(o, io = consoleIo) {
   if (report.pendingNotes > 0) io.log(` - ${report.pendingNotes} note(s) queued locally \u2014 \`mmi-cli saga flush\` to roll forward`);
 }
 async function fetchSagaHead(io = consoleIo) {
+  if (!await requireContinuityAccess("saga", {}, io)) return null;
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
     io.err("saga snapshot: Hub API URL not configured");
@@ -7819,6 +7856,7 @@ async function fetchSagaHead(io = consoleIo) {
   }
 }
 async function postSnapshotNotes(plan2, anchorForce) {
+  if (!await requireContinuityAccess("saga")) return;
   const [sha, key] = await Promise.all([gitOut(["rev-parse", "--short", "HEAD"]), sagaKey(await loadConfig())]);
   const evidence = { sha: sha || void 0, branch: key.branch };
   for (const idx of [...plan2.clearIndices].sort((a, b) => b - a)) {
@@ -7853,7 +7891,7 @@ async function runSagaSnapshotSet(snapshot, opts = {}, io = consoleIo) {
   io.log(`saga snapshot: wrote ${snapshot.kind} snapshot (retired ${plan2.clearIndices.length}, ${plan2.queueOps.length + 1} capture(s))`);
 }
 function registerSagaCommands(program3) {
-  const saga = program3.command("saga").description("per-session continuity");
+  const saga = program3.command("saga").description("Jervaise-only per-session continuity");
   saga.command("note [summary]").description("record a one-line structured note into your saga (the per-turn capture)").option("--next <text>", 'set "where I left off" (NEXT)').option("--decision <text>", "append a verbatim decision").option("--queue-add <text>", "add a worklist item").option("--queue-done <n>", "mark worklist item N done").option("--verified", "mark this claim as checked against source (state: verified, else asserted)").option("--diagnostic", "isolate a probe write (state: diagnostic, source: probe) \u2014 never resume/LAST 5").option("--supersedes <key>", "retire prior decisions matching an evidence key (pr:N | file:path)").option("--anchor <intent>", "set the sprint North-Star (write-protected; needs --anchor-force to change)").option("--anchor-slug <slug>", "bind the anchor to a North Star plan slug (SSOT at plans/.../<slug>.md)").option("--anchor-force", "overwrite an existing anchor").option("--message-file <path|->", "read the summary from a UTF-8 file, or from stdin with - (avoids cmd.exe quoting)").action(async (summary, o) => {
     let text;
     try {
@@ -7873,9 +7911,10 @@ function registerSagaCommands(program3) {
     await runNote(text, { ...o, diagnostic: true });
   });
   saga.command("flush").option("--json", "machine-readable {flushed, dropped, remaining}").option("--run", "detached worker: drain the queue silently (spawned by note/capture)").description("roll the local pending-note queue forward (re-POST queued saga writes); reports what landed").action((o) => runSagaFlush(o));
-  saga.command("show").option("--quiet", "no-op silently when unconfigured/unreachable (SessionStart hook)").option("--latest-anywhere", "resume the newest saga across all repos (default: current repo)").description("print your resume block \u2014 current repo HEAD + project memory (where you left off)").action((opts) => runSagaShow(opts));
+  saga.command("show").option("--quiet", "no-op silently when unconfigured/unreachable (SessionStart hook)").option("--latest-anywhere", "resume the newest saga across all repos (default: current repo)").description("print your resume block \u2014 current repo HEAD + live decisions").action((opts) => runSagaShow(opts));
   saga.command("capture").option("--quiet", "capture silently (for the Stop hook)").description("per-turn deterministic capture (Stop hook): turn boundary + current sha + gated HEAD-update").action(async (opts) => {
     if (!isOrgRepoRoot()) return;
+    if (!await requireContinuityAccess("saga", { quiet: opts.quiet })) return;
     const hook = parseHookInput(await readStdin());
     if (hook.session_id) persistSession(hook.session_id);
     await postCapture({ event: "stop", id: (0, import_node_crypto3.randomUUID)(), source: "hook", sha: await gitOut(["rev-parse", "--short", "HEAD"]), surface: agentSurface() }, opts.quiet ?? false);
@@ -7883,10 +7922,12 @@ function registerSagaCommands(program3) {
   });
   saga.command("session").option("--quiet", "silent (for the SessionStart hook)").description("persist the harness session id for this repo (SessionStart hook)").action(async () => {
     if (!isOrgRepoRoot()) return;
+    if (!await requireContinuityAccess("saga", { quiet: true })) return;
     const hook = parseHookInput(await readStdin());
     if (hook.session_id) persistSession(hook.session_id);
   });
   saga.command("head-update").option("--run", "detached worker: fetch state, run the engine, post the curated HEAD").option("--quiet", "silent (Stop hook)").description("curate the smart HEAD in the background (engine via SAGA_HEAD_ENGINE; default local claude)").action(async (o) => {
+    if (!await requireContinuityAccess("saga", { quiet: o.quiet || o.run })) return;
     if (!o.run) {
       return maybeSpawnHeadUpdate();
     }
@@ -7911,6 +7952,7 @@ function registerSagaCommands(program3) {
     }
   });
   saga.command("key").option("--json", "machine-readable output").description("print the resolved saga key + session-id source (no write)").action(async (o) => {
+    if (!await requireContinuityAccess("saga")) return;
     const cfg = await loadConfig();
     const session = resolveSessionId();
     const key = await sagaKey(cfg, session);
@@ -8100,7 +8142,15 @@ async function fetchScopedSessions(url, project2, branch, retry = FOREGROUND_FET
   const qs = new URLSearchParams({ project: project2 });
   if (branch) qs.set("branch", branch);
   const res = await fetchWithRetry(fetch, `${url}/saga/sessions?${qs}`, { headers: await hubHeaders() }, retry);
-  if (!res.ok) return [];
+  if (!res.ok) {
+    let detail = "";
+    try {
+      const errBody = await res.clone().json();
+      detail = typeof errBody.error === "string" && errBody.error || typeof errBody.message === "string" && errBody.message || "";
+    } catch {
+    }
+    throw new Error(`saga sessions read failed (HTTP ${res.status})${detail ? `: ${detail}` : ""}`);
+  }
   const body = await res.json();
   return body.sessions ?? [];
 }
@@ -8169,11 +8219,11 @@ async function locateClaimedHandoff(key, claimedBySessionId, retry = FOREGROUND_
 }
 async function postKeyedNote(key, summary, options) {
   const cfg = await loadConfig();
-  if (!cfg.sagaApiUrl) fail("handoff: Hub API URL not configured");
+  if (!cfg.sagaApiUrl) return failGraceful("handoff: Hub API URL not configured");
   const sha = await gitOut(["rev-parse", "--short", "HEAD"]);
   const capture = buildNoteCapture(summary, options, (0, import_node_crypto4.randomUUID)(), { sha: sha || void 0, branch: key.branch });
   const result = await postCaptureOnce(cfg.sagaApiUrl, { ...capture, ...key });
-  if (!result.ok) fail(`handoff: write failed${result.status ? ` (HTTP ${result.status})` : ""}${result.message ? `: ${result.message}` : ""}`);
+  if (!result.ok) await failGraceful(`handoff: write failed${result.status ? ` (HTTP ${result.status})` : ""}${result.message ? `: ${result.message}` : ""}`);
 }
 function deriveOpenFields(summary, opts, head, key) {
   const northStarSlug = opts.northStarSlug ?? head.anchor?.slug;
@@ -8192,6 +8242,7 @@ function deriveOpenFields(summary, opts, head, key) {
   });
 }
 async function runHandoffOpen(summary, opts, io = consoleIo) {
+  if (!await requireContinuityAccess("handoff", {}, io)) return;
   let resolvedSummary = summary;
   if (summary !== void 0 || opts.messageFile !== void 0) {
     try {
@@ -8201,23 +8252,29 @@ async function runHandoffOpen(summary, opts, io = consoleIo) {
         noun: "message"
       });
     } catch (e) {
-      return fail(`handoff open: ${e.message}`);
+      return failGraceful(`handoff open: ${e.message}`);
     }
   }
   const current = await fetchCurrentState();
-  if (!current) return fail("handoff open: saga state unavailable");
+  if (!current) return failGraceful("handoff open: saga state unavailable");
   let record;
   try {
     record = deriveOpenFields(resolvedSummary, opts, current.head, current.key);
   } catch (e) {
-    return fail(`handoff open: ${e.message}`);
+    return failGraceful(`handoff open: ${e.message}`);
   }
   await postKeyedNote(current.key, `handoff opened ${record.key}`, { queueAdd: serializeHandoff(record), anchorSlug: record.northStarSlug });
   if (opts.json) return io.log(JSON.stringify({ ok: true, handoff: record }));
   io.log(`handoff open: ${formatHandoffLine({ index: -1, done: false, record })}`);
 }
 async function runHandoffList(opts, io = consoleIo) {
-  const { handoffs } = await collectScopedHandoffs({ includeClosed: opts.all });
+  if (!await requireContinuityAccess("handoff", {}, io)) return [];
+  let handoffs;
+  try {
+    ({ handoffs } = await collectScopedHandoffs({ includeClosed: opts.all }));
+  } catch (e) {
+    return failGraceful(`handoff list: ${e.message}`);
+  }
   if (opts.json) {
     io.log(JSON.stringify({ handoffs }, null, 2));
   } else if (!handoffs.length) {
@@ -8228,25 +8285,42 @@ async function runHandoffList(opts, io = consoleIo) {
   return handoffs;
 }
 async function runHandoffOffer(io = consoleIo, opts = {}) {
+  if (!await requireContinuityAccess("handoff", { quiet: opts.fast }, io)) return;
   const retry = opts.fast ? SESSION_START_FETCH : FOREGROUND_FETCH;
-  const { handoffs } = await collectScopedHandoffs({ retry });
+  let handoffs;
+  try {
+    ({ handoffs } = await collectScopedHandoffs({ retry }));
+  } catch {
+    return;
+  }
   if (!handoffs.length) return;
   io.log("Open handoffs:");
   for (const h of handoffs) io.log(`- ${formatHandoffLine(h)}`);
   io.log("Use `mmi-cli handoff accept <key>` to claim, `mmi-cli handoff cancel <key>` to close, or decline in chat to leave it open.");
 }
 async function closeSourceHandoff(key, state, opts = {}, io = consoleIo) {
+  if (!await requireContinuityAccess("handoff", {}, io)) return;
   const current = await sagaKey(await loadConfig(), resolveSessionId());
-  const located = await locateOpenHandoff(key);
+  let located;
+  try {
+    located = await locateOpenHandoff(key);
+  } catch (e) {
+    return failGraceful(`handoff ${state}: ${e.message}`);
+  }
   if (!located) {
     if (state === "claimed") {
-      const prior = await locateClaimedHandoff(key, current.sessionId);
+      let prior;
+      try {
+        prior = await locateClaimedHandoff(key, current.sessionId);
+      } catch (e) {
+        return failGraceful(`handoff ${state}: ${e.message}`);
+      }
       if (prior) {
         if (opts.json) return io.log(JSON.stringify({ ok: true, handoff: prior.record, idempotent: true }));
         return io.log(`handoff claimed: ${formatHandoffLine(prior)} (already accepted)`);
       }
     }
-    return fail(`handoff ${state}: no open handoff matching ${key}`);
+    return failGraceful(`handoff ${state}: no open handoff matching ${key}`);
   }
   const closed = closeHandoff(located.item.record, state, (/* @__PURE__ */ new Date()).toISOString(), state === "claimed" ? current.sessionId : void 0);
   const sourceBranch = located.item.record.sourceBranch ?? located.key.branch;
@@ -8274,13 +8348,76 @@ async function closeSourceHandoff(key, state, opts = {}, io = consoleIo) {
 var runHandoffAccept = (key, opts = {}, io = consoleIo) => closeSourceHandoff(key, "claimed", opts, io);
 var runHandoffCancel = (key, opts = {}, io = consoleIo) => closeSourceHandoff(key, "cancelled", opts, io);
 async function runHandoffDecline(key, opts = {}, io = consoleIo) {
-  const located = await locateOpenHandoff(key);
-  if (!located) return fail(`handoff decline: no open handoff matching ${key}`);
+  if (!await requireContinuityAccess("handoff", {}, io)) return;
+  let located;
+  try {
+    located = await locateOpenHandoff(key);
+  } catch (e) {
+    return failGraceful(`handoff decline: ${e.message}`);
+  }
+  if (!located) return failGraceful(`handoff decline: no open handoff matching ${key}`);
   if (opts.json) return io.log(JSON.stringify({ ok: true, unchanged: true, handoff: located.item.record }));
   io.log(`handoff decline: left open for re-offer \u2014 ${formatHandoffLine(located.item)}`);
 }
+async function resolveHandoffSummary(summary, messageFile, verb) {
+  if (summary === void 0 && messageFile === void 0) return summary;
+  try {
+    return await resolveTextArg({ value: summary, file: messageFile }, { readFile: import_promises3.readFile, readStdin }, {
+      value: "a summary argument",
+      file: "--message-file",
+      noun: "message"
+    });
+  } catch (e) {
+    return failGraceful(`handoff ${verb}: ${e.message}`);
+  }
+}
+async function runHandoffReplace(oldKey, summary, opts = {}, io = consoleIo) {
+  if (!await requireContinuityAccess("handoff", {}, io)) return;
+  const newKey = opts.key?.trim() || oldKey;
+  const resolvedSummary = await resolveHandoffSummary(summary, opts.messageFile, "replace");
+  let located;
+  try {
+    located = await locateOpenHandoff(oldKey);
+  } catch (e) {
+    return failGraceful(`handoff replace: ${e.message}`);
+  }
+  const current = await fetchCurrentState();
+  if (!current) return failGraceful("handoff replace: saga state unavailable");
+  let record;
+  try {
+    record = deriveOpenFields(resolvedSummary, { key: newKey, northStarSlug: opts.northStarSlug }, current.head, current.key);
+  } catch (e) {
+    return failGraceful(`handoff replace: ${e.message}`);
+  }
+  await postKeyedNote(current.key, `handoff opened ${record.key}`, { queueAdd: serializeHandoff(record), anchorSlug: record.northStarSlug });
+  if (located) {
+    const closed = closeHandoff(located.item.record, "cancelled", (/* @__PURE__ */ new Date()).toISOString());
+    await postKeyedNote(located.key, `handoff cancelled ${located.item.record.key}`, {
+      handoffClose: { index: located.item.index, closedText: serializeHandoff(closed) }
+    });
+  }
+  if (opts.json) {
+    return io.log(JSON.stringify({
+      ok: true,
+      replaced: located ? located.item.record.key : null,
+      supersededIndex: located ? located.item.index : null,
+      handoff: record
+    }));
+  }
+  if (located) {
+    io.log(`handoff replace: superseded ${located.item.record.key} (index ${located.item.index}) -> ${formatHandoffLine({ index: -1, done: false, record })}`);
+  } else {
+    io.log(`handoff replace: no open handoff matching ${oldKey} \u2014 opened ${formatHandoffLine({ index: -1, done: false, record })}`);
+  }
+}
+async function runHandoffEdit(key, summary, opts = {}, io = consoleIo) {
+  if (summary === void 0 && opts.messageFile === void 0) {
+    return failGraceful("handoff edit: a new summary is required (pass it as an argument or via --message-file)");
+  }
+  return runHandoffReplace(key, summary, { ...opts, key }, io);
+}
 function registerHandoffCommands(program3) {
-  const handoff = program3.command("handoff").description("explicit saga + North Star handoff lifecycle");
+  const handoff = program3.command("handoff").description("Jervaise-only saga + North Star handoff lifecycle");
   handoff.command("open [summary]").description("open a handoff bound to a North Star slug or a board issue (--key/--next)").option("--key <slug|#issue>", "handoff key: a North Star slug or a board issue (defaults to the current North Star slug)").option("--next <slug|#issue>", "alias for --key (mirrors `saga note --next`)").option("--north-star-slug <slug>", "North Star slug to bind (optional; omit for an issue-bound handoff)").option("--message-file <path|->", "read the handoff summary from a UTF-8 file, or from stdin with - (avoids cmd.exe quoting)").option("--json", "machine-readable output").action((summary, opts) => runHandoffOpen(summary, { ...opts, key: opts.key ?? opts.next }));
   handoff.command("list").description("list open handoffs for the current repo (any branch)").option("--all", "include claimed/cancelled records").option("--json", "machine-readable output").action(async (opts) => {
     await runHandoffList(opts);
@@ -8288,6 +8425,8 @@ function registerHandoffCommands(program3) {
   handoff.command("accept <key>").description("claim an open handoff and bind this session to its North Star").option("--json", "machine-readable output").action((key, opts) => runHandoffAccept(key, opts));
   handoff.command("cancel <key>").description("close an open handoff without claiming it").option("--json", "machine-readable output").action((key, opts) => runHandoffCancel(key, opts));
   handoff.command("decline <key>").description("leave an open handoff unchanged so it is re-offered later").option("--json", "machine-readable output").action((key, opts) => runHandoffDecline(key, opts));
+  handoff.command("replace <old-key> [summary]").description("supersede an open handoff: open a corrected one (--key) and cancel the stale one atomically").option("--key <slug|#issue>", "the corrected handoff key to open (defaults to <old-key> for an in-place edit)").option("--north-star-slug <slug>", "North Star slug to bind on the corrected handoff (optional)").option("--message-file <path|->", "read the corrected summary from a UTF-8 file, or stdin with - (avoids cmd.exe quoting)").option("--json", "machine-readable output").action((oldKey, summary, opts) => runHandoffReplace(oldKey, summary, opts));
+  handoff.command("edit <key> [summary]").description("update an open handoff's summary in place (supersedes the same key)").option("--north-star-slug <slug>", "North Star slug to bind (optional)").option("--message-file <path|->", "read the new summary from a UTF-8 file, or stdin with - (avoids cmd.exe quoting)").option("--json", "machine-readable output").action((key, summary, opts) => runHandoffEdit(key, summary, opts));
 }
 
 // src/coop-commands.ts
@@ -9694,16 +9833,21 @@ async function runSessionStart(parallel, sequential, io) {
   for (const lines of buffered) flush(lines, io);
   for (const step of sequential) flush(await runBufferedStep(step), io);
 }
-function buildSessionStartPlan(verbs) {
+function buildSessionStartPlan(verbs, opts = {}) {
+  const continuityEnabled = opts.continuityEnabled ?? true;
+  const continuitySteps = continuityEnabled ? [
+    { name: "saga show", run: verbs.sagaShow },
+    { name: "handoff offer", run: verbs.handoffOffer },
+    // northstar context (#1228): curated plan cards when relevance is high-confidence; silent otherwise.
+    { name: "northstar context", run: verbs.northstarContext },
+    { name: "saga health", run: verbs.sagaHealth }
+  ] : [];
   return {
     parallel: [
       { name: "rules sync", run: verbs.rulesSync },
-      { name: "saga show", run: verbs.sagaShow },
-      { name: "handoff offer", run: verbs.handoffOffer },
+      ...continuitySteps.slice(0, 2),
       { name: "coop pending", run: verbs.coopPending },
-      // northstar context (#1228): curated plan cards when relevance is high-confidence; silent otherwise.
-      { name: "northstar context", run: verbs.northstarContext },
-      { name: "saga health", run: verbs.sagaHealth },
+      ...continuitySteps.slice(2),
       // whoami (#879): the resolved human lands in the banner so agents act --for them without asking.
       // Identity reads are memoized process-wide, so this adds no extra gh/Hub round-trip.
       { name: "whoami", run: verbs.whoami },
@@ -9781,6 +9925,10 @@ function northstarPointer(injected = false) {
   }
   return "North Stars: run `mmi-cli northstar relevant` to load plans relevant to your task (`northstar list` for all).";
 }
+function sessionStartContinuityLines(opts) {
+  if (!opts.continuityEnabled) return [];
+  return [northstarPointer(opts.northstarInjected), ...planStoreLines(opts.cwd)];
+}
 function kbPointer() {
   return "MM-KB (org knowledge): start at `mmi-cli kb get kb/INDEX.md`, then `kb get <path>` \u2014 consult before inventing conventions or storing long-term docs.";
 }
@@ -9788,6 +9936,7 @@ function kbPointer() {
 // src/coop-commands.ts
 var FOREGROUND_FETCH2 = { attempts: 2, timeoutMs: 15e3 };
 var SESSION_START_FETCH2 = { attempts: 1, timeoutMs: 3e3 };
+var COOP_WAIT_DELAYS_MS = [6e4, 12e4, 18e4, 3e5, 6e5, 18e5];
 async function hubBase() {
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) fail("Hub API URL not configured (sagaApiUrl)");
@@ -9822,11 +9971,124 @@ async function sessionContext() {
   const session = resolveSessionId();
   const branch = key.branch !== "-" ? key.branch : await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "development") ?? "development";
   const sessionId = session.id;
-  const surface = process.env.MMI_SURFACE ?? "cursor";
+  const surface = coopSurfaceFromEnv(process.env);
   const remote = await gitOut(["remote", "get-url", "origin"]).catch(() => "");
   const repo = remote.includes("github.com") ? remote.replace(/\.git$/, "").replace(/^.*github\.com[:/]/, "") : key.project !== "-" ? key.project : "mutmutco/MMI-Hub";
   return { branch, sessionId, surface, repo };
 }
+function coopSurfaceFromEnv(env) {
+  const explicit = env.MMI_AGENT_SURFACE?.trim();
+  if (explicit && ["claude", "codex", "cursor", "gemini", "opencode"].includes(explicit)) return explicit;
+  const has = (k) => Boolean(env[k]?.trim());
+  if (has("CODEX_THREAD_ID") || has("CODEX_HOME") || (env.CLAUDE_PLUGIN_ROOT ?? "").includes(".codex")) return "codex";
+  if (has("CURSOR_TRACE_ID") || has("CURSOR_USER") || has("CURSOR_SESSION_ID") || env.CURSOR_AGENT === "1" || has("CURSOR_EXTENSION_HOST_ROLE")) {
+    return "cursor";
+  }
+  if (has("OPENCODE_CLIENT") || has("OPENCODE_SERVER_USERNAME")) return "opencode";
+  if (has("CLAUDECODE") || has("CLAUDE_CODE_ENTRYPOINT") || has("CLAUDE_PLUGIN_ROOT")) return "claude";
+  return "shell";
+}
+function coopOpenPath(repo) {
+  return repo ? `/coop/status?repo=${encodeURIComponent(repo)}` : "/coop/status";
+}
+function parseTargetLogins(value) {
+  return (value ?? "").split(",").map((x) => x.trim().replace(/^@/, "")).filter(Boolean);
+}
+function categorizeOpenCoops(open, viewer) {
+  const login = viewer.login?.toLowerCase();
+  const repo = viewer.repo?.toLowerCase();
+  const categories = {
+    invitedToMe: [],
+    myAgents: [],
+    sameRepo: [],
+    internal: []
+  };
+  for (const coop of open) {
+    const targetLogins = (coop.targetLogins ?? []).map((x) => x.toLowerCase());
+    if (login && targetLogins.includes(login)) {
+      categories.invitedToMe.push(coop);
+    } else if (login && coop.coordinatorLogin.toLowerCase() === login) {
+      categories.myAgents.push(coop);
+    } else if (repo && coop.repo.toLowerCase() === repo) {
+      categories.sameRepo.push(coop);
+    } else {
+      categories.internal.push(coop);
+    }
+  }
+  return categories;
+}
+function formatOpenCoop(coop) {
+  const code = coop.sessionCode ?? coop.coopId;
+  const topic = coop.topic ?? "Untitled coop";
+  const target = coop.targetKind ? ` \xB7 target=${coop.targetKind}` : "";
+  return `  - ${code} \xB7 ${topic} \xB7 ${coop.repo}#${coop.issueNumber} \xB7 @${coop.coordinatorLogin}${target}`;
+}
+function formatOpenCoopCategories(categories) {
+  const sections = [
+    ["Invited to me", categories.invitedToMe],
+    ["My agents", categories.myAgents],
+    ["This repo", categories.sameRepo],
+    ["Internal / other repos", categories.internal]
+  ];
+  const lines = [];
+  let any = false;
+  for (const [title, rows] of sections) {
+    if (!rows.length) continue;
+    any = true;
+    lines.push(`${title}:`);
+    for (const row of rows) lines.push(formatOpenCoop(row));
+  }
+  return any ? lines.join("\n") : '[coop] no open sessions. Create one with `mmi-cli coop start --topic "<topic>" --target <own-agents|user|internal>`.';
+}
+async function printOpenCoops(res, repo) {
+  const open = res.open ?? [];
+  const [ctx, login] = await Promise.all([
+    sessionContext().catch(() => void 0),
+    githubLogin().catch(() => void 0)
+  ]);
+  consoleIo.log(formatOpenCoopCategories(categorizeOpenCoops(open, { repo: repo ?? ctx?.repo, login })));
+}
+function newCoopMessages(messages, seenCount) {
+  return messages.slice(seenCount);
+}
+function shouldStopCoopWait(status) {
+  if (status.coop?.state === "ended") return true;
+  return (status.messages ?? []).some((m) => m.phase === "SHOOK" || m.phase === "COOP_END");
+}
+async function runCoopWait(coopId, io, opts = {}) {
+  const statusPath = `/coop/status?coopId=${encodeURIComponent(coopId)}`;
+  let status = await getJson(statusPath);
+  let seenCount = status.messages?.length ?? 0;
+  if (shouldStopCoopWait(status)) {
+    if (!opts.json) io.log(`[coop wait] ${coopId} is already complete`);
+    else console.log(JSON.stringify({ coopId, status: "complete" }));
+    return;
+  }
+  for (const delayMs of COOP_WAIT_DELAYS_MS) {
+    if (!opts.json) io.log(`[coop wait] waiting ${Math.round(delayMs / 6e4)}m for ${coopId}`);
+    await new Promise((r) => setTimeout(r, delayMs));
+    status = await getJson(statusPath);
+    const messages = status.messages ?? [];
+    const fresh = newCoopMessages(messages, seenCount);
+    seenCount = messages.length;
+    if (opts.json) {
+      console.log(JSON.stringify({ coopId, messages: fresh, complete: shouldStopCoopWait(status) }));
+    } else {
+      for (const message of fresh) {
+        if (message.envelope) io.log(message.envelope);
+      }
+    }
+    if (shouldStopCoopWait(status)) {
+      if (!opts.json) io.log(`[coop wait] ${coopId} complete`);
+      return;
+    }
+  }
+  if (!opts.json) {
+    io.log(`[coop wait] no answer after bounded wait; ${coopId} remains open and can be joined later`);
+  } else {
+    console.log(JSON.stringify({ coopId, status: "timeout-open" }));
+  }
+}
 async function fetchCoopPending(retry = SESSION_START_FETCH2) {
   const body = await getJson("/coop/pending", retry);
   return body.pending ?? [];
@@ -9868,7 +10130,7 @@ async function runCoopDeliver(coopId, io, quiet = false) {
 }
 function registerCoopCommands(program3) {
   const coop = program3.command("coop").description("Cross-repo agent coordination (/coop skill)");
-  coop.command("start").description("Start a coop session (coordinator)").option("--repo <owner/name>", "coordinator repo (default: cwd origin)").option("--issue <n>", "existing issue number instead of creating one").option("--message-file <path>", "opening message file (or - for stdin)").option("--json", "machine output").action(async (opts) => {
+  coop.command("start").description("Start a coop session (coordinator)").option("--repo <owner/name>", "coordinator repo (default: cwd origin)").option("--issue <n>", "existing issue number instead of creating one").option("--topic <topic>", "human topic shown in open-session lists").option("--target <kind>", "human target: own-agents, user, or internal").option("--target-users <logins>", "comma-separated GitHub logins for inter-user coop").option("--message-file <path>", "opening message file (or - for stdin)").option("--json", "machine output").action(async (opts) => {
     const ctx = await sessionContext();
     const body = opts.messageFile ? await resolveTextArg(
       { file: opts.messageFile },
@@ -9883,9 +10145,13 @@ function registerCoopCommands(program3) {
       body
     };
     if (opts.issue) payload.issueNumber = Number(opts.issue);
+    if (opts.topic) payload.topic = opts.topic;
+    if (opts.target) payload.targetKind = opts.target;
+    const targetLogins = parseTargetLogins(opts.targetUsers);
+    if (targetLogins.length) payload.targetLogins = targetLogins;
     const res = await postJson("/coop/start", payload);
     if (opts.json) console.log(JSON.stringify(res));
-    else consoleIo.log(`[coop] started ${res.coopId} \u2014 issue ${res.issue?.url ?? ""}`);
+    else consoleIo.log(`[coop] started ${res.coopId} (code ${res.sessionCode ?? res.coopId}) \u2014 issue ${res.issue?.url ?? ""}`);
   });
   coop.command("join <coopId>").description("Join a coop session").option("--cloud", "enable Cursor cloud wake for this joiner").option("--repo <owner/name>", "joiner repo (default: cwd)").option("--json", "machine output").action(async (coopId, opts) => {
     const ctx = await sessionContext();
@@ -9919,11 +10185,42 @@ function registerCoopCommands(program3) {
     });
     consoleIo.log(`[coop] said ${opts.phase} on ${coopId}`);
   });
+  coop.command("invite <coopId>").description("Post a human invite and optionally DM a target through the MMI Future Slack app").requiredOption("--target-user <login>", "target human GitHub login").option("--message-file <path>", "custom invite message file (or - for stdin)").option("--dm", "send a Slack DM in addition to the visible #mmi-agents invite").option("--slack-user <id>", "Slack user id for DM, used with conversations.open").option("--dm-channel <id>", "Slack DM channel id").option("--json", "machine output").action(async (coopId, opts) => {
+    const ctx = await sessionContext();
+    const body = opts.messageFile ? await resolveTextArg(
+      { file: opts.messageFile },
+      { readFile: import_promises4.readFile, readStdin },
+      { value: "a message argument", file: "--message-file", noun: "message" }
+    ) : void 0;
+    const res = await postJson("/coop/invite", {
+      coopId,
+      targetLogin: opts.targetUser,
+      body,
+      branch: ctx.branch,
+      sessionId: ctx.sessionId,
+      surface: ctx.surface,
+      dm: opts.dm === true,
+      slackUserId: opts.slackUser,
+      dmChannel: opts.dmChannel
+    });
+    if (opts.json) console.log(JSON.stringify(res));
+    else {
+      const out = res;
+      const suffix = out.dm && out.dm !== "not-requested" ? `; dm ${out.dm}${out.dmReason ? ` (${out.dmReason})` : ""}` : "";
+      consoleIo.log(`[coop] invited @${opts.targetUser} to ${coopId}${suffix}`);
+    }
+  });
   coop.command("status [coopId]").description("Show coop session status").option("--json", "machine output").action(async (coopId, opts) => {
-    const path2 = coopId ? `/coop/status?coopId=${encodeURIComponent(coopId)}` : "/coop/status";
+    const path2 = coopId ? `/coop/status?coopId=${encodeURIComponent(coopId)}` : coopOpenPath();
     const res = await getJson(path2);
     if (opts.json) console.log(JSON.stringify(res));
-    else console.log(JSON.stringify(res, null, 2));
+    else if (coopId) console.log(JSON.stringify(res, null, 2));
+    else await printOpenCoops(res);
+  });
+  coop.command("open").description("List open coop sessions for join-or-start").option("--repo <owner/name>", "filter open sessions to one repo").option("--json", "machine output").action(async (opts) => {
+    const res = await getJson(coopOpenPath(opts.repo));
+    if (opts.json) console.log(JSON.stringify(res));
+    else await printOpenCoops(res, opts.repo);
   });
   coop.command("pending").description("List pending coop messages for this login").option("--json", "machine output").action(async (opts) => {
     const pending = await fetchCoopPending();
@@ -9943,7 +10240,10 @@ function registerCoopCommands(program3) {
     await postJson("/coop/end", { coopId, body });
     consoleIo.log(`[coop] ended ${coopId}`);
   });
-  coop.command("watch <coopId>").description("Degraded poll \u2014 opt-in fallback when wake is unavailable").option("--interval <sec>", "poll interval seconds", "30").action(async (coopId, opts) => {
+  coop.command("wait <coopId>").description("Bounded poll for coop replies: 1m, 2m, 3m, 5m, 10m, 30m").option("--json", "machine output").action(async (coopId, opts) => {
+    await runCoopWait(coopId, consoleIo, { json: opts.json === true });
+  });
+  coop.command("watch <coopId>").description("Unbounded diagnostic poll for a coop session").option("--interval <sec>", "poll interval seconds", "30").action(async (coopId, opts) => {
     const ms = Math.max(5, Number(opts.interval) || 30) * 1e3;
     consoleIo.log(`[coop watch] polling ${coopId} every ${ms / 1e3}s (Ctrl+C to stop)`);
     for (; ; ) {
@@ -9956,9 +10256,8 @@ function registerCoopCommands(program3) {
 }
 
 // src/overlord.ts
-var import_node_child_process8 = require("node:child_process");
 var import_node_fs15 = require("node:fs");
-var import_node_os3 = require("node:os");
+var import_node_crypto5 = require("node:crypto");
 var import_node_path13 = require("node:path");
 
 // src/atomic-write.ts
@@ -9973,15 +10272,120 @@ function atomicWriteFileSync(path2, content) {
 var OVERLORD_DEFAULT_COUNT = 3;
 var OVERLORD_MIN_COUNT = 3;
 var OVERLORD_MAX_COUNT = 6;
+var OVERLORD_SERVANT_PARALLELISM = 6;
+function overlordServantParallelism() {
+  const parsed = Number(process.env.MMI_OVERLORD_SERVANT_PARALLELISM);
+  if (Number.isFinite(parsed) && parsed >= 1) return Math.min(Math.trunc(parsed), 16);
+  return OVERLORD_SERVANT_PARALLELISM;
+}
+var OVERLORD_DEFAULT_ENGINE = "fugu-api";
+var FUGU_API_DEFAULT_BASE_URL = "https://api.sakana.ai/v1";
+var FUGU_API_DEFAULT_MODEL = "fugu";
+var FUGU_API_DEFAULT_ULTRA_MODEL = "fugu-ultra";
+var FUGU_API_DEFAULT_TIMEOUT_MS = 48e4;
+var FUGU_API_DEFAULT_STARTUP_TIMEOUT_MS = 45e3;
+var FUGU_API_DEFAULT_IDLE_MS = 6e4;
+var FUGU_API_DEFAULT_MAX_TOKENS = 16e3;
+var FUGU_API_DEFAULT_MAX_ATTEMPTS = 3;
+var FUGU_API_RETRY_BASE_MS = 250;
+var FUGU_API_RETRY_CAP_MS = 8e3;
 var OVERLORD_HANDOFF_TIMEOUT_MS = 12e4;
+var SERVANT_REPORT_FIELDS = [
+  "name",
+  "role",
+  "state",
+  "assignment",
+  "evidence",
+  "changes",
+  "verification",
+  "blockers",
+  "recommended next action"
+];
+var SERVANT_REPORT_FIELD_SET = new Set(SERVANT_REPORT_FIELDS);
+function normalizeServantReportField(label) {
+  const normalized = label.trim().toLowerCase().replace(/[`*_]+/g, "").replace(/\s+/g, " ").replace(/:$/, "");
+  if (SERVANT_REPORT_FIELD_SET.has(normalized)) return normalized;
+  if (normalized === "next action") return "recommended next action";
+  return void 0;
+}
+function isVagueVerification(text) {
+  const normalized = (text ?? "").trim().toLowerCase();
+  if (!normalized) return true;
+  return ["done", "complete", "completed", "fixed", "looks good", "verified", "tested", "not tested", "n/a", "na", "none"].includes(normalized);
+}
+function isCompletionState(text) {
+  return /\b(done|complete|completed|fixed)\b/i.test(text ?? "");
+}
+function extractServantReportFields(text) {
+  const fields = {};
+  let currentField;
+  const append = (field, value) => {
+    const trimmed = value.trim();
+    fields[field] = fields[field] ? [fields[field], trimmed].filter(Boolean).join("\n") : trimmed;
+  };
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    const colon = line.match(/^(?:[-*]\s*)?([^:]{1,80}):\s*(.*)$/);
+    const heading = line.match(/^#{1,6}\s+(.+?)\s*#*$/);
+    const field = colon ? normalizeServantReportField(colon[1]) : heading ? normalizeServantReportField(heading[1]) : void 0;
+    if (field) {
+      currentField = field;
+      append(field, colon ? colon[2] : "");
+      continue;
+    }
+    if (currentField && line) append(currentField, line);
+  }
+  return fields;
+}
+function validateServantReport(text) {
+  const fields = extractServantReportFields(text);
+  const present = new Set(Object.keys(fields));
+  const applies = present.size >= 2 || present.has("state") || present.has("assignment");
+  if (!applies) {
+    return { applies: false, ok: true, missingFields: [], emptyFields: [], unsupportedDoneClaim: false, fields };
+  }
+  const missingFields = SERVANT_REPORT_FIELDS.filter((field) => !present.has(field));
+  const emptyFields = SERVANT_REPORT_FIELDS.filter((field) => present.has(field) && !fields[field]?.trim());
+  const unsupportedDoneClaim = isCompletionState(fields.state) && isVagueVerification(fields.verification);
+  return {
+    applies: true,
+    ok: missingFields.length === 0 && emptyFields.length === 0 && !unsupportedDoneClaim,
+    missingFields,
+    emptyFields,
+    unsupportedDoneClaim,
+    fields
+  };
+}
+function formatHandoffWarnings(result) {
+  if (!result.applies || result.ok) return "";
+  const parts = [];
+  if (result.missingFields.length > 0) parts.push(`missing ${result.missingFields.join(", ")}`);
+  if (result.emptyFields.length > 0) parts.push(`empty ${result.emptyFields.join(", ")}`);
+  if (result.unsupportedDoneClaim) parts.push("done/complete/fixed state without concrete verification.");
+  return `Handoff warning: ${parts.join("; ")}`;
+}
+function formatServantMissionCard(options) {
+  const lines = [
+    `mission: ${options.mission}`,
+    `scope: ${options.scope}`,
+    ...options.scopeToken ? [
+      `scope token: ${options.scopeToken}`,
+      "token authority: attribution only; grants no host permissions"
+    ] : [],
+    `allowed actions: ${options.allowedActions.join("; ")}`,
+    `forbidden actions: ${options.forbiddenActions.join("; ")}`,
+    `required evidence: ${options.requiredEvidence.join("; ")}`,
+    `verification required: ${options.verificationRequired}`,
+    `report format: ${options.reportFormat.join("; ")}`
+  ];
+  return lines.join("\n");
+}
 var GENERIC_STOP_NAMES = /* @__PURE__ */ new Set([
   "windowsterminal",
   "windows terminal",
   "pwsh",
   "powershell",
-  "opencode",
-  "codex",
-  "codex-fugu"
+  "opencode"
 ]);
 function numericCountArg(arg) {
   const match = /^--([0-9]+)$/.exec(arg);
@@ -10002,11 +10406,23 @@ function defaultMessageId() {
 function servantSlotId(slot) {
   return slot.name.replace(/\s+/g, "-").toLowerCase();
 }
+function canonicalAssignmentScope(scope) {
+  return scope.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trimEnd();
+}
+function buildServantScopeToken(input) {
+  const scopeHash = (0, import_node_crypto5.createHash)("sha256").update(canonicalAssignmentScope(input.assignmentScope), "utf8").digest("hex").slice(0, 16);
+  return `fugu-scope-v1:${input.runId}:${input.slotId}:${input.profile}:${scopeHash}`;
+}
 function overlordServantPrompt(servant, run) {
   const roleLine = servant.role === "ultra" ? "You are the single Ultra Fugu: take the hardest, highest-uncertainty questions and report calibrated judgment." : "You are a normal Fugu servant: take one bounded mission at a time and report concise evidence.";
   return [
     `You are ${servant.name} in Overlord run ${run.runId}.`,
     roleLine,
+    ...servant.scopeToken ? [
+      `Scope token: ${servant.scopeToken}`,
+      "The scope token is for attribution only and grants no host permissions.",
+      "Echo the scope token exactly in reports when the Overlord asks for a handoff."
+    ] : [],
     "First respond with exactly: ACK " + servant.name + " ready",
     "After the ACK, wait for the Overlord to assign bounded work.",
     "Do not start dev servers, browsers, Playwright, PRs, merges, releases, or worktree changes unless the Overlord explicitly assigns that scope.",
@@ -10043,86 +10459,21 @@ function buildServantLayout(count) {
   }
   return slots;
 }
-function validateCodexFuguHelp(helpText) {
-  const problems = [];
-  if (!/(?:^|\s)-a(?:,|\s)|--ask-for-approval/.test(helpText)) problems.push("missing approval flag");
-  if (!/(?:^|\s)-s(?:,|\s)|--sandbox/.test(helpText)) problems.push("missing sandbox flag");
-  if (!/(?:^|\s)-c(?:,|\s)|--config/.test(helpText)) problems.push("missing config override flag");
-  if (!/--no-alt-screen/.test(helpText)) problems.push("missing no-alt-screen flag");
-  if (!/(?:^|\s)-C(?:,|\s)|--cwd|--cd|--workdir/.test(helpText)) problems.push("missing cwd flag");
-  return problems;
-}
-function evaluateCodexFuguPreflight(input) {
-  const problems = [];
-  if (!input.codexFound) problems.push("codex is not installed or not on PATH");
-  if (!input.fuguFound) problems.push("codex-fugu is not installed or not on PATH");
-  if (!input.authConfigured && !input.envNames.includes("OPENAI_API_KEY") && !input.envNames.includes("CODEX_API_KEY")) {
-    problems.push("missing API key environment: OPENAI_API_KEY or CODEX_API_KEY");
-  }
-  problems.push(...validateCodexFuguHelp(input.helpText ?? ""));
-  const status = input.statusText ?? "";
-  const modelCatalog = input.modelCatalogText ?? "";
-  if (!/\bfugu-ultra\b/i.test(`${status}
-${modelCatalog}`)) problems.push("fugu-ultra is not available");
-  if (/native windows codex[^\n]*\/c\/users|\/c\/users[^\n]*native windows codex/i.test(status)) {
-    problems.push("native Windows Codex is configured with a Git Bash /c/Users path");
-  }
-  return { ok: problems.length === 0, problems };
-}
-function evaluateOpenCodePreflight(input) {
-  const problems = [];
-  if (!input.found) problems.push("opencode is not installed or not on PATH");
-  if (!/sakana\/fugu\b/i.test(input.modelsText ?? "")) problems.push("sakana/fugu is not available");
-  if (!/sakana\/fugu-ultra\b/i.test(input.modelsText ?? "")) problems.push("sakana/fugu-ultra is not available");
-  const probe = input.jsonProbeText ?? "";
-  if (probe && !/(sessionID|sessionId|step_finish|finish)/i.test(probe)) problems.push("opencode run --format json did not emit session or finish events");
-  return { ok: problems.length === 0, problems };
-}
-function buildOpenCodeLaunch(slot, message, sessionId) {
-  const model = slot.role === "ultra" ? "sakana/fugu-ultra" : "sakana/fugu";
-  const args = ["run", "-m", model, "--format", "json"];
-  if (sessionId) args.push("--session", sessionId);
-  args.push(message);
-  return { command: "opencode", args };
-}
-function parseOpenCodeEvents(raw) {
-  const events = [];
-  const trimmed = (raw ?? "").trim();
-  if (!trimmed) return { text: "", finished: false, events };
-  const pushParsed = (chunk) => {
-    const t = chunk.trim();
-    if (!t) return;
-    try {
-      events.push(JSON.parse(t));
-    } catch {
-    }
-  };
+function appendOverlordLedger(ledgerPath, entry) {
   try {
-    const whole = JSON.parse(trimmed);
-    if (Array.isArray(whole)) events.push(...whole);
-    else events.push(whole);
+    (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(ledgerPath), { recursive: true });
+    (0, import_node_fs15.appendFileSync)(ledgerPath, `${JSON.stringify(entry)}
+`, "utf8");
   } catch {
-    for (const line of trimmed.split(/\r?\n/)) pushParsed(line);
   }
-  let sessionId;
-  let text = "";
-  let finished = false;
-  for (const ev of events) {
-    if (!ev || typeof ev !== "object") continue;
-    const e = ev;
-    const sid = e.sessionID ?? e.sessionId ?? e.session?.id;
-    if (typeof sid === "string" && sid) sessionId = sid;
-    const type = typeof e.type === "string" ? e.type : void 0;
-    if (typeof e.text === "string") text += e.text;
-    else if (type === "text" && typeof e.content === "string") text += e.content;
-    if (type === "step_finish" || type === "finish" || e.finishReason || e.finish_reason) finished = true;
-  }
-  return { sessionId, text: text.trim(), finished, events };
 }
-function appendOverlordLedger(ledgerPath, entry) {
+function appendServantJournal(journalPath, label, text, timestamp) {
+  if (!text || !text.trim()) return;
   try {
-    (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(ledgerPath), { recursive: true });
-    (0, import_node_fs15.appendFileSync)(ledgerPath, `${JSON.stringify(entry)}
+    (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(journalPath), { recursive: true });
+    (0, import_node_fs15.appendFileSync)(journalPath, `[${timestamp}] ${label}
+${text.trim()}
+
 `, "utf8");
   } catch {
   }
@@ -10144,12 +10495,88 @@ function writeOverlordRegistry(statePath, registry2) {
   atomicWriteFileSync(statePath, `${JSON.stringify(registry2, null, 2)}
 `);
 }
+function sleepSyncMs(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(1, ms));
+}
+var OVERLORD_REGISTRY_LOCK_TIMEOUT_MS = 5e3;
+var OVERLORD_REGISTRY_LOCK_STALE_MS = 3e4;
+function withRegistryLock(statePath, fn) {
+  const lockPath = `${statePath}.lock`;
+  (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(statePath), { recursive: true });
+  const deadline = Date.now() + OVERLORD_REGISTRY_LOCK_TIMEOUT_MS;
+  let fd;
+  for (; ; ) {
+    try {
+      fd = (0, import_node_fs15.openSync)(lockPath, "wx");
+      break;
+    } catch {
+      let stale = false;
+      try {
+        stale = Date.now() - (0, import_node_fs15.statSync)(lockPath).mtimeMs > OVERLORD_REGISTRY_LOCK_STALE_MS;
+      } catch {
+        stale = false;
+      }
+      if (stale) {
+        try {
+          (0, import_node_fs15.rmSync)(lockPath, { force: true });
+        } catch {
+        }
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error(`Overlord registry lock is busy: ${lockPath}`);
+      sleepSyncMs(25);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (fd !== void 0) (0, import_node_fs15.closeSync)(fd);
+    try {
+      (0, import_node_fs15.rmSync)(lockPath, { force: true });
+    } catch {
+    }
+  }
+}
+function persistRunMutation(statePath, runId, mutate) {
+  return withRegistryLock(statePath, () => {
+    const fresh = readOverlordRegistry(statePath);
+    const current = fresh.runs[runId];
+    if (!current) throw new Error(`Overlord run ${runId} is no longer in the registry`);
+    const next = mutate(current);
+    writeOverlordRegistry(statePath, { ...fresh, runs: { ...fresh.runs, [runId]: next } });
+    return next;
+  });
+}
+function resolveOverlordSendMessage(messageArgs, messageFile) {
+  const inline = messageArgs.join(" ").trim();
+  if (inline) return inline;
+  if (messageFile) {
+    const raw = messageFile === "-" ? (0, import_node_fs15.readFileSync)(0, "utf8") : (0, import_node_fs15.readFileSync)(messageFile, "utf8");
+    return raw.trim();
+  }
+  return "";
+}
+function computeAffectedSlots(servants, normalized, settled) {
+  const targetSlots = normalized === "all" ? servants.map((s) => s.slotId) : servants.filter((s) => s.slotId === normalized || normalizeServantTarget(s.name) === normalized).map((s) => s.slotId);
+  return /* @__PURE__ */ new Set([...(settled?.servantResults ?? []).map((r) => r.slotId), ...targetSlots]);
+}
+function mergeConcurrentDispatch(fresh, dispatched, settled, affected, messageId) {
+  const dispatchedBySlot = new Map(dispatched.servants.map((s) => [s.slotId, s]));
+  const updatedAt = [fresh.updatedAt, dispatched.updatedAt].filter(Boolean).sort().at(-1) ?? dispatched.updatedAt;
+  return {
+    ...fresh,
+    updatedAt,
+    servants: fresh.servants.map((s) => affected.has(s.slotId) ? dispatchedBySlot.get(s.slotId) ?? s : s),
+    messages: [...(fresh.messages ?? []).filter((m) => m.id !== messageId), ...settled ? [settled] : []]
+  };
+}
 function buildOverlordRun(options) {
   const runId = options.runId?.() ?? defaultRunId();
   const runToken = options.runToken?.() ?? defaultRunToken();
   const statePath = defaultOverlordStatePath(options.cwd);
   const journalDir = (0, import_node_path13.join)(options.cwd, "tmp", "overlord", runId);
-  const engine = options.engine ?? "codex-fugu";
+  const engine = options.engine ?? OVERLORD_DEFAULT_ENGINE;
+  const provider = "sakana";
   const timestamp = isoNow(options.now);
   return {
     runId,
@@ -10163,44 +10590,31 @@ function buildOverlordRun(options) {
     journalDir,
     ledgerPath: (0, import_node_path13.join)(journalDir, "ledger.jsonl"),
     engine,
-    provider: engine === "opencode" ? "opencode" : "codex",
-    opencodeVersion: options.opencodeVersion,
-    servants: buildServantLayout(options.count).map((slot) => ({
-      ...slot,
-      slotId: servantSlotId(slot),
-      profile: "consultation",
-      state: "planned",
-      journalPath: (0, import_node_path13.join)(journalDir, `${servantSlotId(slot)}.log`),
-      composerSubmitMode: engine === "opencode" ? "surface-api" : "unknown",
-      engine,
-      provider: engine === "opencode" ? "opencode" : "codex",
-      opencodeVersion: options.opencodeVersion,
-      eventJournalPath: engine === "opencode" ? (0, import_node_path13.join)(journalDir, `${servantSlotId(slot)}.events.jsonl`) : void 0
-    })),
+    provider,
+    servants: buildServantLayout(options.count).map((slot) => {
+      const slotId = servantSlotId(slot);
+      const profile = "consultation";
+      return {
+        ...slot,
+        slotId,
+        profile,
+        state: "planned",
+        journalPath: (0, import_node_path13.join)(journalDir, `${slotId}.log`),
+        composerSubmitMode: "surface-api",
+        engine,
+        provider,
+        eventJournalPath: (0, import_node_path13.join)(journalDir, `${slotId}.events.jsonl`),
+        scopeToken: buildServantScopeToken({
+          runId,
+          slotId,
+          profile,
+          assignmentScope: options.task
+        })
+      };
+    }),
     ownedResources: []
   };
 }
-function recordOverlordHeartbeat(run, options) {
-  const timestamp = isoNow(options.now);
-  const controllerResource = {
-    kind: "process",
-    pid: options.controllerPid,
-    commandName: "mmi-cli overlord controller",
-    runId: run.runId,
-    runToken: run.runToken,
-    fingerprint: options.fingerprint
-  };
-  const others = run.ownedResources.filter((resource) => resource.commandName !== "mmi-cli overlord controller");
-  return {
-    ...run,
-    state: run.state === "starting" ? "active" : run.state,
-    updatedAt: timestamp,
-    controllerPid: options.controllerPid,
-    controllerFingerprint: options.fingerprint,
-    lastControllerHeartbeatAt: timestamp,
-    ownedResources: [controllerResource, ...others]
-  };
-}
 function buildOverlordStartupPlan(args, cwd) {
   const count = parseOverlordCount(args);
   const task = args.filter((arg) => numericCountArg(arg) === void 0).join(" ").trim();
@@ -10231,11 +10645,9 @@ function summarizeOverlordRun(run, probe) {
     state: run.state,
     controller,
     servants: run.servants.map((servant) => {
-      if (run.engine === "opencode" || servant.engine === "opencode") return { name: servant.name, state: servantProgress(run, servant, now) };
-      if (servant.pid == null) return { name: servant.name, state: "not-started" };
-      if (!probe.isPidAlive(servant.pid)) return { name: servant.name, state: "lost" };
       const progress = servantProgress(run, servant, now);
       if (progress !== servant.state) return { name: servant.name, state: progress };
+      if (servant.pid != null && !probe.isPidAlive(servant.pid)) return { name: servant.name, state: "lost" };
       if (servant.state === "ready" && servant.lastAckAt && servant.composerSubmitMode !== "unknown") {
         return { name: servant.name, state: "ready" };
       }
@@ -10253,52 +10665,6 @@ function planOverlordRunStop(run) {
   }
   return { killPids, uncertain };
 }
-function controllerFingerprint(run) {
-  return `mmi-overlord-controller:${run.runId}:${run.worktree}`;
-}
-function defaultStartController(run) {
-  const scriptPath = (0, import_node_path13.join)(__dirname, "overlord-controller.cjs");
-  const fingerprint = controllerFingerprint(run);
-  const child = (0, import_node_child_process8.spawn)(process.execPath, [scriptPath, run.runId, run.statePath, fingerprint], {
-    detached: true,
-    stdio: "ignore",
-    windowsHide: true,
-    cwd: run.worktree
-  });
-  child.unref();
-  return { pid: child.pid, fingerprint };
-}
-function defaultRunOpenCode(run, servant, message, sessionId) {
-  const launch = buildOpenCodeLaunch(servant, message, sessionId ?? servant.opencodeSessionId);
-  const shell2 = process.platform === "win32";
-  const file = shell2 ? [launch.command, ...launch.args].map(shellQuote2).join(" ") : launch.command;
-  const result = (0, import_node_child_process8.spawnSync)(file, shell2 ? [] : launch.args, {
-    encoding: "utf8",
-    shell: shell2,
-    cwd: run.worktree,
-    timeout: 6e5,
-    windowsHide: true,
-    env: { ...process.env }
-  });
-  if (result.error && result.error.code === "ENOENT") {
-    return { ok: false, error: "opencode is not installed or not on PATH" };
-  }
-  const raw = `${result.stdout ?? ""}
-${result.stderr ?? ""}`;
-  if (servant.eventJournalPath) {
-    try {
-      (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(servant.eventJournalPath), { recursive: true });
-      (0, import_node_fs15.appendFileSync)(servant.eventJournalPath, `${raw.trim()}
-`, "utf8");
-    } catch {
-    }
-  }
-  const parsed = parseOpenCodeEvents(raw);
-  if (result.status !== 0 && !parsed.finished) {
-    return { ok: false, sessionId: parsed.sessionId, text: parsed.text, error: `opencode run exited ${result.status ?? "with error"}`, events: parsed.events };
-  }
-  return { ok: true, sessionId: parsed.sessionId, text: parsed.text, events: parsed.events };
-}
 function defaultIsPidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try {
@@ -10311,141 +10677,409 @@ function defaultIsPidAlive(pid) {
 function defaultKillPid(pid) {
   process.kill(pid);
 }
-function shellQuote2(arg) {
-  return /^[A-Za-z0-9_./:-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
+function fuguApiTimeoutMs() {
+  const parsed = Number(process.env.MMI_OVERLORD_LLM_TIMEOUT_MS);
+  if (!Number.isFinite(parsed) || parsed <= 0) return FUGU_API_DEFAULT_TIMEOUT_MS;
+  return Math.min(Math.max(Math.trunc(parsed), 5e3), 12e5);
 }
-function boundedCommandText(command, args) {
-  const shell2 = process.platform === "win32";
-  const file = shell2 ? [command, ...args].map(shellQuote2).join(" ") : command;
-  const result = (0, import_node_child_process8.spawnSync)(file, shell2 ? [] : args, {
-    encoding: "utf8",
-    shell: shell2,
-    timeout: 5e3,
-    windowsHide: true,
-    env: {
-      ...process.env,
-      CODEX_FUGU_NO_NOTICE: "1",
-      CODEX_FUGU_NO_UPDATE: "1"
-    }
+function fuguApiIdleMs() {
+  const parsed = Number(process.env.MMI_OVERLORD_LLM_IDLE_MS);
+  if (!Number.isFinite(parsed) || parsed <= 0) return FUGU_API_DEFAULT_IDLE_MS;
+  return Math.min(Math.max(Math.trunc(parsed), 5e3), 6e5);
+}
+function fuguApiMaxTokens() {
+  const parsed = Number(process.env.MMI_OVERLORD_LLM_MAX_TOKENS);
+  if (!Number.isFinite(parsed) || parsed <= 0) return FUGU_API_DEFAULT_MAX_TOKENS;
+  return Math.min(Math.max(Math.trunc(parsed), 256), 2e5);
+}
+function fuguApiStartupTimeoutMs() {
+  const workTimeout = fuguApiTimeoutMs();
+  const parsed = Number(process.env.MMI_OVERLORD_LLM_STARTUP_TIMEOUT_MS);
+  const chosen = Number.isFinite(parsed) && parsed > 0 ? Math.trunc(parsed) : FUGU_API_DEFAULT_STARTUP_TIMEOUT_MS;
+  return Math.min(Math.max(chosen, 5e3), workTimeout);
+}
+function fuguApiConfig() {
+  return {
+    baseUrl: (process.env.MMI_OVERLORD_LLM_BASE_URL ?? FUGU_API_DEFAULT_BASE_URL).replace(/\/+$/, ""),
+    apiKey: process.env.MMI_OVERLORD_LLM_API_KEY ?? process.env.SAKANA_API_KEY,
+    model: process.env.MMI_OVERLORD_LLM_MODEL ?? FUGU_API_DEFAULT_MODEL,
+    ultraModel: process.env.MMI_OVERLORD_LLM_ULTRA_MODEL ?? FUGU_API_DEFAULT_ULTRA_MODEL,
+    timeoutMs: fuguApiTimeoutMs(),
+    idleMs: fuguApiIdleMs(),
+    maxTokens: fuguApiMaxTokens()
+  };
+}
+function fuguApiModelForServant(config, servant) {
+  return servant.role === "ultra" ? config.ultraModel : config.model;
+}
+function fuguApiSystemMessage(servant, run) {
+  const roleLine = servant.role === "ultra" ? "You are the single Ultra Fugu servant. Take the hardest useful slice, surface risks, and give calibrated judgment." : "You are a normal Fugu servant. Take one bounded assignment at a time and report concise evidence.";
+  const contract = formatServantMissionCard({
+    mission: run.task,
+    scope: servant.role === "ultra" ? "consult on the highest-uncertainty slice assigned by the Overlord" : "consult on one bounded slice assigned by the Overlord",
+    scopeToken: servant.scopeToken,
+    allowedActions: ["inspect assigned evidence", "reason from provided context", "report findings"],
+    forbiddenActions: ["mutate files without explicit scope", "start stage/dev servers", "start browsers or Playwright", "open PRs or merges"],
+    requiredEvidence: ["cite source paths, command results, or observations when available", "separate evidence from inference"],
+    verificationRequired: "name the verification performed before any done/complete/fixed claim, or explain why verification is not applicable",
+    reportFormat: [...SERVANT_REPORT_FIELDS, "scope token"]
   });
-  const text = `${result.stdout ?? ""}
-${result.stderr ?? ""}`.trim();
-  if (result.error && result.error.code === "ENOENT") return { found: false, text };
-  return { found: !result.error, text };
+  return [
+    `You are ${servant.name} in Overlord run ${run.runId}.`,
+    roleLine,
+    "The Overlord is the only coordinator.",
+    "Do not claim ownership of the full mission.",
+    "Do not mutate files, branches, worktrees, stage/dev servers, browsers, PRs, or releases unless the Overlord explicitly grants that scope.",
+    "Gather evidence before acting.",
+    "Verify before claiming done.",
+    "Escalate blockers instead of looping.",
+    contract
+  ].join("\n");
 }
-function readFuguModelCatalogText() {
-  const codexHome = process.env.CODEX_HOME ?? (0, import_node_path13.join)((0, import_node_os3.homedir)(), ".codex");
-  const catalogPath = (0, import_node_path13.join)(codexHome, "fugu.json");
+async function collectFuguApiPreflight() {
+  const config = fuguApiConfig();
+  const problems = [];
+  if (!config.apiKey) problems.push("SAKANA_API_KEY or MMI_OVERLORD_LLM_API_KEY is not available");
+  if (!config.baseUrl) problems.push("Fugu API base URL is not configured");
+  if (!config.apiKey || !config.baseUrl) return { ok: false, problems };
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), Math.min(config.timeoutMs, 15e3));
   try {
-    return (0, import_node_fs15.existsSync)(catalogPath) ? (0, import_node_fs15.readFileSync)(catalogPath, "utf8") : "";
-  } catch {
-    return "";
+    const response = await fetch(`${config.baseUrl}/models`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${config.apiKey}` },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      problems.push(`Fugu API model probe returned HTTP ${response.status}`);
+    } else {
+      const body = await response.json();
+      const models = new Set((body.data ?? []).map((model) => model.id).filter((id) => Boolean(id)));
+      if (!models.has(config.model)) problems.push(`Fugu API model ${config.model} is not available`);
+      if (!models.has(config.ultraModel)) problems.push(`Fugu API ultra model ${config.ultraModel} is not available`);
+    }
+  } catch (e) {
+    problems.push(`Fugu API model probe failed: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    clearTimeout(timeout);
   }
+  return { ok: problems.length === 0, problems };
 }
-function hasCodexAuthEvidence() {
-  const codexHome = process.env.CODEX_HOME ?? (0, import_node_path13.join)((0, import_node_os3.homedir)(), ".codex");
-  return (0, import_node_fs15.existsSync)((0, import_node_path13.join)(codexHome, "auth.json"));
+function mapFuguApiUsage(usage) {
+  if (!usage) return void 0;
+  const mapped = {
+    promptTokens: usage.prompt_tokens,
+    completionTokens: usage.completion_tokens,
+    totalTokens: usage.total_tokens
+  };
+  return Object.values(mapped).some((value) => typeof value === "number") ? mapped : void 0;
 }
-function collectOpenCodePreflight() {
-  const version = boundedCommandText("opencode", ["--version"]);
-  const models = boundedCommandText("opencode", ["models"]);
-  return evaluateOpenCodePreflight({
-    found: version.found,
-    versionText: version.text,
-    modelsText: models.text
-  });
+function buildFuguRequestBody(model, messages, maxTokens) {
+  return {
+    model,
+    messages,
+    temperature: 0.2,
+    max_tokens: maxTokens,
+    stream: true,
+    stream_options: { include_usage: true }
+  };
 }
-function collectCodexFuguPreflight() {
-  const codexHelp = boundedCommandText("codex", ["--help"]);
-  const fuguHelp = boundedCommandText("codex-fugu", ["--help"]);
-  const fuguStatus = boundedCommandText("codex-fugu", ["--status"]);
-  return evaluateCodexFuguPreflight({
-    codexFound: codexHelp.found,
-    fuguFound: fuguHelp.found,
-    helpText: fuguHelp.text || codexHelp.text,
-    statusText: fuguStatus.text,
-    modelCatalogText: readFuguModelCatalogText(),
-    authConfigured: hasCodexAuthEvidence(),
-    envNames: Object.keys(process.env)
-  });
+function foldFuguSse(payloads) {
+  let text = "";
+  let finishReason;
+  let rawUsage;
+  for (const payload of payloads) {
+    const data = payload.trim();
+    if (!data || data === "[DONE]") continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(data);
+    } catch {
+      continue;
+    }
+    const choice = parsed?.choices?.[0];
+    const piece = choice?.delta?.content ?? choice?.message?.content;
+    if (typeof piece === "string") text += piece;
+    if (choice?.finish_reason) finishReason = choice.finish_reason;
+    if (parsed?.usage) rawUsage = parsed.usage;
+  }
+  return { text, finishReason, usage: mapFuguApiUsage(rawUsage) };
+}
+async function defaultRunFuguApi(run, servant, message, options) {
+  const config = fuguApiConfig();
+  if (!config.apiKey) return { ok: false, error: "SAKANA_API_KEY or MMI_OVERLORD_LLM_API_KEY is not available" };
+  const model = fuguApiModelForServant(config, servant);
+  const messages = [
+    ...servant.llmMessages ?? [{ role: "system", content: fuguApiSystemMessage(servant, run) }],
+    { role: "user", content: message }
+  ];
+  const totalMs = options?.timeoutMs ?? config.timeoutMs;
+  const idleMs = Math.min(config.idleMs, totalMs);
+  const controller = new AbortController();
+  let abortKind;
+  const totalTimer = setTimeout(() => {
+    abortKind = "total";
+    controller.abort();
+  }, totalMs);
+  let idleTimer;
+  let streamReader;
+  const armIdle = () => {
+    if (idleTimer) clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => {
+      abortKind = "idle";
+      controller.abort();
+    }, idleMs);
+  };
+  armIdle();
+  try {
+    const response = await fetch(`${config.baseUrl}/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(buildFuguRequestBody(model, messages, config.maxTokens)),
+      signal: controller.signal
+    });
+    const requestId = response.headers.get("x-request-id") ?? response.headers.get("request-id") ?? void 0;
+    if (!response.ok) {
+      const errBody = await response.json().catch(() => void 0);
+      return {
+        ok: false,
+        model,
+        requestId,
+        error: errBody?.error?.message ?? `Fugu API returned HTTP ${response.status}`,
+        retryable: response.status === 429 || response.status >= 500
+      };
+    }
+    if (!response.body) return { ok: false, model, requestId, error: "Fugu API returned no response body", retryable: true };
+    const reader = response.body.getReader();
+    streamReader = reader;
+    const decoder = new TextDecoder();
+    const payloads = [];
+    let buffer = "";
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      armIdle();
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("data:")) payloads.push(trimmed.slice(5).trim());
+      }
+    }
+    const tail = buffer.trim();
+    if (tail.startsWith("data:")) payloads.push(tail.slice(5).trim());
+    const { text: rawText, finishReason, usage } = foldFuguSse(payloads);
+    const text = rawText.trim();
+    if (!text) {
+      const reason = finishReason === "length" ? "Fugu API hit max_tokens before emitting content (raise MMI_OVERLORD_LLM_MAX_TOKENS)" : "Fugu API returned no assistant text";
+      return { ok: false, model, requestId, error: reason, finishReason, usage, retryable: false };
+    }
+    return {
+      ok: true,
+      text,
+      model,
+      requestId,
+      finishReason,
+      usage,
+      messages: [...messages, { role: "assistant", content: text }]
+    };
+  } catch (e) {
+    const aborted = e instanceof Error && e.name === "AbortError";
+    if (aborted) {
+      const bound = abortKind === "idle" ? `${Math.round(idleMs / 1e3)}s with no data` : `${Math.round(totalMs / 1e3)}s total`;
+      return { ok: false, model, error: `Fugu API request timed out (${bound})`, retryable: false };
+    }
+    return { ok: false, model, error: e instanceof Error ? e.message : String(e), retryable: true };
+  } finally {
+    clearTimeout(totalTimer);
+    if (idleTimer) clearTimeout(idleTimer);
+    if (streamReader) {
+      try {
+        streamReader.releaseLock();
+      } catch {
+      }
+    }
+  }
 }
-function renderCodexFuguPreflightFailure(report) {
+function renderOverlordPreflightFailure(report) {
   const lines = [
     "Overlord setup needed",
-    "The servant pool was not started because Codex/Fugu preflight failed.",
+    "The servant pool was not started because Fugu preflight failed.",
     "",
     "Problems:",
     ...report.problems.map((problem) => `- ${problem}`),
     "",
     "Fixes:"
   ];
-  if (report.problems.some((problem) => problem.includes("codex is not installed"))) {
-    lines.push("- Install or update Codex, then confirm with `codex --version`.");
+  if (report.problems.some((problem) => problem.includes("SAKANA_API_KEY") || problem.includes("Fugu API"))) {
+    lines.push("- Confirm `SAKANA_API_KEY` is available and `https://api.sakana.ai/v1/models` is reachable.");
   }
-  if (report.problems.some((problem) => problem.includes("codex-fugu is not installed"))) {
-    lines.push("- Install or repair codex-fugu, then confirm with `codex-fugu --status`.");
-  }
-  if (report.problems.some((problem) => problem.includes("missing API key"))) {
-    lines.push("- Set OPENAI_API_KEY or CODEX_API_KEY in the launching shell; do not paste key values into chat.");
-  }
-  if (report.problems.some((problem) => problem.includes("fugu-ultra"))) {
-    lines.push("- Recheck or update Fugu configs so `fugu-ultra` appears in the Fugu model catalog.");
-  }
-  if (report.problems.some((problem) => problem.includes("missing ") && problem.includes("flag"))) {
-    lines.push("- Update Codex/Fugu until `codex-fugu --help` exposes approval, sandbox, config, cwd, and no-alt-screen flags.");
-  }
-  if (report.problems.some((problem) => problem.includes("/c/Users"))) {
-    lines.push("- Launch from a native shell adapter or repair Fugu path configuration so Windows paths stay native.");
+  if (report.problems.some((problem) => problem.includes("model") || problem.includes("fugu"))) {
+    lines.push("- Confirm the configured Fugu API models are exposed by `/models`.");
   }
   return lines.join("\n");
 }
-function updateOpenCodeServant(run, servant, result, timestamp) {
+function markServantsStarting(run, timestamp) {
+  return {
+    ...run,
+    updatedAt: timestamp,
+    servants: run.servants.map((servant) => ({
+      ...servant,
+      state: "starting"
+    }))
+  };
+}
+async function mapWithConcurrency(items, limit, worker) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const workerCount = Math.min(Math.max(1, limit), items.length);
+  await Promise.all(Array.from({ length: workerCount }, async () => {
+    while (true) {
+      const index = nextIndex;
+      nextIndex += 1;
+      if (index >= items.length) return;
+      results[index] = await worker(items[index]);
+    }
+  }));
+  return results;
+}
+function hasCapturedFuguApiText(result) {
+  return result.ok && Boolean(result.text?.trim());
+}
+function updateFuguApiServant(servant, result, timestamp) {
+  const captured = hasCapturedFuguApiText(result);
   return {
     ...servant,
-    state: result.ok ? "ready" : "blocked",
-    opencodeSessionId: result.sessionId ?? servant.opencodeSessionId,
-    lastAckAt: result.ok ? timestamp : servant.lastAckAt,
-    lastUsefulSignalAt: result.ok ? timestamp : servant.lastUsefulSignalAt,
+    state: captured ? "ready" : "blocked",
+    llmModel: result.model ?? servant.llmModel,
+    llmMessages: result.messages ?? servant.llmMessages,
+    llmRequestId: result.requestId ?? servant.llmRequestId,
+    lastAckAt: captured ? timestamp : servant.lastAckAt,
+    lastUsefulSignalAt: captured ? timestamp : servant.lastUsefulSignalAt,
     lastEventAt: timestamp,
-    lastMessageCompletedAt: result.ok ? timestamp : servant.lastMessageCompletedAt
+    lastMessageCompletedAt: captured ? timestamp : servant.lastMessageCompletedAt
+  };
+}
+function defaultSleep3(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
+}
+function fuguApiRetryConfig(sleep) {
+  const parsed = Number(process.env.MMI_OVERLORD_LLM_MAX_ATTEMPTS);
+  const maxAttempts = Number.isFinite(parsed) && parsed >= 1 ? Math.min(Math.trunc(parsed), 6) : FUGU_API_DEFAULT_MAX_ATTEMPTS;
+  return { maxAttempts, baseDelayMs: FUGU_API_RETRY_BASE_MS, sleep };
+}
+function fuguApiBackoffMs(attempt, baseDelayMs) {
+  const exponential = baseDelayMs * 2 ** (attempt - 1);
+  const capped = Math.min(exponential, FUGU_API_RETRY_CAP_MS);
+  const jitter = Math.random() * capped * 0.25;
+  return Math.round(capped + jitter);
+}
+async function callFuguApiRunner(runFuguApi, run, servant, message, retry, callOptions) {
+  const maxAttempts = Math.max(1, retry?.maxAttempts ?? 1);
+  const baseDelayMs = retry?.baseDelayMs ?? FUGU_API_RETRY_BASE_MS;
+  const sleep = retry?.sleep ?? defaultSleep3;
+  let attempt = 0;
+  for (; ; ) {
+    attempt += 1;
+    let result;
+    try {
+      result = await runFuguApi(run, servant, message, callOptions);
+    } catch (e) {
+      result = { ok: false, error: e instanceof Error ? e.message : String(e), retryable: true };
+    }
+    if (result.ok || !result.retryable || attempt >= maxAttempts) {
+      return { ...result, attempts: attempt };
+    }
+    await sleep(fuguApiBackoffMs(attempt, baseDelayMs));
+  }
+}
+function seedLazyServant(servant, run, timestamp) {
+  const config = fuguApiConfig();
+  const llmMessages = servant.llmMessages ?? [{ role: "system", content: fuguApiSystemMessage(servant, run) }];
+  return {
+    ...servant,
+    state: "ready",
+    llmModel: fuguApiModelForServant(config, servant),
+    llmMessages,
+    lastAckAt: timestamp,
+    lastUsefulSignalAt: timestamp,
+    lastEventAt: timestamp
   };
 }
-function startOpenCodeServants(run, runOpenCode, now) {
+async function startFuguApiServants(run, runFuguApi, now, retry) {
+  const startupCallOptions = { timeoutMs: fuguApiStartupTimeoutMs() };
+  const verifiedTargets = run.servants.filter((servant) => servant.role !== "ultra");
+  const results = await mapWithConcurrency(verifiedTargets, overlordServantParallelism(), async (servant) => ({
+    servant,
+    result: await callFuguApiRunner(runFuguApi, run, servant, overlordServantPrompt(servant, run), retry, startupCallOptions)
+  }));
   const timestamp = isoNow(now);
-  const servants = run.servants.map((servant) => {
-    const result = runOpenCode(run, servant, overlordServantPrompt(servant, run));
-    if (run.ledgerPath) appendOverlordLedger(run.ledgerPath, { at: timestamp, kind: "servant-start", ownerSlotId: servant.slotId, ok: result.ok, sessionId: result.sessionId, responseText: result.text, error: result.error });
-    return updateOpenCodeServant(run, servant, result, timestamp);
-  });
+  const bySlot = /* @__PURE__ */ new Map();
+  for (const { servant, result } of results) {
+    bySlot.set(servant.slotId, result);
+    if (run.ledgerPath) appendOverlordLedger(run.ledgerPath, { at: timestamp, kind: "servant-start", ownerSlotId: servant.slotId, ok: hasCapturedFuguApiText(result), model: result.model, requestId: result.requestId, responseText: result.text, error: result.error, usage: result.usage });
+    appendServantJournal(servant.journalPath, "consultation", result.text, timestamp);
+  }
+  const servants = run.servants.map((servant) => servant.role === "ultra" ? seedLazyServant(servant, run, timestamp) : updateFuguApiServant(servant, bySlot.get(servant.slotId) ?? { ok: false, error: "missing Fugu API result" }, timestamp));
   return { ...run, state: "active", updatedAt: timestamp, servants };
 }
-function dispatchOpenCodeMessage(run, message, runOpenCode, now) {
-  const timestamp = isoNow(now);
+async function dispatchFuguApiMessage(run, message, runFuguApi, now, retry) {
+  const startedAt = isoNow(now);
   const targets = run.servants.filter((servant) => message.target === "all" || servant.slotId === message.target || normalizeServantTarget(servant.name) === message.target);
-  const responses = [];
-  let ok = targets.length > 0;
+  const results = await mapWithConcurrency(targets, overlordServantParallelism(), async (servant) => ({
+    servant,
+    result: await callFuguApiRunner(runFuguApi, run, servant, message.text, retry)
+  }));
+  const completedAt = isoNow(now);
+  const successCount = results.filter(({ result }) => hasCapturedFuguApiText(result)).length;
+  const failureCount = Math.max(0, targets.length - successCount);
+  const state = targets.length > 0 && failureCount === 0 ? "completed" : successCount > 0 && message.target === "all" ? "partial" : "failed";
+  const responses = results.filter(({ result }) => result.text).map(({ servant, result }) => `${servant.slotId}: ${result.text}`);
+  const servantResults = results.map(({ servant, result }) => {
+    if (hasCapturedFuguApiText(result)) {
+      const warning = formatHandoffWarnings(validateServantReport(result.text ?? ""));
+      return {
+        slotId: servant.slotId,
+        state: "completed",
+        responseText: result.text?.trim(),
+        handoffWarnings: warning ? [warning] : void 0,
+        usage: result.usage
+      };
+    }
+    return {
+      slotId: servant.slotId,
+      state: "failed",
+      failureReason: result.error ?? "Fugu API servant returned no text"
+    };
+  });
+  const bySlot = /* @__PURE__ */ new Map();
+  for (const { servant, result } of results) {
+    bySlot.set(servant.slotId, result);
+    if (run.ledgerPath) appendOverlordLedger(run.ledgerPath, { at: completedAt, kind: "message-response", messageId: message.id, ownerSlotId: servant.slotId, ok: hasCapturedFuguApiText(result), model: result.model, requestId: result.requestId, responseText: result.text, error: result.error, usage: result.usage });
+    appendServantJournal(servant.journalPath, `message ${message.id}`, result.text, completedAt);
+  }
   const nextServants = run.servants.map((servant) => {
-    if (!targets.some((target) => target.slotId === servant.slotId)) return servant;
-    const result = runOpenCode(run, servant, message.text, servant.opencodeSessionId);
-    if (!result.ok) ok = false;
-    if (result.text) responses.push(`${servant.slotId}: ${result.text}`);
-    if (run.ledgerPath) appendOverlordLedger(run.ledgerPath, { at: timestamp, kind: "message-response", messageId: message.id, ownerSlotId: servant.slotId, ok: result.ok, sessionId: result.sessionId, responseText: result.text, error: result.error });
-    return updateOpenCodeServant(run, servant, result, timestamp);
+    const result = bySlot.get(servant.slotId);
+    return result ? updateFuguApiServant(servant, result, completedAt) : servant;
   });
   const nextMessage = {
     ...message,
-    state: ok ? "completed" : "failed",
-    startedAt: timestamp,
-    completedAt: ok ? timestamp : void 0,
-    failedAt: ok ? void 0 : timestamp,
-    ackText: ok ? "opencode response captured" : void 0,
+    state,
+    startedAt,
+    completedAt: state === "completed" || state === "partial" ? completedAt : void 0,
+    failedAt: state === "failed" ? completedAt : void 0,
+    ackText: state === "completed" ? "Fugu API response captured" : state === "partial" ? "Fugu API partial response captured" : void 0,
     responseText: responses.join("\n"),
-    failureReason: ok ? void 0 : "one or more OpenCode servant calls failed",
-    eventJournalPath: targets.map((target) => target.eventJournalPath).filter(Boolean).join(",")
+    failureReason: state === "completed" ? void 0 : state === "partial" ? `${failureCount} of ${targets.length} Fugu API servant calls failed or returned no text` : "one or more Fugu API servant calls failed or returned no text",
+    servantResults
   };
   return {
     ...run,
-    updatedAt: timestamp,
+    updatedAt: completedAt,
     servants: nextServants,
     messages: [...(run.messages ?? []).filter((m) => m.id !== message.id), nextMessage]
   };
@@ -10464,38 +11098,142 @@ function hasServantTarget(run, target) {
     (servant) => servant.slotId === normalized || normalizeServantTarget(servant.name) === normalized
   );
 }
-function messageProgress(message, now = /* @__PURE__ */ new Date(), timeoutMs = OVERLORD_HANDOFF_TIMEOUT_MS) {
+function messageProgress(message, now = /* @__PURE__ */ new Date(), timeoutMs = OVERLORD_HANDOFF_TIMEOUT_MS, ownerAlive) {
+  if (message.state === "partial") return "partial";
   if (message.completedAt || message.state === "completed") return "completed";
   if (message.failedAt || message.state === "failed") return "failed";
   const startedAt = message.startedAt ?? message.deliveredAt;
   if (!startedAt) return "queued";
   const elapsed = now.getTime() - new Date(startedAt).getTime();
-  return Number.isFinite(elapsed) && elapsed >= timeoutMs ? "stalled" : "started";
+  if (!(Number.isFinite(elapsed) && elapsed >= timeoutMs)) return "started";
+  return ownerAlive === false ? "orphaned" : "stalled";
+}
+function messageElapsedMs(message, now = /* @__PURE__ */ new Date()) {
+  const startedAt = message.startedAt ?? message.deliveredAt;
+  if (!startedAt) return void 0;
+  const elapsed = now.getTime() - new Date(startedAt).getTime();
+  return Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : void 0;
+}
+function reconcileOverlordRun(run, ownerAlive, now = /* @__PURE__ */ new Date()) {
+  let changed = 0;
+  const messages = (run.messages ?? []).map((message) => {
+    if (messageProgress(message, now, OVERLORD_HANDOFF_TIMEOUT_MS, ownerAlive) === "orphaned") {
+      changed += 1;
+      return {
+        ...message,
+        state: "failed",
+        failedAt: now.toISOString(),
+        failureReason: message.failureReason ?? "orphaned: Overlord controller is not alive"
+      };
+    }
+    return message;
+  });
+  return changed > 0 ? { run: { ...run, messages }, changed } : { run, changed: 0 };
 }
 function servantProgress(run, servant, now = /* @__PURE__ */ new Date()) {
   const relevant = (run.messages ?? []).filter((message) => message.target === "all" || servant.slotId === message.target || normalizeServantTarget(servant.name) === message.target);
-  return relevant.some((message) => messageProgress(message, now) === "stalled") ? "stalled-after-delivery" : servant.state;
+  return relevant.some((message) => {
+    const progress = messageProgress(message, now);
+    return progress === "stalled" || progress === "orphaned";
+  }) ? "stalled-after-delivery" : servant.state;
+}
+function humanSafeText(text, maxLength = 160) {
+  const redacted = (text ?? "").replace(/\bBearer\s+\S+/gi, "[redacted]").replace(/\b(api[_-]?key|token|secret)=\S+/gi, "$1=[redacted]").replace(/\b(sk|sakana|mmi)[-_][A-Za-z0-9_-]{10,}\b/g, "[redacted]").replace(/\s+/g, " ").trim();
+  if (redacted.length <= maxLength) return redacted;
+  return `${redacted.slice(0, Math.max(0, maxLength - 3)).trimEnd()}...`;
+}
+function renderOverlordSendSummary(message, statePath) {
+  const results = message?.servantResults ?? [];
+  const completed = results.filter((result) => result.state === "completed").length;
+  const blocked = results.filter((result) => result.state === "failed").length;
+  const state = message?.state ?? "failed";
+  const lines = [
+    `Message: ${message?.id ?? "unknown"}`,
+    `Target: ${message?.target ?? "unknown"}`,
+    `Result: ${state} - ${completed} completed, ${blocked} blocked.`
+  ];
+  for (const result of results.filter((item) => item.state === "failed").slice(0, 3)) {
+    lines.push(`Blocked: ${result.slotId} - ${humanSafeText(result.failureReason ?? "no reason reported")}`);
+  }
+  const hidden = Math.max(0, blocked - 3);
+  if (hidden > 0) lines.push(`Blocked: +${hidden} more`);
+  lines.push(`State: ${statePath}`);
+  return lines.join("\n");
 }
-function renderOverlordStatus(summary, run) {
-  const servants = summary.servants.map((servant) => `- ${servant.name}: ${servant.state}`).join("\n");
-  const messages = (run.messages ?? []).map((message) => `- ${message.id}: ${message.target} ${messageProgress(message)}`).join("\n");
+function countValues(values, value) {
+  return values.filter((item) => item === value).length;
+}
+function latestServantFailureReason(run, slotId) {
+  for (const message of [...run.messages ?? []].reverse()) {
+    const result = message.servantResults?.find((item) => item.slotId === slotId && item.state === "failed");
+    if (result?.failureReason?.trim()) return result.failureReason;
+  }
+  return void 0;
+}
+function affectedServantStatusLabel(state, reason) {
+  if (state === "stalled-after-delivery") return "Stalled";
+  if (/\btimed?\s*out\b/i.test(reason ?? "")) return "Timed out";
+  return "Blocked";
+}
+function renderOverlordStatus(summary, run, now = /* @__PURE__ */ new Date()) {
+  const servantStates = summary.servants.map((servant) => servant.state);
+  const messageStates = (run.messages ?? []).map((message) => messageProgress(message, now));
+  const activeMessages = messageStates.filter((state) => state === "queued" || state === "started" || state === "stalled").length;
+  const blockedServants = summary.servants.filter((servant) => servant.state === "blocked" || servant.state === "stalled-after-delivery");
+  const latest = (run.messages ?? []).at(-1);
+  const latestState = latest ? messageProgress(latest, now) : void 0;
   return [
     `Overlord run ${summary.runId}`,
     `State: ${summary.state}`,
-    `Task: ${run.task || "not provided yet"}`,
-    `Controller: ${summary.controller}`,
-    "Servants:",
-    servants,
-    ...messages ? ["Messages:", messages] : []
+    `Mission: ${humanSafeText(run.task || "not provided yet")}`,
+    `Servants: ${countValues(servantStates, "ready")} ready, ${countValues(servantStates, "blocked") + countValues(servantStates, "stalled-after-delivery")} blocked, ${countValues(servantStates, "planned")} planned.`,
+    `Messages: ${countValues(messageStates, "completed")} completed, ${countValues(messageStates, "partial")} partial, ${countValues(messageStates, "failed")} failed, ${activeMessages} active.`,
+    ...blockedServants.slice(0, 3).map((servant) => {
+      const slotId = run.servants.find((item) => item.name === servant.name)?.slotId;
+      const reason = slotId ? latestServantFailureReason(run, slotId) : void 0;
+      const label = affectedServantStatusLabel(servant.state, reason);
+      const detail = reason ?? (servant.state === "stalled-after-delivery" ? "no recent update" : void 0);
+      return `${label}: ${servant.name}${detail ? ` - ${humanSafeText(detail)}` : ""}`;
+    }),
+    ...blockedServants.length > 3 ? [`Blocked: +${blockedServants.length - 3} more`] : [],
+    ...latest && latestState ? [`Latest: ${latest.id} ${latest.target} ${latestState}${latest.failureReason ? ` - ${humanSafeText(latest.failureReason)}` : ""}`] : [],
+    `Coordinator: ${summary.controller}`
   ].join("\n");
 }
 function usefulJournalLines(text) {
   return text.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !/^fugu\s/i.test(line) && !/^›/.test(line) && !/^\[overlord\] launched/.test(line)).slice(-20);
 }
+var HANDOFF_SIGNAL = /\b(handoff|evidence|recommend(?:ed|ation|s)?|improvement|suggest(?:ion|s)?|next action|proposal|file)\b|`[^`]+`/i;
+var HANDOFF_MIN_RESPONSE_CHARS = 12;
+function parseJournalBlocks(raw) {
+  const blocks = [];
+  let current = null;
+  for (const line of raw.split(/\r?\n/)) {
+    const header = line.match(/^\[[^\]]+\]\s+(.+)$/);
+    if (header) {
+      if (current) blocks.push(current);
+      current = { label: header[1].trim(), body: "" };
+    } else if (current) {
+      current.body += (current.body ? "\n" : "") + line;
+    }
+  }
+  if (current) blocks.push(current);
+  return blocks;
+}
+function journalHasHandoff(raw, lines) {
+  for (const block of parseJournalBlocks(raw)) {
+    if (!block.label.startsWith("message ")) continue;
+    const body = block.body.trim();
+    if (body.length >= HANDOFF_MIN_RESPONSE_CHARS) return true;
+    if (validateServantReport(body).applies) return true;
+  }
+  return lines.some((line) => HANDOFF_SIGNAL.test(line));
+}
 function servantJournalSummary(servant) {
   try {
-    const lines = usefulJournalLines((0, import_node_fs15.readFileSync)(servant.journalPath, "utf8"));
-    return { lines, hasHandoff: lines.some((line) => /\b(handoff|evidence|recommended|recommendation)\b/i.test(line)) };
+    const raw = (0, import_node_fs15.readFileSync)(servant.journalPath, "utf8");
+    const lines = usefulJournalLines(raw);
+    return { lines, hasHandoff: journalHasHandoff(raw, lines) };
   } catch {
     return { lines: [], hasHandoff: false };
   }
@@ -10519,7 +11257,11 @@ function runJson(run, extra = {}) {
       pid: servant.pid,
       journalPath: servant.journalPath,
       engine: servant.engine,
-      opencodeSessionId: servant.opencodeSessionId
+      opencodeSessionId: servant.opencodeSessionId,
+      scopeToken: servant.scopeToken,
+      llmModel: servant.llmModel,
+      llmRequestId: servant.llmRequestId,
+      llmConversationLength: servant.llmMessages?.length
     })),
     ...extra
   };
@@ -10530,27 +11272,33 @@ function wantsJson(options, command) {
 function countArgsFromOptions(options) {
   return ["3", "4", "5", "6"].filter((key) => options[key]).map((key) => `--${key}`);
 }
+function percentile(values, p) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const rank = Math.ceil(p / 100 * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
 function registerOverlordCommands(program3, deps = {}) {
   const out = deps.out ?? ((text) => process.stdout.write(text));
   const err = deps.err ?? ((text) => process.stderr.write(text));
   const cwd = deps.cwd ?? (() => process.cwd());
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
-  const preflight2 = deps.preflight ?? collectCodexFuguPreflight;
-  const opencodePreflight = deps.opencodePreflight ?? collectOpenCodePreflight;
-  const startController = deps.startController ?? defaultStartController;
-  const runOpenCode = deps.runOpenCode ?? defaultRunOpenCode;
+  const fuguApiPreflight = deps.fuguApiPreflight ?? collectFuguApiPreflight;
+  const runFuguApi = deps.runFuguApi ?? defaultRunFuguApi;
+  const fuguApiRetry = fuguApiRetryConfig(deps.sleep ?? defaultSleep3);
   const isPidAlive = deps.isPidAlive ?? defaultIsPidAlive;
   const killPid = deps.killPid ?? defaultKillPid;
-  const overlord = program3.command("overlord").description("coordinate one Ultra and normal Fugu servants for hard org work").allowUnknownOption(true).argument("[task...]", "task for the Overlord system").option("--3", "run one Ultra and two normal Fugus").option("--4", "run one Ultra and three normal Fugus").option("--5", "run one Ultra and four normal Fugus").option("--6", "run one Ultra and five normal Fugus").option("--engine <engine>", "servant engine: opencode or codex-fugu", "codex-fugu").option("--json", "print machine-readable output").action((task = [], options) => {
+  const overlord = program3.command("overlord").description("coordinate one Ultra and normal Fugu servants for hard org work").allowUnknownOption(true).argument("[task...]", "task for the Overlord system").option("--3", "run one Ultra and two normal Fugus").option("--4", "run one Ultra and three normal Fugus").option("--5", "run one Ultra and four normal Fugus").option("--6", "run one Ultra and five normal Fugus").option("--engine <engine>", "servant engine: fugu-api", OVERLORD_DEFAULT_ENGINE).option("--json", "print machine-readable output").action(async (task = [], options) => {
     try {
       const args = [...countArgsFromOptions(options), ...task];
       const root = cwd();
       const plan2 = buildOverlordStartupPlan(args, root);
-      const engine = `${options.engine ?? "codex-fugu"}`;
-      if (engine !== "codex-fugu" && engine !== "opencode") throw new Error("--engine must be opencode or codex-fugu");
-      const preflightReport = engine === "opencode" ? opencodePreflight() : preflight2();
+      const engine = `${options.engine ?? OVERLORD_DEFAULT_ENGINE}`;
+      if (engine !== "fugu-api") throw new Error("--engine must be fugu-api");
+      if (!options.json) out("Starting Overlord...\n");
+      const preflightReport = await fuguApiPreflight();
       if (!preflightReport.ok) {
-        err(`${renderCodexFuguPreflightFailure(preflightReport)}
+        err(`${renderOverlordPreflightFailure(preflightReport)}
 `);
         process.exitCode = 1;
         return;
@@ -10570,30 +11318,20 @@ function registerOverlordCommands(program3, deps = {}) {
         runToken: deps.runToken
       });
       writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
-      if (engine === "opencode") {
-        run = startOpenCodeServants(run, runOpenCode, now);
-        writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
-      } else {
-        const controller = startController(run);
-        if (controller.pid != null) {
-          run = recordOverlordHeartbeat(run, {
-            controllerPid: controller.pid,
-            fingerprint: controller.fingerprint,
-            now
-          });
-          writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
-        }
-      }
+      if (!options.json) out(`Spawning ${run.servants.length} Fugu (1 ultra, ${run.servants.length - 1} normal)...
+`);
+      run = markServantsStarting(run, isoNow(now));
+      writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
+      run = await startFuguApiServants(run, runFuguApi, now, fuguApiRetry);
+      writeOverlordRegistry(plan2.statePath, { activeRunId: run.runId, runs: { ...registry2.runs, [run.runId]: run } });
       if (options.json) out(`${JSON.stringify(runJson(run, { nextPhase: "consult-servants" }), null, 2)}
 `);
       else {
+        const ready = run.servants.filter((servant) => servant.state === "ready").length;
         out(`${[
-          "Overlord startup",
-          `Task: ${run.task || "not provided yet"}`,
-          `Run: ${run.runId}`,
-          `Servants: ${run.servants.length} total`,
-          `Controller: ${run.controllerPid ? `started (pid ${run.controllerPid})` : "launch requested"}`,
-          "Next: consult servants, interview the human, then print an approved todo list."
+          `Ready: ${ready}/${run.servants.length}.`,
+          `Mission: ${humanSafeText(run.task || "not provided yet")}`,
+          `Run: ${run.runId}`
         ].join("\n")}
 `);
       }
@@ -10606,7 +11344,7 @@ function registerOverlordCommands(program3, deps = {}) {
       process.exitCode = 1;
     }
   });
-  overlord.command("send").description("queue an assignment or redirect for the active Overlord servant controller").argument("<target>", "servant slot id/name, or all").argument("[message...]", "message to deliver to the servant PTY").option("--json", "print machine-readable output").action((target, message = [], options, command) => {
+  overlord.command("send").description("queue an assignment or redirect for active Overlord servant conversations").argument("<target>", "servant slot id/name, or all").argument("[message...]", "message to deliver to the servant session").option("--message-file <path>", "read the message from a UTF-8 file, or - for stdin (prefer a path; #1511)").option("--json", "print machine-readable output").action(async (target, message = [], options, command) => {
     const json = wantsJson(options, command);
     try {
       const statePath = defaultOverlordStatePath(cwd());
@@ -10615,8 +11353,9 @@ function registerOverlordCommands(program3, deps = {}) {
       if (!run) throw new Error("no active Overlord run found");
       const normalized = normalizeServantTarget(target);
       if (!hasServantTarget(run, normalized)) throw new Error(`unknown Overlord servant target: ${target}`);
-      const text = message.join(" ").trim();
-      if (!text) throw new Error("message is required");
+      const text = resolveOverlordSendMessage(message, typeof options.messageFile === "string" ? options.messageFile : void 0);
+      if (!text) throw new Error("message is required (pass it inline or via --message-file)");
+      if (run.engine !== "fugu-api") throw new Error("active Overlord run does not use the fugu-api engine");
       const timestamp = isoNow(now);
       const queued = {
         id: deps.runId?.() ?? defaultMessageId(),
@@ -10626,35 +11365,26 @@ function registerOverlordCommands(program3, deps = {}) {
         queuedAt: timestamp,
         state: "queued"
       };
-      if (run.engine === "opencode") {
-        const dispatched = dispatchOpenCodeMessage(run, queued, runOpenCode, now);
-        writeOverlordRegistry(statePath, { ...registry2, runs: { ...registry2.runs, [run.runId]: dispatched } });
-        const settled = (dispatched.messages ?? []).find((m) => m.id === queued.id);
-        const ok = settled?.state === "completed";
-        const payload2 = { ok, runId: run.runId, target: normalized, messageId: queued.id, state: settled?.state, responseText: settled?.responseText, statePath };
-        if (json) out(`${JSON.stringify(payload2, null, 2)}
+      if (!json) out(`Sending assignment to ${normalized}...
+Awaiting Fugu responses...
 `);
-        else out(`Message ${queued.id} ${ok ? "completed" : "failed"} for ${normalized}.
-State: ${statePath}
-`);
-        if (!ok) process.exitCode = 1;
-        return;
-      }
-      const next = {
-        ...run,
+      const startedMessage = { ...queued, state: "started", startedAt: timestamp };
+      const started = persistRunMutation(statePath, run.runId, (fresh) => ({
+        ...fresh,
         updatedAt: timestamp,
-        messages: [...run.messages ?? [], queued]
-      };
-      writeOverlordRegistry(statePath, {
-        ...registry2,
-        runs: { ...registry2.runs, [run.runId]: next }
-      });
-      const payload = { queued: 1, runId: run.runId, target: normalized, messageId: queued.id, statePath };
+        messages: [...(fresh.messages ?? []).filter((m) => m.id !== queued.id), startedMessage]
+      }));
+      const dispatched = await dispatchFuguApiMessage(started, queued, runFuguApi, now, fuguApiRetry);
+      const settled = (dispatched.messages ?? []).find((m) => m.id === queued.id);
+      const affected = computeAffectedSlots(dispatched.servants, normalized, settled);
+      persistRunMutation(statePath, run.runId, (fresh) => mergeConcurrentDispatch(fresh, dispatched, settled, affected, queued.id));
+      const ok = settled?.state === "completed" || settled?.state === "partial";
+      const payload = { ok, runId: run.runId, target: normalized, messageId: queued.id, state: settled?.state, responseText: settled?.responseText, failureReason: settled?.failureReason, servantResults: settled?.servantResults, statePath };
       if (json) out(`${JSON.stringify(payload, null, 2)}
 `);
-      else out(`Queued message ${queued.id} for ${normalized}.
-State: ${statePath}
+      else out(`${renderOverlordSendSummary(settled, statePath)}
 `);
+      if (!ok) process.exitCode = 1;
     } catch (e) {
       const messageText = e instanceof Error ? e.message : String(e);
       if (json) out(`${JSON.stringify({ ok: false, error: messageText }, null, 2)}
@@ -10680,10 +11410,13 @@ State: ${payload2.statePath}
     }
     const summary = summarizeOverlordRun(run, { isPidAlive, now });
     const current = now();
+    const ownerAlive = summary.controller !== "lost";
+    const { run: reconciledRun, changed } = reconcileOverlordRun(run, ownerAlive, current);
+    if (changed > 0) persistRunMutation(statePath, run.runId, (fresh) => reconcileOverlordRun(fresh, ownerAlive, current).run);
     const payload = {
       ...summary,
       statePath,
-      task: run.task,
+      task: reconciledRun.task,
       engine: run.engine,
       ledgerPath: run.ledgerPath,
       sessions: run.servants.map((servant) => ({
@@ -10691,14 +11424,20 @@ State: ${payload2.statePath}
         slotId: servant.slotId,
         engine: servant.engine,
         opencodeSessionId: servant.opencodeSessionId,
+        scopeToken: servant.scopeToken,
+        llmModel: servant.llmModel,
+        llmRequestId: servant.llmRequestId,
+        llmConversationLength: servant.llmMessages?.length,
         eventJournalPath: servant.eventJournalPath,
         lastEventAt: servant.lastEventAt,
         lastMessageCompletedAt: servant.lastMessageCompletedAt
       })),
-      messages: (run.messages ?? []).map((message) => ({
+      messages: (reconciledRun.messages ?? []).map((message) => ({
         id: message.id,
         target: message.target,
-        state: messageProgress(message, current),
+        state: messageProgress(message, current, OVERLORD_HANDOFF_TIMEOUT_MS, ownerAlive),
+        elapsedMs: messageElapsedMs(message, current),
+        boundMs: OVERLORD_HANDOFF_TIMEOUT_MS,
         queuedAt: message.queuedAt ?? message.createdAt,
         startedAt: message.startedAt ?? message.deliveredAt,
         completedAt: message.completedAt,
@@ -10711,7 +11450,7 @@ State: ${payload2.statePath}
     };
     if (json) out(`${JSON.stringify(payload, null, 2)}
 `);
-    else out(`${renderOverlordStatus(summary, run)}
+    else out(`${renderOverlordStatus(summary, reconciledRun, current)}
 State: ${statePath}
 `);
   });
@@ -10794,17 +11533,128 @@ State: ${payload2.statePath}
 `);
     }
   });
+  overlord.command("canary").description("native Fugu API smoke: summon a small pool, verify a bounded response, stop cleanly").option("--3", "one Ultra and two normal Fugus").option("--4", "one Ultra and three normal Fugus").option("--5", "one Ultra and four normal Fugus").option("--6", "one Ultra and five normal Fugus").option("--json", "print machine-readable output").option("--repeat <n>", "run the smoke N times and report p50/p90 elapsed latency", "1").action(async (options, command) => {
+    const json = wantsJson(options, command);
+    const repeat = Math.min(Math.max(1, Math.trunc(Number(options.repeat) || 1)), 20);
+    const countArgs = countArgsFromOptions(options);
+    try {
+      if (!json) out("Overlord canary starting.\nChecking Fugu API...\n");
+      const preflight2 = await fuguApiPreflight();
+      if (!preflight2.ok) {
+        if (json) out(`${JSON.stringify({ ok: false, phase: "preflight", problems: preflight2.problems }, null, 2)}
+`);
+        else err(`${renderOverlordPreflightFailure(preflight2)}
+`);
+        process.exitCode = 1;
+        return;
+      }
+      const runOnce = async (verbose) => {
+        const startedAtMs = now().getTime();
+        const plan2 = buildOverlordStartupPlan(countArgs, cwd());
+        let run = buildOverlordRun({ task: "overlord canary smoke", cwd: cwd(), count: plan2.count, engine: "fugu-api", now, runId: deps.runId, runToken: deps.runToken });
+        if (verbose) out(`Summoning ${run.servants.length} Fugu servants...
+`);
+        run = markServantsStarting(run, isoNow(now));
+        run = await startFuguApiServants(run, runFuguApi, now, fuguApiRetry);
+        const ready = run.servants.filter((servant) => servant.state === "ready").length;
+        const problems = [];
+        let responded = 0;
+        let evidence;
+        if (ready === run.servants.length) {
+          if (verbose) out("Sending canary probe...\n");
+          const timestamp = isoNow(now);
+          const probe = {
+            id: `${deps.runId?.() ?? defaultMessageId()}-canary`,
+            target: "all",
+            text: "Reply with the single word READY and nothing else.",
+            createdAt: timestamp,
+            queuedAt: timestamp,
+            state: "queued"
+          };
+          run = await dispatchFuguApiMessage(run, probe, runFuguApi, now, fuguApiRetry);
+          const settled = (run.messages ?? []).find((message) => message.id === probe.id);
+          const results = settled?.servantResults ?? [];
+          responded = results.filter((result) => result.state === "completed" && result.responseText?.trim()).length;
+          evidence = results.find((result) => result.responseText?.trim())?.responseText?.trim();
+          if (responded !== run.servants.length) problems.push(`only ${responded}/${run.servants.length} servants returned text`);
+        } else {
+          problems.push(`only ${ready}/${run.servants.length} servants became ready`);
+        }
+        const stopPlan = planOverlordRunStop(run);
+        for (const pid of stopPlan.killPids) {
+          try {
+            killPid(pid);
+          } catch {
+          }
+        }
+        const cleanup = { stopped: stopPlan.killPids.length, uncertain: stopPlan.uncertain.length };
+        if (cleanup.uncertain > 0) problems.push(`${cleanup.uncertain} uncertain resource(s) left untouched`);
+        return { ok: problems.length === 0, runId: run.runId, requested: run.servants.length, ready, responded, elapsedMs: Math.max(0, now().getTime() - startedAtMs), evidence, cleanup, problems };
+      };
+      const runs = [];
+      for (let i = 0; i < repeat; i += 1) {
+        if (!json && repeat > 1) out(`Canary run ${i + 1}/${repeat}...
+`);
+        runs.push(await runOnce(!json && repeat === 1));
+      }
+      if (repeat === 1) {
+        const r = runs[0];
+        if (json) out(`${JSON.stringify({ ok: r.ok, runId: r.runId, requested: r.requested, ready: r.ready, responded: r.responded, elapsedMs: r.elapsedMs, evidence: r.evidence, cleanup: r.cleanup, problems: r.problems }, null, 2)}
+`);
+        else out(`${[
+          r.ok ? "Canary OK." : "Canary FAILED.",
+          `Ready: ${r.ready}/${r.requested}; Responded: ${r.responded}/${r.requested}`,
+          `Cleanup: stopped ${r.cleanup.stopped}, uncertain ${r.cleanup.uncertain}`,
+          ...r.problems.length ? [`Problems: ${r.problems.join("; ")}`] : []
+        ].join("\n")}
+`);
+        if (!r.ok) process.exitCode = 1;
+        return;
+      }
+      const elapsed = runs.map((r) => r.elapsedMs);
+      const passes = runs.filter((r) => r.ok).length;
+      const requested = runs[0].requested;
+      const ok = passes === runs.length;
+      const summary = {
+        ok,
+        repeat,
+        passes,
+        requested,
+        elapsedMs: { p50: percentile(elapsed, 50), p90: percentile(elapsed, 90), min: Math.min(...elapsed), max: Math.max(...elapsed) },
+        readyRate: runs.reduce((sum, r) => sum + r.ready, 0) / (runs.length * requested),
+        respondedRate: runs.reduce((sum, r) => sum + r.responded, 0) / (runs.length * requested),
+        problems: runs.flatMap((r, i) => r.problems.map((problem) => `run ${i + 1}: ${problem}`))
+      };
+      if (json) out(`${JSON.stringify(summary, null, 2)}
+`);
+      else out(`${[
+        ok ? `Canary bench OK (${passes}/${repeat} passed).` : `Canary bench: ${passes}/${repeat} passed.`,
+        `Elapsed p50 ${summary.elapsedMs.p50}ms, p90 ${summary.elapsedMs.p90}ms (min ${summary.elapsedMs.min}, max ${summary.elapsedMs.max})`,
+        `Ready rate ${(summary.readyRate * 100).toFixed(0)}%, responded rate ${(summary.respondedRate * 100).toFixed(0)}%`,
+        ...summary.problems.length ? [`Problems: ${summary.problems.join("; ")}`] : []
+      ].join("\n")}
+`);
+      if (!ok) process.exitCode = 1;
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      if (json) out(`${JSON.stringify({ ok: false, error: message }, null, 2)}
+`);
+      else err(`overlord canary: ${message}
+`);
+      process.exitCode = 1;
+    }
+  });
   return overlord;
 }
 
 // src/throttle-commands.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_fs16 = require("node:fs");
 var import_node_path14 = require("node:path");
 var THROTTLE_TRACE_REL = (0, import_node_path14.join)(".mmi", "throttle", "trace.jsonl");
 function resolveRepoGitRoot(cwd = process.cwd()) {
   try {
-    const root = (0, import_node_child_process9.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+    const root = (0, import_node_child_process8.execFileSync)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
@@ -10953,7 +11803,7 @@ async function syncDocs(deps, docs2 = SYNCED_DOCS) {
 }
 
 // src/board.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_node_util6 = require("node:util");
 
 // src/board-priority.ts
@@ -11061,7 +11911,7 @@ async function filterDependencyBlockedClaimables(items, client, opts = {}) {
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process9.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
 var CLAIM_CONCURRENCY = 5;
@@ -12524,6 +13374,8 @@ var MANAGED_GITIGNORE_LINES = [
   // Plan scratch at ANY depth (root plans/, cli/plans/, .cursor/plans/) — AI planning docs are S3-synced
   // via `mmi-cli northstar push` / auto-save on write; never git-tracked (AGENTS.md "Repo cleanliness", #1550, #1842).
   "**/plans/",
+  // Superpowers plan/spec output is scratch too; authoritative docs live directly under docs/.
+  "docs/superpowers/",
   ".playwright-mcp/",
   ".claude/worktrees/",
   // .mmi is agent/CI scratch — ignore the WHOLE tree at any depth (root + cli/.mmi, .github/workflows/.mmi,
@@ -13471,9 +14323,9 @@ async function resolveAutoAddBoardAttach(client, cfg, selector, priority, warn =
 
 // src/gh-create.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_os4 = require("node:os");
+var import_node_os3 = require("node:os");
 var import_node_path17 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var ISSUE_TYPES = ["bug", "feature", "task"];
 var GH_MUTATION_TIMEOUT_MS = 12e4;
 function timeoutKillNote(err, timeoutMs) {
@@ -13513,7 +14365,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   } };
   const write = deps.write ?? import_promises5.writeFile;
   const remove = deps.remove ?? import_promises5.unlink;
-  const file = (0, import_node_path17.join)(deps.dir ?? (0, import_node_os4.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
+  const file = (0, import_node_path17.join)(deps.dir ?? (0, import_node_os3.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
   await write(file, args[i + 1], "utf8");
   return {
     args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
@@ -14726,7 +15578,7 @@ function designSystemSnapshot(root) {
 }
 
 // src/design-system-registry.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs20 = require("node:fs");
 var import_node_path19 = require("node:path");
 var DESIGN_SYSTEM_CACHE_DIR = ".mmi/design-system/components";
@@ -14789,7 +15641,7 @@ function scanCachedComponentNames(cacheDir) {
   return [...names].sort();
 }
 function contentHash(content) {
-  return (0, import_node_crypto6.createHash)("sha256").update(content, "utf8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(content, "utf8").digest("hex");
 }
 function buildRegistryComponentsCheck(input) {
   const base = {
@@ -14949,6 +15801,17 @@ function renderVerifySecrets(body) {
   if (ssmStatus !== "Success") {
     return { lines, failure: `verify-secrets did not complete (ssm status ${ssmStatus})${body?.commandId ? ` \u2014 command ${body.commandId}` : ""}` };
   }
+  if (secrets.length === 0) {
+    const raw = (body?.raw ?? "").trim();
+    if (/no required runtime secrets declared/i.test(raw)) {
+      return { lines: [raw], failure: null };
+    }
+    const detail = raw ? ` \u2014 on-box output: ${raw.replace(/\s+/g, " ").trim()}` : "";
+    return {
+      lines: raw ? raw.split("\n") : ["verify-secrets: no per-key verdicts returned"],
+      failure: `verify-secrets returned no per-key verdicts, so nothing was verified${detail}`
+    };
+  }
   const bad = counts.mismatch + counts.missing;
   if (bad > 0) {
     return { lines, failure: `${bad} of ${secrets.length} required secret(s) not matching the vault (${counts.mismatch} mismatch, ${counts.missing} missing)` };
@@ -14957,12 +15820,12 @@ function renderVerifySecrets(body) {
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -17663,14 +18526,14 @@ function parseKbTree(stdout, prefix) {
 
 // src/northstar-commands.ts
 var import_node_fs22 = require("node:fs");
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var import_promises6 = require("node:fs/promises");
 var planSyncDetached = false;
 function detachPlanSync() {
   if (planSyncDetached) return;
   planSyncDetached = true;
   try {
-    (0, import_node_child_process12.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
+    (0, import_node_child_process11.spawn)(process.execPath, [process.argv[1], "northstar", "sync", "--quiet"], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -17756,12 +18619,13 @@ function openInEditor(path2) {
     return;
   }
   try {
-    (0, import_node_child_process12.spawn)(editor, [path2], { stdio: "inherit" });
+    (0, import_node_child_process11.spawn)(editor, [path2], { stdio: "inherit" });
   } catch {
     console.log(`open ${path2} manually`);
   }
 }
 async function withPlan(quiet, run, io = consoleIo) {
+  if (!await requireContinuityAccess("northstar", { quiet }, io)) return;
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
     if (!quiet) fail("plan: Hub API URL not configured");
@@ -17770,6 +18634,7 @@ async function withPlan(quiet, run, io = consoleIo) {
   await run(makePlanDeps(cfg, io));
 }
 async function runPlanAutosave(io = consoleIo, opts = {}) {
+  if (!await requireContinuityAccess("northstar", { quiet: opts.quiet }, io)) return [];
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) {
     if (!opts.quiet) fail("plan: Hub API URL not configured");
@@ -18776,10 +19641,10 @@ function registerEdgeCommands(program3) {
 
 // src/doctor-run.ts
 var import_node_fs28 = require("node:fs");
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_promises7 = require("node:fs/promises");
 var import_node_path25 = require("node:path");
-var import_node_os6 = require("node:os");
+var import_node_os5 = require("node:os");
 
 // src/plugin-guard.ts
 function buildPluginGuardDecision(i) {
@@ -18799,9 +19664,9 @@ function buildGuardSessionStartLine(state, opts = {}) {
 }
 
 // src/cursor-plugin-seed.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
-var import_node_os5 = require("node:os");
+var import_node_os4 = require("node:os");
 var import_node_path22 = require("node:path");
 var import_node_util7 = require("node:util");
 function isSemverVersion(v) {
@@ -18810,7 +19675,7 @@ function isSemverVersion(v) {
 var MMI_HUB_REPO = "mutmutco/MMI-Hub";
 var CURSOR_THIRD_PARTY_STATE_KEY = "cursor/thirdPartyExtensibilityEnabled";
 var PLUGIN_JSON_REL = ".cursor-plugin/plugin.json";
-var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process13.execFile);
+var execFileBuffer = (0, import_node_util7.promisify)(import_node_child_process12.execFile);
 function gitFetchReleaseTagArgs(hubCheckout, tag) {
   return ["-C", hubCheckout, "fetch", "origin", "tag", tag, "--quiet"];
 }
@@ -18819,13 +19684,13 @@ function ghReleaseTarballApiArgs(tag) {
 }
 function cursorUserGlobalStatePath() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path22.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
+    const base = process.env.APPDATA || (0, import_node_path22.join)((0, import_node_os4.homedir)(), "AppData", "Roaming");
     return (0, import_node_path22.join)(base, "Cursor", "User", "globalStorage", "state.vscdb");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path22.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
+    return (0, import_node_path22.join)((0, import_node_os4.homedir)(), "Library", "Application Support", "Cursor", "User", "globalStorage", "state.vscdb");
   }
-  return (0, import_node_path22.join)((0, import_node_os5.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return (0, import_node_path22.join)((0, import_node_os4.homedir)(), ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 async function readCursorThirdPartyExtensibilityEnabled(execFileP5) {
   const dbPath = cursorUserGlobalStatePath();
@@ -18981,6 +19846,17 @@ function buildContinuityFreshnessCheck(input) {
     fix: `local branch work is newer than ${stale.join(" + ")} continuity; run ${commands.join(" and ")}`
   };
 }
+function buildContinuityRestrictionNotice(input) {
+  const login = input.login?.trim() || "unknown";
+  return {
+    ok: true,
+    label: "saga / North Star continuity (Jervaise-only)",
+    fix: `continuity tools (saga, North Star, /handoff) are restricted to ${CONTINUITY_OWNER_LOGIN}; not available to ${login}. Your durable record is the board issue, PR, git history, and MM-KB. Hooks no-op these verbs for you and SessionStart omits the continuity steps. If stray local continuity state exists (.mmi/.session, .mmi/saga-pending.jsonl), remove it with: mmi-cli gc --scratch --apply (safe: it never touches config.json or a live queue).`
+  };
+}
+function continuityDoctorCheckForLogin(login) {
+  return login?.trim().toLowerCase() === CONTINUITY_OWNER_LOGIN ? "freshness" : "restriction";
+}
 var MMI_PLUGIN_ID = "mmi@mutmutco";
 var LEGACY_MMI_PLUGIN_ID = "mmi@mmi";
 var LEGACY_MMI_MARKETPLACE = "mmi";
@@ -19940,7 +20816,7 @@ function buildBrowserArtifactsCheck(input) {
   };
 }
 var KB_DRIFT_ADVISORY_LABEL = "KB registry-fact drift (advisory)";
-var KB_DRIFT_ADVISORY_FIX = "review kb-drift report on Hub (`node infra/saga-io.mjs get kb-drift/<date>.json`) and kb-keeper weekly digest; registry-owned facts belong in `mmi-cli project get`, not copied literals in MM-KB";
+var KB_DRIFT_ADVISORY_FIX = "review kb-drift report on Hub (`node infra/saga-io.mjs get kb-drift/<date>.json`); registry-owned facts belong in `mmi-cli project get`, not copied literals in MM-KB";
 function buildKbDriftAdvisoryCheck(input) {
   const base = {
     ok: true,
@@ -20423,7 +21299,7 @@ function reexecMmiCli(args) {
       }
     };
     const env = { ...process.env, [DOCTOR_POST_SELF_UPDATE_ENV]: "1" };
-    const child = isWin ? (0, import_node_child_process14.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", env }) : (0, import_node_child_process14.spawn)("mmi-cli", args, { stdio: "inherit", env });
+    const child = isWin ? (0, import_node_child_process13.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", env }) : (0, import_node_child_process13.spawn)("mmi-cli", args, { stdio: "inherit", env });
     child.on("error", () => done(-1));
     child.on("exit", (code) => done(code ?? 0));
   });
@@ -20480,7 +21356,7 @@ async function applyPluginHeal(token, surface, log, opts) {
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path25.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
@@ -20495,13 +21371,13 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
   return {
     isOrgRepo,
     installRecordPresent: hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()),
-    marketplaceClonePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
-    pluginCachePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os6.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
+    marketplaceClonePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "marketplaces", "mutmutco")),
+    pluginCachePresent: (0, import_node_fs28.existsSync)((0, import_node_path25.join)((0, import_node_os5.homedir)(), homeDir, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 function installedPluginSources() {
   return ["claude", "codex"].map((surface) => {
-    const recordPath = (0, import_node_path25.join)((0, import_node_os6.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
+    const recordPath = (0, import_node_path25.join)((0, import_node_os5.homedir)(), `.${surface}`, "plugins", "installed_plugins.json");
     try {
       return { surface, installed: JSON.parse((0, import_node_fs28.readFileSync)(recordPath, "utf8")), recordPath };
     } catch {
@@ -20556,7 +21432,7 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
   }
 }
 function opencodeConfigDir() {
-  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".config", "opencode");
+  return (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".config", "opencode");
 }
 function opencodeConfigPath() {
   return (0, import_node_path25.join)(opencodeConfigDir(), "opencode.jsonc");
@@ -20642,7 +21518,7 @@ function writeOpencodeCommandFiles() {
 function readOpencodeAdapterDiskVersion() {
   const candidates = [
     (0, import_node_path25.join)(opencodeConfigDir(), "node_modules", "@mutmutco", "opencode-mmi", "package.json"),
-    (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
+    (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".cache", "opencode", "node_modules", "@mutmutco", "opencode-mmi", "package.json")
   ];
   for (const path2 of candidates) {
     try {
@@ -20677,13 +21553,13 @@ function opencodePluginVersionsForReport() {
 }
 function opencodeDesktopLogsRoot() {
   if (process.platform === "win32") {
-    const base = process.env.APPDATA || (0, import_node_path25.join)((0, import_node_os6.homedir)(), "AppData", "Roaming");
+    const base = process.env.APPDATA || (0, import_node_path25.join)((0, import_node_os5.homedir)(), "AppData", "Roaming");
     return (0, import_node_path25.join)(base, "ai.opencode.desktop", "logs");
   }
   if (process.platform === "darwin") {
-    return (0, import_node_path25.join)((0, import_node_os6.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
+    return (0, import_node_path25.join)((0, import_node_os5.homedir)(), "Library", "Application Support", "ai.opencode.desktop", "logs");
   }
-  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".config", "ai.opencode.desktop", "logs");
+  return (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".config", "ai.opencode.desktop", "logs");
 }
 function opencodeDesktopBootstrapSnapshot() {
   const root = opencodeDesktopLogsRoot();
@@ -20699,7 +21575,7 @@ function opencodeDesktopBootstrapSnapshot() {
   }
 }
 function opencodeLegacyConfigSnapshot() {
-  const legacyPath = (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".opencode", "opencode.json");
+  const legacyPath = (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".opencode", "opencode.json");
   if (!(0, import_node_fs28.existsSync)(legacyPath)) return {};
   const content = readTextFile(legacyPath);
   if (content == null) return {};
@@ -20720,7 +21596,7 @@ function quarantineOpencodeLegacyConfig(legacyPath) {
   }
 }
 function cursorPluginCacheRoot() {
-  return (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
+  return (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".cursor", "plugins", "cache", "mutmutco", "mmi");
 }
 function cursorPluginCachePinSnapshots() {
   const root = cursorPluginCacheRoot();
@@ -20766,8 +21642,8 @@ function hubCheckoutForCursorSeed() {
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
-    { surface: "codex", root: (0, import_node_path25.join)((0, import_node_os6.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
+    { surface: "claude", root: (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".claude", "plugins", "cache", "mutmutco", "mmi") },
+    { surface: "codex", root: (0, import_node_path25.join)((0, import_node_os5.homedir)(), ".codex", "plugins", "cache", "mutmutco", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
@@ -20831,7 +21707,7 @@ async function clearNestedPluginTreeDir(targetPath) {
   try {
     if (!(0, import_node_fs28.existsSync)(targetPath)) return true;
     if (isWin) {
-      const emptyDir = (0, import_node_path25.join)((0, import_node_os6.tmpdir)(), `mmi-empty-${Date.now()}`);
+      const emptyDir = (0, import_node_path25.join)((0, import_node_os5.tmpdir)(), `mmi-empty-${Date.now()}`);
       (0, import_node_fs28.mkdirSync)(emptyDir, { recursive: true });
       try {
         await robocopyMirrorEmpty(emptyDir, targetPath);
@@ -20869,7 +21745,7 @@ function readTextFile(path2) {
 }
 function playwrightMcpConfigSnapshots() {
   const cwd = process.cwd();
-  const home = (0, import_node_os6.homedir)();
+  const home = (0, import_node_os5.homedir)();
   const candidates = [
     (0, import_node_path25.join)(cwd, ".mcp.json"),
     (0, import_node_path25.join)(cwd, ".cursor", "mcp.json"),
@@ -21382,7 +22258,7 @@ async function runDoctor(opts, io = consoleIo) {
       releasedVersion,
       hubCheckout: hubCheckoutForCursorSeed(),
       execFileP: execFileP2,
-      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path25.join)((0, import_node_os6.tmpdir)(), prefix)),
+      mkdtemp: (prefix) => (0, import_promises7.mkdtemp)((0, import_node_path25.join)((0, import_node_os5.tmpdir)(), prefix)),
       log: (m) => io.err(m)
     });
     if (seeded) {
@@ -21474,15 +22350,19 @@ async function runDoctor(opts, io = consoleIo) {
     }
   }
   if (runExtended && !opts.banner) {
-    const continuity = readContinuityStamp();
-    checks.push(
-      buildContinuityFreshnessCheck({
-        isOrgRepo: Boolean(cfg.sagaApiUrl),
-        latestWorkAt: await latestBranchWorkAt(),
-        lastSagaNoteAt: continuity.lastSagaNoteAt,
-        lastNorthstarAt: latestNorthstarContinuityAt()
-      })
-    );
+    if (continuityDoctorCheckForLogin(login) === "freshness") {
+      const continuity = readContinuityStamp();
+      checks.push(
+        buildContinuityFreshnessCheck({
+          isOrgRepo: Boolean(cfg.sagaApiUrl),
+          latestWorkAt: await latestBranchWorkAt(),
+          lastSagaNoteAt: continuity.lastSagaNoteAt,
+          lastNorthstarAt: latestNorthstarContinuityAt()
+        })
+      );
+    } else {
+      checks.push(buildContinuityRestrictionNotice({ login: login?.trim() }));
+    }
   }
   if (runExtended) {
     const dashboardConsumer = await resolveDashboardConsumer(cfg);
@@ -21580,7 +22460,7 @@ function mergeGuardHook(settings) {
   next.hooks = hooks;
   return next;
 }
-var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path25.join)((0, import_node_os6.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
+var userScopeSettingsPath = (surface = detectSurface(process.env)) => (0, import_node_path25.join)((0, import_node_os5.homedir)(), surface === "codex" ? ".codex" : ".claude", "settings.json");
 function ensureUserScopeGuardHook(opts = {}) {
   const path2 = opts.settingsPath ?? userScopeSettingsPath();
   try {
@@ -21794,7 +22674,7 @@ async function requireFreshTrainCli(commandName) {
   throw new Error(`running mmi-cli ${report.currentVersion} is stale against released ${report.releasedVersion}; run doctor/update first so ${commandName} uses the current train path`);
 }
 var program2 = new Command();
-program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, saga, KB. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
+program2.name("mmi-cli").description("MMI Future CLI \u2014 org rules delivery, Jervaise-only continuity, KB. The engine the plugin SessionStart hook drives.").version(resolveClientVersion()).showHelpAfterError("(run `mmi-cli commands` to list every subcommand + its flags, or `mmi-cli commands --json` to ground against it)");
 async function runRulesSync(opts, io = consoleIo) {
   const cfg = await loadConfig();
   if (isRulesSource(cfg.orgRulesSource)) {
@@ -22037,7 +22917,7 @@ function runWorktreeInstall(command, cwd, quiet) {
   const file = isWin2 ? "cmd.exe" : bin;
   const spawnArgs = isWin2 ? ["/c", bin, ...args] : args;
   return new Promise((resolve6, reject) => {
-    const child = (0, import_node_child_process15.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
+    const child = (0, import_node_child_process14.spawn)(file, spawnArgs, { cwd, stdio: quiet ? "ignore" : "inherit", windowsHide: true });
     const timer = setTimeout(() => {
       try {
         child.kill();
@@ -22255,7 +23135,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process15.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process14.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -22264,7 +23144,7 @@ function scheduleRelatedDiscovery(o) {
   } catch {
   }
 }
-var northstar = program2.command("northstar").description("North Star \u2014 your cross-device plans/SSOTs (S3-backed, git-clean)");
+var northstar = program2.command("northstar").description("North Star \u2014 Jervaise-only cross-device plans/SSOTs (S3-backed, git-clean)");
 registerNorthStarCommands(northstar);
 var plan = program2.command("plan").description("Alias for `northstar` (deprecated \u2014 use `northstar`)");
 plan.hook("preAction", () => {
@@ -22290,7 +23170,7 @@ tenant.command("control <owner/repo> <stage> <action>").description("run bounded
   try {
     const result = await runTenantControl(trainApplyDeps(), { repo, stage: stage2, action, watch: o.watch });
     if (!o.json && action === "verify-secrets" && result.secrets) {
-      const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed" };
+      const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines, failure } = renderVerifySecrets(body);
       for (const line of lines) printLine(line);
       if (failure) return failGraceful(`tenant control ${stage2} verify-secrets: ${failure}`);
@@ -23391,7 +24271,7 @@ async function remoteBranchExists2(branch, options = {}) {
 }
 var COMPOSE_TIMEOUT_MS = 12e4;
 function spawnDeferredGcSweep() {
-  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["gc", "sweep-deferred", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
 }
 async function createDeferredWorktreeStore() {
   try {
@@ -24631,85 +25511,90 @@ program2.command("doctor").description("check onboarding gates and auto-heal CLI
 ));
 program2.command("guard").description("detect a pruned/unresolved MMI plugin on disk; loud one-line stderr at session start").option("--session-start", "run in user-scope SessionStart mode").action((opts) => runGuard({ sessionStart: opts.sessionStart }));
 program2.command("plugin-heal").description("reinstall + re-enable the MMI plugin (recover from a marketplace prune)").action(() => runPluginHeal());
-program2.command("session-start").description("run the SessionStart verbs (rules sync, saga session+show, saga health, whoami, doctor, plan-store check) in one process; docs sync runs detached").action(async () => {
+program2.command("session-start").description("run the SessionStart verbs (rules sync, Jervaise-only continuity, whoami, doctor, plan-store check) in one process; docs sync runs detached").action(async () => {
   if (isInsideRepoSubdir(process.cwd())) {
     console.error("[mmi-hook] session-start: cwd is a repository SUBDIRECTORY \u2014 skipping the SessionStart hook (spine/docs/plan/saga delivery); run it from the repo root.");
     return;
   }
   if (!isOrgRepoRoot(process.cwd())) return;
-  try {
-    const hook = parseHookInput(await readStdin());
-    if (hook.session_id) persistSession(hook.session_id);
-  } catch (e) {
-    console.error(`[mmi-hook] saga session failed: ${e.message}`);
+  const continuityEnabled = (await continuityAccess().catch(() => ({ allowed: false }))).allowed;
+  if (continuityEnabled) {
+    try {
+      const hook = parseHookInput(await readStdin());
+      if (hook.session_id) persistSession(hook.session_id);
+    } catch (e) {
+      console.error(`[mmi-hook] saga session failed: ${e.message}`);
+    }
   }
-  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
   spawnDeferredGcSweep();
   let northstarInjected = false;
-  const { parallel, sequential } = buildSessionStartPlan({
-    rulesSync: (io) => runRulesSync({ quiet: true }, io),
-    sagaShow: (io) => runSagaShow({ quiet: true }, io),
-    handoffOffer: (io) => runHandoffOffer(io, { fast: true }),
-    coopPending: (io) => runCoopPendingBanner(io),
-    northstarContext: async (io) => {
-      const cfg = await loadConfig();
-      if (!cfg.sagaApiUrl) return;
-      const planDeps = makePlanDeps(cfg, io);
-      northstarInjected = await runNorthstarContext(io, {
-        loadPlans: () => scopedPlanList(planDeps),
-        readLocal: (slug) => planDeps.readLocal(slug),
-        // #1812: thread the saga HEAD's North Star anchor (its NEXT slug) into the relevance gate so
-        // the plan the agent is actively on is force-injected even on a generic branch with no token
-        // overlap. fetchSagaHead errors are swallowed via a silent io — a missing/failed HEAD just
-        // falls back to token-overlap scoring, never noises or blocks the banner.
-        gatherSignals: () => gatherRelevanceSignals({
-          anchorSlug: () => fetchSagaHead({ log: () => {
-          }, err: () => {
-          } }).then((h) => h?.anchor?.slug ?? void 0)
-        })
-      });
-    },
-    sagaHealth: (io) => runSagaHealth({ banner: true, quiet: true }, io),
-    // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
-    // when unknown — a missing gh login must not noise or fail the banner.
-    whoami: async (io) => {
-      const report = await resolveWhoami({
-        hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
-        ghLogin: githubLogin
-      });
-      const line = whoamiLine(report);
-      if (line) io.log(line);
-    },
-    boardSlice: (io) => runBoardSlice(io, {
-      loadConfig: () => loadConfigForRepo(),
-      readBoard,
-      // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
-      // never costs banner time and next session's glance renders instantly within budget.
-      scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
-    }),
-    spineReconcile: async (io) => {
-      const cfg = await loadConfig();
-      const isSource = isRulesSource(cfg.orgRulesSource);
-      if (!isSource && !await isOrgRegisteredRepo(cfg)) return;
-      const restored = await restoreDirtyOrgSpineToHead(
-        { run: async (cmd, args) => (await execFileP2(cmd, args, { timeout: GIT_TIMEOUT_MS })).stdout },
-        { isRulesSource: isSource }
-      );
-      if (restored.length) {
-        io.log(`[mmi] reset ${restored.length} org-delivered file(s) to your branch \u2014 pull latest base to refresh (${restored.join(", ")})`);
-      }
+  const { parallel, sequential } = buildSessionStartPlan(
+    {
+      rulesSync: (io) => runRulesSync({ quiet: true }, io),
+      sagaShow: (io) => runSagaShow({ quiet: true }, io),
+      handoffOffer: (io) => runHandoffOffer(io, { fast: true }),
+      coopPending: (io) => runCoopPendingBanner(io),
+      northstarContext: async (io) => {
+        const cfg = await loadConfig();
+        if (!cfg.sagaApiUrl) return;
+        const planDeps = makePlanDeps(cfg, io);
+        northstarInjected = await runNorthstarContext(io, {
+          loadPlans: () => scopedPlanList(planDeps),
+          readLocal: (slug) => planDeps.readLocal(slug),
+          // #1812: thread the saga HEAD's North Star anchor (its NEXT slug) into the relevance gate so
+          // the plan the agent is actively on is force-injected even on a generic branch with no token
+          // overlap. fetchSagaHead errors are swallowed via a silent io — a missing/failed HEAD just
+          // falls back to token-overlap scoring, never noises or blocks the banner.
+          gatherSignals: () => gatherRelevanceSignals({
+            anchorSlug: () => fetchSagaHead({ log: () => {
+            }, err: () => {
+            } }).then((h) => h?.anchor?.slug ?? void 0)
+          })
+        });
+      },
+      sagaHealth: (io) => runSagaHealth({ banner: true, quiet: true }, io),
+      // whoami (#879): surface the resolved human so agents act --for them without asking. Silent
+      // when unknown — a missing gh login must not noise or fail the banner.
+      whoami: async (io) => {
+        const report = await resolveWhoami({
+          hubSession: async () => hubAuthSession({ baseUrl: (await loadConfig()).sagaApiUrl ?? defaultHubUrl(), githubToken }),
+          ghLogin: githubLogin
+        });
+        const line = whoamiLine(report);
+        if (line) io.log(line);
+      },
+      boardSlice: (io) => runBoardSlice(io, {
+        loadConfig: () => loadConfigForRepo(),
+        readBoard,
+        // #1813: warm the slice cache out-of-band (detached, like docs sync) so the ~20s live read
+        // never costs banner time and next session's glance renders instantly within budget.
+        scheduleRefresh: () => spawnDetachedSelf(["board", "slice-refresh", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] })
+      }),
+      spineReconcile: async (io) => {
+        const cfg = await loadConfig();
+        const isSource = isRulesSource(cfg.orgRulesSource);
+        if (!isSource && !await isOrgRegisteredRepo(cfg)) return;
+        const restored = await restoreDirtyOrgSpineToHead(
+          { run: async (cmd, args) => (await execFileP2(cmd, args, { timeout: GIT_TIMEOUT_MS })).stdout },
+          { isRulesSource: isSource }
+        );
+        if (restored.length) {
+          io.log(`[mmi] reset ${restored.length} org-delivered file(s) to your branch \u2014 pull latest base to refresh (${restored.join(", ")})`);
+        }
+      },
+      doctor: (io) => runDoctor({ banner: true }, io)
     },
-    doctor: (io) => runDoctor({ banner: true }, io)
-  });
+    { continuityEnabled }
+  );
   await runSessionStart(parallel, sequential, consoleIo);
-  consoleIo.log(northstarPointer(northstarInjected));
+  for (const line of sessionStartContinuityLines({ continuityEnabled, northstarInjected, cwd: process.cwd() })) consoleIo.log(line);
   consoleIo.log(kbPointer());
-  for (const line of planStoreLines(process.cwd())) consoleIo.log(line);
-  await runPlanAutosave(consoleIo, { quiet: true }).catch(() => void 0);
+  if (continuityEnabled) await runPlanAutosave(consoleIo, { quiet: true }).catch(() => void 0);
   for (const line of scratchGcLines(process.cwd())) consoleIo.log(line);
   const worktreeBanner = worktreeAutoProvisionBanner(process.cwd());
   if (worktreeBanner) {
-    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+    spawnDetachedSelf(["worktree", "setup", "--quiet"], { spawn: import_node_child_process14.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
     consoleIo.log(worktreeBanner);
   }
 });