@overdeck/desktop 0.45.23 → 0.46.0

package/server/{queries-6d7Cdtm7.js → queries-DHJm7bTd.js}

@@ -1,51 +1,54 @@
 import { n as __esmMin, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { B as getProviderEnvSync, Br as getOverdeckHome, C as TIERED_EXECUTION_DIFFICULTIES, D as resolveTieredExecutionEnabled, Ft as resolveProjectForIssue, G as setupCredentialFileAuthSync, Gr as sessionFilePath, H as init_providers, It as writeAgentHarnessModelSync, K as ensureOpenAICompatibleProxyRunning, L as clearCredentialFileAuthSync, Mt as readIssueRecordForWorkspaceSync, Nr as encodeClaudeProjectDir, Nt as readIssueRecordSync, O as resolveTieredExecutionEnabledForIssue, Ot as init_record, Qn as resolveBareNumericIdSync, R as getBuiltInDefaultHarness, S as DEFAULT_TIERED_EXECUTION_CONFIG, T as init_tier_table, Tn as init_projects, Ur as packageRoot, V as getProviderForModelSync, Vr as init_paths, Wr as resolveOhmypiExtensionPath, Yn as init_issue_id, dt as fnv1a32, er as require_dist, et as init_roles, f as loadConfigSync, fn as findProjectByPathSync, ft as init_percent, gn as getIssuePrefix, hr as AGENTS_DIR, in as shouldCommitLegacyWorkspaceArtifacts, ir as FsError, it as getModelCapabilitySync, l as isClaudeCodeChannelsMcpEnabled, lt as resolveModelIdSync, mr as init_errors, nn as init_state_read_home, nr as ClaudeCredentialParseError, ot as hasModelCapabilitySync, q as init_openai_compatible_proxy, st as init_model_capabilities, t as init_config_yaml, tt as resolveModel, u as isTldrEnabledSync, ut as fmix32, vn as getProjectSwarmHotspots, yn as getProjectSync, zn as resolveProjectFromIssueSync } from "./config-yaml-DvyMuOle.js";
-import { a as init_activity_logger, n as emitActivityEntrySync, r as emitActivityTtsSync } from "./activity-logger-DDlOIAML.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CzaSOgul.js";
-import { $ as init_child_env, A as listPaneValues, D as killSession, E as isPaneDead, H as sessionExists, O as killSessionSync, P as listSessionsSync, R as sendEscapeKeyAsync, U as sessionExistsSync, V as sendRawKeystroke, W as setOption, X as BLANKED_PROVIDER_ENV, a as capturePaneSync, c as createSessionSync, i as capturePane, m as exactPaneTarget, s as createSession, w as init_tmux, z as sendKeys } from "./tmux-ftABRAmc.js";
-import { a as init_event_store, i as initEventStore } from "./event-store-tdiY5eDZ.js";
-import { a as OHMYPI_BEHAVIOR, o as getHarnessBehavior } from "./src-U7_kTPEE.js";
-import { D as listOverdeckAgentStatesSync, E as init_agent_state_sync, O as saveOverdeckAgentStateSync, T as getOverdeckAgentStateSync, h as resetPipelineVerdictsForWorkStartSync, l as init_review_status } from "./review-status-A7quS5KJ.js";
-import { i as countAgentsByStatus, o as init_agents$1 } from "./agents-B4Bjbkfv.js";
-import { n as ensureSessionContextBriefingFile, r as init_briefing_freshness } from "./briefing-freshness-DWdW7vUm.js";
-import { o as getPricingSync, s as init_cost } from "./cost-Ca0YTWDw.js";
-import { _ as init_tier_metrics, g as estimateFeedDeliveryTokens, v as recordTierFeedDelivery } from "./cost-sync-C0VdGme1.js";
-import { a as persistCurrentSessionId, d as isAgentStateServiceInProcess, i as logLauncherSessionPinned, l as getRuntimeSnapshot, n as createFreshSessionIdentity, o as init_persistent_logger, r as init_session_history, s as logAgentLifecycleSync, u as init_agent_runtime_mirror } from "./session-history-CVZDpS3c.js";
-import { t as init_behavior } from "./behavior-B_-4EKF3.js";
-import { i as ensureInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-Bb4XeV2x.js";
-import { i as readReviewStatusMap, n as init_review_status_source, r as isRoleTerminal } from "./review-status-source-CxuEjLGg.js";
-import { m as readWorkspacePlanSync, o as init_io } from "./io-B3_AHDfr.js";
-import { c as bridgeGeminiAuthToCliproxy, d as getCliproxyAuthDir, g as getCliproxyLogPath, l as decodeJwtPayload$1, p as getCliproxyClientEnv, s as bridgeCodexAuthToCliproxySync, v as init_cliproxy } from "./cliproxy-Bgb2XCqi.js";
-import { L as normalizeHarness, R as reactivateConversationForSpawn, S as getConversationByName, k as init_conversations, y as createConversation } from "./conversations-DbOs1e9Q.js";
-import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-B0pmAz0a.js";
-import { a as readCavemanVariant, n as init_workspace } from "./workspace-BVl4rihN.js";
-import { a as requireModelOverrideSync, i as normalizeModelOverrideSync, n as init_launcher_generator, o as shellQuoteModelIdSync, r as init_model_validation, t as generateLauncherScriptSync } from "./launcher-generator-CHVm7bGT.js";
-import { a as init_claude_permissions, r as getClaudePermissionFlagsStringSync } from "./claude-permissions-H_5wHQZQ.js";
-import { h as workspaceContextFile, o as init_layers } from "./layers-DzxSTGNA.js";
-import { a as extractThreadIdFromRollout, c as initCodexHome, l as init_codex, o as findLatestRollout } from "./codex-TmSi-yTv.js";
-import { n as init_harness_binary, r as prepareHarnessLaunch } from "./harness-binary-CVio2m-u.js";
-import { f as init_config, m as loadConfigSync$1 } from "./config-CCvjQf27.js";
-import { a as getFlywheelActiveRunIdSync, s as init_control_settings } from "./control-settings-aP1ANIlI.js";
-import { n as createTrackerFromConfig, r as init_factory, t as createTracker } from "./factory-CynerjXO.js";
-import { a as init_stack_health, i as getWorkspaceStackHealth } from "./stack-health-puygdaMd.js";
-import { i as createActiveSlice, l as init_dag, o as getDispatchableItems, s as groupItemsByWave } from "./dag-CdOjJVDT.js";
-import { c as generateFixedPointPromptSync, f as initHookSync, n as checkHookSync, p as init_hooks } from "./hooks-DUXw8A0-.js";
-import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-qHJBhy3Z.js";
-import { a as loadCloisterConfigSync, r as init_config$1 } from "./config-DjLOdbgT.js";
-import { t as init_reap_terminal_sessions } from "./reap-terminal-sessions-N3BTkmX_.js";
-import { c as isStateMigrated, o as init_state_home } from "./state-home-CIGjwNfJ.js";
-import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-but-_qGY.js";
-import { a as init_lifecycle_io, t as appendContinueSessionEntryForIssue } from "./lifecycle-io-D8iNBcux.js";
-import { r as init_swarm_readiness, t as analyzeSwarmReadiness } from "./swarm-readiness-CQ_fwUWF.js";
+import { B as getProviderEnvSync, C as TIERED_EXECUTION_DIFFICULTIES, Cr as ClaudeCredentialParseError, D as resolveTieredExecutionEnabled, Fr as init_errors, G as setupCredentialFileAuthSync, Gn as init_projects, H as init_providers, In as getIssuePrefix, Ir as AGENTS_DIR, K as ensureOpenAICompatibleProxyRunning, L as clearCredentialFileAuthSync, Mn as findProjectByPathSync, O as resolveTieredExecutionEnabledForIssue, Pt as init_record, R as getBuiltInDefaultHarness, Rn as getProjectSwarmHotspots, Rt as readIssueRecordForWorkspaceSync, S as DEFAULT_TIERED_EXECUTION_CONFIG, Sn as init_state_read_home, T as init_tier_table, Tr as FsError, Ut as writeAgentHarnessModelSync, V as getProviderForModelSync, Vt as resolveProjectForIssue, ar as resolveProjectFromIssueSync, ci as init_paths, di as resolveOhmypiExtensionPath, dt as fmix32, ei as encodeClaudeProjectDir, et as init_roles, f as loadConfigSync, fi as sessionFilePath, ft as fnv1a32, gr as init_issue_id, it as getModelCapabilitySync, l as isClaudeCodeChannelsMcpEnabled, li as isDevMode, lt as resolveModelIdSync, ot as hasModelCapabilitySync, pt as init_percent, q as init_openai_compatible_proxy, si as getOverdeckHome, st as init_model_capabilities, t as init_config_yaml, tt as resolveModel, u as isTldrEnabledSync, ui as packageRoot, ut as CLIPROXY_GPT56_CONTEXT_WINDOW, wn as shouldCommitLegacyWorkspaceArtifacts, xr as require_dist, yr as resolveBareNumericIdSync, zn as getProjectSync, zt as readIssueRecordSync } from "./config-yaml-CmOPzmBb.js";
+import { i as emitActivityTtsSync, o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BjuxvjdS.js";
+import { A as listPaneValues, D as killSession, E as isPaneDead, H as sessionExists, O as killSessionSync, P as listSessionsSync, Q as BLANKED_PROVIDER_ENV, R as sendEscapeKeyAsync, U as sessionExistsSync, V as sendRawKeystroke, W as setOption, a as capturePaneSync, c as createSessionSync, i as capturePane, m as exactPaneTarget, s as createSession, tt as init_child_env, w as init_tmux, z as sendKeys } from "./tmux-B1Wbxz5o.js";
+import { a as init_event_store, i as initEventStore } from "./event-store-zY5MJHgF.js";
+import { o as OHMYPI_BEHAVIOR, s as getHarnessBehavior } from "./src-CRmCHlma.js";
+import { F as init_pipeline_agent_reader, G as saveOverdeckAgentStateSync, H as getOverdeckAgentStateSync, I as registerPipelineTelemetryAgentReader, S as setReviewStatusSync, U as init_agent_state_sync, W as listOverdeckAgentStatesSync, f as init_review_status, u as getReviewStatusSync, v as resetPipelineVerdictsForWorkStartSync } from "./review-status-yljtTd-q.js";
+import { i as countAgentsByStatus, o as init_agents$1 } from "./agents-C5rWYhb6.js";
+import { n as ensureSessionContextBriefingFile, r as init_briefing_freshness } from "./briefing-freshness-DHmCSLar.js";
+import { o as getPricingSync, s as init_cost } from "./cost-Bgcub5kW.js";
+import { _ as init_tier_metrics, g as estimateFeedDeliveryTokens, v as recordTierFeedDelivery } from "./cost-sync-Dv3LUaNW.js";
+import { a as persistCurrentSessionId, d as isAgentStateServiceInProcess, i as logLauncherSessionPinned, l as getRuntimeSnapshot, n as createFreshSessionIdentity, o as init_persistent_logger, r as init_session_history, s as logAgentLifecycleSync, u as init_agent_runtime_mirror } from "./session-history-BUyK29eq.js";
+import { t as init_behavior } from "./behavior-CfIg6pKp.js";
+import { i as ensureInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-DvMTQSOS.js";
+import { i as readReviewStatusMap, n as init_review_status_source, r as isRoleTerminal } from "./review-status-source-CpvJnvnQ.js";
+import { m as readWorkspacePlanSync, o as init_io } from "./io-VHvc0Ssp.js";
+import { c as bridgeGeminiAuthToCliproxy, d as getCliproxyAuthDir, g as getCliproxyLogPath, l as decodeJwtPayload$1, p as getCliproxyClientEnv, s as bridgeCodexAuthToCliproxySync, v as init_cliproxy } from "./cliproxy-C8mB3KuB.js";
+import { L as normalizeHarness, R as reactivateConversationForSpawn, S as getConversationByName, k as init_conversations, y as createConversation } from "./conversations-BUpYsOZg.js";
+import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population--YUXU999.js";
+import { a as readCavemanVariant, n as init_workspace } from "./workspace-C0fH3aek.js";
+import { _ as shellQuoteModelIdSync, d as generateLauncherScriptSync, f as init_launcher_generator, g as requireModelOverrideSync, h as normalizeModelOverrideSync, i as completeKeyedSubmit, l as init_tmux_dedup, m as init_model_validation, u as sendKeysDedup } from "./tmux-dedup-DbN6MGzM.js";
+import { a as init_claude_permissions, r as getClaudePermissionFlagsStringSync } from "./claude-permissions-CN0cSCPp.js";
+import { E as init_layers, I as workspaceContextFile, P as resolveWorkspaceContextFile, c as init_render, i as workspaceContextWithoutProjectLayer, l as renderGlobalLayer, r as init_assemble, u as renderProjectLayer, v as init_harness, y as renderForHarness } from "./assemble-DnffNpOo.js";
+import { a as extractThreadIdFromRollout, c as initCodexHome, l as init_codex, o as findLatestRollout } from "./codex-Drlf5Xhf.js";
+import { i as prepareHarnessLaunch, r as init_harness_binary } from "./harness-binary-DqkftwTb.js";
+import { f as init_config, m as loadConfigSync$1 } from "./config-Dr3pW6w6.js";
+import { a as getFlywheelActiveRunIdSync, s as init_control_settings } from "./control-settings-C7DUehE1.js";
+import { n as createTrackerFromConfig, r as init_factory, t as createTracker } from "./factory-CRoOpGsF.js";
+import { a as getWorkspaceStackHealth, s as init_stack_health } from "./stack-health-DqSqx0zv.js";
+import { i as createActiveSlice, l as init_dag, o as getDispatchableItems, s as groupItemsByWave } from "./dag-ombYYt4s.js";
+import { c as generateFixedPointPromptSync, f as initHookSync, n as checkHookSync, p as init_hooks } from "./hooks-BO3QT1sn.js";
+import { a as init_git_utils, c as rehydrateHeadAnchor, l as renderWorkspaceGitShowPromise } from "./git-utils-ameCgDdy.js";
+import { n as init_workspace_anchor_drift, t as evaluateWorkspaceAnchorDrift } from "./workspace-anchor-drift-CZKofakh.js";
+import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-CqMqM1Mb.js";
+import { a as loadCloisterConfigSync, r as init_config$1 } from "./config-B2IMcBxx.js";
+import { t as init_reap_terminal_sessions } from "./reap-terminal-sessions-CvmwaqKv.js";
+import { c as isStateMigrated, o as init_state_home } from "./state-home-BYV7qZTW.js";
+import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-fvy4RD2b.js";
+import { a as init_lifecycle_io, t as appendContinueSessionEntryForIssue } from "./lifecycle-io-D-lGdzK3.js";
+import { r as init_swarm_readiness, t as analyzeSwarmReadiness } from "./swarm-readiness-BV14DF5N.js";
+import { createRequire } from "node:module";
 import { dirname, join, relative } from "node:path";
 import { Data, Duration, Effect, FileSystem } from "effect";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, statfsSync, unlinkSync, writeFileSync } from "fs";
-import { basename as basename$1, dirname as dirname$1, join as join$1, resolve as resolve$1 } from "path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, statfsSync, unlinkSync, writeFileSync } from "fs";
+import { basename as basename$1, dirname as dirname$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
 import { homedir } from "os";
 import { cpus as cpus$1, loadavg as loadavg$1, platform as platform$1, totalmem as totalmem$1 } from "node:os";
 import { chmodSync as chmodSync$1, closeSync as closeSync$1, constants, cpSync, createReadStream as createReadStream$1, existsSync as existsSync$1, mkdirSync as mkdirSync$1, openSync as openSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, renameSync as renameSync$1, rmSync as rmSync$1, statSync as statSync$1, unlinkSync as unlinkSync$1, writeFileSync as writeFileSync$1, writeSync } from "node:fs";
-import { chmod, mkdir, readFile, stat as stat$1, writeFile } from "node:fs/promises";
-import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, readdir, readlink, stat as stat$1, writeFile } from "node:fs/promises";
+import { createHash, randomUUID } from "crypto";
 import { ChildProcess } from "effect/unstable/process";
 import { mkdir as mkdir$1, open as open$1, readFile as readFile$1, readdir as readdir$1, rename as rename$1, rm as rm$1, stat as stat$2, writeFile as writeFile$1 } from "fs/promises";
 import { platform as platform$2 } from "process";
@@ -1098,6 +1101,31 @@ var init_identity = __esmMin((() => {
 	SINGLETON_AGENT_IDS = new Set(["flywheel-orchestrator", "sequencer-runner"]);
 }));
 //#endregion
+//#region ../../lib/deploy/active-dashboard-bundle.ts
+function activeDashboardBundleFile() {
+	return join$1(getOverdeckHome(), "active-dashboard-bundle.json");
+}
+function isInside(parent, candidate) {
+	const pathFromParent = relative$1(resolve$1(parent), resolve$1(candidate));
+	return pathFromParent === "" || pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep$1}`);
+}
+function readActiveDashboardBundleSync() {
+	try {
+		const parsed = JSON.parse(readFileSync(activeDashboardBundleFile(), "utf8"));
+		if (typeof parsed.repoRoot !== "string" || typeof parsed.deployRoot !== "string" || typeof parsed.serverPath !== "string" || !isInside(parsed.deployRoot, parsed.serverPath) || !existsSync(parsed.serverPath)) return null;
+		return {
+			repoRoot: resolve$1(parsed.repoRoot),
+			deployRoot: resolve$1(parsed.deployRoot),
+			serverPath: resolve$1(parsed.serverPath)
+		};
+	} catch {
+		return null;
+	}
+}
+var init_active_dashboard_bundle = __esmMin((() => {
+	init_paths();
+}));
+//#endregion
 //#region ../../lib/channels/pty-supervisor-locate.ts
 /**
 * Locate (and if necessary materialize) the PTY supervisor artifact.
@@ -1124,15 +1152,63 @@ var init_identity = __esmMin((() => {
 *      (content-hash keyed over the whole staged tree, so an app upgrade
 *      refreshes it even when only non-entry files changed) and the vendored
 *      packages land under node_modules/ there for normal Node resolution.
+*   3. <activeBundle.repoRoot>/dist/pty-supervisor.js — the primary checkout a
+*      `pan reload` deployment was built from (PAN-3172).
 *
-* Missing everywhere is a build/packaging defect and throws — never silently
-* degrade a spawn that the caller expects to be supervised.
+* A candidate is only accepted when its own bare imports actually resolve from
+* where it sits. Existence alone is not enough: `pan reload` runs the dashboard
+* out of ~/.overdeck/deployments/dashboard/.pan-reload-generation-{a,b}, and a
+* generation whose node_modules cannot resolve @lydell/node-pty produces a
+* supervisor that dies on ERR_MODULE_NOT_FOUND before it ever binds its socket
+* — every conversation spawned afterwards then died on a socket timeout with no
+* hint of the real cause (PAN-3172). Falling through to the primary checkout,
+* whose node_modules is complete, keeps spawns alive; that copy is the same
+* build, since activateDashboardDeployment() copies the generation's dist/ into
+* the primary checkout.
+*
+* Missing (or unresolvable) everywhere is a build/packaging defect and throws —
+* never silently degrade a spawn that the caller expects to be supervised.
+*/
+/**
+* Bare package specifiers the built supervisor imports but cannot resolve from
+* its own location. Empty means the artifact can start where it sits.
+*
+* Only a genuine module-not-found counts. A package that is present but whose
+* exports refuse the `require` condition still resolves under `import`, so it
+* must not be reported as missing.
 */
+function unresolvedSupervisorImports(scriptPath) {
+	const source = readFileSync$1(scriptPath, "utf8");
+	const requireFrom = createRequire(scriptPath);
+	const missing = /* @__PURE__ */ new Set();
+	for (const match of source.matchAll(IMPORT_SOURCE_PATTERN)) {
+		const specifier = match[2];
+		if (!specifier || !PACKAGE_SPECIFIER_PATTERN.test(specifier)) continue;
+		try {
+			requireFrom.resolve(specifier);
+		} catch (error) {
+			const code = error.code;
+			if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") missing.add(specifier);
+		}
+	}
+	return [...missing];
+}
 function resolvePtySupervisorScriptPath() {
-	const built = join(packageRoot, "dist", "pty-supervisor.js");
-	if (existsSync$1(built)) return built;
-	const staged = join(moduleDir, "supervisor");
-	if (existsSync$1(join(staged, "pty-supervisor.js"))) return materializePtySupervisorRuntime(staged);
+	const activeBundle = readActiveDashboardBundleSync();
+	const candidates = [
+		join(packageRoot, "dist", "pty-supervisor.js"),
+		join(moduleDir, "supervisor", "pty-supervisor.js"),
+		...activeBundle ? [join(activeBundle.repoRoot, "dist", "pty-supervisor.js")] : []
+	];
+	const rejected = [];
+	for (const candidate of candidates) {
+		if (!existsSync$1(candidate)) continue;
+		const entry = dirname(candidate) === join(moduleDir, "supervisor") ? materializePtySupervisorRuntime(dirname(candidate)) : candidate;
+		const missing = unresolvedSupervisorImports(entry);
+		if (missing.length === 0) return entry;
+		rejected.push(`${entry} cannot resolve ${missing.join(", ")}`);
+	}
+	if (rejected.length > 0) throw new Error(`pty-supervisor cannot start — its dependencies are missing from every built copy: ${rejected.join("; ")}. Reinstall dependencies where the dashboard is running from (\`bun install\`), then rebuild.`);
 	throw new Error("pty-supervisor build artifact missing — run `npm run build`.");
 }
 /**
@@ -1191,10 +1267,13 @@ function materializePtySupervisorRuntime(stagedDir, overdeckHome = getOverdeckHo
 	}
 	return entry;
 }
-var moduleDir;
+var moduleDir, IMPORT_SOURCE_PATTERN, PACKAGE_SPECIFIER_PATTERN;
 var init_pty_supervisor_locate = __esmMin((() => {
+	init_active_dashboard_bundle();
 	init_paths();
 	moduleDir = dirname(fileURLToPath(import.meta.url));
+	IMPORT_SOURCE_PATTERN = /\b(?:from|import)\s*\(?\s*(["'])([^"'\n]+)\1/g;
+	PACKAGE_SPECIFIER_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(?:\/[^\s]*)?$/;
 }));
 //#endregion
 //#region ../../lib/pty-token.ts
@@ -1669,6 +1748,33 @@ function decideResumeGate(block, intent, context = {}) {
 			reason: block.reason
 		};
 	}
+	if (intent === "merge-preparation") {
+		if (block.gate === "paused") {
+			if (block.yieldedByScheduler === true) return {
+				decision: "proceed",
+				clearYield: true
+			};
+			return {
+				decision: "block",
+				reason: `${block.reason}; run pan unpause before merging`,
+				needsYou: true
+			};
+		}
+		if (block.gate === "troubled") return {
+			decision: "block",
+			reason: `${block.reason}; run pan untroubled after investigating the crash`,
+			needsYou: true
+		};
+		if (block.gate === "stopped-by-user") return {
+			decision: "proceed",
+			clearStoppedByUser: true
+		};
+		return {
+			decision: "proceed",
+			overrideFailureBackoff: true,
+			warning: `Merge preparation overrides ${block.reason}`
+		};
+	}
 	if (intent === "operator-start") {
 		if (block.gate === "paused") return {
 			decision: "block",
@@ -1747,12 +1853,14 @@ var init_agent_state = __esmMin((() => {
 	init_persistent_logger();
 	init_feature_registry_population();
 	init_identity();
+	init_pipeline_agent_reader();
 	SESSION_EXITED_BEFORE_KICKOFF = "session-exited-before-kickoff";
 	toAgentFsError = (operation, path, cause) => new FsError({
 		operation,
 		path,
 		cause
 	});
+	registerPipelineTelemetryAgentReader(getAgentStateSync);
 	getAgentState = (agentId) => {
 		return Effect.try({
 			try: () => getAgentStateSync(agentId),
@@ -1827,6 +1935,33 @@ var init_agent_state = __esmMin((() => {
 function buildDefaultResumeContinueMessage(issueId) {
 	return `You are resuming work on ${issueId}. Read .pan/continue.json for context and pick up where you left off — do not wait for further instructions.`;
 }
+/** Completed marker check: the agent dir's own markers, or the workspace's. */
+function hasCompletionMarkerForAgent(state) {
+	const agentDir = getAgentDir(state.id);
+	if (existsSync(join$1(agentDir, "completed")) || existsSync(join$1(agentDir, "completed.processed"))) return true;
+	const workspace = state.workspace;
+	if (workspace && (existsSync(join$1(workspace, ".pan", "completed")) || existsSync(join$1(workspace, ".pan", "completed.processed")))) return true;
+	return false;
+}
+/**
+* PAN-2974 (root cause B): the resume kickoff is phase-aware. Telling an agent
+* whose work was already handed off (completed marker) to "pick up where you
+* left off — do not wait for further instructions" makes it re-drive pipeline
+* stages on its own authority — 2026-07-21 MIN-882: a post-reboot resume
+* re-ran verification, restored config, and fired `pan review request` /
+* `pan review restart` while the operator was mid-UAT on finished work.
+* A handed-off agent gets a PASSIVE restore instead; only agents that crashed
+* mid-implementation get the aggressive kickoff.
+*/
+function buildResumeContinueMessage(state) {
+	const issueId = state.issueId;
+	if (hasCompletionMarkerForAgent(state)) return [
+		`Your session for ${issueId} was restored after a restart.`,
+		`The work was already handed off — a completed marker exists. Do NOT re-drive pipeline stages (review, test, verify, merge) on your own authority.`,
+		`Stay available for the operator and act only on new instructions.`
+	].join(" ");
+	return buildDefaultResumeContinueMessage(issueId);
+}
 async function buildResumeMessageForAgent(state, fallbackMessage, callerMessage) {
 	if (state.role !== "work" || state.kickoffDelivered !== false) return {
 		message: callerMessage ?? fallbackMessage,
@@ -2541,7 +2676,7 @@ var init_provider_env = __esmMin((() => {
 		"NOUS_API_KEY",
 		"DASHSCOPE_API_KEY"
 	];
-	GPT_56_CODEX_CLIENT_CONTEXT_WINDOW = 372e3;
+	GPT_56_CODEX_CLIENT_CONTEXT_WINDOW = CLIPROXY_GPT56_CONTEXT_WINDOW;
 	GPT_56_MODELS = new Set([
 		"gpt-5.6-sol",
 		"gpt-5.6-terra",
@@ -2656,6 +2791,34 @@ var init_claude_auth = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region ../../lib/acp/context.ts
+function materializeAcpContextFile(agentDir, workspace) {
+	const sections = [renderGlobalLayer("acp", isDevMode())];
+	const project = findProjectByPathSync(workspace);
+	if (project) sections.push(renderProjectLayer(project.path, "acp"));
+	const workspaceFile = resolveWorkspaceContextFile(workspace);
+	if (existsSync$1(workspaceFile)) {
+		const workspaceContent = readFileSync$1(workspaceFile, "utf8");
+		const workspaceOnly = project ? workspaceContextWithoutProjectLayer(workspaceContent) : workspaceContent;
+		sections.push(renderForHarness(workspaceOnly, "acp").trim());
+	}
+	const content = sections.filter((section) => section.trim().length > 0).join(SECTION_SEPARATOR);
+	const contextPath = join(agentDir, "acp-context.md");
+	mkdirSync$1(dirname(contextPath), { recursive: true });
+	writeFileSync$1(contextPath, `${content.trim()}\n`, { mode: 384 });
+	return contextPath;
+}
+var SECTION_SEPARATOR;
+var init_context = __esmMin((() => {
+	init_assemble();
+	init_harness();
+	init_layers();
+	init_render();
+	init_paths();
+	init_projects();
+	SECTION_SEPARATOR = "\n\n---\n\n";
+}));
+//#endregion
 //#region ../../lib/runtimes/ohmypi-fifo.ts
 /**
 * oh-my-pi (omp) RPC named-pipe lifecycle (PAN-1989).
@@ -2815,6 +2978,8 @@ async function writeLauncherScriptAtomic(launcherScript, content) {
 	await rename$1(tmp, launcherScript);
 }
 async function claudeSystemPromptFiles(workspace, harness) {
+	const behavior = getHarnessBehavior(harness);
+	if (behavior.contextLayerKind === "acp") return [];
 	const files = [];
 	const contextFile = workspaceContextFile(workspace);
 	try {
@@ -2824,14 +2989,13 @@ async function claudeSystemPromptFiles(workspace, harness) {
 		if (!isNodeNotFound(error)) throw error;
 	}
 	files.push(await ensureSessionContextBriefingFile());
-	const behavior = getHarnessBehavior(harness);
 	if (behavior.contextLayerKind === "pi") {
-		const { piGlobalContextFile } = await import("./context-layers-B3Nt58jl.js");
+		const { piGlobalContextFile } = await import("./context-layers-D6LZo3l1.js");
 		const globalFile = piGlobalContextFile();
 		if (existsSync(globalFile)) files.unshift(globalFile);
 	}
 	if (behavior.contextLayerKind === "codex") {
-		const { codexGlobalContextFile } = await import("./context-layers-B3Nt58jl.js");
+		const { codexGlobalContextFile } = await import("./context-layers-D6LZo3l1.js");
 		const globalFile = codexGlobalContextFile();
 		if (existsSync(globalFile)) files.unshift(globalFile);
 	}
@@ -2887,6 +3051,18 @@ async function getOhmypiLauncherFields(agentId, model) {
 		model
 	};
 }
+function getAcpLauncherFields(agentId, model, workspace, binaryPath, _role) {
+	return {
+		harness: "acp",
+		acpAgentId: agentId,
+		acpProvider: getProviderForModelSync(model).name,
+		acpWorkspace: workspace,
+		acpBinaryPath: binaryPath,
+		acpContextFile: materializeAcpContextFile(getAgentDir(agentId), workspace),
+		model,
+		unsetProviderEnv: true
+	};
+}
 function getCodexLauncherFields(agentId, model, workspacePath, role) {
 	const codexHome = join$1(homedir(), ".overdeck", "agents", agentId, "codex-home");
 	const codexConfig = loadConfigSync().config.codex;
@@ -3048,12 +3224,45 @@ async function waitForCodexAppServerReady(agentId, timeoutSec = 30, deps = {}) {
 	const detail = lastError ? ` Last status error: ${lastError}` : ` Last state: ${lastState}.`;
 	throw new Error(`Timed out waiting for Codex app-server readiness for ${agentId}.${detail}`);
 }
+async function waitForAcpHostReady(agentId, timeoutSec = 30, deps = {}) {
+	const now = deps.now ?? (() => Date.now());
+	const sleep = deps.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)));
+	const sessionExistsForAgent = deps.sessionExists ?? (async (id) => Effect.runPromise(sessionExists(id)));
+	const readText = deps.readText ?? ((path) => readFileSync(path, "utf8"));
+	const pathExists = deps.pathExists ?? existsSync;
+	const agentDir = getAgentDir(agentId);
+	const sessionIdPath = join$1(agentDir, "acp-session-id");
+	const errorPath = join$1(agentDir, "acp-launch-error");
+	const tokenPath = join$1(agentDir, "acp-token");
+	const socketPath = join$1(getOverdeckHome(), "sockets", `acp-${agentId}.sock`);
+	const deadline = now() + timeoutSec * 1e3;
+	while (now() < deadline) {
+		if (pathExists(errorPath)) {
+			const launchError = readText(errorPath).trim();
+			if (launchError) throw new Error(`ACP host ${agentId} failed to start: ${launchError}`);
+		}
+		if (!await sessionExistsForAgent(agentId)) throw new Error(`ACP host session ${agentId} exited before readiness.`);
+		try {
+			const sessionId = readText(sessionIdPath).trim();
+			const token = readText(tokenPath).trim();
+			if (sessionId && token && pathExists(socketPath)) return;
+		} catch (error) {
+			if (!isNodeNotFound(error)) throw error;
+		}
+		await sleep(500);
+	}
+	throw new Error(`Timed out waiting for ACP host readiness for ${agentId}.`);
+}
 async function waitForPromptReady(agentId, harness, timeoutSec = 30) {
 	const readinessKind = harness === "codex" && loadConfigSync().config.codex?.transport !== "tui" ? "codex-app-server-ready" : getHarnessBehavior(harness).readinessKind;
 	if (readinessKind === "codex-app-server-ready") {
 		await waitForCodexAppServerReady(agentId, timeoutSec);
 		return true;
 	}
+	if (readinessKind === "acp-host-ready") {
+		await waitForAcpHostReady(agentId, timeoutSec);
+		return true;
+	}
 	if (readinessKind === "codex-tui-prompt") return waitForCodexTuiReady(agentId, timeoutSec);
 	return waitForReadySignal(agentId, timeoutSec);
 }
@@ -3081,7 +3290,7 @@ async function injectPiPromptTimeMemory(agentId, prompt) {
 			agentRole: agentState.role ?? "work",
 			agentHarness: agentState.harness ?? "claude-code"
 		};
-		const { injectPromptTimeMemory } = await import("./injection-oNZeoDhL.js");
+		const { injectPromptTimeMemory } = await import("./injection-DZxlV2al.js");
 		const result = await injectPromptTimeMemory({
 			prompt,
 			identity,
@@ -3115,7 +3324,7 @@ async function injectPiConversationMemory(opts, prompt) {
 			agentRole: "work",
 			agentHarness: "ohmypi"
 		};
-		const { injectPromptTimeMemory } = await import("./injection-oNZeoDhL.js");
+		const { injectPromptTimeMemory } = await import("./injection-DZxlV2al.js");
 		const result = await injectPromptTimeMemory({
 			prompt,
 			identity,
@@ -3176,6 +3385,7 @@ async function getAgentRuntimeBaseCommand(model, agentName, agentDefinition, har
 	const behavior = getHarnessBehavior(harness);
 	if (behavior.launchCommandKind === "ohmypi-rpc") return `omp --mode rpc --model ${quotedModel}`;
 	if (behavior.launchCommandKind === "codex-work-tui") return `codex`;
+	if (behavior.launchCommandKind === "acp-host") return "acp-host";
 	if (process.env.OVERDECK_TEST_HARNESS_COMMAND) return process.env.OVERDECK_TEST_HARNESS_COMMAND;
 	const provider = getProviderForModelSync(validatedModel);
 	const nameFlag = agentName ? ` --name ${agentName}` : "";
@@ -3273,6 +3483,7 @@ async function getRoleRuntimeBaseCommand(model, agentName, role, harness = "clau
 		return `omp --mode rpc --model ${quotedModel}`;
 	}
 	if (behavior.launchCommandKind === "codex-work-tui") return `codex`;
+	if (behavior.launchCommandKind === "acp-host") return "acp-host";
 	if (process.env.OVERDECK_TEST_HARNESS_COMMAND) return process.env.OVERDECK_TEST_HARNESS_COMMAND;
 	const provider = getProviderForModelSync(validatedModel);
 	const requestedDefinitionPath = roleAgentDefinitionPath(role, subRole);
@@ -3283,7 +3494,7 @@ async function getRoleRuntimeBaseCommand(model, agentName, role, harness = "clau
 	}
 	const roleInject = definitionPath ? roleSystemPromptInjectionSync(definitionPath, effort) : "";
 	const nameFlag = ` --name ${agentName}`;
-	const effortFlag = !definitionPath && effort ? ` --effort ${effort}` : "";
+	const effortFlag = !definitionPath ? ` --effort ${effort ?? "high"}` : "";
 	const permissionFlags = ` ${getClaudePermissionFlagsStringSync()}`;
 	const printFlag = "";
 	if (provider.name === "openai" && await getProviderAuthMode(validatedModel) === "subscription") return `claude${printFlag}${roleInject}${permissionFlags} --model ${shellQuoteModelIdSync(CLI_PROXY_MODEL_ALIASES[validatedModel] ?? validatedModel)}${effortFlag}${nameFlag}`;
@@ -3297,6 +3508,7 @@ var init_runtime_command = __esmMin((() => {
 	init_briefing_freshness();
 	init_claude_auth();
 	init_layers();
+	init_context();
 	init_behavior();
 	init_codex();
 	init_ohmypi_fifo();
@@ -3639,20 +3851,25 @@ async function transitionIssueToInReview(issueId, workspacePath) {
 async function buildAgentLaunchConfig(opts) {
 	const model = requireModelOverrideSync(opts.model);
 	try {
-		const { injectOverdeckInfraDeny } = await import("./claude-settings-overlay-BTENVmYf.js");
+		const { injectOverdeckInfraDeny } = await import("./claude-settings-overlay-Dabi9slj.js");
 		await Effect.runPromise(injectOverdeckInfraDeny(opts.workspace));
 	} catch (err) {
 		console.warn(`[agents] injectOverdeckInfraDeny failed for ${opts.agentId} (non-fatal): ${err instanceof Error ? err.message : err}`);
 	}
-	const providerEnv = await getProviderEnvForModel(model);
-	const provider = getProviderForModelSync(model);
-	if (provider.authType === "credential-file") setupCredentialFileAuthSync(provider, opts.workspace);
-	else clearCredentialFileAuthSync(opts.workspace);
-	const providerExports = await getProviderExportsForModel(model);
-	const launchRole = opts.isPlanning ? "plan" : opts.role;
 	const behavior = getHarnessBehavior(opts.harness);
+	const isAcp = behavior.launchCommandKind === "acp-host";
+	const providerEnv = isAcp ? {} : await getProviderEnvForModel(model);
+	if (!isAcp) {
+		const provider = getProviderForModelSync(model);
+		if (provider.authType === "credential-file") setupCredentialFileAuthSync(provider, opts.workspace);
+		else clearCredentialFileAuthSync(opts.workspace);
+	}
+	const providerExports = isAcp ? void 0 : await getProviderExportsForModel(model);
+	const launchRole = opts.isPlanning ? "plan" : opts.role;
 	const piLauncherFields = behavior.usesRpcFifo ? await getOhmypiLauncherFields(opts.agentId, model) : {};
 	const codexLauncherFields = behavior.usesCodexHome ? getCodexLauncherFields(opts.agentId, model, opts.workspace, launchRole) : {};
+	if (isAcp && !opts.harnessBinaryPath) throw new Error("ACP launch requires the executable path resolved by preflight");
+	const acpLauncherFields = isAcp ? getAcpLauncherFields(opts.agentId, model, opts.workspace, opts.harnessBinaryPath, launchRole) : {};
 	if (opts.spawnMode === "resume" && opts.resumeSessionId) return {
 		launcherContent: generateLauncherScriptSync({
 			role: launchRole,
@@ -3663,7 +3880,7 @@ async function buildAgentLaunchConfig(opts) {
 			providerExports,
 			baseCommand: behavior.launchCommandKind !== "claude-code" ? await getAgentRuntimeBaseCommand(model, opts.agentId, launchRole, opts.harness) : `claude ${getClaudePermissionFlagsStringSync()}${roleSystemPromptInjectionSync(roleAgentDefinitionPath(launchRole))}`,
 			resumeSessionId: opts.resumeSessionId,
-			model: behavior.launchCommandKind !== "claude-code" || providerExports.includes("ANTHROPIC_BASE_URL") ? model : void 0,
+			model: behavior.launchCommandKind !== "claude-code" || providerExports?.includes("ANTHROPIC_BASE_URL") ? model : void 0,
 			extraArgs: behavior.launchCommandKind !== "claude-code" ? void 0 : `--name ${opts.agentId}`,
 			appendSystemPromptFiles: await claudeSystemPromptFiles(opts.workspace, opts.harness),
 			extraEnvExports: opts.extraEnvExports,
@@ -3671,7 +3888,8 @@ async function buildAgentLaunchConfig(opts) {
 			supervisorScriptPath: opts.supervisorScriptPath,
 			promptInline: opts.promptInline,
 			...piLauncherFields,
-			...codexLauncherFields
+			...codexLauncherFields,
+			...acpLauncherFields
 		}),
 		providerEnv
 	};
@@ -3695,6 +3913,7 @@ async function buildAgentLaunchConfig(opts) {
 			promptInline: opts.promptInline,
 			...piLauncherFields,
 			...codexLauncherFields,
+			...acpLauncherFields,
 			...opts.channelsBridgeMcpConfig ? {
 				channelsBridgeMcpConfig: opts.channelsBridgeMcpConfig,
 				channelsBridgeServerName: opts.channelsBridgeServerName ?? "overdeck-bridge"
@@ -3720,7 +3939,7 @@ async function retrieveSpawnTimeMemoryContext(input) {
 			agentRole: input.role,
 			agentHarness: input.harness
 		};
-		const { injectPromptTimeMemory } = await import("./injection-oNZeoDhL.js");
+		const { injectPromptTimeMemory } = await import("./injection-DZxlV2al.js");
 		return (await injectPromptTimeMemory({
 			prompt: input.prompt,
 			identity,
@@ -3811,7 +4030,7 @@ async function assertWorkspaceStackHealthyForSpawn(issueId, role, allowHost = fa
 	record.attempts += 1;
 	spawnStackRebuildState.set(normalizedIssue, record);
 	console.log(`[agents] Workspace stack for ${normalizedIssue} unhealthy (${details}) — rebuilding before spawn (attempt ${record.attempts}/${SPAWN_STACK_REBUILD_MAX_ATTEMPTS})`);
-	const { rebuildWorkspaceStack } = await import("./rebuild-stack-kA7XngID.js");
+	const { rebuildWorkspaceStack } = await import("./rebuild-stack-qeRqHZxH.js");
 	const result = await Effect.runPromise(rebuildWorkspaceStack(issueId, { onProgress: (m) => console.log(`[agents]   ${normalizedIssue} stack rebuild: ${m}`) })).catch((err) => ({
 		success: false,
 		error: err instanceof Error ? err.message : String(err)
@@ -3927,6 +4146,64 @@ var init_cv = __esmMin((() => {
 	init_errors();
 }));
 //#endregion
+//#region ../../lib/cloister/verdict-preservation.ts
+/** Decide whether a fresh work-agent session may keep verdicts earned by the current code. */
+async function shouldPreservePipelineVerdicts(issueId, workspacePath) {
+	try {
+		const status = getReviewStatusSync(issueId);
+		if (!status) return {
+			preserve: false,
+			reason: "no pipeline verdicts are recorded"
+		};
+		if (!status.reviewedAtCommit) return {
+			preserve: false,
+			reason: "the review verdict has no commit anchor"
+		};
+		if (status.reviewStatus !== "passed" && status.reviewStatus !== "skipped") return {
+			preserve: false,
+			reason: `review is ${status.reviewStatus}`
+		};
+		if (status.testStatus !== "passed") return {
+			preserve: false,
+			reason: `tests are ${status.testStatus}`
+		};
+		if (status.verificationStatus !== "passed") return {
+			preserve: false,
+			reason: `verification is ${status.verificationStatus ?? "missing"}`
+		};
+		const verdict = await evaluateWorkspaceAnchorDrift(issueId, workspacePath, rehydrateHeadAnchor(status.reviewedAtCommit));
+		switch (verdict.kind) {
+			case "current": return {
+				preserve: true,
+				reason: "workspace HEAD matches the reviewed commit anchor"
+			};
+			case "benign": return {
+				preserve: true,
+				reason: "workspace HEAD moved without changing the reviewed code",
+				refreshedAnchor: verdict.currentAnchor
+			};
+			case "drifted": return {
+				preserve: false,
+				reason: "workspace code changed after review"
+			};
+			case "unreadable": return {
+				preserve: false,
+				reason: "the current workspace commit anchor is unreadable"
+			};
+		}
+	} catch (error) {
+		return {
+			preserve: false,
+			reason: `verdict preservation check failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+}
+var init_verdict_preservation = __esmMin((() => {
+	init_git_utils();
+	init_review_status();
+	init_workspace_anchor_drift();
+}));
+//#endregion
 //#region ../../lib/bridge-token.ts
 function bridgeTokensDir() {
 	return join(getOverdeckHome(), "bridge-tokens");
@@ -4198,22 +4475,27 @@ async function appendChannelDeliveryLog(agentId, entry) {
 		await (await import("fs/promises")).appendFile(join$1(dir, `bridge-${agentId}.log`), `${line}\n`, "utf-8");
 	} catch {}
 }
-function readAppServerTokenSync(agentId) {
+function readSocketTokenSync(agentId, filename) {
 	try {
-		const tokenPath = join$1(overdeckHomeForSockets(), "agents", agentId, "appserver-token");
+		const tokenPath = join$1(overdeckHomeForSockets(), "agents", agentId, filename);
 		if (!existsSync(tokenPath)) return null;
 		return readFileSync(tokenPath, "utf-8").trim() || null;
 	} catch {
 		return null;
 	}
 }
+function readAppServerTokenSync(agentId) {
+	return readSocketTokenSync(agentId, "appserver-token");
+}
+function readAcpTokenSync(agentId) {
+	return readSocketTokenSync(agentId, "acp-token");
+}
 /**
 * POST a JSON body to a Unix-domain socket using node:net + a hand-rolled
 * minimal HTTP/1.1 request. Resolves on a 200-class response, rejects on any
-* error including socket-not-found, connection refused, write timeout, or
-* non-2xx status. Kept tiny on purpose: this is a hot path, only one caller,
-* and the whole point of a fallback to tmux is that we do not need a robust
-* HTTP client here.
+* error including socket-not-found, connection refused, an optional client
+* timeout, or non-2xx status. Kept tiny on purpose because this is a hot path
+* and these local protocol hosts need only a narrow HTTP client.
 */
 async function postUnixSocketJson(socketPath, body, timeoutMs, token, tokenHeader = BRIDGE_TOKEN_HEADER) {
 	const payload = JSON.stringify(body);
@@ -4261,13 +4543,15 @@ async function postUnixSocketJson(socketPath, body, timeoutMs, token, tokenHeade
 					});
 					return;
 				}
-				finishErr(/* @__PURE__ */ new Error(`socket POST: status ${status}: ${responseBody.slice(0, 100)}`));
+				finishErr(new SocketPostStatusError(status, `socket POST: status ${status}: ${responseBody.slice(0, 100)}`));
 			});
 		});
-		timeout = setTimeout(() => {
-			req.destroy(/* @__PURE__ */ new Error("socket POST timeout"));
-		}, timeoutMs);
-		timeout.unref?.();
+		if (timeoutMs !== void 0) {
+			timeout = setTimeout(() => {
+				req.destroy(/* @__PURE__ */ new Error("socket POST timeout"));
+			}, timeoutMs);
+			timeout.unref?.();
+		}
 		req.on("error", (err) => {
 			finishErr(err);
 		});
@@ -4277,11 +4561,13 @@ async function postUnixSocketJson(socketPath, body, timeoutMs, token, tokenHeade
 }
 /**
 * Single delivery primitive for orchestrator-to-work-agent messages. Auto mode
-* tries the PTY supervisor socket, then legacy Channels MCP, then tmux. Explicit
-* socket methods are strict and throw instead of falling back.
+* tries persistent protocol hosts, the PTY supervisor socket, legacy Channels
+* MCP, then tmux. Explicit socket methods and ACP targets are strict: ACP prompts
+* cannot fall back to terminal injection because only session/prompt reaches the agent.
 */
-async function deliverAgentMessage(agentId, message, caller = "unknown", deliveryMethod) {
+async function deliverAgentMessage(agentId, message, caller = "unknown", deliveryMethod, opts = {}) {
 	const normalizedId = normalizeAgentId(agentId);
+	const dedupKey = opts.dedupKey;
 	let channelsEnabled = false;
 	let resolvedMethod = deliveryMethod;
 	let state = null;
@@ -4292,6 +4578,9 @@ async function deliverAgentMessage(agentId, message, caller = "unknown", deliver
 	} catch {
 		resolvedMethod ??= "auto";
 	}
+	const isAcpTarget = state?.harness === "acp";
+	if (isAcpTarget && resolvedMethod !== "auto") throw new Error(`MessageDeliveryFailed: ACP delivery failed for ${normalizedId} (${caller}): ACP requires authenticated host RPC delivery`);
+	if (dedupKey !== void 0) return deliverKeyedAgentMessage(normalizedId, message, caller, resolvedMethod ?? "auto", isAcpTarget, dedupKey);
 	if (resolvedMethod === "tmux") {
 		await assertTmuxTargetCanReceive(normalizedId, caller);
 		await Effect.runPromise(sendKeys(normalizedId, message));
@@ -4301,7 +4590,7 @@ async function deliverAgentMessage(agentId, message, caller = "unknown", deliver
 		};
 	}
 	let appServerFailure;
-	if (resolvedMethod === "auto") {
+	if (resolvedMethod === "auto" && !isAcpTarget) {
 		const appServerSocketPath = join$1(overdeckHomeForSockets(), "sockets", `appserver-${normalizedId}.sock`);
 		if (existsSync(appServerSocketPath)) {
 			const appServerToken = readAppServerTokenSync(normalizedId);
@@ -4327,6 +4616,39 @@ async function deliverAgentMessage(agentId, message, caller = "unknown", deliver
 			}
 		}
 	}
+	let acpFailure;
+	if (resolvedMethod === "auto") {
+		const acpSocketPath = join$1(overdeckHomeForSockets(), "sockets", `acp-${normalizedId}.sock`);
+		const acpSocketExists = existsSync(acpSocketPath);
+		if (isAcpTarget || acpSocketExists) {
+			const acpToken = readAcpTokenSync(normalizedId);
+			if (!acpSocketExists) acpFailure = "socket-missing";
+			else if (!acpToken) acpFailure = "acp-token-missing";
+			else try {
+				await postUnixSocketJson(acpSocketPath, {
+					op: "message",
+					content: message,
+					meta: { caller }
+				}, 8e3, acpToken);
+				await appendChannelDeliveryLog(normalizedId, {
+					path: "acp",
+					caller
+				});
+				return {
+					ok: true,
+					path: "acp"
+				};
+			} catch (err) {
+				acpFailure = `socket-post-failed: ${err instanceof Error ? err.message : String(err)}`;
+			}
+			await appendChannelDeliveryLog(normalizedId, {
+				path: "acp",
+				reason: acpFailure,
+				caller
+			});
+			throw new Error(`MessageDeliveryFailed: ACP delivery failed for ${normalizedId} (${caller}): ${acpFailure}`);
+		}
+	}
 	let supervisorFailure;
 	if (resolvedMethod === "auto" || resolvedMethod === "supervisor") {
 		const supervisorSocketPath = join$1(overdeckHomeForSockets(), "sockets", `pty-${normalizedId}.sock`);
@@ -4383,6 +4705,7 @@ async function deliverAgentMessage(agentId, message, caller = "unknown", deliver
 			reason: channelFailure,
 			caller,
 			...appServerFailure ? { appServer: appServerFailure } : {},
+			...acpFailure ? { acp: acpFailure } : {},
 			...supervisorFailure ? { "pty-supervisor": supervisorFailure } : {},
 			...channelFailure ? { channels: channelFailure } : {}
 		});
@@ -4402,6 +4725,83 @@ async function deliverAgentMessage(agentId, message, caller = "unknown", deliver
 	};
 }
 /**
+* Keyed delivery cascade (PAN-2997). Only two tiers may carry a keyed
+* message, because only their crash-independent components enforce the key
+* across the COMPLETE visible side effect:
+*
+* - the PTY supervisor reserves the key synchronously (closing the concurrent
+*   same-key race) and completes it only after its single-request
+*   content-plus-Enter injection succeeds; and
+* - the tmux fallback keeps two-phase pending/terminal session markers owned
+*   by the tmux server across paste, settle, and submit.
+*
+* App-server, ACP, and Channels acknowledge receipt without enforcing the
+* key, so they are never used for keyed payloads: a dashboard crash after
+* their side effect but before the caller's acknowledgment would replay the
+* wake. Explicitly requesting one of them with a key is a loud error, not a
+* silent downgrade.
+*/
+async function deliverKeyedAgentMessage(normalizedId, message, caller, resolvedMethod, isAcpTarget, dedupKey) {
+	if (isAcpTarget) throw new Error(`MessageDeliveryFailed: keyed delivery failed for ${normalizedId} (${caller}): the ACP tier cannot enforce a dedup key`);
+	if (resolvedMethod === "channels") throw new Error(`MessageDeliveryFailed: keyed delivery failed for ${normalizedId} (${caller}): the Channels tier cannot enforce a dedup key`);
+	if (resolvedMethod === "tmux") return deliverKeyedViaTmux(normalizedId, message, caller, dedupKey);
+	let supervisorFailure;
+	const supervisorSocketPath = join$1(overdeckHomeForSockets(), "sockets", `pty-${normalizedId}.sock`);
+	const ptyToken = await readPtyToken(normalizedId);
+	if (!existsSync(supervisorSocketPath)) supervisorFailure = "socket-missing";
+	else if (!ptyToken) supervisorFailure = "pty-token-missing";
+	else try {
+		const supervisorResponse = await postUnixSocketJson(supervisorSocketPath, {
+			content: message,
+			meta: { caller },
+			dedupKey
+		}, supervisorInjectionBudgetMs(message.length) + SUPERVISOR_CLIENT_MARGIN_MS, ptyToken, PTY_TOKEN_HEADER);
+		await appendChannelDeliveryLog(normalizedId, {
+			path: "supervisor",
+			caller
+		});
+		let deduplicated = false;
+		try {
+			deduplicated = JSON.parse(supervisorResponse.body).deduplicated === true;
+		} catch {}
+		return {
+			ok: true,
+			path: "supervisor",
+			deduplicated
+		};
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		if (!(err instanceof SocketPostStatusError)) throw new AmbiguousKeyedDeliveryError(normalizedId, caller, reason);
+		supervisorFailure = `socket-post-failed: ${reason}`;
+	}
+	if (resolvedMethod === "supervisor") throw new Error(`MessageDeliveryFailed: PTY supervisor delivery failed for ${normalizedId} (${caller}): ${supervisorFailure}`);
+	await appendChannelDeliveryLog(normalizedId, {
+		path: "tmux",
+		reason: supervisorFailure,
+		caller
+	});
+	return {
+		...await deliverKeyedViaTmux(normalizedId, message, caller, dedupKey),
+		failure: supervisorFailure
+	};
+}
+/**
+* Keyed tmux delivery: paste under the two-phase marker protocol, then
+* complete the submit. A replay that finds the pending marker completes the
+* prior attempt's submission WITHOUT re-pasting; a terminal marker suppresses
+* the replay entirely.
+*/
+async function deliverKeyedViaTmux(normalizedId, message, caller, dedupKey) {
+	await assertTmuxTargetCanReceive(normalizedId, caller);
+	const phase = await sendKeysDedup(normalizedId, message, dedupKey, caller);
+	if (phase !== "deduplicated") await completeKeyedSubmit(normalizedId, dedupKey);
+	return {
+		ok: true,
+		path: "tmux",
+		deduplicated: phase === "deduplicated"
+	};
+}
+/**
 * PAN-2228: loud failure semantics for the tmux tier. `tmux send-keys` into a
 * session whose pane process has EXITED (a remain-on-exit corpse) succeeds at the
 * tmux level while the message lands nowhere — the zombie-kickoff failure mode
@@ -4560,16 +4960,31 @@ async function setAgentDeliveryMethod(agentId, deliveryMethod) {
 	state.deliveryMethod = deliveryMethod;
 	await Effect.runPromise(saveAgentState(state));
 }
-var RESUME_TRANSCRIPT_CONFIRM_TIMEOUT_MS, RESUME_TRANSCRIPT_CONFIRM_INTERVAL_MS;
+var SocketPostStatusError, AmbiguousKeyedDeliveryError, RESUME_TRANSCRIPT_CONFIRM_TIMEOUT_MS, RESUME_TRANSCRIPT_CONFIRM_INTERVAL_MS;
 var init_delivery = __esmMin((() => {
 	init_behavior();
 	init_agents();
 	init_runtime_state();
 	init_tmux();
+	init_tmux_dedup();
 	init_bridge_token();
 	init_pty_token();
 	init_injection_budget();
 	init_transcript_landing();
+	SocketPostStatusError = class extends Error {
+		status;
+		constructor(status, message) {
+			super(message);
+			this.name = "SocketPostStatusError";
+			this.status = status;
+		}
+	};
+	AmbiguousKeyedDeliveryError = class extends Error {
+		constructor(agentId, caller, reason) {
+			super(`MessageDeliveryFailed: ambiguous keyed delivery for ${agentId} (${caller}): ${reason} — the supervisor may have completed the injection; NOT crossing to the tmux tier with the same key`);
+			this.name = "AmbiguousKeyedDeliveryError";
+		}
+	};
 	RESUME_TRANSCRIPT_CONFIRM_TIMEOUT_MS = 3e3;
 	RESUME_TRANSCRIPT_CONFIRM_INTERVAL_MS = 100;
 }));
@@ -4915,6 +5330,12 @@ function stopAgentSync(agentId) {
 		killSessionSync(normalizedId);
 	}
 	killLauncherProcessSync(normalizedId);
+	try {
+		rmSync(join$1(AGENTS_DIR, normalizedId, "git-guard"), {
+			recursive: true,
+			force: true
+		});
+	} catch {}
 	const state = getAgentStateSync(normalizedId);
 	if (state) {
 		if (!state.id) state.id = normalizedId;
@@ -4969,6 +5390,14 @@ var init_termination = __esmMin((() => {
 					throw cause;
 				}
 			}).pipe(Effect.catch(() => Effect.void));
+			yield* Effect.promise(async () => {
+				try {
+					await rm$1(join$1(AGENTS_DIR, normalizedId, "git-guard"), {
+						recursive: true,
+						force: true
+					});
+				} catch {}
+			});
 			const state = yield* getAgentState(normalizedId);
 			if (state) {
 				if (!state.id) state.id = normalizedId;
@@ -5054,18 +5483,18 @@ async function spawnRun(issueId, role, options = {}) {
 		let reapWarmIdle = false;
 		const advancing = role === "review" || role === "test" || role === "ship";
 		try {
-			const { isPaneDead } = await import("./tmux-DoThH6aj.js");
+			const { isPaneDead } = await import("./tmux-DQ6jB76i.js");
 			if (await Effect.runPromise(isPaneDead(agentId))) reapWarmIdle = true;
 			else if (advancing) {
-				const { getReviewStatusSync } = await import("./review-status-C6n6-9f_.js");
-				const { isRoleTerminal } = await import("./reap-terminal-sessions-MWnqdLCJ.js");
+				const { getReviewStatusSync } = await import("./review-status-BZH8h-6W.js");
+				const { isRoleTerminal } = await import("./reap-terminal-sessions-BQ23nriz.js");
 				const status = getReviewStatusSync(issueId);
 				reapWarmIdle = !!status && isRoleTerminal(role, status);
 			}
 		} catch {}
 		if (!reapWarmIdle) throw new Error(`Role run ${agentId} already running. Use 'pan tell' to message it.`);
 		console.log(`[spawn] ${agentId} is warm-idle from the previous cycle — reaping it for the new ${role} dispatch (PAN-2579)`);
-		const { killSession } = await import("./tmux-DoThH6aj.js");
+		const { killSession } = await import("./tmux-DQ6jB76i.js");
 		await Effect.runPromise(killSession(agentId)).catch(() => {});
 	}
 	await assertWorkspaceStackHealthyForSpawn(issueId, role, options.allowHost, workspace);
@@ -5075,11 +5504,12 @@ async function spawnRun(issueId, role, options = {}) {
 		role,
 		model: selectedModel
 	});
+	const isAcp = getHarnessBehavior(resolvedHarness).launchCommandKind === "acp-host";
 	const harnessLaunch = await prepareHarnessLaunch(resolvedHarness);
 	assertCodexNativeAuthForSpawn(resolvedHarness, listAgentStates());
 	await ensureLifecycleHooksBeforeLaunch(agentId, resolvedHarness);
 	if (getProviderForModelSync(selectedModel).name === "openai" && await getProviderAuthMode(selectedModel) === "subscription") {
-		const { isCliproxyRunning } = await import("./cliproxy-DW0V86F8.js");
+		const { isCliproxyRunning } = await import("./cliproxy-PGwTX_o8.js");
 		if (!await Effect.runPromise(isCliproxyRunning())) throw new Error("CLIProxyAPI sidecar is not running. GPT subscription role runs route through a local cliproxy process managed by `pan up`. Run `pan up` (or restart the dashboard) before spawning a GPT role run.");
 	}
 	const state = {
@@ -5102,6 +5532,7 @@ async function spawnRun(issueId, role, options = {}) {
 	const shouldDeliverPromptViaTmux = shouldRegisterConversation && resolvedHarness === "claude-code";
 	const shouldDeliverPromptViaPi = shouldRegisterConversation && resolvedHarness === "ohmypi";
 	const shouldDeliverPromptViaCodexTui = shouldRegisterConversation && resolvedHarness === "codex";
+	const shouldDeliverPromptViaAcp = resolvedHarness === "acp";
 	const prompt = options.prompt ? await withSpawnTimeMemoryContext({
 		prompt: options.prompt,
 		issueId,
@@ -5112,26 +5543,29 @@ async function spawnRun(issueId, role, options = {}) {
 	}) : "";
 	let promptFile;
 	const tracksKickoffDelivery = role === "flywheel";
-	if (prompt && (tracksKickoffDelivery || !shouldDeliverPromptViaTmux && !shouldDeliverPromptViaPi && !shouldDeliverPromptViaCodexTui)) {
+	if (prompt && !shouldDeliverPromptViaAcp && (tracksKickoffDelivery || !shouldDeliverPromptViaTmux && !shouldDeliverPromptViaPi && !shouldDeliverPromptViaCodexTui)) {
 		promptFile = join$1(getAgentDir(agentId), "initial-prompt.md");
 		await writeFile$1(promptFile, prompt);
-		if (tracksKickoffDelivery) {
-			state.kickoffDelivered = false;
-			await Effect.runPromise(saveAgentState(state));
-		}
 	}
-	const provider = getProviderForModelSync(selectedModel);
-	if (provider.authType === "credential-file") setupCredentialFileAuthSync(provider, workspace);
-	else clearCredentialFileAuthSync(workspace);
-	const providerExports = await getProviderExportsForModel(selectedModel);
-	const providerEnv = await getProviderEnvForModel(selectedModel);
+	if (prompt && tracksKickoffDelivery) {
+		state.kickoffDelivered = false;
+		await Effect.runPromise(saveAgentState(state));
+	}
+	if (!isAcp) {
+		const provider = getProviderForModelSync(selectedModel);
+		if (provider.authType === "credential-file") setupCredentialFileAuthSync(provider, workspace);
+		else clearCredentialFileAuthSync(workspace);
+	}
+	const providerExports = isAcp ? void 0 : await getProviderExportsForModel(selectedModel);
+	const providerEnv = isAcp ? {} : await getProviderEnvForModel(selectedModel);
 	const piLauncherFields = resolvedHarness === "ohmypi" ? await getOhmypiLauncherFields(agentId, selectedModel) : {};
 	const codexLauncherFields = resolvedHarness === "codex" ? getCodexLauncherFields(agentId, selectedModel, workspace, role) : {};
+	const acpLauncherFields = isAcp ? getAcpLauncherFields(agentId, selectedModel, workspace, harnessLaunch.binaryPath, role) : {};
 	let sessionId;
 	let rawSessionId;
 	if (shouldRegisterConversation) {
-		rawSessionId = options.resumeSessionId ?? randomUUID();
-		try {
+		rawSessionId = isAcp ? options.resumeSessionId : options.resumeSessionId ?? randomUUID();
+		if (!isAcp && rawSessionId) try {
 			const agentDir = getAgentDir(agentId);
 			await mkdir$1(agentDir, { recursive: true });
 			await writeFile$1(join$1(agentDir, "session.id"), rawSessionId, "utf-8");
@@ -5184,14 +5618,15 @@ async function spawnRun(issueId, role, options = {}) {
 		reviewSignal: void 0,
 		trapHup: void 0,
 		...piLauncherFields,
-		...codexLauncherFields
+		...codexLauncherFields,
+		...acpLauncherFields
 	});
 	const launcherScript = join$1(getAgentDir(agentId), "launcher.sh");
 	await writeLauncherScriptAtomic(launcherScript, launcherContent);
 	const claudeCmd = `bash ${launcherScript}`;
 	console.log(`[claude-invoke] purpose=role-run | role=${role} | model=${state.model} | source=agents.ts:spawnRun | session=${agentId} | command="${claudeCmd}"`);
 	try {
-		const { preTrustDirectory } = await import("./workspace-manager-ZTdJAy9M.js");
+		const { preTrustDirectory } = await import("./workspace-manager-CDTKjjdU.js");
 		preTrustDirectory(workspace);
 	} catch {}
 	clearReadySignal(agentId);
@@ -5216,7 +5651,22 @@ async function spawnRun(issueId, role, options = {}) {
 	await Effect.runPromise(setOption(agentId, "destroy-unattached", "off"));
 	await Effect.runPromise(setOption(exactPaneTarget(agentId), "remain-on-exit", "on"));
 	if (prompt) {
-		if (shouldDeliverPromptViaPi) try {
+		if (shouldDeliverPromptViaAcp) try {
+			await waitForPromptReady(agentId, resolvedHarness, 30);
+			const delivery = await deliverAgentMessage(agentId, prompt, "spawnRun:initial-prompt");
+			if (!delivery.ok) throw new Error(delivery.failure ?? `ACP delivery returned ok=false via ${delivery.path}`);
+			if (tracksKickoffDelivery) {
+				state.kickoffDelivered = true;
+				await Effect.runPromise(saveAgentState(state));
+			}
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			console.error(`[${agentId}] ACP prompt delivery failed:`, message);
+			if (tracksKickoffDelivery) await recordKickoffDeliveryFailure(state, issueId, role);
+			await Effect.runPromise(stopAgent(agentId));
+			throw new Error(`Agent ${agentId} kickoff delivery failed: ${message}`);
+		}
+		else if (shouldDeliverPromptViaPi) try {
 			await writeOhmypiAgentPrompt(agentId, prompt);
 			if (tracksKickoffDelivery) {
 				state.kickoffDelivered = true;
@@ -5241,9 +5691,9 @@ async function spawnRun(issueId, role, options = {}) {
 	}
 	markAgentRunning(state);
 	try {
-		const { stdout } = await execAsync$2("git rev-parse --short=8 HEAD", { cwd: workspace });
-		const head = stdout.trim();
-		if (head) state.roleRunHead = head;
+		const { snapshotWorkspaceHeadsPromise } = await import("./git-utils-CI6cwyyC.js");
+		const headAnchor = await snapshotWorkspaceHeadsPromise(issueId, workspace);
+		if (headAnchor) state.roleRunHead = headAnchor;
 	} catch {}
 	await Effect.runPromise(saveAgentState(state));
 	if (role !== "review") emitActivityEntrySync({
@@ -5271,7 +5721,7 @@ async function spawnAgent(options) {
 	});
 	console.log(`[DEBUG] Selected model: ${selectedModel}`);
 	if (getProviderForModelSync(selectedModel).name === "openai" && await getProviderAuthMode(selectedModel) === "subscription") {
-		const { isCliproxyRunning } = await import("./cliproxy-DW0V86F8.js");
+		const { isCliproxyRunning } = await import("./cliproxy-PGwTX_o8.js");
 		if (!await Effect.runPromise(isCliproxyRunning())) throw new Error("CLIProxyAPI sidecar is not running. GPT subscription agents route through a local cliproxy process managed by `pan up`. Run `pan up` (or restart the dashboard) before spawning a GPT agent.");
 	}
 	const resolvedHarness = await resolveHarness({
@@ -5279,6 +5729,7 @@ async function spawnAgent(options) {
 		role,
 		model: selectedModel
 	});
+	const isAcp = getHarnessBehavior(resolvedHarness).launchCommandKind === "acp-host";
 	const harnessLaunch = await prepareHarnessLaunch(resolvedHarness);
 	assertCodexNativeAuthForSpawn(resolvedHarness, listAgentStates());
 	await ensureLifecycleHooksBeforeLaunch(agentId, resolvedHarness);
@@ -5300,10 +5751,11 @@ async function spawnAgent(options) {
 	saveAgentStateSync(state);
 	if (role === "work") {
 		try {
-			if (resetPipelineVerdictsForWorkStartSync(options.issueId)) {
-				const { resetPostMergeState } = await import("./merge-agent-BQM3a8z5.js");
-				resetPostMergeState(options.issueId);
-			}
+			const preservation = await shouldPreservePipelineVerdicts(options.issueId, options.workspace);
+			if (preservation.preserve) {
+				if (preservation.refreshedAnchor) setReviewStatusSync(options.issueId, { reviewedAtCommit: preservation.refreshedAnchor });
+				console.log(`[spawn] Preserved pipeline verdicts for ${options.issueId} — ${preservation.reason}`);
+			} else if (resetPipelineVerdictsForWorkStartSync(options.issueId)) (await import("./merge-agent-DrXa1CpW.js")).resetPostMergeState(options.issueId);
 		} catch (err) {
 			console.warn(`[agents] Could not reset stale pipeline verdicts for ${options.issueId}: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -5312,7 +5764,7 @@ async function spawnAgent(options) {
 		});
 	}
 	if (role === "work") try {
-		const { writeStoryFeatureContext } = await import("./work-agent-prompt-Yb2bd3Fq.js");
+		const { writeStoryFeatureContext } = await import("./work-agent-prompt-C-vuP3_J.js");
 		await writeStoryFeatureContext(options.workspace, options.issueId);
 	} catch (ctxErr) {
 		console.warn(`[agents] Could not write story feature context for ${options.issueId}: ${ctxErr.message}`);
@@ -5351,17 +5803,15 @@ async function spawnAgent(options) {
 	});
 	const promptFile = join$1(getAgentDir(agentId), "initial-prompt.md");
 	const tracksKickoffDelivery = role === "work" || role === "strike";
-	if (prompt) {
-		await writeFile$1(promptFile, prompt);
-		if (tracksKickoffDelivery) {
-			state.kickoffDelivered = false;
-			saveAgentStateSync(state);
-		}
+	if (prompt && !isAcp) await writeFile$1(promptFile, prompt);
+	if (prompt && tracksKickoffDelivery) {
+		state.kickoffDelivered = false;
+		saveAgentStateSync(state);
 	}
 	try {
 		const venvPath = join$1(options.workspace, ".venv");
 		if (isTldrEnabledSync() && existsSync(venvPath)) {
-			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DL566HbH.js");
+			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-BKOYB616.js");
 			const tldrService = getTldrDaemonServiceSync(options.workspace, venvPath);
 			if (!(await tldrService.getStatus()).running) {
 				await tldrService.start(true);
@@ -5391,6 +5841,7 @@ async function spawnAgent(options) {
 		useSupervisor: supervisorLaunch.useSupervisor,
 		supervisorScriptPath: supervisorLaunch.supervisorScriptPath,
 		harness: state.harness ?? "claude-code",
+		harnessBinaryPath: harnessLaunch.binaryPath,
 		sessionId: state.sessionId,
 		extraEnvExports: [harnessLaunch.pathExport, ...flywheelEnvExports(flywheelEnv)],
 		effort: options.effort
@@ -5401,13 +5852,13 @@ async function spawnAgent(options) {
 	const claudeCmd = `bash ${launcherScript}`;
 	console.log(`[claude-invoke] purpose=work-agent | model=${state.model} | source=agents.ts:spawnAgent | session=${agentId} | command="${claudeCmd}"`);
 	try {
-		const { preTrustDirectory } = await import("./workspace-manager-ZTdJAy9M.js");
+		const { preTrustDirectory } = await import("./workspace-manager-CDTKjjdU.js");
 		preTrustDirectory(options.workspace);
 	} catch {}
 	try {
-		const { isGitHubAppConfigured, generateInstallationToken, configureWorkspaceForBot } = await import("./github-app-CPfoFAdV.js");
+		const { isGitHubAppConfigured, generateInstallationToken, configureWorkspaceForBot } = await import("./github-app-DtAsvwzK.js");
 		if (isGitHubAppConfigured()) {
-			const { findProjectByPathSync } = await import("./projects-9SkRpES9.js");
+			const { findProjectByPathSync } = await import("./projects-B03Wr-xc.js");
 			const ghRepo = findProjectByPathSync(resolve$1(options.workspace, "..", ".."))?.github_repo;
 			if (ghRepo) {
 				const [owner, repo] = ghRepo.split("/");
@@ -5437,7 +5888,22 @@ async function spawnAgent(options) {
 		sessionHarness: resolvedHarness
 	});
 	const dismissChannelsDialogPromise = channelsBridgeMcpConfig ? dismissDevChannelsDialog(agentId).catch(() => void 0) : null;
-	if (prompt && resolvedHarness === "ohmypi") try {
+	if (prompt && isAcp) try {
+		await waitForPromptReady(agentId, resolvedHarness, 30);
+		const delivery = await deliverAgentMessage(agentId, prompt, "spawnAgent:initial-prompt");
+		if (!delivery.ok) throw new Error(delivery.failure ?? `ACP delivery returned ok=false via ${delivery.path}`);
+		if (tracksKickoffDelivery) {
+			state.kickoffDelivered = true;
+			saveAgentStateSync(state);
+		}
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`[${agentId}] ACP prompt delivery failed:`, message);
+		if (tracksKickoffDelivery) await recordKickoffDeliveryFailure(state, options.issueId, role);
+		await Effect.runPromise(stopAgent(agentId));
+		throw new Error(`Agent ${agentId} kickoff delivery failed: ${message}`);
+	}
+	else if (prompt && resolvedHarness === "ohmypi") try {
 		await writeOhmypiAgentPrompt(agentId, prompt);
 		if (tracksKickoffDelivery) {
 			state.kickoffDelivered = true;
@@ -5470,7 +5936,7 @@ async function spawnAgent(options) {
 		const codexHomeForAgent = join$1(homedir(), ".overdeck", "agents", agentId, "codex-home");
 		(async () => {
 			try {
-				const { waitForCodexRollout, extractThreadIdFromRollout, writeThreadId } = await import("./codex-Dg7Is5yb.js");
+				const { waitForCodexRollout, extractThreadIdFromRollout, writeThreadId } = await import("./codex-BdEsUFWh.js");
 				const rollout = await waitForCodexRollout(codexHomeForAgent, 12e4);
 				if (rollout) {
 					const threadId = extractThreadIdFromRollout(rollout);
@@ -5572,6 +6038,7 @@ var init_spawn = __esmMin((() => {
 	init_launcher_generator();
 	init_providers();
 	init_review_status();
+	init_verdict_preservation();
 	init_harness_resolve();
 	init_harness_binary();
 	init_codex_auth();
@@ -6098,6 +6565,11 @@ function pickFreshestExistingSessionIdSync(agentId, candidates) {
 function getLatestSessionIdSync(agentId) {
 	const codexThreadId = resolveCodexThreadIdSync(agentId);
 	if (codexThreadId) return codexThreadId;
+	const agentState = getAgentStateSync(agentId);
+	if (agentState?.harness && getHarnessBehavior(agentState.harness).sessionIdSource === "acp-session-id") try {
+		const acpSessionId = readFileSync(join$1(getAgentDir(agentId), "acp-session-id"), "utf-8").trim();
+		if (acpSessionId) return acpSessionId;
+	} catch {}
 	const fromSessionFile = getSessionId(agentId);
 	if (fromSessionFile) return fromSessionFile;
 	const sessionsFile = join$1(getAgentDir(agentId), "sessions.json");
@@ -6119,7 +6591,6 @@ function getLatestSessionIdSync(agentId) {
 			if (threadId) return threadId;
 		}
 	} catch {}
-	const agentState = getAgentStateSync(agentId);
 	if (agentState?.harness && getHarnessBehavior(agentState.harness).sessionIdSource === "transcript-jsonl") {
 		const ohmypiSessionId = resolveLatestOhmypiSessionId(agentId);
 		if (ohmypiSessionId) return ohmypiSessionId;
@@ -6194,11 +6665,81 @@ function sessionRotationRefused(opts) {
 }
 var init_session_rotation = __esmMin((() => {}));
 //#endregion
+//#region ../../lib/agents/monitor-transport.ts
+/**
+* PAN-3015: pull-based monitor transport for Claude Code sessions.
+*
+* A `pan monitor` process runs as a background task INSIDE the agent's Claude
+* Code session. Claude Code surfaces background-command stdout to the model at
+* the next turn boundary (and wakes an idle session), so a message printed by
+* the monitor reaches the model without any keystroke injection — no composer
+* paste, no echo confirmation, no Enter timing.
+*
+* This module holds the shared pieces: the presence protocol senders use to
+* decide the monitor tier is live, the mail-file format, and the drain logic.
+* The long-running loop lives in `src/cli/commands/monitor.ts`; the delivery
+* decision lives in `messageAgent` (src/lib/agents/messaging.ts) — mid-session
+* tells only, never kickoff/resume (no monitor exists before the first turn).
+* See docs/MONITOR-TRANSPORT.md.
+*/
+function monitorPresencePath(agentId) {
+	return join$1(getAgentDir(agentId), "monitor.json");
+}
+function isPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* A monitor counts as live only with BOTH a fresh heartbeat and a live pid —
+* a dead monitor must fall through to keystroke transports, not strand the
+* message unread (it stays durable in mail/ either way).
+*/
+function isMonitorLive(agentId, nowMs = Date.now()) {
+	try {
+		const raw = readFileSync(monitorPresencePath(agentId), "utf-8");
+		const presence = JSON.parse(raw);
+		if (typeof presence.pid !== "number" || typeof presence.heartbeatAt !== "string") return false;
+		const beatMs = Date.parse(presence.heartbeatAt);
+		if (!Number.isFinite(beatMs) || nowMs - beatMs > 45e3) return false;
+		return isPidAlive(presence.pid);
+	} catch {
+		return false;
+	}
+}
+/**
+* Mail-file format (PAN-3015 adds the provenance header; the legacy format is
+* `# Message\n\n<body>` and must keep parsing):
+*
+*   # Message
+*
+*   source: pan-tell
+*   date: 2026-07-24T00:00:00.000Z
+*
+*   <body>
+*/
+function formatMailFileContent(body, source, date) {
+	return `# Message\n\nsource: ${source}\ndate: ${date.toISOString()}\n\n${body}\n`;
+}
+var init_monitor_transport = __esmMin((() => {
+	init_agent_state();
+}));
+//#endregion
 //#region ../../lib/agents/messaging.ts
-function queueAgentMail(agentId, message, pendingTurnEndDelivery = false) {
+function queueAgentMail(agentId, message, pendingTurnEndDelivery = false, dedupKey, source) {
 	const mailDir = join$1(getAgentDir(agentId), "mail");
 	mkdirSync(mailDir, { recursive: true });
-	writeFileSync(join$1(mailDir, `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}${pendingTurnEndDelivery ? ".pending" : ""}.md`), `# Message\n\n${message}\n`);
+	const now = /* @__PURE__ */ new Date();
+	const filename = dedupKey !== void 0 ? `dedup-${createHash("sha256").update(dedupKey).digest("hex").slice(0, 24)}.md` : `${now.toISOString().replace(/[:.]/g, "-")}${pendingTurnEndDelivery ? ".pending" : ""}.md`;
+	const content = source ? formatMailFileContent(message, source, now) : `# Message\n\n${message}\n`;
+	writeFileSync(join$1(mailDir, filename), content);
+}
+function resolveAgentDeliveryMethod(state) {
+	if (state?.harness === "acp") return "auto";
+	return resilientDeliveryMethod(state?.deliveryMethod);
 }
 function claimCodexIdleTurn(agentId) {
 	try {
@@ -6221,6 +6762,34 @@ async function appendTellInterventionForUserSource(normalizedId, caller) {
 		source: caller
 	});
 }
+/** Call the delivery door with the idempotency key only when one is set, so
+* unkeyed callers keep their exact pre-key call shape. */
+function deliverWithOptionalKey(normalizedId, message, caller, deliveryMethod, dedupKey) {
+	return dedupKey !== void 0 ? deliverAgentMessage(normalizedId, message, caller, deliveryMethod, { dedupKey }) : deliverAgentMessage(normalizedId, message, caller, deliveryMethod);
+}
+/**
+* Keyed delivery to an agent that must be resumed first (PAN-2997 review
+* cycle 7). The keyed message NEVER rides the resume kickoff prompt: the
+* kickoff is delivered by components that cannot enforce the key, so a
+* dashboard crash after the kickoff but before any post-hoc key bookkeeping
+* would replay the wake. Instead the agent is resumed with its bare
+* auto-continue prompt, and the keyed message then goes through the keyed
+* delivery door, where the crash-independent component — the new session's
+* supervisor key set or the tmux session's two-phase markers — enforces
+* at-most-once across the whole replay window.
+*/
+async function resumeThenDeliverKeyed(normalizedId, message, caller, agentState, dedupKey) {
+	const { resumeAgent } = await import("./agents-BKKkxKgK.js");
+	const result = await resumeAgent(normalizedId);
+	if (!result.success) throw new Error(`Failed to auto-resume agent: ${result.error}`);
+	const delivery = await deliverAgentMessage(normalizedId, message, `messageAgent:${caller}`, resolveAgentDeliveryMethod(agentState), { dedupKey });
+	await appendTellInterventionForUserSource(normalizedId, caller);
+	return {
+		delivered: delivery.ok,
+		queuedToMail: false,
+		...delivery.deduplicated ? { deduplicated: true } : {}
+	};
+}
 async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 	const normalizedId = normalizeAgentId(agentId);
 	const agentState = getAgentStateSync(normalizedId);
@@ -6241,45 +6810,65 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 	};
 	if (agentState?.paused === true) {
 		const gateBlockReason = getAgentResumeGateBlockReason(agentState)?.reason ?? "agent is paused";
-		queueAgentMail(normalizedId, message);
+		queueAgentMail(normalizedId, message, false, opts.dedupKey);
 		logAgentLifecycleSync(normalizedId, `messageAgent queued mail without resume: ${gateBlockReason}`);
 		console.log(`[agents] Queued message for ${normalizedId}; ${gateBlockReason}`);
-		return;
+		return {
+			delivered: false,
+			queuedToMail: true,
+			reason: gateBlockReason
+		};
 	}
 	if (getAgentRuntimeStateSync(normalizedId)?.state === "suspended") {
 		const suspendedGate = decideMessageGate();
 		if (suspendedGate.decision !== "proceed") {
 			const gateBlockReason = suspendedGate.reason ?? "agent is gated";
-			queueAgentMail(normalizedId, message);
+			queueAgentMail(normalizedId, message, false, opts.dedupKey);
 			logAgentLifecycleSync(normalizedId, `messageAgent queued mail without resume: ${gateBlockReason}`);
 			console.log(`[agents] Queued message for ${normalizedId}; ${gateBlockReason}`);
-			return;
+			return {
+				delivered: false,
+				queuedToMail: true,
+				reason: gateBlockReason
+			};
 		}
 		console.log(`[agents] Auto-resuming suspended agent ${normalizedId} to deliver message`);
-		const { resumeAgent } = await import("./agents-FlIgQ3ql.js");
+		if (opts.dedupKey !== void 0) return resumeThenDeliverKeyed(normalizedId, message, caller, agentState, opts.dedupKey);
+		const { resumeAgent } = await import("./agents-BKKkxKgK.js");
 		const result = await resumeAgent(normalizedId, message);
 		if (!result.success) throw new Error(`Failed to auto-resume agent: ${result.error}`);
 		if (result.messageDelivered === false) throw new Error(`Agent resumed but ready signal did not fire — message not delivered. Feedback is in the mail queue.`);
 		await appendTellInterventionForUserSource(normalizedId, caller);
-		return;
+		return {
+			delivered: true,
+			queuedToMail: false
+		};
 	}
 	if (agentState && agentState.status === "stopped") {
 		const stoppedGate = decideMessageGate();
 		if (stoppedGate.decision !== "proceed") {
 			const gateBlockReason = stoppedGate.reason ?? "agent is gated";
-			queueAgentMail(normalizedId, message);
+			queueAgentMail(normalizedId, message, false, opts.dedupKey);
 			logAgentLifecycleSync(normalizedId, `messageAgent queued mail without resume: ${gateBlockReason}`);
 			console.log(`[agents] Queued message for ${normalizedId}; ${gateBlockReason}`);
-			return;
+			return {
+				delivered: false,
+				queuedToMail: true,
+				reason: gateBlockReason
+			};
 		}
 		console.log(`[agents] Auto-resuming stopped agent ${normalizedId} to deliver feedback (session exists: ${await Effect.runPromise(sessionExists(normalizedId))})`);
-		const { resumeAgent } = await import("./agents-FlIgQ3ql.js");
+		if (opts.dedupKey !== void 0) return resumeThenDeliverKeyed(normalizedId, message, caller, agentState, opts.dedupKey);
+		const { resumeAgent } = await import("./agents-BKKkxKgK.js");
 		const resumeResult = await resumeAgent(normalizedId, message);
-		queueAgentMail(normalizedId, message);
+		queueAgentMail(normalizedId, message, false);
 		if (resumeResult.success && resumeResult.messageDelivered !== false) {
 			await appendTellInterventionForUserSource(normalizedId, caller);
 			console.log(`[agents] Resumed ${normalizedId} and delivered feedback`);
-			return;
+			return {
+				delivered: true,
+				queuedToMail: true
+			};
 		}
 		if (!resumeResult.success) console.warn(`[agents] Resume failed for ${normalizedId}: ${resumeResult.error} — falling back to fresh launch`);
 		else console.warn(`[agents] Resume succeeded for ${normalizedId} but message not delivered (ready signal timed out) — falling back to fresh launch`);
@@ -6292,7 +6881,11 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 				message: `${normalizedId}: ${stopMsg}`,
 				issueId: agentState.issueId
 			});
-			return;
+			return {
+				delivered: false,
+				queuedToMail: true,
+				reason: stopMsg
+			};
 		}
 		const providerEnv = agentState.model ? await getProviderEnvForModel(agentState.model) : {};
 		if (agentState.model) {
@@ -6310,7 +6903,7 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 		const resumeModel = agentState.model || "claude-sonnet-4-6";
 		const fallbackHarness = agentState.harness ?? "claude-code";
 		const harnessLaunch = await prepareHarnessLaunch(fallbackHarness);
-		const { assertWorkspaceStackHealthyForSpawn } = await import("./agents-FlIgQ3ql.js");
+		const { assertWorkspaceStackHealthyForSpawn } = await import("./agents-BKKkxKgK.js");
 		await assertWorkspaceStackHealthyForSpawn(agentState.issueId || normalizedId.replace(/^agent-/, "").toUpperCase(), resumeRole, agentState.hostOverride === true, agentState.workspace);
 		const fallbackPiFields = fallbackHarness === "ohmypi" ? await getOhmypiLauncherFields(normalizedId, resumeModel) : {};
 		const fallbackCodexFields = fallbackHarness === "codex" ? getCodexLauncherFields(normalizedId, resumeModel, agentState.workspace, resumeRole) : {};
@@ -6341,7 +6934,10 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 		saveAgentStateSync(agentState);
 		const ready = await waitForPromptReady(normalizedId, fallbackHarness, 30);
 		const resumeMessage = await buildResumeMessageForAgent(agentState, `You are resuming work on ${agentState.issueId}. Check .pan/feedback/ for specialist feedback that arrived while you were stopped, then continue working.\n\n${message}`, message);
+		let delivered = false;
+		let reason;
 		if (resumeMessage.error) {
+			reason = resumeMessage.error;
 			console.error(`[agents] Fallback-restarted ${normalizedId} but ${resumeMessage.error}`);
 			emitActivityEntrySync({
 				source: "work-agent",
@@ -6350,7 +6946,6 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 				issueId: agentState.issueId
 			});
 		} else if (ready && resumeMessage.message) {
-			let delivered = false;
 			if (fallbackHarness === "claude-code") {
 				const fallbackSessionId = getLatestSessionIdSync(normalizedId);
 				if (fallbackSessionId) {
@@ -6360,65 +6955,131 @@ async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 						sessionId: fallbackSessionId,
 						message: resumeMessage.message,
 						caller: "resumeAgent:resume-prompt",
-						deliveryMethod: resilientDeliveryMethod(agentState.deliveryMethod)
+						deliveryMethod: resolveAgentDeliveryMethod(agentState)
 					});
 					delivered = delivery.delivered;
-					if (!delivery.delivered) console.error(`[agents] Fallback resume prompt did not land after ${delivery.attempts} delivery attempts`);
-				} else console.error(`[agents] Fallback-restarted ${normalizedId} but no session id was recorded — feedback in mail queue`);
-			} else delivered = (await deliverAgentMessage(normalizedId, resumeMessage.message, "resumeAgent:resume-prompt", resilientDeliveryMethod(agentState.deliveryMethod))).ok;
+					if (!delivery.delivered) {
+						reason = `resume prompt did not land after ${delivery.attempts} delivery attempts`;
+						console.error(`[agents] Fallback resume prompt did not land after ${delivery.attempts} delivery attempts`);
+					}
+				} else {
+					reason = "no session id was recorded";
+					console.error(`[agents] Fallback-restarted ${normalizedId} but no session id was recorded — feedback in mail queue`);
+				}
+			} else {
+				const delivery = await deliverWithOptionalKey(normalizedId, resumeMessage.message, "resumeAgent:resume-prompt", resolveAgentDeliveryMethod(agentState), opts.dedupKey);
+				delivered = delivery.ok;
+				if (!delivery.ok) reason = "resume prompt delivery failed";
+			}
 			if (delivered) {
 				if (resumeMessage.redeliveringKickoff) markKickoffRedelivered(agentState);
 				await appendTellInterventionForUserSource(normalizedId, caller);
 				console.log(`[agents] Fallback-restarted ${normalizedId} and delivered feedback`);
 			}
-		} else console.warn(`[agents] Fallback-restarted ${normalizedId} but ready signal not detected — feedback in mail queue`);
-		return;
+		} else {
+			reason = "ready signal not detected";
+			console.warn(`[agents] Fallback-restarted ${normalizedId} but ready signal not detected — feedback in mail queue`);
+		}
+		return {
+			delivered,
+			queuedToMail: true,
+			...reason ? { reason } : {}
+		};
 	}
-	const { loadRemoteAgentState, sendToRemoteAgent } = await import("./remote-agents-CRCg1L4H.js");
+	const { loadRemoteAgentState, sendToRemoteAgent } = await import("./remote-agents-C1bssi41.js");
 	const remoteState = loadRemoteAgentState(normalizedId);
 	if (remoteState && remoteState.vmName) {
 		console.log(`[agents] Sending message to remote agent ${normalizedId} on ${remoteState.vmName}`);
+		if (opts.dedupKey !== void 0) {
+			const { sendToRemoteAgentKeyed } = await import("./remote-agents-C1bssi41.js");
+			const remoteOutcome = await sendToRemoteAgentKeyed(normalizedId, remoteState.vmName, message, opts.dedupKey);
+			queueAgentMail(normalizedId, message, false, opts.dedupKey);
+			await appendTellInterventionForUserSource(normalizedId, caller);
+			return {
+				delivered: true,
+				queuedToMail: true,
+				...remoteOutcome === "deduplicated" ? {
+					reason: "deduplicated",
+					deduplicated: true
+				} : {}
+			};
+		}
 		await sendToRemoteAgent(normalizedId, remoteState.vmName, message);
-		queueAgentMail(normalizedId, message);
+		queueAgentMail(normalizedId, message, false);
 		await appendTellInterventionForUserSource(normalizedId, caller);
-		return;
+		return {
+			delivered: true,
+			queuedToMail: true
+		};
 	}
 	const expectedHarness = agentState?.harness ?? "claude-code";
+	if (expectedHarness === "claude-code" && opts.dedupKey === void 0 && isMonitorLive(normalizedId)) {
+		queueAgentMail(normalizedId, message, false, opts.dedupKey, caller);
+		logAgentLifecycleSync(normalizedId, `messageAgent delivered via monitor mail (caller: ${caller})`);
+		console.log(`[agents] Delivered message to ${normalizedId} via monitor inbox`);
+		await appendTellInterventionForUserSource(normalizedId, caller);
+		return {
+			delivered: true,
+			queuedToMail: true,
+			reason: "monitor"
+		};
+	}
 	let appServerState;
 	try {
 		appServerState = (await getCodexAppServerStatus(normalizedId)).state;
 	} catch {}
 	if (appServerState && appServerState !== "closed" && appServerState !== "error") {
 		if (!claimCodexIdleTurn(normalizedId)) {
-			queueAgentMail(normalizedId, message, true);
+			queueAgentMail(normalizedId, message, true, opts.dedupKey);
 			logAgentLifecycleSync(normalizedId, "messageAgent queued mail for codex turn-end delivery: agent busy");
 			console.log(`[agents] Queued message for ${normalizedId}; codex agent is mid-turn`);
 			await appendTellInterventionForUserSource(normalizedId, caller);
-			return;
+			return {
+				delivered: true,
+				queuedToMail: true,
+				reason: "queued for turn-end delivery"
+			};
 		}
-		const deliveryMethod = resilientDeliveryMethod(agentState?.deliveryMethod);
-		await deliverAgentMessage(normalizedId, message, `messageAgent:${caller}`, deliveryMethod);
-		queueAgentMail(normalizedId, message);
+		const deliveryMethod = resolveAgentDeliveryMethod(agentState);
+		const delivery = await deliverWithOptionalKey(normalizedId, message, `messageAgent:${caller}`, deliveryMethod, opts.dedupKey);
+		queueAgentMail(normalizedId, message, false, opts.dedupKey);
 		await appendTellInterventionForUserSource(normalizedId, caller);
-		return;
+		return {
+			delivered: delivery.ok,
+			queuedToMail: true,
+			...delivery.deduplicated ? { deduplicated: true } : {}
+		};
 	}
 	if (!await Effect.runPromise(sessionExists(normalizedId))) throw new Error(`Agent ${normalizedId} not running`);
 	const panePids = await Effect.runPromise(listPaneValues(normalizedId, "#{pane_pid}"));
 	if (panePids.length > 0 && !await hasAgentRuntimeInSubtree(panePids[0], expectedHarness)) {
 		console.warn(`[agents] ${normalizedId} tmux session is a zombie (no ${expectedHarness} runtime) — attempting resume`);
-		const { resumeAgent } = await import("./agents-FlIgQ3ql.js");
+		if (opts.dedupKey !== void 0) return resumeThenDeliverKeyed(normalizedId, message, caller, agentState, opts.dedupKey);
+		const { resumeAgent } = await import("./agents-BKKkxKgK.js");
 		const resumeResult = await resumeAgent(normalizedId, message);
 		if (resumeResult.success) {
-			if (resumeResult.messageDelivered !== false) await appendTellInterventionForUserSource(normalizedId, caller);
-			return;
+			const delivered = resumeResult.messageDelivered !== false;
+			if (delivered) await appendTellInterventionForUserSource(normalizedId, caller);
+			return {
+				delivered,
+				queuedToMail: false
+			};
 		}
 		throw new Error(`Agent ${normalizedId} session is dead and resume failed: ${resumeResult.error}`);
 	}
 	if (!await waitForAgentIdle(normalizedId, 5e3)) console.warn(`[agents] ${normalizedId} not at idle prompt after 5s — sending message anyway`);
-	const deliveryMethod = resilientDeliveryMethod(agentState?.deliveryMethod);
-	await deliverAgentMessage(normalizedId, message, `messageAgent:${caller}`, deliveryMethod);
-	queueAgentMail(normalizedId, message);
+	const deliveryMethod = resolveAgentDeliveryMethod(agentState);
+	const delivery = await deliverWithOptionalKey(normalizedId, message, `messageAgent:${caller}`, deliveryMethod, opts.dedupKey);
+	if (opts.dedupKey === void 0) queueAgentMail(normalizedId, message, false);
 	await appendTellInterventionForUserSource(normalizedId, caller);
+	return {
+		delivered: delivery.ok,
+		queuedToMail: opts.dedupKey === void 0,
+		...delivery.deduplicated ? { deduplicated: true } : {}
+	};
+}
+async function messageAgentWithOutcome(agentId, message, caller = "internal", opts = {}) {
+	return (await messageAgent(agentId, message, caller, opts)).delivered ? "delivered" : "queued";
 }
 var USER_MESSAGE_INTERVENTION_SOURCES;
 var init_messaging = __esmMin((() => {
@@ -6435,6 +7096,7 @@ var init_messaging = __esmMin((() => {
 	init_agent_state();
 	init_activity();
 	init_delivery();
+	init_monitor_transport();
 	init_runtime_state();
 	init_runtime_command();
 	init_supervisor_channels();
@@ -6487,6 +7149,54 @@ var init_context_overflow = __esmMin((() => {
 	];
 }));
 //#endregion
+//#region ../../lib/agents/session-pointers.ts
+/**
+* Clear every mutable pointer that can make a later launch resume an old
+* session. Claude JSONL transcripts live outside the agent directory and are
+* deliberately never touched.
+*/
+async function clearAgentSessionPointers(agentId) {
+	const agentDir = getAgentDir(agentId);
+	const cleared = [];
+	for (const name of [
+		"session.id",
+		"sessions.json",
+		"codex-thread-id",
+		"launcher.sh"
+	]) {
+		const path = join(agentDir, name);
+		if (!existsSync$1(path)) continue;
+		unlinkSync$1(path);
+		cleared.push(name);
+	}
+	const runtimeFile = join(agentDir, "runtime.json");
+	if (existsSync$1(runtimeFile)) try {
+		const runtime = JSON.parse(readFileSync$1(runtimeFile, "utf-8"));
+		if (Object.prototype.hasOwnProperty.call(runtime, "claudeSessionId")) {
+			delete runtime.claudeSessionId;
+			writeFileSync$1(runtimeFile, JSON.stringify(runtime, null, 2));
+			cleared.push("runtime.json:claudeSessionId");
+		}
+	} catch {}
+	const state = getAgentStateSync(agentId);
+	if (state?.sessionId) {
+		delete state.sessionId;
+		saveAgentStateSync(state);
+		cleared.push("agents.session_id");
+	}
+	await Effect.runPromise(emitAgentEvent(agentId, {
+		kind: "model_set",
+		model: state?.model ?? "unknown",
+		claudeSessionId: null
+	}));
+	cleared.push("runtime.claudeSessionId");
+	return { cleared };
+}
+var init_session_pointers = __esmMin((() => {
+	init_agent_runtime();
+	init_agent_state();
+}));
+//#endregion
 //#region ../../lib/agents/resume.ts
 /**
 * Resume a suspended agent (PAN-80)
@@ -6519,7 +7229,7 @@ async function buildCompactRecoverySeed(agentId) {
 	if (agentState?.workspace && sessionId) {
 		const sessionFile = sessionFilePath(agentState.workspace, sessionId);
 		try {
-			const [{ getConversationCompactionSettings }, { generateSmartSummary }] = await Promise.all([import("./conversation-compaction-DiG5zWQq.js"), import("./smart-compaction-CHIxLr_d.js")]);
+			const [{ getConversationCompactionSettings }, { generateSmartSummary }] = await Promise.all([import("./conversation-compaction-Dj4FAKoZ.js"), import("./smart-compaction-CPp2Ykf6.js")]);
 			const settings = getConversationCompactionSettings();
 			summary = (await Effect.runPromise(generateSmartSummary({
 				jsonlPath: sessionFile,
@@ -6530,7 +7240,7 @@ async function buildCompactRecoverySeed(agentId) {
 		} catch (err) {
 			logAgentLifecycleSync(normalizedId, `compact-recovery smart summary failed (${err instanceof Error ? err.message : String(err)}); trying heuristic fallback`);
 			try {
-				const { generateFallbackSummary } = await import("./summary-fork-D8bXjCr7.js");
+				const { generateFallbackSummary } = await import("./summary-fork-CD7GOts0.js");
 				summary = await Effect.runPromise(generateFallbackSummary(sessionFile));
 			} catch (fallbackErr) {
 				logAgentLifecycleSync(normalizedId, `compact-recovery fallback summary failed (${fallbackErr instanceof Error ? fallbackErr.message : String(fallbackErr)}); seeding with reseed instructions only`);
@@ -6655,7 +7365,13 @@ async function resumeAgent(agentId, message, opts) {
 		if (legacyHarnessMigrated) resumeDriftReasons.push(`legacy harness ${priorHarness}→${effectiveHarness} (PAN-1797 re-default)`);
 		const piDeadRecovery = effectiveHarness === "ohmypi" && !piProcessWasAlive && !compactSeed && resumeDriftReasons.length === 0;
 		if (piDeadRecovery) logAgentLifecycleSync(normalizedId, "resumeAgent: dead ohmypi process — fresh-launching for recovery instead of omp --resume (PAN-2009)");
-		const shouldResumeSavedSession = !compactSeed && resumeDriftReasons.length === 0 && !piDeadRecovery;
+		const expectedClaudeJsonl = sessionFilePath(agentState.workspace, sessionId);
+		const claudeJsonlMissingRecovery = effectiveHarness === "claude-code" && !compactSeed && resumeDriftReasons.length === 0 && !existsSync(expectedClaudeJsonl);
+		if (claudeJsonlMissingRecovery) {
+			logAgentLifecycleSync(normalizedId, `resumeAgent: saved Claude transcript is missing at ${expectedClaudeJsonl} — clearing stale pointers and fresh-launching (PAN-2895)`);
+			await clearAgentSessionPointers(normalizedId);
+		}
+		const shouldResumeSavedSession = !compactSeed && resumeDriftReasons.length === 0 && !piDeadRecovery && !claudeJsonlMissingRecovery;
 		if (sessionRotationRefused({
 			compactSeed: Boolean(compactSeed),
 			driftReasons: resumeDriftReasons,
@@ -6676,12 +7392,14 @@ async function resumeAgent(agentId, message, opts) {
 		}
 		const freshSessionId = !shouldResumeSavedSession && effectiveHarness === "claude-code" ? randomUUID() : void 0;
 		if (resumeDriftReasons.length > 0) logAgentLifecycleSync(normalizedId, `resumeAgent: starting fresh session instead of --resume because session origin drifted (${resumeDriftReasons.join(", ")})`);
-		if (freshSessionId) saveSessionId(normalizedId, freshSessionId);
-		else if (!shouldResumeSavedSession) try {
+		if (freshSessionId) {
+			saveSessionId(normalizedId, freshSessionId);
+			agentState.sessionId = freshSessionId;
+		} else if (!shouldResumeSavedSession) try {
 			unlinkSync(join$1(getAgentDir(normalizedId), "session.id"));
 		} catch {}
 		const issueId = agentState.issueId || normalizedId.replace(/^agent-/, "").toUpperCase();
-		const defaultResumeMessage = buildDefaultResumeContinueMessage(issueId);
+		const defaultResumeMessage = buildResumeContinueMessage(agentState);
 		const resumeMessage = compactSeed ? {
 			message: message ? `${compactSeed}\n\n${message}` : compactSeed,
 			redeliveringKickoff: false
@@ -6715,6 +7433,7 @@ async function resumeAgent(agentId, message, opts) {
 			} : {},
 			sessionId: freshSessionId,
 			harness: effectiveHarness,
+			harnessBinaryPath: harnessLaunch.binaryPath,
 			useSupervisor: supervisorLaunch.useSupervisor,
 			supervisorScriptPath: supervisorLaunch.supervisorScriptPath,
 			extraEnvExports: [harnessLaunch.pathExport]
@@ -6730,6 +7449,11 @@ async function resumeAgent(agentId, message, opts) {
 			CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: "false",
 			...providerEnv
 		} }));
+		if (freshSessionId) await saveAgentRuntimeState(normalizedId, {
+			claudeSessionId: freshSessionId,
+			sessionModel: model,
+			sessionHarness: effectiveHarness
+		});
 		let messageDelivered = false;
 		if (effectiveHarness === "ohmypi") try {
 			await writeOhmypiAgentPrompt(normalizedId, effectiveMessage);
@@ -6739,7 +7463,18 @@ async function resumeAgent(agentId, message, opts) {
 			const msg = err instanceof Error ? err.message : String(err);
 			console.error(`[resumeAgent] ohmypi prompt delivery failed: ${msg}`);
 		}
-		else if (effectiveHarness === "codex") {
+		else if (effectiveHarness === "acp") {
+			const delivery = await deliverInitialPromptWithRetry(normalizedId, effectiveMessage, "resumeAgent:acp-continue");
+			messageDelivered = delivery.ok;
+			if (delivery.ok && resumeMessage.redeliveringKickoff) markKickoffRedelivered(agentState);
+			if (!delivery.ok) {
+				await Effect.runPromise(killSession(normalizedId));
+				return {
+					success: false,
+					error: `ACP continue prompt did not land: ${delivery.failure ?? "unknown failure"}`
+				};
+			}
+		} else if (effectiveHarness === "codex") {
 			const delivery = await deliverInitialPromptWithRetry(normalizedId, effectiveMessage, "resumeAgent:codex-continue", resilientDeliveryMethod(agentState.deliveryMethod));
 			messageDelivered = delivery.ok;
 			if (delivery.ok && resumeMessage.redeliveringKickoff) markKickoffRedelivered(agentState);
@@ -6768,6 +7503,9 @@ async function resumeAgent(agentId, message, opts) {
 		} else if (piDeadRecovery) {
 			console.log(`[agents] Respawned ${normalizedId} fresh because the prior Pi process was dead (archived session ${sessionId})`);
 			logAgentLifecycleSync(normalizedId, `resumeAgent SUCCESS: fresh respawn after dead Pi process (archived sessionId=${sessionId}), messageDelivered=${messageDelivered}`);
+		} else if (claudeJsonlMissingRecovery) {
+			console.log(`[agents] Respawned ${normalizedId} fresh because the saved Claude transcript was missing (stale session ${sessionId}${freshSessionId ? `, new session ${freshSessionId}` : ""})`);
+			logAgentLifecycleSync(normalizedId, `resumeAgent SUCCESS: fresh respawn after missing Claude JSONL (stale sessionId=${sessionId}${freshSessionId ? `, newSessionId=${freshSessionId}` : ""}), messageDelivered=${messageDelivered}`);
 		} else if (!shouldResumeSavedSession) {
 			console.log(`[agents] Respawned ${normalizedId} fresh because session origin drifted (archived session ${sessionId}${freshSessionId ? `, new session ${freshSessionId}` : ""})`);
 			logAgentLifecycleSync(normalizedId, `resumeAgent SUCCESS: fresh respawn after origin drift (archived sessionId=${sessionId}${freshSessionId ? `, newSessionId=${freshSessionId}` : ""}), messageDelivered=${messageDelivered}`);
@@ -6850,6 +7588,7 @@ var init_resume = __esmMin((() => {
 	init_tmux();
 	init_agent_state();
 	init_activity();
+	init_session_pointers();
 	init_delivery();
 	init_identity();
 	init_runtime_state();
@@ -6885,7 +7624,7 @@ var init_graceful_restart = __esmMin((() => {
 //#endregion
 //#region ../../lib/agents/recovery.ts
 function resolveRecoveryResumeSessionId(agentId, harness) {
-	if (harness !== "codex") return void 0;
+	if (harness !== "codex" && harness !== "acp") return void 0;
 	return getLatestSessionIdSync(agentId) ?? void 0;
 }
 async function restartAgent(agentId, opts = {}) {
@@ -6945,6 +7684,7 @@ async function restartAgent(agentId, opts = {}) {
 			role: agentState.role,
 			isPlanning: agentState.role === "plan",
 			harness: effectiveHarness,
+			harnessBinaryPath: harnessLaunch.binaryPath,
 			useSupervisor: supervisorLaunch.useSupervisor,
 			supervisorScriptPath: supervisorLaunch.supervisorScriptPath,
 			extraEnvExports: [harnessLaunch.pathExport]
@@ -6962,18 +7702,20 @@ async function restartAgent(agentId, opts = {}) {
 			GIT_SEQUENCE_EDITOR: "false",
 			...providerEnv
 		} }));
-		const prompt = message || `You are resuming work on ${agentState.issueId}. Read .pan/continue.json for context and pick up where you left off.`;
+		const prompt = message || buildResumeContinueMessage(agentState);
 		if (effectiveHarness === "ohmypi") try {
 			await writeOhmypiAgentPrompt(normalizedId, prompt);
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
 			console.error(`[restartAgent] ohmypi prompt delivery failed for ${normalizedId}: ${msg}`);
 		}
-		else if (await waitForPromptReady(normalizedId, effectiveHarness, 30)) {
+		else {
+			if (!await waitForPromptReady(normalizedId, effectiveHarness, 30)) throw new Error(`${getHarnessBehavior(effectiveHarness).displayName} did not become ready within 30s for ${normalizedId}`);
 			await new Promise((r) => setTimeout(r, 500));
-			if (effectiveHarness === "codex") await deliverAgentMessage(normalizedId, prompt, "restartAgent:continue-prompt", resilientDeliveryMethod(agentState.deliveryMethod));
-			else await Effect.runPromise(sendKeys(normalizedId, prompt));
-		} else console.error(`[restartAgent] ${effectiveHarness === "codex" ? "Codex" : "Claude"} did not become ready within 30s for ${normalizedId}`);
+			if (effectiveHarness === "codex" || effectiveHarness === "acp") {
+				if (!(await deliverAgentMessage(normalizedId, prompt, "restartAgent:continue-prompt", effectiveHarness === "codex" ? resilientDeliveryMethod(agentState.deliveryMethod) : void 0)).ok) throw new Error(`${getHarnessBehavior(effectiveHarness).displayName} continue prompt delivery failed`);
+			} else await Effect.runPromise(sendKeys(normalizedId, prompt));
+		}
 		markAgentRunning(agentState);
 		saveAgentStateSync(agentState);
 		await saveAgentRuntimeState(normalizedId, {
@@ -6984,6 +7726,7 @@ async function restartAgent(agentId, opts = {}) {
 		return { success: true };
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
+		await Effect.runPromise(stopAgent(normalizedId)).catch(() => void 0);
 		logAgentLifecycleSync(normalizedId, `restartAgent FAILED: ${msg}`);
 		return {
 			success: false,
@@ -7086,6 +7829,7 @@ async function recoverAgent(agentId, opts = {}) {
 			role: recoveryRole,
 			isPlanning: recoveryRole === "plan",
 			harness: "ohmypi",
+			harnessBinaryPath: harnessLaunch.binaryPath,
 			extraEnvExports: [harnessLaunch.pathExport]
 		});
 		const launcherScript = join$1(getAgentDir(normalizedId), "launcher.sh");
@@ -7109,6 +7853,42 @@ async function recoverAgent(agentId, opts = {}) {
 		logAgentLifecycleSync(normalizedId, `recoverAgent SUCCESS: recoveryCount=${health.recoveryCount} (ohmypi)`);
 		return state;
 	}
+	if (recoveryHarness === "acp") {
+		const resumeSessionId = resolveRecoveryResumeSessionId(normalizedId, recoveryHarness);
+		const { launcherContent, providerEnv: acpProviderEnv } = await buildAgentLaunchConfig({
+			agentId: normalizedId,
+			model: state.model,
+			workspace: state.workspace,
+			role: recoveryRole,
+			isPlanning: recoveryRole === "plan",
+			...resumeSessionId ? {
+				spawnMode: "resume",
+				resumeSessionId
+			} : {},
+			harness: "acp",
+			harnessBinaryPath: harnessLaunch.binaryPath,
+			extraEnvExports: [harnessLaunch.pathExport]
+		});
+		const launcherScript = join$1(getAgentDir(normalizedId), "launcher.sh");
+		await writeLauncherScriptAtomic(launcherScript, launcherContent);
+		await Effect.runPromise(createSession(normalizedId, state.workspace, `bash ${launcherScript}`, { env: {
+			...BLANKED_PROVIDER_ENV,
+			OVERDECK_AGENT_ID: normalizedId,
+			OVERDECK_ISSUE_ID: state.issueId || "",
+			OVERDECK_SESSION_TYPE: recoveryRole,
+			CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: "false",
+			...acpProviderEnv
+		} }));
+		const delivery = await deliverInitialPromptWithRetry(normalizedId, recoveryPrompt, "recoverAgent:acp-recovery-prompt");
+		if (!delivery.ok) {
+			await Effect.runPromise(stopAgent(normalizedId));
+			throw new Error(`ACP recovery prompt delivery failed for ${normalizedId}: ${delivery.failure ?? "unknown failure"}`);
+		}
+		markAgentRunning(state);
+		saveAgentStateSync(state);
+		logAgentLifecycleSync(normalizedId, `recoverAgent SUCCESS: recoveryCount=${health.recoveryCount} (acp)`);
+		return state;
+	}
 	const recoveryCodexFields = recoveryHarness === "codex" ? getCodexLauncherFields(normalizedId, state.model, state.workspace, recoveryRole) : {};
 	const recoveryLauncherContent = generateLauncherScriptSync({
 		role: recoveryRole,
@@ -7210,6 +7990,7 @@ var init_recovery = __esmMin((() => {
 	init_persistent_logger();
 	init_providers();
 	init_conversations();
+	init_behavior();
 	init_tmux();
 	init_agent_state();
 	init_delivery();
@@ -7481,11 +8262,11 @@ async function renderCommitFeedDiff(workspace, sha, feedConfig = DEFAULT_FEED_CO
 		".",
 		...feedConfig.exclude.map((glob) => `:(exclude)${glob}`)
 	] : [];
-	const diff = await gitShow(workspace, sha, pathspecArgs);
+	const diff = await renderWorkspaceGitShowPromise(deps.issueId, workspace, sha, pathspecArgs, gitShow);
 	const maxBytes = feedConfig.max_diff_bytes;
 	if (maxBytes === null || Buffer.byteLength(diff, "utf-8") <= maxBytes) return diff;
 	return [
-		(await gitShow(workspace, sha, ["--stat", ...pathspecArgs])).trimEnd(),
+		(await renderWorkspaceGitShowPromise(deps.issueId, workspace, sha, ["--stat", ...pathspecArgs], gitShow)).trimEnd(),
 		"",
 		`[tiered_execution.feed.max_diff_bytes truncated commit diff: ${Buffer.byteLength(diff, "utf-8")} bytes exceeded ${maxBytes} bytes]`,
 		""
@@ -7527,7 +8308,10 @@ function composeCommitFeedMessage(sha, itemTitle, diff, callout) {
 async function broadcastCommit(options) {
 	const feedConfig = options.feedConfig ?? DEFAULT_FEED_CONFIG;
 	if (shouldSkipFeedSubject(options.commitSubject ?? options.itemTitle, feedConfig)) return [];
-	const renderDiff = options.renderDiff ?? (options.gitShow ? (workspace, sha) => options.gitShow(workspace, sha) : renderCommitFeedDiff);
+	const renderDiff = options.renderDiff ?? ((workspace, sha, config) => renderCommitFeedDiff(workspace, sha, config, {
+		issueId: options.issueId,
+		gitShow: options.gitShow ? (repoPath, repoSha) => options.gitShow(repoPath, repoSha) : void 0
+	}));
 	const deliver = options.deliver ?? deliverAgentMessage;
 	const recordDelivery = options.recordDelivery ?? recordTierFeedDelivery;
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -7576,6 +8360,7 @@ async function broadcastCommit(options) {
 }
 var execFileAsync$5, DEFAULT_FEED_CONFIG;
 var init_tier_feed = __esmMin((() => {
+	init_git_utils();
 	init_delivery();
 	init_tier_metrics();
 	init_tier_table();
@@ -7793,13 +8578,19 @@ Rules:
 - Do not use any other endpoint or side channel for the verdict.
 - Only review this commit against this bead's acceptance criteria — compile, lint, and tests are the verification gate's job, and code style is the review convoy's job.`;
 }
-async function getCommitDiff(workspacePath, sha) {
-	const { stdout } = await execFileAsync$4("git", ["show", sha], {
-		cwd: workspacePath,
-		encoding: "utf-8",
-		maxBuffer: 10 * 1024 * 1024
+async function getCommitDiff(issueId, workspacePath, sha) {
+	return renderWorkspaceGitShowPromise(issueId, workspacePath, sha, [], async (repoPath, repoSha, args) => {
+		const { stdout } = await execFileAsync$4("git", [
+			"show",
+			repoSha,
+			...args
+		], {
+			cwd: repoPath,
+			encoding: "utf-8",
+			maxBuffer: 10 * 1024 * 1024
+		});
+		return stdout;
 	});
-	return stdout;
 }
 /**
 * Deliver one subscribed commit to the standing supervisor for review:
@@ -7809,7 +8600,7 @@ async function getCommitDiff(workspacePath, sha) {
 */
 async function deliverCommitForReview(options) {
 	const deliver = options.deps?.deliver ?? deliverAgentMessage;
-	const diff = await (options.deps?.getDiff ?? getCommitDiff)(options.workspacePath, options.sha);
+	const diff = await (options.deps?.getDiff ?? ((workspacePath, sha) => getCommitDiff(options.issueId, workspacePath, sha)))(options.workspacePath, options.sha);
 	const traces = Array.isArray(options.item.metadata?.traces) ? options.item.metadata.traces : [];
 	const frText = options.prdMarkdown && traces.length > 0 ? extractTracedFrText(options.prdMarkdown, traces) : void 0;
 	const message = buildSupervisorReviewMessage({
@@ -7826,6 +8617,7 @@ async function deliverCommitForReview(options) {
 }
 var SUPERVISOR_SUB_ROLE, execFileAsync$4;
 var init_tier_supervisor = __esmMin((() => {
+	init_git_utils();
 	init_delivery();
 	init_spawn_prep();
 	init_spawn();
@@ -7840,7 +8632,7 @@ var init_tier_supervisor = __esmMin((() => {
 * from `git log <base>..HEAD`, oldest commit first.
 */
 async function replayStandingAgent(target, options = {}) {
-	const deps = replayDeps(options.deps);
+	const deps = replayDeps(options.deps, target.issueId);
 	const replayTarget = target.kind === "tier" ? {
 		...target,
 		...resolveReplaySlot(target, deps)
@@ -7865,7 +8657,7 @@ async function replayCrashedStandingAgent(target, options = {}) {
 */
 async function compactAtTierRunBoundary(options) {
 	if (!shouldReplayCompactAtTierRunBoundary(options.compaction)) return null;
-	const deps = replayDeps(options.deps);
+	const deps = replayDeps(options.deps, options.target.issueId);
 	const rerouted = resolveReroutedReplayTarget(options.target);
 	if (!rerouted) {
 		if (options.target.agentId) await deps.stop(options.target.agentId);
@@ -8028,27 +8820,34 @@ async function runGitLog(workspace, base) {
 		};
 	}).filter((entry) => entry.sha.trim().length > 0);
 }
-async function runGitShow(workspace, sha) {
-	const { stdout } = await execFileAsync$3("git", ["show", sha], {
-		cwd: workspace,
-		encoding: "utf-8",
-		maxBuffer: 16 * 1024 * 1024
+async function runGitShow(issueId, workspace, sha) {
+	return renderWorkspaceGitShowPromise(issueId, workspace, sha, [], async (repoPath, repoSha, args) => {
+		const { stdout } = await execFileAsync$3("git", [
+			"show",
+			repoSha,
+			...args
+		], {
+			cwd: repoPath,
+			encoding: "utf-8",
+			maxBuffer: 16 * 1024 * 1024
+		});
+		return stdout;
 	});
-	return stdout;
 }
-function replayDeps(deps = {}) {
+function replayDeps(deps = {}, issueId) {
 	return {
 		spawn: deps.spawn ?? spawnRun,
 		deliver: deps.deliver ?? deliverAgentMessage,
 		stop: deps.stop ?? stopAgent,
 		gitLog: deps.gitLog ?? runGitLog,
-		gitShow: deps.gitShow ?? runGitShow,
-		renderDiff: deps.renderDiff ?? (deps.gitShow ? (workspace, sha) => deps.gitShow(workspace, sha) : renderCommitFeedDiff),
+		gitShow: deps.gitShow ?? ((workspace, sha) => runGitShow(issueId, workspace, sha)),
+		renderDiff: deps.renderDiff ?? (deps.gitShow ? (workspace, sha) => deps.gitShow(workspace, sha) : (workspace, sha, feedConfig) => renderCommitFeedDiff(workspace, sha, feedConfig, { issueId })),
 		listSlotOwnership: deps.listSlotOwnership ?? listSlotOwnership
 	};
 }
 var execFileAsync$3, DEFAULT_REPLAY_THRESHOLD;
 var init_tier_replay = __esmMin((() => {
+	init_git_utils();
 	init_model_capabilities();
 	init_delivery();
 	init_spawn();
@@ -8196,7 +8995,7 @@ async function command(adapters, executable, args) {
 		return null;
 	}
 }
-function createDarwinHostHealthCollector(adapters = defaultAdapters$1) {
+function createDarwinHostHealthCollector(adapters = defaultAdapters$2) {
 	return {
 		platform: "darwin",
 		async sample(previous) {
@@ -8236,6 +9035,9 @@ function createDarwinHostHealthCollector(adapters = defaultAdapters$1) {
 				committedMemoryBytes: unavailable("macOS does not expose Linux Committed_AS."),
 				commitLimitBytes: unavailable("macOS does not expose Linux CommitLimit."),
 				virtualCommitmentPercent: unavailable("macOS virtual commitment is unavailable."),
+				inotifyWatchesUsed: unavailable("inotify is Linux-only."),
+				inotifyWatchesMax: unavailable("inotify is Linux-only."),
+				inotifyWatchesUsedPercent: unavailable("inotify is Linux-only."),
 				counters: {
 					cpu: cpuCounters,
 					swap: vmStat?.swap ?? null
@@ -8244,7 +9046,7 @@ function createDarwinHostHealthCollector(adapters = defaultAdapters$1) {
 		}
 	};
 }
-var execFileAsync$2, COMMAND_TIMEOUT_MS, MIB, DARWIN_MEMORY_PRESSURE_DEFAULTS, defaultAdapters$1;
+var execFileAsync$2, COMMAND_TIMEOUT_MS, MIB, DARWIN_MEMORY_PRESSURE_DEFAULTS, defaultAdapters$2;
 var init_darwin = __esmMin((() => {
 	init_types();
 	execFileAsync$2 = promisify(execFile);
@@ -8256,7 +9058,7 @@ var init_darwin = __esmMin((() => {
 		swapActivityWarningBytesPerMinute: 64 * MIB,
 		swapActivityCriticalBytesPerMinute: 256 * MIB
 	});
-	defaultAdapters$1 = {
+	defaultAdapters$2 = {
 		execFile: async (command, args, timeoutMs) => {
 			const { stdout } = await execFileAsync$2(command, [...args], {
 				encoding: "utf-8",
@@ -8271,6 +9073,121 @@ var init_darwin = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region ../../lib/system-health/inotify.ts
+/**
+* inotify watch/instance accounting for the local user.
+*
+* inotify watches are a per-UID kernel budget (fs.inotify.max_user_watches)
+* shared by every process the user runs — host processes and Docker
+* containers alike, since containers share the kernel and (in Overdeck's
+* setups) the same uid. When the budget is exhausted, any program that
+* tries to add a watch fails with ENOSPC; the classic symptom is a Vite
+* dev server dying at startup while everything else looks healthy
+* (PAN-3063, the 2026-07-25 MIN-898 incident).
+*
+* The kernel exposes no aggregate usage counter, so the only way to measure
+* usage is to walk /proc/<pid>/fd for anon_inode:inotify descriptors and sum
+* the `inotify wd:` lines in the matching fdinfo files. Unprivileged scans
+* can only read same-uid processes, which conveniently matches the per-UID
+* scope of the budget itself.
+*/
+/** Counts `inotify wd:` entries in a /proc/<pid>/fdinfo/<fd> payload. */
+function countInotifyWatches(fdinfoContent) {
+	let count = 0;
+	for (const line of fdinfoContent.split("\n")) if (line.startsWith("inotify wd:")) count += 1;
+	return count;
+}
+function parseProcLimit(content) {
+	const value = Number(content.trim());
+	return Number.isFinite(value) && value > 0 ? value : null;
+}
+async function readLimit(adapters, path) {
+	try {
+		return parseProcLimit(await adapters.readFile(path));
+	} catch {
+		return null;
+	}
+}
+async function scanPid(adapters, pid) {
+	let fds;
+	try {
+		fds = await adapters.readdir(`/proc/${pid}/fd`);
+	} catch {
+		return null;
+	}
+	let watches = 0;
+	let instances = 0;
+	for (const fd of fds) {
+		let target;
+		try {
+			target = await adapters.readlink(`/proc/${pid}/fd/${fd}`);
+		} catch {
+			continue;
+		}
+		if (!target.includes("inotify")) continue;
+		instances += 1;
+		try {
+			watches += countInotifyWatches(await adapters.readFile(`/proc/${pid}/fdinfo/${fd}`));
+		} catch {}
+	}
+	if (instances === 0) return null;
+	return {
+		pid,
+		watches,
+		instances
+	};
+}
+async function readCommand(adapters, pid) {
+	try {
+		const command = (await adapters.readFile(`/proc/${pid}/cmdline`)).replaceAll("\0", " ").trim();
+		return command.length > 120 ? `${command.slice(0, 117)}…` : command;
+	} catch {
+		return `pid ${pid}`;
+	}
+}
+/**
+* Walks /proc and totals inotify watches and instances held by processes
+* this user can read. Returns null when /proc is unavailable (non-Linux).
+*/
+async function sampleInotify(adapters = defaultAdapters$1) {
+	let procEntries;
+	try {
+		procEntries = await adapters.readdir("/proc");
+	} catch {
+		return null;
+	}
+	const pids = procEntries.filter((entry) => /^\d+$/.test(entry)).map(Number);
+	const scans = [];
+	for (let i = 0; i < pids.length; i += PID_SCAN_CONCURRENCY) {
+		const chunk = pids.slice(i, i + PID_SCAN_CONCURRENCY);
+		const results = await Promise.all(chunk.map((pid) => scanPid(adapters, pid)));
+		for (const result of results) if (result) scans.push(result);
+	}
+	const [watchesMax, instancesMax] = await Promise.all([readLimit(adapters, "/proc/sys/fs/inotify/max_user_watches"), readLimit(adapters, "/proc/sys/fs/inotify/max_user_instances")]);
+	const top = [...scans].sort((a, b) => b.watches - a.watches).slice(0, 5);
+	const topConsumers = await Promise.all(top.map(async (scan) => ({
+		pid: scan.pid,
+		watches: scan.watches,
+		command: await readCommand(adapters, scan.pid)
+	})));
+	return {
+		watchesUsed: scans.reduce((sum, scan) => sum + scan.watches, 0),
+		watchesMax,
+		instancesUsed: scans.reduce((sum, scan) => sum + scan.instances, 0),
+		instancesMax,
+		topConsumers
+	};
+}
+var PID_SCAN_CONCURRENCY, defaultAdapters$1;
+var init_inotify = __esmMin((() => {
+	PID_SCAN_CONCURRENCY = 32;
+	defaultAdapters$1 = {
+		readdir: (path) => readdir(path),
+		readlink: (path) => readlink(path),
+		readFile: (path) => readFile(path, "utf-8")
+	};
+}));
+//#endregion
 //#region ../../lib/system-health/linux.ts
 function parseMemInfo(content) {
 	const values = /* @__PURE__ */ new Map();
@@ -8364,10 +9281,16 @@ function percent(part, total) {
 	return Math.round(part / total * 1e3) / 10;
 }
 function createLinuxHostHealthCollector(adapters = defaultAdapters) {
+	let inotifyCache = null;
 	return {
 		platform: "linux",
 		async sample(previous) {
 			const sampledAtMs = adapters.now();
+			if (!inotifyCache || sampledAtMs - inotifyCache.atMs >= 6e4) inotifyCache = {
+				atMs: sampledAtMs,
+				sample: await adapters.sampleInotify().catch(() => null)
+			};
+			const inotify = inotifyCache.sample;
 			const [memInfo, procStat, pressure, vmstat, loadAverage, pageSizeBytes] = await Promise.all([
 				readParsed(adapters, "/proc/meminfo", parseMemInfo),
 				readParsed(adapters, "/proc/stat", parseProcStat),
@@ -8407,6 +9330,9 @@ function createLinuxHostHealthCollector(adapters = defaultAdapters) {
 				committedMemoryBytes: committedMemoryBytes == null ? unavailable("Committed_AS is unavailable.") : available(committedMemoryBytes),
 				commitLimitBytes: commitLimitBytes == null ? unavailable("CommitLimit is unavailable.") : available(commitLimitBytes),
 				virtualCommitmentPercent: committedMemoryBytes == null || commitLimitBytes == null ? unavailable("Virtual commitment cannot be derived.") : available(percent(committedMemoryBytes, commitLimitBytes)),
+				inotifyWatchesUsed: inotify == null ? unavailable("inotify usage could not be scanned from /proc.") : available(inotify.watchesUsed),
+				inotifyWatchesMax: inotify?.watchesMax == null ? unavailable("fs.inotify.max_user_watches is unavailable.") : available(inotify.watchesMax),
+				inotifyWatchesUsedPercent: inotify == null || inotify.watchesMax == null ? unavailable("inotify watch utilization cannot be derived.") : available(percent(inotify.watchesUsed, inotify.watchesMax)),
 				counters: {
 					cpu: cpuCounters,
 					swap: swapCounters
@@ -8417,6 +9343,7 @@ function createLinuxHostHealthCollector(adapters = defaultAdapters) {
 }
 var execFileAsync$1, KB, LINUX_MEMORY_PRESSURE_DEFAULTS, defaultAdapters;
 var init_linux = __esmMin((() => {
+	init_inotify();
 	init_types();
 	execFileAsync$1 = promisify(execFile);
 	KB = 1024;
@@ -8437,7 +9364,8 @@ var init_linux = __esmMin((() => {
 			if (!Number.isFinite(value) || value <= 0) throw new Error("getconf returned an invalid page size");
 			return value;
 		},
-		now: () => Date.now()
+		now: () => Date.now(),
+		sampleInotify: () => sampleInotify()
 	};
 }));
 //#endregion
@@ -8492,6 +9420,9 @@ function createUnsupportedCollector(platform = "unsupported") {
 				committedMemoryBytes: signal(),
 				commitLimitBytes: signal(),
 				virtualCommitmentPercent: signal(),
+				inotifyWatchesUsed: signal(),
+				inotifyWatchesMax: signal(),
+				inotifyWatchesUsedPercent: signal(),
 				counters: {
 					cpu: null,
 					swap: null
@@ -8644,7 +9575,7 @@ var init_runtime_census = __esmMin((() => {
 	]);
 	runtimeCensusService = createRuntimeCensusService({
 		listPanes: async () => {
-			const { listAllPaneRecords } = await import("./tmux-DoThH6aj.js");
+			const { listAllPaneRecords } = await import("./tmux-DQ6jB76i.js");
 			return Effect.runPromise(listAllPaneRecords());
 		},
 		readProcesses: readRuntimeProcessTable
@@ -8798,6 +9729,6 @@ var init_queries = __esmMin((() => {
 	});
 }));
 //#endregion
-export { appendActivity as $, recordAgentFailure as $n, OHMYPI_AGENT_READY_TIMEOUT_SECONDS as $t, spawnTierSupervisor as A, writeChannelsBridgeMcpConfig as An, init_codex_auth as Ar, deliverAgentPermissionDecision as At, detectCrashedAgents as B, getAgentDir as Bn, assertWorkspaceStackHealthyForSpawn as Bt, replayCrashedStandingAgent as C, validateProviderHealth as Cn, getAgentRuntimeStateSync as Cr, tryReserveAdvancingSlot as Ct, init_tier_supervisor as D, decideChannelsForWorkAgent as Dn, init_agent_runtime as Dr, init_memory_verdict_cache as Dt, deliverCommitForReview as E, buildDefaultResumeContinueMessage as En, getAgentRuntimeSnapshot as Er, getCachedMemoryVerdict as Et, init_tier_escalation as F, clearAgentPausedSync as Fn, init_transcript_landing as Ft, resumeAgent as G, init_agent_state as Gn, transitionIssueToInProgress as Gt, restartAgent as H, getAgentState as Hn, defaultRunWorkspace as Ht, init_slot_reconcile as I, clearAgentTroubled as In, probeTranscriptSince as It, isContextOverflowTail as J, isRole as Jn, providerDefaultHarnessSync as Jt, init_context_overflow as K, isAgentPaused as Kn, transitionIssueToInReview as Kt, listSlotAssignments as L, clearAgentTroubledSync as Ln, BRIDGE_TOKEN_HEADER as Lt, broadcastCommit as M, SESSION_EXITED_BEFORE_KICKOFF as Mn, init_ohmypi_parser as Mr, deliverResumeMessageWithTranscriptConfirmation as Mt, init_tier_feed as N, __testInternals as Nn, parseOhmypiSessionCostResultSync as Nr, setAgentDeliveryMethod as Nt, loadPrdDraft as O, decideSupervisorForWorkAgent as On, applyCodexAuthBurnFlag as Or, setCachedMemoryVerdict as Ot, decideEscalation as P, clearAgentPaused as Pn, captureTranscriptUserRecordSnapshot as Pt, operatorInterventionEvent as Q, markAgentTroubled as Qn, resolveTier as Qt, reconcileSlotState as R, clearYieldForResumeSync as Rn, init_bridge_token as Rt, contextWindowForModel as S, init_provider_health as Sn, getAgentRuntimeState as Sr, resetPatrolDispatchBudget as St, shouldReplayCompactAtTierRunBoundary as T, init_openai_auth as Tn, saveAgentRuntimeState as Tr, workResumeSlotsAvailable as Tt, buildCompactRecoverySeed as U, getAgentStateFilePath as Un, init_spawn_prep as Ut, recoverAgent as V, getAgentResumeGateBlockReason as Vn, buildAgentLaunchConfig as Vt, init_resume as W, getAgentStateSync as Wn, retrieveSpawnTimeMemoryContext as Wt, messageAgent as X, markAgentRunningState as Xn, resolveStaffing as Xt, init_messaging as Y, markAgentRunning as Yn, resolveImplicitStaffing as Yt, init_operator_interventions as Z, markAgentStoppedState as Zn, init_resolve_tier as Zt, init_linux as _, buildSpawnEnvForModel as _n, isQualifiedAgentId as _r, emergencyBrake as _t, listRunningAgentsSync as a, getRoleRuntimeBaseCommand as an, setAgentPaused as ar, saveSessionId as at, init_agents as b, getProviderExportsForModel as bn, waitForAgentIdle as br, releaseAdvancingSlot as bt, getRuntimeCensus as c, roleAgentDefinitionPath as cn, wipeAgentStateDirs as cr, init_spawn as ct, panePidsForSession as d, piFifoPaths as dn, readAgentHarnessModelRecordSync as dr, init_termination as dt, describeOhmypiSpawnFailure as en, recordAgentFailureSync as er, getActivity as et, refreshRuntimeCensus as f, init_ohmypi_fifo as fn, init_pty_token as fr, stopAgent as ft, LINUX_MEMORY_PRESSURE_DEFAULTS as g, buildCavemanExports as gn, clearReadySignal as gr, describeRunningAgents as gt, init_collector as h, init_claude_auth as hn, resolvePtySupervisorScriptPath as hr, countRunningSwarmSlotsForIssue as ht, listRunningAgents as i, getProviderAuthMode as in, saveAgentStateSync as ir, init_activity as it, supervisorAgentId as j, GOVERNOR_SLOT_PAUSE_REASON_PREFIX as jn, paneShowsCodexAuthBurn as jr, deliverInitialPromptWithRetry as jt, shouldSupervise as k, dismissDevChannelsDialog as kn, checkCodexAuthStatus as kr, deliverAgentMessage as kt, getRuntimeCensusSnapshot as l, waitForPromptReady as ln, writeAgentStateJsonSync as lr, spawnAgent as lt, createHostHealthCollector as m, getClaudeAuthStatus as mn, init_pty_supervisor_locate as mr, countRunningAgents as mt, init_queries as n, getCodexLauncherFields as nn, resetAgentFailureCount as nr, getLatestSessionIdSync as nt, warnOnBareNumericIssueIds as o, init_runtime_command as on, setAgentPausedSync as or, createOhmypiRuntimeSync as ot, runtimeCensusHasHarnessProcess as p, ohmypiFifoPaths as pn, writePtyToken as pr, stopAgentSync as pt, isContextOverflowError as q, isAgentTroubled as qn, init_staffing as qt, listAgentStates as r, getOhmypiLauncherFields as rn, saveAgentState as rr, getSessionId as rt, descendantPidsForSession as s, injectPiConversationMemory as sn, setAgentYieldedSync as sr, init_ohmypi as st, dropLegacyAgentStatesMissingRoleAsync as t, getAgentRuntimeBaseCommand as tn, recordStartupSessionExit as tr, getLatestSessionId as tt, init_runtime_census as u, init_pi_fifo as un, init_agent_record_sync as ur, spawnRun as ut, DARWIN_MEMORY_PRESSURE_DEFAULTS as v, determineModel as vn, normalizeAgentId as vr, getConcurrencyLimits as vt, replayStandingAgent as w, getOpenAIAuthStatus as wn, init_runtime_state as wr, tryReserveSwarmSlot as wt, compactAtTierRunBoundary as x, getProviderTmuxFlags as xn, waitForReadySignal as xr, releaseSwarmSlot as xt, init_darwin as y, getProviderEnvForModel as yn, resolveAgentTargetSync as yr, init_concurrency as yt, autoRecoverAgents as z, decideResumeGate as zn, writeBridgeTokenSync as zt };
+export { operatorInterventionEvent as $, getAgentDir as $n, providerDefaultHarnessSync as $t, spawnTierSupervisor as A, getProviderExportsForModel as An, isQualifiedAgentId as Ar, AmbiguousKeyedDeliveryError as At, detectCrashedAgents as B, dismissDevChannelsDialog as Bn, init_agent_runtime as Br, init_transcript_landing as Bt, replayCrashedStandingAgent as C, materializeAcpContextFile as Cn, init_agent_record_sync as Cr, resetPatrolDispatchBudget as Ct, init_tier_supervisor as D, buildSpawnEnvForModel as Dn, init_pty_supervisor_locate as Dr, getCachedMemoryVerdict as Dt, deliverCommitForReview as E, buildCavemanExports as En, writePtyToken as Er, workResumeSlotsAvailable as Et, init_tier_escalation as F, init_openai_auth as Fn, getAgentRuntimeState as Fr, deliverResumeMessageWithTranscriptConfirmation as Ft, resumeAgent as G, SESSION_EXITED_BEFORE_KICKOFF as Gn, init_ohmypi_parser as Gr, assertWorkspaceStackHealthyForSpawn as Gt, restartAgent as H, init_supervisor_channels as Hn, checkCodexAuthStatus as Hr, BRIDGE_TOKEN_HEADER as Ht, init_slot_reconcile as I, buildDefaultResumeContinueMessage as In, getAgentRuntimeStateSync as Ir, init_delivery as It, isContextOverflowTail as J, clearAgentPausedSync as Jn, init_spawn_prep as Jt, init_context_overflow as K, __testInternals as Kn, parseOhmypiSessionCostResultSync as Kr, buildAgentLaunchConfig as Kt, listSlotAssignments as L, buildResumeContinueMessage as Ln, init_runtime_state as Lr, resilientDeliveryMethod as Lt, broadcastCommit as M, init_provider_health as Mn, resolveAgentTargetSync as Mr, deliverAgentMessage as Mt, init_tier_feed as N, validateProviderHealth as Nn, waitForAgentIdle as Nr, deliverAgentPermissionDecision as Nt, loadPrdDraft as O, determineModel as On, resolvePtySupervisorScriptPath as Or, init_memory_verdict_cache as Ot, decideEscalation as P, getOpenAIAuthStatus as Pn, waitForReadySignal as Pr, deliverInitialPromptWithRetry as Pt, init_operator_interventions as Q, decideResumeGate as Qn, init_staffing as Qt, reconcileSlotState as R, decideChannelsForWorkAgent as Rn, saveAgentRuntimeState as Rr, setAgentDeliveryMethod as Rt, contextWindowForModel as S, init_context as Sn, writeAgentStateJsonSync as Sr, releaseSwarmSlot as St, shouldReplayCompactAtTierRunBoundary as T, init_claude_auth as Tn, init_pty_token as Tr, tryReserveSwarmSlot as Tt, buildCompactRecoverySeed as U, writeChannelsBridgeMcpConfig as Un, init_codex_auth as Ur, init_bridge_token as Ut, recoverAgent as V, hasCompletionMarkerForAgent as Vn, applyCodexAuthBurnFlag as Vr, probeTranscriptSince as Vt, init_resume as W, GOVERNOR_SLOT_PAUSE_REASON_PREFIX as Wn, paneShowsCodexAuthBurn as Wr, writeBridgeTokenSync as Wt, messageAgent as X, clearAgentTroubledSync as Xn, transitionIssueToInProgress as Xt, init_messaging as Y, clearAgentTroubled as Yn, retrieveSpawnTimeMemoryContext as Yt, messageAgentWithOutcome as Z, clearYieldForResumeSync as Zn, transitionIssueToInReview as Zt, init_linux as _, waitForPromptReady as _n, saveAgentStateSync as _r, describeRunningAgents as _t, listRunningAgentsSync as a, OHMYPI_AGENT_READY_TIMEOUT_SECONDS as an, isAgentPaused as ar, init_activity as at, init_agents as b, init_ohmypi_fifo as bn, setAgentYieldedSync as br, init_concurrency as bt, getRuntimeCensus as c, getAgentRuntimeBaseCommand as cn, markAgentRunning as cr, init_ohmypi as ct, panePidsForSession as d, getProviderAuthMode as dn, markAgentTroubled as dr, spawnRun as dt, resolveImplicitStaffing as en, getAgentResumeGateBlockReason as er, appendActivity as et, refreshRuntimeCensus as f, getRoleRuntimeBaseCommand as fn, recordAgentFailure as fr, init_termination as ft, LINUX_MEMORY_PRESSURE_DEFAULTS as g, waitForAcpHostReady as gn, saveAgentState as gr, countRunningSwarmSlotsForIssue as gt, init_collector as h, roleAgentDefinitionPath as hn, resetAgentFailureCount as hr, countRunningAgents as ht, listRunningAgents as i, resolveTier as in, init_agent_state as ir, getSessionId as it, supervisorAgentId as j, getProviderTmuxFlags as jn, normalizeAgentId as jr, SocketPostStatusError as jt, shouldSupervise as k, getProviderEnvForModel as kn, clearReadySignal as kr, setCachedMemoryVerdict as kt, getRuntimeCensusSnapshot as l, getCodexLauncherFields as ln, markAgentRunningState as lr, init_spawn as lt, createHostHealthCollector as m, injectPiConversationMemory as mn, recordStartupSessionExit as mr, stopAgentSync as mt, init_queries as n, resolveStaffing as nn, getAgentStateFilePath as nr, getLatestSessionId as nt, warnOnBareNumericIssueIds as o, describeOhmypiSpawnFailure as on, isAgentTroubled as or, saveSessionId as ot, runtimeCensusHasHarnessProcess as p, init_runtime_command as pn, recordAgentFailureSync as pr, stopAgent as pt, isContextOverflowError as q, clearAgentPaused as qn, defaultRunWorkspace as qt, listAgentStates as r, init_resolve_tier as rn, getAgentStateSync as rr, getLatestSessionIdSync as rt, descendantPidsForSession as s, getAcpLauncherFields as sn, isRole as sr, createOhmypiRuntimeSync as st, dropLegacyAgentStatesMissingRoleAsync as t, resolveIssueWorkModel as tn, getAgentState as tr, getActivity as tt, init_runtime_census as u, getOhmypiLauncherFields as un, markAgentStoppedState as ur, spawnAgent as ut, DARWIN_MEMORY_PRESSURE_DEFAULTS as v, init_pi_fifo as vn, setAgentPaused as vr, emergencyBrake as vt, replayStandingAgent as w, getClaudeAuthStatus as wn, readAgentHarnessModelRecordSync as wr, tryReserveAdvancingSlot as wt, compactAtTierRunBoundary as x, ohmypiFifoPaths as xn, wipeAgentStateDirs as xr, releaseAdvancingSlot as xt, init_darwin as y, piFifoPaths as yn, setAgentPausedSync as yr, getConcurrencyLimits as yt, autoRecoverAgents as z, decideSupervisorForWorkAgent as zn, getAgentRuntimeSnapshot as zr, captureTranscriptUserRecordSnapshot as zt };
 
-//# sourceMappingURL=queries-6d7Cdtm7.js.map
+//# sourceMappingURL=queries-DHJm7bTd.js.map