@overdeck/desktop 0.45.24 → 0.47.0

package/server/{backlog-auto-trigger-2R2jog7n.js → backlog-auto-trigger-n1lzPgN4.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-Nw29vaFb.js";
-import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-CzkcK6P5.js";
+import { r as isNoResumeValueEnabled, t as init_no_resume_mode } from "./no-resume-mode-BgD0JUmM.js";
+import { a as spawnSequencerAgent, i as init_sequencer_agent } from "./sequencer-agent-CigMyKh2.js";
 //#region ../../lib/backlog/backlog-auto-trigger.ts
 /**
 * PAN-2396: --no-resume is the operator's full-quiescence escape hatch —
@@ -37,4 +37,4 @@ __esmMin((() => {
 }))();
 export { triggerDebouncedIncrementalPass };
 
-//# sourceMappingURL=backlog-auto-trigger-2R2jog7n.js.map
+//# sourceMappingURL=backlog-auto-trigger-n1lzPgN4.js.map

package/server/{behavior-B3exJ42O.js → behavior-td6-xhQk.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { t as init_src } from "./src-DtcUOZCq.js";
+import { t as init_src } from "./src-B948bGVR.js";
 //#region ../../lib/runtimes/behavior.ts
 var init_behavior = __esmMin((() => {
 	init_src();
@@ -7,4 +7,4 @@ var init_behavior = __esmMin((() => {
 //#endregion
 export { init_behavior as t };
 
-//# sourceMappingURL=behavior-B3exJ42O.js.map
+//# sourceMappingURL=behavior-td6-xhQk.js.map

package/server/boot-reconciled-stop-events-C7gGe3oB.js

@@ -0,0 +1,44 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+//#region services/boot-reconciled-stop-events.ts
+async function appendStopOnce(store, stop, errorMessage) {
+	const pendingByKey = appendByStore.get(store) ?? /* @__PURE__ */ new Map();
+	appendByStore.set(store, pendingByKey);
+	const key = `${stop.id}:${stop.previousStatus}`;
+	const existing = pendingByKey.get(key);
+	if (existing && await existing) return;
+	const pending = (async () => {
+		try {
+			const sequence = await store.appendAsync({
+				type: "agent.status_changed",
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				payload: {
+					agentId: stop.id,
+					status: "stopped",
+					previousStatus: stop.previousStatus,
+					hasLiveTmuxSession: false
+				}
+			});
+			if (sequence <= 0) throw new Error(`Event append returned invalid sequence ${sequence}`);
+			return true;
+		} catch (err) {
+			console.error(errorMessage, err);
+			return false;
+		}
+	})();
+	pendingByKey.set(key, pending);
+	if (!await pending && pendingByKey.get(key) === pending) pendingByKey.delete(key);
+}
+async function emitBootReconciledStopEvents(store, stopped, presentAgents, errorMessage) {
+	for (const stop of stopped) {
+		if (!presentAgents[stop.id]) continue;
+		await appendStopOnce(store, stop, errorMessage);
+	}
+}
+var appendByStore;
+var init_boot_reconciled_stop_events = __esmMin((() => {
+	appendByStore = /* @__PURE__ */ new WeakMap();
+}));
+//#endregion
+export { init_boot_reconciled_stop_events as n, emitBootReconciledStopEvents as t };
+
+//# sourceMappingURL=boot-reconciled-stop-events-C7gGe3oB.js.map

package/server/bridge-pool-patrol-CYH2OLb5.js

@@ -0,0 +1,136 @@
+import { o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
+import { promises } from "fs";
+import { exec } from "child_process";
+import { promisify } from "util";
+//#region ../../lib/docker-bridge-pool.ts
+init_activity_logger();
+/** Lists every bridge network on the host, one name per line. */
+const LIST_BRIDGE_NETWORKS_COMMAND = `docker network ls --filter driver=bridge --format '{{.Name}}'`;
+const DOCKER_DAEMON_JSON_PATH = "/etc/docker/daemon.json";
+/** `overdeck-feature-pan-2997_devnet`, `myn-feature-min-852_default`, … */
+const FEATURE_NETWORK_RE = /^(.+?)-feature-[a-z0-9]+-\d+_(?:devnet|default)$/i;
+function parseBridgeNetworkNames(stdout) {
+	return stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+/**
+* Groups networks by the project prefix of their compose project name so the
+* message names which project is consuming the pool. Anything that is not a
+* workspace stack network (`bridge`, `overdeck`, a project's main stack) lands
+* in `other`.
+*/
+function groupBridgeNetworkNames(names) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const match = name.match(FEATURE_NETWORK_RE);
+		const label = match ? `${match[1]}-feature-*` : "other";
+		counts.set(label, (counts.get(label) ?? 0) + 1);
+	}
+	return [...counts.entries()].map(([label, count]) => ({
+		label,
+		count
+	})).sort((a, b) => b.count - a.count || a.label.localeCompare(b.label));
+}
+/**
+* Capacity declared by `default-address-pools`: each pool yields
+* `2^(size - baseMaskBits)` subnets. Returns null when the config is absent or
+* malformed so the caller falls back to the measured default limit rather than
+* trusting a number it could not derive.
+*/
+function bridgePoolLimitFromPools(pools) {
+	if (!Array.isArray(pools) || pools.length === 0) return null;
+	let capacity = 0;
+	for (const pool of pools) {
+		const entry = pool;
+		if (typeof entry?.base !== "string" || typeof entry?.size !== "number") return null;
+		const baseMask = Number(entry.base.split("/")[1]);
+		if (!Number.isInteger(baseMask) || baseMask < 0 || baseMask > 32) return null;
+		if (!Number.isInteger(entry.size) || entry.size < baseMask || entry.size > 32) return null;
+		capacity += 2 ** (entry.size - baseMask);
+	}
+	return capacity > 0 ? capacity : null;
+}
+/**
+* Reads `default-address-pools` from daemon.json. Returns null when the file is
+* missing, unreadable, or declares no pools — which is itself the signal that
+* the host is on Docker's narrow built-in pools.
+*/
+async function readDockerDaemonPools() {
+	try {
+		const text = await promises.readFile(DOCKER_DAEMON_JSON_PATH, "utf-8");
+		const pools = JSON.parse(text)["default-address-pools"];
+		return Array.isArray(pools) ? pools : null;
+	} catch {
+		return null;
+	}
+}
+function assessBridgePoolPressure(names, limit = 31) {
+	const total = names.length;
+	const effectiveLimit = Math.max(1, limit);
+	return {
+		total,
+		limit: effectiveLimit,
+		headroom: Math.max(0, effectiveLimit - total),
+		underPressure: total >= effectiveLimit - 5,
+		exhausted: total >= effectiveLimit,
+		groups: groupBridgeNetworkNames(names)
+	};
+}
+/** `myn-feature-* 13, overdeck-feature-* 6, other 5` — empty when nothing to show. */
+function formatBridgePoolBreakdown(groups) {
+	return groups.map((group) => `${group.label} ${group.count}`).join(", ");
+}
+//#endregion
+//#region ../../lib/cloister/bridge-pool-patrol.ts
+const execAsync = promisify(exec);
+/** Last reported level. Module-level so it survives across patrol cycles. */
+let lastLevel = "ok";
+function defaultDeps() {
+	return {
+		listBridgeNetworkNames: async () => {
+			const { stdout } = await execAsync(LIST_BRIDGE_NETWORKS_COMMAND, { timeout: 15e3 });
+			return parseBridgeNetworkNames(stdout);
+		},
+		readPools: readDockerDaemonPools,
+		emit: (level, message) => {
+			emitActivityEntrySync({
+				source: "cloister",
+				level,
+				message
+			});
+		}
+	};
+}
+async function patrolDockerBridgePool(deps = {}) {
+	const d = {
+		...defaultDeps(),
+		...deps
+	};
+	let names;
+	try {
+		names = await d.listBridgeNetworkNames();
+	} catch {
+		return [];
+	}
+	const pools = await d.readPools().catch(() => null);
+	const pressure = assessBridgePoolPressure(names, bridgePoolLimitFromPools(pools) ?? 31);
+	const level = pressure.exhausted ? "exhausted" : pressure.underPressure ? "warn" : "ok";
+	if (level === lastLevel) return [];
+	const previous = lastLevel;
+	lastLevel = level;
+	const breakdown = formatBridgePoolBreakdown(pressure.groups);
+	const detail = breakdown ? ` (${breakdown})` : "";
+	if (level === "ok") {
+		const action = `Docker bridge network pool recovered — ${pressure.total} of ~${pressure.limit} slots used, ${pressure.headroom} free${detail}`;
+		d.emit("info", `[deacon] ${action}`);
+		console.log(`[deacon] ${action}`);
+		return [action];
+	}
+	const action = level === "exhausted" ? `Docker bridge network pool EXHAUSTED — ${pressure.total} of ~${pressure.limit} slots used; workspace stacks cannot be rebuilt and queued agent feedback will not be delivered${detail}` : `Docker bridge network pool under pressure — ${pressure.total} of ~${pressure.limit} slots used, only ${pressure.headroom} left${detail}`;
+	d.emit(level === "exhausted" ? "error" : "warn", `[deacon] ${action}`);
+	console.warn(`[deacon] ${action} (was ${previous})`);
+	return [action];
+}
+//#endregion
+export { patrolDockerBridgePool };
+
+//# sourceMappingURL=bridge-pool-patrol-CYH2OLb5.js.map

package/server/{briefing-freshness-D1wzUIWv.js → briefing-freshness-DRqZ8lAz.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DySPNmKN.js";
+import { ci as getOverdeckHome, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { mkdir, readFile, rename, stat, writeFile } from "fs/promises";
@@ -128,4 +128,4 @@ var init_briefing_freshness = __esmMin((() => {
 //#endregion
 export { resolveSessionContextBriefingPath as a, recordBriefingSessionStart as i, ensureSessionContextBriefingFile as n, init_briefing_freshness as r, appendFreshBriefingUpdate as t };
 
-//# sourceMappingURL=briefing-freshness-D1wzUIWv.js.map
+//# sourceMappingURL=briefing-freshness-DRqZ8lAz.js.map

package/server/{build-info-Ie_D0_BT.js → build-info-7yiEpl6u.js}

@@ -2,12 +2,14 @@ import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
 //#region ../../lib/deploy/build-info.ts
 function getBuildInfo() {
 	return {
-		buildCommit: "470dfaba75ec7478787a15f9854f20df5c960c05",
-		builtAt: "2026-07-23T14:20:17.760Z"
+		buildCommit: "3eff6973c550a453f51d6c294df9154365f76528",
+		builtAt: "2026-07-27T19:06:18.015Z",
+		buildDirty: false,
+		buildBranch: null
 	};
 }
 var init_build_info = __esmMin((() => {}));
 //#endregion
 export { init_build_info as n, getBuildInfo as t };
 
-//# sourceMappingURL=build-info-Ie_D0_BT.js.map
+//# sourceMappingURL=build-info-7yiEpl6u.js.map

package/server/{build-info-CZk_TITh.js → build-info-CpG__c63.js}

@@ -1,3 +1,3 @@
-import { n as init_build_info, t as getBuildInfo } from "./build-info-Ie_D0_BT.js";
+import { n as init_build_info, t as getBuildInfo } from "./build-info-7yiEpl6u.js";
 init_build_info();
 export { getBuildInfo };

package/server/{checkpoint-manager-DwbQoqrC.js → checkpoint-manager-CkKmB0wZ.js}

@@ -1,3 +1,3 @@
-import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-BI1Wxoku.js";
+import { _ as pruneStaleCheckpointRefs, g as pruneCheckpointRefsForAgents, h as listCheckpoints, i as deleteLegacyCheckpointRefs, m as init_checkpoint_manager, p as getCheckpointTimestamp, s as diffCheckpointFiles } from "./checkpoint-manager-DBcyNR8w.js";
 init_checkpoint_manager();
 export { deleteLegacyCheckpointRefs, diffCheckpointFiles, getCheckpointTimestamp, listCheckpoints, pruneCheckpointRefsForAgents, pruneStaleCheckpointRefs };

package/server/{checkpoint-manager-BI1Wxoku.js → checkpoint-manager-DBcyNR8w.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Kt as STATE_BRANCH_PATHS, Yt as init_state_plane, mr as init_errors, pr as VcsError, sr as InvalidAgentIdError, tr as CheckpointError } from "./config-yaml-DySPNmKN.js";
+import { Fr as init_errors, Or as InvalidAgentIdError, Pr as VcsError, Sr as CheckpointError, fn as STATE_BRANCH_PATHS, hn as init_state_plane } from "./config-yaml-CxdwhAIA.js";
 import { Effect, Layer } from "effect";
 import { join } from "path";
 import { tmpdir } from "os";
@@ -663,4 +663,4 @@ var init_checkpoint_manager = __esmMin((() => {
 //#endregion
 export { pruneStaleCheckpointRefs as _, diffAgainstMain as a, diffCheckpoints as c, diffPatchSinceCommit as d, findCommitAtTime as f, pruneCheckpointRefsForAgents as g, listCheckpoints as h, deleteLegacyCheckpointRefs as i, diffFilesAgainstHead as l, init_checkpoint_manager as m, checkpointStateExclusions as n, diffAgainstMainFiles as o, getCheckpointTimestamp as p, deleteCheckpoint as r, diffCheckpointFiles as s, captureCheckpoint as t, diffPatchFilesAgainstHead as u };
 
-//# sourceMappingURL=checkpoint-manager-BI1Wxoku.js.map
+//# sourceMappingURL=checkpoint-manager-DBcyNR8w.js.map

package/server/checkpoint-worker.js

@@ -1,4 +1,4 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-CQB1h765.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-D95apurL.js";
 import { parentPort } from "node:worker_threads";
 //#region ../../lib/memory/checkpoint-worker.ts
 function runOperation(operation, payload) {

package/server/{checkpoints-CQB1h765.js → checkpoints-D95apurL.js}

@@ -1,4 +1,4 @@
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BEqFxlJc.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BDQDRopn.js";
 import { randomUUID } from "node:crypto";
 //#region ../../lib/overdeck/transcript-checkpoint-sync.ts
 /**
@@ -195,4 +195,4 @@ function getTranscriptCheckpoint(sessionId) {
 //#endregion
 export { releaseTranscriptRange as a, listTranscriptCheckpoints as i, commitTranscriptRange as n, getTranscriptCheckpoint as r, claimTranscriptRange as t };
 
-//# sourceMappingURL=checkpoints-CQB1h765.js.map
+//# sourceMappingURL=checkpoints-D95apurL.js.map

package/server/{checkpoints-BJIs5QIA.js → checkpoints-Wm963lm8.js}

@@ -1,2 +1,2 @@
-import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-CQB1h765.js";
+import { a as releaseTranscriptRange, i as listTranscriptCheckpoints, n as commitTranscriptRange, r as getTranscriptCheckpoint, t as claimTranscriptRange } from "./checkpoints-D95apurL.js";
 export { claimTranscriptRange, commitTranscriptRange, getTranscriptCheckpoint, listTranscriptCheckpoints, releaseTranscriptRange };

package/server/{claude-hooks-provision-8Ngo8TpT.js → claude-hooks-provision-4RPxNkE8.js}

@@ -1,3 +1,3 @@
-import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-D8GXF3_s.js";
+import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-Bjitl9aI.js";
 init_claude_hooks_provision();
 export { provisionClaudeHooks };

package/server/{claude-hooks-provision-D8GXF3_s.js → claude-hooks-provision-Bjitl9aI.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Vr as init_paths, _r as BIN_DIR, jr as SYNC_SOURCES } from "./config-yaml-DySPNmKN.js";
+import { Qr as SYNC_SOURCES, Rr as BIN_DIR, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
@@ -104,6 +104,7 @@ var init_claude_hooks_registration = __esmMin((() => {
 		"pan-hook-lib.sh",
 		"pre-tool-hook",
 		"ask-user-question-hook",
+		"linear-mcp-auth-hook",
 		"auto-approve-hook",
 		"heartbeat-hook",
 		"stop-hook",
@@ -151,6 +152,16 @@ var init_claude_hooks_registration = __esmMin((() => {
 			hookType: "PostToolUse",
 			scriptName: "heartbeat-hook"
 		},
+		{
+			hookType: "PostToolUse",
+			scriptName: "linear-mcp-auth-hook",
+			matcher: "mcp__linear__.*"
+		},
+		{
+			hookType: "PostToolUseFailure",
+			scriptName: "linear-mcp-auth-hook",
+			matcher: "mcp__linear__.*"
+		},
 		{
 			hookType: "PostToolUse",
 			scriptName: "permission-event-hook"
@@ -375,4 +386,4 @@ var init_claude_hooks_provision = __esmMin((() => {
 //#endregion
 export { provisionClaudeHooks as n, init_claude_hooks_provision as t };
 
-//# sourceMappingURL=claude-hooks-provision-D8GXF3_s.js.map
+//# sourceMappingURL=claude-hooks-provision-Bjitl9aI.js.map

package/server/{claude-permissions-DNWEVV6z.js → claude-permissions-CpbpvUQ2.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-DySPNmKN.js";
+import { f as loadConfigSync, t as init_config_yaml } from "./config-yaml-CxdwhAIA.js";
 import "effect";
 //#region ../../lib/claude-permissions.ts
 /** Read PAN_YOLO from the current process env. Returns the implied mode, or undefined if unset/unparseable. */
@@ -94,4 +94,4 @@ var init_claude_permissions = __esmMin((() => {
 //#endregion
 export { init_claude_permissions as a, getClaudePermissionFlagsSync as i, buildClaudeUserSettingsSync as n, resolvePermissionModeSync as o, getClaudePermissionFlagsStringSync as r, BYPASS_PERMISSION_MODE as t };
 
-//# sourceMappingURL=claude-permissions-DNWEVV6z.js.map
+//# sourceMappingURL=claude-permissions-CpbpvUQ2.js.map

package/server/{claude-settings-overlay-DWy-Bb4Y.js → claude-settings-overlay-BzkHYDwR.js}

@@ -1,3 +1,3 @@
-import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-CEdaqpWI.js";
+import { n as init_claude_settings_overlay, r as injectOverdeckInfraDeny } from "./claude-settings-overlay-_H9Yrzab.js";
 init_claude_settings_overlay();
 export { injectOverdeckInfraDeny };

package/server/{claude-settings-overlay-CEdaqpWI.js → claude-settings-overlay-_H9Yrzab.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { ir as FsError, mr as init_errors } from "./config-yaml-DySPNmKN.js";
+import { Fr as init_errors, Tr as FsError } from "./config-yaml-CxdwhAIA.js";
 import { Effect, FileSystem } from "effect";
 import { join } from "path";
 import { homedir, tmpdir } from "os";
@@ -142,4 +142,4 @@ var init_claude_settings_overlay = __esmMin((() => {
 //#endregion
 export { init_claude_settings_overlay as n, injectOverdeckInfraDeny as r, detectProviderEnvConflicts as t };
 
-//# sourceMappingURL=claude-settings-overlay-CEdaqpWI.js.map
+//# sourceMappingURL=claude-settings-overlay-_H9Yrzab.js.map

package/server/cli-CjOCSnfj.js

@@ -0,0 +1,3 @@
+import { r as init_cli, t as createResetMarker } from "./cli-Cte9ZFGn.js";
+init_cli();
+export { createResetMarker };

package/server/{cli-RoOx5DUf.js → cli-Cte9ZFGn.js}

@@ -1,11 +1,11 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Vr as init_paths } from "./config-yaml-DySPNmKN.js";
-import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-D-xWGHdh.js";
-import { b as init_agents } from "./queries-CjNIf-Ub.js";
-import { i as init_settings } from "./settings-BTMvpNFU.js";
-import { r as init_health, t as init_providers } from "./providers-qQAwGQDW.js";
-import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-CE46vDkZ.js";
-import { r as init_rollup } from "./rollup-FGsKki9R.js";
+import { li as init_paths } from "./config-yaml-CxdwhAIA.js";
+import { c as resolveMemoryRoot, i as init_paths$1, l as resolveObservationsFile, p as resolveSummariesDir, r as ensureParentDir } from "./paths-sJBSb7Ul.js";
+import { b as init_agents } from "./queries-C-MUZaIy.js";
+import { i as init_settings } from "./settings-VN0qOh4U.js";
+import { r as init_health, t as init_providers } from "./providers-BJQSnAAp.js";
+import { a as withMemoryFtsDatabase, i as runMemoryFtsTransaction, n as init_fts_db } from "./fts-db-IVc4_M3f.js";
+import { r as init_rollup } from "./rollup-BQaol5TX.js";
 import { dirname, join } from "path";
 import { randomUUID } from "crypto";
 import { readFile, rename, writeFile } from "fs/promises";
@@ -194,7 +194,7 @@ async function writeResetMarkerToFtsDb(projectId, marker) {
 	});
 }
 async function emitResetMarkerCreated(marker, timestamp) {
-	const { initEventStore } = await import("./event-store-EV2cMiXj.js");
+	const { initEventStore } = await import("./event-store-5UKzh9Jf.js");
 	await (await initEventStore()).appendAsync({
 		type: "memory.reset_marker_created",
 		timestamp,
@@ -221,4 +221,4 @@ var init_cli = __esmMin((() => {
 //#endregion
 export { generateDailySummary as n, init_cli as r, createResetMarker as t };
 
-//# sourceMappingURL=cli-RoOx5DUf.js.map
+//# sourceMappingURL=cli-Cte9ZFGn.js.map

package/server/{cliproxy-C8a1vtTU.js → cliproxy-C5fMJ7rY.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Vr as init_paths, _r as BIN_DIR, ir as FsError, mr as init_errors, ur as ProcessSpawnError, wr as OVERDECK_HOME } from "./config-yaml-DySPNmKN.js";
+import { Fr as init_errors, Gr as OVERDECK_HOME, Rr as BIN_DIR, Tr as FsError, jr as ProcessSpawnError, li as init_paths } from "./config-yaml-CxdwhAIA.js";
 import { Data, Effect } from "effect";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -496,4 +496,4 @@ var init_cliproxy = __esmMin((() => {
 //#endregion
 export { restartCliproxy as C, readPidFile as S, stopCliproxy as T, getCliproxyPidPath as _, CliproxyError as a, isCliproxyInstalled as b, bridgeGeminiAuthToCliproxy as c, getCliproxyAuthDir as d, getCliproxyBinary as f, getCliproxyLogPath as g, getCliproxyDir as h, CLIPROXY_PORT as i, decodeJwtPayload as l, getCliproxyConfigPath as m, CLIPROXY_BASE_URL as n, bridgeCodexAuthToCliproxy as o, getCliproxyClientEnv as p, CLIPROXY_HOST as r, bridgeCodexAuthToCliproxySync as s, CLIPROXY_AUTH_TOKEN as t, detectPlatformAsset as u, init_cliproxy as v, startCliproxy as w, isCliproxyRunning as x, installCliproxy as y };
 
-//# sourceMappingURL=cliproxy-C8a1vtTU.js.map
+//# sourceMappingURL=cliproxy-C5fMJ7rY.js.map

package/server/{cliproxy-fHfIeiGd.js → cliproxy-DaAbWMjC.js}

@@ -1,3 +1,3 @@
-import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-C8a1vtTU.js";
+import { v as init_cliproxy, x as isCliproxyRunning } from "./cliproxy-C5fMJ7rY.js";
 init_cliproxy();
 export { isCliproxyRunning };

package/server/{close-issue-DoOifFIK.js → close-issue-BPh1ARCF.js}

@@ -1,6 +1,6 @@
-import { Jn as extractPrefixSync, Xn as normalizeIssueIdSync, Yn as init_issue_id, qn as extractNumberSync } from "./config-yaml-DySPNmKN.js";
-import { b as init_agents, cr as saveAgentState, nr as markAgentStoppedState, qn as getAgentState } from "./queries-CjNIf-Ub.js";
-import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-5M0lupud.js";
+import { _r as normalizeIssueIdSync, gr as init_issue_id, hr as extractPrefixSync, mr as extractNumberSync } from "./config-yaml-CxdwhAIA.js";
+import { b as init_agents, gr as saveAgentState, tr as getAgentState, ur as markAgentStoppedState } from "./queries-C-MUZaIy.js";
+import { a as stepSkipped, i as stepOk, n as init_types, r as stepFailed, t as getLinearApiKey } from "./types-Di8wdakq.js";
 import { Effect } from "effect";
 import { exec } from "child_process";
 import { promisify } from "util";
@@ -227,7 +227,7 @@ function closeRallyDirect(ctx) {
 async function closeRallyDirectImpl(ctx) {
 	const step = "close-issue:transition";
 	if (!ctx.rally) return stepFailed(step, "Rally config not provided");
-	const { RallyTracker } = await import("./rally-zhhtXuDP.js");
+	const { RallyTracker } = await import("./rally-D_VW4bJv.js");
 	const tracker = new RallyTracker({
 		apiKey: ctx.rally.apiKey,
 		server: ctx.rally.server,
@@ -327,4 +327,4 @@ async function applyLabelLinearImpl(ctx, apiKey) {
 //#endregion
 export { closeIssue as t };
 
-//# sourceMappingURL=close-issue-DoOifFIK.js.map
+//# sourceMappingURL=close-issue-BPh1ARCF.js.map

package/server/{closed-issue-reaper-CktPXo8m.js → closed-issue-reaper-DHRfRMrp.js}

@@ -1,2 +1,2 @@
-import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-Bk3SU4RC.js";
+import { t as handleIssueStatusChangedClosed } from "./closed-issue-reaper-DoOZqGFK.js";
 export { handleIssueStatusChangedClosed };

package/server/{closed-issue-reaper-Bk3SU4RC.js → closed-issue-reaper-DoOZqGFK.js}

@@ -1,12 +1,12 @@
-import { Ft as resolveProjectForIssue, Ot as init_record, Tn as init_projects, Vr as init_paths, Yn as init_issue_id, hr as AGENTS_DIR, kn as listProjectsSync } from "./config-yaml-DySPNmKN.js";
-import { a as init_activity_logger, n as emitActivityEntrySync } from "./activity-logger-DDlOIAML.js";
-import { D as killSession, M as listSessionNames, w as init_tmux } from "./tmux-R7N7y-Mh.js";
-import { d as loadReviewStatuses, l as init_review_status } from "./review-status-kZj_KyCk.js";
-import { b as init_agents, ft as stopAgent, i as listRunningAgents } from "./queries-CjNIf-Ub.js";
-import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-DcMTFTUC.js";
-import { l as init_prd_locations, o as init_archive_planning } from "./archive-planning-Du25Jtst.js";
-import { n as init_issue_closed, r as isIssueClosed } from "./issue-closed-CDJk4pIp.js";
-import "./close-issue-DoOifFIK.js";
+import { Gn as init_projects, Ir as AGENTS_DIR, Pt as init_record, Vt as resolveProjectForIssue, Yn as listProjectsSync, gr as init_issue_id, li as init_paths } from "./config-yaml-CxdwhAIA.js";
+import { o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
+import { D as killSession, M as listSessionNames, w as init_tmux } from "./tmux-CfDHob9M.js";
+import { C as setReviewStatusSync, G as readJournalStatus, W as init_review_status_record_sync, h as loadReviewStatuses, p as init_review_status } from "./review-status-CGvlA4o_.js";
+import { b as init_agents, i as listRunningAgents, pt as stopAgent } from "./queries-C-MUZaIy.js";
+import { i as teardownWorkspaceDockerByNamePromise, n as init_docker } from "./docker-BJzlkqYB.js";
+import { i as isTrackerIssueClosed, n as init_issue_closed, r as isIssueClosed } from "./issue-closed-BehTG1be.js";
+import "./archive-planning-BwhxeP7C.js";
+import "./close-issue-BPh1ARCF.js";
 import { join } from "node:path";
 import { Data, Effect } from "effect";
 import "fs";
@@ -20,13 +20,12 @@ import { promisify as promisify$1 } from "util";
 init_activity_logger();
 init_projects();
 init_record();
+init_review_status_record_sync();
 init_agents();
 init_issue_closed();
 init_paths();
-init_prd_locations();
 init_tmux();
 init_review_status();
-init_archive_planning();
 init_docker();
 init_issue_id();
 const execAsync$2 = promisify$1(exec$1);
@@ -254,6 +253,7 @@ async function reapIssueResidue(projectPath, issueId) {
 //#endregion
 //#region ../../lib/cloister/closed-issue-reaper.ts
 init_paths();
+init_review_status();
 init_tmux();
 function issueIdFromStatelessSession(sessionName) {
 	const match = sessionName.match(/^(?:inspect|strike)-([a-z0-9]+-\d+)(?:-|$)/i);
@@ -268,6 +268,7 @@ function issueIdFromAgentDir(entryName) {
 	return match ? match[1].toUpperCase() : null;
 }
 const execAsync = promisify(exec);
+const DEVNET_CLOSURE_CHECK_CONCURRENCY = 4;
 async function listFeatureDevnetIssueIds() {
 	try {
 		const { stdout } = await execAsync(`docker network ls --format '{{.Name}}'`, {
@@ -281,7 +282,7 @@ async function listFeatureDevnetIssueIds() {
 		}
 		return [...issueIds];
 	} catch {
-		return [];
+		return null;
 	}
 }
 async function isClosedIssue(issueId, closedChecks) {
@@ -292,6 +293,52 @@ async function isClosedIssue(issueId, closedChecks) {
 	}
 	return promise;
 }
+async function isTrackerClosedIssue(issueId, trackerClosedChecks) {
+	let promise = trackerClosedChecks.get(issueId);
+	if (!promise) {
+		promise = isTrackerIssueClosed(issueId);
+		trackerClosedChecks.set(issueId, promise);
+	}
+	return promise;
+}
+function hasUnservicedReviewRequest(status) {
+	if (status.reviewStatus !== "pending" || !status.reviewRequestedAt) return false;
+	return !status.reviewSpawnedAt || new Date(status.reviewRequestedAt).getTime() > new Date(status.reviewSpawnedAt).getTime();
+}
+async function reapClosedIssueReviewRequests(trackerClosedChecks) {
+	const actions = [];
+	const pendingStatuses = Object.entries(loadReviewStatuses()).filter(([, status]) => status.reviewStatus === "pending");
+	for (let offset = 0; offset < pendingStatuses.length; offset += 4) {
+		const batch = pendingStatuses.slice(offset, offset + 4);
+		const candidates = (await Promise.all(batch.map(async ([issueId, dbStatus]) => {
+			const journal = await readJournalStatus(issueId);
+			const existing = {
+				...dbStatus,
+				...journal?.durable ?? {},
+				issueId
+			};
+			for (const field of journal?.clearedFields ?? []) delete existing[field];
+			return hasUnservicedReviewRequest(existing) ? [issueId, existing] : null;
+		}))).filter((candidate) => candidate !== null);
+		const trackerClosedCandidates = (await Promise.all(candidates.map(async ([issueId, existing]) => await isTrackerClosedIssue(issueId, trackerClosedChecks) ? [issueId, existing] : null))).filter((candidate) => candidate !== null);
+		for (const [issueId, existing] of trackerClosedCandidates) {
+			setReviewStatusSync(issueId, {
+				reviewRequestedAt: void 0,
+				reviewSpawnedAt: void 0
+			}, existing);
+			const action = `Cleared unserviced review request for ${issueId} — parent issue is closed`;
+			actions.push(action);
+			console.log(`[deacon] ${action}`);
+			emitActivityEntrySync({
+				source: "cloister",
+				level: "info",
+				issueId,
+				message: `[deacon] cleared unserviced review request for ${issueId} — parent issue is closed`
+			});
+		}
+	}
+	return actions;
+}
 async function reapClosedIssueResidue(projectPath, issueId, actions, reapedIssueKeys) {
 	const key = `${projectPath}:${issueId}`;
 	if (reapedIssueKeys.has(key)) return;
@@ -366,6 +413,7 @@ async function handleIssueStatusChangedClosed(issueId) {
 async function reconcileClosedIssueAgents() {
 	const actions = [];
 	const closedChecks = /* @__PURE__ */ new Map();
+	const trackerClosedChecks = /* @__PURE__ */ new Map();
 	const reapedAgentIds = /* @__PURE__ */ new Set();
 	const closedIssueIds = /* @__PURE__ */ new Set();
 	const reapedIssueKeys = /* @__PURE__ */ new Set();
@@ -405,13 +453,36 @@ async function reconcileClosedIssueAgents() {
 		if (!await isClosedIssue(issueId, closedChecks)) continue;
 		await reapResolvedIssueResidue(issueId, actions, reapedIssueKeys);
 	}
-	for (const issueId of await listFeatureDevnetIssueIds()) {
-		if (!await isClosedIssue(issueId, closedChecks)) continue;
-		await reapResolvedIssueResidue(issueId, actions, reapedIssueKeys);
+	const devnetIssueIds = await listFeatureDevnetIssueIds();
+	const openDevnetIssueIds = [];
+	if (devnetIssueIds) for (let offset = 0; offset < devnetIssueIds.length; offset += DEVNET_CLOSURE_CHECK_CONCURRENCY) {
+		const batch = devnetIssueIds.slice(offset, offset + DEVNET_CLOSURE_CHECK_CONCURRENCY);
+		const closureResults = await Promise.all(batch.map(async (issueId) => ({
+			issueId,
+			closed: await isClosedIssue(issueId, closedChecks)
+		})));
+		for (const { issueId, closed } of closureResults) if (closed) await reapResolvedIssueResidue(issueId, actions, reapedIssueKeys);
+		else openDevnetIssueIds.push(issueId);
+	}
+	let mergedIssueIds = devnetIssueIds ? [] : null;
+	if (openDevnetIssueIds.length > 0) try {
+		const { getReviewStatusesSync } = await import("./review-status-Dma9SFaN.js");
+		const statuses = getReviewStatusesSync(openDevnetIssueIds);
+		mergedIssueIds = openDevnetIssueIds.filter((issueId) => statuses[issueId]?.mergeStatus === "merged");
+	} catch (error) {
+		mergedIssueIds = null;
+		actions.push(`Failed to resolve merged-issue Docker cleanup status: ${error}`);
+	}
+	if (mergedIssueIds) try {
+		const { reconcileMergedDockerCleanupQueue } = await import("./merged-docker-cleanup-worker-DH_hrGPI.js");
+		actions.push(...reconcileMergedDockerCleanupQueue(mergedIssueIds));
+	} catch (error) {
+		actions.push(`Failed to reconcile merged-issue Docker cleanup queue: ${error}`);
 	}
+	actions.push(...await reapClosedIssueReviewRequests(trackerClosedChecks));
 	return actions;
 }
 //#endregion
-export { reconcileClosedIssueAgents as n, handleIssueStatusChangedClosed as t };
+export { reapClosedIssueReviewRequests as n, reconcileClosedIssueAgents as r, handleIssueStatusChangedClosed as t };
 
-//# sourceMappingURL=closed-issue-reaper-Bk3SU4RC.js.map
+//# sourceMappingURL=closed-issue-reaper-DoOZqGFK.js.map