@p4code/cli 0.6.2 → 0.6.4

package/dist/bin.mjs

@@ -29,15 +29,15 @@ import * as Duration from "effect/Duration";
 import * as Option from "effect/Option";
 import * as SchemaTransformation from "effect/SchemaTransformation";
 import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
-import * as HttpApi from "effect/unstable/httpapi/HttpApi";
-import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
-import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
-import * as HttpApiMiddleware from "effect/unstable/httpapi/HttpApiMiddleware";
 import * as HttpServerRespondable$1 from "effect/unstable/http/HttpServerRespondable";
 import * as HttpServerResponse$1 from "effect/unstable/http/HttpServerResponse";
 import * as SchemaIssue from "effect/SchemaIssue";
 import * as SchemaGetter from "effect/SchemaGetter";
 import * as Struct from "effect/Struct";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiMiddleware from "effect/unstable/httpapi/HttpApiMiddleware";
 import { Schema } from "effect";
 import * as Rpc from "effect/unstable/rpc/Rpc";
 import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
@@ -263,10 +263,10 @@ const make$122 = () => {
 		})
 	};
 };
-const layer$122 = Layer.sync(NetService, make$122);
+const layer$123 = Layer.sync(NetService, make$122);
 //#endregion
 //#region package.json
-var version$1 = "0.6.2";
+var version$1 = "0.6.4";
 //#endregion
 //#region src/config.ts
 /**
@@ -288,7 +288,7 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$4(cwd, baseDirOrPrefix);
 };
 const make$121 = (config) => ServerConfig$1.of(config);
-const layer$121 = (config) => Layer.succeed(ServerConfig$1, make$121(config));
+const layer$122 = (config) => Layer.succeed(ServerConfig$1, make$121(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path$1.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -1377,276 +1377,6 @@ Schema$1.Struct({
 	expiresAt: Schema$1.Number
 });
 //#endregion
-//#region ../../packages/contracts/src/hubNotifications.ts
-const MAX_NOTIFICATION_ID_CHARS = 128;
-const MAX_PUSH_TOKEN_CHARS = 4096;
-const MAX_HUB_ORIGIN_CHARS = 2048;
-const MAX_ACTIVITY_TITLE_CHARS = 160;
-const MAX_ACTIVITY_DETAIL_CHARS = 240;
-const identifier = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_NOTIFICATION_ID_CHARS), Schema$1.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$(?![\s\S])/));
-const pushToken = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PUSH_TOKEN_CHARS), Schema$1.isPattern(/^[\x21-\x7e]+$(?![\s\S])/));
-/** Server emission is bound to the authenticated environment, never a supplied account. */
-const HubAgentActivityInput = Schema$1.Struct({
-	eventId: identifier,
-	threadId: ThreadId,
-	revision: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(0)),
-	state: Schema$1.Literals([
-		"running",
-		"approval_required",
-		"question_required",
-		"completed",
-		"failed",
-		"stopped"
-	]),
-	title: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_ACTIVITY_TITLE_CHARS)),
-	detail: Schema$1.String.check(Schema$1.isMaxLength(MAX_ACTIVITY_DETAIL_CHARS))
-});
-/** Each authenticated client owns its registration; tokens never belong in public client state. */
-const HubPushRegistrationInput = Schema$1.Union([Schema$1.Struct({
-	platform: Schema$1.Literal("ios"),
-	token: pushToken,
-	sandbox: Schema$1.Boolean
-}), Schema$1.Struct({
-	platform: Schema$1.Literal("android"),
-	token: pushToken
-})]);
-/** Explicit opt-in, independently reversible. Omission never implies permission. */
-const HubNotificationPreferences = Schema$1.Struct({
-	attention: Schema$1.Boolean,
-	completion: Schema$1.Boolean,
-	liveActivity: Schema$1.Boolean
-});
-Schema$1.Struct({
-	registered: Schema$1.Boolean,
-	registrationGeneration: Schema$1.NullOr(identifier),
-	preferences: HubNotificationPreferences
-});
-/** ActivityKit update token, distinct from the app's APNs registration token. */
-const HubActivityOwnership = Schema$1.Struct({
-	origin: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_HUB_ORIGIN_CHARS)),
-	environmentId: EnvironmentId,
-	clientId: HubClientId,
-	registrationGeneration: identifier,
-	threadId: ThreadId,
-	activityId: identifier
-});
-const HubLiveActivityRegistrationInput = Schema$1.Struct({
-	threadId: ThreadId,
-	registrationGeneration: identifier,
-	activityId: identifier,
-	token: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PUSH_TOKEN_CHARS), Schema$1.isPattern(/^(?:[a-fA-F0-9]{2})+$(?![\s\S])/)),
-	sandbox: Schema$1.Boolean,
-	p4Ownership: Schema$1.optional(HubActivityOwnership)
-});
-/** Close only this presentation; delayed requests must not retire a newer activity. */
-const HubLiveActivityRemoveInput = Schema$1.Struct({
-	threadId: ThreadId,
-	registrationGeneration: identifier,
-	activityId: identifier
-});
-const HUB_TUNNEL_WEBSOCKET_PROTOCOL = "p4-hub-tunnel-v1";
-const HUB_TUNNEL_INITIAL_WINDOW_BYTES = 256 * 1024;
-const HUB_TUNNEL_MAX_WINDOW_BYTES = 1024 * 1024;
-const MAX_HEADERS = 64;
-const MAX_HEADER_NAME_CHARS = 128;
-const MAX_HEADER_VALUE_CHARS = 8192;
-const MAX_PATH_CHARS = 8192;
-const MAX_PROTOCOLS = 16;
-const MAX_PROTOCOL_CHARS = 128;
-const HeaderName = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_HEADER_NAME_CHARS), Schema$1.isPattern(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$(?![\s\S])/));
-const HeaderValue = Schema$1.String.check(Schema$1.isMaxLength(MAX_HEADER_VALUE_CHARS), Schema$1.isPattern(/^[\t\x20-\x7e]*$(?![\s\S])/));
-const Headers$2 = Schema$1.Array(Schema$1.Tuple([HeaderName, HeaderValue])).check(Schema$1.isMaxLength(MAX_HEADERS));
-const Path = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PATH_CHARS), Schema$1.isPattern(/^\/(?!\/)[^\s\\#\x00-\x1f\x7f]*$(?![\s\S])/));
-const Protocol = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PROTOCOL_CHARS), Schema$1.isPattern(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$(?![\s\S])/));
-const FailureReason = Schema$1.Literals([
-	"cancelled",
-	"unavailable",
-	"protocol_error"
-]);
-const CloseCode = Schema$1.Int.check(Schema$1.makeFilter((code) => code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006 || code >= 3e3 && code <= 4999));
-/** No caller-supplied account, environment, origin, or connector ownership authority. */
-const HubTunnelControl = Schema$1.Union([
-	Schema$1.Struct({
-		type: Schema$1.Literal("connector_ready"),
-		protocolVersion: Schema$1.Literal(1)
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("http_request_start"),
-		method: Schema$1.Literals([
-			"GET",
-			"HEAD",
-			"POST",
-			"PUT",
-			"PATCH",
-			"DELETE",
-			"OPTIONS"
-		]),
-		path: Path,
-		headers: Headers$2
-	}),
-	Schema$1.Struct({ type: Schema$1.Literal("http_request_end") }),
-	Schema$1.Struct({
-		type: Schema$1.Literal("http_request_abort"),
-		reason: FailureReason
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("http_response_start"),
-		status: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(200), Schema$1.isLessThanOrEqualTo(599)),
-		headers: Headers$2
-	}),
-	Schema$1.Struct({ type: Schema$1.Literal("http_response_end") }),
-	Schema$1.Struct({
-		type: Schema$1.Literal("http_response_abort"),
-		reason: FailureReason
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("websocket_open"),
-		path: Path,
-		headers: Headers$2,
-		protocols: Schema$1.Array(Protocol).check(Schema$1.isMaxLength(MAX_PROTOCOLS))
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("websocket_accept"),
-		protocol: Schema$1.optional(Protocol)
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("websocket_reject"),
-		status: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(400), Schema$1.isLessThanOrEqualTo(599)),
-		reason: FailureReason
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("websocket_close"),
-		code: CloseCode,
-		reason: FailureReason
-	}),
-	Schema$1.Struct({
-		type: Schema$1.Literal("window_update"),
-		creditBytes: Schema$1.Int.check(Schema$1.isGreaterThan(0), Schema$1.isLessThanOrEqualTo(HUB_TUNNEL_MAX_WINDOW_BYTES))
-	})
-]);
-//#endregion
-//#region ../../packages/contracts/src/environment.ts
-const ExecutionEnvironmentPlatformOs = Schema$1.Literals([
-	"darwin",
-	"linux",
-	"windows",
-	"unknown"
-]);
-const ExecutionEnvironmentPlatformArch = Schema$1.Literals([
-	"arm64",
-	"x64",
-	"other"
-]);
-const ExecutionEnvironmentPlatform = Schema$1.Struct({
-	os: ExecutionEnvironmentPlatformOs,
-	arch: ExecutionEnvironmentPlatformArch
-});
-/** How a server can replace itself with another version when asked over RPC:
-"boot-service" rewrites the systemd user unit and restarts it; "respawn"
-installs the target version and respawns the foreground process. */
-const ServerSelfUpdateMethod = Schema$1.Literals(["boot-service", "respawn"]);
-/** What update path a client should offer for a server: one of the RPC
-self-update methods above, or "desktop-managed" when the backend's
-version belongs to the P4Code desktop app supervising it — updating the
-app on that machine is the only way to update the server. */
-const ServerSelfUpdateCapability = Schema$1.Literals([
-	"boot-service",
-	"respawn",
-	"desktop-managed"
-]);
-const ExecutionEnvironmentCapabilities = Schema$1.Struct({
-	computerUseControls: Schema$1.optionalKey(Schema$1.Boolean),
-	usagePriceOverrides: Schema$1.optionalKey(Schema$1.Boolean),
-	projectAutoPull: Schema$1.optionalKey(Schema$1.Boolean),
-	sharedProjectModelDefault: Schema$1.optionalKey(Schema$1.Boolean),
-	projectScriptDefaults: Schema$1.optionalKey(Schema$1.Boolean),
-	customModelDefinitions: Schema$1.optionalKey(Schema$1.Boolean),
-	threadLifecycleV2: Schema$1.optionalKey(Schema$1.Boolean),
-	repositoryIdentity: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(false))),
-	connectionProbe: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server understands thread.settle / thread.unsettle commands. Absent on
-	pre-settlement servers, so clients treat missing as unsupported and
-	never send the commands under version skew. */
-	threadSettlement: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server understands thread.snooze / thread.unsnooze commands. Same
-	version-skew contract as threadSettlement. */
-	threadSnooze: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server understands thread.pin / thread.unpin / thread.pin.reorder
-	commands. Same version-skew contract as threadSettlement. */
-	threadPinning: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server understands the thread.fork command. Same version-skew contract
-	as threadSettlement. */
-	threadFork: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server understands thread.scheduled-task.create / cancel and fires
-	pending tasks. Same version-skew contract as threadSettlement. */
-	threadScheduledTasks: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Server exposes the pull-request list, detail, activity, diff, and mutation APIs. Absent on
-	servers from before the pull-request workspace shipped, so clients must not probe them. */
-	pullRequests: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Whole-host capacity snapshots for automatic draft routing. */
-	hostResources: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Device open returns lease IDs and close honors expectedLeaseId. */
-	deviceSessionLeases: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Manual detail/action requests can require an exact viewing lifetime. */
-	deviceActionLeases: Schema$1.optionalKey(Schema$1.Boolean),
-	/** Stack-scoped mutations preserve expected heads. Require true before sending stack payloads;
-	older servers may otherwise interpret the request as a single-PR action. */
-	pullRequestStackActions: Schema$1.optionalKey(Schema$1.Boolean),
-	/** The update path clients should offer for this server. Absent on
-	servers that must be relaunched manually (dev checkouts, Windows
-	foreground runs, pre-update servers). */
-	serverSelfUpdate: Schema$1.optionalKey(ServerSelfUpdateCapability),
-	/**
-	* Set when a service supervises the server, so a client offering a manual
-	* update must say `service update` rather than a bare relaunch — which would
-	* start a second server beside the supervised one.
-	*
-	* A new optional field rather than a new `ServerSelfUpdateCapability` member:
-	* adding a literal to that union makes older clients fail to decode the whole
-	* descriptor, while an unknown key is ignored.
-	*/
-	serverServiceSupervised: Schema$1.optionalKey(Schema$1.Boolean)
-});
-const ExecutionEnvironmentDescriptor = Schema$1.Struct({
-	environmentId: EnvironmentId,
-	label: TrimmedNonEmptyString,
-	platform: ExecutionEnvironmentPlatform,
-	serverVersion: TrimmedNonEmptyString,
-	capabilities: ExecutionEnvironmentCapabilities
-});
-Schema$1.Literals([
-	"connecting",
-	"connected",
-	"disconnected",
-	"error"
-]);
-const RepositoryIdentityLocator = Schema$1.Struct({
-	source: Schema$1.Literal("git-remote"),
-	remoteName: TrimmedNonEmptyString,
-	remoteUrl: TrimmedNonEmptyString
-});
-const RepositoryIdentity = Schema$1.Struct({
-	canonicalKey: TrimmedNonEmptyString,
-	locator: RepositoryIdentityLocator,
-	rootPath: Schema$1.optionalKey(TrimmedNonEmptyString),
-	displayName: Schema$1.optionalKey(TrimmedNonEmptyString),
-	provider: Schema$1.optionalKey(TrimmedNonEmptyString),
-	owner: Schema$1.optionalKey(TrimmedNonEmptyString),
-	name: Schema$1.optionalKey(TrimmedNonEmptyString)
-});
-Schema$1.Struct({
-	environmentId: EnvironmentId,
-	projectId: ProjectId
-});
-Schema$1.Struct({
-	environmentId: EnvironmentId,
-	threadId: ThreadId
-});
-Schema$1.Struct({
-	environmentId: EnvironmentId,
-	threadId: ThreadId
-});
-//#endregion
 //#region ../../packages/contracts/src/vcs.ts
 const VcsDriverKind = Schema$1.Literals([
 	"git",
@@ -3215,6 +2945,128 @@ const MODEL_SLUG_ALIASES_BY_PROVIDER = {
 	[OPENCODE_DRIVER_KIND]: {}
 };
 //#endregion
+//#region ../../packages/contracts/src/environment.ts
+const ExecutionEnvironmentPlatformOs = Schema$1.Literals([
+	"darwin",
+	"linux",
+	"windows",
+	"unknown"
+]);
+const ExecutionEnvironmentPlatformArch = Schema$1.Literals([
+	"arm64",
+	"x64",
+	"other"
+]);
+const ExecutionEnvironmentPlatform = Schema$1.Struct({
+	os: ExecutionEnvironmentPlatformOs,
+	arch: ExecutionEnvironmentPlatformArch
+});
+/** How a server can replace itself with another version when asked over RPC:
+"boot-service" rewrites the systemd user unit and restarts it; "respawn"
+installs the target version and respawns the foreground process. */
+const ServerSelfUpdateMethod = Schema$1.Literals(["boot-service", "respawn"]);
+/** What update path a client should offer for a server: one of the RPC
+self-update methods above, or "desktop-managed" when the backend's
+version belongs to the P4Code desktop app supervising it — updating the
+app on that machine is the only way to update the server. */
+const ServerSelfUpdateCapability = Schema$1.Literals([
+	"boot-service",
+	"respawn",
+	"desktop-managed"
+]);
+const ExecutionEnvironmentCapabilities = Schema$1.Struct({
+	computerUseControls: Schema$1.optionalKey(Schema$1.Boolean),
+	usagePriceOverrides: Schema$1.optionalKey(Schema$1.Boolean),
+	projectAutoPull: Schema$1.optionalKey(Schema$1.Boolean),
+	sharedProjectModelDefault: Schema$1.optionalKey(Schema$1.Boolean),
+	projectScriptDefaults: Schema$1.optionalKey(Schema$1.Boolean),
+	customModelDefinitions: Schema$1.optionalKey(Schema$1.Boolean),
+	threadLifecycleV2: Schema$1.optionalKey(Schema$1.Boolean),
+	repositoryIdentity: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(false))),
+	connectionProbe: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands thread.settle / thread.unsettle commands. Absent on
+	pre-settlement servers, so clients treat missing as unsupported and
+	never send the commands under version skew. */
+	threadSettlement: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands thread.snooze / thread.unsnooze commands. Same
+	version-skew contract as threadSettlement. */
+	threadSnooze: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands thread.pin / thread.unpin / thread.pin.reorder
+	commands. Same version-skew contract as threadSettlement. */
+	threadPinning: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands the thread.fork command. Same version-skew contract
+	as threadSettlement. */
+	threadFork: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands thread.scheduled-task.create / cancel and fires
+	pending tasks. Same version-skew contract as threadSettlement. */
+	threadScheduledTasks: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server exposes the pull-request list, detail, activity, diff, and mutation APIs. Absent on
+	servers from before the pull-request workspace shipped, so clients must not probe them. */
+	pullRequests: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Whole-host capacity snapshots for automatic draft routing. */
+	hostResources: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Device open returns lease IDs and close honors expectedLeaseId. */
+	deviceSessionLeases: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Manual detail/action requests can require an exact viewing lifetime. */
+	deviceActionLeases: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Stack-scoped mutations preserve expected heads. Require true before sending stack payloads;
+	older servers may otherwise interpret the request as a single-PR action. */
+	pullRequestStackActions: Schema$1.optionalKey(Schema$1.Boolean),
+	/** The update path clients should offer for this server. Absent on
+	servers that must be relaunched manually (dev checkouts, Windows
+	foreground runs, pre-update servers). */
+	serverSelfUpdate: Schema$1.optionalKey(ServerSelfUpdateCapability),
+	/**
+	* Set when a service supervises the server, so a client offering a manual
+	* update must say `service update` rather than a bare relaunch — which would
+	* start a second server beside the supervised one.
+	*
+	* A new optional field rather than a new `ServerSelfUpdateCapability` member:
+	* adding a literal to that union makes older clients fail to decode the whole
+	* descriptor, while an unknown key is ignored.
+	*/
+	serverServiceSupervised: Schema$1.optionalKey(Schema$1.Boolean)
+});
+const ExecutionEnvironmentDescriptor = Schema$1.Struct({
+	environmentId: EnvironmentId,
+	label: TrimmedNonEmptyString,
+	platform: ExecutionEnvironmentPlatform,
+	serverVersion: TrimmedNonEmptyString,
+	capabilities: ExecutionEnvironmentCapabilities
+});
+Schema$1.Literals([
+	"connecting",
+	"connected",
+	"disconnected",
+	"error"
+]);
+const RepositoryIdentityLocator = Schema$1.Struct({
+	source: Schema$1.Literal("git-remote"),
+	remoteName: TrimmedNonEmptyString,
+	remoteUrl: TrimmedNonEmptyString
+});
+const RepositoryIdentity = Schema$1.Struct({
+	canonicalKey: TrimmedNonEmptyString,
+	locator: RepositoryIdentityLocator,
+	rootPath: Schema$1.optionalKey(TrimmedNonEmptyString),
+	displayName: Schema$1.optionalKey(TrimmedNonEmptyString),
+	provider: Schema$1.optionalKey(TrimmedNonEmptyString),
+	owner: Schema$1.optionalKey(TrimmedNonEmptyString),
+	name: Schema$1.optionalKey(TrimmedNonEmptyString)
+});
+Schema$1.Struct({
+	environmentId: EnvironmentId,
+	projectId: ProjectId
+});
+Schema$1.Struct({
+	environmentId: EnvironmentId,
+	threadId: ThreadId
+});
+Schema$1.Struct({
+	environmentId: EnvironmentId,
+	threadId: ThreadId
+});
+//#endregion
 //#region ../../packages/contracts/src/orchestration.ts
 const ORCHESTRATION_WS_METHODS = {
 	dispatchCommand: "orchestration.dispatchCommand",
@@ -3296,6 +3148,12 @@ const COMPRESS_MODE_VALUES = [
 	"ultra",
 	"wenyan"
 ];
+/**
+* The strict mode set, for a reader that must not accept a mode it cannot
+* name. `CompressMode` below stays tolerant for wire compatibility; anything
+* storing a mode as a fact uses this one instead, because coercing an unknown
+* mode to the default would record a compression pass that never happened.
+*/
 const CompressModeLiteral = Schema$1.Literals(COMPRESS_MODE_VALUES);
 /**
 * Tolerant on the wire: an unknown mode decodes to the default instead of
@@ -5347,6 +5205,579 @@ var OrchestrationSearchThreadsError = class extends Schema$1.TaggedErrorClass()(
 	message: TrimmedNonEmptyString,
 	cause: Schema$1.optional(Schema$1.Defect())
 }) {};
+const ThreadWatchEventsInput = Schema$1.Struct({
+	threadId: ThreadId.annotate({ description: "The thread to read events from. Any thread on this server, not only this session's own." }),
+	afterSequence: Schema$1.optional(NonNegativeInt.annotate({ description: "Exclusive sequence cursor. Events with a higher sequence are returned. Omit to read from the beginning." })),
+	limit: Schema$1.optional(NonNegativeInt.check(Schema$1.isLessThanOrEqualTo(200)).annotate({ description: `Maximum events to return (default 50, max 200).` }))
+});
+const ThreadWatchEventsResult = Schema$1.Struct({
+	threadId: ThreadId,
+	/** Ordered by sequence ascending; resume with the last event's sequence. */
+	events: Schema$1.Array(OrchestrationEvent),
+	/**
+	* The engine's latest persisted sequence at read time. Equal to the last
+	* returned event's sequence when the watcher is caught up.
+	*/
+	headSequence: NonNegativeInt,
+	/** True when more events for this thread exist past the returned page. */
+	hasMore: Schema$1.Boolean
+});
+/** Compact review limits are server-owned, independent of raw event paging. */
+const THREAD_REVIEW_SCAN_LIMIT = 2e3;
+const THREAD_REVIEW_ITEM_MAX_BYTES = 8e3;
+const ThreadWatchReviewInput = Schema$1.Struct({
+	threadId: ThreadId,
+	afterSequence: Schema$1.optional(NonNegativeInt),
+	throughSequence: Schema$1.optional(NonNegativeInt.annotate({ description: "Inclusive fixed review boundary. Omit on the first page to capture the head; reuse the returned boundary on every subsequent page." }))
+});
+const ReviewSourceFields = {
+	firstSequence: NonNegativeInt,
+	lastSequence: NonNegativeInt,
+	truncated: Schema$1.Boolean
+};
+const ThreadReviewItem = Schema$1.Union([Schema$1.Struct({
+	...ReviewSourceFields,
+	kind: Schema$1.Literal("message"),
+	messageId: Schema$1.String,
+	turnId: Schema$1.NullOr(Schema$1.String),
+	role: Schema$1.String,
+	/** Apply append/replace by message identity across page boundaries. */
+	operation: Schema$1.Literals(["append", "replace"]),
+	complete: Schema$1.Boolean,
+	text: Schema$1.String,
+	/**
+	* What the message carried besides text.
+	*
+	* Present only when there was something: a message whose fragments are
+	* merged by identity would otherwise lose every trace of an image or a
+	* document the builder attached. Bounded by
+	* {@link THREAD_REVIEW_ITEM_MAX_ATTACHMENTS} so the item stays trimmable -
+	* only its text shrinks under the byte cap, so nothing else may be able to
+	* grow without limit.
+	*/
+	attachments: Schema$1.optionalKey(Schema$1.Array(Schema$1.Struct({
+		type: Schema$1.String,
+		name: Schema$1.String,
+		sizeBytes: NonNegativeInt
+	})))
+}), Schema$1.Struct({
+	...ReviewSourceFields,
+	kind: Schema$1.Literal("event"),
+	type: Schema$1.String,
+	/** JSON evidence excerpt. Truncated excerpts require targeted raw recovery. */
+	payload: Schema$1.String
+})]);
+/**
+* Compressed evidence standing in for the items it replaces.
+*
+* The supervisor reads this instead of paging the range event by event. The
+* sequence bounds are what make that safe: any claim can be verified at source
+* with a targeted `thread_watch_events` read over exactly this range, so the
+* summary is a starting point rather than the only record.
+*
+* `degraded` is set whenever the items came back unsummarized, and names why.
+* Most reasons are failures - unset model, provider error, timeout, empty or
+* unusable output - but `page-under-threshold` is not: it means the page was
+* small enough that summarizing it would have cost more than reading it. The
+* supervisor is never left guessing whether it is reading everything.
+*/
+const ThreadReviewSummary = Schema$1.Struct({
+	text: Schema$1.String,
+	firstSequence: NonNegativeInt,
+	lastSequence: NonNegativeInt,
+	/** How many builder turns the range covered. */
+	turnCount: NonNegativeInt,
+	degraded: Schema$1.NullOr(Schema$1.String)
+});
+const ThreadWatchReviewResult = Schema$1.Struct({
+	threadId: ThreadId,
+	items: Schema$1.Array(ThreadReviewItem),
+	throughSequence: NonNegativeInt,
+	/** Resume from the source scan cursor, even when items is empty. */
+	nextAfterSequence: NonNegativeInt,
+	hasMore: Schema$1.Boolean,
+	scannedEvents: NonNegativeInt,
+	/**
+	* Present only when summarization ran. When its `degraded` is null the
+	* `items` for the summarized range are omitted and this stands in for them;
+	* otherwise the items are intact and this explains why.
+	*/
+	summary: Schema$1.optionalKey(Schema$1.NullOr(ThreadReviewSummary))
+});
+/**
+* How a review ended, from the supervisor's own account of it.
+*
+* Three states rather than a boolean because they are acted on differently: a
+* summary that arrived is evidence, a fallback is a working review that cost
+* full context, and a failure is a misconfiguration worth fixing. The fourth
+* state - a read no report ever answered - is not sayable here: only the
+* server can observe it, through `ThreadEvidenceActivityOutcome`.
+*/
+const ThreadEvidenceReportOutcome = Schema$1.Literals([
+	"summarized",
+	"fallback",
+	"failed"
+]);
+/** Bounded so one report cannot dominate a thread's activity storage. */
+const THREAD_EVIDENCE_REPORT_MAX_CHARS = 8e3;
+const ThreadEvidenceReportInput = Schema$1.Struct({
+	/** The watched thread the summary covers, not the reporting thread. */
+	threadId: ThreadId,
+	firstSequence: NonNegativeInt,
+	lastSequence: NonNegativeInt,
+	/**
+	* The fixed review boundary the pages were read against.
+	*
+	* Identity, not description: the evidence-read rows are keyed on it, so a
+	* report that guessed from its own last sequence would look for a baseline
+	* that never existed whenever the range ended on a filtered event.
+	*/
+	throughSequence: NonNegativeInt,
+	outcome: ThreadEvidenceReportOutcome,
+	/** The summarizer's exact text. Required when the outcome is summarized. */
+	summary: Schema$1.optional(Schema$1.String),
+	/** The model the subagent ran on, when one was spawned. */
+	model: Schema$1.optional(Schema$1.String),
+	/** Why the summary is missing or degraded. Required unless summarized. */
+	reason: Schema$1.optional(Schema$1.String)
+});
+/**
+* The supervisor's own context around the read, correlated by the server.
+*
+* Self-reported numbers would be worth little, so these are read from the
+* reporting thread's projected context-window rows: `before` is what was
+* recorded when the evidence read happened, `after` what is recorded when the
+* report lands. `delta` can be negative when a compaction ran in between, and
+* is null whenever no read-time baseline exists.
+*/
+const ThreadEvidenceReportContext = Schema$1.Struct({
+	/**
+	* Null when no reading was recorded at read time.
+	*
+	* Never the report-time value standing in for itself: a delta of zero read
+	* as measurement would be a lie about a review that cost context.
+	*/
+	usedTokensBefore: Schema$1.NullOr(NonNegativeInt),
+	usedTokensAfter: NonNegativeInt,
+	/** Null exactly when `usedTokensBefore` is. */
+	deltaTokens: Schema$1.NullOr(Schema$1.Number),
+	maxTokens: Schema$1.NullOr(NonNegativeInt),
+	capacityPercent: Schema$1.NullOr(Schema$1.Number)
+});
+/**
+* How the recorded row ended, which is the supervisor's three outcomes plus the
+* one only the server can state: the review closed with no report at all.
+*
+* `unreported` is never accepted from a tool call. The server writes it when a
+* supervisor turn ends over an evidence read that nothing answered, so the
+* absence survives outside a live client that could infer it from two rows.
+*/
+const ThreadEvidenceActivityOutcome = Schema$1.Literals([
+	"summarized",
+	"fallback",
+	"failed",
+	"unreported"
+]);
+/**
+* Server clock around one review, never the supervisor's own account of it.
+*
+* `readAt` is when the evidence-read row was recorded and `closedAt` when the
+* row that closes the review was: the report for a reported review, the
+* completed supervisor turn for an unreported one. A supervisor turn that
+* failed or was interrupted closes nothing, so its read keeps no timing until
+* some later turn reports on it.
+*/
+const ThreadEvidenceReportTiming = Schema$1.Struct({
+	readAt: IsoDateTime,
+	closedAt: IsoDateTime,
+	durationMs: NonNegativeInt
+});
+/** Payload of the single `fusion.evidence.summary` activity a report records. */
+const ThreadEvidenceReportActivity = Schema$1.Struct({
+	watchedThreadId: ThreadId,
+	firstSequence: NonNegativeInt,
+	lastSequence: NonNegativeInt,
+	throughSequence: NonNegativeInt,
+	outcome: ThreadEvidenceActivityOutcome,
+	summary: Schema$1.NullOr(Schema$1.String),
+	/** True when a snapshot dropped the text of a superseded report. */
+	summaryDropped: Schema$1.optionalKey(Schema$1.Boolean),
+	model: Schema$1.NullOr(Schema$1.String),
+	reason: Schema$1.NullOr(Schema$1.String),
+	/** Null when no context-window row exists yet for the reporting thread. */
+	context: Schema$1.NullOr(ThreadEvidenceReportContext),
+	/**
+	* Null when the evidence-read row behind this review is no longer readable,
+	* and absent on rows stored before the server measured a review at all.
+	*/
+	timing: Schema$1.optionalKey(Schema$1.NullOr(ThreadEvidenceReportTiming))
+});
+const ThreadEvidenceReportResult = Schema$1.Struct({
+	recorded: Schema$1.Boolean,
+	context: Schema$1.NullOr(ThreadEvidenceReportContext)
+});
+var WatchToolUnavailableError = class extends Schema$1.TaggedErrorClass()("WatchToolUnavailableError", {
+	capability: Schema$1.Literal("watch"),
+	environmentId: EnvironmentId,
+	threadId: ThreadId,
+	providerSessionId: TrimmedNonEmptyString,
+	providerInstanceId: ProviderInstanceId
+}) {
+	get message() {
+		return `MCP credential does not grant the ${this.capability} capability.`;
+	}
+};
+/**
+* The capability is present but the requested thread is not in the granted
+* set. Separate from {@link WatchToolUnavailableError} so a watcher can tell
+* "you cannot watch at all" apart from "not this thread".
+*/
+var ThreadWatchNotPermittedError = class extends Schema$1.TaggedErrorClass()("ThreadWatchNotPermittedError", { threadId: ThreadId }) {
+	get message() {
+		return `This session was not granted watch access to thread ${this.threadId}.`;
+	}
+};
+var ThreadWatchFailedError = class extends Schema$1.TaggedErrorClass()("ThreadWatchFailedError", {
+	threadId: ThreadId,
+	detail: Schema$1.String
+}) {
+	get message() {
+		return `Reading events for thread ${this.threadId} failed: ${this.detail}`;
+	}
+};
+const ThreadWatchToolError = Schema$1.Union([
+	WatchToolUnavailableError,
+	ThreadWatchNotPermittedError,
+	ThreadWatchFailedError
+]);
+//#endregion
+//#region ../../packages/contracts/src/hubAnalytics.ts
+/**
+* Account-scoped analytics facts the hub stores for its own account holder.
+*
+* Append-only and versioned: a fact is what happened once, never a row that is
+* later corrected, so a changed shape ships as a new `version` beside the old
+* one rather than a rewrite of stored rows. Every payload is bounded, because
+* these travel from environments the hub does not control and a fact that can
+* grow without limit is a store that can be filled by one caller.
+*
+* Nothing here leaves the account: the hub is the only sink, and no field is
+* shaped for an external telemetry vendor.
+*
+* @module hubAnalytics
+*/
+const MAX_FACT_ID_CHARS = 128;
+const MAX_QUESTION_CHARS$2 = 2e3;
+const MAX_HEADER_CHARS$2 = 120;
+const MAX_OPTION_LABEL_CHARS$1 = 200;
+const MAX_OPTION_DESCRIPTION_CHARS$1 = 600;
+const MAX_PRESENTED_OPTIONS$1 = 12;
+const MAX_CUSTOM_ANSWER_CHARS$1 = 2e3;
+const MAX_SELECTED_ANSWERS = MAX_PRESENTED_OPTIONS$1;
+const MAX_VERSION_CHARS = 40;
+const MAX_REASON_CHARS$1 = 200;
+const MAX_MODEL_CHARS$1 = 120;
+const MAX_QUERY_KINDS = 3;
+const MAX_QUERY_LIMIT = 200;
+const DEFAULT_QUERY_LIMIT = 50;
+const MAX_CURSOR_CHARS = 160;
+const factId = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_FACT_ID_CHARS), Schema$1.isPattern(/^[A-Za-z0-9][A-Za-z0-9._:-]*$(?![\s\S])/));
+const nonNegativeInt$1 = Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(0));
+/**
+* One option exactly as the user saw it, so a later preference read has its
+* context. Deliberately its own shape rather than the live question contract:
+* a fact records what was shown that day, and must not change meaning when the
+* question schema does.
+*/
+const PresentedOption = Schema$1.Struct({
+	label: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_OPTION_LABEL_CHARS$1)),
+	description: Schema$1.String.check(Schema$1.isMaxLength(MAX_OPTION_DESCRIPTION_CHARS$1))
+});
+/**
+* What the user actually answered.
+*
+* The custom text is kept verbatim: an answer nobody offered is the most
+* informative one there is, and summarizing it away would leave the fact
+* saying only that the offered options were all wrong.
+*/
+const QuestionAnswer = Schema$1.Union([
+	Schema$1.Struct({
+		kind: Schema$1.Literal("option"),
+		optionIndexes: Schema$1.Array(nonNegativeInt$1).check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_SELECTED_ANSWERS)),
+		labels: Schema$1.Array(Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_OPTION_LABEL_CHARS$1))).check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_SELECTED_ANSWERS))
+	}),
+	Schema$1.Struct({
+		kind: Schema$1.Literal("custom"),
+		text: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_CUSTOM_ANSWER_CHARS$1))
+	}),
+	Schema$1.Struct({ kind: Schema$1.Literal("dismissed") })
+]);
+/** An `ask_user_question` as presented, and what came back. */
+const HubQuestionFactV1 = Schema$1.Struct({
+	questionId: factId,
+	threadId: Schema$1.optional(ThreadId),
+	header: Schema$1.String.check(Schema$1.isMaxLength(MAX_HEADER_CHARS$2)),
+	question: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_QUESTION_CHARS$2)),
+	multiSelect: Schema$1.Boolean,
+	options: Schema$1.Array(PresentedOption).check(Schema$1.isMaxLength(MAX_PRESENTED_OPTIONS$1)),
+	answer: QuestionAnswer,
+	answeredInMs: Schema$1.optional(nonNegativeInt$1)
+});
+/**
+* One Fusion handoff, from one implementer thread.
+*
+* Efficiency is reported as what the handoff carried and what it cost, never
+* as a score: the counts are comparable across versions, a verdict is not.
+*/
+const HubFusionHandoffFactV1 = Schema$1.Struct({
+	fusionVersion: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_VERSION_CHARS)),
+	threadId: ThreadId,
+	/**
+	* The recorded review outcome, in the server's own vocabulary: `unreported`
+	* is a real result - a review that closed answering nothing - and collapsing
+	* it into a failure would lose the only row that says so.
+	*/
+	status: ThreadEvidenceActivityOutcome,
+	/** The model the report names, or null when the review recorded none. */
+	model: Schema$1.NullOr(Schema$1.String.check(Schema$1.isMaxLength(MAX_MODEL_CHARS$1))),
+	reason: Schema$1.NullOr(Schema$1.String.check(Schema$1.isMaxLength(MAX_REASON_CHARS$1))),
+	transcriptEvents: nonNegativeInt$1,
+	transcriptIncluded: nonNegativeInt$1,
+	transcriptDropped: nonNegativeInt$1,
+	transcriptClippedFields: nonNegativeInt$1,
+	ledgerRows: nonNegativeInt$1,
+	ledgerTotalRows: nonNegativeInt$1,
+	summaryChars: Schema$1.NullOr(nonNegativeInt$1),
+	contextDeltaTokens: Schema$1.NullOr(Schema$1.Int),
+	durationMs: Schema$1.NullOr(nonNegativeInt$1)
+});
+/**
+* One compression pass: what it started from, what it left, and what it cost.
+*
+* The mode is the product's own strict mode set, so a mode added there is
+* recordable here the day it ships; a local copy of the literals would quietly
+* reject the new one and lose exactly the passes worth measuring. The strict
+* schema rather than the tolerant wire one: a fact that relabelled an unknown
+* mode as the default would be a record of something that never ran.
+*/
+const HubCompressionFactV1 = Schema$1.Struct({
+	mode: CompressModeLiteral,
+	threadId: Schema$1.optional(ThreadId),
+	beforeTokens: nonNegativeInt$1,
+	afterTokens: nonNegativeInt$1,
+	/** Negative when the pass cost more than it saved; the sign is the finding. */
+	deltaTokens: Schema$1.Int,
+	durationMs: nonNegativeInt$1
+});
+const HubAnalyticsFactKind = Schema$1.Literals([
+	"question.answered",
+	"fusion.handoff",
+	"compression.applied"
+]);
+const factBase = {
+	/** Dedupe identity: the same id appended twice stores one fact. */
+	eventId: factId,
+	occurredAt: IsoDateTime
+};
+/** One append. The kind fixes the payload shape, and the version fixes its meaning. */
+const HubAnalyticsFactInput = Schema$1.Union([
+	Schema$1.Struct({
+		...factBase,
+		kind: Schema$1.Literal("question.answered"),
+		version: Schema$1.Literal(1),
+		payload: HubQuestionFactV1
+	}),
+	Schema$1.Struct({
+		...factBase,
+		kind: Schema$1.Literal("fusion.handoff"),
+		version: Schema$1.Literal(1),
+		payload: HubFusionHandoffFactV1
+	}),
+	Schema$1.Struct({
+		...factBase,
+		kind: Schema$1.Literal("compression.applied"),
+		version: Schema$1.Literal(1),
+		payload: HubCompressionFactV1
+	})
+]);
+/** A stored fact as it is read back, with the environment that reported it. */
+const HubAnalyticsFact = Schema$1.Struct({
+	eventId: factId,
+	environmentId: EnvironmentId,
+	kind: HubAnalyticsFactKind,
+	version: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(1)),
+	occurredAt: IsoDateTime,
+	payload: Schema$1.Unknown
+});
+/**
+* An opaque page position: the occurrence millisecond and the event id that
+* produced it, which together order every row exactly once.
+*/
+const HubAnalyticsCursor = Schema$1.String.check(Schema$1.isMaxLength(MAX_CURSOR_CHARS), Schema$1.isPattern(/^\d+\|[A-Za-z0-9][A-Za-z0-9._:-]*$(?![\s\S])/));
+const HubAnalyticsQuery = Schema$1.Struct({
+	kinds: Schema$1.optional(Schema$1.Array(HubAnalyticsFactKind).check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_QUERY_KINDS))),
+	since: Schema$1.optional(IsoDateTime),
+	until: Schema$1.optional(IsoDateTime),
+	limit: Schema$1.optional(Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(1), Schema$1.isLessThanOrEqualTo(MAX_QUERY_LIMIT))),
+	cursor: Schema$1.optional(HubAnalyticsCursor)
+});
+const HubAnalyticsPage = Schema$1.Struct({
+	facts: Schema$1.Array(HubAnalyticsFact),
+	/** Null when the page reached the end, never an empty string. */
+	nextCursor: Schema$1.NullOr(HubAnalyticsCursor)
+});
+const HUB_ANALYTICS_QUERY_LIMITS = {
+	defaultLimit: DEFAULT_QUERY_LIMIT,
+	maxLimit: MAX_QUERY_LIMIT
+};
+//#endregion
+//#region ../../packages/contracts/src/hubNotifications.ts
+const MAX_NOTIFICATION_ID_CHARS = 128;
+const MAX_PUSH_TOKEN_CHARS = 4096;
+const MAX_HUB_ORIGIN_CHARS = 2048;
+const MAX_ACTIVITY_TITLE_CHARS = 160;
+const MAX_ACTIVITY_DETAIL_CHARS = 240;
+const identifier = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_NOTIFICATION_ID_CHARS), Schema$1.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$(?![\s\S])/));
+const pushToken = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PUSH_TOKEN_CHARS), Schema$1.isPattern(/^[\x21-\x7e]+$(?![\s\S])/));
+/** Server emission is bound to the authenticated environment, never a supplied account. */
+const HubAgentActivityInput = Schema$1.Struct({
+	eventId: identifier,
+	threadId: ThreadId,
+	revision: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(0)),
+	state: Schema$1.Literals([
+		"running",
+		"approval_required",
+		"question_required",
+		"completed",
+		"failed",
+		"stopped"
+	]),
+	title: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_ACTIVITY_TITLE_CHARS)),
+	detail: Schema$1.String.check(Schema$1.isMaxLength(MAX_ACTIVITY_DETAIL_CHARS))
+});
+/** Each authenticated client owns its registration; tokens never belong in public client state. */
+const HubPushRegistrationInput = Schema$1.Union([Schema$1.Struct({
+	platform: Schema$1.Literal("ios"),
+	token: pushToken,
+	sandbox: Schema$1.Boolean
+}), Schema$1.Struct({
+	platform: Schema$1.Literal("android"),
+	token: pushToken
+})]);
+/** Explicit opt-in, independently reversible. Omission never implies permission. */
+const HubNotificationPreferences = Schema$1.Struct({
+	attention: Schema$1.Boolean,
+	completion: Schema$1.Boolean,
+	liveActivity: Schema$1.Boolean
+});
+Schema$1.Struct({
+	registered: Schema$1.Boolean,
+	registrationGeneration: Schema$1.NullOr(identifier),
+	preferences: HubNotificationPreferences
+});
+/** ActivityKit update token, distinct from the app's APNs registration token. */
+const HubActivityOwnership = Schema$1.Struct({
+	origin: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_HUB_ORIGIN_CHARS)),
+	environmentId: EnvironmentId,
+	clientId: HubClientId,
+	registrationGeneration: identifier,
+	threadId: ThreadId,
+	activityId: identifier
+});
+const HubLiveActivityRegistrationInput = Schema$1.Struct({
+	threadId: ThreadId,
+	registrationGeneration: identifier,
+	activityId: identifier,
+	token: Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PUSH_TOKEN_CHARS), Schema$1.isPattern(/^(?:[a-fA-F0-9]{2})+$(?![\s\S])/)),
+	sandbox: Schema$1.Boolean,
+	p4Ownership: Schema$1.optional(HubActivityOwnership)
+});
+/** Close only this presentation; delayed requests must not retire a newer activity. */
+const HubLiveActivityRemoveInput = Schema$1.Struct({
+	threadId: ThreadId,
+	registrationGeneration: identifier,
+	activityId: identifier
+});
+const HUB_TUNNEL_WEBSOCKET_PROTOCOL = "p4-hub-tunnel-v1";
+const HUB_TUNNEL_INITIAL_WINDOW_BYTES = 256 * 1024;
+const HUB_TUNNEL_MAX_WINDOW_BYTES = 1024 * 1024;
+const MAX_HEADERS = 64;
+const MAX_HEADER_NAME_CHARS = 128;
+const MAX_HEADER_VALUE_CHARS = 8192;
+const MAX_PATH_CHARS = 8192;
+const MAX_PROTOCOLS = 16;
+const MAX_PROTOCOL_CHARS = 128;
+const HeaderName = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_HEADER_NAME_CHARS), Schema$1.isPattern(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$(?![\s\S])/));
+const HeaderValue = Schema$1.String.check(Schema$1.isMaxLength(MAX_HEADER_VALUE_CHARS), Schema$1.isPattern(/^[\t\x20-\x7e]*$(?![\s\S])/));
+const Headers$2 = Schema$1.Array(Schema$1.Tuple([HeaderName, HeaderValue])).check(Schema$1.isMaxLength(MAX_HEADERS));
+const Path = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PATH_CHARS), Schema$1.isPattern(/^\/(?!\/)[^\s\\#\x00-\x1f\x7f]*$(?![\s\S])/));
+const Protocol = Schema$1.String.check(Schema$1.isMinLength(1), Schema$1.isMaxLength(MAX_PROTOCOL_CHARS), Schema$1.isPattern(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$(?![\s\S])/));
+const FailureReason = Schema$1.Literals([
+	"cancelled",
+	"unavailable",
+	"protocol_error"
+]);
+const CloseCode = Schema$1.Int.check(Schema$1.makeFilter((code) => code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006 || code >= 3e3 && code <= 4999));
+/** No caller-supplied account, environment, origin, or connector ownership authority. */
+const HubTunnelControl = Schema$1.Union([
+	Schema$1.Struct({
+		type: Schema$1.Literal("connector_ready"),
+		protocolVersion: Schema$1.Literal(1)
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("http_request_start"),
+		method: Schema$1.Literals([
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE",
+			"OPTIONS"
+		]),
+		path: Path,
+		headers: Headers$2
+	}),
+	Schema$1.Struct({ type: Schema$1.Literal("http_request_end") }),
+	Schema$1.Struct({
+		type: Schema$1.Literal("http_request_abort"),
+		reason: FailureReason
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("http_response_start"),
+		status: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(200), Schema$1.isLessThanOrEqualTo(599)),
+		headers: Headers$2
+	}),
+	Schema$1.Struct({ type: Schema$1.Literal("http_response_end") }),
+	Schema$1.Struct({
+		type: Schema$1.Literal("http_response_abort"),
+		reason: FailureReason
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("websocket_open"),
+		path: Path,
+		headers: Headers$2,
+		protocols: Schema$1.Array(Protocol).check(Schema$1.isMaxLength(MAX_PROTOCOLS))
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("websocket_accept"),
+		protocol: Schema$1.optional(Protocol)
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("websocket_reject"),
+		status: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(400), Schema$1.isLessThanOrEqualTo(599)),
+		reason: FailureReason
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("websocket_close"),
+		code: CloseCode,
+		reason: FailureReason
+	}),
+	Schema$1.Struct({
+		type: Schema$1.Literal("window_update"),
+		creditBytes: Schema$1.Int.check(Schema$1.isGreaterThan(0), Schema$1.isLessThanOrEqualTo(HUB_TUNNEL_MAX_WINDOW_BYTES))
+	})
+]);
 //#endregion
 //#region ../../packages/contracts/src/environmentHttp.ts
 const OptionalBearerHeaders = Schema$1.Struct({
@@ -7866,9 +8297,16 @@ const UserInputResolvedPayload = Schema$1.Struct({ answers: UnknownRecordSchema
 * that outlives its turn is in practice a watch loop). Canonical single copy,
 * so the server liveness registry and any client fold classify identically.
 */
+const MONITOR_TOOL_TASK_TYPES = /* @__PURE__ */ new Set(["monitor", "monitor_mcp"]);
+/**
+* A watch loop the agent asked for by name, without the background shells.
+*
+* A backgrounded shell is only a watch loop in practice; it can equally run a
+* build or edit a file, so a consumer that needs proof of waiting rather than
+* a liveness hint must use this narrower set.
+*/
 const MONITOR_TASK_TYPES = /* @__PURE__ */ new Set([
-	"monitor",
-	"monitor_mcp",
+	...MONITOR_TOOL_TASK_TYPES,
 	"local_bash",
 	"shell"
 ]);
@@ -12210,6 +12648,44 @@ const TicketResolveResult = Schema$1.Struct({
 	*/
 	description: Schema$1.optional(TrimmedNonEmptyString)
 });
+/** One link filed alongside a comment: the proof, and what to call it. */
+const TicketCommentAttachment = Schema$1.Struct({
+	url: TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "Publicly reachable URL of the proof to file against the ticket. Local file paths cannot be attached." })),
+	title: Schema$1.optional(TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "Label for the link. Defaults to the URL itself." })))
+});
+/**
+* One comment on a ticket, with the links that belong to it.
+*
+* Commenting rather than editing: closeout writes what happened, and the
+* description belongs to whoever filed the ticket. The attachments ride along
+* because proof without the sentence explaining it is an orphan link.
+*/
+const TicketCommentInput = Schema$1.Struct({
+	reference: TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "The ticket as it was written: an identifier like MOBILE-12241, or a tracker URL." })),
+	body: TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "The comment, in Markdown, exactly as it should appear on the ticket." })),
+	attachments: Schema$1.optional(Schema$1.Array(TicketCommentAttachment))
+});
+/** A link the tracker would not file, and the sentence explaining why. */
+const TicketCommentAttachmentFailure = Schema$1.Struct({
+	url: TrimmedNonEmptyString,
+	detail: Schema$1.String
+});
+const TicketCommentResult = Schema$1.Struct({
+	externalRef: TaskExternalRef,
+	/** Absent when the tracker filed the comment and reported no link to it. */
+	commentUrl: Schema$1.optional(TrimmedNonEmptyString),
+	/** The attachments that landed, in the order they were asked for. */
+	attachedUrls: Schema$1.Array(TrimmedNonEmptyString),
+	/**
+	* The attachments that did not land.
+	*
+	* Reported rather than thrown, because the comment is already on the ticket
+	* by the time a link can fail: a caller told only "it failed" retries the
+	* whole call and files the comment twice. With this it can retry the links
+	* alone, or say in the thread which proof is missing.
+	*/
+	failedAttachments: Schema$1.Array(TicketCommentAttachmentFailure)
+});
 /**
 * Why a reference could not be turned into a ticket.
 *
@@ -12568,251 +13044,6 @@ var ThreadAskFailedError = class extends Schema$1.TaggedErrorClass()("ThreadAskF
 	}
 };
 const ThreadAskToolError = Schema$1.Union([ThreadAskNotPermittedError, ThreadAskFailedError]);
-const ThreadWatchEventsInput = Schema$1.Struct({
-	threadId: ThreadId.annotate({ description: "The thread to read events from. Any thread on this server, not only this session's own." }),
-	afterSequence: Schema$1.optional(NonNegativeInt.annotate({ description: "Exclusive sequence cursor. Events with a higher sequence are returned. Omit to read from the beginning." })),
-	limit: Schema$1.optional(NonNegativeInt.check(Schema$1.isLessThanOrEqualTo(200)).annotate({ description: `Maximum events to return (default 50, max 200).` }))
-});
-const ThreadWatchEventsResult = Schema$1.Struct({
-	threadId: ThreadId,
-	/** Ordered by sequence ascending; resume with the last event's sequence. */
-	events: Schema$1.Array(OrchestrationEvent),
-	/**
-	* The engine's latest persisted sequence at read time. Equal to the last
-	* returned event's sequence when the watcher is caught up.
-	*/
-	headSequence: NonNegativeInt,
-	/** True when more events for this thread exist past the returned page. */
-	hasMore: Schema$1.Boolean
-});
-/** Compact review limits are server-owned, independent of raw event paging. */
-const THREAD_REVIEW_SCAN_LIMIT = 2e3;
-const THREAD_REVIEW_ITEM_MAX_BYTES = 8e3;
-const ThreadWatchReviewInput = Schema$1.Struct({
-	threadId: ThreadId,
-	afterSequence: Schema$1.optional(NonNegativeInt),
-	throughSequence: Schema$1.optional(NonNegativeInt.annotate({ description: "Inclusive fixed review boundary. Omit on the first page to capture the head; reuse the returned boundary on every subsequent page." }))
-});
-const ReviewSourceFields = {
-	firstSequence: NonNegativeInt,
-	lastSequence: NonNegativeInt,
-	truncated: Schema$1.Boolean
-};
-const ThreadReviewItem = Schema$1.Union([Schema$1.Struct({
-	...ReviewSourceFields,
-	kind: Schema$1.Literal("message"),
-	messageId: Schema$1.String,
-	turnId: Schema$1.NullOr(Schema$1.String),
-	role: Schema$1.String,
-	/** Apply append/replace by message identity across page boundaries. */
-	operation: Schema$1.Literals(["append", "replace"]),
-	complete: Schema$1.Boolean,
-	text: Schema$1.String,
-	/**
-	* What the message carried besides text.
-	*
-	* Present only when there was something: a message whose fragments are
-	* merged by identity would otherwise lose every trace of an image or a
-	* document the builder attached. Bounded by
-	* {@link THREAD_REVIEW_ITEM_MAX_ATTACHMENTS} so the item stays trimmable -
-	* only its text shrinks under the byte cap, so nothing else may be able to
-	* grow without limit.
-	*/
-	attachments: Schema$1.optionalKey(Schema$1.Array(Schema$1.Struct({
-		type: Schema$1.String,
-		name: Schema$1.String,
-		sizeBytes: NonNegativeInt
-	})))
-}), Schema$1.Struct({
-	...ReviewSourceFields,
-	kind: Schema$1.Literal("event"),
-	type: Schema$1.String,
-	/** JSON evidence excerpt. Truncated excerpts require targeted raw recovery. */
-	payload: Schema$1.String
-})]);
-/**
-* Compressed evidence standing in for the items it replaces.
-*
-* The supervisor reads this instead of paging the range event by event. The
-* sequence bounds are what make that safe: any claim can be verified at source
-* with a targeted `thread_watch_events` read over exactly this range, so the
-* summary is a starting point rather than the only record.
-*
-* `degraded` is set whenever the items came back unsummarized, and names why.
-* Most reasons are failures - unset model, provider error, timeout, empty or
-* unusable output - but `page-under-threshold` is not: it means the page was
-* small enough that summarizing it would have cost more than reading it. The
-* supervisor is never left guessing whether it is reading everything.
-*/
-const ThreadReviewSummary = Schema$1.Struct({
-	text: Schema$1.String,
-	firstSequence: NonNegativeInt,
-	lastSequence: NonNegativeInt,
-	/** How many builder turns the range covered. */
-	turnCount: NonNegativeInt,
-	degraded: Schema$1.NullOr(Schema$1.String)
-});
-const ThreadWatchReviewResult = Schema$1.Struct({
-	threadId: ThreadId,
-	items: Schema$1.Array(ThreadReviewItem),
-	throughSequence: NonNegativeInt,
-	/** Resume from the source scan cursor, even when items is empty. */
-	nextAfterSequence: NonNegativeInt,
-	hasMore: Schema$1.Boolean,
-	scannedEvents: NonNegativeInt,
-	/**
-	* Present only when summarization ran. When its `degraded` is null the
-	* `items` for the summarized range are omitted and this stands in for them;
-	* otherwise the items are intact and this explains why.
-	*/
-	summary: Schema$1.optionalKey(Schema$1.NullOr(ThreadReviewSummary))
-});
-/**
-* How a review ended, from the supervisor's own account of it.
-*
-* Three states rather than a boolean because they are acted on differently: a
-* summary that arrived is evidence, a fallback is a working review that cost
-* full context, and a failure is a misconfiguration worth fixing. The fourth
-* state - a read no report ever answered - is not sayable here: only the
-* server can observe it, through `ThreadEvidenceActivityOutcome`.
-*/
-const ThreadEvidenceReportOutcome = Schema$1.Literals([
-	"summarized",
-	"fallback",
-	"failed"
-]);
-/** Bounded so one report cannot dominate a thread's activity storage. */
-const THREAD_EVIDENCE_REPORT_MAX_CHARS = 8e3;
-const ThreadEvidenceReportInput = Schema$1.Struct({
-	/** The watched thread the summary covers, not the reporting thread. */
-	threadId: ThreadId,
-	firstSequence: NonNegativeInt,
-	lastSequence: NonNegativeInt,
-	/**
-	* The fixed review boundary the pages were read against.
-	*
-	* Identity, not description: the evidence-read rows are keyed on it, so a
-	* report that guessed from its own last sequence would look for a baseline
-	* that never existed whenever the range ended on a filtered event.
-	*/
-	throughSequence: NonNegativeInt,
-	outcome: ThreadEvidenceReportOutcome,
-	/** The summarizer's exact text. Required when the outcome is summarized. */
-	summary: Schema$1.optional(Schema$1.String),
-	/** The model the subagent ran on, when one was spawned. */
-	model: Schema$1.optional(Schema$1.String),
-	/** Why the summary is missing or degraded. Required unless summarized. */
-	reason: Schema$1.optional(Schema$1.String)
-});
-/**
-* The supervisor's own context around the read, correlated by the server.
-*
-* Self-reported numbers would be worth little, so these are read from the
-* reporting thread's projected context-window rows: `before` is what was
-* recorded when the evidence read happened, `after` what is recorded when the
-* report lands. `delta` can be negative when a compaction ran in between, and
-* is null whenever no read-time baseline exists.
-*/
-const ThreadEvidenceReportContext = Schema$1.Struct({
-	/**
-	* Null when no reading was recorded at read time.
-	*
-	* Never the report-time value standing in for itself: a delta of zero read
-	* as measurement would be a lie about a review that cost context.
-	*/
-	usedTokensBefore: Schema$1.NullOr(NonNegativeInt),
-	usedTokensAfter: NonNegativeInt,
-	/** Null exactly when `usedTokensBefore` is. */
-	deltaTokens: Schema$1.NullOr(Schema$1.Number),
-	maxTokens: Schema$1.NullOr(NonNegativeInt),
-	capacityPercent: Schema$1.NullOr(Schema$1.Number)
-});
-/**
-* How the recorded row ended, which is the supervisor's three outcomes plus the
-* one only the server can state: the review closed with no report at all.
-*
-* `unreported` is never accepted from a tool call. The server writes it when a
-* supervisor turn ends over an evidence read that nothing answered, so the
-* absence survives outside a live client that could infer it from two rows.
-*/
-const ThreadEvidenceActivityOutcome = Schema$1.Literals([
-	"summarized",
-	"fallback",
-	"failed",
-	"unreported"
-]);
-/**
-* Server clock around one review, never the supervisor's own account of it.
-*
-* `readAt` is when the evidence-read row was recorded and `closedAt` when the
-* row that closes the review was: the report for a reported review, the
-* completed supervisor turn for an unreported one. A supervisor turn that
-* failed or was interrupted closes nothing, so its read keeps no timing until
-* some later turn reports on it.
-*/
-const ThreadEvidenceReportTiming = Schema$1.Struct({
-	readAt: IsoDateTime,
-	closedAt: IsoDateTime,
-	durationMs: NonNegativeInt
-});
-/** Payload of the single `fusion.evidence.summary` activity a report records. */
-const ThreadEvidenceReportActivity = Schema$1.Struct({
-	watchedThreadId: ThreadId,
-	firstSequence: NonNegativeInt,
-	lastSequence: NonNegativeInt,
-	throughSequence: NonNegativeInt,
-	outcome: ThreadEvidenceActivityOutcome,
-	summary: Schema$1.NullOr(Schema$1.String),
-	/** True when a snapshot dropped the text of a superseded report. */
-	summaryDropped: Schema$1.optionalKey(Schema$1.Boolean),
-	model: Schema$1.NullOr(Schema$1.String),
-	reason: Schema$1.NullOr(Schema$1.String),
-	/** Null when no context-window row exists yet for the reporting thread. */
-	context: Schema$1.NullOr(ThreadEvidenceReportContext),
-	/**
-	* Null when the evidence-read row behind this review is no longer readable,
-	* and absent on rows stored before the server measured a review at all.
-	*/
-	timing: Schema$1.optionalKey(Schema$1.NullOr(ThreadEvidenceReportTiming))
-});
-const ThreadEvidenceReportResult = Schema$1.Struct({
-	recorded: Schema$1.Boolean,
-	context: Schema$1.NullOr(ThreadEvidenceReportContext)
-});
-var WatchToolUnavailableError = class extends Schema$1.TaggedErrorClass()("WatchToolUnavailableError", {
-	capability: Schema$1.Literal("watch"),
-	environmentId: EnvironmentId,
-	threadId: ThreadId,
-	providerSessionId: TrimmedNonEmptyString,
-	providerInstanceId: ProviderInstanceId
-}) {
-	get message() {
-		return `MCP credential does not grant the ${this.capability} capability.`;
-	}
-};
-/**
-* The capability is present but the requested thread is not in the granted
-* set. Separate from {@link WatchToolUnavailableError} so a watcher can tell
-* "you cannot watch at all" apart from "not this thread".
-*/
-var ThreadWatchNotPermittedError = class extends Schema$1.TaggedErrorClass()("ThreadWatchNotPermittedError", { threadId: ThreadId }) {
-	get message() {
-		return `This session was not granted watch access to thread ${this.threadId}.`;
-	}
-};
-var ThreadWatchFailedError = class extends Schema$1.TaggedErrorClass()("ThreadWatchFailedError", {
-	threadId: ThreadId,
-	detail: Schema$1.String
-}) {
-	get message() {
-		return `Reading events for thread ${this.threadId} failed: ${this.detail}`;
-	}
-};
-const ThreadWatchToolError = Schema$1.Union([
-	WatchToolUnavailableError,
-	ThreadWatchNotPermittedError,
-	ThreadWatchFailedError
-]);
 //#endregion
 //#region ../../packages/contracts/src/threadControl.ts
 /**
@@ -14412,10 +14643,19 @@ const UserInputRankingInput = Schema$1.Struct({
 	requestId: ApprovalRequestId,
 	questionId: Schema$1.String
 });
-const UserInputRankingResult = Schema$1.Struct({ ranks: Schema$1.Array(Schema$1.Struct({
-	optionIndex: Schema$1.Int,
-	rank: Schema$1.Int
-})) });
+/**
+* `probability` is the option's share of the ranker's distribution and
+* `confidence` how concentrated that distribution is. Both come from the
+* TypeSafe answer; neither is invented when the answer carries none.
+*/
+const UserInputRankingResult = Schema$1.Struct({
+	confidence: Schema$1.Number,
+	ranks: Schema$1.Array(Schema$1.Struct({
+		optionIndex: Schema$1.Int,
+		rank: Schema$1.Int,
+		probability: Schema$1.Number
+	}))
+});
 var UserInputRankingError = class extends Schema$1.TaggedErrorClass()("UserInputRankingError", { detail: Schema$1.String }) {};
 //#endregion
 //#region ../../packages/contracts/src/providerSetup.ts
@@ -14928,6 +15168,7 @@ const WS_METHODS = {
 	hubSetSyncMode: "hub.setSyncMode",
 	hubSetShareMode: "hub.setShareMode",
 	hubMintToken: "hub.mintToken",
+	hubAnalyticsQuery: "hub.analyticsQuery",
 	settingsSyncNow: "settingsSync.now",
 	storageCleanupPreview: "storageCleanup.preview",
 	storageCleanupSweep: "storageCleanup.sweep",
@@ -15141,6 +15382,19 @@ const WsWorktreeCleanupSweepRpc = Rpc.make(WS_METHODS.worktreeCleanupSweep, {
 	success: WorktreeCleanupPreview,
 	error: Schema$1.Union([EnvironmentAuthorizationError])
 });
+/**
+* The account's own analytics facts, read through this server.
+*
+* The hub credential belongs to the environment, not to a browser tab, so the
+* client never holds it: it asks its own server, which is already the only
+* thing that can authenticate against the hub. Read-only, and the query is the
+* hub's own contract, so a filter the hub rejects is rejected here too.
+*/
+const WsHubAnalyticsQueryRpc = Rpc.make(WS_METHODS.hubAnalyticsQuery, {
+	payload: HubAnalyticsQuery,
+	success: HubAnalyticsPage,
+	error: HubRpcError
+});
 const WsHubGetSyncStatusRpc = Rpc.make(WS_METHODS.hubGetSyncStatus, {
 	payload: Schema$1.Struct({}),
 	success: AgentSyncStatus,
@@ -16092,7 +16346,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsDeviceGetStateRpc, WsDeviceListRpc, WsDeviceConfigureRpc, WsDeviceOpenRpc, WsDeviceCloseRpc, WsDeviceDetailRpc, WsDeviceActionRpc, WsSubscribeDevicesRpc, WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerProviderAuthStartRpc, WsServerProviderAuthCompleteRpc, WsServerProviderAuthCancelRpc, WsServerProviderAuthLogoutRpc, WsServerProviderAuthSubscribeRpc, WsServerProviderInstallStartRpc, WsServerProviderInstallCancelRpc, WsServerProviderInstallRemoveRpc, WsServerProviderInstallSubscribeRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerGetFusionDefaultPromptsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetHostResourcesRpc, WsServerGetResourceTelemetryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsSubscribeResourceTelemetryRpc, WsThreadHandoffRpc, WsUserInputRankRpc, WsBtwAskRpc, WsBtwCancelRpc, WsServerGetUsageSummaryRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsStackRpc, WsPullRequestsActivityRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsComputerUseConnectRpc, WsComputerUseListRpc, WsComputerUseControlsRpc, WsComputerUseControlRpc, WsComputerUsePreviewRpc, WsComputerUseRespondRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsFeedListRpc, WsFeedRefreshRpc, WsFeedSourcesListRpc, WsFeedSourcesUpsertRpc, WsFeedSourcesDeleteRpc, WsFeedMarkReadRpc, WsFeedCleanupRpc, WsSubscribeTasksRpc, WsStorageCleanupPreviewRpc, WsStorageCleanupSweepRpc, WsWorktreeCleanupPreviewRpc, WsWorktreeCleanupSweepRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSettingsSyncNowRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsTrackerStatusRpc, WsTrackerSetApiKeyRpc, WsSupervisorSecretStatusRpc, WsSupervisorSetApiKeyRpc, WsSupervisorClearApiKeyRpc, WsTrackerClearApiKeyRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetWorkflowScriptRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationSearchThreadsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsDeviceGetStateRpc, WsDeviceListRpc, WsDeviceConfigureRpc, WsDeviceOpenRpc, WsDeviceCloseRpc, WsDeviceDetailRpc, WsDeviceActionRpc, WsSubscribeDevicesRpc, WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerProviderAuthStartRpc, WsServerProviderAuthCompleteRpc, WsServerProviderAuthCancelRpc, WsServerProviderAuthLogoutRpc, WsServerProviderAuthSubscribeRpc, WsServerProviderInstallStartRpc, WsServerProviderInstallCancelRpc, WsServerProviderInstallRemoveRpc, WsServerProviderInstallSubscribeRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerGetFusionDefaultPromptsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetHostResourcesRpc, WsServerGetResourceTelemetryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsSubscribeResourceTelemetryRpc, WsThreadHandoffRpc, WsUserInputRankRpc, WsBtwAskRpc, WsBtwCancelRpc, WsServerGetUsageSummaryRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsStackRpc, WsPullRequestsActivityRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsComputerUseConnectRpc, WsComputerUseListRpc, WsComputerUseControlsRpc, WsComputerUseControlRpc, WsComputerUsePreviewRpc, WsComputerUseRespondRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsFeedListRpc, WsFeedRefreshRpc, WsFeedSourcesListRpc, WsFeedSourcesUpsertRpc, WsFeedSourcesDeleteRpc, WsFeedMarkReadRpc, WsFeedCleanupRpc, WsSubscribeTasksRpc, WsStorageCleanupPreviewRpc, WsStorageCleanupSweepRpc, WsWorktreeCleanupPreviewRpc, WsWorktreeCleanupSweepRpc, WsHubAnalyticsQueryRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSettingsSyncNowRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsTrackerStatusRpc, WsTrackerSetApiKeyRpc, WsSupervisorSecretStatusRpc, WsSupervisorSetApiKeyRpc, WsSupervisorClearApiKeyRpc, WsTrackerClearApiKeyRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetWorkflowScriptRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationSearchThreadsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -16256,7 +16510,7 @@ const make$120 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$120 = Layer.effect(EnvironmentAuthPolicy, make$120);
+const layer$121 = Layer.effect(EnvironmentAuthPolicy, make$120);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -16571,7 +16825,7 @@ const make$119 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$119 = Layer.effect(AuthSessionRepository, make$119);
+const layer$120 = Layer.effect(AuthSessionRepository, make$119);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -16717,7 +16971,7 @@ const make$118 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	return yield* makeForDirectory(config.secretsDir);
 });
-const layer$118 = Layer.effect(ServerSecretStore, make$118);
+const layer$119 = Layer.effect(ServerSecretStore, make$118);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -17270,7 +17524,7 @@ const make$117 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$117 = Layer.effect(SessionStore, make$117).pipe(Layer.provideMerge(layer$119));
+const layer$118 = Layer.effect(SessionStore, make$117).pipe(Layer.provideMerge(layer$120));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -17466,7 +17720,7 @@ const make$116 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$116 = Layer.effect(AuthPairingLinkRepository, make$116);
+const layer$117 = Layer.effect(AuthPairingLinkRepository, make$116);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -17759,7 +18013,7 @@ const make$115 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$115 = Layer.effect(PairingGrantStore, make$115).pipe(Layer.provideMerge(layer$116));
+const layer$116 = Layer.effect(PairingGrantStore, make$115).pipe(Layer.provideMerge(layer$117));
 //#endregion
 //#region src/persistence/DatabaseSnapshot.ts
 /**
@@ -17901,6 +18155,21 @@ var _060_ThreadPairTriageCursor_default = Effect.gen(function* () {
 	yield* (yield* SqlClient.SqlClient)`ALTER TABLE thread_pairs ADD COLUMN triaged_from_sequence INTEGER`;
 });
 //#endregion
+//#region src/persistence/Migrations/061_AnalyticsFactOutbox.ts
+var _061_AnalyticsFactOutbox_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`CREATE TABLE analytics_fact_outbox (
+    event_id TEXT PRIMARY KEY, kind TEXT NOT NULL, version INTEGER NOT NULL,
+    occurred_at TEXT NOT NULL, payload TEXT NOT NULL,
+    pending INTEGER NOT NULL DEFAULT 1, created_at INTEGER NOT NULL
+  )`;
+	yield* sql`CREATE INDEX analytics_fact_outbox_pending
+    ON analytics_fact_outbox(pending, created_at, event_id)`;
+	yield* sql`CREATE TABLE analytics_fact_cursors (
+    source TEXT PRIMARY KEY, after_sequence INTEGER NOT NULL
+  )`;
+});
+//#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
@@ -20082,6 +20351,11 @@ const migrationEntries = [
 		60,
 		"ThreadPairTriageCursor",
 		_060_ThreadPairTriageCursor_default
+	],
+	[
+		61,
+		"AnalyticsFactOutbox",
+		_061_AnalyticsFactOutbox_default
 	]
 ];
 const makeMigrationLoader = (throughId) => Migrator.fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -20429,22 +20703,22 @@ function classifyToolCategory(input) {
 	if (normalized.includes("image")) return "image_view";
 	return "tool";
 }
-function asRecord$10(value) {
+function asRecord$12(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Classify from a runtime item payload's `data` (`{ toolName, input }`). */
 function classifyToolCategoryFromToolData(data) {
-	const record = asRecord$10(data);
+	const record = asRecord$12(data);
 	const toolName = record?.toolName;
 	if (typeof toolName !== "string" || toolName.trim().length === 0) return;
 	return classifyToolCategory({
 		toolName,
-		toolInput: asRecord$10(record?.input)
+		toolInput: asRecord$12(record?.input)
 	});
 }
 //#endregion
 //#region src/orchestration/ActivityPayloadProjection.ts
-function asRecord$9(value) {
+function asRecord$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asTrimmedString$2(value) {
@@ -20474,7 +20748,7 @@ function compactMcpRecord(record) {
 	const entries = Object.entries(record);
 	const projected = {};
 	for (const [key, value] of entries.slice(0, MCP_TOOL_ACTIVITY_FIELD_LIMIT)) {
-		const nestedItem = key === "item" ? asRecord$9(value) : null;
+		const nestedItem = key === "item" ? asRecord$11(value) : null;
 		projected[key] = nestedItem === null ? compactMcpField(value) : compactMcpRecord(nestedItem);
 	}
 	if (entries.length > MCP_TOOL_ACTIVITY_FIELD_LIMIT) projected.truncatedFields = entries.length - MCP_TOOL_ACTIVITY_FIELD_LIMIT;
@@ -20500,7 +20774,7 @@ function collectChangedFiles(value, target, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$9(value);
+	const record = asRecord$11(value);
 	if (!record) return;
 	pushChangedFile(target, seen, record.path);
 	pushChangedFile(target, seen, record.filePath);
@@ -20526,13 +20800,13 @@ function collectChangedFiles(value, target, seen, depth) {
 	}
 }
 function projectCommandData(data) {
-	const item = asRecord$9(data.item);
+	const item = asRecord$11(data.item);
 	if (!item) return;
 	const projectedItem = {};
 	if ("command" in item) projectedItem.command = item.command;
-	const input = asRecord$9(item.input);
+	const input = asRecord$11(item.input);
 	if (input && "command" in input) projectedItem.input = { command: input.command };
-	const result = asRecord$9(item.result);
+	const result = asRecord$11(item.result);
 	if (result && "command" in result) projectedItem.result = { command: result.command };
 	return Object.keys(projectedItem).length > 0 ? projectedItem : void 0;
 }
@@ -20556,7 +20830,7 @@ function summarizeToolTextOutput(value) {
 	return meaningfulLineCount > 1 ? `${meaningfulLineCount.toLocaleString()} lines` : null;
 }
 function projectRawOutput(value) {
-	const rawOutput = asRecord$9(value);
+	const rawOutput = asRecord$11(value);
 	if (!rawOutput) return;
 	if (typeof rawOutput.totalFiles === "number" && Number.isFinite(rawOutput.totalFiles)) return {
 		totalFiles: rawOutput.totalFiles,
@@ -20579,8 +20853,8 @@ function projectRawOutput(value) {
 * tool outputs do not accumulate twice in the event store and activity projection.
 */
 function projectActivityPayload(activity) {
-	const payload = asRecord$9(activity.payload);
-	const data = asRecord$9(payload?.data);
+	const payload = asRecord$11(activity.payload);
+	const data = asRecord$11(payload?.data);
 	if (!payload || !data) return activity;
 	if (payload.itemType === "mcp_tool_call") {
 		const projectedMcpData = projectMcpToolCallData(data);
@@ -20597,7 +20871,7 @@ function projectActivityPayload(activity) {
 	const item = projectCommandData(data);
 	if (item) projectedData.item = item;
 	if ("command" in data) projectedData.command = data.command;
-	const input = asRecord$9(data.input);
+	const input = asRecord$11(data.input);
 	if (input) {
 		const projectedInput = {};
 		if ("command" in input) projectedInput.command = input.command;
@@ -20637,7 +20911,7 @@ function projectActivityPayload(activity) {
 */
 function isResolvableContextWindowActivity(activity) {
 	if (activity.kind !== "context-window.updated") return false;
-	const usedTokens = asRecord$9(activity.payload)?.usedTokens;
+	const usedTokens = asRecord$11(activity.payload)?.usedTokens;
 	return typeof usedTokens === "number" && Number.isFinite(usedTokens) && usedTokens >= 0;
 }
 /**
@@ -20653,7 +20927,7 @@ function isResolvableContextWindowActivity(activity) {
 * client.
 */
 function withoutContextWindowBreakdown$1(activity) {
-	const payload = asRecord$9(activity.payload);
+	const payload = asRecord$11(activity.payload);
 	if (!payload || payload.breakdown === void 0) return activity;
 	const { breakdown: _breakdown, ...rest } = payload;
 	return {
@@ -20668,7 +20942,7 @@ function dropStaleContextWindowActivities(activities) {
 	const retainedIndexes = new Set(latestIndexByTurn.values());
 	let breakdownIndex = null;
 	for (const index of retainedIndexes) {
-		if (asRecord$9(activities[index].payload)?.breakdown === void 0) continue;
+		if (asRecord$11(activities[index].payload)?.breakdown === void 0) continue;
 		if (breakdownIndex === null || index > breakdownIndex) breakdownIndex = index;
 	}
 	return activities.flatMap((activity, index) => {
@@ -20678,12 +20952,12 @@ function dropStaleContextWindowActivities(activities) {
 	});
 }
 function toolLifecycleIdentity(activity) {
-	return asTrimmedString$2(asRecord$9(asRecord$9(activity.payload)?.data)?.toolCallId);
+	return asTrimmedString$2(asRecord$11(asRecord$11(activity.payload)?.data)?.toolCallId);
 }
 /** Clients retain fields missing from a completion when folding an update. */
 function completionPreservesUpdate(update, completion) {
-	const updatePayload = asRecord$9(update.payload);
-	const completionPayload = asRecord$9(completion.payload);
+	const updatePayload = asRecord$11(update.payload);
+	const completionPayload = asRecord$11(completion.payload);
 	if (!updatePayload || !completionPayload) return false;
 	return Object.entries(updatePayload).every(([key, value]) => key === "status" || NodeUtil.isDeepStrictEqual(value, completionPayload[key]));
 }
@@ -20722,13 +20996,13 @@ function dropSupersededEvidenceSummaries(activities) {
 	for (let index = 0; index < activities.length; index += 1) {
 		const activity = activities[index];
 		if (activity.kind !== "fusion.evidence.summary") continue;
-		const watchedThreadId = asRecord$9(activity.payload)?.watchedThreadId;
+		const watchedThreadId = asRecord$11(activity.payload)?.watchedThreadId;
 		if (typeof watchedThreadId === "string") latestIndexByWatched.set(watchedThreadId, index);
 	}
 	if (latestIndexByWatched.size === 0) return activities;
 	return activities.map((activity, index) => {
 		if (activity.kind !== "fusion.evidence.summary") return activity;
-		const payload = asRecord$9(activity.payload);
+		const payload = asRecord$11(activity.payload);
 		const watchedThreadId = payload?.watchedThreadId;
 		if (!payload || typeof watchedThreadId !== "string" || latestIndexByWatched.get(watchedThreadId) === index || payload.summary === null || payload.summary === void 0) return activity;
 		return {
@@ -21339,9 +21613,9 @@ const make$114 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$114 = Layer.effect(EnvironmentAuth, make$114).pipe(Layer.provideMerge(layer$115), Layer.provideMerge(layer$117), Layer.provideMerge(layer$120));
-const storageLayer = Layer.mergeAll(layer$118, layerConfig);
-const runtimeLayer = layer$114.pipe(Layer.provideMerge(storageLayer));
+const layer$115 = Layer.effect(EnvironmentAuth, make$114).pipe(Layer.provideMerge(layer$116), Layer.provideMerge(layer$118), Layer.provideMerge(layer$121));
+const storageLayer = Layer.mergeAll(layer$119, layerConfig);
+const runtimeLayer = layer$115.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region ../../packages/shared/src/Struct.ts
 function deepMerge(current, patch) {
@@ -23189,7 +23463,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$121(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$122(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -23349,7 +23623,7 @@ const make$113 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_L
 		})
 	});
 });
-const layer$113 = Layer.effect(HubAuthThrottle, make$113());
+const layer$114 = Layer.effect(HubAuthThrottle, make$113());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -24122,6 +24396,88 @@ const makeTaskRepository = Effect.gen(function* () {
 });
 const TaskRepositoryLive = Layer.effect(TaskRepository, makeTaskRepository);
 //#endregion
+//#region src/hub/HubClientCors.ts
+const MAX_ORIGIN_CHARS = 2048;
+const DESKTOP_RENDERER_ORIGINS$1 = /* @__PURE__ */ new Set(["p4code://app", "p4code-dev://app"]);
+const MAX_PREFLIGHT_HEADER_CHARS = 128;
+const ALLOWED_HEADERS = /* @__PURE__ */ new Set([
+	"authorization",
+	"content-type",
+	"accept"
+]);
+const CLIENT_ROUTES = {
+	"/v1/client-enrollments/exchange": ["POST"],
+	"/v1/clients/me": ["GET", "DELETE"],
+	"/v1/clients/me/events": ["GET"],
+	"/v1/clients/me/socket-ticket": ["POST"],
+	"/v1/clients/me/asset-grant": ["POST"],
+	"/v1/clients/me/notifications": [
+		"GET",
+		"PUT",
+		"DELETE"
+	],
+	"/v1/clients/me/notifications/preferences": ["PUT"],
+	"/v1/clients/me/live-activities": ["PUT", "DELETE"]
+};
+const routeMethods = (path) => Object.hasOwn(CLIENT_ROUTES, path) ? CLIENT_ROUTES[path] : void 0;
+const denied$2 = () => HttpServerResponse.jsonUnsafe({ error: "invalid_client_origin" }, {
+	status: 403,
+	headers: {
+		"cache-control": "no-store",
+		vary: "Origin"
+	}
+});
+/** Arbitrary self-hosted browser clients are allowed; authentication uses explicit credentials, never cookies. */
+function hubClientCorsOrigin(value) {
+	if (DESKTOP_RENDERER_ORIGINS$1.has(value)) return value;
+	if (value.length > MAX_ORIGIN_CHARS) return void 0;
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:" || value !== url.origin || url.username || url.password) return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
+}
+/** Wrap only client-authenticated routes, after their generic failure mapping. */
+const withHubClientCors = (operation) => Effect.gen(function* () {
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const path = request.url.split("?")[0];
+	if (!routeMethods(path)?.includes(request.method)) return denied$2();
+	const raw = request.headers.origin;
+	if (raw === void 0) return yield* operation;
+	const origin = hubClientCorsOrigin(raw);
+	if (!origin) return denied$2();
+	const response = yield* operation;
+	return response.pipe(HttpServerResponse.setHeaders({
+		"access-control-allow-origin": origin,
+		"access-control-expose-headers": "retry-after",
+		"cache-control": "no-store",
+		vary: response.headers.vary ? `${response.headers.vary}, Origin` : "Origin"
+	}));
+});
+const hubClientPreflight = Effect.gen(function* () {
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const origin = hubClientCorsOrigin(request.headers.origin ?? "");
+	const methods = routeMethods(request.url);
+	const method = request.headers["access-control-request-method"];
+	const raw = request.headers["access-control-request-headers"] ?? "";
+	if (raw.length > MAX_PREFLIGHT_HEADER_CHARS) return denied$2();
+	const headers = raw === "" ? [] : raw.split(",").map((value) => value.trim().toLowerCase());
+	if (!origin || !methods || !method || !methods.includes(method) || raw.length > MAX_PREFLIGHT_HEADER_CHARS || headers.length > ALLOWED_HEADERS.size || new Set(headers).size !== headers.length || headers.some((value) => !ALLOWED_HEADERS.has(value))) return denied$2();
+	return HttpServerResponse.empty({
+		status: 204,
+		headers: {
+			"access-control-allow-origin": origin,
+			"access-control-allow-methods": methods.join(", "),
+			"access-control-allow-headers": "authorization, content-type, accept",
+			"cache-control": "no-store",
+			vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+		}
+	});
+});
+const layer$113 = Layer.mergeAll(Layer.empty, ...Object.keys(CLIENT_ROUTES).map((path) => HttpRouter.add("OPTIONS", path, hubClientPreflight)));
+//#endregion
 //#region src/hub/HubClientRevocations.ts
 var HubClientRevocations = class extends Context.Service()("@p4code/cli/hub/HubClientRevocations") {};
 /** Coalesced invalidations carry no identity or credential; consumers recheck durable state. */
@@ -24282,88 +24638,6 @@ const signOutHubClient = Effect.fn("HubClients.signOut")(function* (credential)
       WHERE id = ${principal.clientId} AND credential_hash = ${hashHubToken(credential)}`;
 	})).pipe(Effect.ensuring(notifications.changed));
 });
-//#endregion
-//#region src/hub/HubClientCors.ts
-const MAX_ORIGIN_CHARS = 2048;
-const DESKTOP_RENDERER_ORIGINS$1 = /* @__PURE__ */ new Set(["p4code://app", "p4code-dev://app"]);
-const MAX_PREFLIGHT_HEADER_CHARS = 128;
-const ALLOWED_HEADERS = /* @__PURE__ */ new Set([
-	"authorization",
-	"content-type",
-	"accept"
-]);
-const CLIENT_ROUTES = {
-	"/v1/client-enrollments/exchange": ["POST"],
-	"/v1/clients/me": ["GET", "DELETE"],
-	"/v1/clients/me/events": ["GET"],
-	"/v1/clients/me/socket-ticket": ["POST"],
-	"/v1/clients/me/asset-grant": ["POST"],
-	"/v1/clients/me/notifications": [
-		"GET",
-		"PUT",
-		"DELETE"
-	],
-	"/v1/clients/me/notifications/preferences": ["PUT"],
-	"/v1/clients/me/live-activities": ["PUT", "DELETE"]
-};
-const routeMethods = (path) => Object.hasOwn(CLIENT_ROUTES, path) ? CLIENT_ROUTES[path] : void 0;
-const denied$2 = () => HttpServerResponse.jsonUnsafe({ error: "invalid_client_origin" }, {
-	status: 403,
-	headers: {
-		"cache-control": "no-store",
-		vary: "Origin"
-	}
-});
-/** Arbitrary self-hosted browser clients are allowed; authentication uses explicit credentials, never cookies. */
-function hubClientCorsOrigin(value) {
-	if (DESKTOP_RENDERER_ORIGINS$1.has(value)) return value;
-	if (value.length > MAX_ORIGIN_CHARS) return void 0;
-	try {
-		const url = new URL(value);
-		if (url.protocol !== "https:" && url.protocol !== "http:" || value !== url.origin || url.username || url.password) return void 0;
-		return url.origin;
-	} catch {
-		return;
-	}
-}
-/** Wrap only client-authenticated routes, after their generic failure mapping. */
-const withHubClientCors = (operation) => Effect.gen(function* () {
-	const request = yield* HttpServerRequest.HttpServerRequest;
-	const path = request.url.split("?")[0];
-	if (!routeMethods(path)?.includes(request.method)) return denied$2();
-	const raw = request.headers.origin;
-	if (raw === void 0) return yield* operation;
-	const origin = hubClientCorsOrigin(raw);
-	if (!origin) return denied$2();
-	const response = yield* operation;
-	return response.pipe(HttpServerResponse.setHeaders({
-		"access-control-allow-origin": origin,
-		"access-control-expose-headers": "retry-after",
-		"cache-control": "no-store",
-		vary: response.headers.vary ? `${response.headers.vary}, Origin` : "Origin"
-	}));
-});
-const hubClientPreflight = Effect.gen(function* () {
-	const request = yield* HttpServerRequest.HttpServerRequest;
-	const origin = hubClientCorsOrigin(request.headers.origin ?? "");
-	const methods = routeMethods(request.url);
-	const method = request.headers["access-control-request-method"];
-	const raw = request.headers["access-control-request-headers"] ?? "";
-	if (raw.length > MAX_PREFLIGHT_HEADER_CHARS) return denied$2();
-	const headers = raw === "" ? [] : raw.split(",").map((value) => value.trim().toLowerCase());
-	if (!origin || !methods || !method || !methods.includes(method) || raw.length > MAX_PREFLIGHT_HEADER_CHARS || headers.length > ALLOWED_HEADERS.size || new Set(headers).size !== headers.length || headers.some((value) => !ALLOWED_HEADERS.has(value))) return denied$2();
-	return HttpServerResponse.empty({
-		status: 204,
-		headers: {
-			"access-control-allow-origin": origin,
-			"access-control-allow-methods": methods.join(", "),
-			"access-control-allow-headers": "authorization, content-type, accept",
-			"cache-control": "no-store",
-			vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
-		}
-	});
-});
-const layer$111 = Layer.mergeAll(Layer.empty, ...Object.keys(CLIENT_ROUTES).map((path) => HttpRouter.add("OPTIONS", path, hubClientPreflight)));
 const HUB_TUNNEL_MAX_FRAME_PAYLOAD_BYTES = 64 * 1024;
 const HUB_TUNNEL_MAX_MESSAGE_BYTES = 128 * 1024 * 1024;
 const HUB_TUNNEL_FRAME_MAGIC = 1345606705;
@@ -24650,7 +24924,7 @@ var HubTunnelConnectorBudget = class {
 const HUB_TUNNEL_RETIRE_TIMEOUT_MS = 1e4;
 var HubTunnelUnavailable = class extends Data.TaggedError("HubTunnelUnavailable") {};
 var HubTunnelRegistry = class extends Context.Service()("@p4code/cli/hub/HubTunnelRegistry") {};
-const layer$110 = Layer.effect(HubTunnelRegistry, Effect.gen(function* () {
+const layer$111 = Layer.effect(HubTunnelRegistry, Effect.gen(function* () {
 	const config = yield* HubConfig;
 	const lock = yield* Semaphore.make(1);
 	const entries = /* @__PURE__ */ new Map();
@@ -24903,7 +25177,7 @@ const makeHubClientSocketTickets = Effect.gen(function* () {
 	};
 });
 var HubClientSocketTickets = class extends Context.Service()("@p4code/cli/hub/HubClientSocketTickets") {};
-const layer$109 = Layer.effect(HubClientSocketTickets, makeHubClientSocketTickets);
+const layer$110 = Layer.effect(HubClientSocketTickets, makeHubClientSocketTickets);
 //#endregion
 //#region src/hub/HubClientLease.ts
 /** Other Hub processes sharing the database are observed within this interval. */
@@ -24992,7 +25266,7 @@ const readBody$1 = Effect.fn("HubClientRoutes.readBody")(function* (schema, maxi
 	}) : request.stream.pipe(Stream.mapError(() => new InvalidClientRequest()))).pipe(Stream.runFoldEffect(() => Buffer.alloc(0), (buffer, chunk) => buffer.byteLength + chunk.byteLength > maximumBytes ? Effect.fail(new InvalidClientRequest()) : Effect.succeed(Buffer.concat([buffer, chunk]))));
 	return yield* Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(schema))(body.toString("utf8"), { onExcessProperty: "error" }).pipe(Effect.mapError(() => new InvalidClientRequest()));
 });
-const json$1 = (body) => HttpServerResponse.jsonUnsafe(body, { headers: { "cache-control": "no-store" } });
+const json$2 = (body) => HttpServerResponse.jsonUnsafe(body, { headers: { "cache-control": "no-store" } });
 const handle$1 = (operation, accountingOwner) => operation.pipe(Effect.timeout(HUB_CLIENT_REQUEST_TIMEOUT_MS), Effect.catch((error) => Effect.gen(function* () {
 	if (error instanceof HubThrottledError) return hubThrottledResponse(error.retryAfterSeconds);
 	if (error instanceof HubUnauthorizedError) {
@@ -25013,15 +25287,15 @@ const handle$1 = (operation, accountingOwner) => operation.pipe(Effect.timeout(H
 const issue$1 = handle$1(Effect.gen(function* () {
 	const principal = yield* authenticateHubServerMembership();
 	const input = yield* readBody$1(HubClientEnrollmentInput);
-	return json$1(yield* issueHubClientEnrollment(principal, input));
+	return json$2(yield* issueHubClientEnrollment(principal, input));
 }), "server-auth");
 const exchange$1 = handle$1(Effect.gen(function* () {
 	const input = yield* readBody$1(HubClientEnrollmentExchange);
-	return json$1(yield* consumeHubClientEnrollment(input.secret));
+	return json$2(yield* consumeHubClientEnrollment(input.secret));
 }), "client-route");
 const identity$2 = handle$1(Effect.gen(function* () {
 	const request = yield* HttpServerRequest.HttpServerRequest;
-	return json$1(yield* authenticateHubClient(readBearerToken(request.headers.authorization)));
+	return json$2(yield* authenticateHubClient(readBearerToken(request.headers.authorization)));
 }), "client-route");
 const events = handle$1(Effect.gen(function* () {
 	return yield* hubClientEvents(readBearerToken((yield* HttpServerRequest.HttpServerRequest).headers.authorization));
@@ -25046,7 +25320,7 @@ const socketTicket = handle$1(Effect.gen(function* () {
 	yield* authenticateHubClient(credential);
 	const input = yield* readBody$1(HubClientSocketTicketInput, MAX_SOCKET_TICKET_REQUEST_BYTES);
 	const tickets = yield* HubClientSocketTickets;
-	return json$1(yield* tickets.issue(credential, {
+	return json$2(yield* tickets.issue(credential, {
 		method: "GET",
 		url: `${HUB_TUNNEL_CLIENT_SOCKET_PATH}${input.path}`,
 		headers: {
@@ -25059,7 +25333,143 @@ const socketTicket = handle$1(Effect.gen(function* () {
 		}
 	}));
 }), "client-route");
-const layer$108 = Layer.mergeAll(layer$111, HttpRouter.add("POST", "/v1/clients/me/socket-ticket", withHubClientCors(socketTicket)), HttpRouter.add("POST", "/v1/client-enrollments", issue$1), HttpRouter.add("POST", "/v1/client-enrollments/exchange", withHubClientCors(exchange$1)), HttpRouter.add("GET", "/v1/clients/me", withHubClientCors(identity$2)), HttpRouter.add("GET", "/v1/clients/me/events", withHubClientCors(events)), HttpRouter.add("DELETE", "/v1/clients/me", withHubClientCors(signOut)), HttpRouter.add("POST", "/v1/clients/revoke", revoke));
+const layer$109 = Layer.mergeAll(layer$113, HttpRouter.add("POST", "/v1/clients/me/socket-ticket", withHubClientCors(socketTicket)), HttpRouter.add("POST", "/v1/client-enrollments", issue$1), HttpRouter.add("POST", "/v1/client-enrollments/exchange", withHubClientCors(exchange$1)), HttpRouter.add("GET", "/v1/clients/me", withHubClientCors(identity$2)), HttpRouter.add("GET", "/v1/clients/me/events", withHubClientCors(events)), HttpRouter.add("DELETE", "/v1/clients/me", withHubClientCors(signOut)), HttpRouter.add("POST", "/v1/clients/revoke", revoke));
+//#endregion
+//#region src/hub/HubAnalytics.ts
+/**
+* Account-scoped analytics facts: append and read.
+*
+* Every row belongs to the authenticated account, and every read is filtered
+* by it, so one account's facts can never appear in another's page. Appends
+* are idempotent on the caller's own event id rather than deduplicated by
+* content: a retry after a dropped response must not double-count, and a fact
+* is never rewritten once stored.
+*
+* @module HubAnalytics
+*/
+const CURSOR_SEPARATOR = "|";
+const decodeFact = Schema$1.decodeUnknownEffect(HubAnalyticsFactInput);
+const decodeQuery = Schema$1.decodeUnknownEffect(HubAnalyticsQuery);
+const encodePayload$1 = Schema$1.encodeEffect(Schema$1.fromJsonString(Schema$1.Unknown));
+const decodePayload$1 = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(Schema$1.Unknown));
+/** The page position of a row, in the exact order the index reads. */
+const cursorOf = (row) => `${row.occurred_at}${CURSOR_SEPARATOR}${row.event_id}`;
+const parseCursor = (cursor) => {
+	const separator = cursor.indexOf(CURSOR_SEPARATOR);
+	if (separator <= 0) return null;
+	const occurredAt = Number.parseInt(cursor.slice(0, separator), 10);
+	const eventId = cursor.slice(separator + 1);
+	return Number.isFinite(occurredAt) && eventId.length > 0 ? {
+		occurredAt,
+		eventId
+	} : null;
+};
+/**
+* Append one fact for the authenticated account.
+*
+* The principal is rechecked inside the transaction, the way every other hub
+* write does it: a credential revoked while the body was being read must not
+* still land a row.
+*/
+const appendHubAnalyticsFact = Effect.fn("HubAnalytics.append")(function* (principal, input) {
+	const config = yield* HubConfig;
+	if (!currentPrincipal(config, principal)) return yield* Effect.fail(new HubUnauthorizedError());
+	const fact = yield* decodeFact(input, { onExcessProperty: "error" });
+	const payload = yield* encodePayload$1(fact.payload);
+	const occurredAt = Date.parse(fact.occurredAt);
+	const sql = yield* SqlClient.SqlClient;
+	const now = yield* Clock.currentTimeMillis;
+	return yield* sql.withTransaction(Effect.gen(function* () {
+		if (!currentPrincipal(config, principal)) return yield* Effect.fail(new HubUnauthorizedError());
+		if ((yield* sql`SELECT event_id FROM hub_analytics_facts
+        WHERE account_id = ${principal.accountId} AND event_id = ${fact.eventId}`).length > 0) return { accepted: false };
+		yield* sql`INSERT INTO hub_analytics_facts
+        (account_id, environment_id, event_id, kind, version, occurred_at, payload, created_at)
+        VALUES (${principal.accountId}, ${principal.environmentId}, ${fact.eventId}, ${fact.kind},
+          ${fact.version}, ${occurredAt}, ${payload}, ${now})
+        ON CONFLICT(account_id, event_id) DO NOTHING`;
+		return { accepted: true };
+	}));
+});
+/**
+* Read this account's facts, newest first.
+*
+* Paged by keyset rather than offset, so a fact appended between two pages
+* cannot shift a row into being read twice or skipped. The limit is bounded by
+* the contract, and one extra row is read to decide whether a next page
+* exists without a second count query.
+*/
+const queryHubAnalyticsFacts = Effect.fn("HubAnalytics.query")(function* (principal, input) {
+	if (!currentPrincipal(yield* HubConfig, principal)) return yield* Effect.fail(new HubUnauthorizedError());
+	const query = yield* decodeQuery(input, { onExcessProperty: "error" });
+	const limit = query.limit ?? HUB_ANALYTICS_QUERY_LIMITS.defaultLimit;
+	const kinds = query.kinds === void 0 ? null : `,${query.kinds.join(",")},`;
+	const since = query.since === void 0 ? null : Date.parse(query.since);
+	const until = query.until === void 0 ? null : Date.parse(query.until);
+	const cursor = query.cursor === void 0 ? null : parseCursor(query.cursor);
+	const cursorOccurredAt = cursor === null ? null : cursor.occurredAt;
+	const cursorEventId = cursor === null ? null : cursor.eventId;
+	const rows = yield* (yield* SqlClient.SqlClient)`
+    SELECT environment_id, event_id, kind, version, occurred_at, payload
+    FROM hub_analytics_facts
+    WHERE account_id = ${principal.accountId}
+      AND (${kinds} IS NULL OR instr(${kinds}, ',' || kind || ',') > 0)
+      AND (${since} IS NULL OR occurred_at >= ${since})
+      AND (${until} IS NULL OR occurred_at <= ${until})
+      AND (
+        ${cursorOccurredAt} IS NULL
+        OR occurred_at < ${cursorOccurredAt}
+        OR (occurred_at = ${cursorOccurredAt} AND event_id < ${cursorEventId})
+      )
+    ORDER BY occurred_at DESC, event_id DESC
+    LIMIT ${limit + 1}`;
+	const page = rows.slice(0, limit);
+	const facts = [];
+	for (const row of page) facts.push({
+		eventId: row.event_id,
+		environmentId: row.environment_id,
+		kind: row.kind,
+		version: row.version,
+		occurredAt: new Date(row.occurred_at).toISOString(),
+		payload: yield* decodePayload$1(row.payload)
+	});
+	const last = page[page.length - 1];
+	return {
+		facts,
+		nextCursor: rows.length > limit && last !== void 0 ? cursorOf(last) : null
+	};
+});
+//#endregion
+//#region src/hub/HubAnalyticsRoutes.ts
+/**
+* The account's own analytics endpoints.
+*
+* Both routes require the same server membership every other environment-owned
+* hub write uses, and neither forwards anything anywhere: the hub is the only
+* sink for these facts.
+*
+* @module HubAnalyticsRoutes
+*/
+const MAX_ANALYTICS_BODY_BYTES = 16 * 1024;
+const json$1 = (value) => HttpServerResponse.jsonUnsafe(value, { headers: { "cache-control": "no-store" } });
+/** Only the filters the query contract knows; anything else is a decode failure. */
+const queryFromUrl = (url) => Object.fromEntries([
+	["kinds", url.searchParams.getAll("kind")],
+	["since", url.searchParams.get("since")],
+	["until", url.searchParams.get("until")],
+	["limit", url.searchParams.get("limit")],
+	["cursor", url.searchParams.get("cursor")]
+].filter(([, value]) => Array.isArray(value) ? value.length > 0 : value !== null).map(([key, value]) => key === "limit" && typeof value === "string" ? [key, Number.parseInt(value, 10)] : [key, value]));
+const layer$108 = Layer.mergeAll(HttpRouter.add("POST", "/v1/analytics/facts", handle$1(Effect.gen(function* () {
+	const principal = yield* authenticateHubServerMembership();
+	const input = yield* readBody$1(HubAnalyticsFactInput, MAX_ANALYTICS_BODY_BYTES);
+	return json$1(yield* appendHubAnalyticsFact(principal, input));
+}), "server-auth")), HttpRouter.add("GET", "/v1/analytics/facts", handle$1(Effect.gen(function* () {
+	const principal = yield* authenticateHubServerMembership();
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const url = new URL(request.url, "http://hub.invalid");
+	return json$1(yield* queryHubAnalyticsFacts(principal, queryFromUrl(url)));
+}), "server-auth")));
 //#endregion
 //#region src/hub/HubPushTokenProtection.ts
 const KEY_NAME = "hub-push-token-encryption-v1";
@@ -26812,7 +27222,7 @@ const layer$100 = Layer.effect(HubTunnelPublished, Effect.gen(function* () {
 }));
 //#endregion
 //#region src/hub/HubTunnelCors.ts
-const MAX_HEADER_CHARS = 256;
+const MAX_HEADER_CHARS$1 = 256;
 const METHODS = [
 	"GET",
 	"HEAD",
@@ -26842,7 +27252,7 @@ function hubTunnelCors(method, headers) {
 	};
 	if (method === "OPTIONS" && headers["access-control-request-method"] !== void 0) {
 		const raw = headers["access-control-request-headers"] ?? "";
-		if (raw.length > MAX_HEADER_CHARS) return null;
+		if (raw.length > MAX_HEADER_CHARS$1) return null;
 		const requested = raw ? raw.split(",").map((name) => name.trim().toLowerCase()) : [];
 		if (!METHODS.includes(headers["access-control-request-method"]) || requested.length > HEADERS.length || new Set(requested).size !== requested.length || requested.some((name) => !HEADERS.includes(name))) return null;
 		result["access-control-allow-methods"] = METHODS.join(", ");
@@ -28597,8 +29007,8 @@ const releaseFeedLeaseRoute = HttpRouter.add("DELETE", "/feed/lease", respondToH
 	return HttpServerResponse.empty({ status: 204 });
 })));
 /** Provide around HttpRouter.serve so request fibers share these process-owned services. */
-const routingServices = Layer.mergeAll(layer$112, layer$109, layer$101, layer$100).pipe(Layer.provideMerge(layer$110));
-const layer$94 = Layer.mergeAll(layer$99, layer$98, layer$102, layer$96, layer$95, layer$108, layer$97, healthRoute, identityRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$112), Layer.provideMerge(layer$109), Layer.provideMerge(layer$101));
+const routingServices = Layer.mergeAll(layer$112, layer$110, layer$101, layer$100).pipe(Layer.provideMerge(layer$111));
+const layer$94 = Layer.mergeAll(layer$99, layer$98, layer$102, layer$96, layer$95, layer$109, layer$97, healthRoute, identityRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$112), Layer.provideMerge(layer$110), Layer.provideMerge(layer$101));
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -29080,6 +29490,21 @@ var _021_NotificationDeliveryProgress_default = Effect.gen(function* () {
 	yield* (yield* SqlClient.SqlClient)`ALTER TABLE hub_notification_deliveries ADD COLUMN app_delivered INTEGER NOT NULL DEFAULT 0`;
 });
 //#endregion
+//#region src/hub/Migrations/022_AnalyticsFacts.ts
+var _022_AnalyticsFacts_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`CREATE TABLE hub_analytics_facts (
+    account_id TEXT NOT NULL, environment_id TEXT NOT NULL, event_id TEXT NOT NULL,
+    kind TEXT NOT NULL, version INTEGER NOT NULL, occurred_at INTEGER NOT NULL,
+    payload TEXT NOT NULL, created_at INTEGER NOT NULL,
+    PRIMARY KEY(account_id, event_id)
+  )`;
+	yield* sql`CREATE INDEX hub_analytics_facts_recent
+    ON hub_analytics_facts(account_id, occurred_at DESC, event_id DESC)`;
+	yield* sql`CREATE INDEX hub_analytics_facts_kind
+    ON hub_analytics_facts(account_id, kind, occurred_at DESC, event_id DESC)`;
+});
+//#endregion
 //#region src/hub/Migrations.ts
 /**
 * Hub migrations.
@@ -29195,6 +29620,11 @@ const hubMigrationEntries = [
 		21,
 		"NotificationDeliveryProgress",
 		_021_NotificationDeliveryProgress_default
+	],
+	[
+		22,
+		"AnalyticsFacts",
+		_022_AnalyticsFacts_default
 	]
 ];
 const hubMigrationLoader = Migrator.fromRecord(Object.fromEntries(hubMigrationEntries.map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -29286,7 +29716,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$94, layer$106)).pipe(Layer.provideMerge(routingServices), Layer.provideMerge(layer$104), Layer.provideMerge(layer$105), Layer.provideMerge(layer$103), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$113), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$94, layer$106, layer$108)).pipe(Layer.provideMerge(routingServices), Layer.provideMerge(layer$104), Layer.provideMerge(layer$105), Layer.provideMerge(layer$103), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$114), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -30502,6 +30932,34 @@ Layer.succeed(ClaudeMcpFiles, {
 const PROBE_CACHE_TTL_MS = 300 * 1e3;
 /** An authorize URL nobody returned from within this window is abandoned. */
 const PENDING_FLOW_TTL_MS = 600 * 1e3;
+/**
+* The two answers that mean the credential, not the request, was refused.
+*
+* The same pair `McpToolClient` reports as "the server rejected p4code's
+* credentials": 401 for a token the server will not accept, 403 for one it
+* accepts and will not act on. Both leave the session with a server it cannot
+* use, so both take the one refresh and, failing that, the sign-in.
+*/
+const credentialsRefused = (status) => status === 401 || status === 403;
+/**
+* Whether a token endpoint's answer means the grant itself is gone.
+*
+* RFC 6749 gives a retired or rejected refresh token one spelling: 400 with
+* `error: "invalid_grant"`. The other 400s - `invalid_request`,
+* `unsupported_grant_type`, `invalid_scope` - are complaints about the request
+* this code sent, and erasing the user's credential over a malformed request
+* of ours would charge them a sign-in for a bug. 401 and 403 stay terminal:
+* the client credential itself was refused, and no retry of this shape fixes
+* that. Everything else - 429, a 5xx, whatever a proxy invents - is the server
+* having a bad minute.
+*/
+const terminalRefreshAnswer = (status, json) => {
+	if (status === 401 || status === 403) return true;
+	if (status !== 400) return false;
+	return (typeof json === "object" && json !== null ? json["error"] : void 0) === "invalid_grant";
+};
+/** Why one refresh attempt failed, and whether the stored grant survives it. */
+var RefreshFailure = class extends Data.TaggedError("RefreshFailure") {};
 /** A token this close to expiry is refreshed rather than handed to a session. */
 const TOKEN_EXPIRY_MARGIN_MS = 60 * 1e3;
 /** Outbound discovery, registration and token requests all use this cap. */
@@ -30613,6 +31071,7 @@ const make$109 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const pendingFlows = yield* Ref.make(/* @__PURE__ */ new Map());
 	const probeCache = yield* Ref.make(/* @__PURE__ */ new Map());
+	const tokenVerdicts = yield* Ref.make(/* @__PURE__ */ new Map());
 	const redirectUri = `http://127.0.0.1:${config.port}${OAUTH_CALLBACK_PATH}`;
 	const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
 	const readRecord = Effect.fn("McpOAuth.readRecord")(function* (server) {
@@ -30644,26 +31103,28 @@ const make$109 = Effect.gen(function* () {
 	* does — while answering the initialize POST with the 401 challenge this
 	* probe exists to see.
 	*/
+	const initializeRequest = (registration, accessToken) => HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.setHeaders(HttpClientRequest.post(registration.url), {
+		...registration.headers,
+		...accessToken === void 0 ? {} : { authorization: `Bearer ${accessToken}` },
+		accept: "application/json, text/event-stream"
+	}), {
+		jsonrpc: "2.0",
+		id: 0,
+		method: "initialize",
+		params: {
+			protocolVersion: MCP_PROBE_PROTOCOL_VERSION,
+			capabilities: {},
+			clientInfo: {
+				name: "p4code",
+				version: "0.0.0"
+			}
+		}
+	});
 	const probe = Effect.fn("McpOAuth.probe")(function* (registration) {
 		const now = yield* nowMillis;
 		const cached = (yield* Ref.get(probeCache)).get(registration.url);
 		if (cached !== void 0 && now - cached.at < PROBE_CACHE_TTL_MS) return cached;
-		const verdict = yield* http.execute(HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.setHeaders(HttpClientRequest.post(registration.url), {
-			...registration.headers,
-			accept: "application/json, text/event-stream"
-		}), {
-			jsonrpc: "2.0",
-			id: 0,
-			method: "initialize",
-			params: {
-				protocolVersion: MCP_PROBE_PROTOCOL_VERSION,
-				capabilities: {},
-				clientInfo: {
-					name: "p4code",
-					version: "0.0.0"
-				}
-			}
-		})).pipe(Effect.timeout(OAUTH_REQUEST_TIMEOUT_MS), Effect.map((response) => {
+		const verdict = yield* http.execute(initializeRequest(registration)).pipe(Effect.timeout(OAUTH_REQUEST_TIMEOUT_MS), Effect.map((response) => {
 			const challengeHeader = response.headers["www-authenticate"];
 			const challenge = response.status === 401 && challengeHeader !== void 0 ? parseWwwAuthenticate(challengeHeader) : void 0;
 			return {
@@ -30690,12 +31151,53 @@ const make$109 = Effect.gen(function* () {
 		next.delete(url);
 		return next;
 	});
+	/**
+	* Ask the server whether the token this machine holds still works.
+	*
+	* `probe` cannot answer this. It asks without credentials, so its 401 is the
+	* one every protected server sends and says nothing about the token sitting
+	* in the record. A token revoked at the other end, or issued for a workspace
+	* the user has since left, stays well inside its stored expiry and is
+	* refused on every call - the state this catches.
+	*
+	* Unreachable counts as usable, exactly as `probe` treats it: a network
+	* fault is not a revocation, and signing someone out of a server that is
+	* merely down helps nobody. Only a real answer is remembered.
+	*/
+	const validateToken = Effect.fn("McpOAuth.validateToken")(function* (registration, accessToken) {
+		const now = yield* nowMillis;
+		const cached = (yield* Ref.get(tokenVerdicts)).get(registration.name);
+		if (cached !== void 0 && cached.accessToken === accessToken) {
+			if (!cached.accepted) return false;
+			if (now - cached.at < PROBE_CACHE_TTL_MS) return true;
+		}
+		const answered = yield* http.execute(initializeRequest(registration, accessToken)).pipe(Effect.timeout(OAUTH_REQUEST_TIMEOUT_MS), Effect.map((response) => Option.some(!credentialsRefused(response.status))), Effect.orElseSucceed(() => Option.none()));
+		if (Option.isNone(answered)) return true;
+		yield* Ref.update(tokenVerdicts, (cache) => {
+			const next = new Map(cache);
+			next.set(registration.name, {
+				accessToken,
+				at: now,
+				accepted: answered.value
+			});
+			return next;
+		});
+		return answered.value;
+	});
+	/** Whether the server has refused the exact token the record still holds. */
+	const rejectedAlready = (server, accessToken) => Effect.map(Ref.get(tokenVerdicts), (cache) => {
+		const verdict = cache.get(server);
+		return verdict !== void 0 && verdict.accessToken === accessToken && !verdict.accepted;
+	});
 	const statusFor = (registration) => Effect.gen(function* () {
 		const record = yield* readRecord(registration.name);
-		if (Option.isSome(record) && record.value.tokens !== void 0) return Option.some({
-			required: true,
-			connected: true
-		});
+		if (Option.isSome(record) && record.value.tokens !== void 0) {
+			const rejected = yield* rejectedAlready(registration.name, record.value.tokens.accessToken);
+			return Option.some({
+				required: true,
+				connected: !rejected
+			});
+		}
 		if ((yield* probe(registration)).requiresAuth || Option.isSome(record)) return Option.some({
 			required: true,
 			connected: false
@@ -30870,6 +31372,24 @@ const make$109 = Effect.gen(function* () {
 		ok: false,
 		detail: "The sign-in failed. See the server log."
 	}))));
+	/**
+	* Drop the tokens the server will not accept, keeping the client
+	* registration so the sign-in that follows skips re-registration.
+	*
+	* Compare-and-delete rather than a blind write, because two sessions can
+	* resolve the same server at once. The loser of that race spends a refresh
+	* token the winner has already rotated, is told `invalid_grant`, and would
+	* otherwise erase the credential the winner just stored - turning a refresh
+	* that worked into a sign-in prompt. A record whose access token has moved on
+	* belongs to somebody else's successful refresh and is left alone.
+	*/
+	const forgetTokens = Effect.fn("McpOAuth.forgetTokens")(function* (server, refusedAccessToken) {
+		const current = yield* readRecord(server);
+		if (Option.isNone(current)) return;
+		if (current.value.tokens?.accessToken !== refusedAccessToken) return;
+		const { tokens: _refused, ...rest } = current.value;
+		yield* writeRecord(server, rest);
+	});
 	const disconnect = (name) => Effect.gen(function* () {
 		const record = yield* readRecord(name);
 		if (Option.isNone(record)) return;
@@ -30887,9 +31407,15 @@ const make$109 = Effect.gen(function* () {
 			...record.clientSecret === void 0 ? {} : { client_secret: record.clientSecret },
 			...record.resource === void 0 ? {} : { resource: record.resource }
 		}));
-		if (status !== 200) return yield* Effect.fail(`status ${status}`);
+		if (status !== 200) return yield* Effect.fail(new RefreshFailure({
+			terminal: terminalRefreshAnswer(status, json),
+			detail: `status ${status}`
+		}));
 		const decoded = decodeTokenResponse(json);
-		if (decoded._tag !== "Success") return yield* Effect.fail("unexpected shape");
+		if (decoded._tag !== "Success") return yield* Effect.fail(new RefreshFailure({
+			terminal: false,
+			detail: "unexpected shape"
+		}));
 		const response = decoded.value;
 		const now = yield* nowMillis;
 		const tokens = {
@@ -30908,9 +31434,16 @@ const make$109 = Effect.gen(function* () {
 		if (Option.isNone(record) || record.value.tokens === void 0) return Option.none();
 		const tokens = record.value.tokens;
 		const now = yield* nowMillis;
-		if (!(tokens.expiresAt !== void 0 && now >= tokens.expiresAt - TOKEN_EXPIRY_MARGIN_MS)) return Option.some(tokens.accessToken);
-		if (tokens.refreshToken === void 0) return Option.none();
-		return yield* refreshTokens(registration.name, record.value, tokens.refreshToken).pipe(Effect.map(Option.some), Effect.catchCause((cause) => Effect.logWarning("mcp oauth refresh failed", {
+		if (!(tokens.expiresAt !== void 0 && now >= tokens.expiresAt - TOKEN_EXPIRY_MARGIN_MS) && (yield* validateToken(registration, tokens.accessToken))) return Option.some(tokens.accessToken);
+		if (tokens.refreshToken === void 0) {
+			yield* forgetTokens(registration.name, tokens.accessToken);
+			return Option.none();
+		}
+		return yield* refreshTokens(registration.name, record.value, tokens.refreshToken).pipe(Effect.map(Option.some), Effect.catchTag("RefreshFailure", (failure) => Effect.logWarning("mcp oauth refresh failed", {
+			server: registration.name,
+			detail: failure.detail,
+			terminal: failure.terminal
+		}).pipe(Effect.andThen(failure.terminal ? forgetTokens(registration.name, tokens.accessToken) : Effect.void), Effect.as(Option.none()))), Effect.catchCause((cause) => Effect.logWarning("mcp oauth refresh could not be attempted", {
 			cause,
 			server: registration.name
 		}).pipe(Effect.as(Option.none()))));
@@ -30944,6 +31477,16 @@ const decodeRegistration$1 = Schema$1.decodeUnknownExit(RegistrationFromJson$1);
 const encodeRegistration = Schema$1.encodeSync(RegistrationFromJson$1);
 var McpRegistry = class extends Context.Service()("@p4code/cli/mcp/McpRegistry") {};
 const slotsOf = (registration) => registration.secrets ?? [];
+/**
+* What a session is told when a server is left out for want of a credential.
+*
+* The name and where the row came from, and nothing else: a token, a url query
+* or a header would end up in a log file that outlives the session. The action
+* names the one place a person can fix it, because "absent" on its own reads as
+* a bug rather than as a sign-in that has not happened.
+*/
+const OMITTED_FOR_SIGN_IN = "mcp server omitted: sign-in required";
+const SIGN_IN_ACTION = "Connect it in Settings > MCP servers.";
 const make$108 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
@@ -31060,6 +31603,14 @@ const make$108 = Effect.gen(function* () {
 			if (registration.transport !== "stdio" && !hasExplicitAuthorization) {
 				const token = yield* oauth.accessTokenFor(registration);
 				if (Option.isSome(token)) headers["Authorization"] = `Bearer ${token.value}`;
+				else if (Option.isSome(yield* oauth.statusFor(registration))) {
+					yield* Effect.logWarning(OMITTED_FOR_SIGN_IN, {
+						server: registration.name,
+						source: "registration",
+						action: SIGN_IN_ACTION
+					});
+					continue;
+				}
 			}
 			resolved[registration.name] = registration.transport === "stdio" ? {
 				type: "stdio",
@@ -31095,7 +31646,15 @@ const make$108 = Effect.gen(function* () {
 			if (!Object.keys(headers).some((key) => key.toLowerCase() === "authorization")) {
 				const token = yield* oauth.accessTokenFor(userScope);
 				if (Option.isSome(token)) headers["Authorization"] = `Bearer ${token.value}`;
-				else if (Option.isSome(yield* oauth.statusFor(userScope))) continue;
+				else if (Option.isSome(yield* oauth.statusFor(userScope))) {
+					yield* Effect.logWarning(OMITTED_FOR_SIGN_IN, {
+						server: userScope.name,
+						source: "user-scope",
+						sessionName,
+						action: SIGN_IN_ACTION
+					});
+					continue;
+				}
 			}
 			resolved[sessionName] = {
 				type: userScope.transport,
@@ -33858,7 +34417,7 @@ const findAgentPreset = (requested) => {
 };
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$87.pipe(Layer.provideMerge(layer$88), Layer.provideMerge(layer$89), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$118))), Layer.provideMerge(layer$118), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$87.pipe(Layer.provideMerge(layer$88), Layer.provideMerge(layer$89), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$119))), Layer.provideMerge(layer$119), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -33866,7 +34425,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$121(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$122(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -36240,7 +36799,11 @@ function projectEvent(model, event) {
 		case "thread.activity-appended": return decodeForEvent(ThreadActivityAppendedPayload, event.payload, event.type, "payload").pipe(Effect.map((payload) => {
 			const thread = nextBase.threads.find((entry) => entry.id === payload.threadId);
 			if (!thread) return nextBase;
-			const activities = [...thread.activities.filter((entry) => entry.id !== payload.activity.id), payload.activity].toSorted(compareThreadActivities).slice(-500);
+			const appended = payload.activity.sequence === void 0 ? {
+				...payload.activity,
+				sequence: event.sequence
+			} : payload.activity;
+			const activities = [...thread.activities.filter((entry) => entry.id !== appended.id), appended].toSorted(compareThreadActivities).slice(-500);
 			return {
 				...nextBase,
 				threads: updateThread(nextBase.threads, payload.threadId, {
@@ -40666,7 +41229,7 @@ const makeOrchestrationProjectionPipeline = Effect.fn("makeOrchestrationProjecti
 					kind: activity.kind,
 					summary: activity.summary,
 					payload: activity.payload,
-					...activity.sequence !== void 0 ? { sequence: activity.sequence } : {},
+					sequence: activity.sequence ?? event.sequence,
 					createdAt: activity.createdAt
 				});
 				return;
@@ -47399,7 +47962,7 @@ const startDeviceHub = Effect.fn("DeviceHubProcess.start")(function* (input) {
 });
 //#endregion
 //#region src/device/AgentDeviceProcessLive.ts
-const decodeJson$2 = Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString);
+const decodeJson$3 = Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString);
 var AgentDeviceProcessLiveFailure = class extends Data.TaggedError("AgentDeviceProcessLiveFailure") {};
 const READY_TIMEOUT_MS = 3e4;
 const MAX_READY_LINE = 256;
@@ -47511,7 +48074,7 @@ const make$93 = Effect.fn("AgentDeviceProcess.make")(function* () {
 					maxBytes: MAX_RESPONSE_BYTES$7
 				});
 				if (response.status !== 200 || body.truncated || body.invalidUtf8) return yield* new AgentDeviceProcessLiveFailure({ message: "Agent authorization failed" });
-				const result = yield* Effect.try(() => decodeJson$2(body.text));
+				const result = yield* Effect.try(() => decodeJson$3(body.text));
 				if (!result || typeof result !== "object" || !("id" in result) || result.id !== "p4-readiness" || !("result" in result) || !result.result || typeof result.result !== "object" || !("ok" in result.result) || result.result.ok !== true) return yield* new AgentDeviceProcessLiveFailure({ message: "Agent readiness rejected" });
 				endpoint = {
 					baseUrl,
@@ -49511,7 +50074,7 @@ main().catch(() => { if (!stopping) emit({ phase: 'failed', message: 'Remote dev
 }
 //#endregion
 //#region src/device/SshDeviceConnection.ts
-const decodeJson$1 = Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString);
+const decodeJson$2 = Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString);
 const START_TIMEOUT_MS = 66e4;
 const FORWARD_TIMEOUT_MS = 15e3;
 const VERIFY_TIMEOUT_MS = 3e4;
@@ -49666,7 +50229,7 @@ const connectSshDevice = Effect.fn("SshDeviceConnection.connect")(function* (inp
 					maxBytes: MAX_RESPONSE_BYTES$4
 				});
 				if (response.status !== 200 || body.truncated || body.invalidUtf8) return yield* fail("verifying forwarded agent")(void 0);
-				const result = yield* Effect.try(() => decodeJson$1(body.text));
+				const result = yield* Effect.try(() => decodeJson$2(body.text));
 				if (!result || typeof result !== "object" || !("id" in result) || result.id !== identity.nonce || !("result" in result) || !result.result || typeof result.result !== "object" || !("ok" in result.result) || result.result.ok !== true) return yield* fail("authenticating forwarded agent")(void 0);
 			}).pipe(Effect.scoped, Effect.timeout(Duration.millis(VERIFY_TIMEOUT_MS)), Effect.mapError(fail("verifying forwarded agent")));
 			return {
@@ -51095,7 +51658,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$121(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$122(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -51106,7 +51669,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$70).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$121(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$70).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$122(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -59682,7 +60245,7 @@ const TYPESAFE_REQUEST_BUDGET_TOKENS = 32e3;
 const TYPESAFE_BUDGET_RESERVE_TOKENS = 2e3;
 var TypeSafeRequestError = class extends Data.TaggedError("TypeSafeRequestError") {};
 var TypeSafeClient = class extends Context.Service()("@p4code/cli/orchestration/triage/TypeSafeClient") {};
-const asRecord$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const asRecord$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 /**
 * The finite numbers out of a probability map, or nothing.
 *
@@ -59691,7 +60254,7 @@ const asRecord$8 = (value) => typeof value === "object" && value !== null && !Ar
 * invented number is worse than one built on fewer.
 */
 function readProbabilities(value) {
-	const record = asRecord$8(value);
+	const record = asRecord$10(value);
 	if (record === void 0) return void 0;
 	const probabilities = {};
 	for (const [key, entry] of Object.entries(record)) if (typeof entry === "number" && Number.isFinite(entry)) probabilities[key] = entry;
@@ -59705,7 +60268,7 @@ function readProbabilities(value) {
 * can never reach the caller wearing a confidence it did not have.
 */
 function parseTypeSafeAnswer(value) {
-	const record = asRecord$8(value);
+	const record = asRecord$10(value);
 	if (record === void 0) return void 0;
 	const confidence = record["confidence"];
 	switch (record["type"]) {
@@ -59746,7 +60309,7 @@ function parseTypeSafeAnswer(value) {
 }
 /** The one answer for the question that was asked, out of the answers map. */
 function readAnswerFor(body, questionId) {
-	const answers = asRecord$8(asRecord$8(body)?.["answers"]);
+	const answers = asRecord$10(asRecord$10(body)?.["answers"]);
 	return answers === void 0 ? void 0 : parseTypeSafeAnswer(answers[questionId]);
 }
 const makeTypeSafeClient = Effect.gen(function* () {
@@ -59850,19 +60413,19 @@ const estimateTokens$1 = (text) => Math.ceil(text.length / 4);
 /** One line per event is plenty to answer "did anything reviewable happen". */
 const MAX_LINE_CHARS = 400;
 const oneLine = (text) => text.replace(/\s+/gu, " ").trim();
-const clip$1 = (text) => text.length <= MAX_LINE_CHARS ? text : `${text.slice(0, MAX_LINE_CHARS)}…`;
+const clip$2 = (text) => text.length <= MAX_LINE_CHARS ? text : `${text.slice(0, MAX_LINE_CHARS)}…`;
 /** The line an event contributes, or null when it says nothing about the work. */
 function describeEvent(event, implementerThreadId) {
 	switch (event.type) {
 		case "thread.message-sent": {
 			if (event.payload.threadId !== implementerThreadId) return null;
 			const text = oneLine(event.payload.text);
-			return text.length === 0 ? null : clip$1(`${event.payload.role}: ${text}`);
+			return text.length === 0 ? null : clip$2(`${event.payload.role}: ${text}`);
 		}
 		case "thread.activity-appended": {
 			if (event.payload.threadId !== implementerThreadId) return null;
 			const activity = event.payload.activity;
-			return clip$1(oneLine(`${activity.kind}: ${activity.summary}`));
+			return clip$2(oneLine(`${activity.kind}: ${activity.summary}`));
 		}
 		case "thread.turn-completed":
 			if (event.payload.threadId !== implementerThreadId) return null;
@@ -60085,7 +60648,7 @@ function renderPrefetchHint(selected) {
 //#endregion
 //#region src/orchestration/userInputRanking.ts
 const MAX_OPTIONS = 255;
-const MAX_QUESTION_CHARS = 16e3;
+const MAX_QUESTION_CHARS$1 = 16e3;
 const RANKING_TIMEOUT_MS = 1e4;
 const PROBABILITY_SUM_TOLERANCE = .01;
 /** Require a complete distribution; never invent missing option ranks. Equal scores share rank. */
@@ -60103,13 +60666,17 @@ function ranksFromAnswer(answer, count) {
 	})).sort((a, b) => b.probability - a.probability || a.optionIndex - b.optionIndex);
 	if (Math.abs(ranked.reduce((sum, item) => sum + item.probability, 0) - 1) > PROBABILITY_SUM_TOLERANCE) return null;
 	let rank = 1;
-	return { ranks: ranked.map((item, index) => {
-		if (index > 0 && item.probability !== ranked[index - 1]?.probability) rank = index + 1;
-		return {
-			optionIndex: item.optionIndex,
-			rank
-		};
-	}) };
+	return {
+		confidence: answer.confidence,
+		ranks: ranked.map((item, index) => {
+			if (index > 0 && item.probability !== ranked[index - 1]?.probability) rank = index + 1;
+			return {
+				optionIndex: item.optionIndex,
+				rank,
+				probability: item.probability
+			};
+		})
+	};
 }
 const makeUserInputRanker = Effect.gen(function* () {
 	const query = yield* ProjectionSnapshotQuery;
@@ -60128,7 +60695,7 @@ const makeUserInputRanker = Effect.gen(function* () {
 		const decoded = Schema$1.decodeUnknownOption(Schema$1.Struct({ questions: Schema$1.Array(UserInputQuestion) }))(payload);
 		const question = Option.isSome(decoded) ? decoded.value.questions.find((question) => question.id === input.questionId) : void 0;
 		if (!question) return yield* fail("This question is no longer pending.");
-		if (question.options.length < 2 || question.options.length > MAX_OPTIONS || question.question.length + question.options.reduce((sum, option) => sum + option.label.length + option.description.length, 0) > MAX_QUESTION_CHARS) return yield* fail("This question cannot be ranked.");
+		if (question.options.length < 2 || question.options.length > MAX_OPTIONS || question.question.length + question.options.reduce((sum, option) => sum + option.label.length + option.description.length, 0) > MAX_QUESTION_CHARS$1) return yield* fail("This question cannot be ranked.");
 		const context = query.getHandoffContext ? yield* query.getHandoffContext(input.threadId).pipe(Effect.mapError(() => fail("Could not read question context."))) : Option.none();
 		if (Option.isNone(context)) return yield* fail("Question context is unavailable.");
 		const state = context.value.transcript;
@@ -60568,8 +61135,15 @@ const FUSION_SAFETY_KERNEL = [
 * `task_propose` is deliberately absent: it tells its caller to stop and wait
 * for the user, and a supervisor that waits is one the builder sits idle
 * behind. Asking the user is what `ask_user_question` is for.
+*
+* `thread_spawn` is here because starting a thread is a coordination act: when
+* the authorized work needs a separate checkout, a different provider or its
+* own pair, the half that owns the plan is the half that decides. It stays in
+* the builder's denial list, so the pair still has exactly one thread that can
+* open new work.
 */
 const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
+	"thread_spawn",
 	"thread_watch_review",
 	"thread_watch_events",
 	"thread_evidence_report",
@@ -60587,7 +61161,8 @@ const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
 	"task_list",
 	"task_create",
 	"task_update",
-	"ticket_resolve"
+	"ticket_resolve",
+	"ticket_comment"
 ]);
 /**
 * What the builder half must not reach.
@@ -60597,8 +61172,9 @@ const FUSION_SUPERVISOR_P4_TOOLS = /* @__PURE__ */ new Set([
 * those should reach it without an edit here. What it must never have is the
 * pair's own machinery - spawning threads, creating pairs, advising, answering
 * its own gate - the phase plan, which the supervisor owns outright, plus
-* task-board mutation. Both roles may read paired history and task-relevant
-* external evidence; only Supervisor writes review reports and the phase plan.
+* task-board mutation and the tracker comment that closes a task. Both roles
+* may read paired history and task-relevant external evidence; only Supervisor
+* writes review reports and the phase plan.
 *
 * Both roles retain `thread_pair_detach` as their way out. Its handler limits
 * detaching to a pair containing the caller whose other thread this session
@@ -60620,6 +61196,7 @@ const FUSION_BUILDER_DENIED_P4_TOOLS = /* @__PURE__ */ new Set([
 	"task_create",
 	"task_update",
 	"task_propose",
+	"ticket_comment",
 	"memory_append"
 ]);
 /**
@@ -60818,7 +61395,7 @@ const forceStopOwnedProcess = (threadId, options) => threadLocks.withPermit(thre
 }));
 //#endregion
 //#region ../../packages/shared/src/toolActivity.ts
-function asRecord$7(value) {
+function asRecord$9(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function asTrimmedString$1(value) {
@@ -60848,10 +61425,10 @@ function extractCommandFromTitle$1(title) {
 	return /`([^`]+)`/u.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCommand(data, title) {
-	const item = asRecord$7(data?.item);
-	const itemInput = asRecord$7(item?.input);
-	const itemResult = asRecord$7(item?.result);
-	const rawInput = asRecord$7(data?.rawInput);
+	const item = asRecord$9(data?.item);
+	const itemInput = asRecord$9(item?.input);
+	const itemResult = asRecord$9(item?.result);
+	const rawInput = asRecord$9(data?.rawInput);
 	const direct = [
 		normalizeCommandValue$1(item?.command),
 		normalizeCommandValue$1(itemInput?.command),
@@ -60879,7 +61456,7 @@ function collectPaths(value, paths, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$7(value);
+	const record = asRecord$9(value);
 	if (!record) return;
 	for (const key of [
 		"path",
@@ -60938,7 +61515,7 @@ function deriveToolActivityPresentation(input) {
 	const title = asTrimmedString$1(input.title);
 	const detail = stripTrailingExitCode(asTrimmedString$1(input.detail));
 	const fallbackSummary = asTrimmedString$1(input.fallbackSummary) ?? "Tool";
-	const data = asRecord$7(input.data);
+	const data = asRecord$9(input.data);
 	const command = extractToolCommand(data, title);
 	const primaryPath = extractPrimaryPath(data);
 	const action = classifyToolAction({
@@ -60962,7 +61539,7 @@ function deriveToolActivityPresentation(input) {
 		...primaryPath ? { detail: primaryPath } : {}
 	};
 	if (action === "search") {
-		const query = asTrimmedString$1(asRecord$7(data?.rawInput)?.query) ?? asTrimmedString$1(asRecord$7(data?.rawInput)?.pattern) ?? asTrimmedString$1(asRecord$7(data?.rawInput)?.searchTerm);
+		const query = asTrimmedString$1(asRecord$9(data?.rawInput)?.query) ?? asTrimmedString$1(asRecord$9(data?.rawInput)?.pattern) ?? asTrimmedString$1(asRecord$9(data?.rawInput)?.searchTerm);
 		return {
 			summary: "Searched files",
 			...query ? { detail: query } : {}
@@ -63215,6 +63792,7 @@ const P4CODE_MCP_TOOL_NAMES = [
 	"thread_spawn",
 	"thread_watch_events",
 	"thread_watch_review",
+	"ticket_comment",
 	"ticket_resolve"
 ];
 /** The catalogue as the adapters read it. */
@@ -98870,7 +99448,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$122));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$123));
 //#endregion
 //#region src/textGeneration/OpenCodeTextGeneration.ts
 const OPENCODE_TEXT_GENERATION_IDLE_TTL = "30 seconds";
@@ -103776,6 +104354,136 @@ const openForActiveThread = Effect.fn("DeviceThreadAdmission.open")(function* (i
 function isRegisteredProviderWorkspace(cwd, projects, threads) {
 	return projects.some((project) => project.workspaceRoot === cwd) || threads.some((thread) => thread.worktreePath === cwd);
 }
+//#endregion
+//#region src/hub/HubActivityTransport.ts
+const REQUEST_TIMEOUT_MS$3 = 8e3;
+const CLEANUP_TIMEOUT_MS = 1e3;
+const MAX_RESPONSE_BYTES = 4096;
+const MAX_REQUEST_BYTES = 16 * 1024;
+const MAX_BEARER_CHARS = 8192;
+var HubActivityUnavailable = class extends Data.TaggedError("HubActivityUnavailable") {};
+var HubActivityUnauthorized = class extends Data.TaggedError("HubActivityUnauthorized") {};
+/** All errors are payload-free; late responses still cancel their bodies after owner interruption. */
+const makeHubActivityTransport = Effect.fn("HubActivityTransport.make")(function* (settings, fetcher = fetch) {
+	const origin = yield* Effect.try({
+		try: () => {
+			const url = new URL(settings.baseUrl);
+			if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/" || settings.token.length === 0 || settings.token.length > MAX_BEARER_CHARS || !/^[\x21-\x7e]+$/.test(settings.token)) throw new HubActivityUnavailable();
+			return url.origin;
+		},
+		catch: () => new HubActivityUnavailable()
+	});
+	const request = Effect.fn("HubActivityTransport.request")(function* (path, body, membership) {
+		return yield* Effect.tryPromise({
+			try: async (signal) => {
+				const controller = new AbortController();
+				const abort = () => controller.abort();
+				signal.addEventListener("abort", abort, { once: true });
+				if (signal.aborted) abort();
+				const timer = setTimeout(abort, REQUEST_TIMEOUT_MS$3);
+				let reader;
+				const cancel = async (work) => {
+					let timeout;
+					try {
+						await Promise.race([Promise.resolve().then(work).catch(() => void 0), new Promise((resolve) => {
+							timeout = setTimeout(resolve, CLEANUP_TIMEOUT_MS);
+						})]);
+					} finally {
+						if (timeout) clearTimeout(timeout);
+					}
+				};
+				try {
+					if (controller.signal.aborted) throw new HubActivityUnavailable();
+					const response = await fetcher(`${origin}${path}`, {
+						method: body === void 0 ? "GET" : "POST",
+						headers: {
+							authorization: `Bearer ${settings.token}`,
+							...membership ? {
+								"x-p4-hub-account": membership.accountId,
+								"x-p4-hub-environment": membership.environmentId
+							} : {},
+							...body === void 0 ? {} : { "content-type": "application/json" }
+						},
+						body,
+						signal: controller.signal,
+						redirect: "error",
+						credentials: "omit",
+						cache: "no-store"
+					});
+					if (controller.signal.aborted) {
+						await cancel(() => response.body?.cancel() ?? Promise.resolve());
+						throw new HubActivityUnavailable();
+					}
+					reader = response.body?.getReader();
+					if (response.status === 401 || response.status === 403) throw new HubActivityUnauthorized();
+					if (response.status !== 200 || !/^application\/json(?:\s*;|$)/i.test(response.headers.get("content-type") ?? "") || !reader) throw new HubActivityUnavailable();
+					let length = 0;
+					const chunks = [];
+					while (true) {
+						const item = await reader.read();
+						if (controller.signal.aborted) throw new HubActivityUnavailable();
+						if (item.done) break;
+						length += item.value.byteLength;
+						if (length > MAX_RESPONSE_BYTES) throw new HubActivityUnavailable();
+						if (item.value.byteLength) chunks.push(item.value);
+					}
+					const bytes = new Uint8Array(length);
+					let offset = 0;
+					for (const chunk of chunks) {
+						bytes.set(chunk, offset);
+						offset += chunk.byteLength;
+					}
+					return Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString)(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+				} finally {
+					controller.abort();
+					clearTimeout(timer);
+					signal.removeEventListener("abort", abort);
+					if (reader) await cancel(() => reader.cancel());
+				}
+			},
+			catch: (error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()
+		}).pipe(Effect.timeout(9e3), Effect.mapError((error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()));
+	});
+	return {
+		identity: Effect.fn("HubActivityTransport.identity")(function* () {
+			const membership = yield* request("/v1/identity").pipe(Effect.flatMap(Schema$1.decodeUnknownEffect(HubServerMembership, { onExcessProperty: "error" })), Effect.mapError((error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()));
+			const destination = yield* Schema$1.encodeUnknownEffect(Schema$1.UnknownFromJsonString)([
+				origin,
+				membership.accountId,
+				membership.environmentId
+			]);
+			return {
+				...membership,
+				destination: NodeCrypto.createHash("sha256").update(destination).digest("hex")
+			};
+		}),
+		post: Effect.fn("HubActivityTransport.post")(function* (input, membership) {
+			const activity = yield* Schema$1.decodeUnknownEffect(HubAgentActivityInput)(input, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
+			const body = yield* Schema$1.encodeEffect(Schema$1.fromJsonString(HubAgentActivityInput))(activity);
+			if (Buffer.byteLength(body) > MAX_REQUEST_BYTES) return yield* Effect.fail(new HubActivityUnavailable());
+			const result = yield* request("/v1/agent-activity", body, membership);
+			return yield* Schema$1.decodeUnknownEffect(Schema$1.Struct({ accepted: Schema$1.Boolean }))(result, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
+		}),
+		postFact: Effect.fn("HubActivityTransport.postFact")(function* (input, membership) {
+			const fact = yield* Schema$1.decodeUnknownEffect(HubAnalyticsFactInput)(input, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
+			const body = yield* Schema$1.encodeEffect(Schema$1.fromJsonString(HubAnalyticsFactInput))(fact);
+			if (Buffer.byteLength(body) > MAX_REQUEST_BYTES) return yield* Effect.fail(new HubActivityUnavailable());
+			const result = yield* request("/v1/analytics/facts", body, membership);
+			return yield* Schema$1.decodeUnknownEffect(Schema$1.Struct({ accepted: Schema$1.Boolean }))(result, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
+		}),
+		queryFacts: Effect.fn("HubActivityTransport.queryFacts")(function* (query, membership) {
+			const search = new URLSearchParams();
+			for (const kind of query.kinds ?? []) search.append("kind", kind);
+			if (query.since !== void 0) search.set("since", query.since);
+			if (query.until !== void 0) search.set("until", query.until);
+			if (query.limit !== void 0) search.set("limit", String(query.limit));
+			if (query.cursor !== void 0) search.set("cursor", query.cursor);
+			const suffix = search.size === 0 ? "" : `?${search.toString()}`;
+			const result = yield* request(`/v1/analytics/facts${suffix}`, void 0, membership);
+			return yield* Schema$1.decodeUnknownEffect(HubAnalyticsPage)(result, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
+		})
+	};
+});
 (() => {
 	try {
 		return process.env.NODE_ENV === "development";
@@ -104486,7 +105194,7 @@ const NESTED_PAYLOAD_KEYS = [
 	"operations"
 ];
 const MAX_COLLECT_DEPTH = 4;
-function asRecord$6(value) {
+function asRecord$8(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function pushChangedFilePath(target, value) {
@@ -104501,7 +105209,7 @@ function collectChangedFilePaths(value, target, depth) {
 		for (const entry of value) collectChangedFilePaths(entry, target, depth + 1);
 		return;
 	}
-	const record = asRecord$6(value);
+	const record = asRecord$8(value);
 	if (!record) return;
 	for (const field of CHANGED_FILE_FIELDS) pushChangedFilePath(target, record[field]);
 	for (const nestedKey of NESTED_PAYLOAD_KEYS) if (nestedKey in record) collectChangedFilePaths(record[nestedKey], target, depth + 1);
@@ -104512,7 +105220,7 @@ function collectChangedFilePaths(value, target, depth) {
 */
 function collectActivityChangedFilePaths(payload) {
 	const target = /* @__PURE__ */ new Set();
-	collectChangedFilePaths(asRecord$6(asRecord$6(payload)?.data), target, 0);
+	collectChangedFilePaths(asRecord$8(asRecord$8(payload)?.data), target, 0);
 	return target;
 }
 /**
@@ -122485,7 +123193,7 @@ const makeBtwRequestCoordinator = (dependencies) => Effect.gen(function* () {
 * already negotiated.
 */
 const MCP_PROTOCOL_VERSION = "2025-06-18";
-const REQUEST_TIMEOUT_MS$3 = 15e3;
+const REQUEST_TIMEOUT_MS$2 = 15e3;
 var McpToolCallError = class extends Schema$1.TaggedErrorClass()("McpToolCallError", {
 	detail: Schema$1.String,
 	status: Schema$1.NullOr(Schema$1.Number)
@@ -122549,7 +123257,7 @@ const callMcpTool = Effect.fn("McpToolClient.callMcpTool")(function* (input) {
 		...input.headers,
 		...extraHeaders,
 		accept: "application/json, text/event-stream"
-	}), body)).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$3), Effect.catchCause((cause) => Effect.fail(new McpToolCallError({
+	}), body)).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$2), Effect.catchCause((cause) => Effect.fail(new McpToolCallError({
 		detail: `Could not reach ${input.url}: ${String(cause)}`,
 		status: null
 	}))));
@@ -122630,6 +123338,9 @@ const callMcpTool = Effect.fn("McpToolClient.callMcpTool")(function* (input) {
 * name that drifts between them fails at runtime with a shrug from the server.
 */
 const LINEAR_GET_ISSUE_TOOL = "get_issue";
+/** The write half: one comment, and the links filed beside it. */
+const LINEAR_SAVE_COMMENT_TOOL = "save_comment";
+const LINEAR_CREATE_ATTACHMENT_TOOL = "create_attachment";
 /** Why a Linear call could not be made, in terms a person can act on. */
 var LinearUnavailable = class extends Schema$1.TaggedErrorClass()("LinearUnavailable", {
 	reason: Schema$1.Literals([
@@ -122643,7 +123354,7 @@ var LinearUnavailable = class extends Schema$1.TaggedErrorClass()("LinearUnavail
 		return this.detail;
 	}
 };
-const asRecord$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const asRecord$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 const asArray$1 = (value) => Array.isArray(value) ? value : void 0;
 /**
 * Find the payload inside whatever the tool returned.
@@ -122673,22 +123384,22 @@ const readPayload = (result) => {
 */
 const readRows = (payload) => {
 	const direct = asArray$1(payload);
-	if (direct !== void 0) return direct.map(asRecord$5).filter((row) => row !== void 0);
-	const record = asRecord$5(payload);
+	if (direct !== void 0) return direct.map(asRecord$7).filter((row) => row !== void 0);
+	const record = asRecord$7(payload);
 	if (record === void 0) return [];
 	for (const value of Object.values(record)) {
 		const rows = asArray$1(value);
-		if (rows !== void 0) return rows.map(asRecord$5).filter((row) => row !== void 0);
+		if (rows !== void 0) return rows.map(asRecord$7).filter((row) => row !== void 0);
 	}
 	return [];
 };
 /** The single object out of a result, unwrapping one level of nesting. */
 const readOne = (payload) => {
-	const record = asRecord$5(payload);
+	const record = asRecord$7(payload);
 	if (record === void 0) return;
 	if (record["id"] !== void 0 || record["identifier"] !== void 0) return record;
 	for (const value of Object.values(record)) {
-		const nested = asRecord$5(value);
+		const nested = asRecord$7(value);
 		if (nested?.["id"] !== void 0) return nested;
 	}
 };
@@ -122798,7 +123509,7 @@ const TrackerSecretsLive = Layer.effect(TrackerSecrets, makeTrackerSecrets);
 *
 * @module tracker/graphqlRequest
 */
-const REQUEST_TIMEOUT_MS$2 = 15e3;
+const REQUEST_TIMEOUT_MS$1 = 15e3;
 var GraphqlRequestError = class extends Schema$1.TaggedErrorClass()("GraphqlRequestError", {
 	detail: Schema$1.String,
 	status: Schema$1.NullOr(Schema$1.Number)
@@ -122807,14 +123518,14 @@ var GraphqlRequestError = class extends Schema$1.TaggedErrorClass()("GraphqlRequ
 		return this.detail;
 	}
 };
-const asRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const asRecord$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 const errorMessages = (value) => {
 	if (!Array.isArray(value)) return [];
-	return value.map((entry) => asRecord$4(entry)?.["message"]).filter((message) => typeof message === "string");
+	return value.map((entry) => asRecord$6(entry)?.["message"]).filter((message) => typeof message === "string");
 };
 const parseJsonRecord = (text) => {
 	try {
-		return asRecord$4(JSON.parse(text));
+		return asRecord$6(JSON.parse(text));
 	} catch {
 		return;
 	}
@@ -122823,7 +123534,7 @@ const graphqlRequest = Effect.fn("tracker/graphqlRequest")(function* (input) {
 	const response = yield* (yield* HttpClient$1.HttpClient).execute(HttpClientRequest$1.bodyJsonUnsafe(HttpClientRequest$1.setHeaders(HttpClientRequest$1.post(input.url), input.headers), {
 		query: input.query,
 		variables: input.variables ?? {}
-	})).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$2), Effect.catchCause((cause) => Effect.fail(new GraphqlRequestError({
+	})).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$1), Effect.catchCause((cause) => Effect.fail(new GraphqlRequestError({
 		detail: `Could not reach ${input.url}: ${String(cause)}`,
 		status: null
 	}))));
@@ -122838,7 +123549,7 @@ const graphqlRequest = Effect.fn("tracker/graphqlRequest")(function* (input) {
 		status: response.status
 	});
 	return {
-		data: asRecord$4(record["data"]),
+		data: asRecord$6(record["data"]),
 		errors: errorMessages(record["errors"])
 	};
 });
@@ -122847,10 +123558,11 @@ const graphqlRequest = Effect.fn("tracker/graphqlRequest")(function* (input) {
 /**
 * Linear over its own GraphQL API, wearing the MCP tool vocabulary.
 *
-* This speaks the same three "tools" the Linear MCP server offers -
-* `list_issues`, `get_issue`, `save_issue` - and answers in the same row
-* shapes, so `LinearTasks` and the resolver cannot tell which transport
-* served them. That is the point: the MCP server remains the fallback, and a
+* This speaks the same "tools" the Linear MCP server offers - `list_issues`,
+* `get_issue`, `save_issue`, `list_comments`, `save_comment` and
+* `create_attachment` - and answers in the same row shapes, so `LinearTasks`,
+* the resolver and the closeout path cannot tell which transport served
+* them. That is the point: the MCP server remains the fallback, and a
 * consumer that could tell the two apart would need two code paths.
 *
 * The one real difference is hidden here: the MCP tools accept names where
@@ -122891,7 +123603,7 @@ const STATE_TYPES = /* @__PURE__ */ new Set([
 	"completed",
 	"canceled"
 ]);
-const asRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const asRecord$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 const asArray = (value) => Array.isArray(value) ? value : [];
 const asString = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 /**
@@ -122901,9 +123613,9 @@ const asString = (value) => typeof value === "string" && value.trim().length > 0
 * `labels` stay structured - the mapping already accepts both forms.
 */
 const toIssueRow = (node) => {
-	const state = asRecord$3(node["state"]);
-	const parent = asRecord$3(node["parent"]);
-	const labels = asRecord$3(node["labels"]);
+	const state = asRecord$5(node["state"]);
+	const parent = asRecord$5(node["parent"]);
+	const labels = asRecord$5(node["labels"]);
 	return {
 		id: node["id"],
 		identifier: node["identifier"],
@@ -122920,6 +123632,29 @@ const toIssueRow = (node) => {
 		parentId: parent?.["id"]
 	};
 };
+/** Everything a closeout comment's caller renders back: who, when, and where. */
+const COMMENT_SELECTION = `
+  id
+  body
+  url
+  createdAt
+  user { id name displayName }
+`;
+/** An attachment as Linear files it: a link with a label, against one issue. */
+const ATTACHMENT_SELECTION = `
+  id
+  url
+  title
+  subtitle
+`;
+/** One comment node, flattened the way `toIssueRow` flattens an issue. */
+const toCommentRow = (node) => ({
+	id: node["id"],
+	body: node["body"],
+	url: node["url"],
+	createdAt: node["createdAt"],
+	user: node["user"]
+});
 /** A case-insensitive equality filter over the ways a person is named. */
 const personFilter = (person) => ({ or: [
 	{ displayName: { eqIgnoreCase: person } },
@@ -122943,7 +123678,7 @@ const makeLinearApiTransport = Effect.gen(function* () {
 	})));
 	/** The one entity out of `data`, or a failure carrying Linear's own words. */
 	const readEntity = (response, key) => {
-		const entity = asRecord$3(response.data?.[key]);
+		const entity = asRecord$5(response.data?.[key]);
 		if (entity !== void 0) return Effect.succeed(entity);
 		if (response.errors.length === 0) return Effect.void.pipe(Effect.as(void 0));
 		if (response.errors.some((message) => /not found|does not exist/iu.test(message))) return Effect.void.pipe(Effect.as(void 0));
@@ -122952,7 +123687,7 @@ const makeLinearApiTransport = Effect.gen(function* () {
 			detail: response.errors.join("; ")
 		}));
 	};
-	const nodesOf = (response, key) => asArray(asRecord$3(response.data?.[key])?.["nodes"]).map(asRecord$3).filter((node) => node !== void 0);
+	const nodesOf = (response, key) => asArray(asRecord$5(response.data?.[key])?.["nodes"]).map(asRecord$5).filter((node) => node !== void 0);
 	const resolveTeamId = (apiKey, team) => Effect.gen(function* () {
 		const response = yield* request(apiKey, `query($filter: TeamFilter) { teams(filter: $filter, first: 2) { nodes { id } } }`, { filter: { or: [{ key: { eqIgnoreCase: team } }, { name: { eqIgnoreCase: team } }] } });
 		const id = asString(nodesOf(response, "teams")[0]?.["id"]);
@@ -122965,7 +123700,7 @@ const makeLinearApiTransport = Effect.gen(function* () {
 	const teamIdOfIssue = (apiKey, issueId) => Effect.gen(function* () {
 		const response = yield* request(apiKey, `query($id: String!) { issue(id: $id) { team { id } } }`, { id: issueId });
 		const issue = yield* readEntity(response, "issue");
-		const id = asString(asRecord$3(issue?.["team"])?.["id"]);
+		const id = asString(asRecord$5(issue?.["team"])?.["id"]);
 		if (id === void 0) return yield* new LinearUnavailable({
 			reason: "failed",
 			detail: `Linear has no issue "${issueId}" to read a team from.`
@@ -123085,13 +123820,114 @@ const makeLinearApiTransport = Effect.gen(function* () {
 			input
 		});
 		const payload = yield* readEntity(response, issueId === void 0 ? "issueCreate" : "issueUpdate");
-		const issue = asRecord$3(payload?.["issue"]);
+		const issue = asRecord$5(payload?.["issue"]);
 		if (issue === void 0) return yield* new LinearUnavailable({
 			reason: "failed",
 			detail: response.errors.length > 0 ? response.errors.join("; ") : "Linear accepted the write but returned no issue."
 		});
 		return toIssueRow(issue);
 	});
+	/**
+	* The issue's own id, from whatever a caller had - an identifier, a URL's
+	* tail, or the id itself.
+	*
+	* The comment and attachment mutations take the UUID only, while every
+	* caller here starts from what a person typed. One lookup closes that gap
+	* and gives the "no such issue" sentence a name to report.
+	*/
+	const resolveIssueNodeId = (apiKey, reference) => Effect.gen(function* () {
+		const response = yield* request(apiKey, `query($id: String!) { issue(id: $id) { id } }`, { id: reference });
+		const issue = yield* readEntity(response, "issue");
+		const id = asString(issue?.["id"]);
+		if (id === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: `Linear has no issue "${reference}".`
+		});
+		return id;
+	});
+	const listComments = (apiKey, args) => Effect.gen(function* () {
+		const reference = asString(args["issueId"]) ?? asString(args["id"]);
+		if (reference === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: "list_comments needs an issueId."
+		});
+		const response = yield* request(apiKey, `query($id: String!, $first: Int!) {
+          issue(id: $id) {
+            comments(first: $first) {
+              nodes { ${COMMENT_SELECTION} }
+            }
+          }
+        }`, {
+			id: reference,
+			first: typeof args["limit"] === "number" ? args["limit"] : 50
+		});
+		const issue = yield* readEntity(response, "issue");
+		if (issue === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: `Linear has no issue "${reference}".`
+		});
+		return { comments: asArray(asRecord$5(issue["comments"])?.["nodes"]).map(asRecord$5).filter((node) => node !== void 0).map(toCommentRow) };
+	});
+	const saveComment = (apiKey, args) => Effect.gen(function* () {
+		const reference = asString(args["issueId"]) ?? asString(args["id"]);
+		const body = typeof args["body"] === "string" ? args["body"] : void 0;
+		if (reference === void 0 || body === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: "save_comment needs an issueId and a body."
+		});
+		const issueNodeId = yield* resolveIssueNodeId(apiKey, reference);
+		const parentId = asString(args["parentId"]);
+		const response = yield* request(apiKey, `mutation($input: CommentCreateInput!) {
+          commentCreate(input: $input) { comment { ${COMMENT_SELECTION} } }
+        }`, { input: {
+			issueId: issueNodeId,
+			body,
+			...parentId === void 0 ? {} : { parentId }
+		} });
+		const payload = yield* readEntity(response, "commentCreate");
+		const comment = asRecord$5(payload?.["comment"]);
+		if (comment === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: response.errors.length > 0 ? response.errors.join("; ") : "Linear accepted the comment and returned nothing."
+		});
+		return toCommentRow(comment);
+	});
+	/**
+	* A link filed against an issue, which is every attachment this transport
+	* can make.
+	*
+	* Linear's own file upload is a signed-URL handshake followed by a PUT of
+	* the bytes, and nothing here has bytes to send: the proof a closeout links
+	* is already hosted somewhere. A caller holding a local file gets the same
+	* answer it would get from the MCP server's `create_attachment`, which also
+	* takes a URL.
+	*/
+	const createAttachment = (apiKey, args) => Effect.gen(function* () {
+		const reference = asString(args["issueId"]) ?? asString(args["id"]);
+		const url = asString(args["url"]);
+		if (reference === void 0 || url === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: "create_attachment needs an issueId and a url."
+		});
+		const issueNodeId = yield* resolveIssueNodeId(apiKey, reference);
+		const title = asString(args["title"]);
+		const subtitle = asString(args["subtitle"]);
+		const response = yield* request(apiKey, `mutation($input: AttachmentCreateInput!) {
+          attachmentCreate(input: $input) { attachment { ${ATTACHMENT_SELECTION} } }
+        }`, { input: {
+			issueId: issueNodeId,
+			url,
+			title: title ?? url,
+			...subtitle === void 0 ? {} : { subtitle }
+		} });
+		const payload = yield* readEntity(response, "attachmentCreate");
+		const attachment = asRecord$5(payload?.["attachment"]);
+		if (attachment === void 0) return yield* new LinearUnavailable({
+			reason: "failed",
+			detail: response.errors.length > 0 ? response.errors.join("; ") : "Linear accepted the attachment and returned nothing."
+		});
+		return attachment;
+	});
 	const isConfigured = secrets.read("linear").pipe(Effect.map((credential) => Option.isSome(credential)));
 	const call = (toolName, args) => Effect.gen(function* () {
 		const credential = yield* secrets.read("linear");
@@ -123104,6 +123940,9 @@ const makeLinearApiTransport = Effect.gen(function* () {
 			case "list_issues": return yield* listIssues(apiKey, args);
 			case "get_issue": return yield* getIssue(apiKey, args);
 			case "save_issue": return yield* saveIssue(apiKey, args);
+			case "list_comments": return yield* listComments(apiKey, args);
+			case "save_comment": return yield* saveComment(apiKey, args);
+			case "create_attachment": return yield* createAttachment(apiKey, args);
 			default: return yield* new LinearUnavailable({
 				reason: "failed",
 				detail: `The Linear API transport has no translation for "${toolName}".`
@@ -123115,11 +123954,11 @@ const makeLinearApiTransport = Effect.gen(function* () {
 			reason: "not_authorized",
 			detail: "Linear rejected this API key."
 		}) : error));
-		if (asString(asRecord$3(response.data?.["viewer"])?.["id"]) === void 0) return yield* new LinearUnavailable({
+		if (asString(asRecord$5(response.data?.["viewer"])?.["id"]) === void 0) return yield* new LinearUnavailable({
 			reason: "not_authorized",
 			detail: response.errors.length > 0 ? response.errors.join("; ") : "Linear rejected this API key."
 		});
-		const organization = asRecord$3(response.data?.["organization"]);
+		const organization = asRecord$5(response.data?.["organization"]);
 		return { workspace: asString(organization?.["name"]) ?? asString(organization?.["urlKey"]) ?? null };
 	});
 	return {
@@ -123340,7 +124179,7 @@ const STATUS_FROM_LINEAR_TYPE = {
 	completed: "done",
 	canceled: "cancelled"
 };
-const asRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+const asRecord$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 const text = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 /**
 * A person's name out of whatever Linear put in the field: an object when the
@@ -123349,14 +124188,14 @@ const text = (value) => typeof value === "string" && value.trim().length > 0 ? v
 const personName = (value) => {
 	const direct = text(value);
 	if (direct !== void 0) return direct;
-	const record = asRecord$2(value);
+	const record = asRecord$4(value);
 	if (record === void 0) return null;
 	return text(record["displayName"]) ?? text(record["name"]) ?? text(record["email"]) ?? null;
 };
 /** Label names, from either `["Bug"]` or `[{ name: "Bug" }]`. */
 const labelNames = (value) => {
 	if (!Array.isArray(value)) return [];
-	return value.map((entry) => text(entry) ?? text(asRecord$2(entry)?.["name"])).filter((name) => name !== void 0);
+	return value.map((entry) => text(entry) ?? text(asRecord$4(entry)?.["name"])).filter((name) => name !== void 0);
 };
 /**
 * The p4code status an issue is in.
@@ -123401,7 +124240,7 @@ const statusToLinearState = (status) => {
 * Medium, and quietly rewrite the local row with it.
 */
 const priorityFromLinear = (value) => {
-	const numeric = typeof value === "number" ? value : asRecord$2(value)?.["value"];
+	const numeric = typeof value === "number" ? value : asRecord$4(value)?.["value"];
 	return typeof numeric === "number" ? PRIORITY_FROM_LINEAR[numeric] ?? "none" : "none";
 };
 const priorityToLinear = (priority) => PRIORITY_TO_LINEAR[priority];
@@ -126920,7 +127759,7 @@ function toAssetFilePath(repositoryPath, root) {
 const REGISTRY_SEARCH_URL = "https://www.skills.sh/api/search";
 const GITHUB_API_URL = "https://api.github.com";
 const GITHUB_RAW_URL = "https://raw.githubusercontent.com";
-const REQUEST_TIMEOUT_MS$1 = 15e3;
+const REQUEST_TIMEOUT_MS = 15e3;
 /** More than a person reads, few enough that the panel is a list and not a feed. */
 const MAX_SEARCH_RESULTS = 25;
 /**
@@ -126960,7 +127799,7 @@ const emptyFetch = (id, unavailable) => ({
 const make$29 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const request = Effect.fn("SkillRegistry.request")(function* (url) {
-		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$1));
+		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS));
 	});
 	const search = (query) => Effect.gen(function* () {
 		const response = yield* request(`${REGISTRY_SEARCH_URL}?q=${encodeURIComponent(query)}`).pipe(Effect.orElseSucceed(() => null));
@@ -130108,6 +130947,7 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.storageCleanupSweep, AuthOrchestrationOperateScope],
 	[WS_METHODS.worktreeCleanupPreview, AuthOrchestrationReadScope],
 	[WS_METHODS.worktreeCleanupSweep, AuthOrchestrationOperateScope],
+	[WS_METHODS.hubAnalyticsQuery, AuthOrchestrationReadScope],
 	[WS_METHODS.hubGetSyncStatus, AuthOrchestrationReadScope],
 	[WS_METHODS.hubConnect, AuthOrchestrationOperateScope],
 	[WS_METHODS.hubDisconnect, AuthOrchestrationOperateScope],
@@ -131135,6 +131975,13 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker, computerUseBrok
 		[WS_METHODS.storageCleanupSweep]: (_input) => observeRpcEffect$1(WS_METHODS.storageCleanupSweep, storageCleanup.sweep, { "rpc.aggregate": "storageCleanup" }),
 		[WS_METHODS.worktreeCleanupPreview]: (_input) => observeRpcEffect$1(WS_METHODS.worktreeCleanupPreview, worktreeCleanup.preview, { "rpc.aggregate": "worktreeCleanup" }),
 		[WS_METHODS.worktreeCleanupSweep]: (_input) => observeRpcEffect$1(WS_METHODS.worktreeCleanupSweep, worktreeCleanup.sweep, { "rpc.aggregate": "worktreeCleanup" }),
+		[WS_METHODS.hubAnalyticsQuery]: (query) => observeRpcEffect$1(WS_METHODS.hubAnalyticsQuery, Effect.gen(function* () {
+			const state = yield* hubLink.current;
+			if (Option.isNone(state.settings)) return yield* new HubLinkError({ detail: "No hub is configured." });
+			const transport = yield* makeHubActivityTransport(state.settings.value);
+			const membership = yield* transport.identity();
+			return yield* transport.queryFacts(query, membership);
+		}).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause instanceof HubLinkError ? cause.detail : "The hub could not be reached." }))), { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubGetSyncStatus]: (_input) => observeRpcEffect$1(WS_METHODS.hubGetSyncStatus, assetSync.status, { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubConnect]: (input) => observeRpcEffect$1(WS_METHODS.hubConnect, hubLink.connect(input).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(assetSync.status)), { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubDisconnect]: (_input) => observeRpcEffect$1(WS_METHODS.hubDisconnect, hubLink.disconnect.pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(assetSync.status)), { "rpc.aggregate": "hub" }),
@@ -132332,6 +133179,23 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 		...event,
 		requestId: RuntimeRequestId.make(String(pending.requestId))
 	};
+	/**
+	* Stamp a compacted event with how long its pass actually took.
+	*
+	* The service owns both ends of a compaction, so it is the only place that
+	* can measure one; every reader downstream would be guessing from
+	* surrounding timestamps instead.
+	*/
+	const withCompactionMeasurement = (event, pending, nowMs) => event.type === "thread.state.changed" && event.payload.state === "compacted" ? {
+		...event,
+		payload: {
+			...event.payload,
+			detail: {
+				...typeof event.payload.detail === "object" && event.payload.detail !== null ? event.payload.detail : {},
+				durationMs: Math.max(0, nowMs - pending.startedAtMs)
+			}
+		}
+	} : event;
 	const compactionTerminal = (event) => event.type === "turn.completed" ? event.payload.state : event.type === "runtime.error" || event.type === "turn.aborted" || event.type === "session.exited" ? event.type : null;
 	const processFallbackCompactionEvent = (pending, event) => Effect.gen(function* () {
 		if (pendingCompactions.get(event.threadId) !== pending) {
@@ -132341,7 +133205,7 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 		const matchesTurn = event.turnId !== void 0 && event.turnId === pending.expectedTurnId;
 		if (matchesTurn && isCompactedEvent(event)) {
 			pending.compactedEventObserved = true;
-			yield* publishRuntimeEvent(withCompactionRequestId(event, pending));
+			yield* publishRuntimeEvent(withCompactionMeasurement(withCompactionRequestId(event, pending), pending, yield* Clock.currentTimeMillis));
 			return;
 		}
 		yield* publishRuntimeEvent(event);
@@ -132354,7 +133218,10 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 			type: "thread.state.changed",
 			payload: {
 				state: "compacted",
-				detail: { source: "provider-native-command" }
+				detail: {
+					source: "provider-native-command",
+					durationMs: Math.max(0, (yield* Clock.currentTimeMillis) - pending.startedAtMs)
+				}
 			},
 			...pending.requestId !== void 0 ? { requestId: RuntimeRequestId.make(String(pending.requestId)) } : {}
 		};
@@ -132386,7 +133253,7 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 		if (pendingCompaction.native) {
 			const compacted = isCompactedEvent(canonicalEvent);
 			const terminal = compacted ? "completed" : canonicalEvent.type === "turn.completed" && canonicalEvent.payload.state === "completed" ? null : compactionTerminal(canonicalEvent);
-			yield* publishRuntimeEvent(compacted ? withCompactionRequestId(canonicalEvent, pendingCompaction) : canonicalEvent);
+			yield* publishRuntimeEvent(compacted ? withCompactionMeasurement(withCompactionRequestId(canonicalEvent, pendingCompaction), pendingCompaction, yield* Clock.currentTimeMillis) : canonicalEvent);
 			if (terminal !== null) yield* settleCompaction(canonicalEvent.threadId, pendingCompaction, terminal);
 			return;
 		}
@@ -132685,6 +133552,7 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 		const completion = yield* Deferred.make();
 		const pending = {
 			completion,
+			startedAtMs: yield* Clock.currentTimeMillis,
 			native: compaction.type === "native",
 			providerInstanceId: routed.instanceId,
 			requestId,
@@ -133660,22 +134528,27 @@ PreviewToolkit.toLayer(handlers$5);
 //#endregion
 //#region src/mcp/TicketResolver.ts
 var TicketResolver = class extends Context.Service()("@p4code/cli/mcp/TicketResolver") {};
+/**
+* The client's reasons map one-to-one except `failed`, which for a caller
+* here means "try again", not "fix your configuration".
+*/
+const toResolveError = (cause) => new TicketResolveError({
+	reason: cause.reason === "failed" ? "unavailable" : cause.reason,
+	detail: cause.detail
+});
 const stringField = (record, key) => {
 	const value = record[key];
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 };
 const make$12 = Effect.gen(function* () {
 	const linear = yield* LinearClient;
-	return { resolve: Effect.fn("TicketResolver.resolve")(function* (reference) {
+	const resolve = Effect.fn("TicketResolver.resolve")(function* (reference) {
 		const identifier = parseTicketReference(reference);
 		if (identifier === null) return yield* new TicketResolveError({
 			reason: "not_found",
 			detail: `"${reference}" does not look like a ticket reference.`
 		});
-		const issue = readOne(yield* linear.call(LINEAR_GET_ISSUE_TOOL, { id: identifier }).pipe(Effect.mapError((cause) => new TicketResolveError({
-			reason: cause.reason === "failed" ? "unavailable" : cause.reason,
-			detail: cause.detail
-		}))));
+		const issue = readOne(yield* linear.call(LINEAR_GET_ISSUE_TOOL, { id: identifier }).pipe(Effect.mapError(toResolveError)));
 		const url = issue === void 0 ? void 0 : stringField(issue, "url");
 		const title = issue === void 0 ? void 0 : stringField(issue, "title");
 		if (issue === void 0 || url === void 0 || title === void 0) return yield* new TicketResolveError({
@@ -133693,7 +134566,43 @@ const make$12 = Effect.gen(function* () {
 			title,
 			...description === void 0 ? {} : { description }
 		};
-	}) };
+	});
+	return {
+		resolve,
+		comment: Effect.fn("TicketResolver.comment")(function* (input) {
+			const ticket = yield* resolve(input.reference);
+			const identifier = ticket.externalRef.identifier;
+			const comment = readOne(yield* linear.call(LINEAR_SAVE_COMMENT_TOOL, {
+				issueId: identifier,
+				body: input.body
+			}).pipe(Effect.mapError(toResolveError)));
+			const commentUrl = comment === void 0 ? void 0 : stringField(comment, "url");
+			const attachedUrls = [];
+			const failedAttachments = [];
+			for (const attachment of input.attachments ?? []) {
+				const failure = yield* linear.call(LINEAR_CREATE_ATTACHMENT_TOOL, {
+					issueId: identifier,
+					url: attachment.url,
+					...attachment.title === void 0 ? {} : { title: attachment.title }
+				}).pipe(Effect.as(void 0), Effect.catch((cause) => Effect.logWarning("ticket attachment failed", {
+					ticket: identifier,
+					url: attachment.url,
+					detail: cause.detail
+				}).pipe(Effect.as(cause.detail))));
+				if (failure === void 0) attachedUrls.push(attachment.url);
+				else failedAttachments.push({
+					url: attachment.url,
+					detail: failure
+				});
+			}
+			return {
+				externalRef: ticket.externalRef,
+				...commentUrl === void 0 ? {} : { commentUrl },
+				attachedUrls,
+				failedAttachments
+			};
+		})
+	};
 });
 const layer$5 = Layer.effect(TicketResolver, make$12);
 //#endregion
@@ -133814,7 +134723,29 @@ const TicketResolveTool = Tool.make("ticket_resolve", {
 	failure: Schema$1.Union([TaskToolUnavailableError, TicketResolveError]),
 	dependencies: [McpInvocationContext, TicketResolver]
 }).annotate(Tool.Title, "Resolve a ticket").annotate(Tool.Readonly, true).annotate(Tool.Destructive, false).annotate(Tool.Idempotent, true);
-const TaskToolkit = Toolkit.make(TaskListTool, TaskGetTool, TaskCurrentTool, TaskCreateTool, TaskUpdateTool, TaskProposeTool, TicketResolveTool);
+/**
+* Writing one comment back to the ticket, through p4code's own transport.
+*
+* Separate from `ticket_resolve` because it writes, and on the task toolkit
+* for the same reason that one is: it is the tracker side of the work a board
+* row describes, under the one capability a session is granted.
+*
+* It exists because a provider's own tracker registration is not a transport
+* p4code controls - it can be absent, or hold a credential the tracker has
+* stopped accepting - while closeout is the moment that must not fail
+* silently. `LinearClient` picks the stored API key when there is one and the
+* registered MCP server otherwise, so this reaches the ticket whenever any
+* route to it exists. Both halves of a Fusion pair may call it; which half
+* should is the prompt's business, not the toolkit's.
+*/
+const TicketCommentTool = Tool.make("ticket_comment", {
+	description: "Comment on a tracker ticket by id or URL (e.g. MOBILE-12241, or a linear.app link), optionally filing links as attachments alongside it. Use it for an authorized closeout note or a requested ticket comment - never for progress chatter. Reaches the tracker through p4code's own credential, so it works when the session has no tracker server of its own. The comment is written as given: Markdown, and the caller's words. Attachments take publicly reachable URLs; a local file path cannot be filed. A link the tracker refuses comes back in failedAttachments with the reason - retry that link alone rather than the whole call, which would file the comment twice.",
+	parameters: TicketCommentInput,
+	success: TicketCommentResult,
+	failure: Schema$1.Union([TaskToolUnavailableError, TicketResolveError]),
+	dependencies: [McpInvocationContext, TicketResolver]
+}).annotate(Tool.Title, "Comment on a ticket").annotate(Tool.Readonly, false).annotate(Tool.Destructive, false).annotate(Tool.Idempotent, false);
+const TaskToolkit = Toolkit.make(TaskListTool, TaskGetTool, TaskCurrentTool, TaskCreateTool, TaskUpdateTool, TaskProposeTool, TicketResolveTool, TicketCommentTool);
 //#endregion
 //#region src/mcp/toolkits/tasks/handlers.ts
 const nowIso$1 = Effect.map(DateTime.now, DateTime.formatIso);
@@ -133917,6 +134848,10 @@ const TaskToolkitHandlersLive = TaskToolkit.toLayer({
 		yield* requireTaskCapability();
 		return yield* (yield* TicketResolver).resolve(input.reference);
 	}),
+	ticket_comment: (input) => Effect.gen(function* () {
+		yield* requireTaskCapability();
+		return yield* (yield* TicketResolver).comment(input);
+	}),
 	task_propose: () => Effect.gen(function* () {
 		yield* requireTaskCapability();
 		return { awaitingConfirmation: true };
@@ -136107,7 +137042,7 @@ const watchesAsFusionSupervisor = Effect.fn("mcp.watch.watchesAsFusionSupervisor
 	return (yield* (yield* ProjectionSnapshotQuery).getActiveThreadPairs().pipe(Effect.orElseSucceed(() => []))).some((pair) => pair.watcherThreadId === readerThreadId && pair.implementerThreadId === watchedThreadId);
 });
 /** Bounded so one report cannot dominate a thread's activity storage. */
-const clip = (value, limit) => {
+const clip$1 = (value, limit) => {
 	const trimmed = value?.trim();
 	if (!trimmed) return null;
 	return trimmed.length <= limit ? trimmed : `${trimmed.slice(0, limit)}…`;
@@ -136143,8 +137078,8 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 			serverReadActivityId: serverEvidenceReadActivityId(input.threadId, input.throughSequence),
 			closedAt: createdAt
 		});
-		const summary = clip(input.summary, THREAD_EVIDENCE_REPORT_MAX_CHARS);
-		const reason = clip(input.reason, 500);
+		const summary = clip$1(input.summary, THREAD_EVIDENCE_REPORT_MAX_CHARS);
+		const reason = clip$1(input.reason, 500);
 		const outcome = summary === null && input.outcome === "summarized" ? "failed" : input.outcome;
 		return {
 			recorded: yield* engine.dispatch({
@@ -136166,7 +137101,7 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 						throughSequence: input.throughSequence,
 						outcome,
 						summary,
-						model: clip(input.model, MODEL_ID_MAX_CHARS),
+						model: clip$1(input.model, MODEL_ID_MAX_CHARS),
 						reason: reason ?? (outcome === "summarized" ? null : "the supervisor gave no reason"),
 						context,
 						timing
@@ -136354,118 +137289,6 @@ const ComputerUseMcpLive = ComputerUseToolkitRegistrationLive.pipe(Layer.provide
 }).pipe(Layer.provide(McpAuthMiddlewareLive))));
 const layer$4 = Layer.mergeAll(Layer.fresh(StandardMcpLive), Layer.fresh(ComputerUseMcpLive));
 //#endregion
-//#region src/hub/HubActivityTransport.ts
-const REQUEST_TIMEOUT_MS = 8e3;
-const CLEANUP_TIMEOUT_MS = 1e3;
-const MAX_RESPONSE_BYTES = 4096;
-const MAX_REQUEST_BYTES = 16 * 1024;
-const MAX_BEARER_CHARS = 8192;
-var HubActivityUnavailable = class extends Data.TaggedError("HubActivityUnavailable") {};
-var HubActivityUnauthorized = class extends Data.TaggedError("HubActivityUnauthorized") {};
-/** All errors are payload-free; late responses still cancel their bodies after owner interruption. */
-const makeHubActivityTransport = Effect.fn("HubActivityTransport.make")(function* (settings, fetcher = fetch) {
-	const origin = yield* Effect.try({
-		try: () => {
-			const url = new URL(settings.baseUrl);
-			if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/" || settings.token.length === 0 || settings.token.length > MAX_BEARER_CHARS || !/^[\x21-\x7e]+$/.test(settings.token)) throw new HubActivityUnavailable();
-			return url.origin;
-		},
-		catch: () => new HubActivityUnavailable()
-	});
-	const request = Effect.fn("HubActivityTransport.request")(function* (path, body, membership) {
-		return yield* Effect.tryPromise({
-			try: async (signal) => {
-				const controller = new AbortController();
-				const abort = () => controller.abort();
-				signal.addEventListener("abort", abort, { once: true });
-				if (signal.aborted) abort();
-				const timer = setTimeout(abort, REQUEST_TIMEOUT_MS);
-				let reader;
-				const cancel = async (work) => {
-					let timeout;
-					try {
-						await Promise.race([Promise.resolve().then(work).catch(() => void 0), new Promise((resolve) => {
-							timeout = setTimeout(resolve, CLEANUP_TIMEOUT_MS);
-						})]);
-					} finally {
-						if (timeout) clearTimeout(timeout);
-					}
-				};
-				try {
-					if (controller.signal.aborted) throw new HubActivityUnavailable();
-					const response = await fetcher(`${origin}${path}`, {
-						method: body === void 0 ? "GET" : "POST",
-						headers: {
-							authorization: `Bearer ${settings.token}`,
-							...membership ? {
-								"x-p4-hub-account": membership.accountId,
-								"x-p4-hub-environment": membership.environmentId
-							} : {},
-							...body === void 0 ? {} : { "content-type": "application/json" }
-						},
-						body,
-						signal: controller.signal,
-						redirect: "error",
-						credentials: "omit",
-						cache: "no-store"
-					});
-					if (controller.signal.aborted) {
-						await cancel(() => response.body?.cancel() ?? Promise.resolve());
-						throw new HubActivityUnavailable();
-					}
-					reader = response.body?.getReader();
-					if (response.status === 401 || response.status === 403) throw new HubActivityUnauthorized();
-					if (response.status !== 200 || !/^application\/json(?:\s*;|$)/i.test(response.headers.get("content-type") ?? "") || !reader) throw new HubActivityUnavailable();
-					let length = 0;
-					const chunks = [];
-					while (true) {
-						const item = await reader.read();
-						if (controller.signal.aborted) throw new HubActivityUnavailable();
-						if (item.done) break;
-						length += item.value.byteLength;
-						if (length > MAX_RESPONSE_BYTES) throw new HubActivityUnavailable();
-						if (item.value.byteLength) chunks.push(item.value);
-					}
-					const bytes = new Uint8Array(length);
-					let offset = 0;
-					for (const chunk of chunks) {
-						bytes.set(chunk, offset);
-						offset += chunk.byteLength;
-					}
-					return Schema$1.decodeUnknownSync(Schema$1.UnknownFromJsonString)(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-				} finally {
-					controller.abort();
-					clearTimeout(timer);
-					signal.removeEventListener("abort", abort);
-					if (reader) await cancel(() => reader.cancel());
-				}
-			},
-			catch: (error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()
-		}).pipe(Effect.timeout(9e3), Effect.mapError((error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()));
-	});
-	return {
-		identity: Effect.fn("HubActivityTransport.identity")(function* () {
-			const membership = yield* request("/v1/identity").pipe(Effect.flatMap(Schema$1.decodeUnknownEffect(HubServerMembership, { onExcessProperty: "error" })), Effect.mapError((error) => error instanceof HubActivityUnauthorized ? error : new HubActivityUnavailable()));
-			const destination = yield* Schema$1.encodeUnknownEffect(Schema$1.UnknownFromJsonString)([
-				origin,
-				membership.accountId,
-				membership.environmentId
-			]);
-			return {
-				...membership,
-				destination: NodeCrypto.createHash("sha256").update(destination).digest("hex")
-			};
-		}),
-		post: Effect.fn("HubActivityTransport.post")(function* (input, membership) {
-			const activity = yield* Schema$1.decodeUnknownEffect(HubAgentActivityInput)(input, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
-			const body = yield* Schema$1.encodeEffect(Schema$1.fromJsonString(HubAgentActivityInput))(activity);
-			if (Buffer.byteLength(body) > MAX_REQUEST_BYTES) return yield* Effect.fail(new HubActivityUnavailable());
-			const result = yield* request("/v1/agent-activity", body, membership);
-			return yield* Schema$1.decodeUnknownEffect(Schema$1.Struct({ accepted: Schema$1.Boolean }))(result, { onExcessProperty: "error" }).pipe(Effect.mapError(() => new HubActivityUnavailable()));
-		})
-	};
-});
-//#endregion
 //#region src/hub/HubActivityProjection.ts
 const titles = {
 	running: "Agent working",
@@ -136596,6 +137419,407 @@ const makeHubActivityOutbound = Effect.fn("HubActivityOutbound.make")(function*
 		})
 	};
 });
+const encodeFact = Schema$1.encodeEffect(Schema$1.fromJsonString(HubAnalyticsFactInput));
+const decodeStoredFact = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(HubAnalyticsFactInput));
+/** Stage one derived fact. Returns false when this id was already staged. */
+const stageAnalyticsFact = Effect.fn("AnalyticsFactOutbox.stage")(function* (fact) {
+	const sql = yield* SqlClient.SqlClient;
+	const payload = yield* encodeFact(fact);
+	const now = yield* Clock.currentTimeMillis;
+	return (yield* sql`
+    INSERT INTO analytics_fact_outbox (event_id, kind, version, occurred_at, payload, pending, created_at)
+    VALUES (${fact.eventId}, ${fact.kind}, ${fact.version}, ${fact.occurredAt}, ${payload}, 1, ${now})
+    ON CONFLICT(event_id) DO NOTHING
+    RETURNING event_id`).length === 1;
+});
+/** The oldest undelivered facts, in the order they were captured. */
+const pendingAnalyticsFacts = Effect.fn("AnalyticsFactOutbox.pending")(function* (limit = 16) {
+	return yield* (yield* SqlClient.SqlClient)`
+    SELECT event_id, payload FROM analytics_fact_outbox WHERE pending = 1
+    ORDER BY created_at, event_id LIMIT ${limit}`;
+});
+/**
+* Mark one fact delivered.
+*
+* The hub answers `accepted: false` for a fact it already holds, which is the
+* same outcome as a fresh accept from here: the row is delivered either way,
+* and a retry that raced an earlier success must not stay pending forever.
+*/
+const acknowledgeAnalyticsFact = Effect.fn("AnalyticsFactOutbox.acknowledge")(function* (eventId) {
+	return (yield* (yield* SqlClient.SqlClient)`UPDATE analytics_fact_outbox SET pending = 0
+    WHERE event_id = ${eventId} AND pending = 1 RETURNING event_id`).length === 1;
+});
+/** Where a source's scan left off, so a restart resumes instead of replaying. */
+const readAnalyticsCursor = Effect.fn("AnalyticsFactOutbox.readCursor")(function* (source) {
+	return (yield* (yield* SqlClient.SqlClient)`SELECT after_sequence FROM analytics_fact_cursors WHERE source = ${source}`)[0]?.after_sequence ?? 0;
+});
+const writeAnalyticsCursor = Effect.fn("AnalyticsFactOutbox.writeCursor")(function* (source, afterSequence) {
+	yield* (yield* SqlClient.SqlClient)`INSERT INTO analytics_fact_cursors (source, after_sequence)
+    VALUES (${source}, ${afterSequence})
+    ON CONFLICT(source) DO UPDATE SET after_sequence = excluded.after_sequence`;
+});
+//#endregion
+//#region src/analytics/analyticsFacts.ts
+const MAX_QUESTION_CHARS = 2e3;
+const MAX_HEADER_CHARS = 120;
+const MAX_OPTION_LABEL_CHARS = 200;
+const MAX_OPTION_DESCRIPTION_CHARS = 600;
+const MAX_PRESENTED_OPTIONS = 12;
+const MAX_CUSTOM_ANSWER_CHARS = 2e3;
+const MAX_REASON_CHARS = 200;
+const MAX_MODEL_CHARS = 120;
+const clip = (value, max) => value.length <= max ? value : value.slice(0, max);
+const asRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+const asFiniteInt$1 = (value) => typeof value === "number" && Number.isFinite(value) ? Math.round(value) : null;
+/** `question:<requestId>:<questionId>`, so a replayed resolution derives the same id. */
+const questionFactId = (requestId, questionId) => `question:${requestId}:${questionId}`;
+/**
+* One fact per question in a resolved request.
+*
+* The presented options travel with the answer because the answer alone says
+* nothing: "Patch" only means something beside what else was offered, and a
+* custom answer only means something beside what it refused.
+*/
+function questionFactsFrom(input) {
+	const questions = Array.isArray(input.questions) ? input.questions : [];
+	const answers = asRecord$3(input.answers) ?? {};
+	const facts = [];
+	for (const raw of questions) {
+		const question = asRecord$3(raw);
+		if (question === null) continue;
+		const questionId = typeof question.id === "string" ? question.id : null;
+		const prompt = typeof question.question === "string" ? question.question : null;
+		if (questionId === null || prompt === null || prompt.length === 0) continue;
+		const options = (Array.isArray(question.options) ? question.options : []).slice(0, MAX_PRESENTED_OPTIONS).flatMap((entry) => {
+			const option = asRecord$3(entry);
+			const label = typeof option?.label === "string" ? option.label : null;
+			return label === null || label.length === 0 ? [] : [{
+				label: clip(label, MAX_OPTION_LABEL_CHARS),
+				description: clip(typeof option?.description === "string" ? option.description : "", MAX_OPTION_DESCRIPTION_CHARS)
+			}];
+		});
+		const given = answers[questionId];
+		const selected = (Array.isArray(given) ? given : given === void 0 ? [] : [given]).flatMap((value) => typeof value === "string" && value.length > 0 ? [value] : []);
+		const indexes = selected.map((label) => options.findIndex((option) => option.label === label));
+		const custom = selected.find((_, position) => indexes[position] === -1);
+		const answer = selected.length === 0 ? { kind: "dismissed" } : custom !== void 0 ? {
+			kind: "custom",
+			text: clip(custom, MAX_CUSTOM_ANSWER_CHARS)
+		} : {
+			kind: "option",
+			optionIndexes: indexes,
+			labels: selected.map((label) => clip(label, MAX_OPTION_LABEL_CHARS))
+		};
+		facts.push({
+			eventId: questionFactId(input.requestId, questionId),
+			occurredAt: input.occurredAt,
+			kind: "question.answered",
+			version: 1,
+			payload: {
+				questionId,
+				threadId: input.threadId,
+				header: clip(typeof question.header === "string" ? question.header : "", MAX_HEADER_CHARS),
+				question: clip(prompt, MAX_QUESTION_CHARS),
+				multiSelect: question.multiSelect === true,
+				options,
+				answer
+			}
+		});
+	}
+	return facts;
+}
+/** `fusion:<threadId>:<throughSequence>`: one handoff covers one range, once. */
+const fusionFactId = (threadId, throughSequence) => `fusion:${threadId}:${throughSequence}`;
+/**
+* One review, read from the two rows that recorded it.
+*
+* The outcome, the model and the duration come from the report, because that
+* is the row the server wrote them on; the coverage and the summary come from
+* the handoff, because that is the row that carried them. Neither is guessed
+* from the other, and a handoff with no report yields nothing at all.
+*/
+function fusionHandoffFactFrom(input) {
+	const payload = asRecord$3(input.payload);
+	const report = asRecord$3(input.reportPayload);
+	if (payload === null || report === null) return null;
+	const outcome = report.outcome;
+	if (outcome !== "summarized" && outcome !== "fallback" && outcome !== "failed" && outcome !== "unreported") return null;
+	const coverage = asRecord$3(payload.coverage) ?? {};
+	const context = asRecord$3(report.context);
+	const timing = asRecord$3(report.timing);
+	const summary = typeof payload.summary === "string" ? payload.summary : null;
+	const reason = typeof report.reason === "string" ? clip(report.reason, MAX_REASON_CHARS) : null;
+	return {
+		eventId: fusionFactId(input.threadId, input.throughSequence),
+		occurredAt: input.occurredAt,
+		kind: "fusion.handoff",
+		version: 1,
+		payload: {
+			fusionVersion: input.fusionVersion,
+			threadId: input.threadId,
+			status: outcome,
+			model: typeof report.model === "string" ? clip(report.model, MAX_MODEL_CHARS) : null,
+			reason,
+			transcriptEvents: asFiniteInt$1(coverage.transcriptEvents) ?? 0,
+			transcriptIncluded: asFiniteInt$1(coverage.transcriptIncluded) ?? 0,
+			transcriptDropped: asFiniteInt$1(coverage.transcriptDropped) ?? 0,
+			transcriptClippedFields: asFiniteInt$1(coverage.transcriptClippedFields) ?? 0,
+			ledgerRows: asFiniteInt$1(coverage.ledgerRows) ?? 0,
+			ledgerTotalRows: asFiniteInt$1(coverage.ledgerTotalRows) ?? 0,
+			summaryChars: summary === null ? null : summary.length,
+			contextDeltaTokens: asFiniteInt$1(context?.deltaTokens),
+			durationMs: asFiniteInt$1(timing?.durationMs)
+		}
+	};
+}
+/** `compression:<threadId>:<turnId>`: one pass per turn, once. */
+const compressionFactId = (threadId, turnId) => `compression:${threadId}:${turnId}`;
+/**
+* A compression pass, only when it was actually measured.
+*
+* Both token readings and the duration have to come from recorded state: a
+* pass whose before or after was never written is not reported as zero, and
+* the delta is derived from the two readings rather than supplied beside them.
+*/
+function compressionFactFrom(input) {
+	const before = asFiniteInt$1(input.beforeTokens);
+	const after = asFiniteInt$1(input.afterTokens);
+	const durationMs = asFiniteInt$1(input.durationMs);
+	if (before === null || after === null || durationMs === null || durationMs < 0) return null;
+	if (before < 0 || after < 0) return null;
+	return {
+		eventId: compressionFactId(input.threadId, input.turnId),
+		occurredAt: input.occurredAt,
+		kind: "compression.applied",
+		version: 1,
+		payload: {
+			mode: input.mode,
+			threadId: input.threadId,
+			beforeTokens: before,
+			afterTokens: after,
+			deltaTokens: before - after,
+			durationMs
+		}
+	};
+}
+//#endregion
+//#region src/analytics/AnalyticsFactCapture.ts
+const ANALYTICS_QUESTION_SOURCE = "events.user-input";
+const ANALYTICS_FUSION_SOURCE = "events.fusion-evidence";
+const ANALYTICS_COMPRESSION_SOURCE = "events.context-compaction";
+const decodeJson$1 = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(Schema$1.Unknown));
+const asRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+const asFiniteInt = (value) => typeof value === "number" && Number.isFinite(value) ? Math.round(value) : null;
+const asUsedTokens = (payload) => asFiniteInt(asRecord$2(payload)?.usedTokens);
+/** One appended activity, read out of its event envelope. */
+const readActivityEvent = Effect.fn("AnalyticsFactCapture.activity")(function* (row) {
+	const payload = asRecord$2(yield* decodeJson$1(row.payload_json));
+	const activity = asRecord$2(payload?.activity);
+	const threadId = typeof payload?.threadId === "string" ? payload.threadId : null;
+	if (activity === null || threadId === null) return null;
+	return {
+		sequence: row.sequence,
+		threadId,
+		turnId: typeof activity.turnId === "string" ? activity.turnId : null,
+		createdAt: typeof activity.createdAt === "string" ? activity.createdAt : "",
+		payload: asRecord$2(activity.payload) ?? {}
+	};
+});
+/** Candidate rows of one activity kind, after a source's own cursor. */
+const readCandidates = Effect.fn("AnalyticsFactCapture.candidates")(function* (kind, after, limit) {
+	return yield* (yield* SqlClient.SqlClient)`
+    SELECT sequence, payload_json FROM orchestration_events
+    WHERE sequence > ${after} AND event_type = 'thread.activity-appended'
+      AND json_extract(payload_json, '$.activity.kind') = ${kind}
+    ORDER BY sequence ASC LIMIT ${limit}`;
+});
+/**
+* The request a resolution answers, matched on the exact request id.
+*
+* A newer question in the same thread must never lend its options to an older
+* answer, which is what a "most recent request" lookup would do whenever two
+* requests were open at once.
+*/
+const readQuestionRequest = Effect.fn("AnalyticsFactCapture.questionRequest")(function* (threadId, requestId, throughSequence) {
+	const [row] = yield* (yield* SqlClient.SqlClient)`
+    SELECT sequence, payload_json FROM orchestration_events
+    WHERE sequence <= ${throughSequence} AND event_type = 'thread.activity-appended'
+      AND json_extract(payload_json, '$.activity.kind') = 'user-input.requested'
+      AND json_extract(payload_json, '$.threadId') = ${threadId}
+      AND json_extract(payload_json, '$.activity.payload.requestId') = ${requestId}
+    ORDER BY sequence DESC LIMIT 1`;
+	if (row === void 0) return null;
+	return (yield* readActivityEvent(row))?.payload ?? null;
+});
+/** The handoff a report closes, found by the range the report names. */
+const readHandoff = Effect.fn("AnalyticsFactCapture.handoff")(function* (threadId, throughSequence, beforeSequence) {
+	const [row] = yield* (yield* SqlClient.SqlClient)`
+    SELECT sequence, payload_json FROM orchestration_events
+    WHERE sequence <= ${beforeSequence} AND event_type = 'thread.activity-appended'
+      AND json_extract(payload_json, '$.activity.kind') = 'fusion.evidence.handoff'
+      AND json_extract(payload_json, '$.activity.payload.watchedThreadId') = ${threadId}
+      AND json_extract(payload_json, '$.activity.payload.throughSequence') = ${throughSequence}
+    ORDER BY sequence DESC LIMIT 1`;
+	if (row === void 0) return null;
+	return (yield* readActivityEvent(row))?.payload ?? null;
+});
+/**
+* The nearest context reading on one side of a compaction, in the same turn.
+*
+* Correlating on the turn is the point: a later turn's context update must
+* never be able to close an old pass, which is exactly what "nearest reading
+* in this thread" would let it do once the pass itself was never completed.
+*/
+const readContextReading = Effect.fn("AnalyticsFactCapture.contextReading")(function* (threadId, turnId, sequence, side) {
+	const sql = yield* SqlClient.SqlClient;
+	const row = (side === "before" ? yield* sql`
+          SELECT sequence, payload_json FROM orchestration_events
+          WHERE sequence < ${sequence} AND event_type = 'thread.activity-appended'
+            AND json_extract(payload_json, '$.activity.kind') = 'context-window.updated'
+            AND json_extract(payload_json, '$.threadId') = ${threadId}
+            AND json_extract(payload_json, '$.activity.turnId') = ${turnId}
+          ORDER BY sequence DESC LIMIT 1` : yield* sql`
+          SELECT sequence, payload_json FROM orchestration_events
+          WHERE sequence > ${sequence} AND event_type = 'thread.activity-appended'
+            AND json_extract(payload_json, '$.activity.kind') = 'context-window.updated'
+            AND json_extract(payload_json, '$.threadId') = ${threadId}
+            AND json_extract(payload_json, '$.activity.turnId') = ${turnId}
+          ORDER BY sequence ASC LIMIT 1`)[0];
+	return row === void 0 ? null : yield* readActivityEvent(row);
+});
+const stageAll = Effect.fn("AnalyticsFactCapture.stageAll")(function* (facts) {
+	let staged = 0;
+	for (const fact of facts) if (yield* stageAnalyticsFact(fact)) staged += 1;
+	return staged;
+});
+/** Questions: one fact per question in each resolved request. */
+const captureQuestionFacts = Effect.fn("AnalyticsFactCapture.questions")(function* (limit = 128) {
+	const after = yield* readAnalyticsCursor(ANALYTICS_QUESTION_SOURCE);
+	const rows = yield* readCandidates("user-input.resolved", after, limit);
+	let cursor = after;
+	let staged = 0;
+	for (const row of rows) {
+		const event = yield* readActivityEvent(row);
+		const requestId = typeof event?.payload.requestId === "string" ? event.payload.requestId : null;
+		if (event !== null && requestId !== null) {
+			const request = yield* readQuestionRequest(event.threadId, requestId, event.sequence);
+			if (request !== null) staged += yield* stageAll(questionFactsFrom({
+				requestId,
+				threadId: event.threadId,
+				occurredAt: event.createdAt,
+				questions: request.questions,
+				answers: event.payload.answers
+			}));
+		}
+		cursor = row.sequence;
+	}
+	if (cursor !== after) yield* writeAnalyticsCursor(ANALYTICS_QUESTION_SOURCE, cursor);
+	return {
+		staged,
+		cursor
+	};
+});
+/**
+* Fusion: staged from the evidence report, never before it.
+*
+* The report is what carries the model, the context delta and the measured
+* duration, so a fact staged at handoff time would be missing exactly the
+* numbers it exists to carry - and could never gain them, because the fact is
+* append-only.
+*/
+const captureFusionFacts = Effect.fn("AnalyticsFactCapture.fusion")(function* (input) {
+	const after = yield* readAnalyticsCursor(ANALYTICS_FUSION_SOURCE);
+	const rows = yield* readCandidates("fusion.evidence.summary", after, input.limit ?? 128);
+	let cursor = after;
+	let staged = 0;
+	for (const row of rows) {
+		const event = yield* readActivityEvent(row);
+		const watchedThreadId = typeof event?.payload.watchedThreadId === "string" ? event.payload.watchedThreadId : null;
+		const throughSequence = asFiniteInt(event?.payload.throughSequence);
+		if (event !== null && watchedThreadId !== null && throughSequence !== null) {
+			const handoff = yield* readHandoff(watchedThreadId, throughSequence, event.sequence);
+			if (handoff !== null) {
+				const fact = fusionHandoffFactFrom({
+					threadId: watchedThreadId,
+					throughSequence,
+					occurredAt: event.createdAt,
+					fusionVersion: input.fusionVersion,
+					payload: handoff,
+					reportPayload: event.payload
+				});
+				if (fact !== null) staged += yield* stageAll([fact]);
+			}
+		}
+		cursor = row.sequence;
+	}
+	if (cursor !== after) yield* writeAnalyticsCursor(ANALYTICS_FUSION_SOURCE, cursor);
+	return {
+		staged,
+		cursor
+	};
+});
+/**
+* Compression: only a pass the service measured and the provider reported.
+*
+* The duration comes from the compaction event the provider service stamped,
+* the tokens from the recorded context readings either side. A pass whose
+* later reading has not landed yet holds back only this cursor, so a question
+* or a handoff behind it is still captured on the same tick.
+*/
+const captureCompressionFacts = Effect.fn("AnalyticsFactCapture.compression")(function* (limit = 128) {
+	const after = yield* readAnalyticsCursor(ANALYTICS_COMPRESSION_SOURCE);
+	const rows = yield* readCandidates("context-compaction", after, limit);
+	let cursor = after;
+	let staged = 0;
+	for (const row of rows) {
+		const event = yield* readActivityEvent(row);
+		if (event === null || event.turnId === null) {
+			cursor = row.sequence;
+			continue;
+		}
+		const durationMs = asFiniteInt(asRecord$2(event.payload.detail)?.durationMs);
+		const before = yield* readContextReading(event.threadId, event.turnId, event.sequence, "before");
+		const afterReading = yield* readContextReading(event.threadId, event.turnId, event.sequence, "after");
+		if (afterReading === null) break;
+		const mode = asRecord$2(before?.payload)?.compressMode ?? afterReading.payload.compressMode;
+		const fact = typeof mode === "string" ? compressionFactFrom({
+			threadId: event.threadId,
+			turnId: event.turnId,
+			occurredAt: event.createdAt,
+			mode,
+			beforeTokens: asUsedTokens(before?.payload),
+			afterTokens: asUsedTokens(afterReading.payload),
+			durationMs
+		}) : null;
+		if (fact !== null) staged += yield* stageAll([fact]);
+		cursor = row.sequence;
+	}
+	if (cursor !== after) yield* writeAnalyticsCursor(ANALYTICS_COMPRESSION_SOURCE, cursor);
+	return {
+		staged,
+		cursor
+	};
+});
+/** One tick over every source. A source that stalls never blocks another. */
+const captureAnalyticsFacts = Effect.fn("AnalyticsFactCapture.run")(function* (input) {
+	const questions = yield* captureQuestionFacts(input.limit);
+	const fusion = yield* captureFusionFacts(input);
+	const compression = yield* captureCompressionFacts(input.limit);
+	return { staged: questions.staged + fusion.staged + compression.staged };
+});
+//#endregion
+//#region src/analytics/AnalyticsDelivery.ts
+const runAnalyticsTick = Effect.fn("AnalyticsDelivery.tick")(function* (transport, identity, fusionVersion) {
+	yield* captureAnalyticsFacts({ fusionVersion });
+	let delivered = 0;
+	for (const row of yield* pendingAnalyticsFacts()) {
+		const fact = yield* decodeStoredFact(row.payload);
+		yield* transport.postFact(fact, identity);
+		yield* acknowledgeAnalyticsFact(row.event_id);
+		delivered += 1;
+	}
+	return { delivered };
+});
 //#endregion
 //#region src/hub/HubTunnelReconnect.ts
 const HUB_TUNNEL_RETRY_INITIAL_MS = 1e3;
@@ -136634,6 +137858,7 @@ const runHubActivityTick = Effect.fn("HubActivityRuntime.tick")(function* (outbo
 		yield* transport.post(activity, identity);
 		yield* outbound.acknowledge(pending.thread_id, pending.revision);
 	}
+	yield* runAnalyticsTick(transport, identity, version$1).pipe(Effect.catchCause((cause) => Effect.logDebug("analytics tick deferred", { cause })));
 });
 /** A credential generation owns every request, staging page and delay. Old destinations remain isolated. */
 const runHubActivityEmission = Effect.fn("HubActivityRuntime.run")(function* (settings, ready) {
@@ -141591,22 +142816,95 @@ function describeHandoffEvent(event, implementerThreadId, clip) {
 	}
 }
 /**
+* An activity line's evidence fields, its kind dropped and its title read the
+* way the ledger reads it: a provider spells the opening fragment's title
+* "<title> started", which is the same call rather than a different one.
+*/
+function activityFields(content) {
+	const [, ...fields] = content.split(" | ");
+	const [title, ...rest] = fields;
+	return title === void 0 ? fields : [title.replace(/ started$/u, ""), ...rest];
+}
+/** What a line is a fragment of, or null when it stands alone. */
+function fragmentIdentity(event) {
+	if (event.type === "thread.message-sent") {
+		const messageId = asTrimmed(event.payload.messageId);
+		return messageId === null ? null : `message:${messageId}`;
+	}
+	if (event.type === "thread.activity-appended") {
+		const data = asRecord(asRecord(event.payload.activity.payload)?.data);
+		const toolCallId = asTrimmed(data?.toolCallId);
+		return toolCallId === null ? null : `tool:${toolCallId}`;
+	}
+	return null;
+}
+/**
+* Fragments whose evidence a later line of the same message or call already
+* carries, so the transcript spends its budget on evidence rather than on the
+* same text streamed twenty times.
+*
+* A streaming message is folded only when a later fragment literally contains
+* it, and a tool fragment only when every field it carries reappears later, so
+* nothing unique is ever folded away. What a folded line did carry alone - the
+* call's identity, its status and the sequence it started at - is exactly what
+* the ledger records beside this transcript.
+*/
+function supersededLines(lines) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const line of lines) {
+		if (line.identity === null) continue;
+		const group = groups.get(line.identity);
+		if (group === void 0) groups.set(line.identity, [line]);
+		else group.push(line);
+	}
+	const superseded = /* @__PURE__ */ new Set();
+	for (const group of groups.values()) {
+		if (group.length < 2) continue;
+		const last = group[group.length - 1];
+		for (let index = 0; index < group.length - 1; index += 1) {
+			const line = group[index];
+			if (line.shape === "message") {
+				if (last.shape === "message" && last.content.includes(line.content)) superseded.add(line);
+				continue;
+			}
+			const laterFields = new Set(group.slice(index + 1).flatMap((later) => later.fields));
+			if (line.fields.every((field) => laterFields.has(field))) superseded.add(line);
+		}
+	}
+	return superseded;
+}
+/**
 * Flatten the range, newest kept when the bound bites.
 *
-* Dropping the oldest is the lesser evil for the same reason it is in the
-* triage window, but unlike there the loss is reported rather than absorbed:
-* a range that did not fit is a range this handoff must not call complete.
+* Duplicate fragments are folded before the bound is applied, because dropping
+* a unique event to make room for the twelfth copy of a streaming message is a
+* loss this handoff can simply avoid. Dropping the oldest is still the lesser
+* evil once the bound does bite, and unlike in the triage window the loss is
+* reported rather than absorbed: a range that did not fit is a range this
+* handoff must not call complete. Clipped fields are counted on the lines
+* actually handed over, so a field clipped inside a folded or dropped line is
+* not charged against coverage twice.
 */
 function buildHandoffEvidence(events, implementerThreadId, maxChars) {
-	const clip = makeClipper();
-	const lines = [];
+	const rendered = [];
 	for (const event of events) {
+		const clip = makeClipper();
 		const text = describeHandoffEvent(event, implementerThreadId, clip);
-		if (text !== null) lines.push({
+		if (text === null) continue;
+		const content = text.replace(/^#\d+ /u, "");
+		const shape = event.type === "thread.message-sent" ? "message" : "activity";
+		rendered.push({
 			sequence: event.sequence,
-			text
+			text,
+			clippedFields: clip.clipped,
+			identity: fragmentIdentity(event),
+			shape,
+			content,
+			fields: shape === "activity" ? activityFields(content) : []
 		});
 	}
+	const superseded = supersededLines(rendered);
+	const lines = rendered.filter((line) => !superseded.has(line));
 	const kept = [];
 	let used = 0;
 	for (let index = lines.length - 1; index >= 0; index -= 1) {
@@ -141618,10 +142916,11 @@ function buildHandoffEvidence(events, implementerThreadId, maxChars) {
 	}
 	return {
 		transcript: kept.map((line) => line.text).join("\n"),
-		eventCount: lines.length,
+		eventCount: rendered.length,
 		includedCount: kept.length,
 		droppedCount: lines.length - kept.length,
-		clippedFields: clip.clipped,
+		coalescedCount: superseded.size,
+		clippedFields: kept.reduce((total, line) => total + line.clippedFields, 0),
 		firstSequence: kept[0]?.sequence ?? null,
 		lastSequence: kept[kept.length - 1]?.sequence ?? null,
 		includedSequences: new Set(kept.map((line) => line.sequence))
@@ -141677,6 +142976,29 @@ const HANDOFF_SUMMARY_INSTRUCTIONS = [
 	"cite at least one sequence, and never a sequence absent from the transcript",
 	"name the user's requirements and corrections, and quote the exact text of any failure or error"
 ];
+/** Enough sequences to show the shape of a citation without dictating the summary. */
+const CITATION_EXAMPLE_COUNT = 2;
+/** The lowest and highest sequence handed over, as the citations they must be copied as. */
+function citationExamples(includedSequences) {
+	const sorted = [...includedSequences].sort((left, right) => left - right);
+	return (sorted.length <= CITATION_EXAMPLE_COUNT ? sorted : [sorted[0], sorted[sorted.length - 1]]).map((sequence) => `#${sequence}`);
+}
+/**
+* The citation rules carrying real sequences, because `#<sequence>` read as a
+* placeholder is what a summarizer answers without any number at all.
+*/
+function handoffSummaryInstructions(input) {
+	const examples = citationExamples(input.includedSequences);
+	return examples.length === 0 ? HANDOFF_SUMMARY_INSTRUCTIONS : [...HANDOFF_SUMMARY_INSTRUCTIONS, `copy citations from the line starts of this transcript, for example ${examples.join(" and ")}`];
+}
+/**
+* The single repair attempt: the same rules, plus what the discarded answer
+* got wrong. Nothing here relaxes the rule - a second miss falls back.
+*/
+function handoffSummaryRepairInstructions(input) {
+	const invented = citedSequences(input.summary).filter((sequence) => !input.includedSequences.has(sequence)).slice(0, CITATION_EXAMPLE_COUNT).map((sequence) => `#${sequence}`);
+	return [...handoffSummaryInstructions(input), input.rejection === "summary-uncited" || invented.length === 0 ? "your previous answer was discarded because it cited no sequence from the transcript; every claim needs one" : `your previous answer was discarded because it cited ${invented.join(" and ")}, which this transcript does not contain; never write a number that is not at a line start`];
+}
 /** How a summarized handoff opens, so a caller can tell one from a fallback. */
 const SERVER_HANDOFF_SUMMARY_PREFIX = "Server evidence handoff for builder thread";
 /**
@@ -141706,6 +143028,7 @@ const EMPTY_EVIDENCE = {
 	eventCount: 0,
 	includedCount: 0,
 	droppedCount: 0,
+	coalescedCount: 0,
 	clippedFields: 0,
 	firstSequence: null,
 	lastSequence: null,
@@ -141765,19 +143088,20 @@ function resolveHandoffModel(settings) {
 	};
 }
 /**
-* Whether a summary may stand in for reading the range.
+* Why a summary may not stand in for reading the range, or null when it may.
 *
-* Empty is refused for the obvious reason. Uncited is refused because a claim
-* with no sequence behind it cannot be checked against the ledger, and a
-* citation outside the window is refused because it is evidence of a model
-* describing something other than this turn.
+* Empty and uncited are refused because a claim with no sequence behind it
+* cannot be checked against the ledger, and a citation outside the window is
+* refused because it is evidence of a model describing something other than
+* this turn. The two are named apart because they fail differently: one is a
+* summarizer that ignored the rule, the other one that read something else.
 */
-function summaryIsUsable(input) {
+function summaryRejection(input) {
 	const trimmed = input.summary.trim();
-	if (trimmed.length === 0) return false;
+	if (trimmed.length === 0) return "summary-uncited";
 	const cited = citedSequences(trimmed);
-	if (cited.length === 0) return false;
-	return cited.every((sequence) => input.includedSequences.has(sequence));
+	if (cited.length === 0) return "summary-uncited";
+	return cited.every((sequence) => input.includedSequences.has(sequence)) ? null : "summary-citation-invalid";
 }
 const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(function* (input) {
 	const engine = yield* OrchestrationEngineService;
@@ -141833,20 +143157,51 @@ const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(func
 	if (driver === void 0 || !HARDENED_SUMMARY_DRIVERS.has(driver)) return yield* fallback("provider-profile-unhardened");
 	if (textGeneration.summarizeFusionEvidence === void 0) return yield* fallback("provider-cannot-summarize");
 	const summarize = textGeneration.summarizeFusionEvidence;
-	const produced = yield* Effect.suspend(() => summarize({
+	const runSummary = (instructions) => Effect.suspend(() => summarize({
 		cwd: serverConfig.cwd,
 		transcript: evidence.transcript,
 		maxTranscriptChars: HANDOFF_TRANSCRIPT_MAX_CHARS,
-		instructions: HANDOFF_SUMMARY_INSTRUCTIONS,
+		instructions,
 		modelSelection: model
-	})).pipe(Effect.map((result) => Option.some(result)), Effect.timeoutOption(HANDOFF_TIMEOUT), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-	if (Option.isNone(produced)) return yield* fallback("summary-unavailable");
-	if (produced.value.agentName !== P4_SUMMARIZER_AGENT.name && produced.value.agentName !== "summarizer") return yield* fallback("summarizer-agent-mismatch");
-	if (produced.value.requestedModel !== model.model) return yield* fallback("summarizer-model-mismatch");
-	if (!summaryIsUsable({
-		summary: produced.value.summary,
-		includedSequences: evidence.includedSequences
-	})) return yield* fallback("summary-uncited");
+	})).pipe(Effect.map((result) => Option.some(result)), Effect.catchCause(() => Effect.succeed(Option.none())));
+	/** The hardened identity checks, which a repair may never talk its way past. */
+	const identityRejection = (result) => result.agentName !== P4_SUMMARIZER_AGENT.name && result.agentName !== "summarizer" ? "summarizer-agent-mismatch" : result.requestedModel !== model.model ? "summarizer-model-mismatch" : null;
+	const noSummary = (reason) => ({
+		produced: Option.none(),
+		reason
+	});
+	const attempt = yield* Effect.gen(function* () {
+		const first = yield* runSummary(handoffSummaryInstructions({ includedSequences: evidence.includedSequences }));
+		if (Option.isNone(first)) return noSummary("summary-unavailable");
+		const identity = identityRejection(first.value);
+		if (identity !== null) return noSummary(identity);
+		const rejection = summaryRejection({
+			summary: first.value.summary,
+			includedSequences: evidence.includedSequences
+		});
+		if (rejection === null) return {
+			produced: first,
+			reason: null
+		};
+		const repaired = yield* runSummary(handoffSummaryRepairInstructions({
+			rejection,
+			summary: first.value.summary,
+			includedSequences: evidence.includedSequences
+		}));
+		if (Option.isNone(repaired)) return noSummary(rejection);
+		const repairedIdentity = identityRejection(repaired.value);
+		if (repairedIdentity !== null) return noSummary(repairedIdentity);
+		const repairedRejection = summaryRejection({
+			summary: repaired.value.summary,
+			includedSequences: evidence.includedSequences
+		});
+		return repairedRejection === null ? {
+			produced: repaired,
+			reason: null
+		} : noSummary(repairedRejection);
+	}).pipe(Effect.timeoutOption(HANDOFF_TIMEOUT), Effect.map(Option.getOrElse(() => noSummary("summary-unavailable"))));
+	const produced = attempt.produced;
+	if (Option.isNone(produced)) return yield* fallback(attempt.reason ?? "summary-unavailable");
 	const preparedAt = DateTime.formatIso(yield* DateTime.now);
 	return {
 		status: "summarized",
@@ -142133,6 +143488,25 @@ const make$3 = Effect.gen(function* () {
 	*/
 	const triageSkipStreak = /* @__PURE__ */ new Map();
 	/**
+	* Consecutive status turns coalesced per pair. In-memory like the counters
+	* above, and safe there: the classification is recomputed from the same
+	* events on replay, so a restart costs at most one extra wake rather than a
+	* wrong one.
+	*/
+	const statusCoalesceStreak = /* @__PURE__ */ new Map();
+	/**
+	* The monitor tasks each pair currently has open.
+	*
+	* A progress row carries no task type, so the only thing that makes it a
+	* wait rather than unclassified work is the `task.started` that named it -
+	* and that row belongs to an earlier turn, outside the window this turn is
+	* described over. Held per pair so an open watch stays recognisable across
+	* the turns it reports through, and dropped the moment the task ends.
+	* In-memory like the counters above, and safe the same way: a restart
+	* forgets the watch and costs one extra wake rather than a wrong one.
+	*/
+	const openMonitorTaskIds = /* @__PURE__ */ new Map();
+	/**
 	* Gate detection and human-override resolution act on the CURRENT persisted
 	* gate state, so replaying them against historical events is wrong twice
 	* over: an old plan event would open a fresh gate, and an old user message
@@ -142551,15 +143925,28 @@ const make$3 = Effect.gen(function* () {
 	/**
 	* What the builder did between two review boundaries, read from the event
 	* window rather than remembered: whether supervisor advice started the turn,
-	* whether a human spoke into it, and whether any tool ran. A text-only
-	* builder question counts as idle on purpose: one or two such rounds pass
-	* unhindered, and a longer tool-free exchange is a debate the user should
-	* see rather than fund.
+	* whether a human spoke into it, whether any tool ran, and whether anything
+	* happened that a supervisor has to see. A text-only builder question counts
+	* as idle on purpose: one or two such rounds pass unhindered, and a longer
+	* tool-free exchange is a debate the user should see rather than fund.
+	*
+	* `waitMarked`, `changedState`, `failedTool` and `gateActivity` are read from
+	* activity kinds and typed task classifications alone; nothing here inspects
+	* prose. Only a live, named wait marks a turn as waiting: a wake scheduled
+	* for a real time, or a Monitor-tool task and its own progress. A command, a
+	* background shell and an unnamed task all count as work, because any of
+	* them can change the repository, and every ending - a cancelled wake, a
+	* completed task, a failure, a decline - is a result rather than a wait.
 	*/
 	const describeBuilderTurn = (input) => {
 		let startedByAdvice = false;
 		let humanMessage = false;
 		let ranTools = false;
+		let changedState = false;
+		let failedTool = false;
+		let gateActivity = false;
+		let waitMarked = false;
+		const monitorTaskIds = input.monitorTaskIds;
 		let summary;
 		const assistantMessages = /* @__PURE__ */ new Map();
 		for (const event of input.events) {
@@ -142573,12 +143960,39 @@ const make$3 = Effect.gen(function* () {
 				if (event.payload.text.startsWith("[fusion-advice]")) startedByAdvice = true;
 				else if (!isFusionProtocolText(event.payload.text)) humanMessage = true;
 			}
-			if (event.type === "thread.activity-appended" && event.payload.threadId === input.implementerThreadId && event.payload.activity.kind.startsWith("tool.")) ranTools = true;
+			if (event.type === "thread.activity-appended" && event.payload.threadId === input.implementerThreadId) {
+				const activity = event.payload.activity;
+				const activityPayload = activity.payload ?? {};
+				const unsuccessful = activityPayload.status === "failed" || activityPayload.status === "declined";
+				if (activity.kind.startsWith("tool.")) {
+					ranTools = true;
+					if (activity.kind === "tool.denied" || unsuccessful) failedTool = true;
+					else changedState = true;
+				} else if (activity.kind === "wake.scheduled") if (activityPayload.wakeAt === null || activityPayload.wakeAt === void 0) changedState = true;
+				else waitMarked = true;
+				else if (activity.kind.startsWith("task.")) {
+					if ((unsuccessful || activity.kind === "task.completed") && activityPayload.taskId !== void 0) monitorTaskIds.delete(activityPayload.taskId);
+					if (unsuccessful) failedTool = true;
+					else if (activity.kind === "task.completed") changedState = true;
+					else if (activity.kind === "task.started") {
+						const taskType = activityPayload.taskType;
+						if (taskType !== void 0 && MONITOR_TOOL_TASK_TYPES.has(taskType)) {
+							waitMarked = true;
+							if (activityPayload.taskId !== void 0) monitorTaskIds.add(activityPayload.taskId);
+						} else if (taskType === void 0 || !INERT_TASK_TYPES.has(taskType)) changedState = true;
+					} else if (activity.kind === "task.progress" && activityPayload.taskId !== void 0 && monitorTaskIds.has(activityPayload.taskId)) waitMarked = true;
+				}
+			}
+			if ((event.type === "thread-pair.gate-opened" || event.type === "thread-pair.gate-advanced" || event.type === "thread-pair.gate-resolved") && event.payload.pairId === input.pairId) gateActivity = true;
 		}
 		return {
 			startedByAdvice,
 			humanMessage,
 			ranTools,
+			changedState,
+			failedTool,
+			gateActivity,
+			waitMarked,
 			summary
 		};
 	};
@@ -143158,7 +144572,7 @@ const make$3 = Effect.gen(function* () {
 			});
 			return;
 		}
-		const idleCycles = turn.startedByAdvice && !turn.humanMessage && !turn.ranTools ? (idleAdviceCycles.get(currentPair.id) ?? 0) + 1 : 0;
+		const idleCycles = turn.startedByAdvice && !turn.humanMessage && !turn.ranTools && !turn.waitMarked && !turn.changedState && !turn.failedTool ? (idleAdviceCycles.get(currentPair.id) ?? 0) + 1 : 0;
 		idleAdviceCycles.set(currentPair.id, idleCycles);
 		if (idleCycles >= 3) {
 			idleAdviceCycles.delete(currentPair.id);
@@ -143170,6 +144584,18 @@ const make$3 = Effect.gen(function* () {
 			});
 			return;
 		}
+		const statusOnly = turn.startedByAdvice && !turn.humanMessage && turn.waitMarked && !turn.changedState && !turn.failedTool && !turn.gateActivity;
+		const streak = statusCoalesceStreak.get(currentPair.id);
+		const alreadyCounted = streak !== void 0 && completion.sequence <= streak.throughSequence;
+		const coalesced = statusOnly ? alreadyCounted ? streak.count : (streak?.count ?? 0) + 1 : 0;
+		if (statusOnly && coalesced < 5) {
+			statusCoalesceStreak.set(currentPair.id, {
+				count: coalesced,
+				throughSequence: Math.max(streak?.throughSequence ?? 0, completion.sequence)
+			});
+			return;
+		}
+		statusCoalesceStreak.delete(currentPair.id);
 		const triageSettings = yield* readTriageSettings;
 		if (triageSettings !== null) {
 			if (currentPair.triagedFromSequence !== null && completion.sequence <= currentPair.triagedFromSequence) return;
@@ -143256,13 +144682,18 @@ const make$3 = Effect.gen(function* () {
 		if (pair.reviewExperiment) completions = completions.filter((completion) => completion.payload.state === "completed").slice(-1);
 		let boundary = activationCompletion?.sequence ?? pair.lastReviewedImplementerSequence;
 		for (const completion of completions.filter((candidate) => candidate.payload.state === "completed")) {
+			const monitorTaskIds = openMonitorTaskIds.get(pair.id) ?? /* @__PURE__ */ new Set();
 			const turn = describeBuilderTurn({
 				events,
 				implementerThreadId: pair.implementerThreadId,
+				pairId: pair.id,
 				afterSequence: boundary,
 				throughSequence: completion.sequence,
-				turnId: completion.payload.turnId
+				turnId: completion.payload.turnId,
+				monitorTaskIds
 			});
+			if (monitorTaskIds.size === 0) openMonitorTaskIds.delete(pair.id);
+			else openMonitorTaskIds.set(pair.id, monitorTaskIds);
 			boundary = completion.sequence;
 			yield* processReview(pair, completion, turn);
 		}
@@ -144891,11 +146322,11 @@ const WorkspaceEntriesLayerLive = layer$17.pipe(Layer.provide(layer$70));
 const WorkspaceFileSystemLayerLive = layer$16.pipe(Layer.provide(layer$70), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$70, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$65.pipe(Layer.provide(layer$70), Layer.provide(layer$66));
-const AuthLayerLive = layer$114.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$118));
+const AuthLayerLive = layer$115.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$119));
 const ProviderRuntimeLayerLive = Layer.mergeAll(ProviderSessionReaperLive, ProviderHealthRefresherLive).pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$27), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$89)), Layer.provideMerge(layer$83), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$60), Layer.provideMerge(Layer.mergeAll(layer$59, layer$72.pipe(Layer.provide(layer$85)), layer$74, layer$69)), Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$62), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$118))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$118))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$84), Layer.provideMerge(layer$68), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$89))), Layer.provideMerge(layer$77), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$90, layer$21).pipe(Layer.provideMerge(layer$91), Layer.provideMerge(layer$92))))), Layer.provideMerge(layer$118));
-const UsageLayerLive = layer$25.pipe(Layer.provide(layer$93.pipe(Layer.provide(layer$118))));
-const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$12), Layer.provideMerge(layer$11), Layer.provideMerge(layer$10), Layer.provideMerge(layer$80), Layer.provideMerge(layer$82), Layer.provideMerge(layer$81), Layer.provide(layer$122));
+const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$27), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$89)), Layer.provideMerge(layer$83), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$60), Layer.provideMerge(Layer.mergeAll(layer$59, layer$72.pipe(Layer.provide(layer$85)), layer$74, layer$69)), Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$62), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$119))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$119))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$84), Layer.provideMerge(layer$68), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$89))), Layer.provideMerge(layer$77), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$90, layer$21).pipe(Layer.provideMerge(layer$91), Layer.provideMerge(layer$92))))), Layer.provideMerge(layer$119));
+const UsageLayerLive = layer$25.pipe(Layer.provide(layer$93.pipe(Layer.provide(layer$119))));
+const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$12), Layer.provideMerge(layer$11), Layer.provideMerge(layer$10), Layer.provideMerge(layer$80), Layer.provideMerge(layer$82), Layer.provideMerge(layer$81), Layer.provide(layer$123));
 /**
 * Hub asset sync.
 *
@@ -145547,7 +146978,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$122, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$123, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *