@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/runtime/services.ts

@@ -1,80 +1,117 @@
-import { join } from 'node:path';
-import { FocusTracker } from '../core/focus-tracker.ts';
-import { ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
+/**
+ * services.ts — the terminal app's composition root, as a CLIENT.
+ *
+ * Every gateway-serving piece — the `GatewayMethodCatalog`, the
+ * inbox/triage/drafts/routing handlers, the cluster group and its election,
+ * the device-posture runtime and its housekeeping, the mail service deps —
+ * lives in the daemon product. This composition serves no verbs, elects
+ * nothing, polls no mailbox, and supervises no remote runner. It builds what
+ * a TURN needs in this process and reaches the daemon for the rest.
+ *
+ * ── The floor comes from the SDK ───────────────────────────────────────────
+ *
+ * The loop essentials — the agent graph, the model stack, config/secrets/
+ * services, hooks, plugins, MCP, the file-tool caches, permissions as a client,
+ * the spine clients — are composed by `createClientRuntimeServices`, the SDK's
+ * one implementation of that shape. Not a fork of it and not a copy of it: the
+ * agent product composes the same function, so a wiring step added there
+ * cannot silently miss this product.
+ *
+ * The SDK's own note on that shape applies here literally: it is a FLOOR, not a
+ * ceiling. Everything below the `createClientRuntimeServices` call is what THIS
+ * surface adds on top — panels, keybindings, the WRFC controller wired over the
+ * client's own `agentManager`, the workstream engine, the fleet read model, the
+ * voice stack with its local playback sink, the knowledge stack the recall
+ * surfaces read. None of those need daemon furniture; they are simply not
+ * required for a turn to run, which is why they are here and not in the SDK's
+ * client floor.
+ *
+ * ── The two things that look like daemon furniture and are not ─────────────
+ *
+ * `sessionBroker` and `approvalBroker` are still constructed. They are this
+ * surface's own record of the sessions it is running and the asks it raised —
+ * what the transcript, the session panel and the approval card read. They are
+ * NOT authoritative: session identity is mirrored to the daemon's spine
+ * (register/heartbeat/inputs) and an ask is raised on the daemon
+ * (`approvals.raise`) so every other surface can see and answer it. Where the
+ * two disagree the daemon's record is the truth, and the client seams in
+ * runtime/client/ are what keep them in step.
+ */
+import { FocusTracker } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
-import { ChannelDeliveryRouter, ChannelPolicyManager } from '@pellux/goodvibes-sdk/platform/channels';
+import { ChannelPolicyManager } from '@pellux/goodvibes-sdk/platform/channels';
 import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
-import { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
-import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
-import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
-import { composeMailDeps } from './mail-composition.ts';
-import { composeCredentialServices } from './credential-composition.ts';
+import { createClientRuntimeServices } from '@pellux/goodvibes-sdk/platform/runtime/client-services';
+import { wireIdlePowerAndLiveTurn } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { createDisposalScope, registerSurfaceRuntimePollers } from './disposal-wiring.ts';
+import { composeCredentialServices } from './credential-composition.ts';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
-import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import { createWebKnowledgeGapRepairer } from '@pellux/goodvibes-sdk/platform/knowledge';
 import { createKnowledgeServices } from './knowledge-services.ts';
+import { cancelAllAgentRuns } from '@pellux/goodvibes-sdk/platform/tools';
 import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/goodvibes-sdk/platform/media';
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
-import { OverflowHandler, ProcessManager, cancelAllAgentRuns, createWorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
-import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath } from '@pellux/goodvibes-sdk/platform/state';
+import { MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, resolveCanonicalMemoryDbPath } from '@pellux/goodvibes-sdk/platform/state';
 import { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
 import { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
 import { createNotificationDispatcher, wireRuntimeNotificationBridge, wireMemoryPressureNotice } from './notification-dispatch.ts';
-import { createDurabilityServices } from './durability-services.ts';
+import { createDurabilityServices } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { MemorySpineClient, createLocalMemoryAccess } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import { createWorkspaceCheckpointing } from './workspace-checkpointing.ts';
-import { createSessionConversationRewindPort } from './conversation-rewind-port.ts';
 import { createDomainDispatch } from './store/index.ts';
-import { DistributedRuntimeManager, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, createShellPathService, createFeatureFlagManager, PolicyRuntimeState } from '@/runtime/index.ts';
-import { createSessionStorageServices } from './session-storage-services.ts';
+import { DistributedRuntimeManager, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, createFeatureFlagManager, createShellPathService } from '@/runtime/index.ts';
+import { createSessionStorageServices } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { VoiceProviderRegistry, VoiceService, ensureBuiltinVoiceProviders } from '@pellux/goodvibes-sdk/platform/voice';
 import { CacheRegistry, PauseController } from '@pellux/goodvibes-sdk/platform/runtime/memory';
 import { wireMemoryGovernance } from './memory-governance-services.ts';
-import { wireVoiceSetup } from './voice-setup-services.ts';
-import { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
+import { wireVoiceSetup } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { PanelManager } from '../panels/panel-manager.ts';
-import { HookActivityTracker } from '@pellux/goodvibes-sdk/platform/hooks';
-import { HookDispatcher, createHookWorkbench } from '@pellux/goodvibes-sdk/platform/hooks';
-import { PluginManager } from '@pellux/goodvibes-sdk/platform/plugins';
 import { BookmarkManager } from '@pellux/goodvibes-sdk/platform/bookmarks';
 import { ProfileManager } from '@pellux/goodvibes-sdk/platform/profiles';
-import { CrossSessionTaskRegistry, SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
+import { SessionChangeTracker } from '@pellux/goodvibes-sdk/platform/sessions';
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
-import { createRemoteExecutionServices } from './remote-execution-composition.ts';
-import { createAgentGraph } from './agent-graph-composition.ts';
-import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { createRemoteExecutionServices } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
 import { deriveFeatureStates, bindFeatureSettingsBridge } from '@pellux/goodvibes-sdk/platform/runtime/state';
-import { createChannelComposition } from './channel-composition.ts';
-import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from './provider-optimizer-wiring.ts';
-import { createFleetServices } from './fleet-services.ts';
-import { createWorkstreamServices } from './workstream-services.ts';
-import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
-import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
-import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
-import { createDevicePostureServices } from './device-posture-composition.ts';
-// Re-exported so the shell's bootstrap reaches the install through the same
-// module it already imports the runtime graph from.
-export { installDevicePosture } from './device-posture-composition.ts';
-import { createClusterServices, startClusterServices } from './cluster-group-composition.ts';
-import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
-import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
+import { createChannelComposition } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { createFleetServices } from '@pellux/goodvibes-terminal-shell';
+import { createWorkstreamServices } from '@pellux/goodvibes-sdk/platform/orchestration';
+import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { WorkspaceTrustManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { ensureConfiguredModelIsRoutable } from '@pellux/goodvibes-sdk/platform/providers';
+import { GOODVIBES_TUI_SURFACE_ROOT } from '../config/surface.ts';
+import { createDaemonVerbCaller } from './client/operator-endpoint.ts';
+import { createTerminalApprovalUpdateSubscriber } from './client/approval-updates.ts';
+import { createHostedSessionsClient } from './client/hosted-sessions.ts';
+import { getSharedHostedSessionRoster } from './client/hosted-roster.ts';
+import {
+  createClientApprovalRaiser,
+  createConversationRewindHost,
+  createDaemonConfigClient,
+  createDaemonCredentialsClient,
+  createDevicesClient,
+  createWireSessionDispatch,
+  readSurfaceAgentOutcome,
+} from '@pellux/goodvibes-sdk/platform/runtime/client';
+import { ClientBuildGuard } from './client/build-floors.ts';
+import { createFleetUnionReadModel } from './client/fleet-union.ts';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { VERSION } from '../version.ts';
+import { createSessionConversationRewindPort, hasSessionConversation } from './conversation-rewind-port.ts';
+import { createFleetReadModel } from '../panels/fleet-read-model.ts';
+import type { PermissionPromptDecision, PermissionPromptRequest } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { RuntimeServicesOptions, RuntimeServices } from './runtime-services-types.ts';
 export type { RuntimeServicesOptions, RuntimeServices } from './runtime-services-types.ts';
 
 export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeServices {
   const disposalScope = createDisposalScope('RuntimeServices'); const workingDirectory = options.workingDir; // disposal seam: see ./disposal-wiring.ts
   const homeDirectory = options.homeDirectory;
-  const shellPaths = createShellPathService({
-    workingDirectory,
-    homeDirectory,
-  });
   // Built before anything that touches session state — see session-storage-services.ts.
-  const { surface, sessionManager } = createSessionStorageServices({ workingDirectory, homeDirectory });
-  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths });
+  const { surface, sessionManager } = createSessionStorageServices({ workingDirectory, homeDirectory, surfaceRoot: GOODVIBES_TUI_SURFACE_ROOT });
   const configManager = options.configManager;
   const featureFlags = options.featureFlags ?? createFeatureFlagManager();
   if (options.featureFlags === undefined) {
@@ -83,13 +120,97 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
     bindFeatureSettingsBridge(configManager, featureFlags);
   }
+
+  // ── The client seams: one resolution of "which daemon", shared by all of them.
+  const verbs = createDaemonVerbCaller({ configManager, homeDirectory });
+  const daemonConfig = createDaemonConfigClient(verbs);
+  const devices = createDevicesClient(verbs);
+  // Daemon-hosted sessions: the session picker (built in the input layer, which
+  // has no config manager to resolve a daemon from) reads the roster; this is
+  // the one place that can give it a client. See client/hosted-roster.ts.
+  getSharedHostedSessionRoster().bindClient(createHostedSessionsClient(verbs));
+
+  // Built here rather than read off the client composition below because the
+  // approval seam it feeds is an INPUT to that composition: the path service is
+  // pure (it derives paths, it opens nothing), so building it twice costs
+  // nothing and keeps the ordering honest.
+  const shellPaths = createShellPathService({ workingDirectory, homeDirectory });
+  // The surface's own record of the asks it raised — what the approval card and
+  // the panel read. The AUTHORITATIVE record is the daemon's; the raiser below
+  // keeps the two in step (see the SDK's client/approval-raiser.ts).
+  const approvalBroker = new ApprovalBroker({
+    storePath: shellPaths.resolveProjectPath('tui', 'control-plane', 'approvals.json'),
+  });
+  // The late-bound terminal prompt: the UI layer patches the real implementation
+  // in after boot, exactly as it always did.
+  const localPromptRef: { requestPermission: (request: PermissionPromptRequest) => Promise<PermissionPromptDecision> } = {
+    requestPermission: async () => ({ approved: false, remember: false }),
+  };
+  const liveSessionIdRef: { value: string | null } = { value: null };
+  const requestApproval = createClientApprovalRaiser({
+    verbs,
+    // The SDK's raiser cannot honestly default this: it names how THIS surface
+    // reports its own decision back to the daemon (`actorSurface`), so every
+    // other surface can see where the answer came from. Reproduces the
+    // previous hard-coded `actor: 'tui', actorSurface: 'tui'` write-back exactly.
+    actor: 'tui',
+    sessionId: () => liveSessionIdRef.value,
+    // The "local prompt" is this surface's own broker plus the terminal ask:
+    // that is what puts the ask on the approval card and in the panel while the
+    // daemon holds the record every other surface reads.
+    localPrompt: () => (request) => approvalBroker.requestApproval({
+      request,
+      ...(liveSessionIdRef.value ? { sessionId: liveSessionIdRef.value } : {}),
+      localPrompt: (prompt) => localPromptRef.requestPermission(prompt),
+    }),
+    // The push channel for a decision made on another surface. Without it the
+    // raiser learns by re-reading the record on an interval; with it a phone's
+    // answer reaches this terminal in the time one SSE frame takes. The interval
+    // stays as the fallback — see client/approval-updates.ts.
+    subscribeApprovalUpdates: createTerminalApprovalUpdateSubscriber({ configManager, homeDirectory }),
+  });
+
+  // ── The SDK's client floor: everything a turn needs in this process.
+  const client = createClientRuntimeServices({
+    runtimeBus: options.runtimeBus,
+    runtimeStore: options.runtimeStore,
+    configManager,
+    surfaceRoot: GOODVIBES_TUI_SURFACE_ROOT,
+    workingDir: workingDirectory,
+    homeDirectory,
+    featureFlags,
+    requestApproval,
+    ...(options.daemonHomeDirectory === undefined ? {} : { daemonHome: options.daemonHomeDirectory }),
+  });
   const runtimeDispatch = createDomainDispatch(options.runtimeStore);
-  // Memory governance seams built EARLY (mirrors the SDK's own createRuntimeServices)
-  // so the scheduler gates and the knowledge background jobs can consult the pause
-  // controller before the MemoryGovernor (constructed at the composition tail)
-  // drives it. The admission gate is late-bound: expensive entry points capture
-  // this closure now and the governor binds into it at the tail — until then
-  // everything is admitted (the daemon is still booting).
+  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths, surfaceRoot: GOODVIBES_TUI_SURFACE_ROOT });
+  const {
+    agentManager, agentMessageBus, agentOrchestrator, archetypeLoader,
+    contextAccountingHolder, providerRegistry, providerCapabilityRegistry, cacheHitTracker,
+    favoritesStore, benchmarkStore, modelLimitsService, toolLLM,
+    secretsManager, serviceRegistry, subscriptionManager, hookDispatcher, hookActivityTracker,
+    hookWorkbench, pluginManager, workflow, artifactStore, webSearchProviders, webSearchService,
+    mcpRegistry: clientMcpRegistry, sandboxSessionRegistry: clientSandboxRegistry,
+    processManager, modeManager, fileUndoManager, overflowHandler, policyRuntimeState,
+    fileCache, projectIndex, sessionOrchestration,
+  } = client;
+  void clientMcpRegistry; void clientSandboxRegistry;
+  disposalScope.registry.add('client runtime services', () => client.dispose());
+
+  ensureConfiguredModelIsRoutable(providerRegistry, configManager);
+  providerRegistry.initCustomProviders();
+  // Background, TTL-respecting live model discovery so provider model lists
+  // refresh from their own listing APIs.
+  providerRegistry.initProviderModelDiscovery();
+
+  // A daemon-scoped credential goes to the daemon over `credentials.set`, which
+  // writes the value AND points the config key at it in one verified sequence.
+  // Everything else stays in this surface's own store.
+  const daemonCredentials = createDaemonCredentialsClient(verbs);
+
+  // Memory governance seams built EARLY so the scheduler gates and the knowledge
+  // background jobs can consult the pause controller before the MemoryGovernor
+  // (constructed at the composition tail) drives it.
   const cacheRegistry = new CacheRegistry();
   const pauseController = new PauseController();
   const MEMORY_BACKGROUND_JOB_IDS = ['knowledge-self-improvement', 'memory-consolidation', 'code-index-reindex'];
@@ -97,11 +218,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const admitExpensiveWork = (label: string): { allowed: boolean; reason?: string | undefined } =>
     admitExpensiveWorkRef.current?.(label) ?? { allowed: true };
   const isKnowledgeBackgroundPaused = (): boolean => pauseController.isPaused('knowledge-self-improvement');
-  const gatewayMethods = new GatewayMethodCatalog();
   const panelManager = new PanelManager();
-  // (the purge): MIGRATE-TO-MODAL surface + redirect registration moved to
-  // registerBuiltinPanels (builtin-panels.ts), where the panels' resolved deps
-  // are available for the surfaces to close over.
   const keybindingsManager = new KeybindingsManager({
     configPath: shellPaths.resolveUserPath('tui', 'keybindings.json'),
   });
@@ -112,72 +229,27 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeBus: options.runtimeBus,
     featureFlags,
   });
-  // The credential/identity seam (credential-composition.ts).
-  const { secretsManager, stepUpService, pairingTokens } = composeCredentialServices({
+  // An EMPTY catalog. This product answers no verbs; the field exists only
+  // because the SDK's startExternalServices takes a daemon-grade graph even in
+  // the adopt-only mode this surface runs in, and because plugin loading is
+  // handed one. With adoptOnly no DaemonServer is constructed, so nothing is
+  // ever served off it.
+  const gatewayMethods = new GatewayMethodCatalog();
+  // The credential/identity seam (credential-composition.ts) — this
+  // installation's own pairing tokens and step-up service.
+  const { stepUpService, pairingTokens } = composeCredentialServices({
     workingDirectory, homeDirectory, configManager,
-    daemonHomeDirectory: options.daemonHomeDirectory,
+    ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
     pairingTokenPath: shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'),
   });
-  const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
-  const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
-    secretsManager,
-    subscriptionManager,
-  });
-  const providerCapabilityRegistry = new ProviderCapabilityRegistry();
-  const cacheHitTracker = new CacheHitTracker();
-  const favoritesStore = new FavoritesStore({ dir: shellPaths.resolveUserPath('tui') });
-  const benchmarkStore = new BenchmarkStore({ dir: shellPaths.resolveUserPath('tui') });
-  const modelLimitsService = new ModelLimitsService({
-    cachePath: shellPaths.resolveUserPath('tui', 'model-limits.json'),
-  });
-  const providerRegistry = new ProviderRegistry({
-    configManager,
-    subscriptionManager,
-    secretsManager,
-    serviceRegistry,
-    capabilityRegistry: providerCapabilityRegistry,
-    cacheHitTracker,
-    favoritesStore,
-    benchmarkStore,
-    modelLimitsService,
-    featureFlags,
-    runtimeBus: options.runtimeBus,
-  });
-  ensureConfiguredModelIsRoutable(providerRegistry, configManager);
-  providerRegistry.initCustomProviders();
-  // Kick off the background, TTL-respecting live model discovery sweep so
-  // provider model lists refresh from their own listing APIs — matching the
-  // SDK and agent compositions (this call was the one omitted here).
-  providerRegistry.initProviderModelDiscovery();
-  const toolLLM = new ToolLLM({
-    configManager,
-    providerRegistry,
-  });
   const localUserAuthManager = options.localUserAuthManager ?? new UserAuthManager({
     bootstrapFilePath: shellPaths.resolveUserPath('tui', 'auth-users.json'),
     bootstrapCredentialPath: shellPaths.resolveUserPath('tui', 'auth-bootstrap.txt'),
   });
   const profileManager = new ProfileManager(shellPaths.resolveUserPath('tui', 'profiles'));
   const bookmarkManager = new BookmarkManager(shellPaths.resolveUserPath('tui', 'bookmarks'));
-  const sessionOrchestration = new CrossSessionTaskRegistry(
-    join(surface.sessionsDir, 'task-graph.json'),
-  );
-  const hookActivityTracker = new HookActivityTracker();
-  // featureFlags is REQUIRED here in practice, even though the SDK types it
-  // optional. isFeatureGateEnabled(null, ...) is permissive by design — a
-  // narrow embed with no manager wired gets the capability rather than a
-  // silent off — so omitting it did not disable the watcher framework when
-  // watchers.enabled is turned off; it made the setting configure nothing.
-  // Threading it preserves current effective behaviour rather than changing
-  // it: watchers.enabled defaults true, the watcher-framework flag's own
-  // defaultState is 'enabled', and the flag declares no notOperable record —
-  // so with nothing configured the gate reads exactly as before, and the
-  // difference is only that turning it OFF now turns it off. This composes
-  // with bootstrap-core.ts's own `if (configManager.get('watchers.enabled'))`
-  // check around the built-in polling watcher registration: that check reads
-  // the same key, so the two never disagree, and this fix only reaches the
-  // watcher registry's OTHER entry points (registerWatcher/startWatcher/etc.)
-  // that bootstrap-core.ts's narrower check does not cover.
+  // The watcher framework is the daemon's to RUN; this registry is the surface's
+  // read/edit handle on the same store, so `/watch` still lists and edits.
   const watcherRegistry = new WatcherRegistry({
     storePath: shellPaths.resolveProjectPath('tui', 'watchers.json'),
     featureFlags,
@@ -186,31 +258,60 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
   });
-  // The agent-execution graph, wired in both directions; see
-  // agent-graph-composition.ts for why the six are built as one.
-  const {
-    agentMessageBus, archetypeLoader, agentOrchestrator,
-    agentManager, contextAccountingHolder, wrfcController,
-  } = createAgentGraph({
-    runtimeBus: options.runtimeBus, workingDirectory, configManager, providerRegistry,
-  });
-  const hookDispatcher = new HookDispatcher({ agentManager, toolLLM, projectRoot: workingDirectory }, hookActivityTracker);
-  configManager.attachHookDispatcher(hookDispatcher);
-  const hookWorkbench = createHookWorkbench({
-    hookDispatcher,
+  // WRFC over the client's own agent graph — the "floor, not ceiling" case,
+  // verbatim: the review/fix workstream controller needs the agent manager and
+  // the message bus, and nothing daemon-side at all.
+  const wrfcController = new WrfcController(options.runtimeBus, agentMessageBus, {
+    agentManager,
     configManager,
+    projectRoot: workingDirectory,
   });
-  const approvalBroker = new ApprovalBroker({
-    storePath: shellPaths.resolveProjectPath('tui', 'control-plane', 'approvals.json'),
-  });
+  agentManager.setWrfcController(wrfcController);
   const sessionBroker = new SharedSessionBroker({
     storePath: shellPaths.resolveProjectPath('tui', 'control-plane', 'sessions.json'),
     routeBindings,
     agentStatusProvider: agentManager,
     messageSender: agentMessageBus,
-    conversationGateConfig: configManager, // without this the gate runs on DEFAULTS: an inbound message landing in a live session takes the handover and starts work whatever conversationGate.mode/gatedSurfaces say
-  });
-  sessionBroker.setContinuationRunner(async ({ task, input }) => {
+    conversationGateConfig: configManager, // without this the gate runs on DEFAULTS
+  });
+  // Work that arrives for a session THIS surface hosts reaches the loop through
+  // the same runner whether it came from the local broker or from the daemon's
+  // queue. The wire half is inert until bootstrap.ts adopts a daemon (see
+  // the SDK's client/session-dispatch.ts); binding one runner to both is what stops a
+  // continuation delivered over the wire from taking a different path — and a
+  // different set of routing options — than one raised locally.
+  const wireSessionDispatch = createWireSessionDispatch({
+    hostedSessionIds: () => (liveSessionIdRef.value ? [liveSessionIdRef.value] : []),
+    // The reply half. A continuation dispatched here runs in THIS process, so
+    // the daemon's own completion poll can never see it finish; this is how the
+    // answer gets reported back, and how a message that arrived over a channel
+    // is answered into that channel instead of into nothing.
+    readAgentOutcome: (agentId) => readSurfaceAgentOutcome(agentManager.getStatus(agentId)),
+  });
+  disposalScope.registry.add('wire session dispatch', () => wireSessionDispatch.stop());
+  // A daemon update swaps the daemon binary and leaves this terminal running
+  // the build it started with. The daemon announces the minimum client build it
+  // accepts on the /status read the attach handshake already makes; when this
+  // build is below it the guard latches, the owner is told on the same surface
+  // daemon notices already render, and the runner below stops taking
+  // shared-session work rather than executing it under superseded rules. See
+  // client/build-floors.ts; bootstrap.ts feeds the reads and attaches the
+  // notice sink.
+  const clientBuildGuard = new ClientBuildGuard({ clientVersion: VERSION });
+  // The parameter type comes from the broker's own runner rather than being
+  // re-declared: a hand-written copy would drift from the routing options the
+  // spawn actually forwards, and the drift would be silent.
+  type ContinuationRequest = Parameters<NonNullable<Parameters<typeof sessionBroker.setContinuationRunner>[0]>>[0];
+  const continuationRunner = async ({ task, input }: ContinuationRequest): Promise<{ agentId: string } | null> => {
+    // Too old for the live daemon: refuse the work instead of doing it the old
+    // way. The owner has already been told to restart this terminal.
+    if (!clientBuildGuard.maySharedSessionWork()) {
+      logger.warn('declined a shared-session continuation: this build is below the daemon floor', {
+        sessionId: input.sessionId,
+        floor: clientBuildGuard.current().floor,
+      });
+      return null;
+    }
     const record = agentManager.spawn({
       mode: 'spawn',
       task,
@@ -230,10 +331,11 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
       context: `shared-session:${input.sessionId}`,
     });
     return { agentId: record.id };
-  });
-  const artifactStore = new ArtifactStore({ configManager });
+  };
+  sessionBroker.setContinuationRunner(continuationRunner);
+  wireSessionDispatch.setContinuationRunner(continuationRunner);
   const memoryEmbeddingRegistry = new MemoryEmbeddingProviderRegistry({ configManager });
-  // Open the ONE home-scoped canonical store; legacy per-project TUI memory folds in at boot (foldTuiLegacyMemory).
+  // Open the ONE home-scoped canonical store; legacy per-project TUI memory folds in at boot (foldLegacyProjectMemory).
   const memoryDbPath = resolveCanonicalMemoryDbPath(homeDirectory);
   const memoryStore = new MemoryStore(memoryDbPath, {
     embeddingRegistry: memoryEmbeddingRegistry,
@@ -243,22 +345,8 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // modal): bootstrap.ts activates the wire transport when a compatible
   // external daemon is adopted, same signal as the session spine.
   const memorySpine = new MemorySpineClient({ local: createLocalMemoryAccess(memoryRegistry) });
-  // featureFlags is REQUIRED here in practice, even though the SDK types it
-  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
-  // omitting it did not disable delivery tracking when
-  // integrations.deliveryTracking is turned off — it made the setting
-  // configure nothing: deliverText/deliverJobRun kept running either way.
-  // Threading it preserves current effective behaviour rather than changing
-  // it: the config default is true, the delivery-engine flag's own
-  // defaultState is 'enabled', and the flag declares no notOperable record —
-  // so with nothing configured the gate reads exactly as before.
   const deliveryManager = new AutomationDeliveryManager({
     configManager,
-    // This manager builds the delivery router the daemon actually replies
-    // through (bootstrap.ts hands it to the daemon facade). Without the
-    // secrets manager it cannot resolve a goodvibes://secrets/... credential,
-    // so Telegram accepted every inbound message and dropped every reply with
-    // "Missing Telegram bot token" while ntfy — which needs no secret — worked.
     secretsManager,
     serviceRegistry,
     runtimeBus: options.runtimeBus,
@@ -267,18 +355,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     artifactStore,
     featureFlags,
   });
-  // Same shape as deliveryManager above: automation.enabled defaults true,
-  // the automation-domain flag's own defaultState is 'enabled', so threading
-  // featureFlags here does not change what a default install does — it only
-  // makes turning automation.enabled off actually turn AutomationManager's own
-  // create/update/run/list surface off. This composes with bootstrap.ts's own
-  // `if (configManager.get('automation.enabled'))` gate around scheduling
-  // automationManager.start(): that check reads the same key, and
-  // AutomationManager.start() re-checks the same gate internally (it no-ops
-  // and stops rather than starting when disabled), so the two can never
-  // disagree — this fix only reaches the manager's OTHER entry points
-  // (createJob/updateJob/runNow/etc.) that the bootstrap.ts gate does not
-  // cover, the same way watchers.enabled and the watcher registry above do.
   const automationManager = new AutomationManager({
     configManager,
     defaultSurfaceKind: 'tui',
@@ -287,8 +363,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
     deliveryManager,
-    // Same live registry: a bare model id on an automation job resolves through
-    // the shared resolver instead of a format-only rejection.
     providerRegistry,
     featureFlags,
     spawnTask: (input) => {
@@ -315,32 +389,18 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     knowledgeService, agentKnowledgeService, homeGraphService,
     projectPlanningService, projectPlanningProjectId, workPlanStore,
   } = createKnowledgeServices({ configManager, providerRegistry, artifactStore, memoryRegistry, runtimeBus: options.runtimeBus, workingDirectory, homeDirectory, isBackgroundPaused: isKnowledgeBackgroundPaused, admitExpensiveWork });
+  // Voice: the PROVIDERS are local (a spoken turn plays out of this terminal's
+  // own speaker) — synthesis reaches `voice.tts.stream` when a daemon serves it
+  // and falls back to a local provider otherwise; see audio/spoken-turn-wiring.ts.
   const voiceProviders = new VoiceProviderRegistry();
   ensureBuiltinVoiceProviders(voiceProviders, { readConfig: (key) => configManager.get(key as Parameters<typeof configManager.get>[0]) });
   const voiceService = new VoiceService(voiceProviders);
-  const webSearchProviders = new WebSearchProviderRegistry({
-    env: process.env,
-    serviceRegistry,
-  });
-  const webSearchService = new WebSearchService(webSearchProviders, {
-    serviceRegistry,
-    featureFlags,
-  });
   for (const [semantic, ingest] of [[knowledgeSemanticService, knowledgeService], [agentKnowledgeSemanticService, agentKnowledgeService], [homeGraphSemanticService, homeGraphService]] as const) {
     semantic.setGapRepairer(createWebKnowledgeGapRepairer({ searchService: webSearchService, ingestService: ingest }));
   }
   const mediaProviders = new MediaProviderRegistry();
   ensureBuiltinMediaProviders(mediaProviders, artifactStore, providerRegistry);
   const multimodalService = new MultimodalService(artifactStore, mediaProviders, voiceService, knowledgeService);
-  const pluginManager = new PluginManager({
-    pathOptions: {
-      cwd: shellPaths.workingDirectory,
-      homeDir: shellPaths.homeDirectory,
-    },
-    stateFilePath: shellPaths.resolveUserPath('tui', 'plugins.json'),
-  });
-  const workflow = createWorkflowServices();
-  hookDispatcher.setTriggerManager(workflow.triggerManager);
   const channelPolicy = new ChannelPolicyManager({
     storePath: shellPaths.resolveProjectPath('tui', 'channels', 'policies.json'),
   });
@@ -352,34 +412,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     approvalBridge: approvalBroker,
     automationBridge: automationManager,
   });
-  // The paired-phone feature for this host, on the SAME runtime phones pair onto
-  // and the SAME approval broker every other confirmation rides. Every `device.*`
-  // setting is read live through this; see device-posture-composition.ts.
-  const { devicePosture } = createDevicePostureServices({
-    configManager,
-    distributedRuntime,
-    approvals: approvalBroker,
-    stateDirectory: shellPaths.resolveProjectPath('tui', 'devices'),
-    gatewayMethods,
-  });
-
-  // Which machines on this network are "us", and which of them reads the
-  // shared inbox. Both inert until startCluster() — no socket, no key material
-  // read; see cluster-group-composition.ts for why they are built together.
-  const { clusterGroup, clusterCoordinator } = createClusterServices({
-    configManager, shellPaths, secretsManager,
-  });
-  // Daemon handler surfaces (see daemon-handler-composition.ts); the inbox
-  // poller registers itself with the coordinator rather than starting eagerly.
-  const daemonHandlers = createDaemonHandlerComposition({
-    gatewayMethods,
-    secretsManager,
-    configManager,
-    workingDirectory,
-    homeDirectory,
-    distributedRuntime,
-    clusterCoordinator,
-  });
 
   // Remote runners and the sandboxes tool calls are confined to; see
   // remote-execution-composition.ts for why the four are built as one.
@@ -387,24 +419,13 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     = createRemoteExecutionServices({
       agentManager, workingDirectory, hookDispatcher, configManager, runtimeBus: options.runtimeBus,
     });
-  // featureFlags is REQUIRED here in practice, even though the SDK types it
-  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
-  // omitting it did not disable managed blocking when
-  // security.tokenAudit.enabled is turned off. Threading it preserves current
-  // effective behaviour rather than changing it: managed is hardcoded false
-  // here (advisory reporting only; excess-scope/overdue tokens are reported,
-  // never blocked, regardless of this flag — see isBlocked()'s
-  // `this._config.managed && this._managedBlockingEnabled()` guard), the
-  // config default for security.tokenAudit.enabled is true, and the
-  // token-scope-rotation-audit flag's own defaultState is 'enabled' — so with
-  // nothing configured the gate reads exactly as before either way.
   const tokenAuditor = new ApiTokenAuditor({ managed: false, featureFlags });
   const componentHealthMonitor = new ComponentHealthMonitor();
   const worktreeRegistry = new WorktreeRegistry(workingDirectory);
   const webhookNotifier = new WebhookNotifier();
   const focusTracker = new FocusTracker();
   const replayEngine = new DeterministicReplayEngine(workingDirectory);
-  const providerOptimizer = new ProviderOptimizer(providerRegistry, providerCapabilityRegistry, false); // dark until its gate flips it (see provider-optimizer-wiring.ts)
+  const providerOptimizer = client.providerOptimizer;
   bindProviderOptimizerFeatureFlag(featureFlags, providerOptimizer);
   applyProviderOptimizerConfigMode(configManager, providerOptimizer);
   const sessionMemoryStore = new SessionMemoryStore();
@@ -412,63 +433,60 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const planManager = new ExecutionPlanManager(workingDirectory);
   const adaptivePlanner = new AdaptivePlanner();
   const idempotencyStore = new IdempotencyStore();
-  const overflowHandler = new OverflowHandler({ baseDir: workingDirectory });
-  const policyRuntimeState = new PolicyRuntimeState();
-  const fileCache = new FileStateCache();
-  const projectIndex = new ProjectIndex(workingDirectory);
-  const channelDeliveryRouter = new ChannelDeliveryRouter({
-    configManager,
-    secretsManager,
-    serviceRegistry,
-    artifactStore,
-  });
-  const processManager = new ProcessManager();
-  // The phase/work-item orchestration engine, constructed
-  // before the process registry so its fleet nodes (workstream/phase/
-  // work-item) can be folded in below via the registry's optional
-  // orchestrationEngine dep.
+  // ONE router, not two. This surface used to build a second ChannelDeliveryRouter
+  // from the same four arguments AutomationDeliveryManager builds its own from,
+  // and expose that second one — so the router on the service surface and the
+  // router replies actually leave through were different objects, and a delivery
+  // strategy registered on the exposed one reached nothing. The SDK's
+  // RuntimeServices contract requires the field; it now names the real router.
+  const channelDeliveryRouter = deliveryManager.getDeliveryRouter();
+  // The phase/work-item orchestration engine, constructed before the process
+  // registry so its fleet nodes can be folded in below.
   const { orchestrationEngine, workstreamCommands } = createWorkstreamServices({
     agentManager, configManager, adaptivePlanner, runtimeBus: options.runtimeBus, projectRoot: workingDirectory,
   });
-  // Repo source-tree code index, sharing memoryEmbeddingRegistry
-  // with MemoryStore above. Auto-build is config-gated (default off) — see
-  // code-index-services.ts's header doc.
-  const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry, isReindexPaused: () => pauseController.isPaused('code-index-reindex'), admitExpensiveWork });
-  // Store snapshots, the periodic append-only sweep, durable remembered-approval rules + the live credential chain — see durability-services.ts.
+  // Repo source-tree code index, sharing memoryEmbeddingRegistry with MemoryStore.
+  const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, surfaceRoot: GOODVIBES_TUI_SURFACE_ROOT, configManager, memoryEmbeddingRegistry, isReindexPaused: () => pauseController.isPaused('code-index-reindex'), admitExpensiveWork });
+  const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler };
+  // Store snapshots, the periodic append-only sweep, durable remembered-approval rules + the live credential chain.
   const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping, stopConfigWatch } = createDurabilityServices({
-    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), surface, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
-    ...(options.currentSessionId ? { currentSessionId: options.currentSessionId } : {}), // exempts the running session from crash-residue reaping
+    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory, GOODVIBES_TUI_SURFACE_ROOT), surface, shellPaths,
+    ...(options.currentSessionId ? { currentSessionId: options.currentSessionId } : {}),
   });
-  const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Code-injection seam (agent here; main via orchestrator-core-services.ts)
-  const { processRegistry } = createFleetServices({ // Shared archive-aware fleet registry (+ daemon observed rows) — see fleet-services.ts
+  const { processRegistry } = createFleetServices({ // Shared archive-aware fleet registry — see fleet-services.ts
     agentManager, wrfcController,
-    orchestrationEngine, // Folds workstream/phase/work-item nodes into the fleet
-    codeIndexService: codeIndexStore, // Folds a single 'code-index' node into the fleet
+    orchestrationEngine,
+    codeIndexService: codeIndexStore,
     processManager, watcherRegistry, workflow, approvalBroker, sessionBroker,
-    messageBus: agentMessageBus, // Backs steer()/`steerable` (the Fleet steer composer builds on top)
-    automationManager, // Folds /schedule AutomationJobs into the fleet as 'schedule' nodes
+    messageBus: agentMessageBus,
+    automationManager,
     runtimeBus: options.runtimeBus,
-    observeExternalAgents: options.observeExternalAgents, providerRegistry, // observeExternalAgents is daemon-side only
+    providerRegistry,
   });
-  // featureFlags is REQUIRED here in practice, even though the SDK types it
-  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
-  // omitting it did not disable the HITL UX mode system when
-  // behavior.hitlMode is set to 'off' — setHITLMode/setDomainVerbosity kept
-  // accepting writes either way. Threading it preserves current effective
-  // behaviour rather than changing it: behavior.hitlMode defaults to
-  // 'balanced' (not 'off'), and the hitl-ux-modes flag's own defaultState is
-  // 'enabled' — so with nothing configured the gate reads exactly as before.
-  const modeManager = new ModeManager({ featureFlags }); const fileUndoManager = new FileUndoManager();
+  // What the Fleet panel reads: this surface's own live registry UNION the
+  // adopted daemon's rows. The daemon runs work no registry here knows about
+  // (scheduled jobs, channel-driven runs, sessions other surfaces started, the
+  // external agents it observes), and a panel showing only half the fleet is
+  // worse than one showing none — the half it shows looks complete.
+  const fleetReadModel = createFleetUnionReadModel({
+    local: createFleetReadModel(processRegistry, options.runtimeBus),
+    verbs,
+  });
+  disposalScope.registry.add('fleet union refresh', () => fleetReadModel.stop());
+  // Conversation-scope rewind, from ANY surface. The daemon holds the
+  // checkpoint store and answers the files half; the messages live in this
+  // process, so this offers them and answers the daemon's questions about them.
+  // Started on adoption (bootstrap.ts), released on disposal.
+  const conversationRewindHost = createConversationRewindHost({
+    verbs,
+    port: createSessionConversationRewindPort(),
+    hosts: hasSessionConversation,
+    label: 'the terminal app',
+  });
+  disposalScope.registry.add('conversation rewind host', () => { void conversationRewindHost.stop(); });
   const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, surface, runtimeBus: options.runtimeBus, configManager });
-  // memory-consolidation honors governor backpressure: it ticks only when idle
-  // AND the 'memory-consolidation' job is not paused AND expensive work is
-  // admitted (mirrors the SDK's own createRuntimeServices idle gate).
   const { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls } = wireIdlePowerAndLiveTurn({ configManager, memoryRegistry, runtimeBus: options.runtimeBus, isIdle: () => sessionBroker.countBusySessions() === 0 && !pauseController.isPaused('memory-consolidation') && admitExpensiveWork('memory consolidation').allowed, snapshotTick: () => storeSnapshotScheduler.tick(), heartbeat: async () => { await automationManager.triggerHeartbeat({ source: 'wake-catchup' }); }, powerSeam: options.powerSeam });
 
-  // Construct + start the MemoryGovernor (default ON — a safety feature) with
-  // the standard KNOWN cache adapters (knowledge stores + shared session
-  // broker), then late-bind the admission gate the expensive entry points
-  // captured earlier. Mirrors the SDK's own createRuntimeServices composition tail.
   const { memoryGovernor } = wireMemoryGovernance({
     configManager,
     runtimeBus: options.runtimeBus,
@@ -478,8 +496,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     receiptPath: shellPaths.resolveProjectPath('tui', 'memory', 'tripwire-receipt.json'),
     knowledgeStores: [knowledgeStore, agentKnowledgeStore, homeGraphKnowledgeStore],
     sessionBroker,
-    // Graceful tripwire shutdown flushes in-flight state via ASYNC store
-    // snapshots so the governor's 10s shutdown ceiling stays enforceable.
     onTripwireShutdown: async () => { await storeSnapshotScheduler.snapshotAllAsync('tripwire'); },
   });
   admitExpensiveWorkRef.current = (label) => memoryGovernor.admitExpensiveWork(label);
@@ -487,17 +503,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // Managed local-voice provisioning (voice.local.status/install) — single-flight
   // one-act install + no-network status; see voice-setup-services.ts.
   const { voiceSetup, stopWakeHousekeeping } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork,
-    // Boot provisioning of the wake-word model + its recovery sweep, opted into
-    // by the real entrypoints only (same treatment as powerSeam) so a one-shot
-    // CLI command and a test composing this graph fetch nothing and start no timer.
     provisionWakeModelsAtBoot: options.provisionWakeModelsAtBoot === true });
+  void voiceSetup;
 
-  // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
-  // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
-  const { emailServiceDeps, describeEmailConfigProblem } = composeMailDeps({ configManager, secretsManager });
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { homeDirectory, emailServiceDeps, describeEmailConfigProblem, processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
-  // surface-scoped: continuity's recovery-file check must read the SAME paths
-  // the app writes with, not the unscoped legacy pair.
   const integrationHelpers = new IntegrationHelperService({
     surface, configManager, automationManager, approvalBroker, sessionBroker, distributedRuntime,
     remoteRunnerRegistry, remoteSupervisor, panelManager, localUserAuthManager, providerRegistry,
@@ -505,12 +513,13 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore, runtimeBus: options.runtimeBus,
     getConversationTitle: options.getConversationTitle,
   });
-  // A loopback fetch that isn't allow-listed asks once through the approval
-  // broker; "allow for this project" persists and later fetches never ask. Built
-  // once and shared with the tool registry (bootstrap-core) so both ask alike.
-  const localhostFetchApproval = buildLocalhostFetchApproval({ requestApproval: (input) => approvalBroker.requestApproval(input), configManager });
-  // Exec stuck on a terminal prompt rides the approval broker; the typed answer feeds the continuing run. Built once and shared (like localhostFetchApproval) so the tool registry AND every setDependencies site — incl. the post-clobber rewire in bootstrap-core — install the SAME handler; otherwise a wholesale replace drops it and interactive prompts hang.
-  const execPromptAnswerHandler = buildExecPromptAnswerHandler({ requestApproval: (input) => approvalBroker.requestApproval(input) });
+  // A loopback fetch that isn't allow-listed asks once through the CLIENT raiser;
+  // "allow for this project" persists and later fetches never ask.
+  const localhostFetchApproval = buildLocalhostFetchApproval({ requestApproval: (input) => requestApproval(input), configManager });
+  // Exec stuck on a terminal prompt rides the same raiser; the typed answer feeds
+  // the continuing run. Built once and shared with every setDependencies site —
+  // a wholesale replace that forgets it hangs interactive prompts.
+  const execPromptAnswerHandler = buildExecPromptAnswerHandler({ requestApproval: (input) => requestApproval(input) });
   agentOrchestrator.setDependencies({
     surfaceRoot: surface.surfaceRoot,
     execPromptAnswerHandler,
@@ -542,13 +551,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     contextAccountingHolder,
   });
 
-  // Give the panel_only notification target a live producer: curated
-  // runtime-domain events route through the notification router into the shared
-  // panel feed (panel_only and burst-collapsed decisions land there).
+  // Give the panel_only notification target a live producer.
   const notificationDispatcher = createNotificationDispatcher(configManager);
   wireRuntimeNotificationBridge(options.runtimeBus, notificationDispatcher);
-  // OPS_MEMORY_PRESSURE is lifted into the notice feed on its own targeted
-  // bridge (the high-churn 'ops' domain stays out of the wholesale allowlist).
   wireMemoryPressureNotice(options.runtimeBus, notificationDispatcher);
 
   const services: RuntimeServices = {
@@ -570,6 +575,19 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     channelDeliveryRouter,
     watcherRegistry,
     approvalBroker,
+    requestApproval,
+    daemonVerbs: verbs,
+    wireSessionDispatch,
+    clientBuildGuard,
+    conversationRewindHost,
+    gatewayMethods,
+    stepUpService,
+    pairingTokens,
+    devices,
+    daemonConfig,
+    daemonCredentials,
+    localPromptRef,
+    liveSessionIdRef,
     localhostFetchApproval,
     execPromptAnswerHandler,
     notificationDispatcher,
@@ -577,7 +595,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     sessionBroker,
     deliveryManager,
     automationManager,
-    gatewayMethods,
     artifactStore,
     knowledgeService,
     agentKnowledgeService,
@@ -590,8 +607,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     memorySpine,
     serviceRegistry,
     secretsManager,
-    stepUpService,
-    pairingTokens,
     subscriptionManager,
     localUserAuthManager,
     profileManager,
@@ -628,11 +643,6 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     providerRegistry,
     toolLLM,
     distributedRuntime,
-    devicePosture,
-    daemonHandlers,
-    clusterCoordinator,
-    clusterGroup,
-    startCluster: () => startClusterServices({ clusterGroup, clusterCoordinator }),
     remoteRunnerRegistry,
     remoteSupervisor,
     sessionMemoryStore,
@@ -662,17 +672,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     pauseController,
     sessionLiveTurnControls,
     processRegistry,
+    fleetReadModel,
     modeManager,
     fileUndoManager,
     workspaceCheckpointManager,
     integrationHelpers,
-    rerootStores: createStoreRerooter({ codeIndexStore, projectIndex }),
-    // Cancels the agent runs this graph was hosting. By dispose() time the
-    // fleet registry, orchestration engine, process registry and bus these runs
-    // report through are already down, so a run still described as "running" is
-    // orphaned rather than preserved — and this is the only shutdown-reachable
-    // way to abort its in-flight provider call instead of letting it sleep out
-    // a retry backoff nobody is waiting on.
+    rerootStores: createStoreRerooter({ codeIndexStore, projectIndex, surfaceRoot: GOODVIBES_TUI_SURFACE_ROOT }),
     cancelHostedAgentRuns: () => cancelAllAgentRuns(agentManager),
     dispose: (): void => disposalScope.dispose(),
   };