@quantiya/codevibe-claude-plugin 2.0.22 → 2.0.24

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -1042,6 +1042,7 @@ __export(cli_exports, {
   CliEntitlementError: () => CliEntitlementError,
   CliUsageError: () => CliUsageError,
   LocalModelPlannerUnavailableAdapter: () => LocalModelPlannerUnavailableAdapter,
+  ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS: () => ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS,
   OrchestrationSessionBootstrapError: () => OrchestrationSessionBootstrapError,
   PlannerUnavailableError: () => PlannerUnavailableError,
   bridgeAuthorityErrorToShellRefusal: () => bridgeAuthorityErrorToShellRefusal,
@@ -1067,7 +1068,8 @@ __export(cli_exports, {
   resumeOrCreateSession: () => resumeOrCreateSession2,
   runAuditCli: () => runAuditCli,
   runModelCli: () => runModelCli,
-  runWithAdmittedSessionOwnership: () => runWithAdmittedSessionOwnership
+  runWithAdmittedSessionOwnership: () => runWithAdmittedSessionOwnership,
+  triggerStartupOrphanSweep: () => triggerStartupOrphanSweep
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_crypto19 = require("node:crypto");
@@ -1173,9 +1175,9 @@ var import_os = __toESM(require("os")), import_path = __toESM(require("path")),
     }
   }
 }, currentConfig = null, configInitialized = !1;
-function getEnvironment() {
-  let env = process.env.ENVIRONMENT;
-  return env === "development" || env === "production" || env === "experiment" ? env : "production";
+function getEnvironment(env = process.env) {
+  let target = env.ENVIRONMENT;
+  return target === "development" || target === "production" || target === "experiment" ? target : "production";
 }
 function loadConfig(environment) {
   let env = environment || getEnvironment();
@@ -4467,6 +4469,18 @@ var RECONNECT_CONFIG = {
 function shouldDeliverSubscribedEvent(event, receiveDesktopEvents) {
   return !!(event.source === "MOBILE" /* MOBILE */ || receiveDesktopEvents && event.source === "DESKTOP" /* DESKTOP */);
 }
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 12e4, MIN_HEARTBEAT_INTERVAL_MS = 1e3, MAX_HEARTBEAT_INTERVAL_MS = 3e5;
+function isRecognizedNonProductionEnvironment(env = process.env) {
+  let canonicalEnv = getEnvironment(env);
+  return canonicalEnv === "development" || canonicalEnv === "experiment";
+}
+function resolveHeartbeatIntervalMs(override, env = process.env) {
+  let candidate;
+  if (override !== void 0 ? candidate = override : isRecognizedNonProductionEnvironment(env) && env.CODEVIBE_HEARTBEAT_INTERVAL_MS !== void 0 && (candidate = env.CODEVIBE_HEARTBEAT_INTERVAL_MS), candidate == null || candidate === "")
+    return DEFAULT_HEARTBEAT_INTERVAL_MS;
+  let num = typeof candidate == "number" ? candidate : Number(candidate);
+  return !Number.isFinite(num) || !Number.isInteger(num) || num < MIN_HEARTBEAT_INTERVAL_MS || num > MAX_HEARTBEAT_INTERVAL_MS ? DEFAULT_HEARTBEAT_INTERVAL_MS : num;
+}
 var AppSyncClient = class _AppSyncClient {
   constructor() {
     this.authenticated = !1;
@@ -7212,14 +7226,14 @@ var AppSyncClient = class _AppSyncClient {
    * Start periodic heartbeat for a session.
    * Updates lastHeartbeatAt on the session every intervalMs (default 2 minutes).
    */
-  startHeartbeat(sessionId, intervalMs = 120 * 1e3) {
-    let existingConfirmation = this.heartbeatInitialPulses.get(sessionId);
+  startHeartbeat(sessionId, intervalMs) {
+    let effectiveIntervalMs = resolveHeartbeatIntervalMs(intervalMs), existingConfirmation = this.heartbeatInitialPulses.get(sessionId);
     if (existingConfirmation) return existingConfirmation;
-    let confirmation = this.startHeartbeatOutcome(sessionId, intervalMs).then((value) => (value === "retired" && this.notifyRetiredSession(sessionId), value === "confirmed"));
+    let confirmation = this.startHeartbeatOutcome(sessionId, effectiveIntervalMs).then((value) => (value === "retired" && this.notifyRetiredSession(sessionId), value === "confirmed"));
     return this.heartbeatInitialPulses.set(sessionId, confirmation), confirmation;
   }
-  startHeartbeatOutcome(sessionId, intervalMs = 120 * 1e3) {
-    let existingToken = this.heartbeatTokens.get(sessionId), existingTimer = this.heartbeatTimers.get(sessionId);
+  startHeartbeatOutcome(sessionId, intervalMs) {
+    let effectiveIntervalMs = resolveHeartbeatIntervalMs(intervalMs), existingToken = this.heartbeatTokens.get(sessionId), existingTimer = this.heartbeatTimers.get(sessionId);
     if (existingToken && existingTimer) {
       let existingOutcome = this.heartbeatInitialOutcomes.get(sessionId);
       if (existingOutcome) return existingOutcome;
@@ -7244,8 +7258,8 @@ var AppSyncClient = class _AppSyncClient {
       ).then((outcome) => {
         outcome === "retired" && this.notifyRetiredSession(sessionId);
       });
-    }, intervalMs);
-    return this.heartbeatTimers.set(sessionId, timer), logger.info("[AppSyncClient] Heartbeat started", { sessionId, intervalMs }), initialHeartbeat;
+    }, effectiveIntervalMs);
+    return this.heartbeatTimers.set(sessionId, timer), logger.info("[AppSyncClient] Heartbeat started", { sessionId, intervalMs: effectiveIntervalMs }), initialHeartbeat;
   }
   /**
    * Stop heartbeat for a session.
@@ -7945,6 +7959,14 @@ function sanitizeForTerminal(input) {
   return out;
 }
 
+// src/ordinal-presentation.ts
+function displayOrdinal(index) {
+  return Number.isSafeInteger(index) && index >= 0 ? String(index + 1) : "?";
+}
+function displaySeatNumber(seatId) {
+  return /^(0|[1-9][0-9]*)$/.test(seatId) ? displayOrdinal(Number(seatId)) : seatId;
+}
+
 // src/reviewer/token-usage.ts
 function finiteToken(n) {
   return tokenFieldAvailable(n) ? n : 0;
@@ -8123,7 +8145,7 @@ function renderProgressLine(event) {
       return "Workspace copy ready \u2014 starting implementor";
     case "implementor_running": {
       let files = typeof event.filesChanged == "number" ? `, ${event.filesChanged} ${event.filesChanged === 1 ? "file" : "files"} changed` : "";
-      return `Implementor working in shadow \u2014 round ${event.round}${files}`;
+      return `Implementor working in shadow \u2014 round ${displayOrdinal(event.round)}${files}`;
     }
     case "diff_captured": {
       let parts = [];
@@ -8132,7 +8154,7 @@ function renderProgressLine(event) {
       return `Diff captured: ${event.files} ${event.files === 1 ? "file" : "files"}${breakdown}`;
     }
     case "submitting_diff":
-      return `Submitting changes for review \u2014 round ${event.round}`;
+      return `Submitting changes for review \u2014 round ${displayOrdinal(event.round)}`;
     case "reviewers_dispatched":
       return `Reviewers dispatched \u2014 ${event.seats} ${event.seats === 1 ? "seat" : "seats"}`;
     case "seat_update":
@@ -8141,10 +8163,10 @@ function renderProgressLine(event) {
       return `Verdicts ${event.received}/${event.expected} received`;
     case "revise_round": {
       let summary = event.feedbackSummary ? ` \u2014 ${event.feedbackSummary}` : "";
-      return `Revise round ${event.round} \u2014 re-running implementor${summary}`;
+      return `Revise round ${displayOrdinal(event.round)} \u2014 re-running implementor${summary}`;
     }
     case "round_failed":
-      return `Implementor round ${event.round} failed \u2014 ${event.reason}`;
+      return `Implementor round ${displayOrdinal(event.round)} failed \u2014 ${event.reason}`;
     case "continuation_offered":
       return `Implementor halted (${event.reason}) \u2014 choose a continuation agent`;
     case "declared_tests_skipped":
@@ -8279,19 +8301,20 @@ function reducer(state, action) {
       return reduceGateSummaryLoaded(state, action.gateId, action.panelModel);
     // ─── CP-12 W3 team-track arms (per PHASE-CP-12-DESIGN.md §3.5) ──────────
     case "TEAM_STARTED":
-      return reduceTeamStarted(state, action.taskGroupId);
+      return reduceTeamStarted(state, action.taskGroupId, action.startedAt);
     case "TEAM_TRACK_ASSIGNED":
       return reduceTeamTrackAssigned(
         state,
         action.trackIndex,
         action.state,
         action.taskId,
-        action.agent
+        action.agent,
+        action.startedAt
       );
     case "TEAM_MERGE_GATE":
       return reduceTeamMergeGate(state, action.status, action.startedAt, action.endedAt);
     case "TEAM_HALTED":
-      return reduceTeamHalted(state, action.haltReason);
+      return reduceTeamHalted(state, action.haltReason, action.completedAt);
     case "TEAM_TRACK_TERMINAL":
       return reduceTeamTrackTerminal(state, action.trackIndex, action.state);
     case "TEAM_TRACK_REVISING":
@@ -8299,7 +8322,7 @@ function reducer(state, action) {
     case "TEAM_TRACK_AWAITING_DECISION":
       return reduceTeamTrackTerminal(state, action.trackIndex, "AwaitingDecision");
     case "TEAM_GROUP_RESOLVED":
-      return reduceTeamGroupResolved(state, action.outcome);
+      return reduceTeamGroupResolved(state, action.outcome, action.completedAt);
     case "TASK_PROGRESS":
       return reduceTaskProgress(
         reduceReviewerStatusLine(
@@ -8410,19 +8433,26 @@ function reduceSessionTaskTerminal(state, event) {
   if (terminal === null) return state;
   let taskId = "taskId" in event ? event.taskId : void 0;
   if (!taskId) return state;
-  let runningTasks = new Map(state.runningTasks), evictedRunningTask = runningTasks.delete(taskId), existing = state.sessionTasks.get(taskId), sessionTasks = new Map(state.sessionTasks);
+  let runningTasks = new Map(state.runningTasks), evictedRunningTask = runningTasks.delete(taskId), existing = state.sessionTasks.get(taskId), sessionTasks = new Map(state.sessionTasks), nextSeq = (state.terminalSequence ?? 0) + 1;
   if (existing) {
     if (existing.origin !== "single" || existing.status !== "running")
       return evictedRunningTask ? { ...state, runningTasks } : state;
-    sessionTasks.set(taskId, { ...existing, status: terminal });
+    sessionTasks.set(taskId, {
+      ...existing,
+      status: terminal,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      terminalSeq: nextSeq
+    });
   } else
     sessionTasks.set(taskId, {
       taskId,
       origin: "single",
       status: terminal,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      terminalSeq: nextSeq
     });
-  return { ...state, runningTasks, sessionTasks };
+  return { ...state, runningTasks, sessionTasks, terminalSequence: nextSeq };
 }
 var REVIEWER_STATUS_PHASES = /* @__PURE__ */ new Set([
   "reviewers_dispatched",
@@ -8727,14 +8757,21 @@ function reduceClarificationAnswered(state, answer) {
 function reduceTaskLifecycle(state, task) {
   let existing = state.sessionTasks.get(task.taskId), existingIsTerminal = existing?.origin === "single" && (existing.status === "completed" || existing.status === "cancelled" || existing.status === "failed"), incomingIsTerminal = task.status === "completed" || task.status === "cancelled" || task.status === "failed", next = new Map(state.runningTasks);
   incomingIsTerminal || existingIsTerminal && !incomingIsTerminal ? next.delete(task.taskId) : next.set(task.taskId, task);
-  let history = new Map(state.sessionTasks);
+  let history = new Map(state.sessionTasks), nextSeq = incomingIsTerminal ? existing?.terminalSeq ?? (state.terminalSequence ?? 0) + 1 : existing?.terminalSeq, terminalSequence = incomingIsTerminal && !existing?.terminalSeq ? nextSeq : state.terminalSequence;
   return history.set(task.taskId, {
     taskId: task.taskId,
     agentKind: task.agentKind,
     origin: "single",
     status: existingIsTerminal && !incomingIsTerminal ? existing.status : task.status,
-    startedAt: task.startedAt
-  }), { ...state, runningTasks: next, sessionTasks: history };
+    startedAt: task.startedAt,
+    completedAt: incomingIsTerminal ? task.completedAt ?? existing?.completedAt ?? task.startedAt : existing?.completedAt,
+    ...nextSeq !== void 0 ? { terminalSeq: nextSeq } : {}
+  }), {
+    ...state,
+    runningTasks: next,
+    sessionTasks: history,
+    ...terminalSequence !== void 0 ? { terminalSequence } : {}
+  };
 }
 function findUnfinalizedGatePromptIndex(state, taskId) {
   for (let i = 0; i < state.conversation.length; i++) {
@@ -9059,28 +9096,38 @@ function reduceGateSummaryLoaded(state, gateId, panelModel) {
   ], attached = { ...state, conversation: nextConversation };
   return isFirstLoad && panelModel.rounds.length > 0 ? appendConversation(attached, makeGateSummaryPanel(panelModel)) : attached;
 }
-function reduceTeamStarted(state, taskGroupId) {
+function reduceTeamStarted(state, taskGroupId, startedAt) {
   if (state.team) {
     if (state.team.taskGroupId === taskGroupId)
       return state;
     if (state.team.taskGroupId === "")
-      return { ...state, team: { ...state.team, taskGroupId } };
+      return {
+        ...state,
+        team: {
+          ...state.team,
+          taskGroupId,
+          startedAt: state.team.startedAt ?? startedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+        }
+      };
   }
-  return { ...state, team: {
+  let team = {
     taskGroupId,
     tracks: /* @__PURE__ */ new Map(),
     mergeGate: "none",
     haltReason: null,
-    groupResolved: !1
-  } };
+    groupResolved: !1,
+    startedAt: startedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { ...state, team };
 }
-function reduceTeamTrackAssigned(state, trackIndex, trackState, taskId, agent) {
+function reduceTeamTrackAssigned(state, trackIndex, trackState, taskId, agent, startedAt) {
   let base = state.team ?? {
     taskGroupId: "",
     tracks: /* @__PURE__ */ new Map(),
     mergeGate: "none",
     haltReason: null,
-    groupResolved: !1
+    groupResolved: !1,
+    startedAt: startedAt ?? (/* @__PURE__ */ new Date()).toISOString()
   }, tracks = new Map(base.tracks), prior = tracks.get(trackIndex), merged = {
     state: trackState,
     // Preserve a prior taskId/agent when the new event omits them.
@@ -9091,12 +9138,16 @@ function reduceTeamTrackAssigned(state, trackIndex, trackState, taskId, agent) {
   let sessionTasks = state.sessionTasks;
   if (merged.taskId) {
     let existing = state.sessionTasks.get(merged.taskId);
-    sessionTasks = new Map(state.sessionTasks), sessionTasks.set(merged.taskId, {
+    sessionTasks = new Map(state.sessionTasks);
+    let isTerminal = trackState === "Passed" || trackState === "Failed";
+    sessionTasks.set(merged.taskId, {
       taskId: merged.taskId,
       agentKind: merged.agent ?? existing?.agentKind,
       origin: "team",
       status: trackState,
-      startedAt: existing?.startedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: existing?.startedAt ?? startedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      completedAt: isTerminal ? existing?.completedAt : void 0,
+      ...isTerminal && existing?.terminalSeq !== void 0 ? { terminalSeq: existing.terminalSeq } : {}
     });
   }
   return { ...state, team: { ...base, tracks }, sessionTasks };
@@ -9132,12 +9183,19 @@ function reduceTeamMergeGate(state, status, startedAt, endedAt) {
   let elapsed = team.mergeGateElapsedMs ?? mergeGateElapsed(team.mergeGateStartedAt, endedAt);
   return { ...state, team: { ...team, mergeGate: status, mergeGateElapsedMs: elapsed } };
 }
-function reduceTeamHalted(state, haltReason) {
+function reduceTeamHalted(state, haltReason, completedAt) {
   if (!state.team) return state;
-  let t = state.team, frozen = t.mergeGateStartedAt != null && t.mergeGateElapsedMs == null ? mergeGateElapsed(t.mergeGateStartedAt, (/* @__PURE__ */ new Date()).toISOString()) : t.mergeGateElapsedMs;
+  let t = state.team, frozen = t.mergeGateStartedAt != null && t.mergeGateElapsedMs == null ? mergeGateElapsed(t.mergeGateStartedAt, (/* @__PURE__ */ new Date()).toISOString()) : t.mergeGateElapsedMs, nextSeq = (state.terminalSequence ?? 0) + 1;
   return {
     ...state,
-    team: { ...t, haltReason, mergeGateElapsedMs: frozen },
+    team: {
+      ...t,
+      haltReason,
+      mergeGateElapsedMs: frozen,
+      completedAt: completedAt ?? t.completedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      terminalSeq: nextSeq
+    },
+    terminalSequence: nextSeq,
     lastReviewerProgress: null
   };
 }
@@ -9147,15 +9205,37 @@ function reduceTeamTrackTerminal(state, trackIndex, trackState) {
   if (!prior || prior.state === trackState) return state;
   let tracks = new Map(state.team.tracks);
   tracks.set(trackIndex, { ...prior, state: trackState });
-  let sessionTasks = state.sessionTasks, record = prior.taskId ? state.sessionTasks.get(prior.taskId) : void 0;
-  return prior.taskId && record && (sessionTasks = new Map(state.sessionTasks), sessionTasks.set(prior.taskId, { ...record, status: trackState })), { ...state, team: { ...state.team, tracks }, sessionTasks };
+  let sessionTasks = state.sessionTasks, record = prior.taskId ? state.sessionTasks.get(prior.taskId) : void 0, terminalSequence = state.terminalSequence;
+  if (prior.taskId && record) {
+    let isTerminal = trackState === "Passed" || trackState === "Failed", nextSeq = isTerminal ? record.terminalSeq ?? (state.terminalSequence ?? 0) + 1 : void 0;
+    isTerminal && !record.terminalSeq && (terminalSequence = nextSeq), sessionTasks = new Map(state.sessionTasks), sessionTasks.set(prior.taskId, {
+      ...record,
+      status: trackState,
+      completedAt: isTerminal ? record.completedAt ?? (/* @__PURE__ */ new Date()).toISOString() : void 0,
+      ...isTerminal && nextSeq !== void 0 ? { terminalSeq: nextSeq } : {}
+    });
+  }
+  return {
+    ...state,
+    team: { ...state.team, tracks },
+    sessionTasks,
+    ...terminalSequence !== void 0 ? { terminalSequence } : {}
+  };
 }
-function reduceTeamGroupResolved(state, outcome) {
+function reduceTeamGroupResolved(state, outcome, completedAt) {
   if (!state.team || state.team.groupResolved && state.team.outcome === outcome) return state;
-  let t = state.team, frozen = t.mergeGateStartedAt != null && t.mergeGateElapsedMs == null ? mergeGateElapsed(t.mergeGateStartedAt, (/* @__PURE__ */ new Date()).toISOString()) : t.mergeGateElapsedMs;
+  let t = state.team, frozen = t.mergeGateStartedAt != null && t.mergeGateElapsedMs == null ? mergeGateElapsed(t.mergeGateStartedAt, (/* @__PURE__ */ new Date()).toISOString()) : t.mergeGateElapsedMs, nextSeq = (state.terminalSequence ?? 0) + 1;
   return {
     ...state,
-    team: { ...t, groupResolved: !0, outcome, mergeGateElapsedMs: frozen },
+    team: {
+      ...t,
+      groupResolved: !0,
+      outcome,
+      mergeGateElapsedMs: frozen,
+      completedAt: completedAt ?? t.completedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      terminalSeq: nextSeq
+    },
+    terminalSequence: nextSeq,
     lastReviewerProgress: null
   };
 }
@@ -9441,7 +9521,7 @@ function ReviewerQuorumStatusNode(props) {
         React5.createElement(
           Text,
           null,
-          `${seat.seatId} ${seat.reviewerKind.padEnd(7)} `
+          `${displaySeatNumber(seat.seatId)} ${seat.reviewerKind.padEnd(7)} `
         ),
         React5.createElement(Text, { color: STATUS_COLOR[seat.status] }, STATUS_GLYPH[seat.status]),
         React5.createElement(Text, null, ` ${seat.status}`)
@@ -9819,7 +9899,7 @@ function buildPerSeatTruncationHint(findingsTruncated, truncatedFindingCount) {
   return truncatedFindingCount > 0 ? `(${truncatedFindingCount} more \u2014 ${PER_SEAT_AUDIT_BROWSER_HINT})` : findingsTruncated ? `(more \u2014 ${PER_SEAT_AUDIT_BROWSER_HINT})` : null;
 }
 function buildGateDetailsPanelModel(envelope) {
-  let headline = envelope.summary ?? null, reason = formatHaltReason(envelope.reason), reasonLabel = reason?.label ?? null, reasonExplanation = reason?.explanation ?? null, roundLabel = `Round ${envelope.currentRound}`, timeline = (envelope.timeline ?? []).map((t) => ({
+  let headline = envelope.summary ?? null, reason = formatHaltReason(envelope.reason), reasonLabel = reason?.label ?? null, reasonExplanation = reason?.explanation ?? null, roundLabel = `Round ${displayOrdinal(envelope.currentRound)}`, timeline = (envelope.timeline ?? []).map((t) => ({
     kind: t.kind,
     at: t.at
   })), elapsedSeconds = computeElapsedSeconds(envelope.timeline), history = envelope.roundHistory ?? [], cascade = history.length > 1 ? history.map((h) => ({
@@ -9837,7 +9917,7 @@ function buildGateDetailsPanelModel(envelope) {
       seatId: seat.seatId,
       role: seat.role,
       reviewerAgent: seat.reviewerAgent,
-      header: `Reviewer ${seat.seatId} (${seat.role}, ${seat.reviewerAgent}): ${formatDecision(
+      header: `Reviewer ${displayOrdinal(seat.seatId)} (${seat.role}, ${seat.reviewerAgent}): ${formatDecision(
         seat.decision
       )}`,
       findings: seat.findings,
@@ -9933,7 +10013,7 @@ function buildReviewSummaryPanelModel(summary) {
         seatId,
         role,
         agent,
-        header: `Reviewer ${seatId} (${role}, ${agent}): ${formatDecision(decision)}`,
+        header: `Reviewer ${displayOrdinal(seatId)} (${role}, ${agent}): ${formatDecision(decision)}`,
         decisionLabel: formatDecision(decision),
         reasoning,
         suggestedChanges
@@ -9941,7 +10021,7 @@ function buildReviewSummaryPanelModel(summary) {
     }
     rounds.push({
       round,
-      roundLabel: `Round ${round}`,
+      roundLabel: `Round ${displayOrdinal(round)}`,
       proposal,
       reviewers,
       outcome,
@@ -10216,7 +10296,7 @@ function GateContextPanel(props) {
         React10.createElement(
           Text,
           { dimColor: !0 },
-          `Round ${c.round}: ${c.reasonLabel}`
+          `Round ${displayOrdinal(c.round)}: ${c.reasonLabel}`
         )
       )
     );
@@ -10423,7 +10503,7 @@ function renderReviewSummarySection(reviewSummary) {
         )
       );
       for (let [index, usage] of terminal.tokenUsage.invocations.entries()) {
-        let locator = usage.role === "reviewer" ? `r${usage.round ?? "?"} seat ${usage.seatId ?? "?"}` : usage.round !== null ? `r${usage.round}` : usage.role, usageBreakdown = [
+        let locator = usage.role === "reviewer" ? `r${usage.round == null ? "?" : displayOrdinal(usage.round)} seat ${usage.seatId == null ? "?" : displayOrdinal(usage.seatId)}` : usage.round !== null ? `r${displayOrdinal(usage.round)}` : usage.role, usageBreakdown = [
           usage.inputTokens !== null ? `${usage.inputTokens.toLocaleString()} input` : null,
           usage.outputTokens !== null ? `${usage.outputTokens.toLocaleString()} output` : null,
           usage.cachedInputTokens !== null ? `cached ${usage.cachedInputTokens.toLocaleString()}` : null
@@ -17859,7 +17939,7 @@ function renderEntryAsLine(entry) {
     case "subagent-event":
       return `  \u23BF [${entry.role}] ${entry.event.kind === "NOTIFICATION" && "payload" in entry.event && typeof entry.event.payload.message == "string" ? entry.event.payload.message : entry.event.kind}`;
     case "reviewer-status-node": {
-      let seatLines = entry.seats.map((s) => `${s.seatId} ${s.reviewerKind} ${s.status}`).join(", ");
+      let seatLines = entry.seats.map((s) => `${displaySeatNumber(s.seatId)} ${s.reviewerKind} ${s.status}`).join(", ");
       return `[quorum ${entry.quorumStatus}] ${seatLines}`;
     }
     case "gate-status-node":
@@ -20277,6 +20357,37 @@ async function bindWorkingDirectory(payload){
     throw new Error('target cwd incarnation changed before launch');
   }
 }
+function holdLaunchPathAuthorities(payload){
+  const authorities=payload.launchPathAuthorities;
+  if(authorities===undefined)return [];
+  if(!Array.isArray(authorities)||authorities.length>16)throw new Error('invalid launch path authorities');
+  const held=[];
+  try{
+    for(const authority of authorities){
+      if(!authority||authority.version!==1||
+          typeof authority.canonicalPath!=='string'||!require('node:path').isAbsolute(authority.canonicalPath)||authority.canonicalPath.includes('\0')||
+          typeof authority.dev!=='string'||typeof authority.ino!=='string'||
+          typeof authority.birthtimeNs!=='string')throw new Error('invalid launch path authority');
+      const flags=fs.constants.O_RDONLY|(fs.constants.O_DIRECTORY||0)|(fs.constants.O_NOFOLLOW||0);
+      const fd=fs.openSync(authority.canonicalPath,flags);
+      held.push(fd);
+      const opened=fs.fstatSync(fd,{bigint:true});
+      const live=fs.lstatSync(authority.canonicalPath,{bigint:true});
+      const canonical=fs.realpathSync(authority.canonicalPath);
+      if(!opened.isDirectory()||!live.isDirectory()||live.isSymbolicLink()||
+          opened.dev.toString()!==authority.dev||opened.ino.toString()!==authority.ino||
+          opened.birthtimeNs.toString()!==authority.birthtimeNs||
+          live.dev.toString()!==authority.dev||live.ino.toString()!==authority.ino||
+          live.birthtimeNs.toString()!==authority.birthtimeNs||canonical!==authority.canonicalPath){
+        throw new Error('launch path authority changed before target spawn');
+      }
+    }
+    return held;
+  }catch(err){
+    for(const fd of held){try{fs.closeSync(fd);}catch{}}
+    throw err;
+  }
+}
 const hostPipe=fs.createReadStream(null,{fd:5,autoClose:false});
 for(const event of ['end','close','error'])hostPipe.once(event,killOwnGroup);
 for(const [signal] of [['SIGTERM'],['SIGINT'],['SIGHUP']])process.on(signal,killOwnGroup);
@@ -20285,9 +20396,17 @@ for(const [signal] of [['SIGTERM'],['SIGINT'],['SIGHUP']])process.on(signal,kill
   const start=await readLine(4);
   if(start!=='START')throw new Error('target start not authorized');
   await bindWorkingDirectory(payload);
+  // This is deliberately synchronous and immediately adjacent to cp.spawn:
+  // keep exact directory descriptors open across native process creation so a
+  // pathname replacement during durable-owner publication cannot be adopted.
+  const launchPathFds=holdLaunchPathAuthorities(payload);
   // No pathname cwd is passed here: the child inherits the wrapper's already-
   // authenticated kernel cwd reference, so a later rename cannot redirect it.
-  target=cp.spawn(payload.command,payload.args,{env:payload.env,stdio:['inherit','inherit','inherit'],detached:false,windowsHide:true});
+  try{
+    target=cp.spawn(payload.command,payload.args,{env:payload.env,stdio:['inherit','inherit','inherit'],detached:false,windowsHide:true});
+  }finally{
+    for(const fd of launchPathFds){try{fs.closeSync(fd);}catch{}}
+  }
   target.once('error',err=>{send({type:'target-exit',code:127,error:String(err&&err.message||err)});});
   target.once('exit',(code,signal)=>{send({type:'target-exit',code:Number.isInteger(code)?code:(signal?128:1)});});
   // Remain the authenticated group/session leader until the outside host has
@@ -20387,6 +20506,7 @@ function spawnPosixOwnedProcess(command, args, options, seams = {}) {
     args,
     cwd: targetCwd,
     cwdAuthority: seams.workingDirAuthority,
+    launchPathAuthorities: seams.launchPathAuthorities,
     env: options?.env ?? process.env,
     ...seams.cleanupTimeoutMs === void 0 ? {} : { cleanupTimeoutMs: seams.cleanupTimeoutMs }
   }), "utf8");
@@ -24639,7 +24759,7 @@ function buildReviewerVerdictModel(payload) {
   let decisionRaw = asString(verdict.verdict);
   if (decisionRaw === null) return null;
   let decisionLabel = decisionCopy[decisionRaw] ?? decisionRaw, parts = [], seatId = payload.seat_id ?? payload.seatId, role = asString(payload.role), agent = asString(payload.reviewer_agent) ?? asString(payload.reviewerAgent);
-  typeof seatId == "number" && parts.push(`Seat ${seatId}`), role && parts.push(role), agent && parts.push(agent);
+  typeof seatId == "number" && parts.push(`Seat ${displayOrdinal(seatId)}`), role && parts.push(role), agent && parts.push(agent);
   let provenance = parts.length > 0 ? parts.join(" \xB7 ") : null, reasoning = asString(verdict.reasoning), sugRaw = verdict.suggested_changes ?? verdict.suggestedChanges, suggestedChanges = Array.isArray(sugRaw) ? sugRaw.filter((s) => typeof s == "string") : [];
   return { decisionLabel, provenance, reasoning, suggestedChanges };
 }
@@ -26409,6 +26529,38 @@ var LocalGemmaPlannerAdapter = class {
 // src/orchestration-shell/quorum-loop.ts
 var import_node_fs24 = require("node:fs");
 
+// src/diagnostics/shape-only.ts
+function outputShapeOnly(raw) {
+  if (typeof raw != "string" || raw.length === 0)
+    return {
+      bytes: 0,
+      lines: 0,
+      leadClass: "empty",
+      fenceCount: 0,
+      bulletLines: 0,
+      blankLines: 0
+    };
+  let lines = raw.split(`
+`), trimmed = raw.trim(), leadClass;
+  return trimmed.length === 0 ? leadClass = "empty" : trimmed.startsWith("{") || trimmed.startsWith("[") ? leadClass = "json-open" : trimmed.startsWith("```") ? leadClass = "fence" : /^#{1,6}\s/.test(trimmed) ? leadClass = "heading" : /^[-*+]\s/.test(trimmed) ? leadClass = "bullet" : /^\d+[.)]\s/.test(trimmed) ? leadClass = "ordinal" : /^[A-Za-z]/.test(trimmed) ? leadClass = "prose" : leadClass = "other", {
+    bytes: Buffer.byteLength(raw, "utf8"),
+    lines: lines.length,
+    leadClass,
+    fenceCount: (raw.match(/```/g) ?? []).length,
+    bulletLines: lines.filter((line) => /^\s*[-*+]\s/.test(line)).length,
+    blankLines: lines.filter((line) => line.trim().length === 0).length
+  };
+}
+function errorShapeOnly(error) {
+  let value = error, message = typeof value?.message == "string" ? value.message : "", causeCount = Array.isArray(value?.causes) ? value.causes.length : value?.cause !== void 0 ? 1 : 0;
+  return {
+    errorClass: error instanceof Error ? "error" : "non-error",
+    messageBytes: Buffer.byteLength(message, "utf8"),
+    hasCause: value?.cause !== void 0,
+    causeCount
+  };
+}
+
 // src/reduced-trust-notice.ts
 var surfacedRationales = /* @__PURE__ */ new Set();
 function noticeKey(sessionId, tier, reason) {
@@ -28104,7 +28256,8 @@ var ClassBConsumer = class {
 };
 
 // src/substrate-launch/apikey-bootstrap.ts
-var import_node_fs14 = require("node:fs"), os19 = __toESM(require("node:os")), path32 = __toESM(require("node:path")), HELPER_SCRIPT_NAME = "broker-apikey-helper.sh", TOKEN_FILE_NAME = "broker-token", CLAUDE_SETTINGS_NAME = "settings.json", CODEX_CONFIG_NAME = "config.toml", SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent", SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config", CODEX_PROVIDER_ID = "codevibe_broker";
+var import_node_fs14 = require("node:fs"), os19 = __toESM(require("node:os")), path32 = __toESM(require("node:path"));
+var HELPER_SCRIPT_NAME = "broker-apikey-helper.sh", TOKEN_FILE_NAME = "broker-token", CLAUDE_SETTINGS_NAME = "settings.json", CODEX_CONFIG_NAME = "config.toml", SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent", SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config", CODEX_PROVIDER_ID = "codevibe_broker";
 function helperScriptSource(tokenFileAbsPathInSandbox) {
   return `#!/bin/sh
 # CP-7 apiKeyHelper \u2014 emits the current broker token (NEVER the vendor key).
@@ -28145,12 +28298,16 @@ function isInsideOrEqual(child, parent) {
   return rel.length > 0 && !rel.startsWith("..") && !path32.isAbsolute(rel);
 }
 var ApiKeyBootstrap = class _ApiKeyBootstrap {
-  constructor(hostDir, sandboxDir, configHostDir, configSandboxDir, tokenFileHostPath) {
+  constructor(hostDir, sandboxDir, configHostDir, configSandboxDir, tokenFileHostPath, claudeScratchHostDir, claudeScratchSandboxDir, claudeScratchIdentity, beforeClaudeScratchCleanupCommit) {
     this.hostDir = hostDir;
     this.sandboxDir = sandboxDir;
     this.configHostDir = configHostDir;
     this.configSandboxDir = configSandboxDir;
     this.tokenFileHostPath = tokenFileHostPath;
+    this.claudeScratchHostDir = claudeScratchHostDir;
+    this.claudeScratchSandboxDir = claudeScratchSandboxDir;
+    this.claudeScratchIdentity = claudeScratchIdentity;
+    this.beforeClaudeScratchCleanupCommit = beforeClaudeScratchCleanupCommit;
   }
   /**
    * Materialize the bootstrap: create the host dir (0700), write the token file
@@ -28166,9 +28323,8 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
     );
     await import_node_fs14.promises.chmod(rawConfigHostDir, 448).catch(() => {
     });
-    let hostDir = await import_node_fs14.promises.realpath(rawHostDir), configHostDir = await import_node_fs14.promises.realpath(rawConfigHostDir);
+    let hostDir = await import_node_fs14.promises.realpath(rawHostDir), configHostDir = await import_node_fs14.promises.realpath(rawConfigHostDir), realWorkdir;
     if (input.workdir !== void 0) {
-      let realWorkdir;
       try {
         realWorkdir = await import_node_fs14.promises.realpath(input.workdir);
       } catch {
@@ -28205,7 +28361,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
         "ApiKeyBootstrap.create: provide `sandboxConfigDir` or `configDirEqualsHostDir`"
       );
     let tokenInSandbox = path32.posix.join(sandboxDir, TOKEN_FILE_NAME), helperInSandbox = path32.posix.join(sandboxDir, HELPER_SCRIPT_NAME), tokenFileHostPath = path32.join(hostDir, TOKEN_FILE_NAME);
-    return await import_node_fs14.promises.writeFile(tokenFileHostPath, input.initialToken, {
+    await import_node_fs14.promises.writeFile(tokenFileHostPath, input.initialToken, {
       encoding: "utf8",
       mode: 384
     }), await import_node_fs14.promises.writeFile(
@@ -28220,12 +28376,107 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
       path32.join(configHostDir, CODEX_CONFIG_NAME),
       codexConfig(input.sandboxBrokerUrl, helperInSandbox),
       { encoding: "utf8", mode: 384 }
-    ), new _ApiKeyBootstrap(
+    );
+    let claudeScratchHostDir = null, claudeScratchSandboxDir = null, claudeScratchIdentity = null;
+    if (input.claudeScratchHostRoot !== void 0) {
+      if (input.provider !== "anthropic" || !input.sandboxDirEqualsHostDir) {
+        let primary = new Error(
+          "ApiKeyBootstrap.create: a short Claude scratch root is valid only for the A5 anthropic path"
+        ), cleanupErrors = [];
+        for (let directory of [hostDir, configHostDir])
+          try {
+            await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        throw cleanupErrors.length > 0 ? Object.assign(
+          new Error(
+            "ApiKeyBootstrap.create: invalid scratch configuration and cleanup did not complete"
+          ),
+          { causes: [primary, ...cleanupErrors] }
+        ) : primary;
+      }
+      let rawScratchDir = null;
+      try {
+        let canonicalScratchRoot = await import_node_fs14.promises.realpath(
+          input.claudeScratchHostRoot
+        );
+        rawScratchDir = await import_node_fs14.promises.mkdtemp(path32.join(canonicalScratchRoot, "cv"));
+        let initial = await import_node_fs14.promises.lstat(rawScratchDir, { bigint: !0 });
+        if (!initial.isDirectory() || initial.isSymbolicLink())
+          throw new Error(
+            "ApiKeyBootstrap.create: generated Claude scratch root is not a real directory"
+          );
+        await input.beforeClaudeScratchOpen?.(rawScratchDir);
+        let scratchHandle = await import_node_fs14.promises.open(
+          rawScratchDir,
+          import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW | (typeof import_node_fs14.constants.O_DIRECTORY == "number" ? import_node_fs14.constants.O_DIRECTORY : 0)
+        );
+        try {
+          let opened = await scratchHandle.stat({ bigint: !0 });
+          if (!opened.isDirectory() || opened.dev !== initial.dev || opened.ino !== initial.ino || opened.birthtimeNs !== initial.birthtimeNs)
+            throw new Error(
+              "ApiKeyBootstrap.create: Claude scratch root changed while binding its directory handle"
+            );
+          await scratchHandle.chmod(448);
+          let sealed = await scratchHandle.stat({ bigint: !0 }), live = await import_node_fs14.promises.lstat(rawScratchDir, { bigint: !0 }), canonical = rawScratchDir, currentUid = process.getuid?.(), mode = sealed.mode & 0o777n;
+          if (!sealed.isDirectory() || !live.isDirectory() || live.isSymbolicLink() || live.dev !== sealed.dev || live.ino !== sealed.ino || live.birthtimeNs !== sealed.birthtimeNs || currentUid === void 0 || sealed.uid !== BigInt(currentUid) || mode !== 0o700n)
+            throw new Error(
+              "ApiKeyBootstrap.create: generated Claude scratch root failed its descriptor-bound private-directory identity check"
+            );
+          claudeScratchHostDir = canonical, claudeScratchSandboxDir = rawScratchDir, claudeScratchIdentity = {
+            version: 1,
+            canonicalPath: canonical,
+            dev: sealed.dev.toString(),
+            ino: sealed.ino.toString(),
+            birthtimeNs: sealed.birthtimeNs.toString()
+          };
+        } finally {
+          await scratchHandle.close();
+        }
+        if (Buffer.byteLength(rawScratchDir, "utf8") > 30)
+          throw new Error(
+            "ApiKeyBootstrap.create: generated Claude scratch path exceeds the 30-byte A5 safety bound"
+          );
+        if (realWorkdir !== void 0 && isInsideOrEqual(claudeScratchHostDir, realWorkdir))
+          throw new Error(
+            "ApiKeyBootstrap.create: Claude scratch root is inside the agent workdir (fail-closed)"
+          );
+      } catch (error) {
+        let cleanupErrors = [];
+        if (claudeScratchIdentity !== null)
+          try {
+            await anchoredRemoveTree(
+              claudeScratchIdentity.canonicalPath,
+              claudeScratchIdentity
+            );
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        for (let directory of [hostDir, configHostDir])
+          try {
+            await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        throw cleanupErrors.length > 0 ? Object.assign(
+          new Error(
+            "ApiKeyBootstrap.create: initialization failed and cleanup did not complete"
+          ),
+          { causes: [error, ...cleanupErrors] }
+        ) : error;
+      }
+    }
+    return new _ApiKeyBootstrap(
       hostDir,
       sandboxDir,
       configHostDir,
       sandboxConfigDir,
-      tokenFileHostPath
+      tokenFileHostPath,
+      claudeScratchHostDir,
+      claudeScratchSandboxDir,
+      claudeScratchIdentity,
+      input.beforeClaudeScratchCleanupCommit
     );
   }
   /** The `SubstrateSpec.agentBootstrap` value for this bootstrap. */
@@ -28236,6 +28487,14 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
   get configSpec() {
     return { hostDir: this.configHostDir, sandboxDir: this.configSandboxDir };
   }
+  /** The unique writable Claude scratch grant, absent on Docker/Codex paths. */
+  get claudeScratchSpec() {
+    return this.claudeScratchHostDir === null || this.claudeScratchSandboxDir === null || this.claudeScratchIdentity === null ? null : {
+      hostDir: this.claudeScratchHostDir,
+      sandboxDir: this.claudeScratchSandboxDir,
+      authority: this.claudeScratchIdentity
+    };
+  }
   /**
    * REFRESH the broker token (rotation / on a broker 401). Atomically rewrites
    * the token file (write a temp + rename) so the agent never reads a partial
@@ -28246,15 +28505,41 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
     let tmp = `${this.tokenFileHostPath}.tmp-${process.pid}-${Date.now()}`;
     await import_node_fs14.promises.writeFile(tmp, token, { encoding: "utf8", mode: 384 }), await import_node_fs14.promises.rename(tmp, this.tokenFileHostPath);
   }
-  /** Remove the bootstrap dir (session teardown). Idempotent. */
+  /**
+   * Remove the bootstrap, config, and unique Claude scratch dirs. Scratch
+   * cleanup is identity-bound: a replaced pathname is retained and reported,
+   * never recursively removed as though it still belonged to this seat.
+   */
   async destroy() {
-    await import_node_fs14.promises.rm(this.hostDir, { recursive: !0, force: !0 }).catch(
-      () => {
+    let cleanupErrors = [];
+    if (this.claudeScratchHostDir !== null && this.claudeScratchIdentity !== null)
+      try {
+        await anchoredRemoveTree(
+          this.claudeScratchIdentity.canonicalPath,
+          this.claudeScratchIdentity,
+          {
+            ...this.beforeClaudeScratchCleanupCommit ? {
+              beforeCommit: () => this.beforeClaudeScratchCleanupCommit(
+                this.claudeScratchHostDir
+              )
+            } : {}
+          }
+        );
+      } catch (error) {
+        cleanupErrors.push(error);
       }
-    ), await import_node_fs14.promises.rm(this.configHostDir, { recursive: !0, force: !0 }).catch(
-      () => {
+    for (let directory of [this.hostDir, this.configHostDir])
+      try {
+        await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+      } catch (error) {
+        cleanupErrors.push(error);
       }
-    );
+    if (cleanupErrors.length === 1) throw cleanupErrors[0];
+    if (cleanupErrors.length > 1)
+      throw Object.assign(
+        new Error("ApiKeyBootstrap.destroy: cleanup did not complete"),
+        { causes: cleanupErrors }
+      );
   }
 };
 
@@ -42776,10 +43061,7 @@ var LocalExecutorImpl = class {
     }).catch(() => {
     }), {
       args: { ...addClaudeSubstrateAuthArgs(args, result.agentConfigDir), substrate: result.substrateHandle },
-      onExit: async () => {
-        await result.teardown().catch(() => {
-        });
-      },
+      onExit: () => result.teardown(),
       // Stage-2 r3 Codex HIGH — the ONLY return that proves a real confining
       // boundary (`result.mode === 'substrate'`, not reduced_trust / no-engager /
       // pre-TaskAuthorized). The danger-sandbox authority keys on THIS boolean,
@@ -42871,7 +43153,11 @@ var LocalExecutorImpl = class {
     }
   }
   async spawnWithLifecycle(args, spawnFn, onSubstrateExit) {
-    let role = args.role, lifecycleAudit = args.lifecycleAudit ?? "active_task", lifecycleTaskId = args.taskId ?? this.taskId, lifecycleCtx = lifecycleTaskId ? { taskId: lifecycleTaskId, ...this.baseCtx } : null, full = {
+    let role = args.role, lifecycleAudit = args.lifecycleAudit ?? "active_task", lifecycleTaskId = args.taskId ?? this.taskId, lifecycleCtx = lifecycleTaskId ? { taskId: lifecycleTaskId, ...this.baseCtx } : null, substrateCleanupError, substrateCleanupPromise, cleanupSubstrate = async () => {
+      onSubstrateExit && (substrateCleanupPromise || (substrateCleanupPromise = onSubstrateExit().catch((error) => {
+        throw substrateCleanupError = error, error;
+      })), await substrateCleanupPromise);
+    }, full = {
       ...args,
       agentKind: args.agentKind ?? this.adapter,
       onProcessSpawned: async (info) => {
@@ -42885,35 +43171,51 @@ var LocalExecutorImpl = class {
         });
       },
       onProcessExited: async (info) => {
-        if (await args.onProcessExited?.(info), lifecycleAudit !== "none") {
-          let ctx = lifecycleCtx;
-          ctx !== null && await this.emitter.emitProcessExited(ctx, {
-            pid: info.pid,
-            exitCode: info.exitCode,
-            failureClass: info.failureClass,
-            occurredAt: info.exitedAt
-          });
+        try {
+          if (await args.onProcessExited?.(info), lifecycleAudit !== "none") {
+            let ctx = lifecycleCtx;
+            ctx !== null && await this.emitter.emitProcessExited(ctx, {
+              pid: info.pid,
+              exitCode: info.exitCode,
+              failureClass: info.failureClass,
+              occurredAt: info.exitedAt
+            });
+          }
+        } catch {
         }
-        onSubstrateExit && await onSubstrateExit().catch(() => {
+        await cleanupSubstrate().catch(() => {
         });
       }
     };
     try {
-      return await spawnFn(full);
+      let handle = await spawnFn(full), done = handle.done.then((info) => {
+        if (substrateCleanupError !== void 0)
+          throw Object.assign(
+            new Error("implementor substrate cleanup failed after process exit"),
+            { cause: substrateCleanupError }
+          );
+        return info;
+      });
+      return { ...handle, done };
     } catch (err) {
-      if (onSubstrateExit && await onSubstrateExit().catch(() => {
-      }), err instanceof AuthorityError) {
+      await cleanupSubstrate().catch(() => {
+      });
+      let primary = err;
+      if (err instanceof AuthorityError) {
         let safeArgv = redactAgyPrintArgv(args.argv), safeDetail = redactAgyPrintValuesFromText(err.refusal.detail, args.argv), safeError = new AuthorityError({
           ...err.refusal,
           detail: safeDetail
         });
-        throw await this.bridge.bridgeAuthorityRefusal(safeError, {
+        await this.bridge.bridgeAuthorityRefusal(safeError, {
           refusedMessageId: "spawn:" + role + ":" + Date.now(),
           shellContent: `Refused spawn (${role}): ${safeDetail}`,
           shellMetadata: { role, argv: safeArgv }
-        }), safeError;
+        }), primary = safeError;
       }
-      throw err;
+      throw substrateCleanupError !== void 0 ? Object.assign(
+        new Error("implementor spawn failed and substrate cleanup also failed"),
+        { causes: [primary, substrateCleanupError] }
+      ) : primary;
     }
   }
   // --- Hook bridge surface ---------------------------------------------------
@@ -44051,7 +44353,8 @@ var LocalExecutorImpl = class {
         metadata: {
           source: "team_group_resolved",
           task_group_id: taskGroupId,
-          outcome
+          outcome,
+          completed_at: (/* @__PURE__ */ new Date()).toISOString()
         }
       }),
       "team_group_resolved"
@@ -49035,10 +49338,11 @@ var ChildProcessCommandRunner = class {
       signal: opts.signal,
       ...opts.env !== void 0 ? { env: opts.env } : {},
       ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {}
-    }, proc = opts.cwdAuthority ? spawnPosixOwnedProcess(argv[0], argv.slice(1), spawnOptions, {
-      workingDirAuthority: opts.cwdAuthority
+    }, needsOwnedProcessHost = opts.cwdAuthority !== void 0 || (opts.launchPathAuthorities?.length ?? 0) > 0, proc = needsOwnedProcessHost ? spawnPosixOwnedProcess(argv[0], argv.slice(1), spawnOptions, {
+      workingDirAuthority: opts.cwdAuthority,
+      launchPathAuthorities: opts.launchPathAuthorities
     }) : (0, import_node_child_process7.spawn)(argv[0], argv.slice(1), spawnOptions);
-    return opts.cwdAuthority && Object.defineProperty(proc, "hostProcessTreeOwnership", {
+    return needsOwnedProcessHost && Object.defineProperty(proc, "hostProcessTreeOwnership", {
       value: "posix-host",
       configurable: !1,
       enumerable: !1,
@@ -49618,13 +49922,14 @@ async function resolveOnParentPath(cmd) {
   return null;
 }
 var SandboxExecHandle = class {
-  constructor(id, runner, profilePath, sanitizedEnv, workdir, workdirAuthority, auditDir = null) {
+  constructor(id, runner, profilePath, sanitizedEnv, workdir, workdirAuthority, scratchAuthority, auditDir = null) {
     this.id = id;
     this.runner = runner;
     this.profilePath = profilePath;
     this.sanitizedEnv = sanitizedEnv;
     this.workdir = workdir;
     this.workdirAuthority = workdirAuthority;
+    this.scratchAuthority = scratchAuthority;
     this.auditDir = auditDir;
     this.egressFidelity = "coarse";
     this.tornDown = !1;
@@ -49660,13 +49965,18 @@ var SandboxExecHandle = class {
 ; exec-time agent-binary read allowance (argv0 resolution, 2026-07-03)
 ${allowLines}
 `
+    ), this.scratchAuthority && await assertWorkspaceRootAuthority(
+      this.scratchAuthority.canonicalPath,
+      this.scratchAuthority,
+      "sandbox-exec Claude scratch handoff"
     );
     let sbArgv = ["sandbox-exec", "-f", this.profilePath, resolvedArgv0, ...argv.slice(1)], proc = this.runner.spawnLong(sbArgv, {
       stdinTty: opts.stdinTty,
       signal: opts.signal,
       env: this.sanitizedEnv,
       cwd: this.workdir,
-      ...this.workdirAuthority ? { cwdAuthority: this.workdirAuthority } : {}
+      ...this.workdirAuthority ? { cwdAuthority: this.workdirAuthority } : {},
+      ...this.scratchAuthority ? { launchPathAuthorities: [this.scratchAuthority] } : {}
     });
     return this.proc = proc, proc;
   }
@@ -49724,6 +50034,22 @@ ${allowLines}
       }
       extraWriteDirs.push(configDir);
     }
+    if (spec.agentScratch) {
+      try {
+        await assertWorkspaceRootAuthority(
+          spec.agentScratch.hostDir,
+          spec.agentScratch.authority,
+          "sandbox-exec Claude scratch launch"
+        );
+      } catch (error) {
+        throw new SubstrateLaunchError(
+          "sandbox_exec",
+          "Claude scratch grant target identity could not be verified (fail-closed)",
+          error
+        );
+      }
+      extraWriteDirs.push(spec.agentScratch.authority.canonicalPath);
+    }
     let resolvedAuditDir = null;
     if (spec.auditDir) {
       resolvedAuditDir = spec.auditDir;
@@ -49764,6 +50090,17 @@ ${allowLines}
         throw await import_node_fs23.promises.rm(profilePath, { force: !0 }).catch(() => {
         }), err;
       }
+    if (spec.agentScratch)
+      try {
+        await assertWorkspaceRootAuthority(
+          spec.agentScratch.authority.canonicalPath,
+          spec.agentScratch.authority,
+          "sandbox-exec Claude scratch profile handoff"
+        );
+      } catch (err) {
+        throw await import_node_fs23.promises.rm(profilePath, { force: !0 }).catch(() => {
+        }), err;
+      }
     return new SandboxExecHandle(
       id,
       this.runner,
@@ -49771,6 +50108,7 @@ ${allowLines}
       finalEnv,
       canonicalWorkdir,
       spec.workdirAuthority,
+      spec.agentScratch?.authority,
       resolvedAuditDir
     );
   }
@@ -50397,13 +50735,13 @@ function formatReviewerError(detail) {
     case "timeout":
       return `${detail.agent} reviewer timed out after ${detail.elapsed_ms}ms`;
     case "spawn_failed":
-      return `${detail.agent} reviewer spawn failed: ${detail.reason}`;
+      return `${detail.agent} reviewer spawn failed`;
     case "parse_failure":
       return `${detail.agent} reviewer output was unparseable`;
     case "cancelled":
       return "reviewer cancelled before completion";
     case "internal_join_failure":
-      return `reviewer task internal join failure: ${detail.reason}`;
+      return "reviewer task internal join failure";
   }
 }
 
@@ -50945,22 +51283,25 @@ var CONTINUATION_EXPIRES_TTL_MS = 1440 * 60 * 1e3, ACTIVE_AGENT_KINDS = ["CLAUDE
 function isActiveAgentKind2(agent) {
   return agent === "CLAUDE" || agent === "CODEX" || agent === "ANTIGRAVITY";
 }
-var IMPLEMENTOR_TICK_MS = 1e4, TICK_SCAN_MAX_TRACKED = 5e3, TICK_SCAN_TIMEOUT_MS = 1e3, BACKGROUND_RECOVERY_ABORTED = /* @__PURE__ */ Symbol("background-recovery-aborted"), REVIEWER_ERROR_LOG_RAW_OUTPUT_CAP = 4e3;
+var IMPLEMENTOR_TICK_MS = 1e4, TICK_SCAN_MAX_TRACKED = 5e3, TICK_SCAN_TIMEOUT_MS = 1e3, BACKGROUND_RECOVERY_ABORTED = /* @__PURE__ */ Symbol("background-recovery-aborted");
 function describeReviewerErrorDetail(detail) {
   switch (detail.kind) {
     case "timeout":
       return { agent: detail.agent, elapsedMs: detail.elapsed_ms };
     case "spawn_failed":
-      return { agent: detail.agent, reason: detail.reason };
+      return {
+        agent: detail.agent,
+        reasonBytes: Buffer.byteLength(detail.reason ?? "", "utf8")
+      };
     case "parse_failure":
       return {
         agent: detail.agent,
-        rawOutput: detail.raw_output.slice(0, REVIEWER_ERROR_LOG_RAW_OUTPUT_CAP)
+        rawOutputShape: outputShapeOnly(detail.raw_output)
       };
     case "cancelled":
       return {};
     case "internal_join_failure":
-      return { reason: detail.reason };
+      return { reasonBytes: Buffer.byteLength(detail.reason ?? "", "utf8") };
   }
 }
 var REVIEWER_AGENT_DISPLAY_NAME = {
@@ -52248,7 +52589,16 @@ var QuorumLoop = class _QuorumLoop {
    * first promote/discard.
    */
   getLastWorkspaceOutcome() {
-    return this.lastWorkspaceOutcome === null ? null : this.lastWorkspaceOutcome.kind === "promoted" ? { kind: "promoted", files: [...this.lastWorkspaceOutcome.files] } : { kind: "discarded" };
+    return this.lastWorkspaceOutcome === null ? null : this.lastWorkspaceOutcome.kind === "promoted" ? {
+      kind: "promoted",
+      files: [...this.lastWorkspaceOutcome.files],
+      taskId: this.lastWorkspaceOutcome.taskId,
+      completedAt: this.lastWorkspaceOutcome.completedAt
+    } : {
+      kind: "discarded",
+      taskId: this.lastWorkspaceOutcome.taskId,
+      completedAt: this.lastWorkspaceOutcome.completedAt
+    };
   }
   /**
    * Session-owned Class-B ingress. The subscription calls this wrapper instead
@@ -53274,8 +53624,8 @@ var QuorumLoop = class _QuorumLoop {
               taskId: args.taskId,
               trackIndex: args.validateDiffScope.trackIndex,
               exitCode: exit.exitCode,
-              stderrExcerpt: handle.stderr().slice(0, 800),
-              stdoutTail: handle.stdout().slice(-3e3)
+              stderrShape: outputShapeOnly(handle.stderr()),
+              stdoutShape: outputShapeOnly(handle.stdout())
             }
           ), await this.reportTeamTrackFailure(
             args.taskId,
@@ -53297,8 +53647,8 @@ var QuorumLoop = class _QuorumLoop {
             // exits 0 is still attributable from the log.
             exitCode: exit.exitCode,
             runtimeMs: exit.runtimeMs,
-            stdoutTail: handle.stdout().slice(-300),
-            stderrTail: handle.stderr().slice(-300)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           });
           try {
             let bundle = createSnapshotTrackBundle({
@@ -53375,8 +53725,8 @@ var QuorumLoop = class _QuorumLoop {
           exitCode: exit.exitCode,
           runtimeMs: exit.runtimeMs,
           ...files.length === 0 ? {
-            stdoutTail: handle.stdout().slice(-300),
-            stderrTail: handle.stderr().slice(-300)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           } : {}
         }), this.surfaceHalt(reason), await this.discardShadow(args.taskId);
       }
@@ -53391,7 +53741,7 @@ var QuorumLoop = class _QuorumLoop {
       }
       logger.warn("[QuorumLoop] implementor round failed", {
         gateId,
-        err: err.message
+        ...errorShapeOnly(err)
       });
       let reason = classifyImplementorRoundFailure(err);
       this.surfaceHalt(`The task could not proceed \u2014 ${reason}.`);
@@ -53879,7 +54229,11 @@ var QuorumLoop = class _QuorumLoop {
         err: err.message
       });
     } finally {
-      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && terminalDiscard && this.terminallyRetiredWorkspaceTasks.add(taskId), this.lastWorkspaceOutcome = { kind: "discarded" }, this.emitProgress(
+      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && terminalDiscard && this.terminallyRetiredWorkspaceTasks.add(taskId), terminalDiscard && opts?.taskContinues !== !0 && (this.lastWorkspaceOutcome = {
+        kind: "discarded",
+        taskId,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }), this.emitProgress(
         {
           phase: "discarded",
           ...terminalDiscard && opts?.taskContinues !== !0 ? { taskId } : {}
@@ -53988,7 +54342,11 @@ var QuorumLoop = class _QuorumLoop {
           err: discardErr.message
         });
       }
-      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.lastWorkspaceOutcome = { kind: "discarded" }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
+      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.lastWorkspaceOutcome = {
+        kind: "discarded",
+        taskId,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
       return;
     }
     if (this.teamRunIsHalted(teamAuthority)) return;
@@ -54022,7 +54380,11 @@ var QuorumLoop = class _QuorumLoop {
           err: discardErr.message
         });
       }
-      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.reviewedSnapshotByTask.delete(taskId), this.lastWorkspaceOutcome = { kind: "discarded" }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
+      discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.reviewedSnapshotByTask.delete(taskId), this.lastWorkspaceOutcome = {
+        kind: "discarded",
+        taskId,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
       return;
     }
     this.reviewedSnapshotByTask.set(taskId, reviewedSnapshot);
@@ -54052,7 +54414,11 @@ var QuorumLoop = class _QuorumLoop {
             err: discardErr.message
           });
         }
-        discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.lastWorkspaceOutcome = { kind: "discarded" }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
+        discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.lastWorkspaceOutcome = {
+          kind: "discarded",
+          taskId,
+          completedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }, this.emitProgress({ phase: "discarded", taskId }, originEpoch), discarded && terminalOutcomeReserved && await this.workspaceOutcomeSink.completeTask(taskId, "apply_failed");
         return;
       }
     }
@@ -54207,7 +54573,12 @@ var QuorumLoop = class _QuorumLoop {
     }), logger.info("[QuorumLoop] shadow promoted to real tree", {
       taskId,
       promoted: appliedPaths.length
-    }), this.lastWorkspaceOutcome = { kind: "promoted", files: [...appliedPaths] }, appendContextItem(this.deps.session.sessionId, {
+    }), this.lastWorkspaceOutcome = {
+      kind: "promoted",
+      files: [...appliedPaths],
+      taskId,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }, appendContextItem(this.deps.session.sessionId, {
       kind: "verdict",
       author: { role: "engine" },
       sensitivity: "user",
@@ -54470,7 +54841,7 @@ var QuorumLoop = class _QuorumLoop {
       if (promptText === null) {
         logger.warn("[QuorumLoop] getReviewerPrompt exhausted \u2014 ESCALATE", {
           key,
-          err: lastErr?.message,
+          ...errorShapeOnly(lastErr),
           audit: "synthesized ESCALATE (#C1F-8): prompt_fetch_failed"
         }), await this.submitVerdict(args, this.synthesizeEscalate(args, DESKTOP_DISPATCH_ESCALATE_REASONING), sessionKey);
         return;
@@ -54505,13 +54876,13 @@ var QuorumLoop = class _QuorumLoop {
             failureReason,
             audit: "synthesized ESCALATE (#C1F-8): reviewer_substrate_engage_failed",
             ...describeReviewerErrorDetail(engageErr.detail),
-            message: engageErr.message
+            ...errorShapeOnly(engageErr)
           }), await this.submitVerdict(args, this.synthesizeEscalate(args, cleanReasoning), sessionKey);
           return;
         }
         throw engageErr;
       }
-      let verdict;
+      let verdict, evaluationError;
       try {
         verdict = await this.evaluateSeatWithTimeout(spec, args.gateId, seatSubstrate.handle);
       } catch (err) {
@@ -54539,7 +54910,7 @@ var QuorumLoop = class _QuorumLoop {
             // Audit prefix kept in LOGS only (#C1F-8) — never on the wire.
             audit: `synthesized ESCALATE (#C1F-8): reviewer_error:${err.detail.kind}`,
             ...describeReviewerErrorDetail(err.detail),
-            message: err.message,
+            ...errorShapeOnly(err),
             // 2026-08-22 (dogfood) — TIMEOUT DIAGNOSTICS, local log only.
             //
             // A live 5-minute reviewer timeout on a ONE-FILE deletion diff was
@@ -54556,16 +54927,51 @@ var QuorumLoop = class _QuorumLoop {
             ...this.describeReviewShapeForDiagnostics(args.gateId)
           }), verdict = this.synthesizeEscalate(args, cleanReasoning);
         } else
-          throw err;
-      } finally {
-        await seatSubstrate.teardown().catch(() => {
+          evaluationError = err;
+      }
+      let cleanupError;
+      try {
+        await seatSubstrate.teardown();
+      } catch (error) {
+        cleanupError = error, logger.warn("[QuorumLoop] reviewer substrate cleanup failed \u2014 forcing ESCALATE", {
+          key,
+          seatId: args.seatId,
+          role: args.role,
+          agentKind: args.agentKind,
+          ...errorShapeOnly(error),
+          audit: "synthesized ESCALATE: reviewer_substrate_cleanup_failed"
         });
       }
+      if (evaluationError !== void 0) {
+        let terminalError = cleanupError !== void 0 ? Object.assign(
+          new Error("reviewer evaluation failed and substrate cleanup also failed"),
+          { causes: [evaluationError, cleanupError] }
+        ) : Object.assign(
+          new Error("reviewer evaluation failed unexpectedly"),
+          { cause: evaluationError }
+        );
+        logger.warn("[QuorumLoop] unexpected reviewer evaluation failure \u2014 forcing ESCALATE", {
+          key,
+          seatId: args.seatId,
+          role: args.role,
+          agentKind: args.agentKind,
+          ...errorShapeOnly(terminalError),
+          audit: "synthesized ESCALATE: reviewer_evaluation_failed"
+        }), verdict = this.synthesizeEscalate(
+          args,
+          DESKTOP_DISPATCH_ESCALATE_REASONING
+        );
+      }
+      if (cleanupError !== void 0 && (verdict = this.synthesizeEscalate(
+        args,
+        DESKTOP_DISPATCH_ESCALATE_REASONING
+      )), verdict === void 0)
+        throw new Error("reviewer completed without a verdict");
       reviewScope !== null && (verdict = enforceReviewRoundScope(verdict, reviewScope)), await this.submitVerdict(args, verdict, sessionKey);
     } catch (err) {
       logger.warn("[QuorumLoop] spawnOneSeat failed \u2014 dropped", {
         key,
-        err: err.message
+        ...errorShapeOnly(err)
       });
     } finally {
       this.runningSeats.delete(key);
@@ -54658,19 +55064,18 @@ var QuorumLoop = class _QuorumLoop {
       if (e.name === REVIEWER_CREDENTIAL_MISSING)
         try {
           this.surfaceHalt(
-            `Reviewer (${seatLabel(args.agentKind, args.seatId)}) cannot start sandboxed: ${e.message}`
+            `Reviewer (${seatLabel(args.agentKind, args.seatId)}) cannot start sandboxed: the required provider credential is unavailable. Run \`codevibe vendor-key setup\`` + (args.agentKind === "codex" ? " (or `codevibe vendor-key import-codex` for a ChatGPT subscription)" : "") + ", or set CODEVIBE_SANDBOX_REVIEWERS=0 to opt out of reviewer sandboxing."
           );
         } catch {
         }
       throw new ReviewerErrorClass({
         kind: "spawn_failed",
         agent: args.agentKind,
-        reason: `CP-7: reviewer substrate engage failed for a Trusted agent \u2014 refusing the unsandboxed (ambient-cred) fallback (fail-closed): ${e.message}`,
+        reason: "CP-7: reviewer substrate engage failed for a Trusted agent \u2014 refusing the unsandboxed (ambient-cred) fallback (fail-closed)",
         failureReason: "spawn_failed"
       });
     }
-    return result.mode === "reduced_trust" ? (this.surfaceReviewerReducedTrust(args, result.reducedTrustReason), await result.teardown().catch(() => {
-    }), NO_TEARDOWN) : (result.reducedTrust && this.surfaceReviewerReducedTrust(
+    return result.mode === "reduced_trust" ? (this.surfaceReviewerReducedTrust(args, result.reducedTrustReason), await result.teardown(), NO_TEARDOWN) : (result.reducedTrust && this.surfaceReviewerReducedTrust(
       args,
       result.reducedTrustReason ?? "coarse egress (A5 sandbox-exec) \u2014 reviewer is sandboxed but loopback-only."
     ), {
@@ -54712,7 +55117,7 @@ var QuorumLoop = class _QuorumLoop {
         reason
       ), logger.warn("[QuorumLoop] reduced-trust badge surfaceHalt threw (badge is best-effort) \u2014 continuing", {
         seatId: args.seatId,
-        err: e.message
+        ...errorShapeOnly(e)
       });
     }
   }
@@ -54767,13 +55172,20 @@ var QuorumLoop = class _QuorumLoop {
         });
         if (result.mode === "substrate")
           return { mode: "substrate", handle: result.substrateHandle, teardown: () => result.teardown() };
-        await result.teardown().catch(() => {
-        });
+        try {
+          await result.teardown();
+        } catch (cleanupError) {
+          return logger.warn("[QuorumLoop] Wave B reduced-trust cleanup failed \u2014 refusing fallback", {
+            taskId,
+            agent,
+            ...errorShapeOnly(cleanupError)
+          }), { mode: "none" };
+        }
       } catch (e) {
         logger.warn("[QuorumLoop] Wave B substrate engage failed \u2014 falling through to trusted-container/none", {
           taskId,
           agent,
-          err: e.message
+          ...errorShapeOnly(e)
         });
       }
     return isTrustedContainerBoundary() ? { mode: "trusted_container", teardown: async () => {
@@ -54804,9 +55216,11 @@ var QuorumLoop = class _QuorumLoop {
         ...substrate !== void 0 ? { substrate } : {}
       });
       if (!outcome.exit_success)
-        throw new Error(
-          `class-2 resolver model call exited non-zero: ${outcome.stderr.trim().slice(0, 200)}`
-        );
+        throw logger.warn("[QuorumLoop] class-2 resolver model call exited non-zero", {
+          ownerTaskId: args.ownerTaskId,
+          stdoutShape: outputShapeOnly(outcome.stdout),
+          stderrShape: outputShapeOnly(outcome.stderr)
+        }), new Error("class-2 resolver model call exited non-zero");
       return outcome.stdout;
     };
     return {
@@ -54850,7 +55264,7 @@ var QuorumLoop = class _QuorumLoop {
         return { establishable: !0, via: "ladder_tier" };
     } catch (err) {
       logger.warn("[QuorumLoop] A1d resolver probe: ladder select failed \u2014 treating as no tier", {
-        err: err.message
+        ...errorShapeOnly(err)
       });
     }
     return (this.deps.resolverProbeDeps?.trustedContainer ?? isTrustedContainerBoundary)() ? { establishable: !0, via: "trusted_container" } : { establishable: !1 };
@@ -54981,8 +55395,8 @@ var QuorumLoop = class _QuorumLoop {
             taskId: tid,
             exitCode: exit.exitCode,
             runtimeMs: exit.runtimeMs,
-            stdoutTail: handle.stdout().slice(-2e3),
-            stderrExcerpt: handle.stderr().slice(0, 600)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           }), exit.failureClass !== null)
             throw new Error(`agentic resolver implementor failed: ${exit.failureClass}`);
         }
@@ -55045,6 +55459,7 @@ var QuorumLoop = class _QuorumLoop {
         });
         continue;
       }
+      let candidateError;
       try {
         let substrate = confinement.mode === "substrate" ? confinement.handle : void 0, spec = {
           seat_id: 0,
@@ -55067,14 +55482,27 @@ var QuorumLoop = class _QuorumLoop {
           ...pass ? {} : { reason: `final-tip Tier-2 verdict: ${verdict.verdict}` }
         };
       } catch (e) {
-        lastFailure = `final-tip Tier-2 reviewer error (${agent}): ${e.message}`, logger.warn("[QuorumLoop] final-tip Tier-2 candidate failed \u2014 trying next", {
+        candidateError = e, lastFailure = `final-tip Tier-2 reviewer ${agent} failed to produce a verdict`, logger.warn("[QuorumLoop] final-tip Tier-2 candidate failed \u2014 trying next", {
           ownerTaskId: args.ownerTaskId,
           agent,
-          err: e.message.slice(0, 300)
+          ...errorShapeOnly(e)
         });
       } finally {
-        await confinement.teardown().catch(() => {
-        });
+        try {
+          await confinement.teardown();
+        } catch (cleanupError) {
+          throw logger.warn("[QuorumLoop] final-tip Tier-2 substrate cleanup failed \u2014 failing closed", {
+            ownerTaskId: args.ownerTaskId,
+            agent,
+            ...errorShapeOnly(cleanupError)
+          }), candidateError !== void 0 ? Object.assign(
+            new Error("final-tip Tier-2 evaluation failed and substrate cleanup also failed"),
+            { causes: [candidateError, cleanupError] }
+          ) : Object.assign(
+            new Error("final-tip Tier-2 substrate cleanup failed"),
+            { cause: cleanupError }
+          );
+        }
       }
     }
     return {
@@ -56825,7 +57253,7 @@ function seatKey(gateId, seatId) {
   return `${gateId}::${seatId}`;
 }
 function seatLabel(agentKind, seatId) {
-  return `${REVIEWER_AGENT_DISPLAY_NAME[agentKind] ?? agentKind} (seat ${seatId})`;
+  return `${REVIEWER_AGENT_DISPLAY_NAME[agentKind] ?? agentKind} (seat ${displayOrdinal(seatId)})`;
 }
 function diffCapturedProgress(round, files) {
   let created = 0, modified = 0, deleted = 0;
@@ -57793,7 +58221,7 @@ async function runOrchestrationShell(args) {
     });
   }
   workspaceTerminalCoordinator && await workspaceTerminalCoordinator.replayPending(), processMarkers();
-  let unsubscribeEvents = null, pendingDurableResolutions = /* @__PURE__ */ new Map(), durableDecisionEffectDispatcher = null, dispatchDurableDecisionEffect = async (resolution) => {
+  let inkUnmount = null, nonTtyAbort = null, explicitExit = null, sessionRetiredExitRequested = !1, triggerSessionRetiredTeardown = null, unsubscribeEvents = null, pendingDurableResolutions = /* @__PURE__ */ new Map(), durableDecisionEffectDispatcher = null, dispatchDurableDecisionEffect = async (resolution) => {
     if (!durableDecisionEffectDispatcher) {
       pendingDurableResolutions.set(resolution.eventId, resolution);
       return;
@@ -57929,6 +58357,16 @@ async function runOrchestrationShell(args) {
               text: "Gate history recovery is unavailable. Existing gate actions remain fail-closed until recovery succeeds."
             })) : rejectInitialSubscription(error);
           });
+        },
+        onSessionRetired: () => {
+          logger.warn(
+            "[orchestration-shell] Session permanently retired on backend; triggering fail-closed teardown",
+            { sessionId: args.session.sessionId }
+          ), store.dispatch({
+            type: "SHELL_ADVISORY",
+            source: "shell",
+            text: "Hosted session has been retired. Exiting orchestration shell."
+          }), triggerSessionRetiredTeardown ? triggerSessionRetiredTeardown() : sessionRetiredExitRequested = !0;
         }
       }
     );
@@ -58171,7 +58609,7 @@ async function runOrchestrationShell(args) {
       if (admitted.length === 0) return;
       await Promise.allSettled(admitted);
     }
-  }, NORMAL_SHUTDOWN_TIMEOUT_MS = 1e4, SIGNAL_SHUTDOWN_TIMEOUT_MS = 3e3, SESSION_RETIRE_TIMEOUT_MS2 = 3e3, hostedSessionIngressFenced = !1, hostedSessionIngressFenceFailures = [], hostedSessionIngressFenceDrain = Promise.resolve(), shutdownFailure = (message, reason) => Object.assign(
+  }, NORMAL_SHUTDOWN_TIMEOUT_MS = 1e4, SIGNAL_SHUTDOWN_TIMEOUT_MS = 3e3, SESSION_RETIRE_TIMEOUT_MS2 = 3e3, hostedSessionIngressFenced = !1, hostedRetirementMutationStarted = !1, lastDitchRetirementPromise = null, hostedSessionIngressFenceFailures = [], hostedSessionIngressFenceDrain = Promise.resolve(), shutdownFailure = (message, reason) => Object.assign(
     new Error(
       `${message}: ${reason instanceof Error ? reason.message : String(reason)}`
     ),
@@ -58242,7 +58680,7 @@ async function runOrchestrationShell(args) {
         shutdownFailure("session heartbeat stop failed", reason)
       );
     }
-  }, hostedRetirementMutationStarted = !1, retireHostedSession = async () => {
+  }, retireHostedSession = async () => {
     await hostedSessionIngressFenceDrain;
     let failures = [...hostedSessionIngressFenceFailures];
     try {
@@ -58279,11 +58717,11 @@ async function runOrchestrationShell(args) {
         new Error("final ContextItems publication did not converge"),
         { causes: failures }
       );
-  }, workspaceResourceRetirement = null, plannerTeardown = createBoundedSharedShutdownOperation({
+  }, workspaceResourceRetirement = null, teardownDeadlineExpired = !1, plannerTeardown = createBoundedSharedShutdownOperation({
     normalTimeoutMs: NORMAL_SHUTDOWN_TIMEOUT_MS,
     signalTimeoutMs: SIGNAL_SHUTDOWN_TIMEOUT_MS,
     onTimeout: (deadlineClass, timeoutMs) => {
-      logger.warn("[orchestration-shell] planner teardown timed out", {
+      teardownDeadlineExpired = !0, logger.warn("[orchestration-shell] planner teardown timed out", {
         deadlineClass,
         timeoutMs
       });
@@ -58350,47 +58788,75 @@ async function runOrchestrationShell(args) {
       });
     }
   }), runPlannerTeardown = async (deadlineClass = "normal") => {
-    let boundedCompletion = plannerTeardown.wait(deadlineClass);
-    if (deadlineClass === "signal") return boundedCompletion;
-    let requiredRetirement = workspaceResourceRetirement;
+    let boundedCompletion = plannerTeardown.wait(deadlineClass), requiredRetirement = workspaceResourceRetirement;
     if (!requiredRetirement)
       throw new Error("workspace retirement boundary was not published");
     let [boundedResult] = await Promise.allSettled([boundedCompletion]);
-    if (boundedResult.status === "rejected" && boundedResult.reason?.teardownDeadlineExpired === !0 && // The leak scenario is a hung EARLIER phase starving `retireHostedSession`
+    if ((teardownDeadlineExpired || boundedResult.status === "rejected" && boundedResult.reason?.teardownDeadlineExpired === !0) && // The leak scenario is a hung EARLIER phase starving `retireHostedSession`
     // before it could issue its mutation. If the ordered mutation already
     // started (in flight when the deadline expired, or settled with the
     // deadline expiring on a parallel phase such as the planner flush), the
     // last-ditch duplicate is redundant — skip it.
-    !hostedRetirementMutationStarted) {
-      let timer;
-      try {
-        await Promise.race([
-          args.appsyncClient.updateSession({
-            sessionId: args.session.sessionId,
-            status: "INACTIVE" /* INACTIVE */
-          }).then(() => {
-            logger.warn(
-              "[orchestration-shell] last-ditch session retirement landed after teardown timeout",
-              { sessionId: args.session.sessionId }
-            );
-          }).catch((reason) => {
-            logger.warn("[orchestration-shell] last-ditch session retirement failed", {
-              sessionId: args.session.sessionId,
-              errorName: reason?.name ?? "Error"
-            });
-          }),
-          new Promise((resolve21) => {
-            timer = setTimeout(resolve21, SESSION_RETIRE_TIMEOUT_MS2), timer.unref?.();
-          })
-        ]);
-      } finally {
-        timer && clearTimeout(timer);
+    !hostedRetirementMutationStarted)
+      if (lastDitchRetirementPromise)
+        await lastDitchRetirementPromise;
+      else {
+        let timer;
+        lastDitchRetirementPromise = (async () => {
+          try {
+            await Promise.race([
+              args.appsyncClient.updateSession({
+                sessionId: args.session.sessionId,
+                status: "INACTIVE" /* INACTIVE */
+              }).then(() => {
+                logger.warn(
+                  "[orchestration-shell] last-ditch session retirement landed after teardown timeout",
+                  { sessionId: args.session.sessionId }
+                );
+              }).catch((reason) => {
+                logger.warn("[orchestration-shell] last-ditch session retirement failed", {
+                  sessionId: args.session.sessionId,
+                  errorName: reason?.name ?? "Error"
+                });
+              }),
+              new Promise((resolve21) => {
+                timer = setTimeout(resolve21, SESSION_RETIRE_TIMEOUT_MS2), timer.unref?.();
+              })
+            ]);
+          } finally {
+            timer && clearTimeout(timer);
+          }
+        })(), await lastDitchRetirementPromise;
       }
-    }
-    let [retirementResult] = await Promise.allSettled([requiredRetirement]);
+    let [retirementResult] = await Promise.allSettled(
+      deadlineClass === "signal" && teardownDeadlineExpired ? [] : [requiredRetirement]
+    );
     if (boundedResult.status === "rejected") throw boundedResult.reason;
-    if (retirementResult.status === "rejected") throw retirementResult.reason;
-  }, inkUnmount = null, nonTtyAbort = null, signalShutdownStarted = !1, signalShutdownCompletion = null, signalsRegistered = /* @__PURE__ */ new Set(), onSignal = (sig) => {
+    if (retirementResult && retirementResult.status === "rejected") throw retirementResult.reason;
+  };
+  triggerSessionRetiredTeardown = () => {
+    if (sessionRetiredExitRequested = !0, nonTtyAbort)
+      try {
+        nonTtyAbort.abort();
+      } catch {
+      }
+    if (explicitExit)
+      try {
+        explicitExit.start();
+      } catch {
+      }
+    else if (inkUnmount)
+      try {
+        inkUnmount(), inkUnmount = null;
+      } catch {
+      }
+    runPlannerTeardown("normal").catch((err) => {
+      logger.warn("[orchestration-shell] session-retired teardown failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
+  }, sessionRetiredExitRequested && triggerSessionRetiredTeardown();
+  let signalShutdownStarted = !1, signalShutdownCompletion = null, signalsRegistered = /* @__PURE__ */ new Set(), onSignal = (sig) => {
     signalShutdownCompletion || (signalShutdownStarted = !0, disableBracketedPaste(), signalShutdownCompletion = Promise.allSettled([runPlannerTeardown("signal")]).then(() => {
     }).finally(() => {
       logger.info(`[orchestration-shell] caught ${sig}, teardown complete`);
@@ -58409,7 +58875,7 @@ async function runOrchestrationShell(args) {
       try {
         process.kill(process.pid, sig);
       } catch {
-        let code = sig === "SIGTERM" ? 143 : 130;
+        let code = sig === "SIGTERM" ? 143 : sig === "SIGHUP" ? 129 : 130;
         process.exit(code);
       }
     }));
@@ -58621,14 +59087,19 @@ async function runOrchestrationShell(args) {
     // land in the active conversation. ABSENT on a non-team session.
     ...args.groupDecisionDeps ? { groupDecision: { ...args.groupDecisionDeps, store } } : {}
   };
-  mobileGateDecisionDeps = gateDecisionDeps, process.once("SIGINT", onSignal), signalsRegistered.add("SIGINT"), process.once("SIGTERM", onSignal), signalsRegistered.add("SIGTERM");
+  mobileGateDecisionDeps = gateDecisionDeps, process.on("SIGINT", onSignal), signalsRegistered.add("SIGINT"), process.on("SIGTERM", onSignal), signalsRegistered.add("SIGTERM"), process.on("SIGHUP", onSignal), signalsRegistered.add("SIGHUP");
   try {
     if (signalShutdownCompletion) {
       await signalShutdownCompletion;
       return;
     }
+    if (sessionRetiredExitRequested)
+      return;
     if (args.acceptSessionLifecycleOwnership?.(), !isInteractiveTty()) {
-      nonTtyAbort = new AbortController();
+      if (nonTtyAbort = new AbortController(), sessionRetiredExitRequested) {
+        nonTtyAbort = null;
+        return;
+      }
       try {
         await runLineLogFallback({
           store,
@@ -58656,6 +59127,8 @@ async function runOrchestrationShell(args) {
       await signalShutdownCompletion;
       return;
     }
+    if (sessionRetiredExitRequested)
+      return;
     let { ink } = getInkRuntime(), { waitUntilExit, unmount } = ink.render(
       React20.createElement(OrchestrationApp, {
         store,
@@ -58706,19 +59179,21 @@ async function runOrchestrationShell(args) {
       { stdout: process.stdout }
     );
     inkUnmount = unmount;
-    let explicitExit = createExplicitTtyExitCoordinator({
+    let ttyExplicitExit = createExplicitTtyExitCoordinator({
       runTeardown: runPlannerTeardown,
       unmount: () => {
         inkUnmount && (inkUnmount(), inkUnmount = null);
       }
-    }), unsubscribe = store.subscribe((state) => {
+    });
+    explicitExit = ttyExplicitExit, sessionRetiredExitRequested && ttyExplicitExit.start();
+    let unsubscribe = store.subscribe((state) => {
       let last = state.conversation[state.conversation.length - 1];
-      last && last.kind === "slash-output" && isExitCommand(last.command) && explicitExit.start();
+      last && last.kind === "slash-output" && isExitCommand(last.command) && ttyExplicitExit.start();
     });
     try {
-      await Promise.race([waitUntilExit(), explicitExit.completion]);
+      await Promise.race([waitUntilExit(), ttyExplicitExit.completion]);
     } finally {
-      unsubscribe(), inkUnmount = null;
+      unsubscribe(), inkUnmount = null, explicitExit = null;
     }
   } finally {
     try {
@@ -59275,8 +59750,8 @@ function routeTeamShellEventToStore(store, evt) {
     return;
   }
   if (source === "task_group_halted") {
-    let haltReason = typeof md.haltReason == "string" ? md.haltReason : "halted";
-    store.dispatch({ type: "TEAM_HALTED", haltReason });
+    let haltReason = typeof md.haltReason == "string" ? md.haltReason : "halted", completedAt = typeof md.completed_at == "string" ? md.completed_at : typeof md.completedAt == "string" ? md.completedAt : void 0;
+    store.dispatch({ type: "TEAM_HALTED", haltReason, ...completedAt ? { completedAt } : {} });
     let team = store.getState().team;
     if (team)
       for (let [trackIndex, t] of team.tracks)
@@ -59322,8 +59797,12 @@ function routeTeamShellEventToStore(store, evt) {
     if (!team || team.groupResolved) return;
     let trackStates = [...team.tracks.values()].map((t) => t.state), allTerminal = trackStates.length > 0 && trackStates.every((s) => s === "Passed" || s === "Failed"), anyFailed = trackStates.some((s) => s === "Failed");
     if (!allTerminal || !anyFailed) return;
-    let failedTrackIndices = [...team.tracks.entries()].filter(([, t]) => t.state === "Failed").map(([idx]) => idx).sort((a, b) => a - b), failedLabel = failedTrackIndices.length === 1 ? `track ${displayTrackNumber(failedTrackIndices[0])}` : `tracks ${failedTrackIndices.map(displayTrackNumber).join(", ")}`;
-    store.dispatch({ type: "TEAM_GROUP_RESOLVED", outcome: `team_halted:${reason}` }), store.dispatch({
+    let failedTrackIndices = [...team.tracks.entries()].filter(([, t]) => t.state === "Failed").map(([idx]) => idx).sort((a, b) => a - b), failedLabel = failedTrackIndices.length === 1 ? `track ${displayTrackNumber(failedTrackIndices[0])}` : `tracks ${failedTrackIndices.map(displayTrackNumber).join(", ")}`, localHaltCompletedAt = typeof md.completed_at == "string" ? md.completed_at : typeof md.completedAt == "string" ? md.completedAt : void 0;
+    store.dispatch({
+      type: "TEAM_GROUP_RESOLVED",
+      outcome: `team_halted:${reason}`,
+      ...localHaltCompletedAt ? { completedAt: localHaltCompletedAt } : {}
+    }), store.dispatch({
       type: "SHELL_ADVISORY",
       source: "shell",
       text: `Agent Teams: Team halted \u2014 ${failedLabel} failed (${reason}). Passing tracks were not applied to your files; CodeVibe will clean up their disposable task resources automatically.`
@@ -59333,8 +59812,12 @@ function routeTeamShellEventToStore(store, evt) {
   if (source === "team_group_resolved") {
     let outcome = md.outcome;
     if (typeof outcome != "string" || outcome.length === 0) return;
-    let priorTeam = store.getState().team, alreadyResolvedSame = priorTeam?.groupResolved === !0 && priorTeam.outcome === outcome;
-    if (store.dispatch({ type: "TEAM_GROUP_RESOLVED", outcome }), alreadyResolvedSame) return;
+    let completedAt = typeof md.completed_at == "string" ? md.completed_at : typeof md.completedAt == "string" ? md.completedAt : void 0, priorTeam = store.getState().team, alreadyResolvedSame = priorTeam?.groupResolved === !0 && priorTeam.outcome === outcome;
+    if (store.dispatch({
+      type: "TEAM_GROUP_RESOLVED",
+      outcome,
+      ...completedAt ? { completedAt } : {}
+    }), alreadyResolvedSame) return;
     let text2 = outcome === "complete" ? "Agent Teams: Team complete" : `Agent Teams: Team halted \u2014 ${outcome}`;
     store.dispatch({ type: "SHELL_ADVISORY", source: "shell", text: text2 });
     return;
@@ -62517,6 +63000,11 @@ var GATE_PROMPT_KIND_LABEL = {
   orchestration_escalated_gate: "escalated review gate",
   continuation_offer_handoff: "continuation handoff offer"
 };
+function parseIsoTimestamp(iso) {
+  if (!iso) return 0;
+  let t = Date.parse(iso);
+  return Number.isFinite(t) ? t : 0;
+}
 function buildStatusSummary(state, quorumLoop) {
   let lines = [];
   if (state.team) {
@@ -62548,7 +63036,80 @@ function buildStatusSummary(state, quorumLoop) {
       `Awaiting your decision: ${label} for task ${entry.envelope.taskId} \u2014 reply with an option number (1-${entry.envelope.options.length})${queued}.`
     );
   }
-  let outcome = state.team ? null : quorumLoop?.getLastWorkspaceOutcome() ?? null;
+  let rawOutcome = quorumLoop?.getLastWorkspaceOutcome() ?? null, outcome = null;
+  if (rawOutcome !== null && !teamActive)
+    if (rawOutcome.taskId) {
+      let refTask = state.sessionTasks.get(rawOutcome.taskId);
+      if (refTask && refTask.origin === "single")
+        if (!state.team)
+          outcome = rawOutcome;
+        else {
+          let singleTaskTime = Math.max(
+            parseIsoTimestamp(rawOutcome.completedAt),
+            parseIsoTimestamp(refTask.completedAt),
+            parseIsoTimestamp(refTask.startedAt)
+          ), teamTasks = [...state.sessionTasks.values()].filter(
+            (t) => t.origin === "team"
+          ), maxTeamTrackTime = teamTasks.length > 0 ? Math.max(
+            ...teamTasks.map(
+              (tt) => Math.max(
+                parseIsoTimestamp(tt.completedAt),
+                parseIsoTimestamp(tt.startedAt)
+              )
+            )
+          ) : 0, teamStartedTime = parseIsoTimestamp(state.team.startedAt), teamCompletedTime = parseIsoTimestamp(state.team.completedAt), latestTeamTime = Math.max(
+            teamStartedTime,
+            teamCompletedTime,
+            maxTeamTrackTime
+          ), teamRanAfter;
+          if (latestTeamTime !== singleTaskTime)
+            teamRanAfter = latestTeamTime > singleTaskTime || teamTasks.length === 0 && teamStartedTime === 0 && teamCompletedTime === 0;
+          else {
+            let teamSeq = Math.max(
+              state.team.terminalSeq ?? 0,
+              ...teamTasks.map((tt) => tt.terminalSeq ?? 0)
+            ), singleSeq = refTask.terminalSeq ?? 0;
+            teamSeq > 0 && singleSeq > 0 ? teamRanAfter = teamSeq > singleSeq : teamRanAfter = teamTasks.length === 0 && teamStartedTime === 0 && teamCompletedTime === 0;
+          }
+          teamRanAfter || (outcome = rawOutcome);
+        }
+    } else if (!state.team)
+      outcome = rawOutcome;
+    else {
+      let singleTasks = [...state.sessionTasks.values()].filter(
+        (t) => t.origin === "single"
+      );
+      if (singleTasks.length > 0) {
+        let latestSingle = singleTasks.reduce((latest, curr) => {
+          let currTime = Math.max(
+            parseIsoTimestamp(curr.completedAt),
+            parseIsoTimestamp(curr.startedAt)
+          ), latestTime = Math.max(
+            parseIsoTimestamp(latest.completedAt),
+            parseIsoTimestamp(latest.startedAt)
+          );
+          return currTime > latestTime ? curr : latest;
+        }), singleTaskTime = Math.max(
+          parseIsoTimestamp(rawOutcome.completedAt),
+          parseIsoTimestamp(latestSingle.completedAt),
+          parseIsoTimestamp(latestSingle.startedAt)
+        ), teamTasks = [...state.sessionTasks.values()].filter(
+          (t) => t.origin === "team"
+        ), maxTeamTrackTime = teamTasks.length > 0 ? Math.max(
+          ...teamTasks.map(
+            (tt) => Math.max(
+              parseIsoTimestamp(tt.completedAt),
+              parseIsoTimestamp(tt.startedAt)
+            )
+          )
+        ) : 0, teamStartedTime = parseIsoTimestamp(state.team.startedAt), teamCompletedTime = parseIsoTimestamp(state.team.completedAt);
+        Math.max(
+          teamStartedTime,
+          teamCompletedTime,
+          maxTeamTrackTime
+        ) > singleTaskTime || teamTasks.length === 0 && teamStartedTime === 0 && teamCompletedTime === 0 || (outcome = rawOutcome);
+      }
+    }
   if (outcome && outcome.kind === "promoted") {
     let n = outcome.files.length;
     n > 0 ? lines.push(
@@ -65193,7 +65754,7 @@ function buildSanitizedBaseEnv(input) {
     let v = safeSource[key];
     typeof v == "string" && v.length > 0 && (env[key] = v);
   }
-  return input.provider === "anthropic" ? env.ANTHROPIC_BASE_URL = input.sandboxBrokerUrl : env.OPENAI_BASE_URL = `${input.sandboxBrokerUrl.replace(/\/+$/, "")}/v1`, input.provider === "anthropic" ? (env.CLAUDE_CONFIG_DIR = input.sandboxBootstrapDir, env.CLAUDE_CODE_TMPDIR = input.sandboxBootstrapDir) : env.CODEX_HOME = input.sandboxBootstrapDir, env;
+  return input.provider === "anthropic" ? env.ANTHROPIC_BASE_URL = input.sandboxBrokerUrl : env.OPENAI_BASE_URL = `${input.sandboxBrokerUrl.replace(/\/+$/, "")}/v1`, input.provider === "anthropic" ? (env.CLAUDE_CONFIG_DIR = input.sandboxBootstrapDir, env.CLAUDE_CODE_TMPDIR = input.claudeScratchDir ?? input.sandboxBootstrapDir) : env.CODEX_HOME = input.sandboxBootstrapDir, env;
 }
 var FORBIDDEN_KEY_PATTERNS = [
   /^ANTHROPIC_API_KEY$/i,
@@ -65319,16 +65880,36 @@ async function engageSubstrate(input) {
   try {
     ({ hostBrokerAddr } = await broker.start());
   } catch (e) {
-    throw await broker.stop().catch(() => {
-    }), new Error(
-      `CP-7: broker failed to start \u2014 refusing to launch the implementor (fail-closed): ${e.message}`
+    let primary = Object.assign(
+      new Error("CP-7: broker failed to start \u2014 refusing to launch the implementor (fail-closed)"),
+      { cause: e }
     );
+    try {
+      await broker.stop();
+    } catch (cleanupError) {
+      throw Object.assign(
+        new Error("CP-7: broker start failed and cleanup also failed"),
+        { causes: [primary, cleanupError] }
+      );
+    }
+    throw primary;
   }
   let initialTokenObj = broker.currentBrokerToken();
-  if (!initialTokenObj)
-    throw await broker.stop().catch(() => {
-    }), new Error("CP-7: broker minted no token \u2014 refusing to launch (fail-closed)");
-  let initialToken = initialTokenObj.value, sandboxBrokerUrl = selection.tier === "docker" ? `http://127.0.0.1:${RELAY_PORT}` : `http://${hostBrokerAddr}`, sandboxHome = selection.tier === "docker" ? CONTAINER_WORKDIR : input.workdir, sandboxBootstrapMount = selection.tier === "docker" ? SANDBOX_BOOTSTRAP_DIR : null, sandboxConfigMount = selection.tier === "docker" ? SANDBOX_AGENT_CONFIG_DIR : null, bootstrap, handle;
+  if (!initialTokenObj) {
+    let primary = new Error(
+      "CP-7: broker minted no token \u2014 refusing to launch (fail-closed)"
+    );
+    try {
+      await broker.stop();
+    } catch (cleanupError) {
+      throw Object.assign(
+        new Error("CP-7: broker minted no token and cleanup also failed"),
+        { causes: [primary, cleanupError] }
+      );
+    }
+    throw primary;
+  }
+  let initialToken = initialTokenObj.value, sandboxBrokerUrl = selection.tier === "docker" ? `http://127.0.0.1:${RELAY_PORT}` : `http://${hostBrokerAddr}`, sandboxHome = selection.tier === "docker" ? CONTAINER_WORKDIR : input.workdir, sandboxBootstrapMount = selection.tier === "docker" ? SANDBOX_BOOTSTRAP_DIR : null, sandboxConfigMount = selection.tier === "docker" ? SANDBOX_AGENT_CONFIG_DIR : null, bootstrap, handle, activeTeardown;
   try {
     bootstrap = await ApiKeyBootstrap.create({
       provider,
@@ -65339,6 +65920,7 @@ async function engageSubstrate(input) {
         sandboxConfigDir: sandboxConfigMount ?? SANDBOX_AGENT_CONFIG_DIR
       } : { sandboxDirEqualsHostDir: !0, configDirEqualsHostDir: !0 },
       hostRoot: input.bootstrapHostRoot,
+      ...selection.tier === "sandbox_exec" && provider === "anthropic" ? { claudeScratchHostRoot: input.claudeScratchHostRoot ?? "/tmp" } : {},
       // M-2 — fail closed if the bootstrap dir lands inside the agent's rw
       // workdir mount (the token would leak through it).
       workdir: input.workdir,
@@ -65350,11 +65932,12 @@ async function engageSubstrate(input) {
     ), agentConfigSpec = sandboxConfigMount !== null ? { hostDir: bootstrap.configHostDir, sandboxDir: sandboxConfigMount } : (
       // A5: sandbox fs == host fs → config path equals the host dir.
       { hostDir: bootstrap.configHostDir, sandboxDir: bootstrap.configHostDir }
-    ), sanitizedBase = buildSanitizedBaseEnv({
+    ), agentScratchSpec = bootstrap.claudeScratchSpec, sanitizedBase = buildSanitizedBaseEnv({
       provider,
       sandboxBrokerUrl,
       sandboxHome,
       sandboxBootstrapDir: agentConfigSpec.sandboxDir,
+      ...agentScratchSpec !== null ? { claudeScratchDir: agentScratchSpec.sandboxDir } : {},
       safeSource: input.localeSource
     });
     assertNoAmbientCreds(sanitizedBase);
@@ -65368,6 +65951,7 @@ async function engageSubstrate(input) {
       sanitizedEnv: finalEnv,
       agentBootstrap: agentBootstrapSpec,
       agentConfig: agentConfigSpec,
+      ...agentScratchSpec !== null ? { agentScratch: agentScratchSpec } : {},
       // CP-7 W3 — Stage-2 r1 HIGH. The resolved audit dir → A5 trailing deny.
       // Undefined when a test injects its own in-memory sink (no real tree).
       ...resolvedAuditDir !== null ? { auditDir: resolvedAuditDir } : {}
@@ -65376,12 +65960,30 @@ async function engageSubstrate(input) {
       `[CP-7] Substrate engaged (tier=${selection.tier}, egress=${handle.egressFidelity}) \u2014 agent is creditless, broker holds the key`,
       { taskId: input.taskId, agent: input.agentKind }
     );
-    let liveBootstrap = bootstrap, liveHandle = handle, liveBroker = broker, refreshTimer = null, teardown = async () => {
-      refreshTimer && (clearInterval(refreshTimer), refreshTimer = null), await liveHandle.teardown().catch(() => {
-      }), await liveBroker.stop().catch(() => {
-      }), await liveBootstrap.destroy().catch(() => {
-      });
-    }, launchId = `launch-${input.taskId}-${Date.now()}`, denialReason = liveHandle.egressFidelity === "strict" ? "structural_deny_network_none" : "coarse_loopback_only", postureRes;
+    let liveBootstrap = bootstrap, liveHandle = handle, liveBroker = broker, refreshTimer = null, teardownPromise, teardown = () => teardownPromise || (teardownPromise = (async () => {
+      refreshTimer && (clearInterval(refreshTimer), refreshTimer = null);
+      let failures = [];
+      for (let cleanup of [
+        () => liveHandle.teardown(),
+        () => liveBroker.stop(),
+        () => liveBootstrap.destroy()
+      ])
+        try {
+          await cleanup();
+        } catch (error) {
+          failures.push(error);
+        }
+      if (failures.length > 0)
+        throw logger.warn("[CP-7] substrate cleanup failed \u2014 task cannot pass", {
+          taskId: input.taskId,
+          failureCount: failures.length,
+          ...errorShapeOnly(failures[0])
+        }), failures.length === 1 ? failures[0] : Object.assign(new Error("CP-7 substrate cleanup failed"), {
+          causes: failures
+        });
+    })(), teardownPromise);
+    activeTeardown = teardown;
+    let launchId = `launch-${input.taskId}-${Date.now()}`, denialReason = liveHandle.egressFidelity === "strict" ? "structural_deny_network_none" : "coarse_loopback_only", postureRes;
     try {
       postureRes = await auditSink.emit("egress_denied", {
         destination: "*",
@@ -65390,13 +65992,16 @@ async function engageSubstrate(input) {
         caller_event_id: launchId
       });
     } catch (e) {
-      throw await teardown(), new Error(
-        `CP-7 W3: egress-posture audit emit THREW \u2014 refusing to launch the creditless agent (audit-before-effect fail-closed): ${e.message}`
+      throw Object.assign(
+        new Error(
+          "CP-7 W3: egress-posture audit emit failed \u2014 refusing to launch the creditless agent (audit-before-effect fail-closed)"
+        ),
+        { cause: e }
       );
     }
     if (!("ack" in postureRes))
-      throw await teardown(), new Error(
-        `CP-7 W3: egress-posture audit nack'd ("${postureRes.nack}") \u2014 refusing to launch the creditless agent (no durable egress posture \u2192 no agent).`
+      throw new Error(
+        "CP-7 W3: egress-posture audit was rejected \u2014 refusing to launch the creditless agent (no durable egress posture \u2192 no agent)"
       );
     let refreshIntervalMs = input.tokenRefreshIntervalMs ?? 600 * 1e3, inFlightRefresh = null, doRefreshOnce = async () => {
       if (!(typeof liveBroker.rotateBrokerToken == "function" && typeof liveBroker.commitBrokerTokenRotation == "function" && typeof liveBroker.rollbackBrokerTokenRotation == "function")) {
@@ -65409,10 +66014,23 @@ async function engageSubstrate(input) {
         try {
           await liveBootstrap.refresh(rotated.token.value), liveBroker.commitBrokerTokenRotation(rotated);
         } catch (e) {
-          throw liveBroker.rollbackBrokerTokenRotation(rotated), logger.warn(
+          liveBroker.rollbackBrokerTokenRotation(rotated), logger.warn(
             "[CP-7] broker-token refresh write FAILED \u2014 rolled back to the prior token and tearing down (fail-closed)",
-            { taskId: input.taskId, err: e.message }
-          ), await teardown(), e instanceof Error ? e : new Error(String(e));
+            { taskId: input.taskId, ...errorShapeOnly(e) }
+          );
+          let refreshFailure = Object.assign(
+            new Error("CP-7 broker-token refresh failed"),
+            { cause: e }
+          );
+          try {
+            await teardown();
+          } catch (cleanupError) {
+            throw Object.assign(
+              new Error("CP-7 broker-token refresh failed and cleanup also failed"),
+              { causes: [refreshFailure, cleanupError] }
+            );
+          }
+          throw refreshFailure;
         }
     }, doRefresh = async () => {
       let next = (inFlightRefresh ?? Promise.resolve()).catch(() => {
@@ -65439,10 +66057,32 @@ async function engageSubstrate(input) {
       teardown
     };
   } catch (e) {
-    throw await handle?.teardown().catch(() => {
-    }), await bootstrap?.destroy().catch(() => {
-    }), await broker.stop().catch(() => {
-    }), e instanceof Error ? e : new Error(String(e));
+    let primary = e instanceof Error ? e : new Error("CP-7 substrate launch failed"), cleanupFailures = [];
+    if (activeTeardown)
+      try {
+        await activeTeardown();
+      } catch (cleanupError) {
+        cleanupFailures.push(cleanupError);
+      }
+    else
+      for (let cleanup of [
+        ...handle ? [() => handle.teardown()] : [],
+        ...bootstrap ? [() => bootstrap.destroy()] : [],
+        () => broker.stop()
+      ])
+        try {
+          await cleanup();
+        } catch (cleanupError) {
+          cleanupFailures.push(cleanupError);
+        }
+    throw cleanupFailures.length > 0 ? (logger.warn("[CP-7] failed launch also failed cleanup", {
+      taskId: input.taskId,
+      failureCount: cleanupFailures.length,
+      ...errorShapeOnly(cleanupFailures[0])
+    }), Object.assign(
+      new Error("CP-7 substrate launch failed and cleanup also failed"),
+      { causes: [primary, ...cleanupFailures] }
+    )) : primary;
   }
 }
 var RESOLVER_AGENT_STATE_DIR_SEGMENTS = {
@@ -67223,13 +67863,14 @@ function createAdmittedSessionOwnershipController(appsyncClient) {
     appsyncClient,
     admittedSession.sessionId
   ), retirement) : Promise.resolve(), removeTemporarySignalHandlers = () => {
-    process.removeListener("SIGINT", onSigint), process.removeListener("SIGTERM", onSigterm);
+    process.removeListener("SIGINT", onSigint), process.removeListener("SIGTERM", onSigterm), process.removeListener("SIGHUP", onSighup);
   }, handleSignal = (signal) => {
-    signalReceived || ownershipAccepted || closed || (signalReceived = !0, removeTemporarySignalHandlers(), retireOnce().finally(() => {
+    signalReceived || ownershipAccepted || closed || (signalReceived = !0, retireOnce().finally(() => {
+      removeTemporarySignalHandlers();
       try {
         process.kill(process.pid, signal);
       } catch {
-        process.exit(signal === "SIGTERM" ? 143 : 130);
+        process.exit(signal === "SIGTERM" ? 143 : signal === "SIGHUP" ? 129 : 130);
       }
     }));
   };
@@ -67239,7 +67880,10 @@ function createAdmittedSessionOwnershipController(appsyncClient) {
   function onSigterm() {
     handleSignal("SIGTERM");
   }
-  process.once("SIGINT", onSigint), process.once("SIGTERM", onSigterm);
+  function onSighup() {
+    handleSignal("SIGHUP");
+  }
+  process.on("SIGINT", onSigint), process.on("SIGTERM", onSigterm), process.on("SIGHUP", onSighup);
   let close = async () => {
     if (closed) return retirement ?? Promise.resolve();
     closed = !0, removeTemporarySignalHandlers(), ownershipAccepted || await retireOnce();
@@ -67270,6 +67914,20 @@ async function runWithAdmittedSessionOwnership(args) {
   let ownership = createAdmittedSessionOwnershipController(args.appsyncClient);
   return ownership.onAdmitted(args.session), ownership.run(args.launch);
 }
+var ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS = 600 * 1e3;
+async function triggerStartupOrphanSweep(appsyncClient, currentSessionId, staleThresholdMs = ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS) {
+  try {
+    return await appsyncClient.sweepOrphanSessions({
+      agentType: "CODEVIBE" /* CODEVIBE */,
+      staleThresholdMs,
+      excludeSessionIds: [currentSessionId]
+    });
+  } catch (err) {
+    return logger.warn("[cli] startup orphan sweep failed (non-fatal)", {
+      error: err?.message
+    }), 0;
+  }
+}
 async function runCompanion(args) {
   let { runCompanionMode: runCompanionMode2 } = (init_companion_mode(), __toCommonJS(companion_mode_exports));
   return runCompanionMode2({
@@ -67601,7 +68259,7 @@ ${err.message}
 `), 1;
   }
   let session = resolved.session;
-  return admissionOwnership.run(async (acceptSessionLifecycleOwnership) => {
+  return triggerStartupOrphanSweep(appsyncClient, session.sessionId), admissionOwnership.run(async (acceptSessionLifecycleOwnership) => {
     let emitter = createShellEventEmitter(appsyncClient, session), localPlanner = await buildLocalGemmaPlannerAdapter({
       state: localModelState
     });
@@ -68033,11 +68691,14 @@ function mapTeamSourceToTypedEvent(sessionId, md) {
     }
     case "team_group_resolved": {
       let outcome = teamMetaStr(md, "outcome");
-      return outcome ? { sessionId, type: "TEAM_GROUP_RESOLVED", source: "DESKTOP", isEncrypted: !0, metadata: {
+      if (!outcome) return null;
+      let completedAt = typeof md.completed_at == "string" ? md.completed_at : typeof md.completedAt == "string" ? md.completedAt : void 0, metadata = {
         team_event: "group_resolved",
         task_group_id: taskGroupId,
-        outcome
-      } } : null;
+        outcome,
+        ...completedAt ? { completed_at: completedAt } : {}
+      };
+      return { sessionId, type: "TEAM_GROUP_RESOLVED", source: "DESKTOP", isEncrypted: !0, metadata };
     }
     // NB TEAM_DECOMPOSED is emitted DIRECTLY at the launch layer
     // (launchTeamFromWorkItems, index.ts) which has no `leEmitShellEvent`, so it
@@ -68644,6 +69305,7 @@ require.main === module && main(process.argv.slice(2)).then(
   CliEntitlementError,
   CliUsageError,
   LocalModelPlannerUnavailableAdapter,
+  ORCHESTRATION_ORPHAN_SWEEP_STALE_THRESHOLD_MS,
   OrchestrationSessionBootstrapError,
   PlannerUnavailableError,
   bridgeAuthorityErrorToShellRefusal,
@@ -68669,5 +69331,6 @@ require.main === module && main(process.argv.slice(2)).then(
   resumeOrCreateSession,
   runAuditCli,
   runModelCli,
-  runWithAdmittedSessionOwnership
+  runWithAdmittedSessionOwnership,
+  triggerStartupOrphanSweep
 });