@quantiya/codevibe-core 2.0.72 → 2.0.74

package/dist/orchestration-shell/cli.js

@@ -321,6 +321,92 @@ function isAgentInstalled(agent, env, commonPaths = COMMON_AGENT_PATHS) {
     return !1;
   }
 }
+function firstNonEmpty(...values) {
+  for (let v of values)
+    if (typeof v == "string") {
+      let trimmed = v.trim();
+      if (trimmed.length > 0) return trimmed;
+    }
+  return null;
+}
+function detectAgentModel(agent, env = process.env, homeDirOrOptions, options) {
+  let homeDir = typeof homeDirOrOptions == "string" ? homeDirOrOptions : void 0, opts = typeof homeDirOrOptions == "object" && homeDirOrOptions !== null ? homeDirOrOptions : options, envKey = `CODEVIBE_${agent}_MODEL`, envKeyVal = firstNonEmpty(env[envKey]);
+  if (envKeyVal) return envKeyVal;
+  if (agent === "ANTIGRAVITY") {
+    let agyExplicit = firstNonEmpty(env.CODEVIBE_AGY_MODEL, env.CODEVIBE_ANTIGRAVITY_MODEL);
+    if (agyExplicit) return agyExplicit;
+  }
+  if (opts?.explicitOnly)
+    return null;
+  if (agent === "CODEX") {
+    let codexVal = firstNonEmpty(env.CODEX_MODEL, env.OPENAI_MODEL);
+    if (codexVal) return codexVal;
+  } else if (agent === "ANTIGRAVITY") {
+    let agyVal = firstNonEmpty(env.ANTIGRAVITY_MODEL, env.AGY_MODEL, env.GEMINI_MODEL);
+    if (agyVal) return agyVal;
+  } else if (agent === "CLAUDE") {
+    let claudeVal = firstNonEmpty(env.CLAUDE_MODEL, env.ANTHROPIC_MODEL);
+    if (claudeVal) return claudeVal;
+  }
+  let resolvedHome = homeDir ?? env.HOME;
+  if (agent === "CODEX")
+    try {
+      let codexHome = env.CODEX_HOME && env.CODEX_HOME.trim() ? env.CODEX_HOME.trim() : resolvedHome && resolvedHome.trim() ? path34.join(resolvedHome, ".codex") : null;
+      if (codexHome) {
+        let configPath = path34.join(codexHome, "config.toml");
+        if (fs29.existsSync(configPath)) {
+          let content = fs29.readFileSync(configPath, "utf8"), parsed = toml2.parse(content);
+          if (typeof parsed?.profile == "string" && typeof parsed.profiles?.[parsed.profile]?.model == "string") {
+            let profileModel = parsed.profiles[parsed.profile].model.trim();
+            if (profileModel) return profileModel;
+          }
+          if (typeof parsed?.model == "string" && parsed.model.trim())
+            return parsed.model.trim();
+        }
+      }
+    } catch {
+    }
+  if (resolvedHome && resolvedHome.trim()) {
+    if (agent === "ANTIGRAVITY") {
+      let candidates = [
+        path34.join(resolvedHome, ".gemini", "antigravity-cli", "settings.json"),
+        path34.join(resolvedHome, ".gemini", "settings.json")
+      ];
+      for (let candidate of candidates)
+        try {
+          if (fs29.existsSync(candidate)) {
+            let parsed = JSON.parse(fs29.readFileSync(candidate, "utf8"));
+            if (typeof parsed?.model == "string" && parsed.model.trim())
+              return parsed.model.trim();
+          }
+        } catch {
+        }
+    } else if (agent === "CLAUDE") {
+      let candidates = [
+        path34.join(resolvedHome, ".claude.json"),
+        path34.join(resolvedHome, ".claude", "settings.json")
+      ];
+      for (let candidate of candidates)
+        try {
+          if (fs29.existsSync(candidate)) {
+            let parsed = JSON.parse(fs29.readFileSync(candidate, "utf8"));
+            if (typeof parsed?.model == "string" && parsed.model.trim())
+              return parsed.model.trim();
+          }
+        } catch {
+        }
+    }
+  }
+  return DEFAULT_AGENT_MODELS[agent] ?? null;
+}
+function detectInstalledAgentModels(env = process.env, homeDir, installedAgents, options) {
+  let models = {}, installed = installedAgents ?? detectInstalledAgents(env);
+  for (let agent of installed) {
+    let model = detectAgentModel(agent, env, homeDir, options);
+    model && (models[agent] = model);
+  }
+  return logger.debug("[detectInstalledAgentModels] Detected models", { models }), models;
+}
 async function pushDetectedAgents(client, log, capabilityRegistry, detectFn = detectInstalledAgents, replace = !1) {
   let agents = detectFn();
   if (agents.length === 0) {
@@ -352,10 +438,10 @@ async function pushDetectedAgents(client, log, capabilityRegistry, detectFn = de
     });
   }
 }
-var import_child_process3, fs29, path34, AGENT_BINARIES, COMMON_AGENT_PATHS, init_detect_agents = __esm({
+var import_child_process3, fs29, path34, toml2, AGENT_BINARIES, COMMON_AGENT_PATHS, DEFAULT_AGENT_MODELS, init_detect_agents = __esm({
   "src/orchestration/detect-agents.ts"() {
     "use strict";
-    import_child_process3 = require("child_process"), fs29 = __toESM(require("fs")), path34 = __toESM(require("path"));
+    import_child_process3 = require("child_process"), fs29 = __toESM(require("fs")), path34 = __toESM(require("path")), toml2 = __toESM(require("@iarna/toml"));
     init_env_scrub();
     init_logger2();
     AGENT_BINARIES = {
@@ -372,6 +458,12 @@ var import_child_process3, fs29, path34, AGENT_BINARIES, COMMON_AGENT_PATHS, ini
       "/usr/bin",
       "/bin"
     ];
+    DEFAULT_AGENT_MODELS = {
+      CLAUDE: "claude-opus-5",
+      GEMINI: "gemini-2.5-pro",
+      CODEX: "gpt-6.1",
+      ANTIGRAVITY: "gemini-3.8"
+    };
   }
 });
 
@@ -8694,8 +8786,8 @@ function validateSourceCursor(value, options) {
   return row3;
 }
 function createSourceJournal(options) {
-  let { id: id5, scope, stream } = options, parse6 = (value) => validateSourceCursor(value, options), read = () => options.read(parse6), required = async () => await read() ?? options.missing(), write = async (row3, assertOwnership) => {
-    let validated = parse6(row3);
+  let { id: id5, scope, stream } = options, parse7 = (value) => validateSourceCursor(value, options), read = () => options.read(parse7), required = async () => await read() ?? options.missing(), write = async (row3, assertOwnership) => {
+    let validated = parse7(row3);
     await assertOwnership(), await options.write(validated);
   }, recoverLocked = async (assertOwnership) => {
     let row3 = await read();
@@ -8793,13 +8885,14 @@ function createSourcePair(options) {
     return { ...baseline, ...pending2.length && { pendingFrameEndOffset: Math.min(...pending2) } };
   };
   return Object.freeze({
-    open: (initial) => {
+    open: (initial, validateInitial) => {
       let snapshot2 = typeof initial == "number" ? initial : position2(initial);
       return options.locked(async () => {
         await recover();
         let present = (await Promise.all(lanes.map((lane) => lane.load()))).filter((row3) => row3 !== null);
         if (present.length === 1 && (present[0].lastFrame !== null || present[0].entries.length !== 0 || present[0].skippedBytes !== 0 || present[0].projection !== null))
           return options.invalid();
+        present.length || validateInitial?.();
         let baseline = present.length ? earliest(present) : snapshot2, rows = [];
         for (let lane of lanes) rows.push(await lane.open(baseline));
         return earliest(rows);
@@ -9991,9 +10084,7 @@ function createPromptRetentionJournal(store) {
         await fence(), receipt2.status === "RERAISE_REQUIRED" && (row3.entries.push({ ...receipt2, reRaiseToken: (0, import_node_crypto12.randomUUID)() }), await save(), await settle(promptId2));
       }
     });
-  }, remove: () => store.runExclusive(async (fence) => {
-    await fence(), await store.remove(), await fence();
-  }) });
+  }, remove: () => store.remove() });
 }
 
 // src/appsync/sync-prompt-publication.ts
@@ -10196,7 +10287,7 @@ function decodeSessionRetirement(value, userId, bad3) {
   let toolOutbox = null;
   if (row3.toolOutbox !== null) {
     let location = row3.toolOutbox;
-    if (!location || typeof location != "object" || Object.keys(location).sort().join(",") !== "agent,root" || !["codex", "claude"].includes(location.agent) || typeof location.root != "string" || location.root.includes("\0") || Buffer.byteLength(location.root) > 4096 || !path17.isAbsolute(location.root) || path17.resolve(location.root) !== location.root) return bad3();
+    if (!location || typeof location != "object" || Object.keys(location).sort().join(",") !== "agent,root" || !["codex", "claude", "agy"].includes(location.agent) || typeof location.root != "string" || location.root.includes("\0") || Buffer.byteLength(location.root) > 4096 || !path17.isAbsolute(location.root) || path17.resolve(location.root) !== location.root) return bad3();
     toolOutbox = Object.freeze({ agent: location.agent, root: location.root });
   }
   return Object.freeze({ schemaVersion: 1, kind: "SESSION_RETIREMENT", operationId: clientOperationId, input, toolOutbox });
@@ -10441,19 +10532,10 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
     let scope = this.sessionScope;
     if (!scope) return invalid7();
     let id5 = stableUuid("codevibe-sync-desktop-registration-v1\0", [scope.sessionId, scope.sessionGenerationId]);
-    this.options.assertAccount(), await this.ensureDirectory();
-    let owner = await this.lock(`registration-${id5}.lockdir`).acquire();
-    try {
-      return await this.withStore(async (key) => {
-        let row3 = await this.readValue(id5, key, ".desktop", (value) => decodeDesktopSyncRegistration(value, invalid7));
-        if (!row3) return !1;
-        if (row3.operationId !== id5) return invalid7();
-        if (this.requireScope(row3), this.options.assertAccount(), !await owner.reassertOwnership()) throw new SyncJournalError("SYNC_JOURNAL_LOCK_LOST");
-        return await import_node_fs5.promises.unlink(this.file(id5, ".desktop")), await this.syncDirectory(this.directory), !0;
-      });
-    } finally {
-      await owner.release();
-    }
+    return this.removeBookkeepingRecord(id5, ".desktop", [`registration-${id5}.lockdir`], async (key) => {
+      let row3 = await this.readValue(id5, key, ".desktop", (value) => decodeDesktopSyncRegistration(value, invalid7));
+      return row3 ? row3.operationId !== id5 ? invalid7() : (this.requireScope(row3), !0) : !1;
+    });
   }
   /** Provider queues share the existing encrypted/account-fenced capacity.
    * Native identity and generation are immutable: no automatic re-homing. */
@@ -10746,13 +10828,12 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
         let sealed = this.seal(row3, key);
         await this.checkCapacity(Buffer.byteLength(sealed), id5 + ".retention"), await this.write(id5, sealed, ".retention");
       }),
-      remove: () => this.withStore(async (key) => {
-        let row3 = await this.readValue(id5, key, ".retention", decodePromptRetention);
-        if (row3) {
-          if (row3.operationId !== id5 || !this.matchesScope(row3)) return invalid7();
-          this.options.assertAccount(), await import_node_fs5.promises.unlink(this.file(id5, ".retention")), await this.syncDirectory(this.directory);
-        }
-      })
+      remove: async () => {
+        await this.removeBookkeepingRecord(id5, ".retention", ["prompt-retention-" + id5 + ".lockdir"], async (key) => {
+          let row3 = await this.readValue(id5, key, ".retention", decodePromptRetention);
+          return row3 ? row3.operationId !== id5 || !this.matchesScope(row3) ? invalid7() : !0 : !1;
+        });
+      }
     });
   }
   /** Canonical INACTIVE proof and joined publication owners are prerequisites.
@@ -10816,23 +10897,11 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
       }
       return ids2.sort();
     }), removed = 0;
-    for (let id5 of ids) {
-      let owner = await this.lock("deferred-dispatch-" + id5 + ".lockdir").acquire();
-      try {
-        await this.withStore(async (key) => {
-          let row3 = await read(id5, key);
-          if (row3) {
-            if (!deferredScopeMatches(row3, scope)) return invalid7();
-            if (!row3.entries.some((entry5) => entry5.notice)) {
-              if (this.options.assertAccount(), !await owner.reassertOwnership()) throw new SyncJournalError("SYNC_JOURNAL_LOCK_LOST");
-              await import_node_fs5.promises.unlink(this.file(id5, ".deferred")), await this.syncDirectory(this.directory), removed++;
-            }
-          }
-        });
-      } finally {
-        await owner.release();
-      }
-    }
+    for (let id5 of ids)
+      await this.removeBookkeepingRecord(id5, ".deferred", ["deferred-dispatch-" + id5 + ".lockdir"], async (key) => {
+        let row3 = await read(id5, key);
+        return row3 ? deferredScopeMatches(row3, scope) ? !row3.entries.some((entry5) => entry5.notice) : invalid7() : !1;
+      }) && removed++;
     return removed;
   }
   /** One small encrypted row for unresolved inbound inputs. Completed cloud
@@ -10882,23 +10951,30 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
     let scope = this.sessionScope;
     if (!scope) return invalid7();
     let id5 = stableUuid("codevibe-sync-inbound-v1\0", [scope.sessionId, scope.sessionGenerationId]);
+    return this.removeBookkeepingRecord(id5, ".inbox", [`inbound-dispatch-${id5}.lockdir`, `inbound-record-${id5}.lockdir`], async (key) => {
+      let row3 = await this.readValue(id5, key, ".inbox", decodeDesktopInbound);
+      return row3 ? row3.operationId !== id5 ? invalid7() : (this.requireScope(row3), !0) : !1;
+    });
+  }
+  /** The encrypted record is also the recovery index for these outer locks.
+   * Release them strictly BEFORE unlinking it, while the store stays fenced.
+   * A failed release preserves the record and the caller's retirement intent. */
+  async removeBookkeepingRecord(id5, suffix, names, removable) {
     this.options.assertAccount(), await this.ensureDirectory();
-    let dispatch = await this.lock(`inbound-dispatch-${id5}.lockdir`).acquire();
+    let owners = [], release = async () => {
+      let failed = (await Promise.allSettled(owners.splice(0).reverse().map((owner) => owner.release()))).find((result) => result.status === "rejected");
+      if (failed?.status === "rejected") throw failed.reason;
+    };
     try {
-      let record2 = await this.lock(`inbound-record-${id5}.lockdir`).acquire();
-      try {
-        return await this.withStore(async (key) => {
-          let row3 = await this.readValue(id5, key, ".inbox", decodeDesktopInbound);
-          if (!row3) return !1;
-          if (row3.operationId !== id5) return invalid7();
-          if (this.requireScope(row3), this.options.assertAccount(), !await dispatch.reassertOwnership() || !await record2.reassertOwnership()) throw new SyncJournalError("SYNC_JOURNAL_LOCK_LOST");
-          return await import_node_fs5.promises.unlink(this.file(id5, ".inbox")), await this.syncDirectory(this.directory), !0;
-        });
-      } finally {
-        await record2.release();
-      }
+      for (let name of names) owners.push(await this.lock(name, !0).acquire());
+      return await this.withStore(async (key, storeFence) => {
+        let remove = await removable(key);
+        this.options.assertAccount();
+        for (let owner of owners) if (!await owner.reassertOwnership()) throw new SyncJournalError("SYNC_JOURNAL_LOCK_LOST");
+        return await release(), await storeFence(), remove ? (await import_node_fs5.promises.unlink(this.file(id5, suffix)), await this.syncDirectory(this.directory), await storeFence(), !0) : !1;
+      });
     } finally {
-      await dispatch.release();
+      await release();
     }
   }
   /** Exact empty-source GC only after the owner has joined all its emitters
@@ -10957,7 +11033,34 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
       if (errorCode(error) !== "ENOENT") throw error;
       return this.options.assertAccount(), !1;
     }
-    return this.withStore(async (key) => (await this.retiredSourcePlan(key, expectedSessionKeyGen)).sources.length > 0);
+    return await this.withStore(async (key) => (await this.retiredSourcePlan(key, expectedSessionKeyGen)).sources.length > 0) ? !0 : this.hasSessionRegistrationState();
+  }
+  /** Presence is not deletion authority. Callers still need their joined
+   * terminal owner and fresh retirement confirmation before cleanup. */
+  async hasSessionRegistrationState() {
+    if (!this.sessionScope) return invalid7();
+    this.options.assertAccount();
+    try {
+      await import_node_fs5.promises.lstat(this.directory);
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") throw error;
+      return this.options.assertAccount(), !1;
+    }
+    return this.withStore(async (key) => {
+      let records = [
+        [".desktop", (value) => decodeDesktopSyncRegistration(value, invalid7)],
+        [".inbox", decodeDesktopInbound],
+        [".retention", decodePromptRetention],
+        [".echo", decodeMobileEcho],
+        [".deferred", decodeDeferredInputs]
+      ];
+      for (let [suffix, decode] of records) for (let name of await this.recordNames(suffix)) {
+        let row3 = await this.readValue(name.slice(0, -suffix.length), key, suffix, decode);
+        if (!row3) return invalid7();
+        if (this.matchesScope(row3)) return !0;
+      }
+      return !1;
+    });
   }
   /** Durable stop/join intent -> confirmed source cleanup -> control ACKs ->
    * intent removal. Network I/O never holds the account-store lock. */
@@ -10991,7 +11094,7 @@ var sourceCursorId = (scope, stream) => stableUuid("codevibe-sync-source-cursor-
       if (!saved) return null;
       await fence();
       let result = await cleanup(saved, fence);
-      return await fence(), await this.withStore(async (key, storeFence) => {
+      return await fence(), options.isComplete && !options.isComplete(result) || await this.withStore(async (key, storeFence) => {
         if (!await read(key)) throw new SyncJournalError("SYNC_JOURNAL_MISSING");
         await fence();
         let held = owner;
@@ -11883,23 +11986,24 @@ var UUID9 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f
   throw new SyncEventClientError("INVALID_SYNC_INPUT");
 };
 function toolWindow(scope, id5, value) {
-  let envelope = ToolActivityOutboxEnvelopeSchema.parse(value);
-  (id5 !== scope.sessionId || envelope.backendSessionId !== id5 || envelope.syncSessionGenerationId !== scope.sessionGenerationId || !/^[A-Za-z0-9_-]{1,128}$/.test(envelope.clientEventId) || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(envelope.windowStart) || !Number.isFinite(Date.parse(envelope.windowStart)) || new Date(envelope.windowStart).toISOString() !== envelope.windowStart) && invalid8();
+  let envelope = ToolActivityOutboxEnvelopeSchema.parse(value), timestamp5 = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ$/.test(envelope.windowStart) ? envelope.windowStart.slice(0, -1) + ".000Z" : envelope.windowStart;
+  (id5 !== scope.sessionId || envelope.backendSessionId !== id5 || envelope.syncSessionGenerationId !== scope.sessionGenerationId || !/^[A-Za-z0-9_-]{1,128}$/.test(envelope.clientEventId) || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(timestamp5) || !Number.isFinite(Date.parse(timestamp5)) || new Date(timestamp5).toISOString() !== timestamp5) && invalid8();
   let bytes = (0, import_node_crypto16.createHash)("sha256").update("codevibe-sync-tool-window-v1\0").update(JSON.stringify([scope.sessionId, scope.sessionGenerationId, envelope.clientEventId])).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 128, bytes[8] = bytes[8] & 63 | 128;
   let hex = bytes.toString("hex"), operationId2 = [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20)].join("-");
-  return { envelope, operationId: operationId2 };
+  return { envelope, operationId: operationId2, timestamp: timestamp5 };
 }
 async function retireToolActivityWindows(options) {
   let scope = { ...options.sessionScope };
   return await options.outbox.withRetirementSources(scope, async (sources) => {
+    if (options.deferIfPaged && sources.hasMore) return { windowsRemoved: 0, operationsRemoved: 0, hasMore: !0 };
     let ids = sources.windows.map((window) => toolWindow(scope, scope.sessionId, window).operationId), operationsRemoved = await options.writer.removeRetiredToolOperations(
       ids,
       options.expectedSessionKeyGen,
       options.confirm,
       sources
     );
-    return { windowsRemoved: ids.length, operationsRemoved };
+    return { windowsRemoved: ids.length, operationsRemoved, ...sources.hasMore && { hasMore: !0 } };
   }) ?? { windowsRemoved: 0, operationsRemoved: 0 };
 }
 function createToolActivitySyncTransport(options) {
@@ -11910,7 +12014,7 @@ function createToolActivitySyncTransport(options) {
     protocol: "SYNC_V2",
     sessionGenerationId: scope.sessionGenerationId,
     send: async (id5, value) => {
-      let { envelope, operationId: operationId2 } = window(id5, value);
+      let { envelope, operationId: operationId2, timestamp: timestamp5 } = window(id5, value);
       try {
         return await writer.retry(operationId2);
       } catch (error) {
@@ -11923,7 +12027,7 @@ function createToolActivitySyncTransport(options) {
         ...scope,
         clientOperationId: operationId2,
         type: "TOOL_ACTIVITY",
-        timestamp: envelope.windowStart,
+        timestamp: timestamp5,
         expectedSessionKeyGen: context.sessionKeyGen ?? SESSION_KEY_GEN_ABSENT_SENTINEL,
         isEncrypted: !0,
         encryptionVersion: 1,
@@ -12251,6 +12355,18 @@ var ToolActivityLedger = class {
   async markRetired(clientEventId, invocationIds) {
     return this.markSettled(clientEventId, invocationIds, "terminal", !0);
   }
+  /** One durable mutation per bounded retirement page, not per window. */
+  async markRetiredWindows(windows) {
+    let ids = new Set(windows.map((window) => window.clientEventId));
+    await this.mutateAndPersist((next, terminalWindows) => {
+      for (let window of windows) {
+        terminalWindows.add(window.clientEventId);
+        for (let id5 of window.invocationIds) id5 && !next.has(id5) && next.set(id5, { clientEventId: window.clientEventId, byteOffset: 0, state: "terminal" });
+      }
+      for (let [id5, entry5] of next) ids.has(entry5.clientEventId) && entry5.state === "durably-outboxed" && next.set(id5, { ...entry5, state: "terminal" });
+      return !0;
+    }, !0);
+  }
   /** R2 keeps a window settlement independently of occurrence remapping/pruning. */
   async markSettled(clientEventId, invocationIds, disposition, requireDirectorySync = !1) {
     await this.mutateAndPersist((next, terminalWindows) => {
@@ -12464,7 +12580,7 @@ var RESERVED_STATE_FILES = /* @__PURE__ */ new Set(["ledger.json", "legacy-owned
   }
   /** Trusted local namespace persisted inside the encrypted cleanup intent. */
   retirementLocation() {
-    if (this.agent !== "codex" && this.agent !== "claude") throw new Error("Invalid tool sync provider");
+    if (!["codex", "claude", "agy"].includes(this.agent)) throw new Error("Invalid tool sync provider");
     return Object.freeze({ agent: this.agent, root: path21.resolve(this.rootDir) });
   }
   entryPath(sessionId, clientEventId) {
@@ -12578,23 +12694,25 @@ var RESERVED_STATE_FILES = /* @__PURE__ */ new Set(["ledger.json", "legacy-owned
       throw new Error("Invalid tool sync generation");
     let { sessionId, sessionGenerationId } = scope;
     return this.withSyncRecovery(sessionId, async (fence) => {
-      let dir = this.sessionDir(sessionId), snapshots = [], names = 0, bytes = 0, windows = 0, listing = await import_node_fs8.promises.opendir(dir);
+      let dir = this.sessionDir(sessionId), snapshots = [], bytes = 0, hasMore = !1, listing = await import_node_fs8.promises.opendir(dir);
       for await (let entry5 of listing) {
-        if (++names > 1032) throw new Error("Tool sync outbox capacity exceeded");
         if (entry5.name.endsWith(".corrupt")) throw new Error("Tool sync outbox recovery required");
         if (entry5.name.includes(TEMP_INFIX) || RESERVED_STATE_FILES.has(entry5.name) || !entry5.name.endsWith(".json")) continue;
-        if (++windows > 256) throw new Error("Tool sync outbox capacity exceeded");
-        let file = await readBoundedToolFile(path21.join(dir, entry5.name), 1024 * 1024);
-        if (bytes += file.bytes.length, bytes > 32 * 1024 * 1024) throw new Error("Tool sync outbox capacity exceeded");
-        let envelope = ToolActivityOutboxEnvelopeSchema.parse(JSON.parse(file.bytes.toString("utf8")));
+        let file = await readBoundedToolFile(path21.join(dir, entry5.name), 1024 * 1024), envelope = ToolActivityOutboxEnvelopeSchema.parse(JSON.parse(file.bytes.toString("utf8")));
         if (envelope.backendSessionId !== sessionId || !/^[A-Za-z0-9_-]{1,128}$/.test(envelope.clientEventId) || entry5.name !== `${envelope.clientEventId}.json`) throw new Error("Tool sync outbox recovery required");
-        envelope.syncSessionGenerationId === sessionGenerationId && snapshots.push({
-          name: entry5.name,
-          dev: file.dev,
-          ino: file.ino,
-          sha256: (0, import_node_crypto17.createHash)("sha256").update(file.bytes).digest("hex"),
-          envelope
-        });
+        if (envelope.syncSessionGenerationId === sessionGenerationId) {
+          if (snapshots.length >= 256 || bytes + file.bytes.length > 32 * 1024 * 1024) {
+            hasMore = !0;
+            break;
+          }
+          bytes += file.bytes.length, snapshots.push({
+            name: entry5.name,
+            dev: file.dev,
+            ino: file.ino,
+            sha256: (0, import_node_crypto17.createHash)("sha256").update(file.bytes).digest("hex"),
+            envelope
+          });
+        }
       }
       if (!snapshots.length) return null;
       let ledger = new ToolActivityLedger({ agent: this.agent, sessionId, root: this.rootDir, logger: this.logger });
@@ -12608,10 +12726,9 @@ var RESERVED_STATE_FILES = /* @__PURE__ */ new Set(["ledger.json", "legacy-owned
       };
       return action2({
         windows: snapshots.map((snapshot2) => snapshot2.envelope),
+        hasMore,
         markRetired: async () => {
-          await verify();
-          for (let { envelope } of snapshots)
-            await fence(), await ledger.markRetired(envelope.clientEventId, envelope.invocationIds);
+          await verify(), await ledger.markRetiredWindows(snapshots.map((snapshot2) => snapshot2.envelope));
         },
         prune: async () => {
           await verify();
@@ -14396,6 +14513,13 @@ var AppSyncClient = class _AppSyncClient {
   async retireDesktopSyncRegistration(options, retired) {
     let userId = this.getCurrentUserId();
     if (this.assertSyncAccount(userId), !retired || retired.userId !== userId || retired.sessionId !== options.sessionId || retired.status !== "INACTIVE" /* INACTIVE */ || retired.sessionGenerationId !== options.sessionGenerationId) throw new SyncEventClientError("SYNC_SESSION_UNAVAILABLE");
+    return this.removeDesktopSyncRegistrationState(options);
+  }
+  /** Both callers have terminal authority and have joined their read owners:
+   * the returned INACTIVE session above, or a freshly confirmed durable intent. */
+  async removeDesktopSyncRegistrationState(options) {
+    let userId = this.getCurrentUserId();
+    this.assertSyncAccount(userId);
     let writer = this.desktopSyncWriter({ root: options.root, sessionScope: options }), result = await writer.removeDesktopRegistration();
     return await writer.removeInbound(), await writer.removeDeferredInputs(), await writer.removeMobileEchoes(), await writer.promptRetention().remove(), this.assertSyncAccount(userId), result;
   }
@@ -14830,7 +14954,7 @@ var AppSyncClient = class _AppSyncClient {
     return this.resolvePromptPublication({ sessionId: input.sessionId, promptId: input.promptId }, async () => (await fence(), _AppSyncClient.throwIfAborted(signal), await this.resolveDesktopSyncPrompt(input, signal), await fence(), !0), { ...options, signal });
   }
   /** Explicit session-owned restart recovery. Inventory is bounded by the
-   * account store's 256-file cap; empty inventory does no cloud I/O. Reuses
+   * account store's file cap; empty inventory does no cloud I/O. Reuses
    * original ownership/generation, not current Session or encryption state.
    * No failure/age/quota condition deletes an outstanding intent. */
   recoverPromptResolutions(options, signal) {
@@ -14945,7 +15069,18 @@ var AppSyncClient = class _AppSyncClient {
     }), toolOutbox = options.toolOutbox?.retirementLocation() ?? null;
     await this.quiesceDesktopSyncSession(sessionId, quiesce, signal);
     let writer = this.desktopSyncWriter({ root, sessionScope: input }), hasWork = await writer.hasSessionRetirementWork(input.expectedSessionKeyGen) || options.toolOutbox && await options.toolOutbox.withRetirementSources(input, async () => !0);
-    return this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), hasWork ? await writer.runSessionRetirement(input, toolOutbox, (record2, fence) => this.finishRecordedSessionRetirement(record2, { root }, fence, signal)) ?? { sourcesRemoved: 0, operationsRemoved: 0 } : { sourcesRemoved: 0, operationsRemoved: 0 };
+    if (this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), !hasWork) return { sourcesRemoved: 0, operationsRemoved: 0 };
+    let result = await writer.runSessionRetirement(
+      input,
+      toolOutbox,
+      (record2, fence) => this.finishRecordedSessionRetirement(record2, { root, deferOversizedTools: !0 }, fence, signal),
+      { isComplete: (result2) => !result2.cleanupDeferred }
+    );
+    return result?.cleanupDeferred && logger.warn("[sync-retirement] cloud session retired; local cleanup page remains durable", {
+      sessionId,
+      sourcesRemoved: result.sourcesRemoved,
+      operationsRemoved: result.operationsRemoved
+    }), result ?? { sourcesRemoved: 0, operationsRemoved: 0 };
   }
   /** No Session fetch, live key lookup, native-process operation or re-homing.
    * The encrypted intent records a completed producer join; fresh cloud proof
@@ -14959,7 +15094,12 @@ var AppSyncClient = class _AppSyncClient {
       try {
         let writer = this.desktopSyncWriter({ root, sessionScope: record2.input });
         await this.quiesceDesktopSyncSession(record2.input.sessionId, async () => {
-        }, signal), await writer.runSessionRetirement(record2.input, record2.toolOutbox, (saved, fence) => this.finishRecordedSessionRetirement(saved, { root }, fence, signal), { existingOnly: !0 }), completed++;
+        }, signal), (await writer.runSessionRetirement(
+          record2.input,
+          record2.toolOutbox,
+          (saved, fence) => this.finishRecordedSessionRetirement(saved, { root }, fence, signal),
+          { existingOnly: !0, isComplete: (result2) => !result2.cleanupDeferred }
+        ))?.cleanupDeferred ? deferred++ : completed++;
       } catch (error) {
         this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), deferred++, logger.warn("[sync-retirement] prior-session cleanup retained for recovery", {
           code: error instanceof SyncJournalError ? error.code : "CLEANUP_DEFERRED"
@@ -14985,12 +15125,12 @@ var AppSyncClient = class _AppSyncClient {
     await work, this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal);
   }
   async finishRecordedSessionRetirement(record2, options, fence, signal) {
-    let { input } = record2, { root } = options, userId = this.getCurrentUserId(), writer = this.desktopSyncWriter({ root, sessionScope: input });
+    let { input } = record2, { root } = options, userId = this.getCurrentUserId(), writer = this.desktopSyncWriter({ root, sessionScope: input }), confirmed = !1, confirm = async (request3) => {
+      let receipt2 = await this.confirmDesktopSyncRetirement(request3, signal);
+      return confirmed = !0, receipt2;
+    };
     await fence(), _AppSyncClient.throwIfAborted(signal);
-    let result = await writer.removeRetiredSources(
-      input.expectedSessionKeyGen,
-      (request3) => this.confirmDesktopSyncRetirement(request3, signal)
-    );
+    let result = await writer.removeRetiredSources(input.expectedSessionKeyGen, confirm), cleanupDeferred = !1;
     if (record2.toolOutbox) {
       await fence();
       let tools = await retireToolActivityWindows({
@@ -14998,13 +15138,14 @@ var AppSyncClient = class _AppSyncClient {
         writer,
         outbox: new ToolActivityOutbox({ ...record2.toolOutbox, logger }),
         expectedSessionKeyGen: input.expectedSessionKeyGen,
-        confirm: (input2) => this.confirmDesktopSyncRetirement(input2, signal)
+        confirm,
+        deferIfPaged: options.deferOversizedTools
       });
-      result.sourcesRemoved += tools.windowsRemoved, result.operationsRemoved += tools.operationsRemoved;
+      result.sourcesRemoved += tools.windowsRemoved, result.operationsRemoved += tools.operationsRemoved, cleanupDeferred = tools.hasMore === !0;
     }
     for (let input2 of await writer.promptResolutions())
       await fence(), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), await writer.runPromptResolution(input2, async (saved, fence2) => (await fence2(), await this.resolveDesktopSyncPrompt(saved, signal), await fence2(), !0), { existingOnly: !0 });
-    return await fence(), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), result;
+    return await fence(), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), await writer.hasSessionRegistrationState() && (confirmed || await confirm(input), await fence(), _AppSyncClient.throwIfAborted(signal), await this.removeDesktopSyncRegistrationState({ ...input, root })), await fence(), this.assertSyncAccount(userId), _AppSyncClient.throwIfAborted(signal), { ...result, ...cleanupDeferred && { cleanupDeferred: !0 } };
   }
   /** Wire-only PROMPT_OWNERSHIP transition. It cannot create an Event. Plugin
    * preimage authority does not require the retired Session's encryption key;
@@ -60353,7 +60494,8 @@ ${formatPacket(packet, hash3)}`
 }
 
 // src/orchestration-shell/audit-summary.ts
-var crypto27 = __toESM(require("node:crypto")), MAX_SUMMARY_BYTES = 16384, FIELD_MAX_CHARS = 512, MAX_SEATS_PER_MODEL = 10, MAX_FINDINGS_PER_MODEL = 20, MAX_RESIDUALS_PER_RECORD = 10;
+var crypto27 = __toESM(require("node:crypto"));
+var MAX_SUMMARY_BYTES = 16384, FIELD_MAX_CHARS = 512, MAX_SEATS_PER_MODEL = 10, MAX_FINDINGS_PER_MODEL = 20, MAX_RESIDUALS_PER_RECORD = 10;
 var SECTION_BYTE_BUDGETS = {
   section1: 1800,
   section2: 7500,
@@ -60441,7 +60583,7 @@ function boundSummaryModel(model) {
       role: capCodePoints(s.role, 64),
       reviewerModel: capCodePoints(s.reviewerModel, 64),
       reviewerAgent: capCodePoints(s.reviewerAgent, 64),
-      modelUsed: capCodePoints(s.modelUsed, 64),
+      modelUsed: s.modelUsed ? capCodePoints(s.modelUsed, 64) : void 0,
       verdict: capCodePoints(s.verdict, 32),
       reasoning: capCodePoints(s.reasoning, FIELD_MAX_CHARS),
       durationSeconds: typeof s.durationSeconds == "number" ? s.durationSeconds : null,
@@ -60462,8 +60604,8 @@ function boundSummaryModel(model) {
       testDetails: capCodePoints(model.verification?.testDetails, FIELD_MAX_CHARS),
       teardownStatus: model.verification?.teardownStatus ?? "unrecorded",
       filesApplied: typeof model.verification?.filesApplied == "number" ? model.verification.filesApplied : void 0,
-      completedAt: capCodePoints(model.verification?.completedAt, 64),
-      serverAuthorizedAt: capCodePoints(model.verification?.serverAuthorizedAt, 64),
+      completedAt: model.verification?.completedAt ? capCodePoints(model.verification.completedAt, 64) : void 0,
+      serverAuthorizedAt: model.verification?.serverAuthorizedAt ? capCodePoints(model.verification.serverAuthorizedAt, 64) : void 0,
       workspaceApplicationStatus: model.verification?.workspaceApplicationStatus
     }
   };
@@ -61141,11 +61283,13 @@ function compileAuditSummary(args) {
       let displayRound = rec.round + 1;
       rec.historyDegraded && (historyDegraded = !0), rec.omittedFindingsCount && (recordOmittedFindings += rec.omittedFindingsCount), rec.omittedResidualsCount && (recordOmittedResiduals += rec.omittedResidualsCount);
       let dur = typeof rec.durationSeconds == "number" ? rec.durationSeconds : typeof rec.latencyMs == "number" ? rec.latencyMs / 1e3 : null;
-      dur !== null ? totalReviewerSeconds += dur : (timingPartial = !0, roundTimingPartial[displayRound] = !0), dur !== null && (roundDurations[displayRound] = Math.max(roundDurations[displayRound] ?? 0, dur)), seats.push({
+      dur !== null ? totalReviewerSeconds += dur : (timingPartial = !0, roundTimingPartial[displayRound] = !0), dur !== null && (roundDurations[displayRound] = Math.max(roundDurations[displayRound] ?? 0, dur));
+      let agentKey = rec.reviewerAgent ? rec.reviewerAgent.toUpperCase() : void 0, detectedDefault = agentKey && args.detectedAgentModels ? args.detectedAgentModels[agentKey] || args.detectedAgentModels[rec.reviewerAgent.toLowerCase()] || args.detectedAgentModels[rec.reviewerAgent] : void 0, displayModel;
+      rec.modelUsed && rec.modelUsed.trim() ? displayModel = rec.modelUsed.trim() : detectedDefault && detectedDefault.trim() ? displayModel = `native default (unverified: ${detectedDefault.trim()})` : displayModel = "native default (unverified)", seats.push({
         round: displayRound,
         seatId: String(rec.seatId),
         role: rec.role,
-        reviewerModel: rec.modelUsed || rec.reviewerAgent,
+        reviewerModel: displayModel,
         reviewerAgent: rec.reviewerAgent,
         modelUsed: rec.modelUsed ?? void 0,
         verdict: normalizeVerdictKind(rec.verdict),
@@ -61157,7 +61301,7 @@ function compileAuditSummary(args) {
         findings.push({
           round: displayRound,
           seatId: String(rec.seatId),
-          findingId: `F-${displayRound}-${rec.seatId}-${idx + 1}`,
+          findingId: `F-${displayRound}-${displaySeatNumber(rec.seatId)}-${idx + 1}`,
           issue: sc,
           changesMade: "Unavailable (resolution not recorded)"
         });
@@ -61246,13 +61390,15 @@ function compileAuditSummary(args) {
       let maxSeatDur = 0;
       for (let [seatId, s] of gate.seats.entries()) {
         let dur = typeof s.durationSeconds == "number" ? s.durationSeconds : null;
-        dur !== null ? (totalReviewerSeconds += dur, maxSeatDur = Math.max(maxSeatDur, dur)) : (timingPartial = !0, roundTimingPartial[gate.roundNumber] = !0), seats.push({
+        dur !== null ? (totalReviewerSeconds += dur, maxSeatDur = Math.max(maxSeatDur, dur)) : (timingPartial = !0, roundTimingPartial[gate.roundNumber] = !0);
+        let agentKey = s.reviewerAgent ? s.reviewerAgent.toUpperCase() : void 0, detectedDefault = agentKey && args.detectedAgentModels ? args.detectedAgentModels[agentKey] || args.detectedAgentModels[s.reviewerAgent?.toLowerCase() ?? ""] || args.detectedAgentModels[s.reviewerAgent ?? ""] : void 0, displayModel;
+        s.modelUsed && s.modelUsed.trim() ? displayModel = s.modelUsed.trim() : s.reviewerModel && s.reviewerModel !== "unknown" && s.reviewerModel !== s.reviewerAgent ? displayModel = s.reviewerModel : detectedDefault && detectedDefault.trim() ? displayModel = `native default (unverified: ${detectedDefault.trim()})` : displayModel = "native default (unverified)", seats.push({
           round: gate.roundNumber,
           seatId: s.seatId,
           role: s.role,
-          reviewerModel: s.reviewerModel,
+          reviewerModel: displayModel,
           reviewerAgent: s.reviewerAgent,
-          modelUsed: s.modelUsed,
+          modelUsed: s.modelUsed ?? void 0,
           verdict: s.verdict,
           reasoning: s.reasoning,
           durationSeconds: dur,
@@ -61357,16 +61503,16 @@ function renderSummaryMarkdown(summaryModel) {
   else {
     let tableHeader = `| Round | Seat | Role | Agent | Model | Verdict | Duration |
 |-------|------|------|-------|-------|---------|----------|`, tableRows = bounded.seats.map((s) => {
-      let durStr = typeof s.durationSeconds == "number" ? `${s.durationSeconds.toFixed(1)}s` : "N/A";
-      return `| ${s.round} | ${escapeMarkdownTableCell(s.seatId)} | ${escapeMarkdownTableCell(s.role)} | ${escapeMarkdownTableCell(s.reviewerAgent ?? s.role)} | ${escapeMarkdownTableCell(s.reviewerModel)} | ${escapeMarkdownTableCell(s.verdict)} | ${durStr} |`;
+      let durStr = typeof s.durationSeconds == "number" ? `${s.durationSeconds.toFixed(1)}s` : "N/A", displaySeat = displaySeatNumber(s.seatId);
+      return `| ${s.round} | ${escapeMarkdownTableCell(displaySeat)} | ${escapeMarkdownTableCell(s.role)} | ${escapeMarkdownTableCell(s.reviewerAgent ?? s.role)} | ${escapeMarkdownTableCell(s.reviewerModel)} | ${escapeMarkdownTableCell(s.verdict)} | ${durStr} |`;
     });
     s2 = [tableHeader, ...tableRows].join(`
 `);
   }
   let s3 = "";
   bounded.findings.length === 0 ? s3 = "None recorded." : s3 = bounded.findings.map((f) => {
-    let resolution = f.changesMade ? sanitizeMarkdownContent(f.changesMade) : "Unavailable (resolution not recorded)", safeFindingId = String(f.findingId).replace(/[\r\n]+/g, " ").replace(/`/g, "'").trim(), safeSeatId = String(f.seatId).replace(/[\r\n]+/g, " ").replace(/`/g, "'").trim();
-    return `- **[Round ${f.round} / Seat ${escapeMarkdownTableCell(safeSeatId)}]** \`${safeFindingId}\`: ${sanitizeMarkdownContent(f.issue)} -> ${resolution}`;
+    let resolution = f.changesMade ? sanitizeMarkdownContent(f.changesMade) : "Unavailable (resolution not recorded)", safeFindingId = String(f.findingId).replace(/[\r\n]+/g, " ").replace(/`/g, "'").trim(), safeSeatId = String(f.seatId).replace(/[\r\n]+/g, " ").replace(/`/g, "'").trim(), displaySeat = displaySeatNumber(safeSeatId);
+    return `- **[Round ${f.round} / Seat ${escapeMarkdownTableCell(displaySeat)}]** \`${safeFindingId}\`: ${sanitizeMarkdownContent(f.issue)} -> ${resolution}`;
   }).join(`
 `);
   let roundTimes = /* @__PURE__ */ new Map(), roundHasPartial = /* @__PURE__ */ new Map();
@@ -64765,7 +64911,8 @@ var QuorumLoop = class _QuorumLoop {
      * Enables reconciliation if a user decision arrives or is replayed after promotion.
      */
     this.completedTaskSummaries = /* @__PURE__ */ new Map();
-    this.expectedRosterByTask = /* @__PURE__ */ new Map();
+    this.declaredRosterByTask = /* @__PURE__ */ new Map();
+    this.dispatchedRosterByTask = /* @__PURE__ */ new Map();
     this.taskDegradedMetadataByTask = /* @__PURE__ */ new Map();
     /**
      * A1b — the implementor's own per-round stdout rationale (the
@@ -65325,6 +65472,7 @@ var QuorumLoop = class _QuorumLoop {
     } catch {
     }
   }
+  /** @internal */
   recordCompletedTaskSummary(taskId, info) {
     try {
       this.withCompletedSummariesLock(() => {
@@ -66074,6 +66222,25 @@ var QuorumLoop = class _QuorumLoop {
     }
     return out;
   }
+  getDetectedModelForAgent(agent) {
+    if (!agent) return null;
+    let up = agent.toUpperCase(), low = agent.toLowerCase(), models = this.deps.detectedAgentModels;
+    if (models) {
+      if (models[up]) return models[up];
+      if (models[low]) return models[low];
+    }
+    return null;
+  }
+  getExplicitModelForAgent(agent) {
+    if (!agent) return null;
+    let up = agent.toUpperCase(), low = agent.toLowerCase(), models = this.deps.configuredAgentModels;
+    if (models) {
+      if (models[up]) return models[up];
+      if (models[low]) return models[low];
+      if (models[agent]) return models[agent];
+    }
+    return null;
+  }
   /**
    * #585 auto-continuation (Max) — pick the agent to AUTO-CONTINUE on when the
    * implementor for `taskId` hit a quota wall, or `null` to fall through to the
@@ -66349,8 +66516,8 @@ var QuorumLoop = class _QuorumLoop {
   async handleGateDispatch(payload, envelopeTaskId) {
     let dispatchTaskId = envelopeTaskId || this.latestInFlightStart;
     if (dispatchTaskId && Array.isArray(payload.reviewerSeats) && payload.reviewerSeats.length > 0) {
-      let roster = this.expectedRosterByTask.get(dispatchTaskId);
-      roster || (roster = /* @__PURE__ */ new Map(), this.expectedRosterByTask.set(dispatchTaskId, roster));
+      let roster = this.declaredRosterByTask.get(dispatchTaskId);
+      roster || (roster = /* @__PURE__ */ new Map(), this.declaredRosterByTask.set(dispatchTaskId, roster));
       for (let seat of payload.reviewerSeats)
         roster.set(String(seat.seatId), String(seat.role || "reviewer").toLowerCase());
     }
@@ -66789,7 +66956,7 @@ var QuorumLoop = class _QuorumLoop {
     if (!stale) return;
     await stale.assertCanDiscard(), logger.info("[QuorumLoop] replacing a stale shadow for a fresh round-0 dispatch (restart)", {
       taskId
-    }), await stale.discard(), this.shadowsByTask.get(taskId) === stale && this.shadowsByTask.delete(taskId), this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.expectedRosterByTask.delete(taskId), this.clearSeenGateDispatchRunIdsForTask(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId);
+    }), await stale.discard(), this.shadowsByTask.get(taskId) === stale && this.shadowsByTask.delete(taskId), this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.declaredRosterByTask.delete(taskId), this.dispatchedRosterByTask.delete(taskId), this.clearSeenGateDispatchRunIdsForTask(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId);
     let nextFence = (this.restartFenceByTaskId.get(taskId) ?? 0) + 1;
     this.restartFenceByTaskId.set(taskId, nextFence), this.reviewedSnapshotByTask.delete(taskId);
   }
@@ -67733,14 +67900,16 @@ ${section}`);
     let completedInfo = this.getCompletedTaskSummary(taskId);
     if (completedInfo)
       try {
-        let summaryModel = compileAuditSummary({
+        let d = decision?.decision?.toLowerCase(), isApprove = (d === "approve" || d === "accept") && decision?.isFinalApproval !== !1, isPendingMerge = completedInfo.workspaceApplicationStatus === "pending_merge_gate", summaryModel = compileAuditSummary({
           taskId,
           sessionId: this.deps.session.sessionId,
           historySnapshot: completedInfo.historySnapshot,
           userDecision: decision,
           filesApplied: completedInfo.filesApplied,
           completedAt: completedInfo.completedAt,
-          workspaceApplicationStatus: completedInfo.workspaceApplicationStatus
+          serverAuthorizedAt: isApprove && !isPendingMerge ? decision?.serverRecordedAt ?? void 0 : void 0,
+          workspaceApplicationStatus: completedInfo.workspaceApplicationStatus,
+          detectedAgentModels: this.deps.detectedAgentModels
         }), markdown = renderSummaryMarkdown(summaryModel);
         try {
           this.deps.onTaskAuditSummary?.(summaryModel, markdown);
@@ -67795,17 +67964,23 @@ ${section}`);
     let records = this.roundHistoryByTask.get(taskId) ?? [], taskDegraded = this.taskDegradedMetadataByTask.get(taskId), historyDegraded = !!taskDegraded?.historyDegraded, omittedFindingsCount = taskDegraded?.omittedFindingsCount ?? 0, omittedResidualsCount = taskDegraded?.omittedResidualsCount ?? 0, omittedRounds = taskDegraded?.omittedRounds, truncatedForSize = taskDegraded?.truncatedForSize;
     for (let r of records)
       r.historyDegraded && (historyDegraded = !0), omittedFindingsCount += r.omittedFindingsCount ?? 0, omittedResidualsCount += r.omittedResidualsCount ?? 0;
-    let seatCount = this.deps.tier === "MAX" ? 3 : 2, rosterMap = this.expectedRosterByTask.get(taskId), expectedRosterMap = /* @__PURE__ */ new Map();
-    if (rosterMap && rosterMap.size > 0)
-      for (let [seatId, role] of rosterMap.entries())
+    let declaredRoster = this.declaredRosterByTask.get(taskId), expectedRosterMap = /* @__PURE__ */ new Map();
+    if (declaredRoster && declaredRoster.size > 0)
+      for (let [seatId, role] of declaredRoster.entries())
         expectedRosterMap.set(seatId, role);
-    else
+    else {
       for (let r of records)
         expectedRosterMap.set(String(r.seatId), String(r.role || "reviewer").toLowerCase());
-    let missingIdx = 0;
-    for (; expectedRosterMap.size < seatCount; ) {
-      let seatKey2 = `missing-seat-${missingIdx++}`;
-      expectedRosterMap.has(seatKey2) || expectedRosterMap.set(seatKey2, "required_seat_unassigned");
+      let dispatched = this.dispatchedRosterByTask.get(taskId);
+      if (dispatched)
+        for (let [seatId, role] of dispatched.entries())
+          expectedRosterMap.set(seatId, role);
+      let minRequiredSeats = this.deps.tier === "FREE" ? 1 : 2, padIdx = 0;
+      for (; expectedRosterMap.size < minRequiredSeats; ) {
+        let syntheticSeat = String(padIdx);
+        expectedRosterMap.has(syntheticSeat) || expectedRosterMap.set(syntheticSeat, "required_seat_unassigned"), padIdx++;
+      }
+      this.deps.tier !== "FREE" && expectedRosterMap.set("unverified_roster_declaration", "required_seat_unassigned");
     }
     let expectedRoster = Array.from(expectedRosterMap.entries()).map(([seatId, role]) => ({ seatId, role }));
     return {
@@ -67862,8 +68037,8 @@ ${section}`);
   ingestReviewSummary(taskId, summary) {
     if (!taskId || !summary || this.isWorkspaceTaskTerminallyRetired(taskId) || this.getCompletedTaskSummary(taskId))
       return;
-    let roster = this.expectedRosterByTask.get(taskId);
-    if (roster || (roster = /* @__PURE__ */ new Map(), this.expectedRosterByTask.set(taskId, roster)), summary.reviewQuorum && Array.isArray(summary.reviewQuorum.seats))
+    let roster = this.declaredRosterByTask.get(taskId);
+    if (roster || (roster = /* @__PURE__ */ new Map(), this.declaredRosterByTask.set(taskId, roster)), summary.reviewQuorum && Array.isArray(summary.reviewQuorum.seats))
       for (let s of summary.reviewQuorum.seats) {
         if (!s || s.seatId == null || String(s.seatId).trim().length === 0) continue;
         let seatIdStr = String(s.seatId).trim(), roleStr = String(s.role || "").trim().toLowerCase();
@@ -68304,7 +68479,7 @@ ${section}`);
         });
         return;
       }
-    if (opts?.preserveReviseContext || (this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.reviewScopeResetEligibleTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), opts?.taskContinues !== !0 && this.forgetSingleTask(taskId, "discarded"), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.expectedRosterByTask.delete(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId), this.restartFenceByTaskId.delete(taskId), appendContextItem(this.deps.session.sessionId, {
+    if (opts?.preserveReviseContext || (this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.reviewScopeResetEligibleTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), opts?.taskContinues !== !0 && this.forgetSingleTask(taskId, "discarded"), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.declaredRosterByTask.delete(taskId), this.dispatchedRosterByTask.delete(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId), this.restartFenceByTaskId.delete(taskId), appendContextItem(this.deps.session.sessionId, {
       kind: "verdict",
       author: { role: "engine" },
       sensitivity: "user",
@@ -68513,7 +68688,7 @@ ${section}`);
           error: err?.message
         }), historySnapshot = null;
       }
-      this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.reviewScopeResetEligibleTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), this.forgetSingleTask(taskId, "apply_failed"), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.expectedRosterByTask.delete(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId), this.restartFenceByTaskId.delete(taskId);
+      this.userNotesByTask.delete(taskId), this.reviewScopeResetTasks.delete(taskId), this.reviewScopeResetEligibleTasks.delete(taskId), this.roundHistoryByTask.delete(taskId), this.forgetSingleTask(taskId, "apply_failed"), this.rationaleByTask.delete(taskId), this.taskDegradedMetadataByTask.delete(taskId), this.declaredRosterByTask.delete(taskId), this.dispatchedRosterByTask.delete(taskId), this.activeGateByTaskId.delete(taskId), this.conflictedSeatsByTask.delete(taskId), this.nonApprovedSeatsByTask.delete(taskId), this.restartFenceByTaskId.delete(taskId);
       let shadow = this.shadowsByTask.get(taskId);
       if (!shadow) {
         if (this.singleTaskHistory.get(taskId)?.outcome === "discarded") {
@@ -68735,12 +68910,16 @@ ${section}`);
         }
         discarded && this.shadowsByTask.get(taskId) === shadow && this.shadowsByTask.delete(taskId), discarded && this.terminallyRetiredWorkspaceTasks.add(taskId), this.reviewedSnapshotByTask.delete(taskId);
         try {
-          let userDecision = this.lastUserDecisionByTask.get(taskId) ?? null, completedAt = (/* @__PURE__ */ new Date()).toISOString(), summaryModel = compileAuditSummary({
+          let userDecision = this.lastUserDecisionByTask.get(taskId) ?? null, completedAt = (/* @__PURE__ */ new Date()).toISOString(), d = userDecision?.decision?.toLowerCase(), isApprove = d === "approve" || d === "accept", summaryModel = compileAuditSummary({
             taskId,
             sessionId: this.deps.session.sessionId,
             historySnapshot,
             userDecision,
-            workspaceApplicationStatus: "pending_merge_gate"
+            completedAt,
+            serverAuthorizedAt: void 0,
+            // pending merge gate — unpromoted
+            workspaceApplicationStatus: "pending_merge_gate",
+            detectedAgentModels: this.deps.detectedAgentModels
           }), markdown = renderSummaryMarkdown(summaryModel);
           try {
             this.deps.onTaskAuditSummary?.(summaryModel, markdown);
@@ -68955,13 +69134,15 @@ ${section}`);
     }), onTaskBoundary(this.deps.session.sessionId).catch(() => {
     }), this.emitProgress({ phase: "promoted", files: appliedPaths.length, taskId }, originEpoch);
     try {
-      let userDecision = this.lastUserDecisionByTask.get(taskId) ?? null, completedAt = this.lastWorkspaceOutcome?.completedAt ?? (/* @__PURE__ */ new Date()).toISOString(), filesApplied = appliedPaths.length, summaryModel = compileAuditSummary({
+      let userDecision = this.lastUserDecisionByTask.get(taskId) ?? null, completedAt = this.lastWorkspaceOutcome?.completedAt ?? (/* @__PURE__ */ new Date()).toISOString(), filesApplied = appliedPaths.length, d = userDecision?.decision?.toLowerCase(), isApprove = (d === "approve" || d === "accept") && userDecision?.isFinalApproval !== !1, summaryModel = compileAuditSummary({
         taskId,
         sessionId: this.deps.session.sessionId,
         historySnapshot,
         userDecision,
         filesApplied,
-        completedAt
+        completedAt,
+        serverAuthorizedAt: isApprove ? userDecision?.serverRecordedAt ?? void 0 : void 0,
+        detectedAgentModels: this.deps.detectedAgentModels
       }), markdown = renderSummaryMarkdown(summaryModel);
       try {
         this.deps.onTaskAuditSummary?.(summaryModel, markdown);
@@ -68987,6 +69168,14 @@ ${section}`);
               sessionId: this.deps.session.sessionId,
               summary: summaryModel
             }
+          }).then((result) => {
+            if (result.emitted) return;
+            let code = result.error?.code;
+            logger.warn("[QuorumLoop] Companion audit summary was not acknowledged (non-fatal)", {
+              taskId,
+              reason: result.reason,
+              ...typeof code == "string" && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? { errorCode: code } : {}
+            });
           }).catch((wErr) => {
             logger.warn("[QuorumLoop] Companion audit summary emission failed (non-fatal)", {
               taskId,
@@ -69183,8 +69372,8 @@ ${section}`);
       seatId: seat,
       ...dispatchTaskId ? { taskId: dispatchTaskId } : {}
     }), dispatchTaskId) {
-      let roster = this.expectedRosterByTask.get(dispatchTaskId);
-      roster || (roster = /* @__PURE__ */ new Map(), this.expectedRosterByTask.set(dispatchTaskId, roster)), roster.set(String(seat), String(payload.role || "reviewer"));
+      let roster = this.dispatchedRosterByTask.get(dispatchTaskId);
+      roster || (roster = /* @__PURE__ */ new Map(), this.dispatchedRosterByTask.set(dispatchTaskId, roster)), roster.set(String(seat), String(payload.role || "reviewer"));
     }
     let dispatched = this.dispatchedSeatsByGate.get(payload.gateId) ?? /* @__PURE__ */ new Set(), wasNew = !dispatched.has(seat);
     dispatched.add(seat), this.dispatchedSeatsByGate.set(payload.gateId, dispatched), wasNew && this.emitProgressForTask(dispatchTaskId, originEpoch, {
@@ -69278,7 +69467,7 @@ ${section}`);
         tool_allowlist: [...REVIEWER_TOOL_ALLOWLIST],
         prompt_template: promptText,
         timeout_ms: REVIEWER_TIMEOUT_MS,
-        model_hint: null
+        model_hint: this.getExplicitModelForAgent(args.agentKind)
       }, seatSubstrate;
       try {
         seatSubstrate = await this.engageSeatSubstrate(args, key);
@@ -69891,7 +70080,7 @@ ${section}`);
           tool_allowlist: [...REVIEWER_TOOL_ALLOWLIST],
           prompt_template: renderFinalTier2Prompt(diff, bundleSections),
           timeout_ms: REVIEWER_TIMEOUT_MS,
-          model_hint: null
+          model_hint: this.getExplicitModelForAgent(agent)
         }, verdict = await this.deps.reviewerRegistry.evaluate(spec, `wave-b-tier2-${args.ownerTaskId}`, {
           ...this.deps.classifyVerdict !== void 0 ? { classifyVerdict: this.deps.classifyVerdict } : {},
           ...substrate !== void 0 ? { substrate, workdir: this.deps.workingDir } : {},
@@ -81104,9 +81293,9 @@ function createTaskProgressRelay(deps) {
   let minIntervalMs = deps.minIntervalMs ?? DEFAULT_MIN_RELAY_INTERVAL_MS, lastRelayedAt = 0, lastMessage = null, lastPhase = null, lastTaskId = null, pendingTimeout = null, pendingFlush = null, emit = async (event, message2) => {
     pendingTimeout && (clearTimeout(pendingTimeout), pendingTimeout = null), pendingFlush = null;
     let taskId = event.progressTaskId ?? ("taskId" in event && typeof event.taskId == "string" ? event.taskId : void 0);
-    lastRelayedAt = Date.now(), lastMessage = message2, lastPhase = event.phase, lastTaskId = taskId ?? null, RUNTIME_LABELLED_PHASES.has(event.phase) ? logger.info("[task-progress-relay] relayed", { phase: event.phase, message: message2 }) : logger.debug("[task-progress-relay] relayed", { phase: event.phase });
+    lastRelayedAt = Date.now(), lastMessage = message2, lastPhase = event.phase, lastTaskId = taskId ?? null;
     try {
-      return await deps.emitShellEvent({
+      let result = await deps.emitShellEvent({
         sessionId: deps.sessionId,
         type: "NOTIFICATION",
         source: "DESKTOP",
@@ -81118,7 +81307,16 @@ function createTaskProgressRelay(deps) {
           message: message2,
           ...taskId ? { taskId } : {}
         }
-      }), !0;
+      });
+      if (!result.emitted) {
+        let code = result.error?.code;
+        return logger.warn("[task-progress-relay] progress notification was not acknowledged", {
+          phase: event.phase,
+          reason: result.reason,
+          ...typeof code == "string" && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? { errorCode: code } : {}
+        }), !1;
+      }
+      return RUNTIME_LABELLED_PHASES.has(event.phase) ? logger.info("[task-progress-relay] relayed", { phase: event.phase, message: message2 }) : logger.debug("[task-progress-relay] relayed", { phase: event.phase }), !0;
     } catch (err) {
       return logger.debug("[task-progress-relay] failed to emit progress notification (non-fatal)", {
         phase: event.phase,
@@ -82571,7 +82769,7 @@ async function runOrchestrationShellSession(args) {
       finalApprovalCancelled ? "CANCEL" : "ABORT"
     ), args.quorumLoop.reportTeamTrackUserResolved(taskId, postAction), args.quorumLoop.reportFinalApprovalCancelled(taskId, postAction);
     try {
-      let timestamp5 = gateResolution?.recordedAt || (/* @__PURE__ */ new Date()).toISOString(), gateId = gateResolution?.gateId, decisionClaimId = gateResolution?.decisionClaimId;
+      let timestamp5 = (/* @__PURE__ */ new Date()).toISOString(), serverRecordedAt = gateResolution?.recordedAt, gateId = gateResolution?.gateId, decisionClaimId = gateResolution?.decisionClaimId;
       if (postAction.kind === "final_approval_resolved") {
         let dec = canonicalDecision ? canonicalDecision.trim().toLowerCase() : postAction.decision;
         args.quorumLoop?.recordUserDecision?.(taskId, {
@@ -82579,7 +82777,8 @@ async function runOrchestrationShellSession(args) {
           isFinalApproval: !0,
           gateId,
           decisionClaimId,
-          timestamp: timestamp5
+          timestamp: timestamp5,
+          serverRecordedAt
         });
       } else if (postAction.kind === "terminate_gate") {
         let canon = canonicalDecision ? canonicalDecision.trim().toLowerCase() : "", dec = canon === "accept_with_notes" || !canon && postAction.notes ? "accept_with_notes" : canon || "accept";
@@ -82589,14 +82788,16 @@ async function runOrchestrationShellSession(args) {
           notes: postAction.notes ?? void 0,
           gateId,
           decisionClaimId,
-          timestamp: timestamp5
+          timestamp: timestamp5,
+          serverRecordedAt
         });
       } else postAction.kind === "abort_task" && args.quorumLoop?.recordUserDecision?.(taskId, {
         decision: "cancel",
         isFinalApproval: !1,
         gateId,
         decisionClaimId,
-        timestamp: timestamp5
+        timestamp: timestamp5,
+        serverRecordedAt
       });
     } catch {
     }
@@ -88100,6 +88301,7 @@ var import_uuid18 = require("uuid"), fs65 = __toESM(require("fs"));
 
 // src/orchestration-shell/doctor-cli.ts
 var fs59 = __toESM(require("fs")), path79 = __toESM(require("path")), crypto32 = __toESM(require("crypto")), import_child_process7 = require("child_process");
+init_detect_agents();
 
 // src/auth/auth-service.ts
 var crypto31 = __toESM(require("crypto")), fs58 = __toESM(require("fs")), http3 = __toESM(require("http")), import_child_process6 = require("child_process");
@@ -88731,13 +88933,16 @@ function probeAgentClis(env = process.env) {
         error: err.message
       };
     }
+    let explicitModel = detectAgentModel(agent, env, { explicitOnly: !0 }), resolvedModel = explicitModel ?? detectAgentModel(agent, env) ?? void 0;
     return {
       agent,
       command,
       name,
       installed: !0,
       version: version || "installed",
-      binPath
+      binPath,
+      model: resolvedModel,
+      modelIsConfigured: !!explicitModel
     };
   });
 }
@@ -88982,9 +89187,10 @@ function renderPreflight(agents, auth, connectivity, orphans) {
   console.log(`${colors.bold}CodeVibe Preflight Diagnostics${colors.reset}
 `), console.log(`${colors.bold}Agent CLIs:${colors.reset}`);
   for (let agent of agents)
-    if (agent.installed)
-      console.log(`  [${colors.green}ok${colors.reset}] ${agent.name} (${agent.version ?? "installed"})${agent.binPath ? ` ${colors.dim}${agent.binPath}${colors.reset}` : ""}`);
-    else {
+    if (agent.installed) {
+      let modelInfo = agent.model ? agent.modelIsConfigured ? ` [model: ${agent.model}]` : ` [model: native default (unverified: ${agent.model})]` : "";
+      console.log(`  [${colors.green}ok${colors.reset}] ${agent.name} (${agent.version ?? "installed"})${modelInfo}${agent.binPath ? ` ${colors.dim}${agent.binPath}${colors.reset}` : ""}`);
+    } else {
       let reason = agent.error ? `(${agent.error})` : "(not in $PATH)";
       console.log(`  [${colors.yellow}missing${colors.reset}] ${agent.name} ${colors.dim}${reason}${colors.reset}`);
     }
@@ -93622,7 +93828,7 @@ Run codevibe --help for usage.
   if ((args.resume || args.continue) && tier === "FREE")
     return process.stderr.write(`${RESUME_NEEDS_PAID_TIER2}
 `), 1;
-  let mode = await resolveLaunchMode(args, tier), detectedAgents = detectInstalledAgents();
+  let mode = await resolveLaunchMode(args, tier), detectedAgents = detectInstalledAgents(), detectedAgentModels = detectInstalledAgentModels(process.env, void 0, detectedAgents), configuredAgentModels = detectInstalledAgentModels(process.env, void 0, detectedAgents, { explicitOnly: !0 });
   await pushDetectedAgents(
     appsyncClient,
     logger,
@@ -93746,6 +93952,8 @@ ${err.message}
           // CP-1.f LOCK RP-6 — thread the single host-agent probe so the
           // QuorumLoop carries it in `startTask` (race-free gate-row stamp).
           detectedAgents,
+          detectedAgentModels,
+          configuredAgentModels,
           // #585 auto-continuation (Max) — the authoritative resolved tier (the
           // team path is MAX-only, but thread it explicitly for consistency).
           tier,
@@ -93776,6 +93984,8 @@ ${err.message}
           // CP-1.f LOCK RP-6 — thread the single host-agent probe so the
           // QuorumLoop carries it in `startTask` (race-free gate-row stamp).
           detectedAgents,
+          detectedAgentModels,
+          configuredAgentModels,
           // #585 auto-continuation (Max) — the authoritative resolved tier.
           tier,
           // [Gemma classifier · §Wiring] The session's Gemma pipeline (the planner's
@@ -93977,6 +94187,8 @@ function buildAndArmQuorumLoop(args) {
     workingDir: args.workingDir,
     // CP-1.f LOCK RP-6 — race-free request-carried host agents.
     detectedAgents: args.detectedAgents,
+    ...args.detectedAgentModels ? { detectedAgentModels: args.detectedAgentModels } : {},
+    ...args.configuredAgentModels ? { configuredAgentModels: args.configuredAgentModels } : {},
     // #585 auto-continuation (Max) — thread the resolved tier to the loop.
     tier: args.tier,
     // CP-1.f execute-first (#EF-1 / #SR-2) — synchronous halt + fail-closed
@@ -94122,6 +94334,8 @@ async function buildQuorumLoopExecutor(args) {
     holder: quorumLoopHolder,
     // CP-1.f LOCK RP-6 — race-free request-carried host agents.
     detectedAgents: args.detectedAgents,
+    ...args.detectedAgentModels ? { detectedAgentModels: args.detectedAgentModels } : {},
+    ...args.configuredAgentModels ? { configuredAgentModels: args.configuredAgentModels } : {},
     // #585 auto-continuation (Max) — thread the resolved tier to the loop.
     tier: args.tier,
     // [Gemma classifier · §Wiring] Thread the runner so the loop wires the
@@ -94639,6 +94853,8 @@ async function buildTeamLocalExecutor(args) {
     ...args.onTaskAuditSummary ? { onTaskAuditSummary: args.onTaskAuditSummary } : {},
     // CP-1.f LOCK RP-6 — race-free request-carried host agents.
     detectedAgents: args.detectedAgents,
+    ...args.detectedAgentModels ? { detectedAgentModels: args.detectedAgentModels } : {},
+    ...args.configuredAgentModels ? { configuredAgentModels: args.configuredAgentModels } : {},
     // #585 auto-continuation (Max) — thread the resolved tier to the loop.
     tier: args.tier,
     // [Gemma classifier · §Wiring] Thread the runner so the loop wires the