@qwen-code/qwen-code 0.21.0 → 0.21.1-nightly.20260731.702932cc7

package/chunks/{run-qwen-serve-FU6HEM4J.js → run-qwen-serve-JEN6FO2A.js}

@@ -35,22 +35,22 @@ import {
   require_express,
   resolveWebShellDir,
   setDeferredRuntimeRequestTiming
-} from "./chunk-IJTOWOD7.js";
+} from "./chunk-MB32MS4U.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
 import {
   DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
-  normalizeCompactedReplayMaxBytes
-} from "./chunk-COH43MRJ.js";
-import {
-  LOAD_REPLAY_META_KEY
-} from "./chunk-3SJ43L4W.js";
-import "./chunk-WBL3FJEU.js";
-import "./chunk-T2NCM2ET.js";
+  DEFAULT_MAX_JOURNAL_BYTES,
+  DEFAULT_MAX_JOURNAL_EVENTS,
+  normalizeCompactedReplayMaxBytes,
+  normalizeMaxJournalBytes,
+  normalizeMaxJournalEvents
+} from "./chunk-XCGIMOLN.js";
+import "./chunk-FC4KQFCS.js";
 import {
   resolveChannelCwd
-} from "./chunk-7ZCNENPP.js";
+} from "./chunk-FANRZEAJ.js";
 import {
   loadServeFastPathSettings,
   preResolveServeFastPathHomeEnvOverrides
@@ -59,45 +59,54 @@ import {
   MAX_REGISTERED_WORKSPACES,
   resolveWorkspaceInputs,
   workspaceRegistrationId
-} from "./chunk-Q4M4MDQ4.js";
+} from "./chunk-B43QHWY6.js";
+import "./chunk-E2FN6SM7.js";
+import {
+  LOAD_REPLAY_META_KEY
+} from "./chunk-CPZAH673.js";
+import "./chunk-B4AJNNOL.js";
 import {
   canonicalizeWorkspace,
   translateAndCheckAbsoluteWorkspacePath
 } from "./chunk-2RFKHEXL.js";
-import "./chunk-UDX5OBWR.js";
-import "./chunk-5NBDS5S6.js";
+import "./chunk-FCYYAB4S.js";
+import "./chunk-FYJ7W2PI.js";
 import {
   ChannelDeliveryError,
   ChannelWebhookEnqueueError,
   QWEN_SERVER_TOKEN_ENV,
-  isChannelDeliveryError,
+  isChannelDeliveryError
+} from "./chunk-U4VTUMMK.js";
+import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-LK7CHLVP.js";
+} from "./chunk-6MPDY6ZG.js";
 import {
   channelSelectionNames
-} from "./chunk-JLU636DO.js";
+} from "./chunk-ALMR3E6Q.js";
 import "./chunk-BK2UNYWD.js";
 import "./chunk-M5GB774H.js";
+import "./chunk-5HBA2Z7V.js";
+import "./chunk-K6KS3LTN.js";
+import "./chunk-T3CHYWJZ.js";
 import {
   sanitizeLogText
-} from "./chunk-RWTEFFPU.js";
+} from "./chunk-JCJ7LKNA.js";
 import "./chunk-UDXSXLER.js";
-import "./chunk-5HBA2Z7V.js";
 import "./chunk-GOXKNSDZ.js";
 import {
   getGlobalQwenDirLite,
   resolveConfigPathLite
 } from "./chunk-IDS7MSUP.js";
 import "./chunk-6PEXNQTX.js";
-import {
-  getCliVersion
-} from "./chunk-YX324OPW.js";
-import "./chunk-VJNBRRZG.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot
 } from "./chunk-MR3PXB6E.js";
+import {
+  getCliVersion
+} from "./chunk-XDS22O52.js";
+import "./chunk-VJNBRRZG.js";
 import {
   writeStderrLine,
   writeStdoutLine
@@ -1260,7 +1269,7 @@ function createConcreteLogger(input) {
         }
       });
       let timeout;
-      const deadline = new Promise((resolve) => {
+      const deadline = new Promise((resolve2) => {
         timeout = setTimeout(() => {
           try {
             input.warnOnce(
@@ -1269,7 +1278,7 @@ function createConcreteLogger(input) {
             );
           } catch {
           } finally {
-            resolve();
+            resolve2();
           }
         }, input.policy.closeDrainBudgetMs);
         timeout.unref();
@@ -2317,8 +2326,8 @@ async function flushDaemonLogBounded(daemonLog, budgetMs) {
     await Promise.race([
       daemonLog.flush().catch(() => {
       }),
-      new Promise((resolve) => {
-        timer = setTimeout(resolve, budgetMs);
+      new Promise((resolve2) => {
+        timer = setTimeout(resolve2, budgetMs);
         timer.unref();
       })
     ]);
@@ -2492,6 +2501,13 @@ function formatHostForUrl(host) {
   return host;
 }
 __name(formatHostForUrl, "formatHostForUrl");
+function workspaceRuntimeEffectiveEnv(runtime, daemonEnv) {
+  if (runtime.env.mode === "runtime-overlay") {
+    return runtime.env.effectiveEnv ?? {};
+  }
+  return runtime.env.effectiveEnv ?? daemonEnv;
+}
+__name(workspaceRuntimeEffectiveEnv, "workspaceRuntimeEffectiveEnv");
 function formatChannelWorkerDaemonUrl(host, port) {
   const normalized = host.trim().toLowerCase();
   if (normalized === "" || normalized === "0.0.0.0" || normalized === "::" || normalized === "[::]") {
@@ -2529,15 +2545,16 @@ function withSettingsLock(workspace, fn) {
   return next;
 }
 __name(withSettingsLock, "withSettingsLock");
+var retryableChannelWorkerShutdownErrors = /* @__PURE__ */ new WeakSet();
 var channelWorkerRuntimePromise;
 async function loadChannelWorkerRuntime() {
   channelWorkerRuntimePromise ??= Promise.all([
-    import("./channel-worker-supervisor-V7KCFJTS.js"),
-    import("./pidfile-TFRZZZIO.js"),
-    import("./runtime-XXRRTNP6.js"),
+    import("./channel-worker-supervisor-CABBXYHK.js"),
+    import("./pidfile-MV347TTZ.js"),
+    import("./runtime-WVP22ISH.js"),
     import("./cli-entry-path-4VJ3Y6T2.js"),
-    import("./channel-worker-group-2ZD7TVAT.js"),
-    import("./channel-worker-manager-4OA4BCGB.js")
+    import("./channel-worker-group-OVWGYMZS.js"),
+    import("./channel-worker-manager-H55GKOQA.js")
   ]).then(
     ([
       supervisor,
@@ -2642,7 +2659,7 @@ function shouldPreheatBridge(deps) {
 __name(shouldPreheatBridge, "shouldPreheatBridge");
 var coreRuntimePromise;
 function loadCoreRuntime() {
-  coreRuntimePromise ??= import("./src-GE4TTTML.js");
+  coreRuntimePromise ??= import("./core-runtime-253XV2DB.js");
   return coreRuntimePromise;
 }
 __name(loadCoreRuntime, "loadCoreRuntime");
@@ -2672,10 +2689,10 @@ __name(resolveDaemonLogBaseDirForRun, "resolveDaemonLogBaseDirForRun");
 var settingsRuntimePromise;
 function loadSettingsRuntimeModules() {
   settingsRuntimePromise ??= Promise.all([
-    import("./settings-CR2EWTBA.js"),
-    import("./environment-W5UFC2CH.js"),
-    import("./loadedSettingsAdapter-OT6JVQ7U.js"),
-    import("./trustedFolders-KHXHY6PY.js")
+    import("./settings-73RMIOJ6.js"),
+    import("./environment-IJG3N2PR.js"),
+    import("./loadedSettingsAdapter-GQGNHP5I.js"),
+    import("./trustedFolders-YMUTRHEQ.js")
   ]).then(([settings, environment, loadedSettingsAdapter, trustedFolders]) => ({
     settings,
     environment,
@@ -2688,8 +2705,8 @@ __name(loadSettingsRuntimeModules, "loadSettingsRuntimeModules");
 var channelWebhookConfigRuntimePromise;
 function loadChannelWebhookConfigRuntime() {
   channelWebhookConfigRuntimePromise ??= Promise.all([
-    import("./runtime-XXRRTNP6.js"),
-    import("./config-utils-7V7GGIW6.js")
+    import("./runtime-WVP22ISH.js"),
+    import("./config-utils-WADIDWGG.js")
   ]).then(([channelRuntime, configUtils]) => ({
     loadChannelsConfig: channelRuntime.loadChannelsConfig,
     parseChannelWebhookConfig: configUtils.parseChannelWebhookConfig
@@ -2705,6 +2722,7 @@ async function loadServeRuntimeModules() {
     serverModule,
     bridgeModule,
     spawnChannelModule,
+    processRegistryModule,
     workspaceModule,
     workspaceTypesModule,
     daemonStatusProviderModule,
@@ -2713,16 +2731,17 @@ async function loadServeRuntimeModules() {
     totalSessionAdmissionModule,
     workspaceRegistryModule
   ] = await Promise.all([
-    import("./server-4UMH7OIZ.js"),
-    import("./bridge-ZUB64FAE.js"),
-    import("./spawnChannel-RWNDBXGA.js"),
-    import("./workspace-service-JFWRUS4V.js"),
+    import("./server-JNW2NOSQ.js"),
+    import("./bridge-NYOBVRIT.js"),
+    import("./spawnChannel-T5THBHFN.js"),
+    import("./process-registry-2CHQBXH5.js"),
+    import("./workspace-service-SVWOXX2B.js"),
     import("./types-ML3TRJQ5.js"),
-    import("./daemon-status-provider-2233Q37D.js"),
-    import("./workspace-providers-status-QSVZUETE.js"),
-    import("./workspace-skills-status-ZBBKJOI2.js"),
-    import("./total-session-admission-DLHHHLD3.js"),
-    import("./workspace-registry-UT4RBNBM.js")
+    import("./daemon-status-provider-AKALDYJJ.js"),
+    import("./workspace-providers-status-YM3WLW3N.js"),
+    import("./workspace-skills-status-YZHZ3PT5.js"),
+    import("./total-session-admission-QPUKGHKO.js"),
+    import("./workspace-registry-NGZOZKQP.js")
   ]);
   return {
     createServeApp: serverModule.createServeApp,
@@ -2731,6 +2750,7 @@ async function loadServeRuntimeModules() {
     resolveBridgeFsFactory: serverModule.resolveBridgeFsFactory,
     createAcpSessionBridge: bridgeModule.createAcpSessionBridge,
     createSpawnChannelFactory: spawnChannelModule.createSpawnChannelFactory,
+    ProcessRegistry: processRegistryModule.ProcessRegistry,
     createDaemonWorkspaceService: workspaceModule.createDaemonWorkspaceService,
     WorkspaceSettingsPartialPersistError: workspaceTypesModule.WorkspaceSettingsPartialPersistError,
     WorkspaceSkillNotToggleableError: workspaceTypesModule.WorkspaceSkillNotToggleableError,
@@ -2739,7 +2759,8 @@ async function loadServeRuntimeModules() {
     createWorkspaceSkillsStatusProvider: workspaceSkillsStatusModule.createWorkspaceSkillsStatusProvider,
     createTotalSessionAdmissionController: totalSessionAdmissionModule.createTotalSessionAdmissionController,
     createWorkspaceRegistry: workspaceRegistryModule.createWorkspaceRegistry,
-    createWorkspaceSessionOwnerIndex: workspaceRegistryModule.createWorkspaceSessionOwnerIndex
+    createWorkspaceSessionOwnerIndex: workspaceRegistryModule.createWorkspaceSessionOwnerIndex,
+    createWorkspaceGenerationGuard: workspaceRegistryModule.createWorkspaceGenerationGuard
   };
 }
 __name(loadServeRuntimeModules, "loadServeRuntimeModules");
@@ -2779,6 +2800,7 @@ function currentServeFeaturesForRunQwenServe(opts, sessionShellCommandEnabled, s
     reloadAvailable: true,
     channelReloadAvailable: opts.channelSelection !== void 0,
     channelControlAvailable: true,
+    channelManagementAvailable: true,
     persistentWorkspaceRegistrationAvailable: true,
     workspaceRuntimeRemovalAvailable: true,
     // Advertise the same WS feature flags as the runtime path (serve-features.ts)
@@ -2913,12 +2935,12 @@ async function waitForRuntimeStartingForShutdown(runtimeStarting, daemonLog, tim
   let timer;
   await Promise.race([
     runtimeStarting,
-    new Promise((resolve) => {
+    new Promise((resolve2) => {
       timer = setTimeout(() => {
         daemonLog.warn(
           `${timeoutMs}ms runtime-startup wait reached during shutdown; continuing listener close`
         );
-        resolve();
+        resolve2();
       }, timeoutMs);
       timer.unref();
     })
@@ -3087,6 +3109,8 @@ function createBootstrapServeApp(input) {
         listenerMaxConnections: listenerMaxConnections(opts.maxConnections),
         eventRingSize: opts.eventRingSize ?? DEFAULT_EVENT_RING_SIZE,
         compactedReplayMaxBytes: opts.compactedReplayMaxBytes ?? DEFAULT_COMPACTED_REPLAY_MAX_BYTES,
+        maxJournalEvents: opts.maxJournalEvents ?? DEFAULT_MAX_JOURNAL_EVENTS,
+        maxJournalBytes: opts.maxJournalBytes ?? DEFAULT_MAX_JOURNAL_BYTES,
         promptDeadlineMs: positiveFiniteOrNull(opts.promptDeadlineMs),
         writerIdleTimeoutMs: positiveFiniteOrNull(opts.writerIdleTimeoutMs),
         channelIdleTimeoutMs: channelIdleTimeoutMs(opts.channelIdleTimeoutMs),
@@ -3610,7 +3634,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   }
   let workspaceRegistrationStore = deps.workspaceRegistrationStore;
   if (workspaceRegistrationStore === void 0 && process.env["QWEN_SERVE_NO_PERSISTENT_REGISTRATION"] !== "1") {
-    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-24JMHDGF.js");
+    const { WorkspaceRegistrationStore } = await import("./workspace-registration-store-4EGNCIPG.js");
     workspaceRegistrationStore = new WorkspaceRegistrationStore(boundWorkspace);
   }
   if (workspaceRegistrationStore) {
@@ -3765,6 +3789,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   if (opts.compactedReplayMaxBytes !== void 0) {
     normalizeCompactedReplayMaxBytes(opts.compactedReplayMaxBytes);
   }
+  if (opts.maxJournalEvents !== void 0) {
+    normalizeMaxJournalEvents(opts.maxJournalEvents);
+  }
+  if (opts.maxJournalBytes !== void 0) {
+    normalizeMaxJournalBytes(opts.maxJournalBytes);
+  }
   if (opts.writerIdleTimeoutMs !== void 0) {
     if (!isPositiveIntegerMs(opts.writerIdleTimeoutMs)) {
       throw new TypeError(
@@ -3849,6 +3879,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   let runtimeApp;
   let runtimeAppForCleanup;
   let bridgeRef = deps.bridge;
+  let managedProcessRegistry;
   const internalRuntimeBridgesForCleanup = [];
   let daemonEventLoopMonitor;
   let daemonMetricsSampler;
@@ -3860,8 +3891,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   let startRuntimeAfterHealth;
   let startRuntimeForRequest;
   const deferRuntimeUntilFirstHealth = deps.resolveOnListen === true && deps.deferRuntimeUntilFirstHealth === true;
-  const runtimeReady = new Promise((resolve, reject) => {
-    markRuntimeReady = resolve;
+  const runtimeReady = new Promise((resolve2, reject) => {
+    markRuntimeReady = resolve2;
     markRuntimeFailed = reject;
   });
   void runtimeReady.catch(() => {
@@ -4015,6 +4046,19 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   const disposedRuntimeApps = /* @__PURE__ */ new WeakSet();
   const stoppedRuntimeAppProducers = /* @__PURE__ */ new WeakSet();
   const stoppedExtensionReconcilers = /* @__PURE__ */ new WeakSet();
+  const stoppedTrustPolicyMonitors = /* @__PURE__ */ new WeakSet();
+  const stopTrustPolicyMonitor = /* @__PURE__ */ __name((app2) => {
+    if (!app2 || stoppedTrustPolicyMonitors.has(app2)) return;
+    stoppedTrustPolicyMonitors.add(app2);
+    const stop = app2.locals?.["stopTrustPolicyMonitor"];
+    try {
+      stop?.();
+    } catch (err) {
+      daemonLog.warn(
+        `trust policy monitor dispose error: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }, "stopTrustPolicyMonitor");
   const stopExtensionReconciler = /* @__PURE__ */ __name((app2) => {
     if (!app2 || stoppedExtensionReconcilers.has(app2)) return;
     stoppedExtensionReconcilers.add(app2);
@@ -4042,6 +4086,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }, "stopSafely");
     stopSafely("scheduled-task keepalive", locals.stopScheduledTaskKeepalive);
     stopSafely("workspace git state", locals.stopWorkspaceGitState);
+    stopTrustPolicyMonitor(app2);
     for (const stop of locals.subSessionStoppers ?? []) {
       stopSafely("sub-session launcher", stop);
     }
@@ -4095,13 +4140,23 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     return [...new Set(bridges)];
   }, "getRuntimeBridgesForCleanup");
   const buildRuntime = /* @__PURE__ */ __name(async () => {
-    const [runtime, core, settingsRuntime, resolvedCliVersion] = await Promise.all([
+    const [runtime, core, settingsRuntime, resolvedCliVersion, trustPolicy] = await Promise.all([
       loadServeRuntimeModules(),
       loadCoreRuntime(),
       loadSettingsRuntimeModules(),
-      cliVersionPromise
+      cliVersionPromise,
+      import("./daemon-trust-policy-XB7ZSQFQ.js")
     ]);
     cliVersion = resolvedCliVersion;
+    settingsRuntime.environment.preResolveHomeEnvOverrides();
+    const bootTrustSnapshot = await trustPolicy.readDaemonTrustPolicySnapshot();
+    let latestTrustPolicySnapshot = bootTrustSnapshot;
+    const bootPrimaryTrustDecision = trustPolicy.evaluateDaemonWorkspaceTrust(
+      bootTrustSnapshot,
+      boundWorkspace
+    );
+    const trustedWorkspace = deps.trustedWorkspace ?? bootPrimaryTrustDecision.targetTrusted;
+    const workspaceTrustHotReloadAvailable = deps.trustedWorkspace === void 0 && deps.bridge === void 0 && deps.fsFactory === void 0;
     let managedScratchRoot;
     try {
       managedScratchRoot = prepareManagedScratchRoot(
@@ -4115,16 +4170,19 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }
     let runtimeBootSettings;
     try {
-      runtimeBootSettings = settingsRuntime.settings.loadSettings(boundWorkspace);
+      runtimeBootSettings = settingsRuntime.settings.loadSettings(
+        boundWorkspace,
+        {
+          skipLoadEnvironment: true,
+          skipWorkspaceSettings: !trustedWorkspace,
+          workspaceTrusted: trustedWorkspace
+        }
+      );
     } catch (err) {
       writeStderrLine(
         `qwen serve: could not read full settings for runtime startup (${err instanceof Error ? err.message : String(err)}); falling back to defaults.`
       );
     }
-    const trustedWorkspace = deps.trustedWorkspace ?? (runtimeBootSettings ? settingsRuntime.trustedFolders.getWorkspaceTrustStatus(
-      runtimeBootSettings.merged,
-      boundWorkspace
-    ).effective.state === "trusted" : true);
     if (deps.trustedWorkspace === void 0 && runtimeBootSettings && !trustedWorkspace) {
       daemonLog.warn(
         "workspace file writes are disabled because the bound workspace is not trusted",
@@ -4134,7 +4192,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     const runtimeEnvSnapshot = runtimeBootSettings ? settingsRuntime.environment.buildRuntimeEnvironment(
       runtimeBootSettings.merged,
       boundWorkspace,
-      daemonRuntimeBaseEnv
+      daemonRuntimeBaseEnv,
+      trustedWorkspace
     ) : {
       effectiveEnv: { ...daemonRuntimeBaseEnv },
       overlayKeys: Object.freeze([]),
@@ -4142,6 +4201,29 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       envFileReadFailed: false,
       envFileReadFailures: Object.freeze([])
     };
+    const resolveSessionRuntimeBaseDir = /* @__PURE__ */ __name((workspace, settings, effectiveEnv) => {
+      const resolveConfiguredPath = /* @__PURE__ */ __name((configuredPath, relativeTo) => {
+        const expanded = configuredPath === "~" ? os.homedir() : configuredPath.startsWith("~/") || configuredPath.startsWith("~\\") ? path.join(
+          os.homedir(),
+          ...configuredPath.slice(2).split(/[/\\]+/).filter(Boolean)
+        ) : configuredPath;
+        return path.resolve(relativeTo, expanded);
+      }, "resolveConfiguredPath");
+      const runtimeDir = effectiveEnv["QWEN_RUNTIME_DIR"];
+      if (runtimeDir) {
+        return resolveConfiguredPath(runtimeDir, process.cwd());
+      }
+      const settingsDir = settings?.merged.advanced?.runtimeOutputDir;
+      if (settingsDir) {
+        return resolveConfiguredPath(settingsDir, workspace);
+      }
+      const qwenHome = effectiveEnv["QWEN_HOME"];
+      if (qwenHome) {
+        return resolveConfiguredPath(qwenHome, process.cwd());
+      }
+      const homeDir = os.homedir();
+      return homeDir ? path.join(homeDir, ".qwen") : path.join(os.tmpdir(), ".qwen");
+    }, "resolveSessionRuntimeBaseDir");
     const logRuntimeEnvFileReadFailures = /* @__PURE__ */ __name((workspace, snapshot) => {
       if (!snapshot.envFileReadFailed) return;
       const failedFiles = snapshot.envFileReadFailures ?? [];
@@ -4151,14 +4233,21 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       });
     }, "logRuntimeEnvFileReadFailures");
     logRuntimeEnvFileReadFailures(boundWorkspace, runtimeEnvSnapshot);
+    const primarySessionRuntimeBaseDir = resolveSessionRuntimeBaseDir(
+      boundWorkspace,
+      runtimeBootSettings,
+      runtimeEnvSnapshot.effectiveEnv
+    );
     const runtimeEffectiveEnv = {
-      ...runtimeEnvSnapshot.effectiveEnv
+      ...runtimeEnvSnapshot.effectiveEnv,
+      QWEN_RUNTIME_DIR: primarySessionRuntimeBaseDir
     };
     const replaceRuntimeEffectiveEnv = /* @__PURE__ */ __name((nextEnv) => {
       for (const key of Object.keys(runtimeEffectiveEnv)) {
         delete runtimeEffectiveEnv[key];
       }
       Object.assign(runtimeEffectiveEnv, nextEnv);
+      runtimeEffectiveEnv["QWEN_RUNTIME_DIR"] = primarySessionRuntimeBaseDir;
     }, "replaceRuntimeEffectiveEnv");
     const primaryRuntimeEnv = {
       mode: "runtime-overlay",
@@ -4305,17 +4394,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       void 0,
       (workspace, index) => {
         if (index === 0) return true;
-        if (!runtimeBootSettings) {
-          daemonLog.warn(
-            "excluding secondary workspace root because trust settings are unavailable",
-            { workspace }
-          );
-          return false;
-        }
-        const trustedSecondary = settingsRuntime.trustedFolders.getWorkspaceTrustStatus(
-          runtimeBootSettings.merged,
+        const trustedSecondary = trustPolicy.evaluateDaemonWorkspaceTrust(
+          bootTrustSnapshot,
           workspace
-        ).effective.state === "trusted";
+        ).targetTrusted;
         if (!trustedSecondary) {
           daemonLog.warn(
             "excluding untrusted secondary workspace root from file-system access",
@@ -4330,7 +4412,16 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       secondary: boundWorkspaces.slice(1),
       ideEnvPresent: !!process.env["QWEN_CODE_IDE_WORKSPACE_PATH"]
     });
+    const primaryGenerationGuard = runtime.createWorkspaceGenerationGuard();
+    const primaryTrustMaterialization = JSON.stringify({
+      trusted: trustedWorkspace,
+      boundWorkspaces: [...boundWorkspaces].sort()
+    });
     const sharedPathLocks = new PathMutexRegistry();
+    const workspaceTrustOperationGate = new PathMutexRegistry();
+    const runWorkspaceTrustOperation = /* @__PURE__ */ __name((operation) => workspaceTrustOperationGate.runExclusive("runtime-topology", operation), "runWorkspaceTrustOperation");
+    const processRegistry = new runtime.ProcessRegistry();
+    managedProcessRegistry = processRegistry;
     const fsFactory = runtime.resolveBridgeFsFactory({
       // Secondary roots share a write-capable factory only after their own
       // folder trust check passes; untrusted secondary roots stay outside.
@@ -4339,6 +4430,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       trusted: trustedWorkspace,
       emit: deps.fsAuditEmit,
       pathLocks: sharedPathLocks,
+      generationGuard: primaryGenerationGuard,
       ...customIgnoreFiles !== void 0 ? { customIgnoreFiles } : {}
     });
     const routeFsFactory = runtime.resolveBridgeFsFactory({
@@ -4348,9 +4440,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       trusted: trustedWorkspace,
       emit: deps.fsAuditEmit,
       pathLocks: sharedPathLocks,
+      generationGuard: primaryGenerationGuard,
       ...customIgnoreFiles !== void 0 ? { customIgnoreFiles } : {}
     });
     const channelFactory = runtime.createSpawnChannelFactory({
+      processRegistry,
       sourceEnv: runtimeEffectiveEnv,
       onDiagnosticLine: diagnosticSink,
       pipeHooks: {
@@ -4368,9 +4462,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       env: runtimeEffectiveEnv
     });
     const workspaceProvidersStatusProvider = runtime.createWorkspaceProvidersStatusProvider({
-      env: runtimeEffectiveEnv
+      env: runtimeEffectiveEnv,
+      workspaceTrusted: trustedWorkspace
+    });
+    const workspaceSkillsStatusProvider = runtime.createWorkspaceSkillsStatusProvider({
+      workspaceTrusted: trustedWorkspace
     });
-    const workspaceSkillsStatusProvider = runtime.createWorkspaceSkillsStatusProvider();
     const clientMcpSenderRegistry = new ClientMcpSenderRegistry();
     const runtimeBridges = [];
     const totalSessionAdmission = runtime.createTotalSessionAdmissionController(
@@ -4380,84 +4477,108 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
     );
     const sessionOwnerIndex = runtime.createWorkspaceSessionOwnerIndex();
-    const persistDisabledToolsFn = /* @__PURE__ */ __name((workspace, toolName, enabled) => withSettingsLock(workspace, async () => {
-      const fresh = settingsRuntime.settings.loadSettings(workspace);
+    const workspaceRegistryForPersistence = { current: void 0 };
+    const isWorkspaceTrustedForPersistence = /* @__PURE__ */ __name((workspace) => workspaceRegistryForPersistence.current?.getByWorkspaceCwd(workspace)?.trusted ?? (workspaceRegistryForPersistence.current === void 0 && workspace === boundWorkspace && trustedWorkspace), "isWorkspaceTrustedForPersistence");
+    const loadSettingsForPersistence = /* @__PURE__ */ __name((workspace) => {
+      const trusted = isWorkspaceTrustedForPersistence(workspace);
+      return settingsRuntime.settings.loadSettings(workspace, {
+        skipLoadEnvironment: true,
+        skipWorkspaceSettings: !trusted,
+        workspaceTrusted: trusted
+      });
+    }, "loadSettingsForPersistence");
+    const persistDisabledToolsFn = /* @__PURE__ */ __name((workspace, toolName, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = loadSettingsForPersistence(workspace);
       const wsScope = fresh.forScope(WORKSPACE_SETTING_SCOPE).settings;
       const wsDisabled = wsScope.tools?.disabled;
       const current = Array.isArray(wsDisabled) ? wsDisabled.filter((v) => typeof v === "string") : [];
       const next = new Set(current);
       if (enabled) next.delete(toolName);
       else next.add(toolName);
+      assertGenerationOpen?.();
       fresh.setValue(
         WORKSPACE_SETTING_SCOPE,
         "tools.disabled",
-        [...next].sort()
+        [...next].sort(),
+        assertGenerationOpen
       );
     }), "persistDisabledToolsFn");
-    const persistDisabledSkillsFn = /* @__PURE__ */ __name((workspace, skillName, enabled) => withSettingsLock(workspace, async () => {
-      const fresh = settingsRuntime.settings.loadSettings(workspace);
+    const persistDisabledSkillsFn = /* @__PURE__ */ __name((workspace, skillName, enabled, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const {
+        resolveSkillSettings,
+        skillSettingStrings,
+        updateWorkspaceSkillSettingLists
+      } = await import("./skill-settings-5IGIJDGA.js");
+      const fresh = loadSettingsForPersistence(workspace);
       const normalizedName = skillName.trim().toLowerCase();
-      const disabledNames = /* @__PURE__ */ __name((value) => Array.isArray(value) ? value.filter(
-        (entry) => typeof entry === "string"
-      ) : [], "disabledNames");
-      const lockedScopes = [
-        ["system", fresh.system.settings.skills?.disabled],
-        ["user", fresh.user.settings.skills?.disabled],
-        ["systemDefaults", fresh.systemDefaults.settings.skills?.disabled]
-      ];
-      for (const [scope, names] of lockedScopes) {
-        if (disabledNames(names).some(
-          (name) => name.trim().toLowerCase() === normalizedName
-        )) {
-          throw new runtime.WorkspaceSkillNotToggleableError(
-            skillName,
-            "locked",
-            scope
-          );
-        }
+      const resolved = resolveSkillSettings(fresh);
+      const disablement = resolved.disablements.get(normalizedName);
+      if (disablement?.reason === "hard" && disablement.lockedScope) {
+        throw new runtime.WorkspaceSkillNotToggleableError(
+          skillName,
+          "locked",
+          disablement.lockedScope
+        );
       }
-      const workspaceDisabled = disabledNames(
-        fresh.workspace.settings.skills?.disabled
+      const workspaceDisabled = skillSettingStrings(
+        fresh,
+        WORKSPACE_SETTING_SCOPE,
+        "disabled"
       );
-      const next = [];
-      let found = false;
-      let changed = false;
-      for (const name of workspaceDisabled) {
-        if (name.trim().toLowerCase() !== normalizedName) {
-          next.push(name);
-          continue;
-        }
-        if (enabled) {
-          changed = true;
-          continue;
-        }
-        if (!found) {
-          next.push(skillName);
-          found = true;
-          if (name !== skillName) changed = true;
-        } else {
-          changed = true;
-        }
+      const workspaceEnabled = skillSettingStrings(
+        fresh,
+        WORKSPACE_SETTING_SCOPE,
+        "enabled"
+      );
+      const next = updateWorkspaceSkillSettingLists(
+        { disabled: workspaceDisabled, enabled: workspaceEnabled },
+        skillName,
+        enabled,
+        resolved.defaultDisabledNames.has(normalizedName) && !resolved.enabledNames.has(normalizedName)
+      );
+      const settingsChanges = [];
+      if (JSON.stringify(next.disabled) !== JSON.stringify(workspaceDisabled)) {
+        settingsChanges.push({
+          key: "skills.disabled",
+          value: next.disabled.length > 0 ? next.disabled : void 0
+        });
       }
-      if (!enabled && !found) {
-        next.push(skillName);
-        changed = true;
+      if (JSON.stringify(next.enabled) !== JSON.stringify(workspaceEnabled)) {
+        settingsChanges.push({
+          key: "skills.enabled",
+          value: next.enabled.length > 0 ? next.enabled : void 0
+        });
       }
-      if (!changed) return { changed: false, disabled: workspaceDisabled };
-      fresh.setValue(
-        WORKSPACE_SETTING_SCOPE,
-        "skills.disabled",
-        next.length > 0 ? next : void 0
+      if (settingsChanges.length === 0) {
+        return { changed: false, disabled: workspaceDisabled };
+      }
+      assertGenerationOpen?.();
+      fresh.setValues(
+        settingsChanges.map((change) => ({
+          scope: WORKSPACE_SETTING_SCOPE,
+          ...change
+        })),
+        void 0,
+        assertGenerationOpen
       );
-      return { changed: true, disabled: next };
+      return {
+        changed: true,
+        disabled: next.disabled,
+        settingsChanges
+      };
     }), "persistDisabledSkillsFn");
-    const persistSettingFn = /* @__PURE__ */ __name((workspace, scope, key, value) => withSettingsLock(workspace, async () => {
-      const fresh = settingsRuntime.settings.loadSettings(workspace);
-      fresh.setValue(scope, key, value);
+    const persistSettingFn = /* @__PURE__ */ __name((workspace, scope, key, value, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = loadSettingsForPersistence(workspace);
+      assertGenerationOpen?.();
+      fresh.setValue(scope, key, value, assertGenerationOpen);
       return fresh;
     }), "persistSettingFn");
-    const persistSettingsFn = /* @__PURE__ */ __name((workspace, writes) => withSettingsLock(workspace, async () => {
-      const fresh = settingsRuntime.settings.loadSettings(workspace);
+    const persistSettingsFn = /* @__PURE__ */ __name((workspace, writes, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+      assertGenerationOpen?.();
+      const fresh = loadSettingsForPersistence(workspace);
       const writesByScope = /* @__PURE__ */ new Map();
       for (const write of writes) {
         writesByScope.set(
@@ -4468,10 +4589,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       const committedScopes = /* @__PURE__ */ new Set();
       let committed = 0;
       try {
-        fresh.setValues(writes, (scope) => {
-          committedScopes.add(scope);
-          committed += writesByScope.get(scope) ?? 0;
-        });
+        assertGenerationOpen?.();
+        fresh.setValues(
+          writes,
+          (scope) => {
+            committedScopes.add(scope);
+            committed += writesByScope.get(scope) ?? 0;
+          },
+          assertGenerationOpen
+        );
       } catch (err) {
         const failedWrite = writes.find((write) => !committedScopes.has(write.scope)) ?? writes[committed];
         const message = `persistSettings partial failure (workspace=${workspace}, committed=${committed}/${writes.length}, failedKey=${failedWrite?.key ?? "<unknown>"}, failedScope=${failedWrite?.scope ?? "<unknown>"}): ${err instanceof Error ? err.message : String(err)}`;
@@ -4483,7 +4609,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         );
       }
     }), "persistSettingsFn");
-    const { createSubSessionLauncher } = await import("./create-sub-session-QRJLW5BV.js");
+    const { createSubSessionLauncher } = await import("./create-sub-session-45POYEVP.js");
     const subSessionLauncher = createSubSessionLauncher({
       getBridge: /* @__PURE__ */ __name(() => bridgeRef, "getBridge"),
       boundWorkspace
@@ -4502,10 +4628,17 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       ),
       maxSessions: opts.maxSessions,
       freshSessionAdmission: totalSessionAdmission.admit,
-      sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
+      sessionLifecycle: /* @__PURE__ */ __name((event) => {
+        if (event.type === "registered" && primaryGenerationGuard.closed) {
+          return;
+        }
+        sessionOwnerIndex.handleBridgeSessionLifecycle(event);
+      }, "sessionLifecycle"),
       ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
       ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
       ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
+      ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
+      ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
       ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
       ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
       ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
@@ -4523,8 +4656,23 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       statusProvider,
       fileSystem: createBridgeFileSystemAdapter(fsFactory),
       persistApprovalMode: /* @__PURE__ */ __name((workspace, mode) => withSettingsLock(workspace, async () => {
-        const fresh = settingsRuntime.settings.loadSettings(workspace);
-        fresh.setValue(WORKSPACE_SETTING_SCOPE, "tools.approvalMode", mode);
+        primaryGenerationGuard.assertOpen();
+        if (!trustedWorkspace) {
+          throw new Error(
+            "Cannot persist approval mode for an untrusted workspace."
+          );
+        }
+        const fresh = settingsRuntime.settings.loadSettings(workspace, {
+          skipLoadEnvironment: true,
+          workspaceTrusted: trustedWorkspace
+        });
+        primaryGenerationGuard.assertOpen();
+        fresh.setValue(
+          WORKSPACE_SETTING_SCOPE,
+          "tools.approvalMode",
+          mode,
+          () => primaryGenerationGuard.assertOpen()
+        );
       }), "persistApprovalMode")
     });
     if (!deps.bridge) {
@@ -4536,6 +4684,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     }, "invalidatePrimaryServeFeaturesCache");
     const workspaceService = runtime.createDaemonWorkspaceService({
       boundWorkspace,
+      isWorkspaceTrusted: /* @__PURE__ */ __name(() => trustedWorkspace, "isWorkspaceTrusted"),
+      assertGenerationOpen: /* @__PURE__ */ __name(() => primaryGenerationGuard.assertOpen(), "assertGenerationOpen"),
       contextFilename: contextFilenameForInit ?? "QWEN.md",
       statusProvider,
       workspaceProvidersStatusProvider,
@@ -4548,13 +4698,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       persistSetting: persistSettingFn,
       persistSettings: persistSettingsFn,
       preheatAcpChild: /* @__PURE__ */ __name(() => bridge.preheat(), "preheatAcpChild"),
-      reloadDaemonEnv: /* @__PURE__ */ __name((workspace) => withSettingsLock(workspace, async () => {
+      reloadDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+        assertGenerationOpen?.();
         const fresh = settingsRuntime.settings.loadSettings(workspace, {
-          skipLoadEnvironment: true
+          skipLoadEnvironment: true,
+          skipWorkspaceSettings: !trustedWorkspace,
+          workspaceTrusted: trustedWorkspace
         });
+        assertGenerationOpen?.();
         const result = settingsRuntime.settings.reloadEnvironment(
           fresh.merged,
-          workspace
+          workspace,
+          trustedWorkspace
         );
         let refreshedRuntimeEnv;
         let fallbackReason;
@@ -4562,7 +4717,8 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
             fresh.merged,
             workspace,
-            daemonRuntimeBaseEnv
+            daemonRuntimeBaseEnv,
+            trustedWorkspace
           );
         } catch (err) {
           fallbackReason = err instanceof Error ? err.message : String(err);
@@ -4621,6 +4777,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       {
         workspaceId: daemonWorkspaceHash,
         workspaceCwd: boundWorkspace,
+        sessionRuntimeBaseDir: primarySessionRuntimeBaseDir,
         ...workspaceInputs[0]?.displayName ? { displayName: workspaceInputs[0].displayName } : {},
         primary: true,
         trusted: trustedWorkspace,
@@ -4630,14 +4787,17 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         bridge,
         workspaceService,
         routeFileSystemFactory: routeFsFactory,
-        clientMcpSenderRegistry
+        clientMcpSenderRegistry,
+        generationGuard: primaryGenerationGuard,
+        trustMaterialization: primaryTrustMaterialization
       }
     ];
-    const createRuntimeEnvMetadata = /* @__PURE__ */ __name((workspace, settings) => {
+    const createRuntimeEnvMetadata = /* @__PURE__ */ __name((workspace, settings, trusted) => {
       const snapshot = settings ? settingsRuntime.environment.buildRuntimeEnvironment(
         settings.merged,
         workspace,
-        daemonRuntimeBaseEnv
+        daemonRuntimeBaseEnv,
+        trusted
       ) : {
         effectiveEnv: { ...daemonRuntimeBaseEnv },
         overlayKeys: Object.freeze([]),
@@ -4646,7 +4806,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         envFileReadFailures: Object.freeze([])
       };
       logRuntimeEnvFileReadFailures(workspace, snapshot);
-      const effectiveEnv = { ...snapshot.effectiveEnv };
+      const sessionRuntimeBaseDir = resolveSessionRuntimeBaseDir(
+        workspace,
+        settings,
+        snapshot.effectiveEnv
+      );
+      const effectiveEnv = {
+        ...snapshot.effectiveEnv,
+        QWEN_RUNTIME_DIR: sessionRuntimeBaseDir
+      };
       const metadata = {
         mode: "runtime-overlay",
         overlayKeys: [...snapshot.overlayKeys],
@@ -4658,36 +4826,44 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       return {
         metadata,
         effectiveEnv,
+        sessionRuntimeBaseDir,
         replace(nextEnv) {
           for (const key of Object.keys(effectiveEnv)) {
             delete effectiveEnv[key];
           }
           Object.assign(effectiveEnv, nextEnv);
+          effectiveEnv["QWEN_RUNTIME_DIR"] = sessionRuntimeBaseDir;
         }
       };
     }, "createRuntimeEnvMetadata");
     const subSessionStoppers = [];
-    const subSessionStoppersByWorkspace = /* @__PURE__ */ new Map();
+    const subSessionStoppersByRuntime = /* @__PURE__ */ new WeakMap();
     const runtimeCleanupPromises = /* @__PURE__ */ new WeakMap();
     const removeArrayValue = /* @__PURE__ */ __name((values, value) => {
       const index = values.indexOf(value);
       if (index >= 0) values.splice(index, 1);
     }, "removeArrayValue");
     for (const workspaceInput of workspaceInputs.slice(1)) {
+      const secondaryDecision = trustPolicy.evaluateDaemonWorkspaceTrust(
+        bootTrustSnapshot,
+        workspaceInput.cwd
+      );
+      const secondaryTrusted = secondaryDecision.targetTrusted;
       let secondarySettings;
       try {
         secondarySettings = settingsRuntime.settings.loadSettings(
-          workspaceInput.cwd
+          workspaceInput.cwd,
+          {
+            skipLoadEnvironment: true,
+            skipWorkspaceSettings: !secondaryTrusted,
+            workspaceTrusted: secondaryTrusted
+          }
         );
       } catch (err) {
         writeStderrLine(
           `qwen serve: could not read full settings for secondary workspace ${workspaceInput.cwd} (${err instanceof Error ? err.message : String(err)}); falling back to defaults.`
         );
       }
-      const secondaryTrusted = secondarySettings ? settingsRuntime.trustedFolders.getWorkspaceTrustStatus(
-        secondarySettings.merged,
-        workspaceInput.cwd
-      ).effective.state === "trusted" : false;
       if (!secondaryTrusted) {
         daemonLog.warn("secondary workspace is not trusted", {
           workspace: workspaceInput.cwd,
@@ -4696,11 +4872,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }
       const secondaryEnv = createRuntimeEnvMetadata(
         workspaceInput.cwd,
-        secondarySettings
+        secondarySettings,
+        secondaryTrusted
       );
+      const secondaryCustomIgnoreFiles = secondarySettings?.merged.context?.fileFiltering?.customIgnoreFiles;
+      const secondaryContextFilename = extractContextFilename(secondarySettings?.merged.context?.fileName) ?? contextFilenameForInit ?? "QWEN.md";
       const secondaryWorkspaceHash = core.hashDaemonWorkspace(
         workspaceInput.cwd
       );
+      const secondaryGenerationGuard = runtime.createWorkspaceGenerationGuard();
       const secondaryStatusProvider = runtime.createDaemonStatusProvider({
         env: secondaryEnv.effectiveEnv
       });
@@ -4709,9 +4889,11 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         trusted: secondaryTrusted,
         emit: deps.fsAuditEmit,
         pathLocks: sharedPathLocks,
-        ...customIgnoreFiles !== void 0 ? { customIgnoreFiles } : {}
+        generationGuard: secondaryGenerationGuard,
+        ...secondaryCustomIgnoreFiles !== void 0 ? { customIgnoreFiles: secondaryCustomIgnoreFiles } : {}
       });
       const secondaryChannelFactory = runtime.createSpawnChannelFactory({
+        processRegistry,
         sourceEnv: secondaryEnv.effectiveEnv,
         onDiagnosticLine: diagnosticSink,
         pipeHooks: {
@@ -4743,10 +4925,17 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         ),
         maxSessions: opts.maxSessions,
         freshSessionAdmission: totalSessionAdmission.admit,
-        sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
+        sessionLifecycle: /* @__PURE__ */ __name((event) => {
+          if (event.type === "registered" && secondaryGenerationGuard.closed) {
+            return;
+          }
+          sessionOwnerIndex.handleBridgeSessionLifecycle(event);
+        }, "sessionLifecycle"),
         ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
         ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
         ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
+        ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
+        ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
         ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
         ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
         ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
@@ -4766,26 +4955,42 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         statusProvider: secondaryStatusProvider,
         fileSystem: createBridgeFileSystemAdapter(secondaryBridgeFsFactory),
         persistApprovalMode: /* @__PURE__ */ __name((workspace, mode) => withSettingsLock(workspace, async () => {
-          const fresh = settingsRuntime.settings.loadSettings(workspace);
-          fresh.setValue(WORKSPACE_SETTING_SCOPE, "tools.approvalMode", mode);
+          secondaryGenerationGuard.assertOpen();
+          if (!secondaryTrusted) {
+            throw new Error(
+              "Cannot persist approval mode for an untrusted workspace."
+            );
+          }
+          const fresh = settingsRuntime.settings.loadSettings(workspace, {
+            skipLoadEnvironment: true,
+            workspaceTrusted: secondaryTrusted
+          });
+          secondaryGenerationGuard.assertOpen();
+          fresh.setValue(
+            WORKSPACE_SETTING_SCOPE,
+            "tools.approvalMode",
+            mode,
+            () => secondaryGenerationGuard.assertOpen()
+          );
         }), "persistApprovalMode")
       });
       secondaryBridgeRef = secondaryBridge;
       runtimeBridges.push(secondaryBridge);
       internalRuntimeBridgesForCleanup.push(secondaryBridge);
       subSessionStoppers.push(secondarySubSessionLauncher.stop);
-      subSessionStoppersByWorkspace.set(
-        workspaceInput.cwd,
-        secondarySubSessionLauncher.stop
-      );
       const secondaryWorkspaceService = runtime.createDaemonWorkspaceService({
         boundWorkspace: workspaceInput.cwd,
-        contextFilename: contextFilenameForInit ?? "QWEN.md",
+        isWorkspaceTrusted: /* @__PURE__ */ __name(() => secondaryTrusted, "isWorkspaceTrusted"),
+        assertGenerationOpen: /* @__PURE__ */ __name(() => secondaryGenerationGuard.assertOpen(), "assertGenerationOpen"),
+        contextFilename: secondaryContextFilename,
         statusProvider: secondaryStatusProvider,
         workspaceProvidersStatusProvider: runtime.createWorkspaceProvidersStatusProvider({
-          env: secondaryEnv.effectiveEnv
+          env: secondaryEnv.effectiveEnv,
+          workspaceTrusted: secondaryTrusted
+        }),
+        workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider({
+          workspaceTrusted: secondaryTrusted
         }),
-        workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider(),
         skillInstallEnv: secondaryEnv.effectiveEnv,
         voiceEnv: secondaryEnv.effectiveEnv,
         voiceSettingsScope: WORKSPACE_SETTING_SCOPE,
@@ -4795,19 +5000,25 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         persistDisabledSkills: persistDisabledSkillsFn,
         persistSetting: persistSettingFn,
         persistSettings: persistSettingsFn,
-        reloadDaemonEnv: /* @__PURE__ */ __name((workspace) => withSettingsLock(workspace, async () => {
+        reloadDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+          assertGenerationOpen?.();
           const fresh = settingsRuntime.settings.loadSettings(workspace, {
-            skipLoadEnvironment: true
+            skipLoadEnvironment: true,
+            skipWorkspaceSettings: !secondaryTrusted,
+            workspaceTrusted: secondaryTrusted
           });
+          assertGenerationOpen?.();
           const result = settingsRuntime.settings.reloadEnvironment(
             fresh.merged,
-            workspace
+            workspace,
+            secondaryTrusted
           );
           try {
             const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
               fresh.merged,
               workspace,
-              daemonRuntimeBaseEnv
+              daemonRuntimeBaseEnv,
+              secondaryTrusted
             );
             logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
             secondaryEnv.replace(refreshedRuntimeEnv.effectiveEnv);
@@ -4845,9 +5056,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => secondaryBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
         publishWorkspaceEvent: /* @__PURE__ */ __name((event) => secondaryBridge.publishWorkspaceEvent(event), "publishWorkspaceEvent")
       });
-      workspaceRuntimes.push({
+      const secondaryRuntime = {
         workspaceId: secondaryWorkspaceHash,
         workspaceCwd: workspaceInput.cwd,
+        sessionRuntimeBaseDir: secondaryEnv.sessionRuntimeBaseDir,
         ...workspaceInput.displayName ? { displayName: workspaceInput.displayName } : {},
         primary: false,
         trusted: secondaryTrusted,
@@ -4857,12 +5069,24 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         bridge: secondaryBridge,
         workspaceService: secondaryWorkspaceService,
         routeFileSystemFactory: secondaryBridgeFsFactory,
-        clientMcpSenderRegistry: secondaryClientMcpSenderRegistry
-      });
+        clientMcpSenderRegistry: secondaryClientMcpSenderRegistry,
+        generationGuard: secondaryGenerationGuard,
+        trustMaterialization: JSON.stringify({
+          trusted: secondaryTrusted,
+          boundWorkspaces: [workspaceInput.cwd]
+        })
+      };
+      subSessionStoppersByRuntime.set(
+        secondaryRuntime,
+        secondarySubSessionLauncher.stop
+      );
+      workspaceRuntimes.push(secondaryRuntime);
     }
     const workspaceRegistry = runtime.createWorkspaceRegistry(workspaceRuntimes, {
-      sessionOwnerIndex
+      sessionOwnerIndex,
+      scanUnindexedOwners: deps.bridge !== void 0
     });
+    workspaceRegistryForPersistence.current = workspaceRegistry;
     const workspaceVoiceCoordinator = new WorkspaceVoiceCoordinator();
     core.registerDaemonGaugeCallbacks({
       sessionCount: /* @__PURE__ */ __name(() => workspaceRegistry.list().reduce((sum, item) => sum + item.bridge.sessionCount, 0), "sessionCount"),
@@ -4897,9 +5121,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         const rejectedTotal = hits ? hits.prompt + hits.mutation + hits.read : 0;
         const rateLimitRejected = prevRateRejected === void 0 ? 0 : Math.max(0, rejectedTotal - prevRateRejected);
         prevRateRejected = rejectedTotal;
-        const child = bridge.getChildResourceSnapshot?.();
+        const primaryEntry = workspaceRegistry.primaryEntry;
+        const primaryRuntimeBridge = primaryEntry.state === "active" ? primaryEntry.current?.runtime.bridge : void 0;
+        const child = primaryRuntimeBridge?.getChildResourceSnapshot?.();
         if (runtime.getActiveSseCount() > 0 || (acp?.wsStreams ?? 0) > 0) {
-          void bridge.refreshChildResource?.();
+          void primaryRuntimeBridge?.refreshChildResource?.().catch((err) => {
+            daemonLog.warn(
+              `ACP child resource refresh failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          });
         }
         metricsRing.sample(nowMs, {
           cpuPercent,
@@ -4955,34 +5185,52 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         metricsLoopDelay.disable();
       }
     };
-    const createDynamicWorkspaceRuntime = /* @__PURE__ */ __name(async (cwd, options) => {
-      if (options.provenance === "managed-scratch" && (!managedScratchRoot || !isManagedScratchChild(cwd, managedScratchRoot.canonicalRoot))) {
+    const createDynamicWorkspaceRuntime = /* @__PURE__ */ __name(async (cwd, buildOptions) => {
+      const provenance = buildOptions?.provenance ?? "existing";
+      if (provenance === "managed-scratch" && (!managedScratchRoot || !isManagedScratchChild(cwd, managedScratchRoot.canonicalRoot))) {
         throw new Error(
           "Managed scratch runtime must use an accepted direct child directory"
         );
       }
+      const snapshot = buildOptions?.snapshot ?? await trustPolicy.readDaemonTrustPolicySnapshot();
+      const decision = buildOptions?.decision ?? trustPolicy.evaluateDaemonWorkspaceTrust(snapshot, cwd);
+      const trusted = provenance === "managed-scratch" ? true : buildOptions?.trusted ?? decision.targetTrusted;
       let wsSettings;
       try {
-        wsSettings = settingsRuntime.settings.loadSettings(cwd);
+        wsSettings = settingsRuntime.settings.loadSettings(cwd, {
+          skipLoadEnvironment: true,
+          skipWorkspaceSettings: !trusted,
+          workspaceTrusted: trusted
+        });
       } catch (err) {
         writeStderrLine(
           `qwen serve: could not read full settings for dynamic workspace ${cwd} (${err instanceof Error ? err.message : String(err)}); falling back to defaults.`
         );
       }
-      const trusted = options.provenance === "managed-scratch" || (wsSettings ? settingsRuntime.trustedFolders.getWorkspaceTrustStatus(
-        wsSettings.merged,
-        cwd
-      ).effective.state === "trusted" : false);
-      const wsEnv = createRuntimeEnvMetadata(cwd, wsSettings);
+      const wsEnv = createRuntimeEnvMetadata(cwd, wsSettings, trusted);
+      const wsCustomIgnoreFiles = wsSettings?.merged.context?.fileFiltering?.customIgnoreFiles;
+      const wsContextFilename = extractContextFilename(wsSettings?.merged.context?.fileName) ?? contextFilenameForInit ?? "QWEN.md";
       const wsHash = core.hashDaemonWorkspace(cwd);
+      const generationGuard = buildOptions?.generationGuard ?? runtime.createWorkspaceGenerationGuard();
+      const runtimeBoundWorkspaces = buildOptions?.boundWorkspaces ?? [cwd];
       const wsFsFactory = runtime.resolveBridgeFsFactory({
-        boundWorkspaces: [cwd],
+        boundWorkspaces: runtimeBoundWorkspaces,
         trusted,
         emit: deps.fsAuditEmit,
         pathLocks: sharedPathLocks,
-        ...customIgnoreFiles !== void 0 ? { customIgnoreFiles } : {}
+        generationGuard,
+        ...wsCustomIgnoreFiles !== void 0 ? { customIgnoreFiles: wsCustomIgnoreFiles } : {}
       });
+      const wsRouteFsFactory = buildOptions?.primary === true && runtimeBoundWorkspaces.length > 1 ? runtime.resolveBridgeFsFactory({
+        boundWorkspaces: [cwd],
+        trusted,
+        emit: deps.fsAuditEmit,
+        pathLocks: sharedPathLocks,
+        generationGuard,
+        ...wsCustomIgnoreFiles !== void 0 ? { customIgnoreFiles: wsCustomIgnoreFiles } : {}
+      }) : wsFsFactory;
       const wsChannelFactory = runtime.createSpawnChannelFactory({
+        processRegistry,
         sourceEnv: wsEnv.effectiveEnv,
         onDiagnosticLine: diagnosticSink,
         pipeHooks: {
@@ -5016,10 +5264,15 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           ),
           maxSessions: opts.maxSessions,
           freshSessionAdmission: totalSessionAdmission.admit,
-          sessionLifecycle: sessionOwnerIndex.handleBridgeSessionLifecycle,
+          sessionLifecycle: /* @__PURE__ */ __name((event) => {
+            if (event.type === "registered" && generationGuard.closed) return;
+            sessionOwnerIndex.handleBridgeSessionLifecycle(event);
+          }, "sessionLifecycle"),
           ...opts.maxPendingPromptsPerSession !== void 0 ? { maxPendingPromptsPerSession: opts.maxPendingPromptsPerSession } : {},
           ...opts.eventRingSize !== void 0 ? { eventRingSize: opts.eventRingSize } : {},
           ...opts.compactedReplayMaxBytes !== void 0 ? { compactedReplayMaxBytes: opts.compactedReplayMaxBytes } : {},
+          ...opts.maxJournalEvents !== void 0 ? { maxJournalEvents: opts.maxJournalEvents } : {},
+          ...opts.maxJournalBytes !== void 0 ? { maxJournalBytes: opts.maxJournalBytes } : {},
           ...opts.channelIdleTimeoutMs !== void 0 ? { channelIdleTimeoutMs: opts.channelIdleTimeoutMs } : {},
           ...opts.initializeTimeoutMs !== void 0 ? { initializeTimeoutMs: opts.initializeTimeoutMs } : {},
           ...opts.sessionReapIntervalMs !== void 0 ? { sessionReapIntervalMs: opts.sessionReapIntervalMs } : {},
@@ -5032,18 +5285,31 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           onDiagnosticLine: diagnosticSink,
           telemetry: createRuntimeBridgeTelemetry(wsHash),
           ...permissionPolicy !== void 0 ? { permissionPolicy } : {},
-          ...permissionConsensusQuorum !== void 0 ? { permissionConsensusQuorum } : {},
+          ...permissionConsensusQuorum !== void 0 ? {
+            permissionConsensusQuorum
+          } : {},
           permissionAudit: permissionAuditPublisher,
           statusProvider: runtime.createDaemonStatusProvider({
             env: wsEnv.effectiveEnv
           }),
           fileSystem: createBridgeFileSystemAdapter(wsFsFactory),
           persistApprovalMode: /* @__PURE__ */ __name((workspace, mode) => withSettingsLock(workspace, async () => {
-            const fresh = settingsRuntime.settings.loadSettings(workspace);
+            generationGuard.assertOpen();
+            if (!trusted) {
+              throw new Error(
+                "Cannot persist approval mode for an untrusted workspace."
+              );
+            }
+            const fresh = settingsRuntime.settings.loadSettings(workspace, {
+              skipLoadEnvironment: true,
+              workspaceTrusted: trusted
+            });
+            generationGuard.assertOpen();
             fresh.setValue(
               WORKSPACE_SETTING_SCOPE,
               "tools.approvalMode",
-              mode
+              mode,
+              () => generationGuard.assertOpen()
             );
           }), "persistApprovalMode")
         });
@@ -5056,36 +5322,47 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       try {
         wsService = runtime.createDaemonWorkspaceService({
           boundWorkspace: cwd,
-          contextFilename: contextFilenameForInit ?? "QWEN.md",
+          isWorkspaceTrusted: /* @__PURE__ */ __name(() => trusted, "isWorkspaceTrusted"),
+          assertGenerationOpen: /* @__PURE__ */ __name(() => generationGuard.assertOpen(), "assertGenerationOpen"),
+          contextFilename: wsContextFilename,
           statusProvider: runtime.createDaemonStatusProvider({
             env: wsEnv.effectiveEnv
           }),
           workspaceProvidersStatusProvider: runtime.createWorkspaceProvidersStatusProvider({
-            env: wsEnv.effectiveEnv
+            env: wsEnv.effectiveEnv,
+            workspaceTrusted: trusted
+          }),
+          workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider({
+            workspaceTrusted: trusted
           }),
-          workspaceSkillsStatusProvider: runtime.createWorkspaceSkillsStatusProvider(),
           skillInstallEnv: wsEnv.effectiveEnv,
           voiceEnv: wsEnv.effectiveEnv,
-          voiceSettingsScope: WORKSPACE_SETTING_SCOPE,
+          ...buildOptions?.primary === true ? {} : { voiceSettingsScope: WORKSPACE_SETTING_SCOPE },
           isChannelLive: /* @__PURE__ */ __name(() => wsBridge.isChannelLive(), "isChannelLive"),
           preheatAcpChild: /* @__PURE__ */ __name(() => wsBridge.preheat(), "preheatAcpChild"),
           persistDisabledTools: persistDisabledToolsFn,
           persistDisabledSkills: persistDisabledSkillsFn,
           persistSetting: persistSettingFn,
           persistSettings: persistSettingsFn,
-          reloadDaemonEnv: /* @__PURE__ */ __name((workspace) => withSettingsLock(workspace, async () => {
+          reloadDaemonEnv: /* @__PURE__ */ __name((workspace, assertGenerationOpen) => withSettingsLock(workspace, async () => {
+            assertGenerationOpen?.();
             const fresh = settingsRuntime.settings.loadSettings(workspace, {
-              skipLoadEnvironment: true
+              skipLoadEnvironment: true,
+              skipWorkspaceSettings: !trusted,
+              workspaceTrusted: trusted
             });
+            assertGenerationOpen?.();
             const result = settingsRuntime.settings.reloadEnvironment(
               fresh.merged,
-              workspace
+              workspace,
+              trusted
             );
             try {
               const refreshedRuntimeEnv = settingsRuntime.environment.buildRuntimeEnvironment(
                 fresh.merged,
                 workspace,
-                daemonRuntimeBaseEnv
+                daemonRuntimeBaseEnv,
+                trusted
               );
               logRuntimeEnvFileReadFailures(workspace, refreshedRuntimeEnv);
               wsEnv.replace(refreshedRuntimeEnv.effectiveEnv);
@@ -5121,7 +5398,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           queryWorkspaceStatus: /* @__PURE__ */ __name((method, idle) => wsBridge.queryWorkspaceStatus(method, idle), "queryWorkspaceStatus"),
           invokeWorkspaceCommand: /* @__PURE__ */ __name((method, params, invokeOpts) => wsBridge.invokeWorkspaceCommand(method, params, invokeOpts), "invokeWorkspaceCommand"),
           refreshExtensionsForAllSessions: /* @__PURE__ */ __name(() => wsBridge.refreshExtensionsForAllSessions(), "refreshExtensionsForAllSessions"),
-          publishWorkspaceEvent: /* @__PURE__ */ __name((event) => wsBridge.publishWorkspaceEvent(event), "publishWorkspaceEvent")
+          publishWorkspaceEvent: /* @__PURE__ */ __name((event) => {
+            if (buildOptions?.primary === true && (event.type === "settings_changed" || event.type === "settings_reloaded")) {
+              invalidatePrimaryServeFeaturesCache();
+            }
+            wsBridge.publishWorkspaceEvent(event);
+          }, "publishWorkspaceEvent")
         });
       } catch (err) {
         wsSubSessionLauncher.stop();
@@ -5136,31 +5418,76 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       runtimeBridges.push(wsBridge);
       internalRuntimeBridgesForCleanup.push(wsBridge);
       subSessionStoppers.push(wsSubSessionLauncher.stop);
-      subSessionStoppersByWorkspace.set(cwd, wsSubSessionLauncher.stop);
-      return {
+      const wsRuntime = {
         workspaceId: wsHash,
         workspaceCwd: cwd,
-        primary: false,
+        sessionRuntimeBaseDir: wsEnv.sessionRuntimeBaseDir,
+        ...buildOptions?.displayName !== void 0 ? { displayName: buildOptions.displayName } : {},
+        primary: buildOptions?.primary ?? false,
         trusted,
-        removable: true,
-        registrationIds: [],
+        provenance,
+        removable: buildOptions?.removable ?? true,
+        registrationIds: [...buildOptions?.registrationIds ?? []],
         env: wsEnv.metadata,
         bridge: wsBridge,
         workspaceService: wsService,
-        routeFileSystemFactory: wsFsFactory,
-        clientMcpSenderRegistry: wsClientMcpRegistry
+        routeFileSystemFactory: wsRouteFsFactory,
+        clientMcpSenderRegistry: wsClientMcpRegistry,
+        generationGuard,
+        trustMaterialization: buildOptions?.trustMaterialization ?? JSON.stringify({
+          trusted,
+          boundWorkspaces: [...runtimeBoundWorkspaces].sort()
+        })
       };
+      subSessionStoppersByRuntime.set(wsRuntime, wsSubSessionLauncher.stop);
+      if (provenance !== "managed-scratch" && !buildOptions?.snapshot) {
+        const latest = await trustPolicy.readDaemonTrustPolicySnapshot();
+        if (latest.revision !== snapshot.revision) {
+          generationGuard.close();
+          wsSubSessionLauncher.stop();
+          await wsBridge.shutdown({ reason: "trust_reconfigured" }).catch(() => {
+            try {
+              wsBridge.killAllSync();
+            } catch {
+            }
+          });
+          subSessionStoppersByRuntime.delete(wsRuntime);
+          removeArrayValue(subSessionStoppers, wsSubSessionLauncher.stop);
+          removeArrayValue(runtimeBridges, wsBridge);
+          removeArrayValue(internalRuntimeBridgesForCleanup, wsBridge);
+          if ((buildOptions?.validationAttempt ?? 0) >= 2) {
+            throw new Error(
+              "Workspace trust policy kept changing during runtime creation."
+            );
+          }
+          const { generationGuard: _staleGuard, ...retryOptions } = buildOptions ?? {};
+          return createDynamicWorkspaceRuntime(cwd, {
+            ...retryOptions,
+            validationAttempt: (buildOptions?.validationAttempt ?? 0) + 1
+          });
+        }
+      }
+      return wsRuntime;
     }, "createDynamicWorkspaceRuntime");
+    const serveAppForRuntimeLifecycle = { current: void 0 };
     const workspaceRuntimeRemoval = {
       async runtimeAdded(runtimeAdded) {
-        const app3 = runtimeApp ?? runtimeAppForCleanup;
+        channelWebhookEnvByWorkspace.set(
+          runtimeAdded.workspaceCwd,
+          workspaceRuntimeEffectiveEnv(runtimeAdded, daemonRuntimeBaseEnv)
+        );
+        channelWebhookConfigVersion += 1;
+        refreshChannelWebhookConfigs?.();
+        const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
         const startScheduledTaskKeepaliveForWorkspace = app3?.locals?.["startScheduledTaskKeepaliveForWorkspace"];
         startScheduledTaskKeepaliveForWorkspace?.(runtimeAdded);
         if (!channelWorkerManager) return;
         try {
-          await channelWorkerManager.restoreWorkspace(
-            runtimeAdded.workspaceCwd
-          );
+          if (runtimeAdded.trusted) {
+            await channelWorkerManager.restoreWorkspace(
+              runtimeAdded.workspaceCwd
+            );
+          }
           await channelWorkerManager.refreshWorkspaces();
         } catch (err) {
           daemonLog.error(
@@ -5172,14 +5499,51 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         }
       },
       beginDrain(runtimeToDrain) {
+        if (runtimeToDrain.primary) {
+          if (bridgeRef === runtimeToDrain.bridge) bridgeRef = void 0;
+          invalidatePrimaryServeFeaturesCache();
+        }
         totalSessionAdmission.beginWorkspaceDrain(runtimeToDrain.workspaceCwd);
         channelWorkerManager?.beginWorkspaceDrain(runtimeToDrain.workspaceCwd);
         workspaceVoiceCoordinator.beginWorkspaceDrain(runtimeToDrain);
+        channelWebhookEnvByWorkspace.delete(runtimeToDrain.workspaceCwd);
+        channelWebhookConfigVersion += 1;
+        refreshChannelWebhookConfigs?.();
+        const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
+        const stopScheduledTaskKeepaliveForWorkspace = app3?.locals?.["stopScheduledTaskKeepaliveForWorkspace"];
+        try {
+          stopScheduledTaskKeepaliveForWorkspace?.(runtimeToDrain.workspaceCwd);
+        } catch (err) {
+          daemonLog.error(
+            "workspace scheduled-task drain error",
+            err instanceof Error ? err : null
+          );
+        }
       },
       cancelDrain(runtimeToDrain) {
+        if (runtimeToDrain.primary && bridgeRef === void 0) {
+          bridgeRef = runtimeToDrain.bridge;
+          invalidatePrimaryServeFeaturesCache();
+        }
         channelWorkerManager?.cancelWorkspaceDrain(runtimeToDrain.workspaceCwd);
         totalSessionAdmission.cancelWorkspaceDrain(runtimeToDrain.workspaceCwd);
         workspaceVoiceCoordinator.cancelWorkspaceDrain(runtimeToDrain);
+        channelWebhookEnvByWorkspace.set(
+          runtimeToDrain.workspaceCwd,
+          workspaceRuntimeEffectiveEnv(runtimeToDrain, daemonRuntimeBaseEnv)
+        );
+        channelWebhookConfigVersion += 1;
+        refreshChannelWebhookConfigs?.();
+        const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
+        const startScheduledTaskKeepaliveForWorkspace = app3?.locals?.["startScheduledTaskKeepaliveForWorkspace"];
+        try {
+          startScheduledTaskKeepaliveForWorkspace?.(runtimeToDrain);
+        } catch (err) {
+          daemonLog.error(
+            "workspace scheduled-task drain rollback error",
+            err instanceof Error ? err : null
+          );
+        }
       },
       completeDrain(runtimeToDrain) {
         totalSessionAdmission.completeWorkspaceDrain(
@@ -5202,18 +5566,29 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         const existing = runtimeCleanupPromises.get(runtimeToDrain);
         if (existing) return existing;
         const cleanup = (async () => {
-          await workspaceVoiceCoordinator.disposeRuntime(
-            runtimeToDrain,
-            reason
-          );
-          const stopSubSessions = subSessionStoppersByWorkspace.get(
-            runtimeToDrain.workspaceCwd
-          );
+          const containmentErrors = [];
+          try {
+            await workspaceVoiceCoordinator.disposeRuntime(
+              runtimeToDrain,
+              reason
+            );
+          } catch (err) {
+            daemonLog.error(
+              "workspace voice cleanup error",
+              err instanceof Error ? err : null
+            );
+          }
+          if (reason === "trust_reconfigured" && workspaceVoiceCoordinator.getWorkspaceActivity(runtimeToDrain) > 0) {
+            containmentErrors.push(
+              new Error("Workspace voice sessions are still active.")
+            );
+          }
+          const stopSubSessions = subSessionStoppersByRuntime.get(runtimeToDrain);
           try {
             stopSubSessions?.();
           } catch {
           }
-          if (reason === "workspace_removed" && channelWorkerManager) {
+          if (reason !== "daemon_shutdown" && channelWorkerManager) {
             await channelWorkerManager.removeWorkspace(runtimeToDrain.workspaceCwd).catch((err) => {
               daemonLog.error(
                 "workspace channel worker cleanup error",
@@ -5234,25 +5609,65 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               );
             }
             writeChannelWorkerPidfile();
+            if (reason === "trust_reconfigured" && channelWorkerManager.workspaceActivity(
+              runtimeToDrain.workspaceCwd
+            ) > 0) {
+              containmentErrors.push(
+                new Error("Workspace channel workers are still active.")
+              );
+            }
           }
-          if (reason === "workspace_removed") {
-            const app3 = runtimeApp ?? runtimeAppForCleanup;
+          if (reason !== "daemon_shutdown") {
+            const app3 = serveAppForRuntimeLifecycle.current ?? runtimeApp ?? runtimeAppForCleanup;
             const stopWorkspaceGitStateForWorkspace = app3?.locals?.["stopWorkspaceGitStateForWorkspace"];
             const stopScheduledTaskKeepaliveForWorkspace = app3?.locals?.["stopScheduledTaskKeepaliveForWorkspace"];
-            stopWorkspaceGitStateForWorkspace?.(runtimeToDrain.workspaceCwd);
-            stopScheduledTaskKeepaliveForWorkspace?.(
-              runtimeToDrain.workspaceCwd
-            );
+            try {
+              stopWorkspaceGitStateForWorkspace?.(runtimeToDrain.workspaceCwd);
+            } catch (err) {
+              daemonLog.error(
+                "workspace git-state cleanup error",
+                err instanceof Error ? err : null
+              );
+            }
+            try {
+              stopScheduledTaskKeepaliveForWorkspace?.(
+                runtimeToDrain.workspaceCwd
+              );
+            } catch (err) {
+              daemonLog.error(
+                "workspace scheduled-task cleanup error",
+                err instanceof Error ? err : null
+              );
+            }
           }
           let bridgeStopped = false;
           try {
             if (!shutdownBridges.has(runtimeToDrain.bridge)) {
-              await runtimeToDrain.bridge.shutdown({ reason });
+              try {
+                await runtimeToDrain.bridge.shutdown({ reason });
+              } catch (shutdownError) {
+                try {
+                  runtimeToDrain.bridge.killAllSync();
+                  daemonLog.warn(
+                    "workspace bridge required forceful shutdown",
+                    {
+                      workspace: runtimeToDrain.workspaceCwd,
+                      reason,
+                      error: shutdownError instanceof Error ? shutdownError.message : String(shutdownError)
+                    }
+                  );
+                } catch (killError) {
+                  throw new AggregateError(
+                    [shutdownError, killError],
+                    "Workspace bridge shutdown could not be confirmed."
+                  );
+                }
+              }
             }
             bridgeStopped = true;
           } finally {
-            if (bridgeStopped || reason === "workspace_removed") {
-              subSessionStoppersByWorkspace.delete(runtimeToDrain.workspaceCwd);
+            if (bridgeStopped) {
+              subSessionStoppersByRuntime.delete(runtimeToDrain);
               if (stopSubSessions) {
                 removeArrayValue(subSessionStoppers, stopSubSessions);
               }
@@ -5264,22 +5679,103 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               shutdownBridges.add(runtimeToDrain.bridge);
             }
           }
+          if (containmentErrors.length > 0) {
+            throw new AggregateError(
+              containmentErrors,
+              "Workspace runtime containment could not be confirmed."
+            );
+          }
         })();
         runtimeCleanupPromises.set(runtimeToDrain, cleanup);
         void cleanup.catch(() => {
-          if (reason === "daemon_shutdown" && runtimeCleanupPromises.get(runtimeToDrain) === cleanup) {
+          if (runtimeCleanupPromises.get(runtimeToDrain) === cleanup) {
             runtimeCleanupPromises.delete(runtimeToDrain);
           }
         });
         return cleanup;
       }
     };
+    const channelManagementServices = /* @__PURE__ */ new WeakMap();
+    const channelManagementService = /* @__PURE__ */ __name((targetRuntime) => {
+      const existing = channelManagementServices.get(targetRuntime);
+      if (existing) return existing;
+      const pending = (async () => {
+        if (!ensureChannelWorkerManager) {
+          throw Object.assign(
+            new Error("Channel worker manager is unavailable."),
+            { code: "channel_worker_unavailable" }
+          );
+        }
+        const [
+          { createChannelManagementService },
+          { WorkspaceChannelSettingsStore }
+        ] = await Promise.all([
+          import("./channel-management-service-5S7YCWX5.js"),
+          import("./channel-settings-store-NLOKYO23.js")
+        ]);
+        return createChannelManagementService({
+          workspaceCwd: targetRuntime.workspaceCwd,
+          store: new WorkspaceChannelSettingsStore(targetRuntime.workspaceCwd),
+          manager: await ensureChannelWorkerManager()
+        });
+      })();
+      channelManagementServices.set(targetRuntime, pending);
+      void pending.catch(() => {
+        if (channelManagementServices.get(targetRuntime) === pending) {
+          channelManagementServices.delete(targetRuntime);
+        }
+      });
+      return pending;
+    }, "channelManagementService");
+    const validateWorkspaceRuntimeForPublication = /* @__PURE__ */ __name(async (runtimeForPublication) => {
+      let candidate = runtimeForPublication;
+      for (let attempt = 0; attempt < 3; attempt++) {
+        const snapshot = await trustPolicy.readDaemonTrustPolicySnapshot();
+        const decision = trustPolicy.evaluateDaemonWorkspaceTrust(
+          snapshot,
+          candidate.workspaceCwd
+        );
+        const materialization = JSON.stringify({
+          trusted: decision.targetTrusted,
+          boundWorkspaces: [candidate.workspaceCwd]
+        });
+        if (candidate.trustMaterialization === materialization) {
+          return candidate;
+        }
+        candidate.generationGuard?.close();
+        await workspaceRuntimeRemoval.disposeRuntime(
+          candidate,
+          "trust_reconfigured"
+        );
+        if (attempt === 2) {
+          throw new Error(
+            "Workspace trust policy kept changing before runtime publication."
+          );
+        }
+        candidate = await createDynamicWorkspaceRuntime(
+          runtimeForPublication.workspaceCwd,
+          {
+            primary: runtimeForPublication.primary,
+            removable: runtimeForPublication.removable,
+            displayName: runtimeForPublication.displayName,
+            registrationIds: runtimeForPublication.registrationIds
+          }
+        );
+      }
+      throw new Error("Workspace runtime publication validation failed.");
+    }, "validateWorkspaceRuntimeForPublication");
     const app2 = runtime.createServeApp(opts, () => actualPort, {
       workspaceRegistry,
       createWorkspaceRuntime: createDynamicWorkspaceRuntime,
+      ...workspaceTrustHotReloadAvailable ? {
+        validateWorkspaceRuntimeForPublication,
+        runWorkspaceTrustOperation,
+        getWorkspaceTrustPolicySnapshot: /* @__PURE__ */ __name(() => latestTrustPolicySnapshot, "getWorkspaceTrustPolicySnapshot")
+      } : {},
       managedScratchRoot,
       workspaceRegistrationStore,
       workspaceRuntimeRemoval,
+      workspaceTrustHotReloadAvailable,
       voiceCoordinator: workspaceVoiceCoordinator,
       bridge,
       webShellDir,
@@ -5330,6 +5826,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       }, "deliverChannelMessage"),
       channelDeliveryAuthorizations,
       reloadChannelWorker,
+      channelManagementService,
       getPerfSnapshot: /* @__PURE__ */ __name(() => ({
         eventLoop: currentDaemonEventLoopMonitor.snapshot(),
         promptQueueWait: {
@@ -5357,9 +5854,10 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       sessionArtifactsPersistenceAvailable: sessionArtifactsPersistenceAvailableFromSettings(
         runtimeBootSettings?.merged
       ),
-      installAuthProvider: /* @__PURE__ */ __name((req) => withSettingsLock(
+      installAuthProvider: /* @__PURE__ */ __name((req, assertGenerationOpen) => withSettingsLock(
         boundWorkspace,
         async () => {
+          assertGenerationOpen?.();
           const provider = core.findProviderById(req.providerId);
           if (!provider) {
             throw new Error(`Unsupported auth provider: ${req.providerId}`);
@@ -5369,7 +5867,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             resolveBaseUrl: core.resolveBaseUrl
           });
           const plan = core.buildInstallPlan(provider, inputs);
-          const fresh = settingsRuntime.settings.loadSettings(boundWorkspace);
+          const fresh = loadSettingsForPersistence(boundWorkspace);
           const adapter = settingsRuntime.loadedSettingsAdapter.createLoadedSettingsAdapter(
             fresh
           );
@@ -5377,6 +5875,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             settings: adapter,
             doRefreshAuth: false
           });
+          assertGenerationOpen?.();
           core.emitDaemonLog("Auth provider installed.", {
             "qwen-code.daemon.auth.provider_id": provider.id,
             "qwen-code.daemon.auth.auth_type": plan.authType
@@ -5395,11 +5894,171 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         }
       ), "installAuthProvider")
     });
+    serveAppForRuntimeLifecycle.current = app2;
     invalidatePrimaryServeFeaturesCache = app2.locals.invalidateServeFeaturesCache ?? invalidatePrimaryServeFeaturesCache;
     app2.locals.subSessionStoppers = subSessionStoppers;
     subSessionStoppers.push(subSessionLauncher.stop);
-    subSessionStoppersByWorkspace.set(boundWorkspace, subSessionLauncher.stop);
-    return { app: app2, bridge };
+    subSessionStoppersByRuntime.set(
+      workspaceRegistry.primary,
+      subSessionLauncher.stop
+    );
+    if (workspaceTrustHotReloadAvailable) {
+      const [
+        { createWorkspaceTrustReconciler },
+        { createDaemonTrustPolicyMonitor }
+      ] = await Promise.all([
+        import("./workspace-trust-reconciler-GGBQV2U5.js"),
+        import("./daemon-trust-policy-monitor-FUTKP42Q.js")
+      ]);
+      const materializationFor = /* @__PURE__ */ __name((entry, snapshot, decision) => {
+        const boundWorkspaces2 = entry.primary && decision.targetTrusted ? runtime.resolveBoundWorkspacesFromIdeEnv(
+          entry.workspaceCwd,
+          void 0,
+          (workspace, index) => index === 0 || trustPolicy.evaluateDaemonWorkspaceTrust(snapshot, workspace).targetTrusted
+        ) : [entry.workspaceCwd];
+        return {
+          key: JSON.stringify({
+            trusted: decision.targetTrusted,
+            boundWorkspaces: [...boundWorkspaces2].sort()
+          }),
+          boundWorkspaces: boundWorkspaces2
+        };
+      }, "materializationFor");
+      const acpHandle = /* @__PURE__ */ __name(() => app2.locals?.["acpHandle"], "acpHandle");
+      const trustReconciler = createWorkspaceTrustReconciler({
+        registry: workspaceRegistry,
+        readLatestSnapshot: trustPolicy.readDaemonTrustPolicySnapshot,
+        materializationKey: /* @__PURE__ */ __name(({ entry, snapshot, decision }) => materializationFor(entry, snapshot, decision).key, "materializationKey"),
+        isTrustDecrease: /* @__PURE__ */ __name(({
+          runtime: current,
+          nextMaterialization,
+          decision
+        }) => {
+          if (current.trusted && !decision.targetTrusted) return true;
+          if (!current.primary || !current.trusted) return false;
+          try {
+            const previous = JSON.parse(
+              current.trustMaterialization ?? "{}"
+            );
+            const next = JSON.parse(nextMaterialization);
+            if (!Array.isArray(previous.boundWorkspaces) || !Array.isArray(next.boundWorkspaces)) {
+              return true;
+            }
+            const nextRoots = new Set(
+              next.boundWorkspaces.filter(
+                (value) => typeof value === "string"
+              )
+            );
+            return previous.boundWorkspaces.some(
+              (value) => typeof value !== "string" || !nextRoots.has(value)
+            );
+          } catch {
+            return true;
+          }
+        }, "isTrustDecrease"),
+        buildRuntime: /* @__PURE__ */ __name(async ({
+          entry,
+          trusted,
+          snapshot,
+          decision,
+          generationGuard
+        }) => {
+          const materialized = materializationFor(
+            entry,
+            snapshot,
+            trusted === decision.targetTrusted ? decision : { ...decision, targetTrusted: trusted }
+          );
+          return createDynamicWorkspaceRuntime(entry.workspaceCwd, {
+            trusted,
+            snapshot,
+            decision,
+            generationGuard,
+            primary: entry.primary,
+            removable: entry.removable,
+            displayName: entry.displayName,
+            registrationIds: entry.registrationIds,
+            boundWorkspaces: materialized.boundWorkspaces,
+            trustMaterialization: materialized.key
+          });
+        }, "buildRuntime"),
+        drainRuntime: /* @__PURE__ */ __name(async (runtimeToDrain) => {
+          workspaceRuntimeRemoval.beginDrain(runtimeToDrain);
+          acpHandle()?.beginWorkspaceDrain(runtimeToDrain.workspaceId);
+        }, "drainRuntime"),
+        disposeRuntime: /* @__PURE__ */ __name(async (runtimeToDispose, reason) => {
+          const errors = [];
+          try {
+            await workspaceRuntimeRemoval.disposeRuntime(
+              runtimeToDispose,
+              reason
+            );
+          } catch (error) {
+            errors.push(error);
+          }
+          try {
+            const handle = acpHandle();
+            if (!runtimeToDispose.primary) {
+              handle?.commitWorkspaceRemoval(runtimeToDispose.workspaceId);
+            }
+            handle?.disposeWorkspace(runtimeToDispose.workspaceId);
+            const deadline = Date.now() + 1e3;
+            while ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0 && Date.now() < deadline) {
+              await new Promise((resolve2) => setTimeout(resolve2, 25));
+            }
+            if ((handle?.getWorkspaceActivity(runtimeToDispose.workspaceId).memoryTasks ?? 0) > 0) {
+              throw new Error(
+                "Workspace memory tasks did not stop after runtime disposal."
+              );
+            }
+          } catch (error) {
+            errors.push(error);
+          }
+          if (errors.length === 1) throw errors[0];
+          if (errors.length > 1) {
+            throw new AggregateError(
+              errors,
+              "Workspace runtime and ACP cleanup failed."
+            );
+          }
+        }, "disposeRuntime"),
+        runtimeActivated: /* @__PURE__ */ __name(async (runtimeAdded) => {
+          workspaceRuntimeRemoval.cancelDrain(runtimeAdded);
+          acpHandle()?.cancelWorkspaceDrain(runtimeAdded.workspaceId);
+          if (runtimeAdded.primary) {
+            bridgeRef = runtimeAdded.bridge;
+            invalidatePrimaryServeFeaturesCache();
+          }
+          await workspaceRuntimeRemoval.runtimeAdded(runtimeAdded);
+        }, "runtimeActivated"),
+        onError: /* @__PURE__ */ __name((entry, error) => {
+          daemonLog.error(
+            `workspace trust reconciliation failed for ${entry.workspaceCwd}`,
+            error instanceof Error ? error : null
+          );
+        }, "onError")
+      });
+      const trustMonitor = createDaemonTrustPolicyMonitor({
+        onSnapshot: /* @__PURE__ */ __name((snapshot) => {
+          latestTrustPolicySnapshot = snapshot;
+          return runWorkspaceTrustOperation(
+            () => trustReconciler.reconcile(snapshot)
+          );
+        }, "onSnapshot"),
+        onError: /* @__PURE__ */ __name((error) => {
+          daemonLog.error(
+            "workspace trust policy monitor failed",
+            error instanceof Error ? error : null
+          );
+        }, "onError")
+      });
+      app2.locals.stopTrustPolicyMonitor = () => trustMonitor.stop();
+      app2.locals.requestTrustReconcile = () => trustMonitor.requestReconcile("manual");
+      app2.locals.waitForTrustPolicyIdle = () => runWorkspaceTrustOperation(async () => void 0);
+      await trustMonitor.start();
+    }
+    const activePrimaryBridge = workspaceRegistry.primaryEntry.current?.runtime.bridge;
+    bridgeRef = activePrimaryBridge;
+    return { app: app2, bridge: activePrimaryBridge };
   }, "buildRuntime");
   if (deps.bridge) {
     const runtime = await buildRuntime();
@@ -5456,46 +6115,89 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
     );
   }
   const channelValidationSettingsRuntime = opts.channelSelection ? await loadSettingsRuntimeModules() : void 0;
+  const channelValidationTrustPolicy = opts.channelSelection ? await import("./daemon-trust-policy-XB7ZSQFQ.js") : void 0;
+  const channelValidationTrustSnapshot = channelValidationTrustPolicy ? await channelValidationTrustPolicy.readDaemonTrustPolicySnapshot() : void 0;
   const resolveChannelWorkspaceGroupsAtListen = /* @__PURE__ */ __name(() => {
     if (!opts.channelSelection || !channelValidationSettingsRuntime || !channelRuntime) {
       return void 0;
     }
+    const registry = (runtimeApp ?? runtimeAppForCleanup)?.locals?.["workspaceRegistry"];
+    const resolveRuntime = /* @__PURE__ */ __name((workspaceCwd) => {
+      const runtime = registry?.getByWorkspaceCwd(workspaceCwd);
+      if (registry && !runtime) {
+        throw Object.assign(
+          new Error(`Workspace "${workspaceCwd}" is unavailable.`),
+          { code: "workspace_unavailable" }
+        );
+      }
+      return runtime;
+    }, "resolveRuntime");
+    const resolveTrusted = /* @__PURE__ */ __name((workspaceCwd, primary, runtime) => {
+      if (runtime) return runtime.trusted;
+      if (primary && deps.trustedWorkspace !== void 0) {
+        return deps.trustedWorkspace;
+      }
+      if (!channelValidationTrustPolicy || !channelValidationTrustSnapshot) {
+        return false;
+      }
+      return channelValidationTrustPolicy.evaluateDaemonWorkspaceTrust(
+        channelValidationTrustSnapshot,
+        workspaceCwd
+      ).targetTrusted;
+    }, "resolveTrusted");
     const settingsByWorkspace = /* @__PURE__ */ new Map();
     if (workspaceInputs.length === 1) {
       const workspace = workspaceInputs[0];
-      const settings = channelValidationSettingsRuntime.settings.loadSettings(
-        workspace.cwd
-      );
-      channelWebhookEnvByWorkspace.set(
-        workspace.cwd,
-        channelValidationSettingsRuntime.environment.buildRuntimeEnvironment(
-          settings.merged,
+      const runtime = resolveRuntime(workspace.cwd);
+      const trusted = resolveTrusted(workspace.cwd, true, runtime);
+      if (!trusted) {
+        throw Object.assign(
+          new Error(
+            `Primary workspace "${workspace.cwd}" is not trusted; cannot host channels.`
+          ),
+          { code: "untrusted_workspace" }
+        );
+      }
+      const effectiveEnv = runtime ? workspaceRuntimeEffectiveEnv(runtime, daemonRuntimeBaseEnv) : channelValidationSettingsRuntime.environment.buildRuntimeEnvironment(
+        channelValidationSettingsRuntime.settings.loadSettings(
           workspace.cwd,
-          daemonRuntimeBaseEnv
-        ).effectiveEnv
-      );
+          {
+            skipLoadEnvironment: true,
+            skipWorkspaceSettings: false,
+            workspaceTrusted: true
+          }
+        ).merged,
+        workspace.cwd,
+        daemonRuntimeBaseEnv,
+        trusted
+      ).effectiveEnv;
+      channelWebhookEnvByWorkspace.set(workspace.cwd, effectiveEnv);
       return void 0;
     }
     const workspaces = workspaceInputs.map((workspace, index) => {
+      const runtime = resolveRuntime(workspace.cwd);
+      const trusted = resolveTrusted(workspace.cwd, index === 0, runtime);
       const settings = channelValidationSettingsRuntime.settings.loadSettings(
-        workspace.cwd
+        workspace.cwd,
+        {
+          skipLoadEnvironment: true,
+          skipWorkspaceSettings: !trusted,
+          workspaceTrusted: trusted
+        }
       );
       settingsByWorkspace.set(workspace.cwd, settings);
       channelWebhookEnvByWorkspace.set(
         workspace.cwd,
-        channelValidationSettingsRuntime.environment.buildRuntimeEnvironment(
+        runtime ? workspaceRuntimeEffectiveEnv(runtime, daemonRuntimeBaseEnv) : channelValidationSettingsRuntime.environment.buildRuntimeEnvironment(
           settings.merged,
           workspace.cwd,
-          daemonRuntimeBaseEnv
+          daemonRuntimeBaseEnv,
+          trusted
         ).effectiveEnv
       );
-      const trusted = index === 0 && deps.trustedWorkspace !== void 0 ? deps.trustedWorkspace : channelValidationSettingsRuntime.trustedFolders.getWorkspaceTrustStatus(
-        settings.merged,
-        workspace.cwd
-      ).effective.state === "trusted";
       return {
         workspaceCwd: workspace.cwd,
-        primary: index === 0,
+        primary: runtime?.primary ?? index === 0,
         trusted
       };
     });
@@ -5519,7 +6221,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
   if (opts.channelSelection) {
     reserveChannelServicePidfile(opts.channelSelection);
   }
-  return await new Promise((resolve, reject) => {
+  return await new Promise((resolve2, reject) => {
     const onListening = /* @__PURE__ */ __name((error) => {
       if (error) return;
       startup.listenerReadyAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -5674,7 +6376,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         daemonLog.error("runtime startup failed", error2);
         markRuntimeFailed(error2);
         if (closeServerAfterChannelWorkerStartupFailure && server.listening) {
-          runtimeFailureListenerClose = new Promise((resolve2) => {
+          runtimeFailureListenerClose = new Promise((resolve3) => {
             server.close((closeErr) => {
               if (closeErr) {
                 daemonLog.error(
@@ -5682,7 +6384,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   closeErr
                 );
               }
-              resolve2();
+              resolve3();
             });
           });
           server.closeAllConnections();
@@ -5715,9 +6417,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         }
         const runtimes = registry.list();
         if (runtimes.length <= 1 && operation === "initial") {
+          const primary = registry.primary;
+          if (!primary.trusted) {
+            throw Object.assign(
+              new Error(
+                `Primary workspace "${primary.workspaceCwd}" is not trusted; cannot host channels.`
+              ),
+              { code: "untrusted_workspace" }
+            );
+          }
           return [
             {
-              workspaceCwd: registry.primary.workspaceCwd,
+              workspaceCwd: primary.workspaceCwd,
               selection: channelSelection
             }
           ];
@@ -5728,7 +6439,12 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         const grouping = resolveChannelWorkspaceGroups({
           workspaces: runtimes.map((runtime) => {
             const settings = settingsRuntime.settings.loadSettings(
-              runtime.workspaceCwd
+              runtime.workspaceCwd,
+              {
+                skipLoadEnvironment: true,
+                skipWorkspaceSettings: !runtime.trusted,
+                workspaceTrusted: runtime.trusted
+              }
             );
             settingsByWorkspace.set(runtime.workspaceCwd, settings);
             return {
@@ -5899,7 +6615,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             );
             return;
           }
-          if (shouldPreheat) {
+          if (shouldPreheat && runtime.bridge) {
             startBridgePreheat(runtime.bridge);
           }
           await completeRuntimeStartup(runtime.app);
@@ -5941,6 +6657,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
         if (shuttingDown) {
           daemonLog.warn(`received ${signal} during drain \u2014 forcing exit`);
           try {
+            managedProcessRegistry?.killAllSync();
             channelWorkerManager?.killAllSync();
             for (const runtimeBridge of getRuntimeBridgesForCleanup()) {
               runtimeBridge.killAllSync();
@@ -5968,7 +6685,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
           process.exit(runtimeStartupError === void 0 ? 0 : 1);
         } catch (err) {
           daemonLog.error("shutdown error", err instanceof Error ? err : null);
-          if (channelWorkerManager?.state().enabled) {
+          if (err instanceof Error && retryableChannelWorkerShutdownErrors.has(err)) {
             daemonLog.error(
               "refusing to exit while a channel worker or service lease remains; signal again to retry after the child exits (another signal during that retry forces exit)"
             );
@@ -6000,7 +6717,17 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
             channelControlDraining = true;
             const initiallyMountedApp = runtimeApp ?? runtimeAppForCleanup;
             const initiallyMountedManagement = initiallyMountedApp?.locals?.["workspaceManagementHandle"];
+            const initiallyMountedSessionMaintenance = initiallyMountedApp?.locals?.["sessionArchiveCoordinator"];
             const initialManagementWait = initiallyMountedManagement?.sealAndWait?.();
+            const initialSessionMaintenanceWait = initiallyMountedSessionMaintenance?.sealMaintenanceAndWait?.();
+            let processRegistryShutdown;
+            const startProcessRegistryShutdown = /* @__PURE__ */ __name(() => {
+              processRegistryShutdown ??= managedProcessRegistry?.shutdown().then(
+                () => void 0,
+                (error2) => error2 instanceof Error ? error2 : new Error(String(error2))
+              );
+            }, "startProcessRegistryShutdown");
+            startProcessRegistryShutdown();
             clearRuntimeStartAfterHealthTimer();
             clearRuntimeStartFallbackTimer();
             cancelDeferredRuntimeStartup();
@@ -6029,6 +6756,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                 const finalErr = err ?? bridgeShutdownError ?? channelWorkerShutdownError;
                 const retryableChannelClose = channelWorkerShutdownError !== void 0 && channelWorkerManager?.state().enabled === true;
                 if (retryableChannelClose) {
+                  const retryableError = channelWorkerShutdownError;
                   await flushDaemonLogBounded(
                     daemonLog,
                     DAEMON_LOG_FORCED_FLUSH_BUDGET_MS
@@ -6036,13 +6764,18 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   closePromise = void 0;
                   shuttingDown = false;
                   channelControlDraining = false;
-                  rej(finalErr);
+                  retryableChannelWorkerShutdownErrors.add(retryableError);
+                  rej(retryableError);
                   return;
                 }
                 if (loggerPublished || loggerSignalOwned) {
-                  writeDaemonLifecycleBestEffort(
-                    () => daemonLog.info("daemon stopped")
-                  );
+                  writeDaemonLifecycleBestEffort(() => {
+                    if (finalErr) {
+                      daemonLog.error("daemon shutdown incomplete", finalErr);
+                    } else {
+                      daemonLog.info("daemon stopped");
+                    }
+                  });
                   await daemonLog.close();
                 }
                 if (finalErr) rej(finalErr);
@@ -6061,10 +6794,24 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
               );
               const appForCleanup = runtimeApp ?? runtimeAppForCleanup;
               const workspaceManagementHandle = appForCleanup?.locals?.["workspaceManagementHandle"];
+              const sessionMaintenance = appForCleanup?.locals?.["sessionArchiveCoordinator"];
               await initialManagementWait;
               if (workspaceManagementHandle !== initiallyMountedManagement) {
                 await workspaceManagementHandle?.sealAndWait?.();
               }
+              await initialSessionMaintenanceWait;
+              if (sessionMaintenance !== initiallyMountedSessionMaintenance) {
+                await sessionMaintenance?.sealMaintenanceAndWait?.();
+              }
+              stopTrustPolicyMonitor(appForCleanup);
+              const waitForTrustPolicyIdle = appForCleanup?.locals?.["waitForTrustPolicyIdle"];
+              await waitForTrustPolicyIdle?.().catch((err) => {
+                daemonLog.error(
+                  "workspace trust reconciliation shutdown wait failed",
+                  err instanceof Error ? err : null
+                );
+              });
+              startProcessRegistryShutdown();
               disposeRuntimeAppResources(appForCleanup);
               disposeDaemonEventLoopMonitor();
               if (channelWorkerManager) {
@@ -6115,6 +6862,14 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                   bridgeShutdownError = err instanceof Error ? err : new Error(String(err));
                 });
               }
+              const processRegistryError = await processRegistryShutdown;
+              if (processRegistryError) {
+                daemonLog.error(
+                  "ACP process registry shutdown error",
+                  processRegistryError
+                );
+                bridgeShutdownError ??= processRegistryError;
+              }
             }).finally(() => {
               if (!server.listening) {
                 void (runtimeFailureListenerClose ?? Promise.resolve()).then(
@@ -6177,13 +6932,13 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
       if (deps.resolveOnListen) {
         loggerPublished = true;
         loggerLifecycle.published();
-        resolve(handle);
+        resolve2(handle);
       } else {
         void runtimeReady.then(
           () => {
             loggerPublished = true;
             loggerLifecycle.published();
-            resolve(handle);
+            resolve2(handle);
           },
           (err) => {
             void handle.close().then(
@@ -6197,7 +6952,7 @@ async function runQwenServeImpl(optsIn, deps, loggerLifecycle) {
                     closeErr instanceof Error ? closeErr : null
                   )
                 );
-                if (channelWorkerManager?.state().enabled) {
+                if (closeErr instanceof Error && retryableChannelWorkerShutdownErrors.has(closeErr)) {
                   writeDaemonLifecycleBestEffort(
                     () => daemonLog.error(
                       "runtime startup failed, but qwen serve remains alive to retain the channel service lease until worker exit is confirmed"