@qwen-code/qwen-code 0.21.1 → 0.21.2

package/chunks/{server-WEH7DVCH.js → server-EP2LLAPD.js}

@@ -1,10 +1,5 @@
 // Force strict mode and setup for ESM
 "use strict";
-import {
-  openQwenAsrRealtimeStream,
-  openVoiceStream,
-  openVoiceStreamWithRetry
-} from "./chunk-BCZFQXWK.js";
 import {
   GENERATION_MAX_PROMPT_BYTES,
   MAX_REMEMBER_CONTENT_BYTES,
@@ -21,7 +16,12 @@ import {
   shouldSuppressRememberErrorDetails,
   workspaceMemoryFailureCode,
   workspaceMemoryFailureDiagnostics
-} from "./chunk-6PE7N3A4.js";
+} from "./chunk-JLZ3RBQG.js";
+import {
+  openQwenAsrRealtimeStream,
+  openVoiceStream,
+  openVoiceStreamWithRetry
+} from "./chunk-YUFIEIWC.js";
 import {
   SetupGithubError,
   collectSessionData,
@@ -33,13 +33,13 @@ import {
   toJson,
   toJsonl,
   toMarkdown
-} from "./chunk-LO4ROVP4.js";
+} from "./chunk-PZEXDV3H.js";
 import {
   OBSERVED_CONTACT_MAX_FRESH_WITHIN_SECONDS,
   ObservedChannelContactStore
-} from "./chunk-LGAOC3ZS.js";
-import "./chunk-XFZYFU3I.js";
+} from "./chunk-675H6PLP.js";
 import "./chunk-YDLJGZHL.js";
+import "./chunk-PCK4B6LR.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-QTERJVPZ.js";
@@ -101,14 +101,18 @@ import {
   setRateLimiter,
   unsafeRevealSecret,
   validateMcpRuntimeServerName
-} from "./chunk-YGF33UXG.js";
+} from "./chunk-MB32MS4U.js";
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
+import {
+  createWorkspaceSkillsStatusProvider
+} from "./chunk-BBIQAX4V.js";
+import "./chunk-L55JWS76.js";
 import {
   evaluateDaemonWorkspaceTrust,
   readDaemonTrustPolicySnapshot
-} from "./chunk-HV26XH34.js";
+} from "./chunk-TTJZAIFP.js";
 import {
   EMPTY_WORKSPACE_VOICE_UPDATE_ERROR,
   MAX_WORKSPACE_SKILL_NAME_LENGTH,
@@ -122,14 +126,14 @@ import {
   validateWorkspaceSkillName,
   validateWorkspaceVoiceState,
   voiceSettingsScopeToWire
-} from "./chunk-P4WOAOJW.js";
+} from "./chunk-56Z7QEAQ.js";
 import {
   PermissionRulesValidationError,
   buildPermissionSettings,
   isPermissionRuleType,
   normalizePermissionRules,
   readPermissionRuleSet
-} from "./chunk-MR5EAQ5M.js";
+} from "./chunk-YANIWTRZ.js";
 import {
   assertVoiceBaseUrlNetworkAllowed,
   isStreamingVoiceModel,
@@ -137,13 +141,13 @@ import {
   resolveVoiceTranscriptionConfig,
   sanitizeVoiceErrorMessage,
   transcribeVoiceAudio
-} from "./chunk-CAPPWD3X.js";
+} from "./chunk-7KAXXBER.js";
 import {
   isVoiceEnabled,
   isVoiceMode,
   readVoiceModel
-} from "./chunk-JTV5K7NH.js";
-import "./chunk-ZHBO7WVX.js";
+} from "./chunk-P5VC5USY.js";
+import "./chunk-CNTR4GR6.js";
 import {
   WorkspacePermissionRulesSessionRequiredError,
   WorkspaceSettingsPartialPersistError,
@@ -161,19 +165,19 @@ import {
 import "./chunk-GRC5HGPI.js";
 import {
   assertValidChannelSecretUpdates
-} from "./chunk-5ZF5XXTS.js";
+} from "./chunk-EQNUDTL6.js";
 import {
   createDaemonStatusProvider
-} from "./chunk-TBBV36Y4.js";
+} from "./chunk-GL4JOZXU.js";
 import "./chunk-VXZBKKQR.js";
-import "./chunk-QIZKCVM3.js";
+import "./chunk-Q5WZTTWE.js";
 import "./chunk-E5Z2AVNV.js";
 import {
   SessionArtifactAuthorizationError,
   SessionArtifactValidationError,
   createAcpSessionBridge,
   parseSessionSource
-} from "./chunk-ZURDMIDR.js";
+} from "./chunk-44F4LBWZ.js";
 import {
   EVENT_SCHEMA_VERSION,
   EventBus,
@@ -181,41 +185,37 @@ import {
 } from "./chunk-GLWP3FDB.js";
 import "./chunk-XCGIMOLN.js";
 import "./chunk-OCPBI7J5.js";
-import "./chunk-KAMYKP7E.js";
+import "./chunk-XUGZYLDH.js";
 import {
   createWorkspaceProvidersStatusProvider
-} from "./chunk-3EFXSQCM.js";
+} from "./chunk-NTDH4IML.js";
 import {
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-KCO4FLFJ.js";
+} from "./chunk-6TAASXWL.js";
 import {
   snapshotProcessEnv
-} from "./chunk-2FAK6PNM.js";
-import {
-  createWorkspaceSkillsStatusProvider
-} from "./chunk-UBEPNVDI.js";
-import "./chunk-L55JWS76.js";
+} from "./chunk-VEMNQMHA.js";
 import {
   STATUS_SCHEMA_VERSION,
   createIdleWorkspaceMemoryStatus,
   mapDomainErrorToErrorKind
-} from "./chunk-FTD6DP4T.js";
+} from "./chunk-GURGAJTX.js";
 import "./chunk-Z4X5MTRT.js";
-import "./chunk-WBL3FJEU.js";
+import "./chunk-FC4KQFCS.js";
 import {
   daemonObservedContactsPath,
   loadChannelsConfig
-} from "./chunk-BNWB5CYE.js";
-import "./chunk-5MKRTI4T.js";
+} from "./chunk-D6MDRSZ6.js";
+import "./chunk-A7Y5H4TX.js";
 import "./chunk-57OAHC2Y.js";
 import {
   parseChannelWebhookConfigLenient
-} from "./chunk-2XSLTRFZ.js";
-import "./chunk-TFRMVU6R.js";
+} from "./chunk-I5BT7ADR.js";
+import "./chunk-FANRZEAJ.js";
 import {
   supportedChannelCatalog
-} from "./chunk-XBYYDKAZ.js";
+} from "./chunk-KWHKHSIS.js";
 import "./chunk-V6WHFGST.js";
 import {
   MAX_REGISTERED_WORKSPACES,
@@ -224,8 +224,8 @@ import {
   WorkspaceRegistrationStoreLimitError,
   normalizeWorkspaceDisplayName,
   workspaceRegistrationId
-} from "./chunk-AQIDMUGU.js";
-import "./chunk-XZC5VLBZ.js";
+} from "./chunk-LYI2PZDK.js";
+import "./chunk-CPZAH673.js";
 import {
   BranchWhilePromptActiveError,
   CancelSentinelCollisionError,
@@ -277,7 +277,7 @@ import {
 } from "./chunk-U4VTUMMK.js";
 import {
   normalizeWorkerDiagnostic
-} from "./chunk-GZ3RCT54.js";
+} from "./chunk-6MPDY6ZG.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -286,10 +286,11 @@ import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import "./chunk-5HBA2Z7V.js";
-import "./chunk-T2NCM2ET.js";
+import "./chunk-K6KS3LTN.js";
+import "./chunk-T3CHYWJZ.js";
 import {
   sanitizeLogText
-} from "./chunk-7I5GTCT4.js";
+} from "./chunk-JCJ7LKNA.js";
 import "./chunk-UDXSXLER.js";
 import {
   getDialogSettingKeys,
@@ -300,27 +301,27 @@ import {
   getWritableScopes,
   loadSettings,
   validateSettingValue
-} from "./chunk-EIF3FXTB.js";
+} from "./chunk-W3UKBMSI.js";
 import "./chunk-RKUWKYED.js";
+import "./chunk-GOXKNSDZ.js";
+import "./chunk-IDS7MSUP.js";
 import {
   SUPPORTED_LANGUAGES,
   detectSystemLanguage,
   resolveLanguageSetting,
   resolveSupportedLanguage
-} from "./chunk-TCIFAA7K.js";
-import "./chunk-2N7CODY5.js";
-import "./chunk-GOXKNSDZ.js";
-import "./chunk-IDS7MSUP.js";
+} from "./chunk-3F2WDAV6.js";
+import "./chunk-EU5TBFJI.js";
 import "./chunk-6PEXNQTX.js";
-import "./chunk-VYOXCEPJ.js";
-import "./chunk-VJNBRRZG.js";
 import {
   getWorkspaceTrustStatus
-} from "./chunk-Q43KPN7X.js";
+} from "./chunk-P755N4CS.js";
 import "./chunk-ALGGS7UH.js";
 import {
   isWithinRoot as isWithinRoot2
 } from "./chunk-MR3PXB6E.js";
+import "./chunk-2KKCCLPT.js";
+import "./chunk-VJNBRRZG.js";
 import {
   writeStderrLine,
   writeStderrLineSafe
@@ -398,19 +399,20 @@ import {
   writeWorkspaceContextFile,
   writeWorktreeSession,
   writeWorktreeSessionMarker
-} from "./chunk-X5WNMMIA.js";
+} from "./chunk-54YCNSK5.js";
+import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
-import "./chunk-5M6IDOMF.js";
-import "./chunk-UPUG4GXM.js";
-import "./chunk-64LQLPL7.js";
-import "./chunk-2LQTH543.js";
-import "./chunk-KRXPRVGL.js";
-import "./chunk-BMFALVGQ.js";
 import {
   MAX_JOBS,
   nextDurableFireMs
-} from "./chunk-CVHIL5IG.js";
+} from "./chunk-AOHY3QJ3.js";
+import "./chunk-5NNHICSA.js";
+import "./chunk-SHN4KHDK.js";
+import "./chunk-JXVC2PL3.js";
+import "./chunk-KRXPRVGL.js";
+import "./chunk-6PVPNMXU.js";
+import "./chunk-ZMOJ7ISP.js";
 import {
   nextFireTime,
   parseCron
@@ -423,22 +425,25 @@ import {
   readCronTasks,
   taskHasLegacyCondition,
   updateCronTasks
-} from "./chunk-PONHVBRT.js";
+} from "./chunk-TEGJSJDF.js";
+import "./chunk-TIRRPCFS.js";
+import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
-import "./chunk-6PVPNMXU.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-6QIGFD5W.js";
-import "./chunk-XWWKIXVD.js";
-import "./chunk-75GFAX4R.js";
-import "./chunk-OKF7JF3R.js";
+import "./chunk-4KP2F2TE.js";
+import "./chunk-3APUUXRF.js";
+import "./chunk-THVU3RNH.js";
+import "./chunk-LHKCY7DY.js";
+import "./chunk-6FMJLI5M.js";
 import {
   APPROVAL_MODES,
   SubagentError,
   SubagentErrorCode
-} from "./chunk-JSD33JG6.js";
+} from "./chunk-CBBP4BMC.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-JCW2R7WC.js";
-import "./chunk-2DN4J57Y.js";
+import "./chunk-K623ENWT.js";
+import "./chunk-AQ37AY7B.js";
+import "./chunk-N4ACHWNH.js";
 import "./chunk-ZPJWUGCS.js";
 import {
   QwenOAuth2Client,
@@ -448,15 +453,15 @@ import {
   isDeviceAuthorizationSuccess,
   isDeviceTokenPending,
   isDeviceTokenSuccess
-} from "./chunk-2LKVPASC.js";
+} from "./chunk-D4HTUMGX.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-LW3RFMG7.js";
-import "./chunk-W4MIWP6M.js";
+import "./chunk-LOY7RWQG.js";
+import "./chunk-E6CJ2SMM.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
 import "./chunk-GLNBDYUX.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-5KTQXHPY.js";
+import "./chunk-6CQWRWUC.js";
 import {
   addDaemonRequestAttribute,
   emitDaemonLog,
@@ -466,40 +471,44 @@ import {
   recordDaemonHttpRequest,
   recordDaemonHttpResponse,
   withDaemonRequestSpan
-} from "./chunk-75MIQ3LV.js";
+} from "./chunk-Z3S5EMOW.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-RPLGZJV2.js";
+import "./chunk-XQK4XXTN.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-DZLYR4U3.js";
+import "./chunk-QDK4F2N5.js";
 import "./chunk-CR3C7WXL.js";
 import "./chunk-XWRJCPHC.js";
 import {
+  CursorNotAtLineBoundaryError,
+  LargeNonUtf8TextError,
+  TextScanBudgetExceededError,
   decodeBufferWithEncodingInfoAsync,
   getAllGeminiMdFilenames,
+  isUtf8CompatibleEncoding,
   isWithinRoot,
   parseLineTolerant,
   read
-} from "./chunk-PT722TDT.js";
+} from "./chunk-DUNI4EBW.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-SGFT55XI.js";
-import "./chunk-Y4IHBGBP.js";
-import "./chunk-Y6AXW2OG.js";
-import "./chunk-VCPIZRYH.js";
+import "./chunk-3I6DUGQD.js";
+import "./chunk-7ULQIS27.js";
+import "./chunk-MM7TH7ZM.js";
+import "./chunk-HIVKI6O6.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-WZRWHXFE.js";
-import "./chunk-A3NDJ5SB.js";
-import "./chunk-7XATOOE7.js";
-import "./chunk-BGTQCTQW.js";
+import "./chunk-Q3T5KA2V.js";
+import "./chunk-R2XWGR75.js";
+import "./chunk-HC45LTEN.js";
+import "./chunk-QARJNL2V.js";
 import "./chunk-W4RQUHY3.js";
-import "./chunk-S7W2GKIO.js";
+import "./chunk-G7XXKQYS.js";
 import {
   FatalConfigError,
   Storage,
   createDebugLogger,
   runWithoutDebugLogSession
-} from "./chunk-UHUSJ6X7.js";
+} from "./chunk-E2BHWIDT.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";
@@ -936,7 +945,9 @@ init_esbuild_shims();
 init_esbuild_shims();
 import * as path2 from "node:path";
 var MAX_READ_BYTES = 256 * 1024;
+var MAX_TEXT_SCAN_BYTES = 8 * 1024 * 1024;
 var MAX_WRITE_BYTES = 5 * 1024 * 1024;
+var BINARY_PROBE_BYTES = 4096;
 function shouldIgnore(absolute, boundWorkspace, ignore, kind = "file") {
   const rel = path2.relative(boundWorkspace, absolute);
   if (rel === "" || rel.startsWith("..")) return { ignored: false };
@@ -1089,6 +1100,64 @@ init_esbuild_shims();
 import { createHash as createHash2, randomBytes } from "node:crypto";
 import { constants as fsConstants, promises as fsp2 } from "node:fs";
 import * as path4 from "node:path";
+
+// packages/cli/src/serve/fs/text-cursor.ts
+init_esbuild_shims();
+var CURSOR_VERSION = 1;
+var MAX_TEXT_CURSOR_CHARS = 1024;
+function encodeTextCursor(state) {
+  return Buffer.from(
+    JSON.stringify({ v: CURSOR_VERSION, ...state }),
+    "utf8"
+  ).toString("base64url");
+}
+__name(encodeTextCursor, "encodeTextCursor");
+function decodeTextCursor(cursor) {
+  if (cursor.length === 0 || cursor.length > MAX_TEXT_CURSOR_CHARS) {
+    throw new FsError(
+      "parse_error",
+      `cursor must be a non-empty string of at most ${MAX_TEXT_CURSOR_CHARS} characters`,
+      { hint: "pass a cursor returned by a previous read" }
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+  } catch {
+    throw new FsError("parse_error", "cursor is not a valid read cursor", {
+      hint: "pass a cursor returned by a previous read"
+    });
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new FsError("parse_error", "cursor is not a valid read cursor", {
+      hint: "pass a cursor returned by a previous read"
+    });
+  }
+  const raw = parsed;
+  const off = raw["off"];
+  const size = raw["size"];
+  const dev = raw["dev"];
+  const ino = raw["ino"];
+  if (raw["v"] !== CURSOR_VERSION || !Number.isSafeInteger(off) || off < 0 || !Number.isSafeInteger(size) || size < 0 || typeof dev !== "string" || typeof ino !== "string") {
+    throw new FsError("parse_error", "cursor is not a valid read cursor", {
+      hint: "pass a cursor returned by a previous read"
+    });
+  }
+  return { off, size, dev, ino };
+}
+__name(decodeTextCursor, "decodeTextCursor");
+function assertCursorMatchesFile(cursor, stats, path14) {
+  if (String(stats.dev) !== cursor.dev || String(stats.ino) !== cursor.ino || stats.size < cursor.size) {
+    throw new FsError(
+      "hash_mismatch",
+      `cursor no longer matches the file it was issued for: ${path14}`,
+      { hint: "re-read the file from the beginning to get a fresh cursor" }
+    );
+  }
+}
+__name(assertCursorMatchesFile, "assertCursorMatchesFile");
+
+// packages/cli/src/serve/fs/workspace-file-system.ts
 function createWorkspaceFileSystemFactory(deps) {
   const boundWorkspaces = canonicalizeWorkspaces(deps.boundWorkspaces);
   if (boundWorkspaces.length === 0) {
@@ -1227,7 +1296,19 @@ var WorkspaceFileSystemImpl = class {
           `limit must be a positive integer, got ${opts.limit}`
         );
       }
-      const snapshot = await readTextSnapshotFromResolvedFile(p, opts);
+      if (opts.cursor !== void 0 && opts.line !== void 0) {
+        throw new FsError(
+          "parse_error",
+          "cursor and line are mutually exclusive; a cursor already encodes where to resume"
+        );
+      }
+      if (opts.maxBytes !== void 0 && (!Number.isSafeInteger(opts.maxBytes) || opts.maxBytes < 1 || opts.maxBytes > MAX_READ_BYTES)) {
+        throw new FsError(
+          "parse_error",
+          `maxBytes must be a positive integer in [1, ${MAX_READ_BYTES}], got ${opts.maxBytes}`
+        );
+      }
+      const snapshot = await readTextFromResolvedFile(p, opts, this.deps.lowFs);
       this.deps.generationGuard?.assertOpen();
       const ignoreVerdict = this.ignoreVerdict(p, "file");
       const meta = snapshot.meta;
@@ -1882,7 +1963,7 @@ function validateWriteTextAtomicOptions(opts) {
   }
 }
 __name(validateWriteTextAtomicOptions, "validateWriteTextAtomicOptions");
-async function readTextSnapshotFromResolvedFile(p, opts = {}) {
+async function readTextFromResolvedFile(p, opts, lowFs) {
   const pre = await fsp2.lstat(p);
   if (pre.isSymbolicLink()) {
     throw new FsError("symlink_escape", `path is a symlink: ${p}`, {
@@ -1892,12 +1973,32 @@ async function readTextSnapshotFromResolvedFile(p, opts = {}) {
   if (!pre.isFile()) {
     throw new FsError("parse_error", `path is not a regular file: ${p}`);
   }
+  if (opts.cursor !== void 0) {
+    return readTextCursorWindowFromResolvedFile(p, pre, opts, lowFs);
+  }
+  const wantsWindow = opts.limit !== void 0 || opts.maxBytes !== void 0 || opts.line !== void 0;
+  if (pre.size > MAX_READ_BYTES && wantsWindow) {
+    return readLargeTextWindowFromResolvedFile(p, pre, opts, lowFs);
+  }
+  return readTextSnapshotFromResolvedFile(p, opts, pre);
+}
+__name(readTextFromResolvedFile, "readTextFromResolvedFile");
+async function readTextSnapshotFromResolvedFile(p, opts = {}, knownPre) {
+  const pre = knownPre ?? await fsp2.lstat(p);
+  if (pre.isSymbolicLink()) {
+    throw new FsError("symlink_escape", `path is a symlink: ${p}`, {
+      hint: "re-resolve the target file instead of reading through a link"
+    });
+  }
+  if (!pre.isFile()) {
+    throw new FsError("parse_error", `path is not a regular file: ${p}`);
+  }
   if (pre.size > MAX_READ_BYTES) {
     throw new FsError(
       "file_too_large",
       `file of ${pre.size} bytes exceeds read cap of ${MAX_READ_BYTES} bytes`,
       {
-        hint: "use readBytes for explicit byte-windowed access on large files"
+        hint: "use a finite line limit for large UTF-8 text, or readBytes for explicit byte-windowed access"
       }
     );
   }
@@ -1914,8 +2015,10 @@ async function readTextSnapshotFromResolvedFile(p, opts = {}) {
     startLineIndex,
     opts.limit ?? Number.POSITIVE_INFINITY
   );
-  const sizeOutcome = enforceReadSize(raw.length, opts.maxBytes);
+  const maxOutputBytes = opts.maxBytes ?? MAX_READ_BYTES;
+  const sizeOutcome = enforceReadSize(raw.length, maxOutputBytes);
   let content = sliced.content;
+  let byteTruncated = false;
   const meta = {
     encoding: decoded.encoding,
     bom: decoded.bom,
@@ -1924,22 +2027,243 @@ async function readTextSnapshotFromResolvedFile(p, opts = {}) {
     originalLineCount: sliced.originalLineCount,
     hash: hashBuffer(raw)
   };
+  const output = Buffer.from(content, "utf-8");
+  if (output.length > maxOutputBytes) {
+    content = safeUtf8Truncate(output, maxOutputBytes).toString("utf-8");
+    meta.lineEnding = detectLineEnding(content);
+    meta.truncated = true;
+    byteTruncated = true;
+  }
   if (sizeOutcome.truncated) {
-    const buf = Buffer.from(content, "utf-8");
-    if (buf.length > sizeOutcome.bytesToRead) {
-      content = safeUtf8Truncate(buf, sizeOutcome.bytesToRead).toString(
-        "utf-8"
-      );
-      meta.lineEnding = detectLineEnding(content);
-    }
     meta.truncated = true;
   }
   if (opts.limit !== void 0 && Number.isFinite(opts.limit) && sliced.originalLineCount > opts.limit + startLineIndex) {
     meta.truncated = true;
   }
+  const pageableLineCount = sliced.originalLineCount - (decoded.content.endsWith("\n") ? 1 : 0);
+  meta.hasMore = byteTruncated || sliced.endLine < pageableLineCount;
+  const bomBytes = decoded.bom ? 3 : 0;
+  const decodedBytesMatchSource = isUtf8CompatibleEncoding(decoded.encoding) && Buffer.from(decoded.content, "utf-8").equals(raw.subarray(bomBytes));
+  if (meta.hasMore && !byteTruncated && decodedBytesMatchSource) {
+    const startByte = bomBytes + sliced.startByteOffset;
+    const contentBytes = Buffer.byteLength(content, "utf-8");
+    const nextOffset = startByte + contentBytes + 1;
+    if (nextOffset < raw.length) {
+      meta.nextCursor = encodeTextCursor({
+        off: nextOffset,
+        size: raw.length,
+        dev: String(pre.dev),
+        ino: String(pre.ino)
+      });
+    }
+  }
   return { content, meta };
 }
 __name(readTextSnapshotFromResolvedFile, "readTextSnapshotFromResolvedFile");
+function assertStreamWindowStable(before, after, p, reason) {
+  const beforeSize = toBigInt(before.size);
+  const afterSize = toBigInt(after.size);
+  if (afterSize < beforeSize || afterSize === beforeSize && (after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)) {
+    throw new FsError("hash_mismatch", `${reason}: ${p}`, {
+      hint: "retry after re-reading the latest file"
+    });
+  }
+}
+__name(assertStreamWindowStable, "assertStreamWindowStable");
+async function readTextCursorWindowFromResolvedFile(p, pre, opts, lowFs) {
+  const cursor = decodeTextCursor(opts.cursor);
+  const fh = await fsp2.open(p, "r");
+  let opened;
+  let afterRead;
+  let window;
+  let primaryError;
+  let hasPrimaryError = false;
+  try {
+    opened = await fh.stat();
+    assertSameFile(pre, opened, p, "read");
+    assertStreamWindowStable(pre, opened, p, "file changed before read");
+    assertCursorMatchesFile(cursor, opened, p);
+    try {
+      const probe = Buffer.alloc(Math.min(BINARY_PROBE_BYTES, opened.size));
+      if (probe.length > 0) {
+        const { bytesRead } = await fh.read(probe, 0, probe.length, 0);
+        if (looksBinary(probe.subarray(0, bytesRead))) {
+          throw new FsError("binary_file", `binary file: ${p}`, {
+            hint: "use readBytes for binary content"
+          });
+        }
+      }
+      window = await lowFs.readTextCursorFromHandle({
+        fileHandle: fh,
+        startOffset: cursor.off,
+        fileSize: opened.size,
+        maxOutputBytes: opts.maxBytes ?? MAX_READ_BYTES,
+        maxSnapBytes: MAX_TEXT_SCAN_BYTES,
+        ...opts.limit !== void 0 ? { limit: opts.limit } : {}
+      });
+    } catch (err) {
+      hasPrimaryError = true;
+      primaryError = err;
+    }
+    afterRead = await fh.stat();
+  } finally {
+    await fh.close();
+  }
+  if (opened === void 0 || afterRead === void 0) {
+    throw new FsError("internal_error", `failed to stat opened file: ${p}`);
+  }
+  const post = await fsp2.lstat(p);
+  if (post.isSymbolicLink()) {
+    throw new FsError(
+      "symlink_escape",
+      `path was replaced with a symlink during read: ${p}`,
+      { hint: "TOCTOU swap detected via post-read lstat" }
+    );
+  }
+  assertSameFile(opened, afterRead, p, "read");
+  assertStreamWindowStable(opened, afterRead, p, "file changed during read");
+  assertSameFile(opened, post, p, "read");
+  assertStreamWindowStable(opened, post, p, "file changed during read");
+  if (hasPrimaryError) {
+    if (primaryError instanceof LargeNonUtf8TextError) {
+      throw new FsError("binary_file", primaryError.message, {
+        cause: primaryError,
+        hint: "convert the file to UTF-8, or use readBytes for the raw bytes"
+      });
+    }
+    if (primaryError instanceof CursorNotAtLineBoundaryError) {
+      throw new FsError("parse_error", primaryError.message, {
+        cause: primaryError,
+        hint: "pass a cursor returned by a previous read"
+      });
+    }
+    throw primaryError;
+  }
+  if (window === void 0) {
+    throw new FsError(
+      "internal_error",
+      `cursor text read returned no result: ${p}`
+    );
+  }
+  const meta = {
+    encoding: window.encoding,
+    bom: window.bom,
+    lineEnding: window.lineEnding,
+    sizeBytes: opened.size,
+    truncated: true,
+    hasMore: window.nextOffset !== void 0 || window.truncatedByBytes === true
+  };
+  if (window.nextOffset !== void 0) {
+    meta.nextCursor = encodeTextCursor({
+      off: window.nextOffset,
+      size: opened.size,
+      dev: String(opened.dev),
+      ino: String(opened.ino)
+    });
+  }
+  return { content: window.content, meta };
+}
+__name(readTextCursorWindowFromResolvedFile, "readTextCursorWindowFromResolvedFile");
+async function readLargeTextWindowFromResolvedFile(p, pre, opts, lowFs) {
+  const fh = await fsp2.open(p, "r");
+  let opened;
+  let afterRead;
+  let result;
+  let primaryError;
+  let hasPrimaryError = false;
+  try {
+    opened = await fh.stat();
+    assertSameFile(pre, opened, p, "read");
+    assertStreamWindowStable(pre, opened, p, "file changed before read");
+    try {
+      const probe = Buffer.alloc(Math.min(BINARY_PROBE_BYTES, opened.size));
+      if (probe.length > 0) {
+        const { bytesRead } = await fh.read(probe, 0, probe.length, 0);
+        if (looksBinary(probe.subarray(0, bytesRead))) {
+          throw new FsError("binary_file", `binary file: ${p}`, {
+            hint: "use readBytes for binary content"
+          });
+        }
+      }
+      result = await lowFs.readTextFileFromHandle({
+        fileHandle: fh,
+        fileSize: opened.size,
+        limit: opts.limit ?? Number.POSITIVE_INFINITY,
+        line: opts.line !== void 0 ? opts.line - 1 : 0,
+        maxOutputBytes: opts.maxBytes ?? MAX_READ_BYTES,
+        maxScanBytes: MAX_TEXT_SCAN_BYTES
+      });
+    } catch (err) {
+      hasPrimaryError = true;
+      primaryError = err;
+    }
+    afterRead = await fh.stat();
+  } finally {
+    await fh.close();
+  }
+  if (opened === void 0 || afterRead === void 0) {
+    throw new FsError("internal_error", `failed to stat opened file: ${p}`);
+  }
+  const post = await fsp2.lstat(p);
+  if (post.isSymbolicLink()) {
+    throw new FsError(
+      "symlink_escape",
+      `path was replaced with a symlink during read: ${p}`,
+      { hint: "TOCTOU swap detected via post-read lstat" }
+    );
+  }
+  assertSameFile(opened, afterRead, p, "read");
+  assertStreamWindowStable(opened, afterRead, p, "file changed during read");
+  assertSameFile(opened, post, p, "read");
+  assertStreamWindowStable(opened, post, p, "file changed during read");
+  if (hasPrimaryError) {
+    if (primaryError instanceof LargeNonUtf8TextError) {
+      throw new FsError("binary_file", primaryError.message, {
+        cause: primaryError,
+        hint: "convert the file to UTF-8, or use readBytes for the raw bytes"
+      });
+    }
+    if (primaryError instanceof TextScanBudgetExceededError) {
+      throw new FsError("file_too_large", primaryError.message, {
+        cause: primaryError,
+        hint: `line offsets are resolved by scanning from byte 0 and stop after ${MAX_TEXT_SCAN_BYTES} bytes; page with the cursor from a shallower read to reach this offset in O(1), or use readBytes for raw bytes`
+      });
+    }
+    throw primaryError;
+  }
+  if (result === void 0) {
+    throw new FsError(
+      "internal_error",
+      `large text range read returned no result: ${p}`
+    );
+  }
+  const content = result.content;
+  const readMeta = result._meta;
+  const meta = {
+    encoding: readMeta?.encoding,
+    bom: readMeta?.bom,
+    lineEnding: readMeta?.lineEnding ?? detectLineEnding(content),
+    // Size as of `open`, not as of now: it describes the snapshot the
+    // returned window was cut from. A file that grew during the read
+    // reports the smaller, consistent number.
+    sizeBytes: opened.size,
+    truncated: true,
+    hasMore: readMeta?.nextByteOffset !== void 0 || readMeta?.truncatedByBytes === true
+  };
+  if (readMeta?.nextByteOffset !== void 0) {
+    meta.nextCursor = encodeTextCursor({
+      off: readMeta.nextByteOffset,
+      size: opened.size,
+      dev: String(opened.dev),
+      ino: String(opened.ino)
+    });
+  }
+  if (readMeta?.originalLineCountExact === true && readMeta?.originalLineCount !== void 0) {
+    meta.originalLineCount = readMeta.originalLineCount;
+  }
+  return { content, meta };
+}
+__name(readLargeTextWindowFromResolvedFile, "readLargeTextWindowFromResolvedFile");
 async function readStableRegularFileBuffer(p, pre) {
   const fh = await fsp2.open(p, "r");
   let opened;
@@ -1951,7 +2275,7 @@ async function readStableRegularFileBuffer(p, pre) {
         "file_too_large",
         `file of ${opened.size} bytes exceeds read cap of ${MAX_READ_BYTES} bytes`,
         {
-          hint: "use readBytes for explicit byte-windowed access on large files"
+          hint: "use a finite line limit for large UTF-8 text, or readBytes for explicit byte-windowed access"
         }
       );
     }
@@ -1987,9 +2311,15 @@ function sliceDecodedText(content, startLine, limit) {
   const originalLineCount = lines.length;
   const endLine = Math.min(startLine + limit, originalLineCount);
   const actualStartLine = Math.min(startLine, originalLineCount);
+  let startByteOffset = 0;
+  for (let i = 0; i < actualStartLine; i++) {
+    startByteOffset += Buffer.byteLength(lines[i], "utf-8") + 1;
+  }
   return {
     content: lines.slice(actualStartLine, endLine).join("\n"),
-    originalLineCount
+    originalLineCount,
+    startByteOffset,
+    endLine
   };
 }
 __name(sliceDecodedText, "sliceDecodedText");
@@ -2780,13 +3110,29 @@ async function handleGetFile(req, res, deps) {
     });
     return;
   }
+  const rawCursor = req.query["cursor"];
+  if (rawCursor !== void 0 && (typeof rawCursor !== "string" || rawCursor.length === 0 || rawCursor.length > MAX_TEXT_CURSOR_CHARS)) {
+    applyReadHeaders(res);
+    res.status(400).json({
+      errorKind: "parse_error",
+      error: `\`cursor\` must be a non-empty string of at most ${MAX_TEXT_CURSOR_CHARS} characters`,
+      status: 400
+    });
+    return;
+  }
+  const cursor = rawCursor;
   const fs6 = factory.forRequest({
     originatorClientId: clientId ?? void 0,
     route: ROUTE2
   });
   try {
     const resolved = await fs6.resolve(queryPath, "read");
-    const out = await fs6.readText(resolved, { maxBytes, line, limit });
+    const out = await fs6.readText(resolved, {
+      maxBytes,
+      line,
+      limit,
+      cursor
+    });
     const returnedBytes = Buffer.byteLength(out.content, "utf-8");
     applyReadHeaders(res);
     res.status(200).json({
@@ -2801,7 +3147,9 @@ async function handleGetFile(req, res, deps) {
       truncated: out.meta.truncated === true,
       hash: out.meta.hash,
       matchedIgnore: out.meta.matchedIgnore ?? null,
-      originalLineCount: out.meta.originalLineCount ?? null
+      originalLineCount: out.meta.originalLineCount ?? null,
+      nextCursor: out.meta.nextCursor ?? null,
+      hasMore: out.meta.hasMore === true
     });
   } catch (err) {
     sendFsError(res, err, ROUTE2);
@@ -6851,18 +7199,34 @@ async function removeTasksForSessions(projectRoot, sessionIds) {
 __name(removeTasksForSessions, "removeTasksForSessions");
 
 // packages/cli/src/serve/server/session-archive.ts
+var DaemonDrainingError = class extends Error {
+  static {
+    __name(this, "DaemonDrainingError");
+  }
+  name = "DaemonDrainingError";
+  code = "daemon_draining";
+  constructor() {
+    super("The daemon is draining and no longer accepts session maintenance.");
+  }
+};
 var SessionArchiveCoordinator = class {
   static {
     __name(this, "SessionArchiveCoordinator");
   }
   exclusive = /* @__PURE__ */ new Set();
   shared = /* @__PURE__ */ new Map();
+  maintenanceSealed = false;
+  activeMaintenance = 0;
+  maintenanceDrain;
   assertNotTransitioning(sessionId) {
     if (this.exclusive.has(sessionId)) {
       throw new SessionArchivingError(sessionId);
     }
   }
   async runExclusiveMany(sessionIds, fn) {
+    if (this.maintenanceSealed) {
+      throw new DaemonDrainingError();
+    }
     const uniqueSessionIds = [...new Set(sessionIds)];
     for (const sessionId of uniqueSessionIds) {
       this.assertNotTransitioning(sessionId);
@@ -6873,13 +7237,33 @@ var SessionArchiveCoordinator = class {
     for (const sessionId of uniqueSessionIds) {
       this.exclusive.add(sessionId);
     }
+    this.activeMaintenance++;
     try {
       return await fn();
     } finally {
       for (const sessionId of uniqueSessionIds) {
         this.exclusive.delete(sessionId);
       }
+      this.activeMaintenance--;
+      if (this.activeMaintenance === 0) {
+        this.maintenanceDrain?.resolve();
+        this.maintenanceDrain = void 0;
+      }
+    }
+  }
+  sealMaintenanceAndWait() {
+    this.maintenanceSealed = true;
+    if (this.activeMaintenance === 0) {
+      return Promise.resolve();
+    }
+    if (!this.maintenanceDrain) {
+      let resolve5;
+      const promise = new Promise((done) => {
+        resolve5 = done;
+      });
+      this.maintenanceDrain = { promise, resolve: resolve5 };
     }
+    return this.maintenanceDrain.promise;
   }
   async runSharedMany(sessionIds, fn) {
     const uniqueSessionIds = [...new Set(sessionIds)];
@@ -6903,70 +7287,280 @@ var SessionArchiveCoordinator = class {
     }
   }
 };
+async function runWithDaemonWriterLease(params) {
+  const {
+    action,
+    sessionId,
+    service,
+    mutate,
+    mutationAppliedAfterError,
+    afterMutationApplied
+  } = params;
+  let lease;
+  try {
+    lease = await service.acquireSessionWriterLease(sessionId, {
+      processKind: "daemon",
+      reclaimPolicy: "never"
+    });
+  } catch (error2) {
+    return { mutationApplied: false, error: error2 };
+  }
+  let value;
+  let mutationApplied = false;
+  let mutationError;
+  try {
+    const mutation = await mutate(() => lease.assertOwnedAndUnchanged());
+    value = mutation.value;
+    mutationApplied = mutation.mutationApplied;
+  } catch (error2) {
+    mutationError = error2;
+    try {
+      mutationApplied = await mutationAppliedAfterError();
+    } catch {
+      mutationApplied = false;
+    }
+  }
+  let maintenanceError;
+  if (mutationApplied) {
+    try {
+      await afterMutationApplied();
+    } catch (error2) {
+      maintenanceError = error2;
+      logSessionArchiveWarning(
+        `scheduled task lifecycle update failed action=${action} workspace=${safeLogValue(
+          service.getProjectRoot()
+        )} session=${safeLogValue(sessionId)} error=${safeLogValue(
+          errorMessage(error2)
+        )}`
+      );
+    }
+  }
+  let releaseError;
+  try {
+    await lease.release();
+  } catch (error2) {
+    releaseError = error2;
+  }
+  if (releaseError !== void 0) {
+    logMaintenanceLeaseReleaseFailure({
+      action,
+      workspace: service.getProjectRoot(),
+      sessionId,
+      error: releaseError,
+      mutationApplied
+    });
+    if (mutationError !== void 0) {
+      logSessionArchiveWarning(
+        `session maintenance mutation also failed action=${action} workspace=${safeLogValue(
+          service.getProjectRoot()
+        )} session=${safeLogValue(sessionId)} error=${safeLogValue(
+          errorMessage(mutationError)
+        )}`
+      );
+    }
+    return { mutationApplied, error: releaseError, maintenanceError };
+  }
+  if (mutationError !== void 0) {
+    return { mutationApplied, error: mutationError, maintenanceError };
+  }
+  return { value, mutationApplied, maintenanceError };
+}
+__name(runWithDaemonWriterLease, "runWithDaemonWriterLease");
+function logMaintenanceLeaseReleaseFailure(params) {
+  const errorKind = typeof params.error === "object" && params.error !== null && typeof params.error.errorKind === "string" ? params.error.errorKind : "unknown";
+  logSessionArchiveWarning(
+    `session maintenance lease release failed action=${params.action} workspace=${safeLogValue(
+      params.workspace
+    )} session=${safeLogValue(params.sessionId)} errorKind=${safeLogValue(
+      errorKind
+    )} mutationApplied=${params.mutationApplied}`
+  );
+}
+__name(logMaintenanceLeaseReleaseFailure, "logMaintenanceLeaseReleaseFailure");
+async function classifySessionLocation(service, sessionId) {
+  return service.getSessionLocation(sessionId);
+}
+__name(classifySessionLocation, "classifySessionLocation");
+function sessionLocationError(sessionId) {
+  return new Error(`Session archive conflict: ${sessionId}`);
+}
+__name(sessionLocationError, "sessionLocationError");
+function updateScheduledTaskForMaintenance(service, sessionId, action) {
+  if (action === "archive") {
+    return disableTasksForSessions(service.getProjectRoot(), [sessionId]);
+  }
+  if (action === "unarchive") {
+    return enableTasksForSessions(service.getProjectRoot(), [sessionId]);
+  }
+  return removeTasksForSessions(service.getProjectRoot(), [sessionId]);
+}
+__name(updateScheduledTaskForMaintenance, "updateScheduledTaskForMaintenance");
+async function deletePersistedSessionWithLease(service, sessionId) {
+  const initialLocation = await classifySessionLocation(service, sessionId);
+  if (initialLocation === void 0) {
+    return { kind: "notFound", mutationApplied: false };
+  }
+  if (initialLocation === "conflict") {
+    return {
+      kind: "error",
+      error: sessionLocationError(sessionId),
+      mutationApplied: false
+    };
+  }
+  const mutation = await runWithDaemonWriterLease({
+    action: "delete",
+    sessionId,
+    service,
+    mutate: /* @__PURE__ */ __name(async (assertOwnedAndUnchanged) => {
+      const lockedLocation = await classifySessionLocation(service, sessionId);
+      if (lockedLocation === void 0) {
+        return {
+          value: "notFound",
+          mutationApplied: false
+        };
+      }
+      if (lockedLocation === "conflict") {
+        throw sessionLocationError(sessionId);
+      }
+      await assertOwnedAndUnchanged();
+      const removed = await service.removeSession(sessionId);
+      return {
+        value: removed ? "removed" : "notFound",
+        mutationApplied: removed
+      };
+    }, "mutate"),
+    mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === void 0, "mutationAppliedAfterError"),
+    afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(service, sessionId, "delete"), "afterMutationApplied")
+  });
+  if (mutation.error !== void 0) {
+    return {
+      kind: "error",
+      error: mutation.error,
+      mutationApplied: mutation.mutationApplied
+    };
+  }
+  return {
+    kind: mutation.value ?? "notFound",
+    mutationApplied: mutation.mutationApplied
+  };
+}
+__name(deletePersistedSessionWithLease, "deletePersistedSessionWithLease");
 async function deleteDaemonSessions(params) {
   const { sessionIds, service, bridge, coordinator, onError } = params;
   const uniqueSessionIds = [...new Set(sessionIds)];
-  const closeErrors = [];
-  const removed = [];
-  const notFound = [];
-  const removeErrors = [];
   for (const sessionId of uniqueSessionIds) {
     coordinator.assertNotTransitioning(sessionId);
   }
-  await Promise.all(
+  const results = await Promise.all(
     uniqueSessionIds.map(async (sessionId) => {
       try {
-        await coordinator.runExclusiveMany([sessionId], async () => {
-          let shouldRemove = false;
+        return await coordinator.runExclusiveMany([sessionId], async () => {
           try {
             await bridge.closeSession(sessionId);
-            shouldRemove = true;
-          } catch (closeErr) {
-            if (closeErr instanceof SessionNotFoundError || closeErr instanceof Error && closeErr.name === "SessionNotFoundError") {
-              shouldRemove = true;
-            } else {
-              const message = closeErr instanceof Error ? closeErr.message : String(closeErr);
-              onError?.({ phase: "close", sessionId, error: message });
-              closeErrors.push({ sessionId, error: message });
+          } catch (error2) {
+            if (isSessionNotFoundError(error2)) {
+              const result2 = await deletePersistedSessionWithLease(
+                service,
+                sessionId
+              );
+              if (result2.kind === "error") {
+                onError?.({
+                  phase: "remove",
+                  sessionId,
+                  error: errorMessage(result2.error)
+                });
+              }
+              return result2;
             }
+            onError?.({
+              phase: "close",
+              sessionId,
+              error: errorMessage(error2)
+            });
+            return {
+              kind: "error",
+              error: error2,
+              mutationApplied: false
+            };
           }
-          if (!shouldRemove) return;
-          try {
-            if (await service.removeSession(sessionId)) {
-              removed.push(sessionId);
-            } else {
-              notFound.push(sessionId);
-            }
-          } catch (removeErr) {
-            const message = removeErr instanceof Error ? removeErr.message : String(removeErr);
-            onError?.({ phase: "remove", sessionId, error: message });
-            removeErrors.push({ sessionId, error: message });
+          const result = await deletePersistedSessionWithLease(
+            service,
+            sessionId
+          );
+          if (result.kind === "error") {
+            onError?.({
+              phase: "remove",
+              sessionId,
+              error: errorMessage(result.error)
+            });
           }
+          return result;
         });
-      } catch (err) {
-        if (err instanceof SessionArchivingError && err.lockKind === "exclusive") {
-          throw err;
+      } catch (error2) {
+        if (error2 instanceof DaemonDrainingError) {
+          throw error2;
         }
-        const message = err instanceof Error ? err.message : String(err);
-        onError?.({ phase: "delete", sessionId, error: message });
-        closeErrors.push({ sessionId, error: message });
+        onError?.({
+          phase: "delete",
+          sessionId,
+          error: errorMessage(error2)
+        });
+        return {
+          kind: "error",
+          error: error2,
+          mutationApplied: false
+        };
       }
     })
   );
-  await removeTasksForSessions(service.getProjectRoot(), removed).catch(
-    (err) => {
-      logSessionArchiveWarning(
-        `removeTasksForSessions failed for [${removed.join(", ")}]: ${err instanceof Error ? err.message : String(err)}`
-      );
+  const removed = [];
+  const notFound = [];
+  const errors = [];
+  for (let i = 0; i < results.length; i++) {
+    const sessionId = uniqueSessionIds[i];
+    const result = results[i];
+    if (result.kind === "removed") {
+      removed.push(sessionId);
+    } else if (result.kind === "notFound") {
+      notFound.push(sessionId);
+    } else {
+      errors.push({ sessionId, error: errorMessage(result.error) });
     }
-  );
-  return { removed, notFound, errors: [...closeErrors, ...removeErrors] };
+  }
+  return { removed, notFound, errors };
 }
 __name(deleteDaemonSessions, "deleteDaemonSessions");
-async function assertSessionLoadable(workspaceCwd, sessionId) {
-  const location = await new SessionService(workspaceCwd).getSessionLocation(
-    sessionId
-  );
+async function deleteDaemonSessionIfOrphan(params) {
+  const { sessionId, service, bridge, coordinator } = params;
+  coordinator.assertNotTransitioning(sessionId);
+  const result = await coordinator.runExclusiveMany([sessionId], async () => {
+    let killed = false;
+    try {
+      killed = await bridge.killSession(sessionId, {
+        requireZeroAttaches: true
+      });
+    } catch (error2) {
+      if (!isSessionNotFoundError(error2)) throw error2;
+      killed = true;
+    }
+    if (!killed) {
+      return void 0;
+    }
+    return deletePersistedSessionWithLease(service, sessionId);
+  });
+  if (result === void 0) {
+    return false;
+  }
+  if (result.kind === "error") {
+    throw result.error;
+  }
+  return true;
+}
+__name(deleteDaemonSessionIfOrphan, "deleteDaemonSessionIfOrphan");
+async function assertSessionLoadable(workspaceCwd, sessionId, runtimeBaseDir) {
+  const location = await new SessionService(workspaceCwd, {
+    runtimeBaseDir
+  }).getSessionLocation(sessionId);
   if (location === "archived") {
     throw new SessionArchivedError(sessionId);
   }
@@ -6976,10 +7570,10 @@ async function assertSessionLoadable(workspaceCwd, sessionId) {
   return location;
 }
 __name(assertSessionLoadable, "assertSessionLoadable");
-async function assertSessionArchived(workspaceCwd, sessionId) {
-  const location = await new SessionService(workspaceCwd).getSessionLocation(
-    sessionId
-  );
+async function assertSessionArchived(workspaceCwd, sessionId, runtimeBaseDir) {
+  const location = await new SessionService(workspaceCwd, {
+    runtimeBaseDir
+  }).getSessionLocation(sessionId);
   if (location === "active") {
     throw new SessionNotArchivedError(sessionId);
   }
@@ -6995,43 +7589,6 @@ function isSessionNotFoundError(err) {
   return err instanceof SessionNotFoundError || err instanceof Error && err.name === "SessionNotFoundError";
 }
 __name(isSessionNotFoundError, "isSessionNotFoundError");
-async function classifySessionLocations(service, sessionIds) {
-  const result = {
-    active: [],
-    archived: [],
-    notFound: [],
-    errors: []
-  };
-  const locationResults = await Promise.allSettled(
-    sessionIds.map(async (sessionId) => ({
-      sessionId,
-      location: await service.getSessionLocation(sessionId)
-    }))
-  );
-  for (let i = 0; i < locationResults.length; i++) {
-    const sessionId = sessionIds[i];
-    const locationResult = locationResults[i];
-    if (locationResult.status === "rejected") {
-      result.errors.push({ sessionId, error: locationResult.reason });
-      continue;
-    }
-    const location = locationResult.value.location;
-    if (location === void 0) {
-      result.notFound.push(sessionId);
-    } else if (location === "archived") {
-      result.archived.push(sessionId);
-    } else if (location === "conflict") {
-      result.errors.push({
-        sessionId,
-        error: new Error(`Session archive conflict: ${sessionId}`)
-      });
-    } else {
-      result.active.push(sessionId);
-    }
-  }
-  return result;
-}
-__name(classifySessionLocations, "classifySessionLocations");
 function logSessionArchiveResult(action, result) {
   const changedLabel = action === "archive" ? "archived" : "unarchived";
   const alreadyLabel = action === "archive" ? "alreadyArchived" : "alreadyActive";
@@ -7071,59 +7628,126 @@ __name(sanitizeLogLine, "sanitizeLogLine");
 async function archiveDaemonSessions(params) {
   const { sessionIds, service, bridge, coordinator } = params;
   const uniqueSessionIds = [...new Set(sessionIds)];
-  const archived = [];
-  const alreadyArchived = [];
-  const notFound = [];
-  const errors = [];
-  const initial = await classifySessionLocations(service, uniqueSessionIds);
-  const activeIds = initial.active;
-  alreadyArchived.push(...initial.archived);
-  notFound.push(...initial.notFound);
-  errors.push(...initial.errors);
-  if (activeIds.length > 0) {
-    await coordinator.runExclusiveMany(activeIds, async () => {
-      const locked = await classifySessionLocations(service, activeIds);
-      const closableIds = locked.active;
-      alreadyArchived.push(...locked.archived);
-      notFound.push(...locked.notFound);
-      errors.push(...locked.errors);
-      const closeResults = await Promise.allSettled(
-        closableIds.map(async (sessionId) => {
+  for (const sessionId of uniqueSessionIds) {
+    coordinator.assertNotTransitioning(sessionId);
+  }
+  const results = await Promise.all(
+    uniqueSessionIds.map(async (sessionId) => {
+      try {
+        return await coordinator.runExclusiveMany([sessionId], async () => {
           try {
             await bridge.closeSession(sessionId, void 0, {
               requireAgentClose: true
             });
-          } catch (err) {
-            if (!isSessionNotFoundError(err)) {
-              throw err;
+          } catch (error2) {
+            if (!isSessionNotFoundError(error2)) {
+              return {
+                kind: "error",
+                error: error2,
+                mutationApplied: false
+              };
             }
           }
-        })
-      );
-      const archiveIds = [];
-      for (let i = 0; i < closeResults.length; i++) {
-        const sessionId = closableIds[i];
-        const result = closeResults[i];
-        if (result.status === "fulfilled") {
-          archiveIds.push(sessionId);
-        } else {
-          errors.push({ sessionId, error: result.reason });
-        }
-      }
-      try {
-        const archiveResult = await service.archiveSessions(archiveIds, {
-          knownLocation: "active"
+          const initialLocation = await classifySessionLocation(
+            service,
+            sessionId
+          );
+          if (initialLocation === void 0) {
+            return { kind: "notFound", mutationApplied: false };
+          }
+          if (initialLocation === "archived") {
+            return {
+              kind: "alreadyArchived",
+              mutationApplied: false
+            };
+          }
+          if (initialLocation === "conflict") {
+            return {
+              kind: "error",
+              error: sessionLocationError(sessionId),
+              mutationApplied: false
+            };
+          }
+          const mutation = await runWithDaemonWriterLease({
+            action: "archive",
+            sessionId,
+            service,
+            mutate: /* @__PURE__ */ __name(async (assertOwnedAndUnchanged) => {
+              const lockedLocation = await classifySessionLocation(
+                service,
+                sessionId
+              );
+              if (lockedLocation === void 0) {
+                return {
+                  value: "notFound",
+                  mutationApplied: false
+                };
+              }
+              if (lockedLocation === "archived") {
+                return {
+                  value: "alreadyArchived",
+                  mutationApplied: false
+                };
+              }
+              if (lockedLocation === "conflict") {
+                throw sessionLocationError(sessionId);
+              }
+              await assertOwnedAndUnchanged();
+              const result = await service.archiveSessions([sessionId], {
+                knownLocation: "active"
+              });
+              if (result.errors[0]) throw result.errors[0].error;
+              if (result.archived.length > 0) {
+                return {
+                  value: "archived",
+                  mutationApplied: true
+                };
+              }
+              return {
+                value: result.alreadyArchived.length > 0 ? "alreadyArchived" : "notFound",
+                mutationApplied: false
+              };
+            }, "mutate"),
+            mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === "archived", "mutationAppliedAfterError"),
+            afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(service, sessionId, "archive"), "afterMutationApplied")
+          });
+          if (mutation.error !== void 0) {
+            return {
+              kind: "error",
+              error: mutation.error,
+              mutationApplied: mutation.mutationApplied
+            };
+          }
+          return {
+            kind: mutation.value ?? "notFound",
+            mutationApplied: mutation.mutationApplied
+          };
         });
-        archived.push(...archiveResult.archived);
-        alreadyArchived.push(...archiveResult.alreadyArchived);
-        notFound.push(...archiveResult.notFound);
-        errors.push(...archiveResult.errors);
-      } catch (err) {
-        for (const sessionId of archiveIds) {
-          errors.push({ sessionId, error: err });
+      } catch (error2) {
+        if (error2 instanceof DaemonDrainingError) {
+          throw error2;
         }
+        return {
+          kind: "error",
+          error: error2,
+          mutationApplied: false,
+          maintenanceError: void 0
+        };
       }
-    });
+    })
+  );
+  const archived = [];
+  const alreadyArchived = [];
+  const notFound = [];
+  const errors = [];
+  for (let i = 0; i < results.length; i++) {
+    const sessionId = uniqueSessionIds[i];
+    const result = results[i];
+    if (result.kind === "archived") archived.push(sessionId);
+    else if (result.kind === "alreadyArchived") {
+      alreadyArchived.push(sessionId);
+    } else if (result.kind === "notFound") notFound.push(sessionId);
+    else errors.push({ sessionId, error: result.error });
   }
   logSessionArchiveResult("archive", {
     requested: uniqueSessionIds,
@@ -7132,51 +7756,144 @@ async function archiveDaemonSessions(params) {
     notFound,
     errors
   });
-  await disableTasksForSessions(service.getProjectRoot(), archived).catch(
-    (err) => {
-      logSessionArchiveWarning(
-        `disableTasksForSessions failed for [${archived.join(", ")}]: ${err instanceof Error ? err.message : String(err)} \u2014 bound tasks may keep firing until reconciled`
-      );
-    }
-  );
   return { archived, alreadyArchived, notFound, errors };
 }
 __name(archiveDaemonSessions, "archiveDaemonSessions");
 async function unarchiveDaemonSessions(params) {
   const { sessionIds, service, coordinator } = params;
   const uniqueSessionIds = [...new Set(sessionIds)];
-  const unarchived = [];
-  const alreadyActive = [];
-  const notFound = [];
-  const errors = [];
-  const initial = await classifySessionLocations(service, uniqueSessionIds);
-  const archivedIds = initial.archived;
-  alreadyActive.push(...initial.active);
-  notFound.push(...initial.notFound);
-  errors.push(...initial.errors);
-  if (archivedIds.length > 0) {
-    await coordinator.runExclusiveMany(archivedIds, async () => {
-      const locked = await classifySessionLocations(service, archivedIds);
-      const unarchiveIds = locked.archived;
-      alreadyActive.push(...locked.active);
-      notFound.push(...locked.notFound);
-      errors.push(...locked.errors);
-      if (unarchiveIds.length > 0) {
-        try {
-          const result = await service.unarchiveSessions(unarchiveIds, {
-            knownLocation: "archived"
+  for (const sessionId of uniqueSessionIds) {
+    coordinator.assertNotTransitioning(sessionId);
+  }
+  const results = await Promise.all(
+    uniqueSessionIds.map(async (sessionId) => {
+      try {
+        return await coordinator.runExclusiveMany([sessionId], async () => {
+          const initialLocation = await classifySessionLocation(
+            service,
+            sessionId
+          );
+          if (initialLocation === void 0) {
+            return { kind: "notFound", mutationApplied: false };
+          }
+          if (initialLocation === "active") {
+            let maintenanceError;
+            try {
+              await updateScheduledTaskForMaintenance(
+                service,
+                sessionId,
+                "unarchive"
+              );
+            } catch (error2) {
+              maintenanceError = error2;
+              logSessionArchiveWarning(
+                `scheduled task lifecycle update failed action=unarchive workspace=${safeLogValue(
+                  service.getProjectRoot()
+                )} session=${safeLogValue(sessionId)} error=${safeLogValue(
+                  errorMessage(error2)
+                )}`
+              );
+            }
+            return {
+              kind: "alreadyActive",
+              mutationApplied: false,
+              maintenanceError
+            };
+          }
+          if (initialLocation === "conflict") {
+            return {
+              kind: "error",
+              error: sessionLocationError(sessionId),
+              mutationApplied: false
+            };
+          }
+          const mutation = await runWithDaemonWriterLease({
+            action: "unarchive",
+            sessionId,
+            service,
+            mutate: /* @__PURE__ */ __name(async (assertOwnedAndUnchanged) => {
+              const lockedLocation = await classifySessionLocation(
+                service,
+                sessionId
+              );
+              if (lockedLocation === void 0) {
+                return {
+                  value: "notFound",
+                  mutationApplied: false
+                };
+              }
+              if (lockedLocation === "active") {
+                return {
+                  value: "alreadyActive",
+                  mutationApplied: false
+                };
+              }
+              if (lockedLocation === "conflict") {
+                throw sessionLocationError(sessionId);
+              }
+              await assertOwnedAndUnchanged();
+              const result = await service.unarchiveSessions([sessionId], {
+                knownLocation: "archived"
+              });
+              if (result.errors[0]) throw result.errors[0].error;
+              if (result.unarchived.length > 0) {
+                return {
+                  value: "unarchived",
+                  mutationApplied: true
+                };
+              }
+              return {
+                value: result.alreadyActive.length > 0 ? "alreadyActive" : "notFound",
+                mutationApplied: false
+              };
+            }, "mutate"),
+            mutationAppliedAfterError: /* @__PURE__ */ __name(async () => await classifySessionLocation(service, sessionId) === "active", "mutationAppliedAfterError"),
+            afterMutationApplied: /* @__PURE__ */ __name(() => updateScheduledTaskForMaintenance(
+              service,
+              sessionId,
+              "unarchive"
+            ), "afterMutationApplied")
           });
-          unarchived.push(...result.unarchived);
-          alreadyActive.push(...result.alreadyActive);
-          notFound.push(...result.notFound);
-          errors.push(...result.errors);
-        } catch (err) {
-          for (const sessionId of unarchiveIds) {
-            errors.push({ sessionId, error: err });
+          if (mutation.error !== void 0) {
+            return {
+              kind: "error",
+              error: mutation.error,
+              mutationApplied: mutation.mutationApplied
+            };
           }
+          return {
+            kind: mutation.value ?? "notFound",
+            mutationApplied: mutation.mutationApplied,
+            maintenanceError: mutation.maintenanceError
+          };
+        });
+      } catch (error2) {
+        if (error2 instanceof DaemonDrainingError) {
+          throw error2;
         }
+        return {
+          kind: "error",
+          error: error2,
+          mutationApplied: false,
+          maintenanceError: void 0
+        };
       }
-    });
+    })
+  );
+  const unarchived = [];
+  const alreadyActive = [];
+  const notFound = [];
+  const errors = [];
+  for (let i = 0; i < results.length; i++) {
+    const sessionId = uniqueSessionIds[i];
+    const result = results[i];
+    if (result.kind === "unarchived") unarchived.push(sessionId);
+    else if (result.kind === "alreadyActive") alreadyActive.push(sessionId);
+    else if (result.kind === "notFound") notFound.push(sessionId);
+    else errors.push({ sessionId, error: result.error });
+    if (result.maintenanceError !== void 0) {
+      errors.push({ sessionId, error: result.maintenanceError });
+    }
   }
   logSessionArchiveResult("unarchive", {
     requested: uniqueSessionIds,
@@ -7185,17 +7902,6 @@ async function unarchiveDaemonSessions(params) {
     notFound,
     errors
   });
-  const resumeSessionIds = [.../* @__PURE__ */ new Set([...unarchived, ...alreadyActive])];
-  try {
-    await enableTasksForSessions(service.getProjectRoot(), resumeSessionIds);
-  } catch (err) {
-    logSessionArchiveWarning(
-      `enableTasksForSessions failed for [${resumeSessionIds.join(", ")}]: ${err instanceof Error ? err.message : String(err)}`
-    );
-    for (const sessionId of resumeSessionIds) {
-      errors.push({ sessionId, error: err });
-    }
-  }
   return { unarchived, alreadyActive, notFound, errors };
 }
 __name(unarchiveDaemonSessions, "unarchiveDaemonSessions");
@@ -7596,6 +8302,13 @@ function pickSessionArtifactInput(params) {
 }
 __name(pickSessionArtifactInput, "pickSessionArtifactInput");
 function toRpcError(err) {
+  if (err instanceof DaemonDrainingError) {
+    return {
+      code: RPC.INTERNAL_ERROR,
+      message: err.message,
+      data: { errorKind: "daemon_draining" }
+    };
+  }
   const writerError = sessionWriterRpcError(err);
   if (writerError) return writerError;
   if (err instanceof AcpParamError || err instanceof InvalidCursorError) {
@@ -7804,7 +8517,7 @@ function rpcErrorFrame(id, err) {
 __name(rpcErrorFrame, "rpcErrorFrame");
 var ACP_PROTOCOL_VERSION = 1;
 var AcpDispatcher = class {
-  constructor(bridge, boundWorkspace, getEnv, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator(), isWorkspaceTrusted = () => true, captureGenerationAssertion = () => void 0) {
+  constructor(bridge, boundWorkspace, getEnv, workspace, workspaceRememberLane, fsFactory, deviceFlowRegistry, sessionShellCommandEnabled = false, registry, archiveCoordinator = new SessionArchiveCoordinator(), isWorkspaceTrusted = () => true, captureGenerationAssertion = () => void 0, sessionRuntimeBaseDir = Storage.getRuntimeBaseDir()) {
     this.bridge = bridge;
     this.boundWorkspace = boundWorkspace;
     this.getEnv = getEnv;
@@ -7817,6 +8530,7 @@ var AcpDispatcher = class {
     this.archiveCoordinator = archiveCoordinator;
     this.isWorkspaceTrusted = isWorkspaceTrusted;
     this.captureGenerationAssertion = captureGenerationAssertion;
+    this.sessionRuntimeBaseDir = sessionRuntimeBaseDir;
     this.agentManager = createDaemonSubagentManager(boundWorkspace);
   }
   static {
@@ -7824,13 +8538,15 @@ var AcpDispatcher = class {
   }
   agentManager;
   killOrphanSession(sessionId, removePersistedSession = false) {
-    void this.bridge.killSession(sessionId, { requireZeroAttaches: true }).then(async (killed) => {
-      if (killed && removePersistedSession) {
-        await new SessionService(this.boundWorkspace).removeSession(
-          sessionId
-        );
-      }
-    }).catch(
+    const cleanup = removePersistedSession ? deleteDaemonSessionIfOrphan({
+      sessionId,
+      service: new SessionService(this.boundWorkspace, {
+        runtimeBaseDir: this.sessionRuntimeBaseDir
+      }),
+      bridge: this.bridge,
+      coordinator: this.archiveCoordinator
+    }) : this.bridge.killSession(sessionId, { requireZeroAttaches: true });
+    void cleanup.catch(
       (err) => writeStderrLine(
         `qwen serve: /acp orphan killSession(${logSafe(sessionId)}) failed: ${logSafe(errMsg(err))}`
       )
@@ -8080,6 +8796,12 @@ var AcpDispatcher = class {
    * (it mints the connection) and never reaches here.
    */
   async handle(conn, msg, sessionHeader, reqLoopback) {
+    return Storage.runWithResolvedRuntimeBaseDir(
+      this.sessionRuntimeBaseDir,
+      () => this.handleInRuntime(conn, msg, sessionHeader, reqLoopback)
+    );
+  }
+  async handleInRuntime(conn, msg, sessionHeader, reqLoopback) {
     const loopback = reqLoopback ?? conn.fromLoopback;
     if (isResponse(msg)) {
       try {
@@ -9926,8 +10648,26 @@ var AcpDispatcher = class {
               );
             return;
           }
+          const rawCursor = params["cursor"];
+          if (rawCursor !== void 0 && (typeof rawCursor !== "string" || rawCursor.length === 0 || rawCursor.length > MAX_TEXT_CURSOR_CHARS)) {
+            if (id !== void 0)
+              conn.sendConn(
+                error(
+                  id,
+                  RPC.INVALID_PARAMS,
+                  `\`cursor\` must be a non-empty string of at most ${MAX_TEXT_CURSOR_CHARS} characters`
+                )
+              );
+            return;
+          }
+          const cursor = rawCursor;
           const resolved = await fs6.resolve(p, "read");
-          const out = await fs6.readText(resolved, { maxBytes, line, limit });
+          const out = await fs6.readText(resolved, {
+            maxBytes,
+            line,
+            limit,
+            cursor
+          });
           this.replyConn(conn, id, {
             path: p,
             content: out.content,
@@ -13061,7 +13801,8 @@ function mountAcpHttp(app, bridge, opts) {
     () => {
       const guard = opts.workspaceRegistry?.primaryEntry.current?.guard;
       return guard ? () => guard.assertOpen() : void 0;
-    }
+    },
+    opts.workspaceRegistry?.primary.sessionRuntimeBaseDir ?? Storage.getRuntimeBaseDir()
   );
   dispatcherRef.current = dispatcher;
   const primaryMount = {
@@ -13368,7 +14109,8 @@ function mountAcpHttp(app, bridge, opts) {
       () => {
         const guard = rt.generationGuard;
         return guard ? () => guard.assertOpen() : void 0;
-      }
+      },
+      rt.sessionRuntimeBaseDir
     );
     secondaryDispatcherRef.current = secondaryDispatcher;
     return {
@@ -16646,13 +17388,17 @@ function createExtensionsController(deps) {
                 const startedAt = Date.now();
                 try {
                   runtime.workspaceService.invalidateWorkspaceSkillsStatus();
-                  return {
-                    status: "fulfilled",
-                    result: await runtime.bridge.refreshExtensionsForAllSessions(
-                      bridgeMutationEvent(event)
-                    ),
-                    elapsedMs: Date.now() - startedAt
-                  };
+                  try {
+                    return {
+                      status: "fulfilled",
+                      result: await runtime.bridge.refreshExtensionsForAllSessions(
+                        bridgeMutationEvent(event)
+                      ),
+                      elapsedMs: Date.now() - startedAt
+                    };
+                  } finally {
+                    runtime.workspaceService.invalidateWorkspaceSkillsStatus();
+                  }
                 } catch (reason) {
                   return {
                     status: "rejected",
@@ -16727,10 +17473,14 @@ function createExtensionsController(deps) {
             const { result, elapsedMs } = await runReconciliation(async () => {
               workspace.invalidateWorkspaceSkillsStatus();
               const startedAt = Date.now();
-              const result2 = await bridge.refreshExtensionsForAllSessions(
-                bridgeMutationEvent(event)
-              );
-              return { result: result2, elapsedMs: Date.now() - startedAt };
+              try {
+                const result2 = await bridge.refreshExtensionsForAllSessions(
+                  bridgeMutationEvent(event)
+                );
+                return { result: result2, elapsedMs: Date.now() - startedAt };
+              } finally {
+                workspace.invalidateWorkspaceSkillsStatus();
+              }
             });
             const warnings = [...commitWarnings];
             if (result.failed > 0) {
@@ -17249,11 +17999,15 @@ function registerWorkspaceExtensionRoutes(app, deps) {
           async () => await Promise.allSettled(
             runtimes.map(async (runtime) => {
               runtime.workspaceService.invalidateWorkspaceSkillsStatus();
-              const result = await runtime.bridge.refreshExtensionsForAllSessions();
-              if (result.failed > 0) {
-                throw new Error(
-                  `${result.failed} extension session refresh(es) failed`
-                );
+              try {
+                const result = await runtime.bridge.refreshExtensionsForAllSessions();
+                if (result.failed > 0) {
+                  throw new Error(
+                    `${result.failed} extension session refresh(es) failed`
+                  );
+                }
+              } finally {
+                runtime.workspaceService.invalidateWorkspaceSkillsStatus();
               }
             })
           )
@@ -19071,6 +19825,12 @@ var legacySessionTelemetryRoutes = [
     attribution: "handler_resolved",
     route: "POST /session/:id/fork"
   },
+  {
+    method: "POST",
+    path: "/session/:id/side-task",
+    attribution: "handler_resolved",
+    route: "POST /session/:id/side-task"
+  },
   {
     method: "POST",
     path: "/session/:id/cd",
@@ -21045,10 +21805,8 @@ var VirtualSubagentSessions = class {
         totalTokens: task.stats?.totalTokens
       };
     }
-    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
-    const projectDir = Storage.runWithRuntimeBaseDir(
-      runtimeDir,
-      runtime.workspaceCwd,
+    const projectDir = Storage.runWithResolvedRuntimeBaseDir(
+      runtime.sessionRuntimeBaseDir,
       () => new Storage(runtime.workspaceCwd).getProjectDir()
     );
     const sessionDir = getSubagentSessionDir(projectDir, parentSessionId);
@@ -21083,10 +21841,8 @@ var VirtualSubagentSessions = class {
     return void 0;
   }
   async findLegacyTaskByToolCall(runtime, parentSessionId, toolCallId) {
-    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
-    const projectDir = Storage.runWithRuntimeBaseDir(
-      runtimeDir,
-      runtime.workspaceCwd,
+    const projectDir = Storage.runWithResolvedRuntimeBaseDir(
+      runtime.sessionRuntimeBaseDir,
       () => new Storage(runtime.workspaceCwd).getProjectDir()
     );
     const parentRecords = await read(
@@ -21159,10 +21915,8 @@ var VirtualSubagentSessions = class {
     };
   }
   async readParentToolCallMetrics(runtime, parentSessionId, toolCallId) {
-    const runtimeDir = runtime.env.effectiveEnv?.["QWEN_RUNTIME_DIR"];
-    const projectDir = Storage.runWithRuntimeBaseDir(
-      runtimeDir,
-      runtime.workspaceCwd,
+    const projectDir = Storage.runWithResolvedRuntimeBaseDir(
+      runtime.sessionRuntimeBaseDir,
       () => new Storage(runtime.workspaceCwd).getProjectDir()
     );
     const records = await read(
@@ -21174,7 +21928,11 @@ var VirtualSubagentSessions = class {
     let task = await this.findTask(
       runtime,
       parentSessionId,
-      (candidate) => candidate.toolUseId === toolCallId || candidate.id.endsWith(`-${toolCallId}`)
+      (candidate) => (
+        // /fork has no parent transcript tool call, so its task ID is the
+        // stable reference used by Web Shell.
+        candidate.id === toolCallId || candidate.toolUseId === toolCallId || candidate.id.endsWith(`-${toolCallId}`)
+      )
     );
     const metrics = task && task.status !== "running" ? await this.readParentToolCallMetrics(
       runtime,
@@ -21234,6 +21992,23 @@ var VirtualSubagentSessions = class {
   }
 };
 
+// packages/cli/src/serve/workspace-runtime-storage.ts
+init_esbuild_shims();
+function runWithWorkspaceRuntimeStorage(runtime, fn) {
+  return Storage.runWithResolvedRuntimeBaseDir(
+    runtime.sessionRuntimeBaseDir,
+    fn
+  );
+}
+__name(runWithWorkspaceRuntimeStorage, "runWithWorkspaceRuntimeStorage");
+function createWorkspaceRuntimeSessionService(runtime, options = {}) {
+  return new SessionService(runtime.workspaceCwd, {
+    ...options,
+    runtimeBaseDir: runtime.sessionRuntimeBaseDir
+  });
+}
+__name(createWorkspaceRuntimeSessionService, "createWorkspaceRuntimeSessionService");
+
 // packages/cli/src/serve/routes/session.ts
 var GIT_RESERVED_BRANCH = "HEAD";
 var MAX_BRANCH_NAME_BYTES = 1e3;
@@ -21244,6 +22019,7 @@ var TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR = "Transcript pagination state exce
 var CHANNEL_DELIVERY_AUTHORIZATION_GRACE_MS = 6e4;
 var PRIMARY_ONLY_LIVE_SESSION_ROUTES = [
   "POST /session/:id/branch",
+  "POST /session/:id/side-task",
   "POST /session/:id/fork",
   "POST /session/:id/cd"
 ];
@@ -21258,7 +22034,8 @@ function isReadOnlyWorkspaceInspection(runtime) {
 }
 __name(isReadOnlyWorkspaceInspection, "isReadOnlyWorkspaceInspection");
 function runWorkspaceInspectionWithLogPolicy(runtime, read2) {
-  return isReadOnlyWorkspaceInspection(runtime) ? runWithoutDebugLogSession(read2) : read2();
+  const readInRuntime = /* @__PURE__ */ __name(() => runWithWorkspaceRuntimeStorage(runtime, read2), "readInRuntime");
+  return isReadOnlyWorkspaceInspection(runtime) ? runWithoutDebugLogSession(readInRuntime) : readInRuntime();
 }
 __name(runWorkspaceInspectionWithLogPolicy, "runWorkspaceInspectionWithLogPolicy");
 function requireSessionArtifactClientId(clientId, res) {
@@ -21595,9 +22372,30 @@ function registerSessionRoutes(app, deps) {
     }
     return runtime;
   }, "resolveRuntimeForCatalogRoute");
-  const hasActivePersistedSessions = /* @__PURE__ */ __name(async (workspaceCwd) => {
+  const resolveLegacyPrimaryRuntimeFromParam = /* @__PURE__ */ __name((req, res) => {
+    const entry = resolveWorkspaceEntryFromParam(
+      workspaceRegistry,
+      req,
+      res,
+      "id"
+    );
+    if (!entry) return null;
+    if (!entry.primary) {
+      sendWorkspaceMismatch2(res, entry.workspaceCwd);
+      return null;
+    }
+    const runtime = entry.state === "active" ? entry.current?.runtime : void 0;
+    if (!runtime) {
+      sendWorkspaceRuntimeUnavailable(res, entry);
+      return null;
+    }
+    return runtime;
+  }, "resolveLegacyPrimaryRuntimeFromParam");
+  const hasActivePersistedSessions = /* @__PURE__ */ __name(async (runtime) => {
     try {
-      const page = await new SessionService(workspaceCwd).listSessions({
+      const page = await createWorkspaceRuntimeSessionService(
+        runtime
+      ).listSessions({
         archiveState: "active",
         size: 1
       });
@@ -21647,20 +22445,28 @@ function registerSessionRoutes(app, deps) {
     try {
       const result = await archiveCoordinator.runSharedMany(
         [sessionId],
-        async () => {
+        () => runWithWorkspaceRuntimeStorage(target.runtime, async () => {
           if (target.archiveState === "archived") {
-            await assertSessionArchived(target.workspaceCwd, sessionId);
+            await assertSessionArchived(
+              target.runtime.workspaceCwd,
+              sessionId,
+              target.runtime.sessionRuntimeBaseDir
+            );
           } else {
-            await assertSessionLoadable(target.workspaceCwd, sessionId);
+            await assertSessionLoadable(
+              target.runtime.workspaceCwd,
+              sessionId,
+              target.runtime.sessionRuntimeBaseDir
+            );
           }
           return exportSessionTranscript({
-            workspaceCwd: target.workspaceCwd,
+            workspaceCwd: target.runtime.workspaceCwd,
             sessionId,
             format,
             archiveState: target.archiveState,
             config: { getChannel: /* @__PURE__ */ __name(() => "daemon", "getChannel") }
           });
-        }
+        })
       );
       const filename = result.filename.replace(/["\\\r\n]/g, "_");
       res.status(200).set("Cache-Control", "no-store").set("X-Content-Type-Options", "nosniff").set("Content-Type", result.mimeType).set("Content-Disposition", `attachment; filename="${filename}"`).send(result.content);
@@ -21676,7 +22482,7 @@ function registerSessionRoutes(app, deps) {
       sendBridgeError2(res, err, {
         route: target.route,
         sessionId,
-        ...target.workspaceQualified ? { workspaceCwd: target.workspaceCwd } : {}
+        ...target.workspaceQualified ? { workspaceCwd: target.runtime.workspaceCwd } : {}
       });
     }
   }, "handleSessionExport");
@@ -21861,7 +22667,8 @@ function registerSessionRoutes(app, deps) {
     const activeInRuntime = /* @__PURE__ */ __name(async (runtime) => {
       const location = await assertSessionLoadable(
         runtime.workspaceCwd,
-        sessionId
+        sessionId,
+        runtime.sessionRuntimeBaseDir
       );
       return location === "active";
     }, "activeInRuntime");
@@ -21964,19 +22771,6 @@ function registerSessionRoutes(app, deps) {
     sessionId: e.sessionId,
     error: e.error instanceof Error ? e.error.message : String(e.error)
   })), "serializeSessionErrors");
-  const resolveWorkspaceParam = /* @__PURE__ */ __name((req, res) => {
-    const workspaceCwd = req.params["id"] ?? "";
-    if (!path10.isAbsolute(workspaceCwd)) {
-      res.status(400).json({ error: "`:id` must decode to an absolute workspace path" });
-      return null;
-    }
-    const key = canonicalizeWorkspace(workspaceCwd);
-    if (key !== boundWorkspace) {
-      sendWorkspaceMismatch2(res, key);
-      return null;
-    }
-    return key;
-  }, "resolveWorkspaceParam");
   const withPrimaryOnlyMutableSession = /* @__PURE__ */ __name((route, handler) => {
     if (!isPrimaryOnlyLiveSessionRoute(route)) {
       throw new Error(`Unregistered primary-only session route: ${route}`);
@@ -22250,13 +23044,16 @@ function registerSessionRoutes(app, deps) {
       } catch (error2) {
         if (!session.attached) {
           try {
-            const killed = await runtime.bridge.killSession(session.sessionId, {
-              requireZeroAttaches: true
-            });
-            if (killed) {
-              await new SessionService(runtime.workspaceCwd).removeSession(
-                session.sessionId
-              );
+            const removed = await runWithWorkspaceRuntimeStorage(
+              runtime,
+              () => deleteDaemonSessionIfOrphan({
+                sessionId: session.sessionId,
+                service: createWorkspaceRuntimeSessionService(runtime),
+                bridge: runtime.bridge,
+                coordinator: archiveCoordinator
+              })
+            );
+            if (removed) {
               if (worktreeMeta) {
                 await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
                 });
@@ -22288,13 +23085,16 @@ function registerSessionRoutes(app, deps) {
         }
         if (!session.attached) {
           try {
-            const killed = await runtime.bridge.killSession(session.sessionId, {
-              requireZeroAttaches: true
-            });
-            if (killed) {
-              await new SessionService(runtime.workspaceCwd).removeSession(
-                session.sessionId
-              );
+            const removed = await runWithWorkspaceRuntimeStorage(
+              runtime,
+              () => deleteDaemonSessionIfOrphan({
+                sessionId: session.sessionId,
+                service: createWorkspaceRuntimeSessionService(runtime),
+                bridge: runtime.bridge,
+                coordinator: archiveCoordinator
+              })
+            );
+            if (removed) {
               if (worktreeMeta) {
                 await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
                 });
@@ -22353,9 +23153,9 @@ function registerSessionRoutes(app, deps) {
           ).catch(() => {
           });
           await writeWorktreeSession(
-            new SessionService(workspaceCwd).getWorktreeSessionPath(
-              session.sessionId
-            ),
+            createWorkspaceRuntimeSessionService(
+              runtime
+            ).getWorktreeSessionPath(session.sessionId),
             {
               slug: worktreeMeta.slug,
               worktreePath: worktreeMeta.path,
@@ -22373,11 +23173,15 @@ function registerSessionRoutes(app, deps) {
               error: cdErr instanceof Error ? cdErr.message : String(cdErr)
             });
           }
-          const killed = await runtime.bridge.killSession(session.sessionId, { requireZeroAttaches: true }).catch(() => false);
-          if (killed) {
-            await new SessionService(workspaceCwd).removeSession(session.sessionId).catch(() => {
-            });
-          }
+          await runWithWorkspaceRuntimeStorage(
+            runtime,
+            () => deleteDaemonSessionIfOrphan({
+              sessionId: session.sessionId,
+              service: createWorkspaceRuntimeSessionService(runtime),
+              bridge: runtime.bridge,
+              coordinator: archiveCoordinator
+            })
+          ).catch(() => false);
           await new GitWorktreeService(workspaceCwd).removeUserWorktree(worktreeMeta.slug, { deleteBranch: true }).catch(() => {
           });
           res.status(500).json({
@@ -22502,9 +23306,13 @@ function registerSessionRoutes(app, deps) {
       const session = await archiveCoordinator.runSharedMany(
         [sessionId],
         async () => {
-          await assertSessionLoadable(workspaceCwd, sessionId);
-          const metadata = await new SessionService(
-            workspaceCwd
+          await assertSessionLoadable(
+            workspaceCwd,
+            sessionId,
+            runtime.sessionRuntimeBaseDir
+          );
+          const metadata = await createWorkspaceRuntimeSessionService(
+            runtime
           ).readCreationMetadata(sessionId);
           runtime.generationGuard?.assertOpen();
           return action === "load" ? await runtime.bridge.loadSession({
@@ -22554,7 +23362,9 @@ function registerSessionRoutes(app, deps) {
       }
       if (!session.worktree) {
         const sidecar = await readWorktreeSession(
-          new SessionService(workspaceCwd).getWorktreeSessionPath(sessionId)
+          createWorkspaceRuntimeSessionService(
+            runtime
+          ).getWorktreeSessionPath(sessionId)
         ).catch(() => null);
         if (sidecar) {
           let realTarget;
@@ -22757,13 +23567,72 @@ function registerSessionRoutes(app, deps) {
           { name },
           { clientId }
         );
+        try {
+          runtime.generationGuard?.assertOpen();
+        } catch (error2) {
+          if (!result.attached) {
+            await runWithWorkspaceRuntimeStorage(
+              runtime,
+              () => deleteDaemonSessionIfOrphan({
+                sessionId: result.sessionId,
+                service: createWorkspaceRuntimeSessionService(runtime),
+                bridge: runtime.bridge,
+                coordinator: archiveCoordinator
+              })
+            ).catch(() => false);
+          } else {
+            await runtime.bridge.detachClient(result.sessionId, result.clientId).catch(() => {
+            });
+          }
+          throw error2;
+        }
+        if (!res.writable) {
+          if (!result.attached) {
+            void runWithWorkspaceRuntimeStorage(
+              runtime,
+              () => deleteDaemonSessionIfOrphan({
+                sessionId: result.sessionId,
+                service: createWorkspaceRuntimeSessionService(runtime),
+                bridge: runtime.bridge,
+                coordinator: archiveCoordinator
+              })
+            ).catch(() => {
+            });
+          } else {
+            runtime.bridge.detachClient(result.sessionId, result.clientId).catch(() => {
+            });
+          }
+          return;
+        }
+        res.status(201).json(result);
+      }
+    )
+  );
+  app.post(
+    "/session/:id/side-task",
+    mutate(),
+    withPrimaryOnlyMutableSession(
+      "POST /session/:id/side-task",
+      async (req, res, sessionId, runtime) => {
+        const body = safeBody(req);
+        let name = typeof body?.["name"] === "string" ? body["name"] : void 0;
+        if (name) {
+          name = Array.from(name.replace(/[\x00-\x1F\x7F-\x9F]/g, "")).slice(0, 200).join("");
+        }
+        const clientId = parseClientIdHeader(req, res);
+        if (clientId === null) return;
+        const result = await runtime.bridge.createSideTaskSession(
+          sessionId,
+          { name },
+          { clientId }
+        );
         try {
           runtime.generationGuard?.assertOpen();
         } catch (error2) {
           if (!result.attached) {
             const killed = await runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).catch(() => false);
             if (killed) {
-              await new SessionService(runtime.workspaceCwd).removeSession(result.sessionId).catch(() => {
+              await createWorkspaceRuntimeSessionService(runtime).removeSession(result.sessionId).catch(() => {
               });
             }
           } else {
@@ -22774,7 +23643,12 @@ function registerSessionRoutes(app, deps) {
         }
         if (!res.writable) {
           if (!result.attached) {
-            runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).catch(() => {
+            runtime.bridge.killSession(result.sessionId, { requireZeroAttaches: true }).then((killed) => {
+              if (!killed) return void 0;
+              return createWorkspaceRuntimeSessionService(
+                runtime
+              ).removeSession(result.sessionId);
+            }).catch(() => {
             });
           } else {
             runtime.bridge.detachClient(result.sessionId, result.clientId).catch(() => {
@@ -22870,7 +23744,7 @@ function registerSessionRoutes(app, deps) {
   app.get("/session/:id/export", async (req, res) => {
     await handleSessionExport(req, res, {
       route: "GET /session/:id/export",
-      workspaceCwd: boundWorkspace
+      runtime: workspaceRegistry.primary
     });
   });
   app.get("/workspaces/:workspace/session/:id/export", async (req, res) => {
@@ -22879,7 +23753,7 @@ function registerSessionRoutes(app, deps) {
     if (!runtime) return;
     await handleSessionExport(req, res, {
       route,
-      workspaceCwd: runtime.workspaceCwd,
+      runtime,
       workspaceQualified: true
     });
   });
@@ -22891,7 +23765,7 @@ function registerSessionRoutes(app, deps) {
       if (!runtime) return;
       await handleSessionExport(req, res, {
         route,
-        workspaceCwd: runtime.workspaceCwd,
+        runtime,
         workspaceQualified: true,
         archiveState: "archived"
       });
@@ -22988,67 +23862,74 @@ function registerSessionRoutes(app, deps) {
     }
     try {
       const result = await runWithoutDebugLogSession(
-        () => archiveCoordinator.runSharedMany([sessionId], async () => {
-          const service = new SessionService(runtime.workspaceCwd);
-          if (cursor === void 0) {
-            await assertSessionLoadable(runtime.workspaceCwd, sessionId);
-          }
-          const codec = getTranscriptCursorCodec(runtime);
-          const reader = new SessionTranscriptReader(
-            runtime.workspaceCwd,
-            codec
-          );
-          let page;
-          try {
-            page = await reader.readPage(sessionId, {
-              ...limit !== void 0 ? { limit } : {},
-              ...cursor !== void 0 ? { cursor } : {},
-              ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
-              maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
-            });
-          } catch (error2) {
-            if (error2.code !== "ENOENT") {
-              throw error2;
-            }
-            if (cursor !== void 0) {
-              throw new SessionTranscriptSnapshotUnavailableError(sessionId);
+        () => archiveCoordinator.runSharedMany(
+          [sessionId],
+          () => runWithWorkspaceRuntimeStorage(runtime, async () => {
+            const service = createWorkspaceRuntimeSessionService(runtime);
+            if (cursor === void 0) {
+              await assertSessionLoadable(
+                runtime.workspaceCwd,
+                sessionId,
+                runtime.sessionRuntimeBaseDir
+              );
             }
-            const location = await service.getSessionLocation(sessionId);
-            if (location === "archived") {
-              throw new SessionArchivedError(sessionId);
+            const codec = getTranscriptCursorCodec(runtime);
+            const reader = new SessionTranscriptReader(
+              runtime.workspaceCwd,
+              codec
+            );
+            let page;
+            try {
+              page = await reader.readPage(sessionId, {
+                ...limit !== void 0 ? { limit } : {},
+                ...cursor !== void 0 ? { cursor } : {},
+                ...beforeRecordId !== void 0 ? { beforeRecordId } : {},
+                maxBytes: SESSION_TRANSCRIPT_MAX_PAGE_BYTES
+              });
+            } catch (error2) {
+              if (error2.code !== "ENOENT") {
+                throw error2;
+              }
+              if (cursor !== void 0) {
+                throw new SessionTranscriptSnapshotUnavailableError(sessionId);
+              }
+              const location = await service.getSessionLocation(sessionId);
+              if (location === "archived") {
+                throw new SessionArchivedError(sessionId);
+              }
+              if (location === "conflict") {
+                throw new SessionConflictError(sessionId);
+              }
+              throw new SessionNotFoundError(sessionId);
             }
-            if (location === "conflict") {
-              throw new SessionConflictError(sessionId);
+            if (page.records.some((record) => record.sessionId !== sessionId)) {
+              throw new SessionTranscriptSnapshotUnavailableError(sessionId);
             }
-            throw new SessionNotFoundError(sessionId);
-          }
-          if (page.records.some((record) => record.sessionId !== sessionId)) {
-            throw new SessionTranscriptSnapshotUnavailableError(sessionId);
-          }
-          const replay = await replayTranscriptRecordPage({
-            sessionId,
-            page,
-            encodeCursor: /* @__PURE__ */ __name((state) => codec.encode(state), "encodeCursor")
-          });
-          const cursorTooLarge = replay.nextCursor !== void 0 && Buffer.byteLength(replay.nextCursor) > WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES;
-          return {
-            v: 1,
-            sessionId,
-            events: replay.updates.map((update) => ({
+            const replay = await replayTranscriptRecordPage({
+              sessionId,
+              page,
+              encodeCursor: /* @__PURE__ */ __name((state) => codec.encode(state), "encodeCursor")
+            });
+            const cursorTooLarge = replay.nextCursor !== void 0 && Buffer.byteLength(replay.nextCursor) > WORKSPACE_TRANSCRIPT_CURSOR_MAX_BYTES;
+            return {
               v: 1,
-              type: "session_update",
-              data: update
-            })),
-            ...replay.nextCursor && !cursorTooLarge ? { nextCursor: replay.nextCursor } : {},
-            hasMore: cursorTooLarge ? false : replay.hasMore,
-            startTime: replay.startTime,
-            lastUpdated: replay.lastUpdated,
-            ...replay.partial || cursorTooLarge ? {
-              partial: true,
-              replayError: cursorTooLarge ? TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR : replay.replayError
-            } : {}
-          };
-        })
+              sessionId,
+              events: replay.updates.map((update) => ({
+                v: 1,
+                type: "session_update",
+                data: update
+              })),
+              ...replay.nextCursor && !cursorTooLarge ? { nextCursor: replay.nextCursor } : {},
+              hasMore: cursorTooLarge ? false : replay.hasMore,
+              startTime: replay.startTime,
+              lastUpdated: replay.lastUpdated,
+              ...replay.partial || cursorTooLarge ? {
+                partial: true,
+                replayError: cursorTooLarge ? TRANSCRIPT_CURSOR_TOO_LARGE_REPLAY_ERROR : replay.replayError
+              } : {}
+            };
+          })
+        )
       );
       const serialized = serializeWorkspaceTranscriptResponse(
         result,
@@ -23701,18 +24582,22 @@ function registerSessionRoutes(app, deps) {
     const uniqueIds = parseSessionIdsBody(req, res);
     if (uniqueIds === void 0) return;
     try {
-      const service = new SessionService(boundWorkspace);
-      const result = await deleteDaemonSessions({
-        sessionIds: uniqueIds,
-        service,
-        bridge,
-        coordinator: archiveCoordinator,
-        onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
-          writeStderrLine(
-            `qwen serve: ${phase}Session failed for ${safeLogValue(sessionId)}: ${safeLogValue(error2)}`
-          );
-        }, "onError")
-      });
+      const runtime = workspaceRegistry.primary;
+      const service = createWorkspaceRuntimeSessionService(runtime);
+      const result = await runWithWorkspaceRuntimeStorage(
+        runtime,
+        () => deleteDaemonSessions({
+          sessionIds: uniqueIds,
+          service,
+          bridge,
+          coordinator: archiveCoordinator,
+          onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
+            writeStderrLine(
+              `qwen serve: ${phase}Session failed for ${safeLogValue(sessionId)}: ${safeLogValue(error2)}`
+            );
+          }, "onError")
+        })
+      );
       for (const removedId of result.removed) {
         clearBranchSessionEntry(removedId);
       }
@@ -23724,16 +24609,20 @@ function registerSessionRoutes(app, deps) {
   app.post("/sessions/archive", mutate(), async (req, res) => {
     const uniqueIds = parseSessionIdsBody(req, res);
     if (uniqueIds === void 0) return;
-    const service = new SessionService(boundWorkspace, {
+    const runtime = workspaceRegistry.primary;
+    const service = createWorkspaceRuntimeSessionService(runtime, {
       onWarning: logSessionArchiveWarning
     });
     try {
-      const result = await archiveDaemonSessions({
-        sessionIds: uniqueIds,
-        service,
-        bridge,
-        coordinator: archiveCoordinator
-      });
+      const result = await runWithWorkspaceRuntimeStorage(
+        runtime,
+        () => archiveDaemonSessions({
+          sessionIds: uniqueIds,
+          service,
+          bridge,
+          coordinator: archiveCoordinator
+        })
+      );
       res.status(200).json({
         archived: result.archived,
         alreadyArchived: result.alreadyArchived,
@@ -23747,15 +24636,19 @@ function registerSessionRoutes(app, deps) {
   app.post("/sessions/unarchive", mutate(), async (req, res) => {
     const uniqueIds = parseSessionIdsBody(req, res);
     if (uniqueIds === void 0) return;
-    const service = new SessionService(boundWorkspace, {
+    const runtime = workspaceRegistry.primary;
+    const service = createWorkspaceRuntimeSessionService(runtime, {
       onWarning: logSessionArchiveWarning
     });
     try {
-      const result = await unarchiveDaemonSessions({
-        sessionIds: uniqueIds,
-        service,
-        coordinator: archiveCoordinator
-      });
+      const result = await runWithWorkspaceRuntimeStorage(
+        runtime,
+        () => unarchiveDaemonSessions({
+          sessionIds: uniqueIds,
+          service,
+          coordinator: archiveCoordinator
+        })
+      );
       res.status(200).json({
         unarchived: result.unarchived,
         alreadyActive: result.alreadyActive,
@@ -23778,18 +24671,21 @@ function registerSessionRoutes(app, deps) {
       const uniqueIds = parseSessionIdsBody(req, res);
       if (uniqueIds === void 0) return;
       try {
-        const service = new SessionService(runtime.workspaceCwd);
-        const result = await deleteDaemonSessions({
-          sessionIds: uniqueIds,
-          service,
-          bridge: runtime.bridge,
-          coordinator: archiveCoordinator,
-          onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
-            writeStderrLine(
-              `qwen serve: ${phase}Session failed for ${safeLogValue(sessionId)}: ${safeLogValue(error2)}`
-            );
-          }, "onError")
-        });
+        const service = createWorkspaceRuntimeSessionService(runtime);
+        const result = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => deleteDaemonSessions({
+            sessionIds: uniqueIds,
+            service,
+            bridge: runtime.bridge,
+            coordinator: archiveCoordinator,
+            onError: /* @__PURE__ */ __name(({ phase, sessionId, error: error2 }) => {
+              writeStderrLine(
+                `qwen serve: ${phase}Session failed for ${safeLogValue(sessionId)}: ${safeLogValue(error2)}`
+              );
+            }, "onError")
+          })
+        );
         for (const removedId of result.removed) {
           clearBranchSessionEntry(removedId);
         }
@@ -23808,16 +24704,19 @@ function registerSessionRoutes(app, deps) {
       if (!runtime) return;
       const uniqueIds = parseSessionIdsBody(req, res);
       if (uniqueIds === void 0) return;
-      const service = new SessionService(runtime.workspaceCwd, {
+      const service = createWorkspaceRuntimeSessionService(runtime, {
         onWarning: logSessionArchiveWarning
       });
       try {
-        const result = await archiveDaemonSessions({
-          sessionIds: uniqueIds,
-          service,
-          bridge: runtime.bridge,
-          coordinator: archiveCoordinator
-        });
+        const result = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => archiveDaemonSessions({
+            sessionIds: uniqueIds,
+            service,
+            bridge: runtime.bridge,
+            coordinator: archiveCoordinator
+          })
+        );
         res.status(200).json({
           archived: result.archived,
           alreadyArchived: result.alreadyArchived,
@@ -23838,15 +24737,18 @@ function registerSessionRoutes(app, deps) {
       if (!runtime) return;
       const uniqueIds = parseSessionIdsBody(req, res);
       if (uniqueIds === void 0) return;
-      const service = new SessionService(runtime.workspaceCwd, {
+      const service = createWorkspaceRuntimeSessionService(runtime, {
         onWarning: logSessionArchiveWarning
       });
       try {
-        const result = await unarchiveDaemonSessions({
-          sessionIds: uniqueIds,
-          service,
-          coordinator: archiveCoordinator
-        });
+        const result = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => unarchiveDaemonSessions({
+            sessionIds: uniqueIds,
+            service,
+            coordinator: archiveCoordinator
+          })
+        );
         res.status(200).json({
           unarchived: result.unarchived,
           alreadyActive: result.alreadyActive,
@@ -23890,74 +24792,80 @@ function registerSessionRoutes(app, deps) {
     const sessionId = requireSessionId(req, res);
     if (sessionId === null) return;
     try {
-      await archiveCoordinator.runSharedMany([sessionId], async () => {
-        const sessionService = new SessionService(target.workspaceCwd);
-        let exists = await sessionService.sessionExistsInAnyState(sessionId);
-        if (!exists) {
-          try {
-            const summary = target.bridge.getSessionSummary(sessionId);
-            exists = summary.workspaceCwd === target.workspaceCwd;
-          } catch {
-            exists = false;
+      await archiveCoordinator.runSharedMany(
+        [sessionId],
+        () => runWithWorkspaceRuntimeStorage(target.runtime, async () => {
+          const sessionService = createWorkspaceRuntimeSessionService(
+            target.runtime
+          );
+          let exists = await sessionService.sessionExistsInAnyState(sessionId);
+          if (!exists) {
+            try {
+              const summary = target.runtime.bridge.getSessionSummary(sessionId);
+              exists = summary.workspaceCwd === target.runtime.workspaceCwd;
+            } catch {
+              exists = false;
+            }
           }
-        }
-        if (!exists) {
-          res.status(404).json({
-            error: `No session with id "${sessionId}"`,
-            sessionId
-          });
-          return;
-        }
-        const body = safeBody(req);
-        const rawIsPinned = body["isPinned"];
-        if (rawIsPinned !== void 0 && typeof rawIsPinned !== "boolean") {
-          res.status(400).json({
-            error: "`isPinned` must be a boolean",
-            code: "invalid_session_organization",
-            field: "isPinned"
-          });
-          return;
-        }
-        const rawGroupId = body["groupId"];
-        if (rawGroupId !== void 0 && rawGroupId !== null && typeof rawGroupId !== "string") {
-          res.status(400).json({
-            error: "`groupId` must be a string or null",
-            code: "invalid_session_organization",
-            field: "groupId"
-          });
-          return;
-        }
-        const rawColor = body["color"];
-        if (rawColor !== void 0 && rawColor !== null && (typeof rawColor !== "string" || !GROUP_COLOR_OPTIONS.includes(rawColor))) {
-          res.status(400).json({
-            error: "`color` must be a supported color or null",
-            code: "invalid_session_organization",
-            field: "color"
+          if (!exists) {
+            res.status(404).json({
+              error: `No session with id "${sessionId}"`,
+              sessionId
+            });
+            return;
+          }
+          const body = safeBody(req);
+          const rawIsPinned = body["isPinned"];
+          if (rawIsPinned !== void 0 && typeof rawIsPinned !== "boolean") {
+            res.status(400).json({
+              error: "`isPinned` must be a boolean",
+              code: "invalid_session_organization",
+              field: "isPinned"
+            });
+            return;
+          }
+          const rawGroupId = body["groupId"];
+          if (rawGroupId !== void 0 && rawGroupId !== null && typeof rawGroupId !== "string") {
+            res.status(400).json({
+              error: "`groupId` must be a string or null",
+              code: "invalid_session_organization",
+              field: "groupId"
+            });
+            return;
+          }
+          const rawColor = body["color"];
+          if (rawColor !== void 0 && rawColor !== null && (typeof rawColor !== "string" || !GROUP_COLOR_OPTIONS.includes(
+            rawColor
+          ))) {
+            res.status(400).json({
+              error: "`color` must be a supported color or null",
+              code: "invalid_session_organization",
+              field: "color"
+            });
+            return;
+          }
+          const organization = await createSessionOrganizationService(
+            target.runtime.workspaceCwd
+          ).updateSessionOrganization(sessionId, {
+            ...rawIsPinned !== void 0 ? { isPinned: rawIsPinned } : {},
+            ...rawGroupId !== void 0 ? { groupId: rawGroupId } : {},
+            ...rawColor !== void 0 ? { color: rawColor } : {}
           });
-          return;
-        }
-        const organization = await createSessionOrganizationService(
-          target.workspaceCwd
-        ).updateSessionOrganization(sessionId, {
-          ...rawIsPinned !== void 0 ? { isPinned: rawIsPinned } : {},
-          ...rawGroupId !== void 0 ? { groupId: rawGroupId } : {},
-          ...rawColor !== void 0 ? { color: rawColor } : {}
-        });
-        res.status(200).json({ sessionId, ...organization });
-      });
+          res.status(200).json({ sessionId, ...organization });
+        })
+      );
     } catch (err) {
       if (sendSessionOrganizationError(res, err)) return;
       sendBridgeError2(res, err, {
         route: target.route,
         sessionId,
-        workspaceCwd: target.workspaceCwd
+        workspaceCwd: target.runtime.workspaceCwd
       });
     }
   }, "handleSessionOrganizationUpdate");
   app.patch("/session/:id/organization", mutate(), async (req, res) => {
     await handleSessionOrganizationUpdate(req, res, {
-      workspaceCwd: boundWorkspace,
-      bridge,
+      runtime: workspaceRegistry.primary,
       route: "PATCH /session/:id/organization"
     });
   });
@@ -23969,8 +24877,7 @@ function registerSessionRoutes(app, deps) {
       const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
       if (!runtime) return;
       await handleSessionOrganizationUpdate(req, res, {
-        workspaceCwd: runtime.workspaceCwd,
-        bridge: runtime.bridge,
+        runtime,
         route
       });
     }
@@ -23992,14 +24899,17 @@ function registerSessionRoutes(app, deps) {
     }
   });
   app.post("/workspace/:id/session-groups", mutate(), async (req, res) => {
-    const key = resolveWorkspaceParam(req, res);
-    if (key === null) return;
+    const runtime = resolveLegacyPrimaryRuntimeFromParam(req, res);
+    if (runtime === null) return;
     const body = safeBody(req);
     try {
-      const group = await createSessionOrganizationService(key).createGroup({
-        name: body["name"],
-        color: body["color"]
-      });
+      const group = await runWithWorkspaceRuntimeStorage(
+        runtime,
+        () => createSessionOrganizationService(runtime.workspaceCwd).createGroup({
+          name: body["name"],
+          color: body["color"]
+        })
+      );
       res.status(201).json({ group });
     } catch (err) {
       if (sendSessionOrganizationError(res, err)) return;
@@ -24012,17 +24922,20 @@ function registerSessionRoutes(app, deps) {
     "/workspace/:id/session-groups/:groupId",
     mutate(),
     async (req, res) => {
-      const key = resolveWorkspaceParam(req, res);
-      if (key === null) return;
+      const runtime = resolveLegacyPrimaryRuntimeFromParam(req, res);
+      if (runtime === null) return;
       const body = safeBody(req);
       try {
-        const group = await createSessionOrganizationService(key).updateGroup(
-          req.params["groupId"] ?? "",
-          {
-            ...Object.prototype.hasOwnProperty.call(body, "name") ? { name: body["name"] } : {},
-            ...Object.prototype.hasOwnProperty.call(body, "color") ? { color: body["color"] } : {},
-            ...Object.prototype.hasOwnProperty.call(body, "order") ? { order: body["order"] } : {}
-          }
+        const group = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => createSessionOrganizationService(runtime.workspaceCwd).updateGroup(
+            req.params["groupId"] ?? "",
+            {
+              ...Object.prototype.hasOwnProperty.call(body, "name") ? { name: body["name"] } : {},
+              ...Object.prototype.hasOwnProperty.call(body, "color") ? { color: body["color"] } : {},
+              ...Object.prototype.hasOwnProperty.call(body, "order") ? { order: body["order"] } : {}
+            }
+          )
         );
         res.status(200).json({ group });
       } catch (err) {
@@ -24037,11 +24950,14 @@ function registerSessionRoutes(app, deps) {
     "/workspace/:id/session-groups/:groupId",
     mutate(),
     async (req, res) => {
-      const key = resolveWorkspaceParam(req, res);
-      if (key === null) return;
+      const runtime = resolveLegacyPrimaryRuntimeFromParam(req, res);
+      if (runtime === null) return;
       try {
-        const deleted = await createSessionOrganizationService(key).deleteGroup(
-          req.params["groupId"] ?? ""
+        const deleted = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => createSessionOrganizationService(runtime.workspaceCwd).deleteGroup(
+            req.params["groupId"] ?? ""
+          )
         );
         res.status(200).json({ deleted });
       } catch (err) {
@@ -24076,12 +24992,13 @@ function registerSessionRoutes(app, deps) {
       if (!runtime) return;
       const body = safeBody(req);
       try {
-        const group = await createSessionOrganizationService(
-          runtime.workspaceCwd
-        ).createGroup({
-          name: body["name"],
-          color: body["color"]
-        });
+        const group = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => createSessionOrganizationService(runtime.workspaceCwd).createGroup({
+            name: body["name"],
+            color: body["color"]
+          })
+        );
         res.status(201).json({ group });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -24098,13 +25015,17 @@ function registerSessionRoutes(app, deps) {
       if (!runtime) return;
       const body = safeBody(req);
       try {
-        const group = await createSessionOrganizationService(
-          runtime.workspaceCwd
-        ).updateGroup(req.params["groupId"] ?? "", {
-          ...Object.prototype.hasOwnProperty.call(body, "name") ? { name: body["name"] } : {},
-          ...Object.prototype.hasOwnProperty.call(body, "color") ? { color: body["color"] } : {},
-          ...Object.prototype.hasOwnProperty.call(body, "order") ? { order: body["order"] } : {}
-        });
+        const group = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => createSessionOrganizationService(runtime.workspaceCwd).updateGroup(
+            req.params["groupId"] ?? "",
+            {
+              ...Object.prototype.hasOwnProperty.call(body, "name") ? { name: body["name"] } : {},
+              ...Object.prototype.hasOwnProperty.call(body, "color") ? { color: body["color"] } : {},
+              ...Object.prototype.hasOwnProperty.call(body, "order") ? { order: body["order"] } : {}
+            }
+          )
+        );
         res.status(200).json({ group });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -24120,9 +25041,12 @@ function registerSessionRoutes(app, deps) {
       const runtime = requireTrustedRuntimeForWorkspaceRoute(req, res, route);
       if (!runtime) return;
       try {
-        const deleted = await createSessionOrganizationService(
-          runtime.workspaceCwd
-        ).deleteGroup(req.params["groupId"] ?? "");
+        const deleted = await runWithWorkspaceRuntimeStorage(
+          runtime,
+          () => createSessionOrganizationService(runtime.workspaceCwd).deleteGroup(
+            req.params["groupId"] ?? ""
+          )
+        );
         res.status(200).json({ deleted });
       } catch (err) {
         if (sendSessionOrganizationError(res, err)) return;
@@ -24210,7 +25134,7 @@ function registerSessionRoutes(app, deps) {
         ...parentSessionId !== void 0 ? { parentSessionId } : {},
         ...parsedSource
       };
-      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(key));
+      const usePersisted = readOnlySecondary || runtime.primary || view === "organized" || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0 || (cursor !== void 0 && cursor !== "" ? isNumericSessionCursor(cursor) : await hasActivePersistedSessions(runtime));
       if (!usePersisted && (view !== void 0 || archiveState === "archived" || parentSessionId !== void 0 || parsedSource.sourceType !== void 0)) {
         throw new Error(
           "session list live path received persisted-only options"
@@ -24707,11 +25631,14 @@ function requireOpenGeneration2(target, res) {
   }
 }
 __name(requireOpenGeneration2, "requireOpenGeneration");
-async function rollbackCronMutation(workspaceCwd, before, after, route) {
+async function rollbackCronMutation(target, before, after, route) {
   if (!before || !after) return;
-  await updateCronTasks(
-    workspaceCwd,
-    (tasks) => isDeepStrictEqual2(tasks, after) ? before : tasks
+  await runWithScheduledTaskTarget(
+    target,
+    () => updateCronTasks(
+      target.workspaceCwd,
+      (tasks) => isDeepStrictEqual2(tasks, after) ? before : tasks
+    )
   ).catch((error2) => {
     writeStderrLine(
       `qwen serve: ${route} failed to roll back a stale task mutation: ${error2 instanceof Error ? error2.message : String(error2)}`
@@ -24719,6 +25646,27 @@ async function rollbackCronMutation(workspaceCwd, before, after, route) {
   });
 }
 __name(rollbackCronMutation, "rollbackCronMutation");
+async function teardownBoundSession(target, sessionId) {
+  if (target.cleanupSession) {
+    await target.cleanupSession(sessionId).catch(() => {
+    });
+  } else if (target.bridge) {
+    await target.bridge.closeSession(sessionId).catch(() => {
+    });
+    await new SessionService(target.workspaceCwd, {
+      runtimeBaseDir: target.runtimeBaseDir
+    }).removeSession(sessionId).catch(() => {
+    });
+  }
+}
+__name(teardownBoundSession, "teardownBoundSession");
+function runWithScheduledTaskTarget(target, fn) {
+  if (target.runtimeBaseDir === void 0) {
+    return fn();
+  }
+  return Storage.runWithResolvedRuntimeBaseDir(target.runtimeBaseDir, fn);
+}
+__name(runWithScheduledTaskTarget, "runWithScheduledTaskTarget");
 function computeNextRunAt(task) {
   if (task.enabled === false) return null;
   return nextDurableFireMs(task);
@@ -24793,7 +25741,10 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     if (!target) return;
     if (!requireOpenGeneration2(target, res)) return;
     try {
-      const tasks = await readCronTasks(target.workspaceCwd);
+      const tasks = await runWithScheduledTaskTarget(
+        target,
+        () => readCronTasks(target.workspaceCwd)
+      );
       if (!requireOpenGeneration2(target, res)) return;
       res.status(200).json({ v: 1, tasks: tasks.map(toView) });
     } catch (err) {
@@ -24887,7 +25838,10 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     let boundSessionId;
     if (bridge) {
       try {
-        if ((await readCronTasks(workspaceCwd)).length >= MAX_SCHEDULED_TASKS) {
+        if ((await runWithScheduledTaskTarget(
+          target,
+          () => readCronTasks(workspaceCwd)
+        )).length >= MAX_SCHEDULED_TASKS) {
           res.status(409).json({
             error: `Maximum number of scheduled tasks (${MAX_SCHEDULED_TASKS}) reached`,
             code: "max_tasks_reached"
@@ -24906,10 +25860,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         });
         boundSessionId = session.sessionId;
         if (!requireOpenGeneration2(target, res)) {
-          await bridge.closeSession(boundSessionId).catch(() => {
-          });
-          await new SessionService(workspaceCwd).removeSession(boundSessionId).catch(() => {
-          });
+          await teardownBoundSession(target, boundSessionId);
           return;
         }
         try {
@@ -24946,29 +25897,29 @@ function registerScheduledTaskCrudRoutes(app, deps) {
       ...nameResult.value !== void 0 ? { name: nameResult.value } : {}
     };
     const rollbackSession = /* @__PURE__ */ __name(async () => {
-      if (boundSessionId !== void 0 && bridge) {
-        await bridge.closeSession(boundSessionId).catch(() => {
-        });
-        await new SessionService(workspaceCwd).removeSession(boundSessionId).catch(() => {
-        });
+      if (boundSessionId !== void 0) {
+        await teardownBoundSession(target, boundSessionId);
       }
     }, "rollbackSession");
     let overCap = false;
     let rollbackBefore;
     let rollbackAfter;
     try {
-      await updateCronTasks(
-        workspaceCwd,
-        (tasks) => {
-          if (tasks.length >= MAX_SCHEDULED_TASKS) {
-            overCap = true;
-            return tasks;
-          }
-          rollbackBefore = tasks;
-          rollbackAfter = [...tasks, task];
-          return rollbackAfter;
-        },
-        { assertCanCommit: target.assertGenerationOpen }
+      await runWithScheduledTaskTarget(
+        target,
+        () => updateCronTasks(
+          workspaceCwd,
+          (tasks) => {
+            if (tasks.length >= MAX_SCHEDULED_TASKS) {
+              overCap = true;
+              return tasks;
+            }
+            rollbackBefore = tasks;
+            rollbackAfter = [...tasks, task];
+            return rollbackAfter;
+          },
+          { assertCanCommit: target.assertGenerationOpen }
+        )
       );
     } catch (err) {
       await rollbackSession();
@@ -24987,7 +25938,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         target.assertGenerationOpen?.();
       } catch (error2) {
         await rollbackCronMutation(
-          workspaceCwd,
+          target,
           rollbackBefore,
           rollbackAfter,
           `POST ${base}`
@@ -25121,44 +26072,47 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     let rollbackBefore;
     let rollbackAfter;
     try {
-      await updateCronTasks(
-        workspaceCwd,
-        (tasks) => {
-          const idx = tasks.findIndex((t) => t.id === id);
-          if (idx === -1) return tasks;
-          found = true;
-          const current = tasks[idx];
-          if (patch.enabled === true && taskHasLegacyCondition(current)) {
-            blockedLegacy = true;
-            return tasks;
-          }
-          if (patch.enabled === true && current.disabledByArchive === true) {
-            blockedByArchive = true;
-            return tasks;
-          }
-          const next = { ...current, ...patch };
-          if (clearName) delete next.name;
-          if (clearDelivery) delete next.delivery;
-          const justReEnabled = current.enabled === false && patch.enabled === true;
-          const cronChanged = patch.cron !== void 0 && canonicalCron(patch.cron) !== canonicalCron(current.cron);
-          const becameRecurring = patch.recurring === true && current.recurring !== true;
-          const becameOneShot = patch.recurring === false && current.recurring !== false;
-          {
-            const now = Date.now();
-            const minute = now - now % 6e4;
-            if (next.recurring && (justReEnabled || cronChanged || becameRecurring)) {
-              next.lastFiredAt = minute;
-            } else if (!next.recurring && (justReEnabled || cronChanged || becameOneShot)) {
-              next.createdAt = now;
-              next.lastFiredAt = minute;
+      await runWithScheduledTaskTarget(
+        target,
+        () => updateCronTasks(
+          workspaceCwd,
+          (tasks) => {
+            const idx = tasks.findIndex((t) => t.id === id);
+            if (idx === -1) return tasks;
+            found = true;
+            const current = tasks[idx];
+            if (patch.enabled === true && taskHasLegacyCondition(current)) {
+              blockedLegacy = true;
+              return tasks;
             }
-          }
-          updated = next;
-          rollbackBefore = tasks;
-          rollbackAfter = tasks.map((t, i) => i === idx ? next : t);
-          return rollbackAfter;
-        },
-        { assertCanCommit: target.assertGenerationOpen }
+            if (patch.enabled === true && current.disabledByArchive === true) {
+              blockedByArchive = true;
+              return tasks;
+            }
+            const next = { ...current, ...patch };
+            if (clearName) delete next.name;
+            if (clearDelivery) delete next.delivery;
+            const justReEnabled = current.enabled === false && patch.enabled === true;
+            const cronChanged = patch.cron !== void 0 && canonicalCron(patch.cron) !== canonicalCron(current.cron);
+            const becameRecurring = patch.recurring === true && current.recurring !== true;
+            const becameOneShot = patch.recurring === false && current.recurring !== false;
+            {
+              const now = Date.now();
+              const minute = now - now % 6e4;
+              if (next.recurring && (justReEnabled || cronChanged || becameRecurring)) {
+                next.lastFiredAt = minute;
+              } else if (!next.recurring && (justReEnabled || cronChanged || becameOneShot)) {
+                next.createdAt = now;
+                next.lastFiredAt = minute;
+              }
+            }
+            updated = next;
+            rollbackBefore = tasks;
+            rollbackAfter = tasks.map((t, i) => i === idx ? next : t);
+            return rollbackAfter;
+          },
+          { assertCanCommit: target.assertGenerationOpen }
+        )
       );
     } catch (err) {
       if (sendGenerationClosedError(res, err)) return;
@@ -25176,7 +26130,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         target.assertGenerationOpen?.();
       } catch (error2) {
         await rollbackCronMutation(
-          workspaceCwd,
+          target,
           rollbackBefore,
           rollbackAfter,
           `PATCH ${base}/${id}`
@@ -25245,21 +26199,24 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     let rollbackBefore;
     let rollbackAfter;
     try {
-      await updateCronTasks(
-        workspaceCwd,
-        (tasks) => {
-          const idx = tasks.findIndex((t) => t.id === id);
-          if (idx === -1) return tasks;
-          const match = tasks[idx].sessionId;
-          if (typeof match === "string" && match.length > 0) {
-            boundSessionId = match;
-          }
-          removed = true;
-          rollbackBefore = tasks;
-          rollbackAfter = tasks.filter((_, i) => i !== idx);
-          return rollbackAfter;
-        },
-        { assertCanCommit: target.assertGenerationOpen }
+      await runWithScheduledTaskTarget(
+        target,
+        () => updateCronTasks(
+          workspaceCwd,
+          (tasks) => {
+            const idx = tasks.findIndex((t) => t.id === id);
+            if (idx === -1) return tasks;
+            const match = tasks[idx].sessionId;
+            if (typeof match === "string" && match.length > 0) {
+              boundSessionId = match;
+            }
+            removed = true;
+            rollbackBefore = tasks;
+            rollbackAfter = tasks.filter((_, i) => i !== idx);
+            return rollbackAfter;
+          },
+          { assertCanCommit: target.assertGenerationOpen }
+        )
       );
     } catch (err) {
       if (sendGenerationClosedError(res, err)) return;
@@ -25277,7 +26234,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         target.assertGenerationOpen?.();
       } catch (error2) {
         await rollbackCronMutation(
-          workspaceCwd,
+          target,
           rollbackBefore,
           rollbackAfter,
           `DELETE ${base}/${id}`
@@ -25321,37 +26278,40 @@ function registerScheduledTaskCrudRoutes(app, deps) {
     let rollbackBefore;
     let rollbackAfter;
     try {
-      await updateCronTasks(
-        workspaceCwd,
-        (tasks) => {
-          const idx = tasks.findIndex((t) => t.id === id);
-          if (idx === -1) return tasks;
-          found = true;
-          const current = tasks[idx];
-          if (taskHasLegacyCondition(current)) {
-            blockedLegacy = true;
-            return tasks;
-          }
-          if (current.enabled === false) {
-            blockedDisabled = true;
-            return tasks;
-          }
-          const next = {
-            ...current,
-            lastFiredAt: now,
-            runs: appendCronRun(current.runs, {
-              at: now,
-              kind: "manual",
-              ...current.sessionId ? { sessionId: current.sessionId } : {}
-            })
-          };
-          updated = next;
-          rollbackBefore = tasks;
-          const nextTasks = !current.recurring ? tasks.filter((_, i) => i !== idx) : tasks.map((t, i) => i === idx ? next : t);
-          rollbackAfter = nextTasks;
-          return nextTasks;
-        },
-        { assertCanCommit: target.assertGenerationOpen }
+      await runWithScheduledTaskTarget(
+        target,
+        () => updateCronTasks(
+          workspaceCwd,
+          (tasks) => {
+            const idx = tasks.findIndex((t) => t.id === id);
+            if (idx === -1) return tasks;
+            found = true;
+            const current = tasks[idx];
+            if (taskHasLegacyCondition(current)) {
+              blockedLegacy = true;
+              return tasks;
+            }
+            if (current.enabled === false) {
+              blockedDisabled = true;
+              return tasks;
+            }
+            const next = {
+              ...current,
+              lastFiredAt: now,
+              runs: appendCronRun(current.runs, {
+                at: now,
+                kind: "manual",
+                ...current.sessionId ? { sessionId: current.sessionId } : {}
+              })
+            };
+            updated = next;
+            rollbackBefore = tasks;
+            const nextTasks = !current.recurring ? tasks.filter((_, i) => i !== idx) : tasks.map((t, i) => i === idx ? next : t);
+            rollbackAfter = nextTasks;
+            return nextTasks;
+          },
+          { assertCanCommit: target.assertGenerationOpen }
+        )
       );
     } catch (err) {
       if (sendGenerationClosedError(res, err)) return;
@@ -25369,7 +26329,7 @@ function registerScheduledTaskCrudRoutes(app, deps) {
         target.assertGenerationOpen?.();
       } catch (error2) {
         await rollbackCronMutation(
-          workspaceCwd,
+          target,
           rollbackBefore,
           rollbackAfter,
           `POST ${base}/${id}/run`
@@ -25425,6 +26385,12 @@ function registerScheduledTasksRoutes(app, deps) {
       if (runtime && !requireTrustedWorkspaceRuntime(runtime, res)) return null;
       return {
         workspaceCwd: boundWorkspace,
+        ...runtime ? {
+          runtimeBaseDir: runtime.sessionRuntimeBaseDir,
+          ...deps.cleanupSession ? {
+            cleanupSession: /* @__PURE__ */ __name((sessionId) => deps.cleanupSession(runtime, sessionId), "cleanupSession")
+          } : {}
+        } : {},
         bridge: runtime?.bridge ?? bridge,
         ...runtime?.generationGuard ? {
           assertGenerationOpen: /* @__PURE__ */ __name(() => runtime.generationGuard?.assertOpen(), "assertGenerationOpen")
@@ -25443,7 +26409,8 @@ function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
     mutate,
     safeBody: safeBody2,
     manageScheduledTaskSessions,
-    channelDeliveryAuthorizations
+    channelDeliveryAuthorizations,
+    cleanupSession
   } = deps;
   registerScheduledTaskCrudRoutes(app, {
     prefix: "/workspaces/:workspace",
@@ -25457,6 +26424,10 @@ function registerWorkspaceQualifiedScheduledTasksRoutes(app, deps) {
       if (!requireTrustedWorkspaceRuntime(runtime, res)) return null;
       return {
         workspaceCwd: runtime.workspaceCwd,
+        runtimeBaseDir: runtime.sessionRuntimeBaseDir,
+        ...cleanupSession ? {
+          cleanupSession: /* @__PURE__ */ __name((sessionId) => cleanupSession(runtime, sessionId), "cleanupSession")
+        } : {},
         // Mirror the primary surface: only bind a session when management is on,
         // so a bound task always has something to keep it resident + rehydrate it.
         bridge: manageScheduledTaskSessions ? runtime.bridge : void 0,
@@ -25735,7 +26706,7 @@ __name(collectBoundSessionIds, "collectBoundSessionIds");
 var KEEPALIVE_REVIVE_TIMEOUT_MS = 3e4;
 var KEEPALIVE_SPAWN_TIMEOUT_MS = 3e4;
 var MAX_REVIVE_BACKOFF_MS = 30 * 6e4;
-async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawnTimeoutMs, binding) {
+async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawnTimeoutMs, binding, cleanupSession) {
   const unbound = tasks.filter(
     (t) => !t.sessionId && t.enabled !== false && !taskHasLegacyCondition(t) && !binding.has(t.id)
   );
@@ -25753,16 +26724,14 @@ async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawn
         sourceId: task.id
       });
       let timedOut = false;
-      rawSpawn.then(({ sessionId: sessionId2 }) => {
+      rawSpawn.then(async ({ sessionId: sessionId2 }) => {
         if (timedOut) {
           log.debug(
             "keepalive: late spawn resolved, cleaning up",
             task.id,
             sessionId2
           );
-          bridge.closeSession(sessionId2).catch(() => {
-          });
-          new SessionService(boundWorkspace).removeSession(sessionId2).catch(() => {
+          await cleanupSession(sessionId2).catch(() => {
           });
         }
       }).catch(() => {
@@ -25810,9 +26779,7 @@ async function bindAndNameSessions(bridge, boundWorkspace, tasks, renamed, spawn
     } catch (err) {
       log.debug("keepalive: failed to bind task", task.id, err);
       if (spawnedSessionId !== void 0) {
-        await bridge.closeSession(spawnedSessionId).catch(() => {
-        });
-        await new SessionService(boundWorkspace).removeSession(spawnedSessionId).catch(() => {
+        await cleanupSession(spawnedSessionId).catch(() => {
         });
       }
     }
@@ -25834,11 +26801,17 @@ function startScheduledTaskKeepalive(opts) {
   const { bridge, boundWorkspace, intervalMs } = opts;
   const reviveTimeoutMs = opts.reviveTimeoutMs ?? KEEPALIVE_REVIVE_TIMEOUT_MS;
   const spawnTimeoutMs = opts.spawnTimeoutMs ?? KEEPALIVE_SPAWN_TIMEOUT_MS;
+  const cleanupSession = opts.cleanupSession ?? (async (sessionId) => {
+    await bridge.closeSession(sessionId);
+    await new SessionService(boundWorkspace, {
+      runtimeBaseDir: opts.runtimeBaseDir
+    }).removeSession(sessionId);
+  });
   const reviveState = /* @__PURE__ */ new Map();
   const reviving = /* @__PURE__ */ new Set();
   const binding = /* @__PURE__ */ new Set();
   const renamed = /* @__PURE__ */ new Set();
-  const tick = /* @__PURE__ */ __name(async () => {
+  const tickInRuntime = /* @__PURE__ */ __name(async () => {
     let tasks;
     try {
       tasks = await readCronTasks(boundWorkspace);
@@ -25916,9 +26889,14 @@ function startScheduledTaskKeepalive(opts) {
       tasks,
       renamed,
       spawnTimeoutMs,
-      binding
+      binding,
+      cleanupSession
     );
-  }, "tick");
+  }, "tickInRuntime");
+  const tick = /* @__PURE__ */ __name(() => opts.runtimeBaseDir === void 0 ? tickInRuntime() : Storage.runWithResolvedRuntimeBaseDir(
+    opts.runtimeBaseDir,
+    tickInRuntime
+  ), "tick");
   let running = false;
   const timer = setInterval(() => {
     if (running) return;
@@ -25929,7 +26907,10 @@ function startScheduledTaskKeepalive(opts) {
   }, intervalMs);
   timer.unref?.();
   let bindDebounce;
-  const cronFilePath = getCronFilePath(boundWorkspace);
+  const cronFilePath = opts.runtimeBaseDir === void 0 ? getCronFilePath(boundWorkspace) : Storage.runWithResolvedRuntimeBaseDir(
+    opts.runtimeBaseDir,
+    () => getCronFilePath(boundWorkspace)
+  );
   const cronDir = path11.dirname(cronFilePath);
   const cronFileName = path11.basename(cronFilePath);
   let fileWatcher;
@@ -27424,6 +28405,14 @@ function sendPermissionVoteError(res, err, ctx, daemonLog) {
 }
 __name(sendPermissionVoteError, "sendPermissionVoteError");
 function sendBridgeError(res, err, ctx, daemonLog) {
+  if (err instanceof DaemonDrainingError) {
+    res.status(503).json({
+      error: err.message,
+      code: err.code,
+      errorKind: err.code
+    });
+    return;
+  }
   if (sendGenerationClosedError(res, err)) return;
   if (err instanceof SessionWriterError) {
     res.status(err.httpStatus).json({
@@ -32730,6 +33719,18 @@ function parsePairingCode(body, res) {
   return code.trim().toUpperCase();
 }
 __name(parsePairingCode, "parsePairingCode");
+function parsePairingSenderId(body, res) {
+  const senderId = body["senderId"];
+  if (typeof senderId !== "string" || senderId.length === 0) {
+    res.status(400).json({
+      error: "`senderId` must be a non-empty string.",
+      code: "invalid_channel_pairing_sender_id"
+    });
+    return void 0;
+  }
+  return senderId;
+}
+__name(parsePairingSenderId, "parsePairingSenderId");
 function errorCode2(error2) {
   if (!error2 || typeof error2 !== "object") return void 0;
   try {
@@ -32751,6 +33752,7 @@ var ERROR_STATUS = /* @__PURE__ */ new Map([
   ["untrusted_workspace", 403],
   ["channel_instance_not_found", 404],
   ["channel_pairing_request_not_found", 404],
+  ["channel_pairing_approval_not_found", 404],
   ["channel_pairing_not_enabled", 409],
   ["channel_settings_conflict", 409],
   ["channel_runtime_owner_mismatch", 409],
@@ -32807,6 +33809,8 @@ function registerWorkspaceChannelManagementRoutes(app, deps) {
   const register = /* @__PURE__ */ __name((prefix, resolveRuntime) => {
     const pairingRead = deps.mutate({ strict: true });
     const pairingApprove = deps.mutate({ strict: true });
+    const pairingApprovalsRead = deps.mutate({ strict: true });
+    const pairingRevoke = deps.mutate({ strict: true });
     const upsert = deps.mutate({ strict: true });
     const remove = deps.mutate({ strict: true });
     const startup = deps.mutate({ strict: true });
@@ -32869,6 +33873,40 @@ function registerWorkspaceChannelManagementRoutes(app, deps) {
         }
       }
     );
+    app.get(
+      `${prefix}/channels/:name/pairing-approvals`,
+      pairingApprovalsRead,
+      async (req, res) => {
+        const resolved = await target(req, res);
+        if (!resolved || !validateClient(req, res, resolved.runtime)) return;
+        const name = parseInstanceName(req, res);
+        if (!name) return;
+        try {
+          noStore(res);
+          res.status(200).json(await resolved.service.pairingApprovals(name));
+        } catch (error2) {
+          sendManagementError(res, error2);
+        }
+      }
+    );
+    app.delete(
+      `${prefix}/channels/:name/pairing-approvals`,
+      pairingRevoke,
+      async (req, res) => {
+        const resolved = await target(req, res);
+        if (!resolved || !validateClient(req, res, resolved.runtime)) return;
+        const name = parseInstanceName(req, res);
+        if (!name) return;
+        const senderId = parsePairingSenderId(deps.safeBody(req), res);
+        if (!senderId) return;
+        try {
+          noStore(res);
+          res.status(200).json(await resolved.service.revokePairingApproval(name, senderId));
+        } catch (error2) {
+          sendManagementError(res, error2);
+        }
+      }
+    );
     app.put(`${prefix}/channels/:name`, upsert, async (req, res) => {
       const resolved = await target(req, res);
       if (!resolved || !validateClient(req, res, resolved.runtime)) return;
@@ -33993,6 +35031,16 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     defaultBridgeForAdmission = bridge;
   }
   const archiveCoordinator = new SessionArchiveCoordinator();
+  app.locals.sessionArchiveCoordinator = archiveCoordinator;
+  const cleanupSession = /* @__PURE__ */ __name((runtime, sessionId) => runWithWorkspaceRuntimeStorage(
+    runtime,
+    () => deleteDaemonSessionIfOrphan({
+      sessionId,
+      service: createWorkspaceRuntimeSessionService(runtime),
+      bridge: runtime.bridge,
+      coordinator: archiveCoordinator
+    })
+  ), "cleanupSession");
   installSelfOriginStripMiddleware(app, getPort);
   app.locals.fsFactory = fsFactory;
   app.locals.boundWorkspace = boundWorkspace;
@@ -34057,6 +35105,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     {
       workspaceId: hashDaemonWorkspace(boundWorkspace),
       workspaceCwd: boundWorkspace,
+      sessionRuntimeBaseDir: Storage.getRuntimeBaseDir(),
       primary: true,
       trusted: deps.primaryWorkspaceTrusted ?? false,
       env: primaryRuntimeEnvMetadata ?? {
@@ -34681,6 +35730,7 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     safeBody,
     bridge: deps.manageScheduledTaskSessions ? primaryBridge : void 0,
     getRuntime: /* @__PURE__ */ __name(() => workspaceRegistry.primaryEntry.state === "active" ? workspaceRegistry.primaryEntry.current?.runtime : void 0, "getRuntime"),
+    cleanupSession,
     channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations
   });
   registerGoalsRoutes(app, {
@@ -34694,7 +35744,8 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     mutate,
     safeBody,
     manageScheduledTaskSessions: deps.manageScheduledTaskSessions === true,
-    channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations
+    channelDeliveryAuthorizations: deps.channelDeliveryAuthorizations,
+    cleanupSession
   });
   registerUsageStatsRoutes(app);
   if (deps.manageScheduledTaskSessions) {
@@ -34714,23 +35765,26 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
     }, "registerScheduledTaskAuthorizations");
     const idleTimeoutMs = opts.sessionIdleTimeoutMs ?? DEFAULT_SESSION_IDLE_TIMEOUT_MS;
     const keepaliveIntervalMs = computeKeepaliveIntervalMs(idleTimeoutMs);
-    const rehydrateWorkspace = /* @__PURE__ */ __name((taskBridge, workspaceCwd) => {
-      void rehydrateScheduledTaskSessions({
-        bridge: taskBridge,
-        boundWorkspace: workspaceCwd,
-        onTasksRead: /* @__PURE__ */ __name((tasks) => registerScheduledTaskAuthorizations(workspaceCwd, tasks), "onTasksRead"),
-        onError: /* @__PURE__ */ __name((sessionId, err) => {
-          process.stderr.write(
-            `qwen serve: failed to rehydrate scheduled-task session ${sessionId}: ${err instanceof Error ? err.message : String(err)}
+    const rehydrateWorkspace = /* @__PURE__ */ __name((runtime) => {
+      void runWithWorkspaceRuntimeStorage(
+        runtime,
+        () => rehydrateScheduledTaskSessions({
+          bridge: runtime.bridge,
+          boundWorkspace: runtime.workspaceCwd,
+          onTasksRead: /* @__PURE__ */ __name((tasks) => registerScheduledTaskAuthorizations(runtime.workspaceCwd, tasks), "onTasksRead"),
+          onError: /* @__PURE__ */ __name((sessionId, err) => {
+            process.stderr.write(
+              `qwen serve: failed to rehydrate scheduled-task session ${sessionId}: ${err instanceof Error ? err.message : String(err)}
 `
-          );
-        }, "onError")
-        // Outer catch is defense-in-depth: rehydrateScheduledTaskSessions already
-        // catches readCronTasks failures and per-session load errors internally
-        // (returning { loaded, failed }), so this only guards an unexpected throw
-        // from the function entry itself. Log rather than swallow it — a silent
-        // failure here leaves every bound task dormant with no diagnostic.
-      }).catch((err) => {
+            );
+          }, "onError")
+          // Outer catch is defense-in-depth: rehydrateScheduledTaskSessions already
+          // catches readCronTasks failures and per-session load errors internally
+          // (returning { loaded, failed }), so this only guards an unexpected throw
+          // from the function entry itself. Log rather than swallow it — a silent
+          // failure here leaves every bound task dormant with no diagnostic.
+        })
+      ).catch((err) => {
         process.stderr.write(
           `qwen serve: unexpected scheduled-task rehydration failure: ${err instanceof Error ? err.message : String(err)}
 `
@@ -34746,9 +35800,11 @@ function createServeApp(opts, getPort = () => opts.port, deps = {}) {
         bridge: runtime.bridge,
         boundWorkspace: runtime.workspaceCwd,
         intervalMs: keepaliveIntervalMs,
+        runtimeBaseDir: runtime.sessionRuntimeBaseDir,
+        cleanupSession: /* @__PURE__ */ __name((sessionId) => cleanupSession(runtime, sessionId), "cleanupSession"),
         onTasksRead: /* @__PURE__ */ __name((tasks) => registerScheduledTaskAuthorizations(runtime.workspaceCwd, tasks), "onTasksRead")
       });
-      rehydrateWorkspace(runtime.bridge, runtime.workspaceCwd);
+      rehydrateWorkspace(runtime);
       keepaliveStops.set(runtime.workspaceCwd, keepalive.stop);
     }, "startKeepaliveForWorkspace");
     for (const runtime of workspaceRegistry.list()) {