@sechroom/cli 2026.7.30 → 2026.7.31

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { Command } from "commander";
 
 // src/auth.ts
@@ -724,7 +724,9 @@ Examples:
   $ sechroom id peek FR sechroom            inspect the sequence without consuming
   $ sechroom id peek FR sechroom --json`
   );
-  id.command("next <namespaceKind> <scope>").description("Allocate the next id in a sequence (POST /id-registry/allocate)").action(async (namespaceKind, scope, _opts, cmd) => {
+  id.command("next <namespaceKind> <scope>").description(
+    "Allocate the next id in a sequence (POST /id-registry/allocate)"
+  ).action(async (namespaceKind, scope, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Allocating id", async () => {
       const client = await makeClient(cfg);
@@ -732,9 +734,15 @@ Examples:
         body: { namespaceKind, scope, clientNonce: null }
       });
     });
-    emitAction(`allocated ${style.bold(data.id)} ${style.dim(`(seq ${data.seq})`)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `allocated ${style.bold(data.id)} ${style.dim(`(seq ${data.seq})`)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  id.command("peek <namespaceKind> <scope>").description("Inspect a sequence without consuming (GET /id-registry/state)").action(async (namespaceKind, scope, _opts, cmd) => {
+  id.command("peek <namespaceKind> <scope>").description(
+    "Inspect a sequence without consuming (GET /id-registry/state)"
+  ).action(async (namespaceKind, scope, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Peeking id sequence", async () => {
       const client = await makeClient(cfg);
@@ -780,7 +788,13 @@ Examples:
     });
     emitAction("updated profile", data, cmd.optsWithGlobals().json);
   });
-  account.command("feed").description("Your recent memory feed (GET /me/memories/feed)").option("--limit <n>", "Max results", "20").option("--cursor <cursor>", "Opaque paging cursor").option("--query <query>", "Free-text filter").option("--filter-tags <tags>", "Comma-separated tag filter").option("--include-archived", "Include archived memories", false).option("--include-text", "Include memory body text", false).option("--since <iso>", "Only contributions updated since this ISO-8601 timestamp (updatedSince)").option("--order <order>", "Order: LastTouchedDesc | LastTouchedAsc | FirstTouchedDesc | FirstTouchedAsc").action(async (opts, cmd) => {
+  account.command("feed").description("Your recent memory feed (GET /me/memories/feed)").option("--limit <n>", "Max results", "20").option("--cursor <cursor>", "Opaque paging cursor").option("--query <query>", "Free-text filter").option("--filter-tags <tags>", "Comma-separated tag filter").option("--include-archived", "Include archived memories", false).option("--include-text", "Include memory body text", false).option(
+    "--since <iso>",
+    "Only contributions updated since this ISO-8601 timestamp (updatedSince)"
+  ).option(
+    "--order <order>",
+    "Order: LastTouchedDesc | LastTouchedAsc | FirstTouchedDesc | FirstTouchedAsc"
+  ).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching feed", async () => {
       const client = await makeClient(cfg);
@@ -822,7 +836,9 @@ Examples:
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching review", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/reviews/{reviewId}", { params: { path: { reviewId } } });
+      return client.GET("/reviews/{reviewId}", {
+        params: { path: { reviewId } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
@@ -835,13 +851,19 @@ Examples:
         body: { decisions: {} }
       });
     });
-    emitAction(`accepted review ${style.bold(reviewId)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `accepted review ${style.bold(reviewId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
   account.command("lookup-batch <ids...>").description("Resolve many ids at once (POST /lookup/batch)").action(async (ids, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi(`Resolving ${ids.length} ids`, async () => {
       const client = await makeClient(cfg);
-      return client.POST("/lookup/batch", { body: { ids } });
+      return client.POST("/lookup/batch", {
+        body: { ids, includeArchived: false }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
@@ -1542,8 +1564,8 @@ target:gpt-codex-agent), the dispatchable workers your loop skills call
 }
 
 // src/commands/channel.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join11 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join12 } from "path";
 import {
   HttpTransportType,
   HubConnectionBuilder
@@ -1552,8 +1574,8 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/commands/executor.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname7, join as join10 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
 
 // src/sem.ts
 import { dirname as dirname2, join as join5 } from "path";
@@ -1706,8 +1728,8 @@ function ensureSemIgnored(semPath) {
     if (target.exists) {
       const content = readFileSync3(target.path, "utf8");
       if (ignoresSem(content)) return;
-      const sep = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-      appendFileSync(target.path, `${sep}${STATE_DIR_IGNORE}
+      const sep2 = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+      appendFileSync(target.path, `${sep2}${STATE_DIR_IGNORE}
 `);
     } else {
       writeFileSync4(target.path, `${STATE_DIR_IGNORE}
@@ -1718,74 +1740,87 @@ function ensureSemIgnored(semPath) {
 }
 
 // src/commands/executor-run.ts
-import { join as join9, resolve as resolve2 } from "path";
+import { join as join10, resolve as resolve3 } from "path";
 
-// src/executor-run/claim.ts
-var SUCCESS = /* @__PURE__ */ new Set(["Claimed", "AlreadyHeld"]);
-async function claimNextTask(deps) {
-  const { request, executorInstanceId } = deps;
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
-  const idempotencyKey = deps.idempotencyKey ?? ((offer) => `executor-run:${offer.generationId}`);
-  const tokenVersion = deps.tokenVersion ?? 1;
-  const log = deps.log ?? (() => {
+// src/executor-run/request.ts
+var AuthExpiredError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthExpiredError";
+  }
+};
+var HttpError = class extends Error {
+  constructor(status, method, path, body) {
+    super(`${method} ${path} failed (${status}): ${body}`);
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    this.body = body;
+    this.name = "HttpError";
+  }
+  status;
+  method;
+  path;
+  body;
+};
+function createAuthedRequest(cfg, deps = {}) {
+  const getToken = deps.getToken ?? requireToken;
+  const refresh = deps.refreshToken ?? forceRefreshToken;
+  const doFetch = deps.fetch ?? fetch;
+  const call = async (path, init, token) => doFetch(`${cfg.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      tenant: cfg.tenant,
+      "content-type": "application/json",
+      "x-sechroom-surface": "cli",
+      ...init?.headers
+    }
   });
-  const base = `/me/executor-instances/${encodeURIComponent(executorInstanceId)}`;
-  const offers = await request(`${base}/dispatch-offers`);
-  if (offers.length === 0) return null;
-  const head = offers[0];
-  if (head.suggestedClaimDelayMs > 0) await sleep(head.suggestedClaimDelayMs);
-  const next = await request(
-    `${base}/dispatch-offers/claim-next`,
-    {
-      method: "POST",
-      body: JSON.stringify({ idempotencyKey: idempotencyKey(head) })
+  return async (path, init) => {
+    const method = init?.method ?? "GET";
+    let token;
+    try {
+      token = await getToken(cfg);
+    } catch (error) {
+      throw new AuthExpiredError(
+        error instanceof Error ? error.message : String(error)
+      );
     }
-  );
-  if (SUCCESS.has(next.outcome)) return toClaimed(next, tokenVersion, next.offer ?? head);
-  if (next.outcome === "NoOffer") return null;
-  log(
-    `claim-next returned ${next.outcome}; falling through to direct per-generation claim`
-  );
-  for (const offer of offers) {
-    const direct = await request(`/me/executor-task-claims`, {
-      method: "POST",
-      body: JSON.stringify({
-        generationId: offer.generationId,
-        executorInstanceId
-      })
-    });
-    if (SUCCESS.has(direct.outcome)) return toClaimed(direct, tokenVersion, offer);
-  }
-  return null;
-}
-function toClaimed(result, tokenVersion, offer) {
-  const lease = result.lease;
-  const claimToken = result.claimToken;
-  if (!lease?.id || !claimToken) return null;
-  return {
-    outcome: result.outcome,
-    leaseId: lease.id,
-    claimToken,
-    tokenVersion,
-    memoryId: lease.memoryId,
-    workspaceId: lease.workspaceId,
-    generationId: lease.generationId,
-    decompositionId: decompositionIdFrom(offer?.tags ?? [])
+    let response = await call(path, init, token);
+    if (response.status === 401) {
+      let fresh;
+      try {
+        fresh = await refresh(cfg);
+      } catch (error) {
+        throw new AuthExpiredError(
+          error instanceof Error ? error.message : String(error)
+        );
+      }
+      response = await call(path, init, fresh);
+      if (response.status === 401)
+        throw new AuthExpiredError(
+          `${method} ${path} still 401 after token refresh \u2014 re-authenticate (\`sechroom login\`).`
+        );
+    }
+    if (!response.ok)
+      throw new HttpError(
+        response.status,
+        method,
+        path,
+        await safeText(response)
+      );
+    return await response.json();
   };
 }
-function decompositionIdFrom(tags) {
-  const tag = tags.find((value) => value.startsWith("wlp-decomposition:"));
-  return tag?.slice("wlp-decomposition:".length) || void 0;
+async function safeText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
 }
 
-// src/executor-run/codex.ts
-import {
-  execFile,
-  spawn
-} from "child_process";
-import { createInterface } from "readline";
-import { promisify } from "util";
-
 // src/executor-run/usage.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname3 } from "path";
@@ -1804,11 +1839,21 @@ function parseWindow(value) {
   if (!obj) return void 0;
   const usedPercent = numberOf(obj, "used_percent", "usedPercent");
   if (usedPercent === void 0) return void 0;
-  return {
+  const parsed = {
     usedPercent,
-    windowMinutes: numberOf(obj, "window_minutes", "windowMinutes"),
+    windowMinutes: numberOf(
+      obj,
+      "window_minutes",
+      "windowMinutes",
+      "window_duration_mins",
+      "windowDurationMins"
+    ),
     resetsInSeconds: numberOf(obj, "resets_in_seconds", "resetsInSeconds")
   };
+  const resetsAtUnixSeconds = numberOf(obj, "resets_at", "resetsAt");
+  if (resetsAtUnixSeconds !== void 0)
+    parsed.resetsAtUnixSeconds = resetsAtUnixSeconds;
+  return parsed;
 }
 function object(value) {
   return value && typeof value === "object" ? value : void 0;
@@ -1967,33 +2012,321 @@ function createUsageLogAppender(path, log) {
   };
 }
 
+// src/executor-run/account-capacity.ts
+var CODEX_CAPACITY_LEG = "codex-capacity";
+var CODEX_CAPACITY_SOURCE = "codex-app-server:account/rateLimits/read";
+var CODEX_WEEKLY_WINDOW_MINUTES = 7 * 24 * 60;
+function normalizeCodexAccountCapacity(signal, nowMs) {
+  const account = object2(object2(signal.accountResponse)?.account);
+  const email = account?.type === "chatgpt" && typeof account.email === "string" ? account.email.trim().toLowerCase() : "";
+  if (!email) return void 0;
+  const response = object2(signal.rateLimitsResponse);
+  const byLimitId = object2(response?.rateLimitsByLimitId);
+  const topLevelLimits = object2(response?.rateLimits);
+  const limits = object2(byLimitId?.codex) ?? topLevelLimits;
+  if (!limits) return void 0;
+  const parsed = parseRateLimitPayload(limits);
+  const credits = object2(limits.credits) ?? object2(topLevelLimits?.credits) ?? object2(response?.credits);
+  const hasCreditsValue = credits?.hasCredits ?? credits?.has_credits;
+  const hasCredits = typeof hasCreditsValue === "boolean" ? hasCreditsValue : null;
+  const weekly = [parsed?.primary, parsed?.secondary].find(
+    (window) => window?.windowMinutes === CODEX_WEEKLY_WINDOW_MINUTES
+  );
+  if (!weekly) return void 0;
+  const weeklyPctUsed = Math.max(0, Math.min(100, weekly.usedPercent));
+  const resetAtMs = weekly.resetsAtUnixSeconds !== void 0 ? weekly.resetsAtUnixSeconds * 1e3 : weekly.resetsInSeconds !== void 0 ? nowMs + weekly.resetsInSeconds * 1e3 : void 0;
+  return {
+    leg: CODEX_CAPACITY_LEG,
+    accountId: `codex:chatgpt:${email}`,
+    weeklyPctUsed,
+    weeklyPctLeft: 100 - weeklyPctUsed,
+    hasCredits,
+    windowResetAt: resetAtMs === void 0 ? null : new Date(resetAtMs).toISOString(),
+    capturedAt: new Date(nowMs).toISOString(),
+    source: CODEX_CAPACITY_SOURCE
+  };
+}
+async function captureCodexAccountCapacityOnce(options) {
+  const signal = await options.read();
+  const snapshot = normalizeCodexAccountCapacity(
+    signal,
+    options.now?.() ?? Date.now()
+  );
+  if (!snapshot) {
+    if (object2(object2(signal.accountResponse)?.account)?.type === "apiKey") {
+      options.log(
+        "codex capacity capture disabled for API-key auth \u2014 codex:api-key:<fingerprint> is reserved until Codex exposes an attributable fingerprint"
+      );
+      return void 0;
+    }
+    options.log(
+      "codex capacity read carried no attributable weekly window \u2014 snapshot skipped"
+    );
+    return void 0;
+  }
+  await options.persist(snapshot);
+  options.log(
+    `codex capacity captured \u2014 ${snapshot.accountId}, ${snapshot.weeklyPctLeft.toFixed(1)}% weekly left`
+  );
+  return snapshot;
+}
+async function runCodexAccountCapacityTick(options) {
+  try {
+    await captureCodexAccountCapacityOnce(options);
+  } catch (error) {
+    if (error instanceof AuthExpiredError) throw error;
+    options.log(
+      `codex capacity capture failed (${error instanceof Error ? error.message : String(error)}) \u2014 retrying next interval`
+    );
+  }
+}
+function startCodexAccountCapacityCapture(options) {
+  const timers = options.timers ?? { setInterval, clearInterval };
+  let stopped = false;
+  let running = false;
+  let apiKeyNoticeLogged = false;
+  let timer;
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    if (timer !== void 0) timers.clearInterval(timer);
+  };
+  const captureOptions = {
+    ...options,
+    log: (line) => {
+      if (line.startsWith("codex capacity capture disabled for API-key auth")) {
+        if (apiKeyNoticeLogged) return;
+        apiKeyNoticeLogged = true;
+      }
+      options.log(line);
+    }
+  };
+  const tick = async () => {
+    if (stopped || running) return;
+    running = true;
+    try {
+      await runCodexAccountCapacityTick(captureOptions);
+    } catch (error) {
+      if (error instanceof AuthExpiredError) {
+        stop();
+        try {
+          options.onTerminal(error);
+        } catch (callbackError) {
+          options.log(
+            `codex capacity terminal callback failed (${callbackError instanceof Error ? callbackError.message : String(callbackError)})`
+          );
+        }
+      }
+    } finally {
+      running = false;
+    }
+  };
+  timer = timers.setInterval(() => void tick(), options.intervalMs);
+  timer.unref?.();
+  void tick();
+  return stop;
+}
+async function postCodexAccountCapacity(request, snapshot) {
+  await request("/work-layer/telemetry/codex-account-capacity", {
+    method: "POST",
+    body: JSON.stringify(snapshot)
+  });
+}
+function object2(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
+
+// src/executor-run/claim.ts
+var SUCCESS = /* @__PURE__ */ new Set(["Claimed", "AlreadyHeld"]);
+var CONTENTION_STATUSES = /* @__PURE__ */ new Set([409, 410]);
+async function claimNextTask(deps) {
+  const { request, executorInstanceId } = deps;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
+  const idempotencyKey = deps.idempotencyKey ?? ((offer) => `executor-run:${offer.generationId}`);
+  const tokenVersion = deps.tokenVersion ?? 1;
+  const log = deps.log ?? (() => {
+  });
+  const excludeTags = deps.excludeTags ?? [];
+  const base = `/me/executor-instances/${encodeURIComponent(executorInstanceId)}`;
+  const offers = await request(`${base}/dispatch-offers`);
+  if (offers.length === 0) return null;
+  const eligible = [];
+  let anyExcluded = false;
+  for (const offer of offers) {
+    const hit = excludeTags.find((tag) => offer.tags.includes(tag));
+    if (hit !== void 0) {
+      anyExcluded = true;
+      const key = `${offer.memoryId}:${offer.generationId}`;
+      if (!deps.skipLog?.has(key)) {
+        deps.skipLog?.add(key);
+        log(`skipped ${offer.memoryId} (excluded tag ${hit})`);
+      }
+      continue;
+    }
+    eligible.push(offer);
+  }
+  if (eligible.length === 0) return null;
+  if (!anyExcluded) {
+    const head = eligible[0];
+    if (head.suggestedClaimDelayMs > 0) await sleep(head.suggestedClaimDelayMs);
+    let next;
+    try {
+      next = await request(
+        `${base}/dispatch-offers/claim-next`,
+        {
+          method: "POST",
+          body: JSON.stringify({ idempotencyKey: idempotencyKey(head) })
+        }
+      );
+    } catch (error) {
+      if (!(error instanceof HttpError && CONTENTION_STATUSES.has(error.status)))
+        throw error;
+      log(
+        `claim-next lost the race (HTTP ${error.status}); falling through to direct per-generation claim`
+      );
+    }
+    if (next) {
+      if (SUCCESS.has(next.outcome))
+        return toClaimed(next, next.tokenVersion ?? tokenVersion);
+      if (next.outcome === "NoOffer") return null;
+      log(
+        `claim-next returned ${next.outcome}; falling through to direct per-generation claim`
+      );
+    }
+  }
+  for (const offer of eligible) {
+    let direct;
+    try {
+      direct = await request(`/me/executor-task-claims`, {
+        method: "POST",
+        body: JSON.stringify({
+          generationId: offer.generationId,
+          executorInstanceId
+        })
+      });
+    } catch (error) {
+      if (error instanceof HttpError && CONTENTION_STATUSES.has(error.status)) {
+        log(
+          `direct claim ${offer.generationId} lost the race (HTTP ${error.status}); trying the next offer`
+        );
+        continue;
+      }
+      throw error;
+    }
+    if (SUCCESS.has(direct.outcome))
+      return toClaimed(direct, direct.tokenVersion ?? tokenVersion);
+  }
+  return null;
+}
+function toClaimed(result, tokenVersion) {
+  const lease = result.lease;
+  const claimToken = result.claimToken;
+  if (!lease?.id || !claimToken) return null;
+  return {
+    outcome: result.outcome,
+    leaseId: lease.id,
+    claimToken,
+    tokenVersion,
+    memoryId: lease.memoryId,
+    workspaceId: lease.workspaceId,
+    generationId: lease.generationId,
+    decompositionId: lease.decompositionId ?? void 0
+  };
+}
+
 // src/executor-run/codex.ts
+import {
+  execFile,
+  spawn
+} from "child_process";
+import { createInterface } from "readline";
+import { promisify } from "util";
 var execFileAsync = promisify(execFile);
+var DEFAULT_ACCOUNT_READ_TIMEOUT_MS = 3e4;
 function shouldResumeTimedOutTurn(input) {
   return input.outcome === "timeout" && !input.hasPacket && Boolean(input.threadId) && (input.contextUsed > 0 || input.detailEventCount > 0 || input.lastAgentMessage.length > 0);
 }
 function parseCodexUsage(params, previous) {
-  const info = object2(params.tokenUsageInfo) ?? params;
-  const last = object2(info.last) ?? object2(info.lastTokenUsage) ?? object2(info.last_turn);
-  const total = object2(info.total) ?? object2(info.totalTokenUsage) ?? info;
+  const info = object3(params.tokenUsageInfo) ?? object3(params.tokenUsage) ?? object3(params.token_usage) ?? params;
+  const last = object3(info.last) ?? object3(info.lastTokenUsage) ?? object3(info.last_token_usage) ?? object3(info.last_turn);
+  const total = object3(info.total) ?? object3(info.totalTokenUsage) ?? object3(info.total_token_usage) ?? info;
   const resumed = Boolean(params.resumed ?? info.resumed ?? last);
   const spend = resumed && last ? last : total;
   const tokensIn = numberOf2(spend, "input_tokens", "inputTokens", "input") ?? previous?.tokensIn ?? 0;
   const tokensOut = numberOf2(spend, "output_tokens", "outputTokens", "output") ?? previous?.tokensOut ?? 0;
   const contextUsed = numberOf2(last ?? spend, "total_tokens", "totalTokens", "total") ?? tokensIn + tokensOut;
-  const contextWindow = numberOf2(params, "modelContextWindow", "contextWindow") ?? numberOf2(info, "modelContextWindow", "contextWindow") ?? previous?.contextWindow ?? 0;
+  const contextWindow = numberOf2(
+    params,
+    "modelContextWindow",
+    "contextWindow",
+    "model_context_window"
+  ) ?? numberOf2(
+    info,
+    "modelContextWindow",
+    "contextWindow",
+    "model_context_window"
+  ) ?? previous?.contextWindow ?? 0;
   const modelId = stringOf(params, "model", "modelId") ?? stringOf(info, "model", "modelId") ?? previous?.modelId ?? null;
-  return { tokensIn, tokensOut, contextUsed, contextWindow, modelId };
+  const cachedInputTokens = numberOf2(spend, "cached_input_tokens", "cachedInputTokens") ?? previous?.cachedInputTokens ?? null;
+  const reasoningEffort = stringOf(params, "reasoning_effort", "reasoningEffort") ?? stringOf(info, "reasoning_effort", "reasoningEffort") ?? previous?.reasoningEffort ?? null;
+  const rateLimits = parseRateLimitPayload(params);
+  const remainingAllowance = (rateLimits ? rateLimitRemainingFraction(rateLimits) : void 0) ?? previous?.remainingAllowance ?? null;
+  return {
+    tokensIn,
+    tokensOut,
+    contextUsed,
+    contextWindow,
+    modelId,
+    cachedInputTokens,
+    reasoningEffort,
+    remainingAllowance
+  };
 }
-function object2(value) {
+function rateLimitRemainingFraction(payload) {
+  let remaining;
+  for (const window of [payload.primary, payload.secondary]) {
+    if (!window) continue;
+    const fraction = Math.max(0, Math.min(100, 100 - window.usedPercent)) / 100;
+    remaining = remaining === void 0 ? fraction : Math.min(remaining, fraction);
+  }
+  return remaining;
+}
+function emptyCodexUsage() {
+  return {
+    tokensIn: 0,
+    tokensOut: 0,
+    contextUsed: 0,
+    contextWindow: 0,
+    modelId: null,
+    cachedInputTokens: null,
+    reasoningEffort: null,
+    remainingAllowance: null
+  };
+}
+function mergeCodexThreadStartUsage(started, previous) {
+  const normalized = parseCodexUsage(started, previous);
+  const modelIdentified = normalized.modelId !== (previous?.modelId ?? null);
+  const reasoningEffort = stringOf(started, "reasoning_effort", "reasoningEffort") ?? stringOf(
+    object3(started.thread) ?? {},
+    "reasoning_effort",
+    "reasoningEffort"
+  );
+  return reasoningEffort === void 0 && !modelIdentified ? previous : {
+    ...normalized,
+    reasoningEffort: reasoningEffort ?? normalized.reasoningEffort
+  };
+}
+function object3(value) {
   return value && typeof value === "object" ? value : void 0;
 }
 function numberOf2(obj, ...keys) {
-  for (const key of keys) if (typeof obj[key] === "number") return obj[key];
+  for (const key of keys)
+    if (typeof obj[key] === "number") return obj[key];
   return void 0;
 }
 function stringOf(obj, ...keys) {
-  for (const key of keys) if (typeof obj[key] === "string") return obj[key];
+  for (const key of keys)
+    if (typeof obj[key] === "string") return obj[key];
   return void 0;
 }
 function renderUsage(usage) {
@@ -2005,13 +2338,19 @@ function mapThreadItem(msg) {
   const type = String(msg.params?.type ?? msg.params?.itemType ?? method);
   const text2 = JSON.stringify({ method, type, id: msg.params?.id ?? null });
   if (/approval/i.test(type)) return { kind: "Approval", text: text2 };
-  if (/commandExecution|fileChange|contextCompaction|agentMessage|userMessage/i.test(type))
-    return { kind: /agentMessage|userMessage/i.test(type) ? "Raw" : "Parsed", text: text2 };
+  if (/commandExecution|fileChange|contextCompaction|agentMessage|userMessage/i.test(
+    type
+  ))
+    return {
+      kind: /agentMessage|userMessage/i.test(type) ? "Raw" : "Parsed",
+      text: text2
+    };
   return void 0;
 }
 function verdictForTelemetry(status) {
   if (status === "completed") return "pass";
-  if (status === "needs_approval" || status === "cancelled" || status === "canceled") return "blocked";
+  if (status === "needs_approval" || status === "cancelled" || status === "canceled")
+    return "blocked";
   return "soft-fail";
 }
 var CodexAppServer = class {
@@ -2026,10 +2365,14 @@ var CodexAppServer = class {
   onNotification;
   exited;
   cliVersion;
+  warnedZeroUsage = false;
   /** Spawn the child + initialize. Idempotent per instance. */
   async start() {
     if (this.child) return;
-    this.cliVersion ??= await pinCodexVersion(this.options.codexBin, this.options.log);
+    this.cliVersion ??= await pinCodexVersion(
+      this.options.codexBin,
+      this.options.log
+    );
     const child = spawn(this.options.codexBin, ["app-server", "--stdio"], {
       cwd: this.options.cwd,
       stdio: ["pipe", "pipe", "pipe"]
@@ -2037,7 +2380,9 @@ var CodexAppServer = class {
     this.child = child;
     child.on("exit", (code) => {
       this.exited = { code };
-      const failure = new Error(`codex app-server exited (${code ?? "signal"})`);
+      const failure = new Error(
+        `codex app-server exited (${code ?? "signal"})`
+      );
       for (const waiter of this.pending.values()) waiter.reject(failure);
       this.pending.clear();
     });
@@ -2057,6 +2402,15 @@ var CodexAppServer = class {
   get alive() {
     return this.child !== void 0 && this.exited === void 0;
   }
+  /** Read the same authenticated account + weekly capacity signal Codex panes render. */
+  async readAccountCapacitySignal() {
+    const timeoutMs = this.options.accountReadTimeoutMs ?? DEFAULT_ACCOUNT_READ_TIMEOUT_MS;
+    const [accountResponse, rateLimitsResponse] = await Promise.all([
+      this.request("account/read", {}, timeoutMs),
+      this.request("account/rateLimits/read", void 0, timeoutMs)
+    ]);
+    return { accountResponse, rateLimitsResponse };
+  }
   /**
    * Run one task as one thread+turn; resolves when the server reports
    * `turn/completed` (a server→client REQUEST, per the Looper-verified protocol),
@@ -2068,6 +2422,7 @@ var CodexAppServer = class {
     let threadId = "";
     let turnId = "";
     let usage;
+    let fileChangeCount = 0;
     const detailEvents = [];
     const modelId = this.options.model ?? null;
     const event = (kind, text2 = null) => ({
@@ -2088,20 +2443,40 @@ var CodexAppServer = class {
     this.onNotification = (msg) => {
       if (msg.method === "thread/tokenUsage/updated") {
         usage = parseCodexUsage(msg.params ?? {}, usage);
+        if (!this.warnedZeroUsage && usage.tokensIn === 0 && usage.tokensOut === 0 && usage.contextUsed === 0) {
+          this.warnedZeroUsage = true;
+          this.options.log(
+            `usage parsed all-zero \u2014 raw payload: ${JSON.stringify(msg.params ?? {}).slice(0, 400)}`
+          );
+        }
         this.options.log(renderUsage(usage));
         this.options.onUsage?.(telemetry?.taskId ?? "", usage);
         this.tapRateLimits(msg.params ?? {});
         return;
       }
+      if (msg.method && rateLimitMethod(msg.method)) {
+        const limits = parseRateLimitPayload(msg.params ?? {});
+        const allowance = limits ? rateLimitRemainingFraction(limits) : void 0;
+        if (allowance !== void 0) {
+          usage = {
+            ...usage ?? emptyCodexUsage(),
+            remainingAllowance: allowance
+          };
+        }
+      }
       const mapped = mapThreadItem(msg);
       if (mapped) detailEvents.push(event(mapped.kind, mapped.text));
+      if (/fileChange/i.test(
+        `${msg.method ?? ""} ${String(msg.params?.type ?? msg.params?.itemType ?? "")}`
+      ))
+        fileChangeCount += 1;
     };
-    const terminal = new Promise((resolve5) => {
+    const terminal = new Promise((resolve6) => {
       this.onServerRequest = (msg) => {
         const method = msg.method ?? "";
         if (terminalMethod(method)) {
           this.respond(msg.id, {});
-          resolve5("completed");
+          resolve6("completed");
           return;
         }
         if (method === "item/tool/call") {
@@ -2117,19 +2492,29 @@ var CodexAppServer = class {
             return;
           }
           if (name === "sechroom_lifecycle_signal") {
-            detailEvents.push(event("Parsed", `phase:${String(args.phase ?? "?")}:${String(args.status ?? "?")}`));
+            detailEvents.push(
+              event(
+                "Parsed",
+                `phase:${String(args.phase ?? "?")}:${String(args.status ?? "?")}`
+              )
+            );
             this.options.log(
               `lifecycle ${String(args.phase ?? "?")}:${String(args.status ?? "?")} \u2014 ${String(args.summary ?? "")}`
             );
             this.respond(msg.id, toolText("ok"));
             return;
           }
-          this.options.log(`unknown dynamic tool '${name}' \u2014 acknowledged empty`);
+          this.options.log(
+            `unknown dynamic tool '${name}' \u2014 acknowledged empty`
+          );
           this.respond(msg.id, toolText("unsupported tool"));
           return;
         }
         if (method.endsWith("requestApproval") || method.includes("elicitation")) {
-          detailEvents.push({ ...event("Approval", method), approvalState: "denied" });
+          detailEvents.push({
+            ...event("Approval", method),
+            approvalState: "denied"
+          });
           this.options.log(
             `approval requested (${method}) under approvalPolicy=never \u2014 DENIED (unattended run)`
           );
@@ -2148,6 +2533,7 @@ var CodexAppServer = class {
         developerInstructions: prompt,
         dynamicTools: dynamicToolDefinitions()
       });
+      usage = mergeCodexThreadStartUsage(started, usage);
       threadId = String(
         started.threadId ?? started.thread?.id ?? ""
       );
@@ -2200,11 +2586,14 @@ var CodexAppServer = class {
           timeout(this.options.resumeTurnTimeoutMs)
         ]);
       } catch (error) {
-        return { status: "crashed", reason: `thread resume failed: ${String(error)}` };
+        return {
+          status: "crashed",
+          reason: `thread resume failed: ${String(error)}`
+        };
       }
     }
     if (outcome === "timeout")
-      return packet ? { status: "completed", packet, lastAgentMessage } : { status: "timeout" };
+      return packet ? { status: "completed", packet, lastAgentMessage, fileChangeCount } : { status: "timeout" };
     if (outcome !== "completed")
       return { status: "crashed", reason: String(outcome) };
     if (!packet && threadId) {
@@ -2222,14 +2611,22 @@ var CodexAppServer = class {
       } catch {
       }
     }
-    await this.emitTurnTelemetry(telemetry, event, detailEvents, usage, packet).catch(
+    await this.emitTurnTelemetry(
+      telemetry,
+      event,
+      detailEvents,
+      usage,
+      packet
+    ).catch(
       (error) => this.options.log(`telemetry emit failed (non-fatal): ${String(error)}`)
     );
-    return { status: "completed", packet, lastAgentMessage };
+    return { status: "completed", packet, lastAgentMessage, fileChangeCount };
   }
   async emitTurnTelemetry(context, makeEvent, details, usage, packet) {
     if (!context?.decompositionId) {
-      this.options.log("telemetry absent: claimed task carried no wlp-decomposition tag");
+      this.options.log(
+        "telemetry absent: task is unmanaged or legacy dispatch attribution could not be resolved"
+      );
       return;
     }
     const verdict = verdictForTelemetry(packet?.terminal_status);
@@ -2240,6 +2637,9 @@ var CodexAppServer = class {
       contextUsed: usage?.contextUsed ?? null,
       contextWindow: usage?.contextWindow ?? null,
       modelId: usage?.modelId ?? this.options.model ?? null,
+      cachedInputTokens: usage?.cachedInputTokens ?? null,
+      reasoningEffort: usage?.reasoningEffort ?? null,
+      remainingAllowance: usage?.remainingAllowance ?? null,
       verdict
     };
     await this.options.emitTelemetry(
@@ -2258,19 +2658,47 @@ var CodexAppServer = class {
     this.child?.kill("SIGTERM");
     this.child = void 0;
   }
-  request(method, params) {
+  request(method, params, timeoutMs) {
     const child = this.child;
     if (!child || this.exited)
       return Promise.reject(new Error("codex app-server is not running"));
     const id = this.nextId++;
-    return new Promise((resolve5, reject) => {
-      this.pending.set(id, { resolve: resolve5, reject });
-      child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+    return new Promise((resolve6, reject) => {
+      let timer;
+      const clearTimer = () => {
+        if (timer) clearTimeout(timer);
+      };
+      const resolvePending = (value) => {
+        clearTimer();
+        resolve6(value);
+      };
+      const rejectPending = (error) => {
+        clearTimer();
+        reject(error);
+      };
+      this.pending.set(id, {
+        resolve: resolvePending,
+        reject: rejectPending
+      });
+      if (timeoutMs !== void 0) {
+        timer = setTimeout(() => {
+          if (!this.pending.delete(id)) return;
+          rejectPending(
+            new Error(
+              `codex app-server ${method} timed out after ${timeoutMs}ms`
+            )
+          );
+        }, timeoutMs);
+      }
+      const payload = params === void 0 ? { jsonrpc: "2.0", id, method } : { jsonrpc: "2.0", id, method, params };
+      child.stdin.write(JSON.stringify(payload) + "\n");
     });
   }
   respond(id, result) {
     if (id === void 0 || !this.child) return;
-    this.child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, result }) + "\n");
+    this.child.stdin.write(
+      JSON.stringify({ jsonrpc: "2.0", id, result }) + "\n"
+    );
   }
   onLine(line) {
     if (!line.trim()) return;
@@ -2295,7 +2723,8 @@ var CodexAppServer = class {
       this.onServerRequest?.(msg);
       return;
     }
-    if (msg.method && rateLimitMethod(msg.method)) this.tapRateLimits(msg.params ?? {});
+    if (msg.method && rateLimitMethod(msg.method))
+      this.tapRateLimits(msg.params ?? {});
     if (msg.method) this.onNotification?.(msg);
     if (msg.method && terminalMethod(msg.method)) {
       this.onServerRequest?.(msg);
@@ -2307,10 +2736,10 @@ var CodexAppServer = class {
     if (parsed) this.options.onRateLimits?.(parsed);
   }
   exitAsResult() {
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       this.child?.once(
         "exit",
-        (code) => resolve5(`app-server exited (${code ?? "signal"})`)
+        (code) => resolve6(`app-server exited (${code ?? "signal"})`)
       );
     });
   }
@@ -2335,7 +2764,9 @@ function terminalMethod(method) {
   return method === "turn/completed" || method.endsWith("/turn/completed");
 }
 function timeout(ms) {
-  return new Promise((resolve5) => setTimeout(() => resolve5("timeout"), ms).unref?.());
+  return new Promise(
+    (resolve6) => setTimeout(() => resolve6("timeout"), ms).unref?.()
+  );
 }
 function dynamicToolDefinitions() {
   return [
@@ -2374,12 +2805,16 @@ function dynamicToolDefinitions() {
 // src/executor-run/delivery.ts
 import { execFile as execFile2 } from "child_process";
 function createGitRunner(rootDir) {
-  return (bin, args) => new Promise((resolve5) => {
+  return (bin, args) => new Promise((resolve6) => {
     execFile2(
       bin,
       bin === "git" ? ["-C", rootDir, ...args] : args,
       { cwd: rootDir, maxBuffer: 10 * 1024 * 1024 },
-      (error, stdout, stderr) => resolve5({ ok: !error, stdout: String(stdout), stderr: String(stderr) })
+      (error, stdout, stderr) => resolve6({
+        ok: !error,
+        stdout: String(stdout),
+        stderr: String(stderr)
+      })
     );
   });
 }
@@ -2411,11 +2846,27 @@ async function checkRootReady(git, allowDirty) {
 async function deliverTurn(git, options) {
   const status = await git("git", ["status", "--porcelain"]);
   if (!status.ok)
-    return { delivered: false, note: `delivery skipped \u2014 git status failed: ${status.stderr.trim()}` };
+    return {
+      delivered: false,
+      note: `delivery skipped \u2014 git status failed: ${status.stderr.trim()}`
+    };
   const preDirty = new Set(options.snapshot.dirtyPaths);
-  const turnPaths = porcelainPaths(status.stdout).filter((p) => !preDirty.has(p));
-  if (turnPaths.length === 0)
-    return { delivered: false, note: "no file changes produced by the turn \u2014 nothing to deliver" };
+  const turnPaths = porcelainPaths(status.stdout).filter(
+    (p) => !preDirty.has(p)
+  );
+  if (turnPaths.length === 0) {
+    if ((options.turnFileChangeCount ?? 0) > 0) {
+      const toplevel = await git("git", ["rev-parse", "--show-toplevel"]);
+      const where = toplevel.ok ? toplevel.stdout.trim() : "(rev-parse failed)";
+      const diagnosis = `WRITE-VOID (FR-496 facet 4): turn emitted ${options.turnFileChangeCount} fileChange item(s) but the tree at ${where} is clean \u2014 the turn's writes landed somewhere else. Verify the executor's --root, the fleet entry root, and the codex thread cwd.`;
+      options.log(diagnosis);
+      return { delivered: false, note: diagnosis };
+    }
+    return {
+      delivered: false,
+      note: "no file changes produced by the turn \u2014 nothing to deliver"
+    };
+  }
   const branch = await freeBranchName(git, `task/${slug(options.taskId)}`);
   const created = await git("git", ["checkout", "-b", branch]);
   if (!created.ok)
@@ -2432,11 +2883,14 @@ async function deliverTurn(git, options) {
       "-m",
       commitMessage(options)
     ]);
-    if (!committed.ok) return failBack(`git commit failed: ${committed.stderr.trim()}`);
+    if (!committed.ok)
+      return failBack(`git commit failed: ${committed.stderr.trim()}`);
     const sha = (await git("git", ["rev-parse", "--short", "HEAD"])).stdout.trim();
     const pushed = await git("git", ["push", "-u", "origin", branch]);
     if (!pushed.ok)
-      notes.push(`push failed (${firstLine(pushed.stderr)}) \u2014 branch is local-only`);
+      notes.push(
+        `push failed (${firstLine(pushed.stderr)}) \u2014 branch is local-only`
+      );
     let prUrl;
     if (options.raisePr && pushed.ok) {
       const pr = await git("gh", [
@@ -2450,7 +2904,10 @@ async function deliverTurn(git, options) {
         prBody(options, sha)
       ]);
       if (pr.ok) prUrl = firstLine(pr.stdout);
-      else notes.push(`PR raise failed (${firstLine(pr.stderr)}) \u2014 raise manually from ${branch}`);
+      else
+        notes.push(
+          `PR raise failed (${firstLine(pr.stderr)}) \u2014 raise manually from ${branch}`
+        );
     }
     notes.unshift(
       `delivered ${turnPaths.length} path(s) to ${branch} @ ${sha}${prUrl ? ` \u2014 PR ${prUrl}` : ""}`
@@ -2498,85 +2955,6 @@ function firstLine(text2) {
   return text2.trim().split("\n")[0] ?? "";
 }
 
-// src/executor-run/request.ts
-var AuthExpiredError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AuthExpiredError";
-  }
-};
-var HttpError = class extends Error {
-  constructor(status, method, path, body) {
-    super(`${method} ${path} failed (${status}): ${body}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.body = body;
-    this.name = "HttpError";
-  }
-  status;
-  method;
-  path;
-  body;
-};
-function createAuthedRequest(cfg, deps = {}) {
-  const getToken = deps.getToken ?? requireToken;
-  const refresh = deps.refreshToken ?? forceRefreshToken;
-  const doFetch = deps.fetch ?? fetch;
-  const call = async (path, init, token) => doFetch(`${cfg.baseUrl}${path}`, {
-    ...init,
-    headers: {
-      authorization: `Bearer ${token}`,
-      tenant: cfg.tenant,
-      "content-type": "application/json",
-      "x-sechroom-surface": "cli",
-      ...init?.headers
-    }
-  });
-  return async (path, init) => {
-    const method = init?.method ?? "GET";
-    let token;
-    try {
-      token = await getToken(cfg);
-    } catch (error) {
-      throw new AuthExpiredError(
-        error instanceof Error ? error.message : String(error)
-      );
-    }
-    let response = await call(path, init, token);
-    if (response.status === 401) {
-      let fresh;
-      try {
-        fresh = await refresh(cfg);
-      } catch (error) {
-        throw new AuthExpiredError(
-          error instanceof Error ? error.message : String(error)
-        );
-      }
-      response = await call(path, init, fresh);
-      if (response.status === 401)
-        throw new AuthExpiredError(
-          `${method} ${path} still 401 after token refresh \u2014 re-authenticate (\`sechroom login\`).`
-        );
-    }
-    if (!response.ok)
-      throw new HttpError(
-        response.status,
-        method,
-        path,
-        await safeText(response)
-      );
-    return await response.json();
-  };
-}
-async function safeText(response) {
-  try {
-    return await response.text();
-  } catch {
-    return "";
-  }
-}
-
 // src/executor-run/driver.ts
 function verdictFor(terminalStatus) {
   switch (terminalStatus) {
@@ -2591,92 +2969,150 @@ function verdictFor(terminalStatus) {
       return "soft-fail";
   }
 }
+var DEFAULT_TRANSIENT_BACKOFF = {
+  baseMs: 2e3,
+  maxMs: 6e4,
+  maxConsecutive: 20
+};
+var BackoffCeilingExhaustedError = class extends Error {
+  constructor(attempts, lastError) {
+    super(
+      `driven executor exiting: ${attempts} consecutive API interruptions exhausted the backoff ceiling \u2014 last error: ${String(lastError)}`
+    );
+    this.attempts = attempts;
+    this.lastError = lastError;
+    this.name = "BackoffCeilingExhaustedError";
+  }
+  attempts;
+  lastError;
+};
 async function runDriverLoop(ports, options) {
-  const summary = { processed: 0, completed: 0, abandoned: 0 };
+  const summary = {
+    processed: 0,
+    completed: 0,
+    abandoned: 0
+  };
+  const backoff = { ...DEFAULT_TRANSIENT_BACKOFF, ...options.transientBackoff };
   let admissionDeferred = false;
+  let consecutiveTransient = 0;
   while (!options.stopping()) {
-    if (ports.checkAdmission) {
-      const admission = await ports.checkAdmission();
-      if (!admission.ok) {
-        admissionDeferred = true;
+    try {
+      if (ports.checkAdmission) {
+        const admission = await ports.checkAdmission();
+        if (!admission.ok) {
+          admissionDeferred = true;
+          ports.log(
+            `ADMISSION DEFERRED \u2014 not claiming: ${admission.reason ?? "usage budget exhausted"}`
+          );
+          await ports.waitForWake(options.pollMs);
+          continue;
+        }
+        if (admissionDeferred) {
+          admissionDeferred = false;
+          ports.log("admission recovered \u2014 resuming claims");
+        }
+      }
+      if (ports.checkRootReady) {
+        const ready = await ports.checkRootReady();
+        if (!ready.ok) {
+          ports.log(
+            `root not ready \u2014 not claiming: ${ready.reason ?? "unknown"}`
+          );
+          await ports.waitForWake(options.pollMs);
+          continue;
+        }
+      }
+      const claim = await ports.claimNext();
+      if (consecutiveTransient > 0) {
         ports.log(
-          `ADMISSION DEFERRED \u2014 not claiming: ${admission.reason ?? "usage budget exhausted"}`
+          `API reachable again after ${consecutiveTransient} interruption(s) \u2014 resuming`
         );
-        await ports.waitForWake(options.pollMs);
-        continue;
-      }
-      if (admissionDeferred) {
-        admissionDeferred = false;
-        ports.log("admission recovered \u2014 resuming claims");
+        consecutiveTransient = 0;
       }
-    }
-    if (ports.checkRootReady) {
-      const ready = await ports.checkRootReady();
-      if (!ready.ok) {
-        ports.log(`root not ready \u2014 not claiming: ${ready.reason ?? "unknown"}`);
+      if (!claim) {
         await ports.waitForWake(options.pollMs);
         continue;
       }
-    }
-    const claim = await ports.claimNext();
-    if (!claim) {
-      await ports.waitForWake(options.pollMs);
-      continue;
-    }
-    summary.processed++;
-    ports.log(`claimed ${claim.memoryId} (lease ${claim.leaseId})`);
-    const task = await ports.loadTask(claim.memoryId);
-    const stopHeartbeat = ports.startLeaseHeartbeat(claim);
-    let result;
-    try {
-      result = await ports.runTurn(task, claim);
-    } catch (e) {
-      if (e instanceof AuthExpiredError) throw e;
-      result = { status: "crashed", reason: String(e) };
-    } finally {
-      stopHeartbeat();
-    }
-    if (result.status === "crashed" || result.status === "timeout") {
-      summary.abandoned++;
-      ports.log(
-        `ABANDONED ${claim.memoryId}: ${result.status === "timeout" ? "turn timed out" : result.reason} \u2014 lease will expire and the task re-offers (work may re-run).`
-      );
-    } else {
-      const verdict = verdictFor(result.packet?.terminal_status);
-      let text2 = closeoutText(task, result);
-      if (ports.deliver) {
-        try {
-          const delivery = await ports.deliver(claim, task, verdict);
-          ports.log(`delivery: ${delivery.note}`);
-          text2 += `
+      summary.processed++;
+      ports.log(`claimed ${claim.memoryId} (lease ${claim.leaseId})`);
+      const task = await ports.loadTask(claim.memoryId);
+      const stopHeartbeat = ports.startLeaseHeartbeat(claim);
+      let result;
+      try {
+        result = await ports.runTurn(task, claim);
+      } catch (e) {
+        if (e instanceof AuthExpiredError) throw e;
+        result = { status: "crashed", reason: String(e) };
+      } finally {
+        stopHeartbeat();
+      }
+      if (result.status === "crashed" || result.status === "timeout") {
+        summary.abandoned++;
+        ports.log(
+          `ABANDONED ${claim.memoryId}: ${result.status === "timeout" ? "turn timed out" : result.reason} \u2014 lease will expire and the task re-offers (work may re-run).`
+        );
+      } else {
+        const verdict = verdictFor(result.packet?.terminal_status);
+        let text2 = closeoutText(task, result);
+        if (ports.deliver) {
+          try {
+            const delivery = await ports.deliver(
+              claim,
+              task,
+              verdict,
+              result.status === "completed" ? result.fileChangeCount ?? 0 : 0
+            );
+            ports.log(`delivery: ${delivery.note}`);
+            text2 += `
 
 Delivery: ${delivery.note}`;
-        } catch (e) {
-          if (e instanceof AuthExpiredError) throw e;
-          ports.log(`delivery threw (continuing to completion): ${String(e)}`);
-          text2 += `
+          } catch (e) {
+            if (e instanceof AuthExpiredError) throw e;
+            ports.log(
+              `delivery threw (continuing to completion): ${String(e)}`
+            );
+            text2 += `
 
 Delivery: FAILED unexpectedly (${String(e)}) \u2014 changes remain in the executor root.`;
+          }
+        }
+        try {
+          const done = await ports.completeLease(
+            claim,
+            verdict,
+            text2,
+            `${task.title} \u2014 driven closeout`
+          );
+          summary.completed++;
+          ports.log(
+            `completed ${claim.memoryId} verdict:${verdict} \u2192 ${done.completionMemoryId ?? done.outcome}`
+          );
+        } catch (e) {
+          if (e instanceof AuthExpiredError) throw e;
+          summary.abandoned++;
+          ports.log(
+            `COMPLETE REJECTED for ${claim.memoryId} (${String(e)}) \u2014 task will re-offer; investigate the heartbeat gap.`
+          );
         }
       }
-      try {
-        const done = await ports.completeLease(
-          claim,
-          verdict,
-          text2,
-          `${task.title} \u2014 driven closeout`
-        );
-        summary.completed++;
-        ports.log(
-          `completed ${claim.memoryId} verdict:${verdict} \u2192 ${done.completionMemoryId ?? done.outcome}`
-        );
-      } catch (e) {
-        if (e instanceof AuthExpiredError) throw e;
-        summary.abandoned++;
+    } catch (e) {
+      if (e instanceof AuthExpiredError) throw e;
+      consecutiveTransient++;
+      if (consecutiveTransient > backoff.maxConsecutive) {
         ports.log(
-          `COMPLETE REJECTED for ${claim.memoryId} (${String(e)}) \u2014 task will re-offer; investigate the heartbeat gap.`
+          `FATAL: ${backoff.maxConsecutive} consecutive API interruptions exhausted the backoff ceiling \u2014 deregistering and exiting (loud). Last error: ${String(e)}`
         );
+        throw new BackoffCeilingExhaustedError(backoff.maxConsecutive, e);
       }
+      const delay = Math.min(
+        backoff.baseMs * 2 ** (consecutiveTransient - 1),
+        backoff.maxMs
+      );
+      ports.log(
+        `API interruption (${consecutiveTransient}/${backoff.maxConsecutive}) \u2014 backing off ${delay}ms and continuing: ${String(e)}`
+      );
+      await ports.waitForWake(delay);
+      continue;
     }
     if (options.once) break;
   }
@@ -2709,8 +3145,152 @@ function startLeaseHeartbeat(beat, log, intervalMs = 3e4, timers = {}) {
 
 // src/executor-run/fleet.ts
 import { spawn as spawn2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import {
+  closeSync,
+  mkdirSync as mkdirSync6,
+  openSync,
+  readFileSync as readFileSync4,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync5
+} from "fs";
 import { readFile } from "fs/promises";
-import { resolve } from "path";
+import {
+  createConnection,
+  createServer as createServer2
+} from "net";
+import { tmpdir } from "os";
+import { dirname as dirname4, join as join6, resolve } from "path";
+var DEFAULT_RESTART_POLICY = {
+  enabled: true,
+  maxRetries: 10,
+  backoffMs: 1e3,
+  maxBackoffMs: 3e4,
+  resetAfterMs: 6e4
+};
+var MAX_ROUTE_LOG_ENTRIES = 1e3;
+var MAX_EARLY_UNROUTED_RESERVATIONS = 1e3;
+function createFleetChildRouteInbox(options) {
+  let ready = false;
+  let pending;
+  let activeRoute;
+  const releasedClaims = /* @__PURE__ */ new Set();
+  const report = () => {
+    if (!options.enabled) return;
+    options.send({
+      type: "fleet-child-routing-status",
+      instanceKey: options.instanceKey,
+      instanceId: options.instanceId,
+      ...options.localStatus(),
+      ready
+    });
+  };
+  const finish = (claim) => {
+    const active2 = pending;
+    if (!active2) return;
+    clearTimeout(active2.windowTimer);
+    if (active2.reservationTimer) clearTimeout(active2.reservationTimer);
+    pending = void 0;
+    ready = false;
+    report();
+    active2.resolve(claim);
+  };
+  const onMessage = (raw) => {
+    if (!raw || typeof raw !== "object") return;
+    const message = raw;
+    if (message.type === "fleet-route-release" && typeof message.reservationId === "string") {
+      if (pending && message.reservationId === pending.reservationId) {
+        finish(void 0);
+        return;
+      }
+      if (activeRoute && message.reservationId === activeRoute.reservationId) {
+        const reason = message.reason ?? "route released by fleet node";
+        releasedClaims.add(activeRoute.leaseId);
+        options.onClaimRelease?.(activeRoute.leaseId, reason);
+        activeRoute = void 0;
+      }
+      return;
+    }
+    if (!pending) return;
+    if (message.type === "fleet-route-reserve" && typeof message.reservationId === "string" && typeof message.generationId === "string" && ready && !pending.reservationId) {
+      clearTimeout(pending.windowTimer);
+      ready = false;
+      pending.reservationId = message.reservationId;
+      report();
+      options.send({
+        type: "fleet-route-reserved",
+        instanceKey: options.instanceKey,
+        reservationId: message.reservationId
+      });
+      pending.reservationTimer = setTimeout(() => {
+        options.send({
+          type: "fleet-route-unrouted",
+          instanceKey: options.instanceKey,
+          reservationId: message.reservationId,
+          reason: "reservation orphaned before claim mint began"
+        });
+        finish(void 0);
+      }, options.orphanReservationTimeoutMs ?? 1e4);
+      pending.reservationTimer.unref?.();
+      return;
+    }
+    if (message.type === "fleet-route-claiming" && typeof message.reservationId === "string" && message.reservationId === pending.reservationId) {
+      if (pending.reservationTimer) clearTimeout(pending.reservationTimer);
+      pending.reservationTimer = setTimeout(() => {
+        options.send({
+          type: "fleet-route-unrouted",
+          instanceKey: options.instanceKey,
+          reservationId: message.reservationId,
+          reason: "claim mint window expired before handoff"
+        });
+        finish(void 0);
+      }, options.claimMintTimeoutMs ?? 6e4);
+      pending.reservationTimer.unref?.();
+      return;
+    }
+    if (message.type === "fleet-route-claim" && typeof message.reservationId === "string" && message.reservationId === pending.reservationId && message.claim) {
+      activeRoute = {
+        reservationId: message.reservationId,
+        leaseId: message.claim.leaseId
+      };
+      options.send({
+        type: "fleet-route-claim-accepted",
+        instanceKey: options.instanceKey,
+        reservationId: message.reservationId,
+        leaseId: message.claim.leaseId
+      });
+      finish(message.claim);
+      return;
+    }
+  };
+  if (options.enabled) options.subscribe(onMessage);
+  return {
+    report,
+    waitForClaim() {
+      if (!options.enabled) return Promise.resolve(void 0);
+      if (pending)
+        throw new Error("fleet child already has a pending route window");
+      activeRoute = void 0;
+      ready = true;
+      return new Promise((resolvePromise) => {
+        const windowTimer = setTimeout(
+          () => finish(void 0),
+          options.routeWindowMs ?? 1e3
+        );
+        windowTimer.unref?.();
+        pending = { resolve: resolvePromise, windowTimer };
+        report();
+      });
+    },
+    consumeClaimRelease(leaseId) {
+      return releasedClaims.delete(leaseId);
+    },
+    close() {
+      finish(void 0);
+      if (options.enabled) options.unsubscribe(onMessage);
+    }
+  };
+}
 async function readFleetConfig(path) {
   const parsed = JSON.parse(
     await readFile(resolve(path), "utf8")
@@ -2736,7 +3316,7 @@ async function readFleetConfig(path) {
   }
   return parsed;
 }
-function entryArgs(entry, parentId) {
+function entryArgs(entry, parentId, activationMode) {
   const args = [
     "executor",
     "run",
@@ -2749,6 +3329,8 @@ function entryArgs(entry, parentId) {
     if (v !== void 0) args.push(flag, String(v));
   };
   value("--parent-id", parentId);
+  if (parentId) args.push("--fleet-child");
+  if (activationMode === "Detached") args.push("--activation-mode", "detached");
   value("--lane", entry.lane);
   value("--model", entry.model);
   value("--connector", entry.connector);
@@ -2761,13 +3343,31 @@ function entryArgs(entry, parentId) {
   value("--codex-bin", entry.codexBin);
   value("--sandbox", entry.sandbox);
   value("--usage-reserve", entry.usageReserve);
+  if (entry.excludeTags?.length)
+    args.push("--exclude-tag", ...entry.excludeTags);
   return args;
 }
 function superviseFleet(config2, options = {}) {
   const log = options.log ?? ((line) => process.stderr.write(`${line}
 `));
+  const now = options.now ?? (() => Date.now());
+  const scheduleRestart = options.scheduleRestart ?? ((run, ms) => {
+    const timer = setTimeout(run, ms);
+    timer.unref?.();
+    return { cancel: () => clearTimeout(timer) };
+  });
   const states = /* @__PURE__ */ new Map();
   const children = /* @__PURE__ */ new Map();
+  const restartCounts = /* @__PURE__ */ new Map();
+  const startedAt = /* @__PURE__ */ new Map();
+  const pendingRestarts = /* @__PURE__ */ new Map();
+  const routingStatus = /* @__PURE__ */ new Map();
+  const routeLog = /* @__PURE__ */ new Set();
+  const pendingReservations = /* @__PURE__ */ new Map();
+  const pendingHandoffs = /* @__PURE__ */ new Map();
+  const earlyUnroutedReservations = /* @__PURE__ */ new Map();
+  const routedLeases = /* @__PURE__ */ new Map();
+  const intentionalRestart = /* @__PURE__ */ new Set();
   let stopping = false;
   let resolveDone;
   const done = new Promise((resolvePromise) => {
@@ -2776,109 +3376,938 @@ function superviseFleet(config2, options = {}) {
   const status = () => log(
     `[fleet] ${[...states].map(([key, state]) => `${key}=${state}`).join(" ")}`
   );
+  const policyFor = (entry) => ({
+    ...DEFAULT_RESTART_POLICY,
+    ...config2.restart,
+    ...entry.restart
+  });
+  const isTerminal = (state) => state === "exited" || state === "failed";
+  const maybeResolveDone = () => {
+    if ([...states.values()].every(isTerminal)) resolveDone();
+  };
   const spawnEntry = options.spawnEntry ?? ((entry, args) => {
     const script = process.argv[1];
     if (!script) throw new Error("cannot locate the sechroom CLI entrypoint");
     return spawn2(process.execPath, [script, ...args], {
       cwd: resolve(entry.root),
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: options.parentId ? ["ignore", "pipe", "pipe", "ipc"] : ["ignore", "pipe", "pipe"],
       env: process.env
     });
   });
-  for (const entry of config2.instances) {
-    const child = spawnEntry(entry, entryArgs(entry, options.parentId));
-    children.set(entry.instanceKey, child);
-    states.set(entry.instanceKey, "live");
+  const isChildMessage = (message) => {
+    if (!message || typeof message !== "object") return false;
+    const value = message;
+    if (value.type === "fleet-route-reserved" && typeof value.instanceKey === "string" && typeof value.reservationId === "string")
+      return true;
+    if (value.type === "fleet-route-claim-accepted" && typeof value.instanceKey === "string" && typeof value.reservationId === "string" && typeof value.leaseId === "string")
+      return true;
+    if (value.type === "fleet-route-unrouted" && typeof value.instanceKey === "string" && typeof value.reservationId === "string" && typeof value.reason === "string")
+      return true;
+    if (value.type !== "fleet-child-routing-status") return false;
+    const admission = value.admission;
+    return typeof value.instanceKey === "string" && typeof value.instanceId === "string" && typeof value.advertisementExpiresAtMs === "number" && typeof value.ready === "boolean" && !!admission && typeof admission.ok === "boolean" && (admission.reason === void 0 || typeof admission.reason === "string");
+  };
+  const recordMessage = (key, child, message) => {
+    if (children.get(key) !== child) return;
+    if (!isChildMessage(message) || message.instanceKey !== key) return;
+    if (message.type === "fleet-child-routing-status") {
+      routingStatus.set(key, message);
+      if (message.ready) {
+        for (const [leaseId, routed2] of routedLeases) {
+          if (routed2.instanceKey === key && routed2.state === "running")
+            routedLeases.delete(leaseId);
+        }
+      }
+      options.onRoutingSignal?.();
+      return;
+    }
+    if (message.type === "fleet-route-reserved") {
+      const pending2 = pendingReservations.get(message.reservationId);
+      if (!pending2 || pending2.instanceKey !== key) return;
+      pendingReservations.delete(message.reservationId);
+      pending2.resolve(true);
+      return;
+    }
+    if (message.type === "fleet-route-unrouted") {
+      let matched = false;
+      const pending2 = pendingHandoffs.get(message.reservationId);
+      if (pending2?.instanceKey === key) {
+        pendingHandoffs.delete(message.reservationId);
+        pending2.resolve("confirmed-unrouted");
+        matched = true;
+      }
+      for (const [leaseId, routed2] of routedLeases) {
+        if (routed2.instanceKey !== key || routed2.reservationId !== message.reservationId)
+          continue;
+        routedLeases.delete(leaseId);
+        matched = true;
+        routed2.releasePromise = routed2.release(
+          routed2.claim,
+          `fleet child confirmed route was not accepted: ${message.reason}`
+        );
+      }
+      const senderStatus = routingStatus.get(key);
+      const separator = message.reservationId.lastIndexOf(":");
+      const reservationInstanceId = separator >= 0 ? message.reservationId.slice(separator + 1) : void 0;
+      if (!matched && senderStatus && reservationInstanceId === senderStatus.instanceId) {
+        if (earlyUnroutedReservations.size >= MAX_EARLY_UNROUTED_RESERVATIONS) {
+          const oldest = earlyUnroutedReservations.keys().next();
+          if (!oldest.done) earlyUnroutedReservations.delete(oldest.value);
+        }
+        earlyUnroutedReservations.set(message.reservationId, {
+          instanceKey: key,
+          reason: message.reason
+        });
+      }
+      return;
+    }
+    const pending = pendingHandoffs.get(message.reservationId);
+    if (!pending || pending.instanceKey !== key || pending.leaseId !== message.leaseId)
+      return;
+    pendingHandoffs.delete(message.reservationId);
+    const routed = routedLeases.get(message.leaseId);
+    if (routed) routed.state = "running";
+    pending.resolve("accepted");
+  };
+  const start = (entry) => {
+    const key = entry.instanceKey;
+    const child = spawnEntry(
+      entry,
+      entryArgs(entry, options.parentId, options.activationMode)
+    );
+    children.set(key, child);
+    states.set(key, "live");
+    startedAt.set(key, now());
     const prefix = (text2) => {
       for (const line of text2.replace(/\n$/, "").split("\n"))
-        log(`[${entry.instanceKey}] ${line}`);
+        log(`[${key}] ${line}`);
     };
     const concrete = child;
     concrete.stdout?.on("data", (chunk) => prefix(String(chunk)));
     concrete.stderr?.on("data", (chunk) => prefix(String(chunk)));
-    child.on("exit", (code, signal) => {
-      states.set(entry.instanceKey, "exited");
-      log(`[${entry.instanceKey}] exited (${signal ?? code ?? "unknown"})`);
+    child.on("message", (message) => recordMessage(key, child, message));
+    child.on("exit", (code, signal) => handleExit(entry, code, signal));
+  };
+  const handleExit = (entry, code, signal) => {
+    const key = entry.instanceKey;
+    const reason = signal ?? code ?? "unknown";
+    routingStatus.delete(key);
+    for (const [reservationId, pending] of pendingReservations) {
+      if (pending.instanceKey !== key) continue;
+      pendingReservations.delete(reservationId);
+      pending.resolve(false);
+    }
+    for (const [reservationId, pending] of pendingHandoffs) {
+      if (pending.instanceKey !== key) continue;
+      pendingHandoffs.delete(reservationId);
+      pending.resolve("child-exited");
+    }
+    for (const [reservationId, unrouted] of earlyUnroutedReservations) {
+      if (unrouted.instanceKey === key)
+        earlyUnroutedReservations.delete(reservationId);
+    }
+    for (const [leaseId, routed] of routedLeases) {
+      if (routed.instanceKey !== key) continue;
+      routedLeases.delete(leaseId);
+      routed.releasePromise = routed.release(
+        routed.claim,
+        "fleet child exited while holding routed claim"
+      );
+    }
+    options.onRoutingSignal?.();
+    if (intentionalRestart.has(key)) {
+      intentionalRestart.delete(key);
+      if (stopping) {
+        states.set(key, "exited");
+        log(`[${key}] exited (${reason}) \u2014 drained during restart`);
+        status();
+        maybeResolveDone();
+        return;
+      }
+      restartCounts.set(key, 0);
+      log(`[${key}] exited (${reason}) \u2014 restarting on request`);
+      start(entry);
+      status();
+      return;
+    }
+    if (stopping || states.get(key) === "stopping") {
+      states.set(key, "exited");
+      log(`[${key}] exited (${reason})`);
+      status();
+      maybeResolveDone();
+      return;
+    }
+    const policy = policyFor(entry);
+    if (!policy.enabled) {
+      states.set(key, "exited");
+      log(`[${key}] exited (${reason}) \u2014 restart disabled`);
+      status();
+      maybeResolveDone();
+      return;
+    }
+    const uptime = now() - (startedAt.get(key) ?? now());
+    if (uptime >= policy.resetAfterMs) restartCounts.set(key, 0);
+    const count = (restartCounts.get(key) ?? 0) + 1;
+    if (count > policy.maxRetries) {
+      states.set(key, "failed");
+      log(
+        `[${key}] exited (${reason}) \u2014 restart budget exhausted after ${policy.maxRetries} retries; leaving it DOWN. Restart the supervisor to revive it.`
+      );
+      status();
+      maybeResolveDone();
+      return;
+    }
+    restartCounts.set(key, count);
+    const delay = Math.min(
+      policy.backoffMs * 2 ** (count - 1),
+      policy.maxBackoffMs
+    );
+    states.set(key, "restarting");
+    log(
+      `[${key}] exited (${reason}) \u2014 restart ${count}/${policy.maxRetries} in ${delay}ms`
+    );
+    status();
+    const timer = scheduleRestart(() => {
+      pendingRestarts.delete(key);
+      if (stopping) {
+        states.set(key, "exited");
+        maybeResolveDone();
+        return;
+      }
+      log(`[${key}] restarting (attempt ${count})`);
+      start(entry);
+      status();
+    }, delay);
+    pendingRestarts.set(key, timer);
+  };
+  const snapshot = () => [...states].map(([instanceKey, state]) => ({
+    instanceKey,
+    state,
+    pid: state === "live" ? children.get(instanceKey)?.pid ?? null : null,
+    restarts: restartCounts.get(instanceKey) ?? 0
+  }));
+  const restartChild = (instanceKey) => {
+    const entry = config2.instances.find((e) => e.instanceKey === instanceKey);
+    if (!entry || !states.has(instanceKey))
+      return { ok: false, error: `unknown instanceKey '${instanceKey}'` };
+    if (stopping) return { ok: false, error: "supervisor is shutting down" };
+    if (intentionalRestart.has(instanceKey))
+      return { ok: true, message: "restart already in progress" };
+    const pending = pendingRestarts.get(instanceKey);
+    if (pending) {
+      pending.cancel();
+      pendingRestarts.delete(instanceKey);
+    }
+    if (states.get(instanceKey) === "live") {
+      intentionalRestart.add(instanceKey);
+      states.set(instanceKey, "restarting");
+      children.get(instanceKey)?.kill("SIGINT");
       status();
-      if ([...states.values()].every((state) => state === "exited"))
-        resolveDone();
+      return { ok: true, message: "signalled for graceful restart" };
+    }
+    restartCounts.set(instanceKey, 0);
+    start(entry);
+    status();
+    return { ok: true, message: "revived" };
+  };
+  const logRouteOnce = (offer, outcome, line) => {
+    const key = `${offer.generationId}:${outcome}:${line}`;
+    if (routeLog.has(key)) return;
+    if (routeLog.size >= MAX_ROUTE_LOG_ENTRIES) routeLog.clear();
+    routeLog.add(key);
+    log(`[router] ${line}`);
+  };
+  const sendToChild = (child, message) => {
+    if (!child.send) return Promise.resolve(false);
+    return new Promise((resolvePromise) => {
+      try {
+        child.send(message, (error) => resolvePromise(!error));
+      } catch {
+        resolvePromise(false);
+      }
     });
-  }
+  };
+  const releaseReservation = (child, reservationId, reason) => {
+    if (child)
+      void sendToChild(child, {
+        type: "fleet-route-release",
+        reservationId,
+        reason
+      });
+  };
+  const reserve = async (child, instanceKey, generationId, reservationId) => {
+    if (!child.send) return false;
+    const acknowledged = new Promise((resolvePromise) => {
+      pendingReservations.set(reservationId, {
+        instanceKey,
+        resolve: resolvePromise
+      });
+    });
+    const sent = await sendToChild(child, {
+      type: "fleet-route-reserve",
+      reservationId,
+      generationId
+    });
+    if (!sent) {
+      pendingReservations.delete(reservationId);
+      return false;
+    }
+    const timeoutMs = options.reserveAckTimeoutMs ?? 1e3;
+    let timer;
+    const timedOut = new Promise((resolvePromise) => {
+      timer = setTimeout(() => resolvePromise(false), timeoutMs);
+    });
+    let accepted;
+    try {
+      accepted = await Promise.race([acknowledged, timedOut]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    if (!accepted) pendingReservations.delete(reservationId);
+    if (!accepted) return false;
+    return sendToChild(child, {
+      type: "fleet-route-claiming",
+      reservationId
+    });
+  };
+  const handoff = async (child, instanceKey, reservationId, claim) => {
+    if (!child.send) return "not-sent";
+    let acknowledgedOutcome;
+    const acknowledged = new Promise((resolvePromise) => {
+      pendingHandoffs.set(reservationId, {
+        instanceKey,
+        leaseId: claim.leaseId,
+        resolve: (outcome) => {
+          acknowledgedOutcome = outcome;
+          resolvePromise(outcome);
+        }
+      });
+    });
+    const sent = await sendToChild(child, {
+      type: "fleet-route-claim",
+      reservationId,
+      claim
+    });
+    if (!sent) {
+      return acknowledgedOutcome ?? "not-sent";
+    }
+    const timeoutMs = options.handoffTimeoutMs ?? 3e4;
+    let timer;
+    const timedOut = new Promise((resolvePromise) => {
+      timer = setTimeout(() => resolvePromise("timed-out"), timeoutMs);
+    });
+    try {
+      return await Promise.race([acknowledged, timedOut]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  const routeOffer = async (offer, claim, release) => {
+    const suggestedKey = offer.suggestedChildInstanceKey;
+    const suggestedId = offer.suggestedChildInstanceId;
+    const rationale = offer.suggestedChildRationale;
+    const rationaleText = routingRationaleText(rationale);
+    if (!suggestedKey || !suggestedId) {
+      logRouteOnce(
+        offer,
+        "no-suggestion",
+        `${offer.memoryId}: server supplied no child suggestion (${rationaleText}); no client fallback guessed`
+      );
+      return "no-suggestion";
+    }
+    if (!options.parentId || !config2.instances.some((x) => x.instanceKey === suggestedKey)) {
+      logRouteOnce(
+        offer,
+        "not-enrolled",
+        `${offer.memoryId}: selected child ${suggestedKey} is not enrolled under this node; sibling offers remain claimable`
+      );
+      return "not-enrolled";
+    }
+    if (states.get(suggestedKey) !== "live") {
+      logRouteOnce(
+        offer,
+        "not-live",
+        `${offer.memoryId}: selected child ${suggestedKey} is not locally live; sibling offers remain claimable`
+      );
+      return "not-live";
+    }
+    if ([...routedLeases.values()].some(
+      (routed) => routed.instanceKey === suggestedKey && routed.state === "handoff-pending"
+    )) {
+      logRouteOnce(
+        offer,
+        "not-ready",
+        `${offer.memoryId}: selected child ${suggestedKey} still has an unresolved routed handoff; refusing another proxy claim`
+      );
+      return "not-ready";
+    }
+    const status2 = routingStatus.get(suggestedKey);
+    if (!status2 || status2.instanceId !== suggestedId || status2.advertisementExpiresAtMs <= now()) {
+      logRouteOnce(
+        offer,
+        "stale-suggestion",
+        `${offer.memoryId}: selected child ${suggestedKey}/${suggestedId} is stale or no longer advertised; refusing proxy claim`
+      );
+      return "stale-suggestion";
+    }
+    if (!status2.admission.ok) {
+      logRouteOnce(
+        offer,
+        "admission-deferred",
+        `${offer.memoryId}: ADMISSION DEFERRED for selected child ${suggestedKey} \u2014 ${status2.admission.reason ?? "usage budget exhausted"}; sibling offers remain claimable`
+      );
+      return "admission-deferred";
+    }
+    if (!status2.ready) {
+      logRouteOnce(
+        offer,
+        "not-ready",
+        `${offer.memoryId}: selected child ${suggestedKey} is live but not ready for a new route; sibling offers remain claimable`
+      );
+      return "not-ready";
+    }
+    const child = children.get(suggestedKey);
+    if (!child) {
+      logRouteOnce(
+        offer,
+        "not-live",
+        `${offer.memoryId}: selected child ${suggestedKey} has no live process handle; sibling offers remain claimable`
+      );
+      return "not-live";
+    }
+    const reservationId = `${offer.generationId}:${suggestedId}`;
+    if (!await reserve(child, suggestedKey, offer.generationId, reservationId)) {
+      releaseReservation(
+        child,
+        reservationId,
+        "reservation acknowledgement timed out"
+      );
+      logRouteOnce(
+        offer,
+        "reservation-refused",
+        `${offer.memoryId}: selected child ${suggestedKey} did not reserve the route; no proxy claim made`
+      );
+      return "reservation-refused";
+    }
+    let routedClaim;
+    let earlyUnrouted;
+    try {
+      const reservedStatus = routingStatus.get(suggestedKey);
+      if (states.get(suggestedKey) !== "live" || !reservedStatus || reservedStatus.instanceId !== suggestedId || reservedStatus.advertisementExpiresAtMs <= now()) {
+        releaseReservation(child, reservationId, "stale after reservation");
+        return "stale-suggestion";
+      }
+      try {
+        routedClaim = await claim(offer, suggestedId);
+      } finally {
+        earlyUnrouted = earlyUnroutedReservations.get(reservationId);
+        earlyUnroutedReservations.delete(reservationId);
+      }
+      if (!routedClaim) {
+        releaseReservation(child, reservationId, "proxy claim lost");
+        logRouteOnce(
+          offer,
+          "claim-lost",
+          `${offer.memoryId}: proxy claim lost before handoff; child ${suggestedKey} released to ordinary polling`
+        );
+        return "claim-lost";
+      }
+      if (earlyUnrouted?.instanceKey === suggestedKey) {
+        const released2 = await release(
+          routedClaim,
+          `fleet child confirmed route was not accepted before proxy claim completed: ${earlyUnrouted.reason}`
+        );
+        logRouteOnce(
+          offer,
+          "handoff-failed",
+          `${offer.memoryId}: child ${suggestedKey} closed reservation ${reservationId} as unrouted before proxy claim ${routedClaim.leaseId} returned; ${released2 ? "lease released and task re-offered" : "lease release failed \u2014 operator recovery required"}`
+        );
+        return "handoff-failed";
+      }
+      if (states.get(suggestedKey) !== "live" || children.get(suggestedKey) !== child) {
+        const released2 = await release(
+          routedClaim,
+          "fleet child exited while proxy claim was in flight"
+        );
+        logRouteOnce(
+          offer,
+          "handoff-failed",
+          `${offer.memoryId}: node-held lease ${routedClaim.leaseId} has no live runner (child-exited); ${released2 ? "lease released and task re-offered" : "lease release failed \u2014 operator recovery required"}`
+        );
+        return "handoff-failed";
+      }
+      const routedLease = {
+        instanceKey: suggestedKey,
+        reservationId,
+        claim: routedClaim,
+        state: "handoff-pending",
+        release
+      };
+      routedLeases.set(routedClaim.leaseId, routedLease);
+      const handoffOutcome = await handoff(
+        child,
+        suggestedKey,
+        reservationId,
+        routedClaim
+      );
+      if (handoffOutcome === "accepted") {
+        log(
+          `[router] routed ${offer.memoryId} generation ${offer.generationId} \u2192 ${suggestedKey}/${suggestedId} via ${rationaleText} (node-held lease ${routedClaim.leaseId})`
+        );
+        return "routed";
+      }
+      if (handoffOutcome === "timed-out" || handoffOutcome === "not-sent") {
+        logRouteOnce(
+          offer,
+          "handoff-failed",
+          `${offer.memoryId}: IPC handoff acknowledgement/delivery for node-held lease ${routedClaim.leaseId} is still unknown (${handoffOutcome}); lease retained because child ${suggestedKey} may already be running it`
+        );
+        return "handoff-failed";
+      }
+      routedLeases.delete(routedClaim.leaseId);
+      const released = handoffOutcome === "child-exited" || handoffOutcome === "confirmed-unrouted" ? await (routedLease.releasePromise ?? release(routedClaim, "fleet child exited during claim handoff")) : await release(routedClaim, "fleet claim handoff was not delivered");
+      logRouteOnce(
+        offer,
+        "handoff-failed",
+        `${offer.memoryId}: node-held lease ${routedClaim.leaseId} has no live runner (${handoffOutcome}); ${released ? "lease released and task re-offered" : "lease release failed \u2014 operator recovery required"}`
+      );
+      return "handoff-failed";
+    } catch (error) {
+      releaseReservation(child, reservationId, "proxy claim failed");
+      throw error;
+    }
+  };
+  for (const entry of config2.instances) start(entry);
   status();
   return {
     done,
+    snapshot,
+    restartChild,
+    routeOffer,
+    routingStatus,
     shutdown(signal = "SIGINT") {
       if (stopping) return done;
       stopping = true;
+      for (const [key, timer] of pendingRestarts) {
+        timer.cancel();
+        if (!isTerminal(states.get(key))) states.set(key, "exited");
+      }
+      pendingRestarts.clear();
       for (const [key, child] of children) {
-        if (states.get(key) !== "exited") {
+        if (states.get(key) === "live") {
           states.set(key, "stopping");
           child.kill(signal);
         }
       }
       status();
+      maybeResolveDone();
       return done;
     },
-    states
+    states,
+    restartCounts
+  };
+}
+function routingRationaleText(rationale) {
+  if (!rationale) return "no rationale";
+  return `rule ${rationale.ruleId}, reason ${rationale.reasonCode}, preference ${rationale.preference}, eligible children ${rationale.eligibleChildCount}`;
+}
+function startNodeOfferRouter(options) {
+  const log = options.log ?? ((line) => process.stderr.write(`${line}
+`));
+  const pollMs = options.pollMs ?? 5e3;
+  let stopping = false;
+  let wake = () => {
+  };
+  const wait = () => new Promise((resolvePromise) => {
+    const timer = setTimeout(resolvePromise, pollMs);
+    timer.unref?.();
+    wake = () => {
+      clearTimeout(timer);
+      resolvePromise();
+    };
+  });
+  const claim = async (offer, childInstanceId) => {
+    const result = await options.request(
+      "/me/executor-task-proxy-claims",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          generationId: offer.generationId,
+          nodeInstanceId: options.nodeId,
+          proxiedForInstanceId: childInstanceId
+        })
+      }
+    );
+    if (!SUCCESS.has(result.outcome) || !result.lease || result.lease.executorInstanceId !== options.nodeId || result.lease.proxiedForInstanceId !== childInstanceId) {
+      log(
+        `node proxy claim for ${offer.memoryId} returned ${result.outcome}${result.reason ? ` (${result.reason})` : ""}; leaving child offers to reconcile`
+      );
+      return void 0;
+    }
+    const claimed = toClaimed(result, result.tokenVersion ?? 1);
+    if (!claimed) {
+      log(
+        `node proxy claim for ${offer.memoryId} returned ${result.outcome} without re-issued holder proof; retaining the existing lease and re-polling`
+      );
+      return void 0;
+    }
+    return {
+      memoryId: claimed.memoryId,
+      leaseId: claimed.leaseId,
+      claimToken: claimed.claimToken,
+      tokenVersion: claimed.tokenVersion,
+      executorInstanceId: options.nodeId,
+      decompositionId: claimed.decompositionId
+    };
+  };
+  const releaseByTask = async (memoryId, reason) => {
+    try {
+      await options.request(
+        `/work-executors/tasks/${encodeURIComponent(memoryId)}/force-re-offer`,
+        { method: "POST", body: JSON.stringify({}) }
+      );
+      log(
+        `released node-held claim for ${memoryId} (${reason}); task re-offered`
+      );
+      return true;
+    } catch (error) {
+      log(
+        `FAILED to release node-held claim for ${memoryId} (${reason}): ${String(error)}`
+      );
+      return false;
+    }
+  };
+  const release = (held, reason) => releaseByTask(held.memoryId, reason);
+  const done = (async () => {
+    while (!stopping) {
+      try {
+        const offers = await options.request(
+          `/me/executor-instances/${encodeURIComponent(options.nodeId)}/dispatch-offers`
+        );
+        for (const offer of offers) {
+          if (stopping) break;
+          await options.routeOffer(offer, claim, release);
+        }
+      } catch (error) {
+        log(`node offer reconciliation failed (${String(error)}) \u2014 retrying`);
+      }
+      if (!stopping) await wait();
+    }
+  })();
+  return {
+    done,
+    wake: () => wake(),
+    async stop() {
+      stopping = true;
+      wake();
+      await done;
+    }
+  };
+}
+var DETACHED_SUPERVISOR_ENV = "SECHROOM_FLEET_DETACHED";
+function isProcessAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+function readPidFile(path) {
+  let raw;
+  try {
+    raw = readFileSync4(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  const pid = Number.parseInt(raw.trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+function claimPidFile(path, options = {}) {
+  const isAlive = options.isAlive ?? isProcessAlive;
+  const log = options.log ?? (() => {
+  });
+  let raw;
+  try {
+    raw = readFileSync4(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  const pid = Number.parseInt(raw.trim(), 10);
+  const valid = Number.isInteger(pid) && pid > 0;
+  if (valid && isAlive(pid))
+    throw new Error(
+      `pid-file ${path} already names a live supervisor (pid ${pid}) \u2014 refusing to start a second one. Stop it first, or remove the pid-file if that process is not a fleet supervisor.`
+    );
+  log(
+    `stale pid-file ${path} (${valid ? `pid ${pid}` : "unparseable"} not running) \u2014 reclaiming`
+  );
+  rmSync3(path, { force: true });
+}
+function writePidFile(path, pid) {
+  mkdirSync6(dirname4(path), { recursive: true });
+  writeFileSync5(path, `${pid}
+`, { flag: "wx" });
+}
+function removePidFileIfOwned(path, pid, log) {
+  if (readPidFile(path) !== pid) return;
+  try {
+    rmSync3(path, { force: true });
+  } catch (error) {
+    log?.(`pid-file ${path} cleanup failed: ${String(error)}`);
+  }
+}
+function launchDetachedSupervisor(options) {
+  const log = options.log ?? (() => {
+  });
+  const pidFile = resolve(options.pidFile);
+  const logFile = resolve(options.logFile);
+  claimPidFile(pidFile, { log, isAlive: options.isAlive });
+  mkdirSync6(dirname4(logFile), { recursive: true });
+  const openLogFd = options.openLogFd ?? ((path) => openSync(path, "a"));
+  const logFd = openLogFd(logFile);
+  const spawnSupervisor = options.spawnSupervisor ?? ((fd) => {
+    const script = process.argv[1];
+    if (!script) throw new Error("cannot locate the sechroom CLI entrypoint");
+    const argv = options.argv ?? [script, ...process.argv.slice(2)];
+    return spawn2(process.execPath, argv, {
+      detached: true,
+      stdio: ["ignore", fd, fd],
+      env: { ...process.env, [DETACHED_SUPERVISOR_ENV]: "1" }
+    });
+  });
+  let child;
+  try {
+    child = spawnSupervisor(logFd);
+  } finally {
+    try {
+      closeSync(logFd);
+    } catch {
+    }
+  }
+  const pid = child.pid;
+  if (pid === void 0)
+    throw new Error("detached supervisor failed to spawn (no pid)");
+  try {
+    writePidFile(pidFile, pid);
+  } catch (error) {
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+    throw error;
+  }
+  child.unref();
+  return pid;
+}
+function controlSocketPath(pidFile) {
+  const hash = createHash2("sha256").update(resolve(pidFile)).digest("hex").slice(0, 16);
+  return join6(tmpdir(), `sechroom-fleet-${hash}.sock`);
+}
+function startControlServer(socketPath, handlers, options = {}) {
+  const log = options.log ?? (() => {
+  });
+  rmSync3(socketPath, { force: true });
+  const dispatch = (req) => {
+    switch (req.command) {
+      case "status":
+        return { ok: true, command: "status", status: handlers.status() };
+      case "restart": {
+        if (!req.instanceKey)
+          return { ok: false, error: "restart requires an instanceKey" };
+        const r = handlers.restart(req.instanceKey);
+        return r.ok ? {
+          ok: true,
+          command: "restart",
+          message: r.message ?? "restarted"
+        } : { ok: false, error: r.error ?? "restart failed" };
+      }
+      case "stop":
+        handlers.stop();
+        return { ok: true, command: "stop", message: "draining" };
+      default:
+        return { ok: false, error: "unknown command" };
+    }
+  };
+  const onConnection = (socket) => {
+    let buffer = "";
+    const reply = (res) => {
+      socket.end(`${JSON.stringify(res)}
+`);
+    };
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const nl = buffer.indexOf("\n");
+      if (nl === -1) return;
+      let req;
+      try {
+        req = JSON.parse(buffer.slice(0, nl));
+      } catch {
+        reply({
+          ok: false,
+          error: "malformed request (expected one JSON line)"
+        });
+        return;
+      }
+      try {
+        reply(dispatch(req));
+      } catch (error) {
+        reply({ ok: false, error: String(error) });
+      }
+    });
+    socket.on("error", () => {
+    });
   };
+  return new Promise((resolvePromise, rejectPromise) => {
+    const server = createServer2(onConnection);
+    server.on("error", rejectPromise);
+    server.listen(socketPath, () => {
+      server.removeListener("error", rejectPromise);
+      server.on("error", (e) => log(`control socket error: ${String(e)}`));
+      resolvePromise({
+        socketPath,
+        close: () => new Promise((res) => {
+          server.close(() => {
+            rmSync3(socketPath, { force: true });
+            res();
+          });
+        })
+      });
+    });
+  });
+}
+var FleetControlUnreachableError = class extends Error {
+  constructor(socketPath, cause) {
+    super(`no fleet supervisor is listening on ${socketPath} (${cause})`);
+    this.name = "FleetControlUnreachableError";
+  }
+};
+function sendControlCommand(socketPath, request, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  return new Promise((resolvePromise, rejectPromise) => {
+    let settled = false;
+    let buffer = "";
+    const socket = createConnection(socketPath);
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      fn();
+    };
+    const timer = setTimeout(
+      () => finish(
+        () => rejectPromise(
+          new Error(`fleet control request timed out after ${timeoutMs}ms`)
+        )
+      ),
+      timeoutMs
+    );
+    timer.unref?.();
+    socket.setEncoding("utf8");
+    socket.on("connect", () => {
+      socket.write(`${JSON.stringify(request)}
+`);
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const nl = buffer.indexOf("\n");
+      if (nl === -1) return;
+      clearTimeout(timer);
+      let res;
+      try {
+        res = JSON.parse(buffer.slice(0, nl));
+      } catch (error) {
+        finish(
+          () => rejectPromise(
+            new Error(`malformed control response: ${String(error)}`)
+          )
+        );
+        return;
+      }
+      finish(() => resolvePromise(res));
+    });
+    socket.on("error", (error) => {
+      clearTimeout(timer);
+      const code = error.code;
+      if (code === "ENOENT" || code === "ECONNREFUSED")
+        finish(
+          () => rejectPromise(new FleetControlUnreachableError(socketPath, code))
+        );
+      else finish(() => rejectPromise(error));
+    });
+    socket.on("close", () => {
+      clearTimeout(timer);
+      if (!settled)
+        finish(
+          () => rejectPromise(
+            new FleetControlUnreachableError(socketPath, "connection closed")
+          )
+        );
+    });
+  });
 }
 
 // src/commands/telemetry.ts
 import {
   existsSync as existsSync7,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync5,
-  rmSync as rmSync3,
-  writeFileSync as writeFileSync6
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync6,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname6, join as join8 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname7, join as join9, parse, resolve as resolve2, sep } from "path";
 
 // src/commands/hook-install.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { delimiter, dirname as dirname5, join as join7 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { delimiter, dirname as dirname6, join as join8 } from "path";
 
 // src/setup/clients.ts
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname5, join as join7 } from "path";
 function claudeDesktopConfigPath(home) {
   switch (process.platform) {
     case "darwin":
-      return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join7(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "win32":
-      return join6(process.env.APPDATA ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      return join7(process.env.APPDATA ?? join7(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     default:
-      return join6(home, ".config", "Claude", "claude_desktop_config.json");
+      return join7(home, ".config", "Claude", "claude_desktop_config.json");
   }
 }
 function clientTargets(cwd, opts = {}) {
   const home = homedir3();
-  const claudeDir = opts.claudeDir ?? join6(home, ".claude");
-  const codexHome = opts.codexHome ?? join6(home, ".codex");
+  const claudeDir = opts.claudeDir ?? join7(home, ".claude");
+  const codexHome = opts.codexHome ?? join7(home, ".codex");
   return {
     "claude-code": {
       key: "claude-code",
       label: "Claude Code",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".mcp.json"), format: "json" },
-      instruction: { surfaceKey: "claude-code", path: join6(cwd, "CLAUDE.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".mcp.json"), format: "json" },
+      instruction: { surfaceKey: "claude-code", path: join7(cwd, "CLAUDE.md") }
     },
     "claude-desktop": {
       key: "claude-desktop",
       label: "Claude Desktop",
       mcp: { surfaceKey: "claude-desktop", sectionType: SectionType.McpConfig, path: claudeDesktopConfigPath(home), format: "json" },
-      instruction: { surfaceKey: "claude-desktop", path: join6(claudeDir, "CLAUDE.md") }
+      instruction: { surfaceKey: "claude-desktop", path: join7(claudeDir, "CLAUDE.md") }
     },
     codex: {
       key: "codex",
       label: "Codex CLI",
-      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join6(codexHome, "config.toml"), format: "toml" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "chatgpt", sectionType: SectionType.McpConfigToml, path: join7(codexHome, "config.toml"), format: "toml" },
+      instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     cursor: {
       key: "cursor",
       label: "Cursor",
-      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join6(cwd, ".cursor", "mcp.json"), format: "json" },
-      instruction: { surfaceKey: "chatgpt", path: join6(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "claude-code", sectionType: SectionType.McpConfig, path: join7(cwd, ".cursor", "mcp.json"), format: "json" },
+      instruction: { surfaceKey: "chatgpt", path: join7(cwd, "AGENTS.md") }
     },
     antigravity: {
       key: "antigravity",
@@ -2889,8 +4318,8 @@ function clientTargets(cwd, opts = {}) {
       // `type` — comes from the `antigravity` server surface, so we don't
       // hardcode it here. Instructions go in the project `AGENTS.md`
       // (cross-tool, shared with Codex/Cursor).
-      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join6(home, ".gemini", "config", "mcp_config.json"), format: "json" },
-      instruction: { surfaceKey: "antigravity", path: join6(cwd, "AGENTS.md") }
+      mcp: { surfaceKey: "antigravity", sectionType: SectionType.McpConfig, path: join7(home, ".gemini", "config", "mcp_config.json"), format: "json" },
+      instruction: { surfaceKey: "antigravity", path: join7(cwd, "AGENTS.md") }
     }
   };
 }
@@ -2900,10 +4329,10 @@ function detectInstalledClients(cwd) {
   const home = homedir3();
   const detected = [];
   if (resolveClaudeTargets({}).some((t) => existsSync5(t.dir))) detected.push("claude-code");
-  if (existsSync5(dirname4(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
+  if (existsSync5(dirname5(claudeDesktopConfigPath(home)))) detected.push("claude-desktop");
   if (resolveCodexHomes({}).some((d) => existsSync5(d))) detected.push("codex");
-  if (existsSync5(join6(home, ".cursor")) || existsSync5(join6(cwd, ".cursor"))) detected.push("cursor");
-  if (existsSync5(join6(home, ".gemini"))) detected.push("antigravity");
+  if (existsSync5(join7(home, ".cursor")) || existsSync5(join7(cwd, ".cursor"))) detected.push("cursor");
+  if (existsSync5(join7(home, ".gemini"))) detected.push("antigravity");
   return detected;
 }
 
@@ -2947,28 +4376,28 @@ function mergeHooks(config2, commands) {
 }
 function readJsonConfig2(path) {
   if (!existsSync6(path)) return {};
-  const raw = readFileSync4(path, "utf8");
+  const raw = readFileSync5(path, "utf8");
   if (!raw.trim()) return {};
   return JSON.parse(raw);
 }
 function installHooksJson(path, commands, dryRun) {
-  const existed = existsSync6(path) && readFileSync4(path, "utf8").trim().length > 0;
+  const existed = existsSync6(path) && readFileSync5(path, "utf8").trim().length > 0;
   const config2 = readJsonConfig2(path);
   const added = mergeHooks(config2, commands);
   if (added === 0 && existed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(config2, null, 2) + "\n");
+    mkdirSync7(dirname6(path), { recursive: true });
+    writeFileSync6(path, JSON.stringify(config2, null, 2) + "\n");
   }
   return { path, status: existed ? "merged" : "created" };
 }
 function installClaudeCommands(claudeDir, commands, dryRun) {
-  return installHooksJson(join7(claudeDir, "settings.json"), commands, dryRun);
+  return installHooksJson(join8(claudeDir, "settings.json"), commands, dryRun);
 }
 function installCodexCommands(codexHome, commands, dryRun) {
   return [
-    installHooksJson(join7(codexHome, "hooks.json"), commands, dryRun),
-    installCodexFeatureFlag(join7(codexHome, "config.toml"), dryRun)
+    installHooksJson(join8(codexHome, "hooks.json"), commands, dryRun),
+    installCodexFeatureFlag(join8(codexHome, "config.toml"), dryRun)
   ];
 }
 function ensureCodexFeaturesHooks(content) {
@@ -2993,12 +4422,12 @@ function ensureCodexFeaturesHooks(content) {
 }
 function installCodexFeatureFlag(path, dryRun) {
   const existed = existsSync6(path);
-  const content = existed ? readFileSync4(path, "utf8") : "";
+  const content = existed ? readFileSync5(path, "utf8") : "";
   const { next, changed } = ensureCodexFeaturesHooks(content);
   if (!changed) return { path, status: "current" };
   if (!dryRun) {
-    mkdirSync6(dirname5(path), { recursive: true });
-    writeFileSync5(path, next);
+    mkdirSync7(dirname6(path), { recursive: true });
+    writeFileSync6(path, next);
   }
   return { path, status: existed ? "merged" : "created" };
 }
@@ -3023,11 +4452,11 @@ function installHookSurfaces(surfaces, opts) {
   const out = [];
   for (const surface of surfaces) {
     if (surface === "claude") {
-      const path = join7(opts.claudeDir, "settings.json");
+      const path = join8(opts.claudeDir, "settings.json");
       out.push({ surface, results: [installHooksJson(path, CLAUDE_HOOK_COMMANDS, opts.dryRun)] });
     } else {
-      const hooksJson = installHooksJson(join7(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
-      const featureFlag = installCodexFeatureFlag(join7(opts.codexHome, "config.toml"), opts.dryRun);
+      const hooksJson = installHooksJson(join8(opts.codexHome, "hooks.json"), CODEX_HOOK_COMMANDS, opts.dryRun);
+      const featureFlag = installCodexFeatureFlag(join8(opts.codexHome, "config.toml"), opts.dryRun);
       out.push({ surface, results: [hooksJson, featureFlag] });
     }
   }
@@ -3047,7 +4476,7 @@ function isSechroomOnPath() {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
     for (const name of names) {
-      if (existsSync6(join7(dir, name))) return true;
+      if (existsSync6(join8(dir, name))) return true;
     }
   }
   return false;
@@ -3147,14 +4576,14 @@ function registerTelemetry(program2) {
     "Decomposition id this session executes"
   ).requiredOption("--task <id>", "Task id this session executes").action((opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const dir = join8(process.cwd(), ".sechroom");
-    mkdirSync7(dir, { recursive: true });
-    const path = join8(dir, BINDING_FILE);
+    const dir = join9(process.cwd(), ".sechroom");
+    mkdirSync8(dir, { recursive: true });
+    const path = join9(dir, BINDING_FILE);
     const binding = {
       decompositionId: opts.decomposition,
       taskId: opts.task
     };
-    writeFileSync6(path, JSON.stringify(binding, null, 2) + "\n");
+    writeFileSync7(path, JSON.stringify(binding, null, 2) + "\n");
     ensureStateDirIgnored(process.cwd());
     if (json) {
       emit({ bound: true, ...binding, path }, true);
@@ -3169,9 +4598,9 @@ function registerTelemetry(program2) {
   });
   telemetry.command("unbind").description("Clear this checkout's telemetry binding").action((_opts, cmd) => {
     const json = Boolean(cmd.optsWithGlobals().json);
-    const path = join8(process.cwd(), ".sechroom", BINDING_FILE);
+    const path = join9(process.cwd(), ".sechroom", BINDING_FILE);
     const existed = existsSync7(path);
-    if (existed) rmSync3(path);
+    if (existed) rmSync4(path);
     if (json) emit({ unbound: existed, path }, true);
     else
       process.stdout.write(
@@ -3188,7 +4617,16 @@ function registerTelemetry(program2) {
       const binding = findBinding(cwd);
       if (!binding) return process.exit(0);
       const usage = input.transcript_path ? parseTranscript(input.transcript_path) : null;
-      const events = buildHookEvents(input, usage, binding.taskId);
+      const configRoot = resolveClaudeConfigRoot(
+        process.env.CLAUDE_CONFIG_DIR,
+        input.transcript_path
+      );
+      const events = buildHookEvents(
+        input,
+        usage,
+        binding.taskId,
+        configRoot
+      );
       if (events.length === 0) return process.exit(0);
       const cfg = resolveConfig(cmd.optsWithGlobals());
       await postTelemetry(cfg, binding.decompositionId, events);
@@ -3278,11 +4716,11 @@ async function postTelemetry(cfg, decompositionId, events) {
 function findBinding(start) {
   let dir = start;
   for (; ; ) {
-    const path = join8(dir, ".sechroom", BINDING_FILE);
+    const path = join9(dir, ".sechroom", BINDING_FILE);
     if (existsSync7(path)) {
       try {
         const b = JSON.parse(
-          readFileSync5(path, "utf8")
+          readFileSync6(path, "utf8")
         );
         if (b.decompositionId && b.taskId)
           return { decompositionId: b.decompositionId, taskId: b.taskId };
@@ -3290,7 +4728,7 @@ function findBinding(start) {
       }
       return null;
     }
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -3301,7 +4739,7 @@ function parseTranscript(path) {
   let tokensOut = 0;
   let contextUsed = 0;
   let model = "";
-  for (const line of readFileSync5(path, "utf8").split("\n")) {
+  for (const line of readFileSync6(path, "utf8").split("\n")) {
     if (!line.trim()) continue;
     let obj;
     try {
@@ -3325,7 +4763,7 @@ function windowFor(model, contextUsed = 0) {
   if (m.includes("[1m]") || m.includes("-1m")) return 1e6;
   return contextUsed > 2e5 ? 1e6 : 2e5;
 }
-function buildHookEvents(input, usage, taskId) {
+function buildHookEvents(input, usage, taskId, configRoot = null) {
   const events = [];
   const base = (kind, over) => ({
     taskId,
@@ -3338,6 +4776,7 @@ function buildHookEvents(input, usage, taskId) {
     approvalState: null,
     verdict: null,
     modelId: null,
+    configRoot,
     ...over
   });
   if (usage) {
@@ -3371,6 +4810,29 @@ function buildHookEvents(input, usage, taskId) {
   }
   return events;
 }
+function resolveClaudeConfigRoot(configuredRoot, transcriptPath) {
+  if (configuredRoot?.trim()) {
+    const configured = configuredRoot.split(",").map((candidate) => candidate.trim()).filter(Boolean);
+    if (configured.length === 1)
+      return normalizeClaudeConfigRoot(configured.at(0));
+  }
+  if (!transcriptPath?.trim()) return null;
+  const path = normalizeClaudeConfigRoot(transcriptPath);
+  if (!path) return null;
+  const projectsMarker = `${sep}projects${sep}`;
+  const markerIndex = path.lastIndexOf(projectsMarker);
+  return markerIndex > 0 ? normalizeClaudeConfigRoot(path.slice(0, markerIndex)) : null;
+}
+function normalizeClaudeConfigRoot(candidate) {
+  const trimmed = candidate?.trim();
+  if (!trimmed) return null;
+  const expanded = trimmed === "~" ? homedir4() : trimmed.startsWith(`~${sep}`) ? join9(homedir4(), trimmed.slice(2)) : trimmed;
+  let normalized = resolve2(expanded);
+  const rootLength = parse(normalized).root.length;
+  while (normalized.length > rootLength && normalized.endsWith(sep))
+    normalized = normalized.slice(0, -1);
+  return normalized;
+}
 function isPermissionNotification(input) {
   const t = (input.notification_type ?? input.type ?? "").toLowerCase();
   if (t) return t.includes("permission");
@@ -3412,17 +4874,53 @@ function parseIntOpt(v) {
 
 // src/commands/executor-run.ts
 function registerExecutorRunCommand(executor) {
-  executor.command("fleet").description(
+  const fleetCommand = executor.command("fleet").description(
     "Run multiple isolated driven codex executors from one config file"
-  ).requiredOption("--config <file>", "JSON fleet config").action(async (opts, cmd) => {
-    const config2 = await readFleetConfig(String(opts.config));
-    const cfg = resolveConfig(cmd.optsWithGlobals());
+  ).option("--config <file>", "JSON fleet config").option(
+    "--detach",
+    "Run the supervisor as a detached service that outlives the launching shell (canonical default)",
+    false
+  ).option(
+    "--foreground",
+    "Run session-attached (the pre-service behaviour): the supervisor dies with the launching shell",
+    false
+  ).option(
+    "--log-file <file>",
+    "Detached mode: append the supervisor + prefixed child logs here (default .sechroom/fleet.log)"
+  ).option(
+    "--pid-file <file>",
+    "Detached mode: write the supervisor pid here atomically, for adoption by the lifecycle verbs (default .sechroom/fleet.pid)"
+  ).action(async (opts, cmd) => {
     const log = (line) => process.stderr.write(style.dim(`[fleet] ${line}
 `));
+    const isDetachedChild = process.env.SECHROOM_FLEET_DETACHED === "1";
+    if (!opts.config) fail("required option '--config <file>' not specified");
+    const foreground = Boolean(opts.foreground);
+    if (foreground && opts.detach)
+      fail("--detach and --foreground are mutually exclusive");
+    const detach = !foreground;
+    const pidFile = resolve3(
+      opts.pidFile ? String(opts.pidFile) : join10(process.cwd(), ".sechroom", "fleet.pid")
+    );
+    const logFile = resolve3(
+      opts.logFile ? String(opts.logFile) : join10(process.cwd(), ".sechroom", "fleet.log")
+    );
+    if (detach && !isDetachedChild) {
+      await readFleetConfig(String(opts.config));
+      const pid = launchDetachedSupervisor({ logFile, pidFile, log });
+      log(`detached supervisor started \u2014 pid ${pid}`);
+      log(`  logs      \u2192 ${logFile}`);
+      log(`  pid-file  \u2192 ${pidFile}`);
+      log(`  adopt it from any session via the pid-file above.`);
+      return;
+    }
+    const config2 = await readFleetConfig(String(opts.config));
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const activationMode = isDetachedChild ? "Detached" : "Attached";
     let nodeId;
     let stopNodeHeartbeat;
     if (config2.node) {
-      const node = await registerFleetNode(cfg, config2.node);
+      const node = await registerFleetNode(cfg, config2.node, activationMode);
       nodeId = node.id;
       const nodeTtl = config2.node.ttl ?? 120;
       log(`node registered \u2014 ${node.id} (${config2.node.instanceKey})`);
@@ -3432,8 +4930,47 @@ function registerExecutorRunCommand(executor) {
         { onError: (e) => log(`node refresh failed: ${String(e)}`) }
       );
     }
-    const fleet = superviseFleet(config2, { parentId: nodeId });
-    const stop = () => void fleet.shutdown("SIGINT");
+    let wakeNodeRouter = () => {
+    };
+    const fleet = superviseFleet(config2, {
+      parentId: nodeId,
+      activationMode,
+      onRoutingSignal: () => wakeNodeRouter()
+    });
+    const nodeRouter = nodeId ? startNodeOfferRouter({
+      request: createAuthedRequest(cfg),
+      nodeId,
+      routeOffer: fleet.routeOffer,
+      log
+    }) : void 0;
+    wakeNodeRouter = () => nodeRouter?.wake();
+    let controlServer;
+    if (isDetachedChild) {
+      try {
+        controlServer = await startControlServer(
+          controlSocketPath(pidFile),
+          {
+            status: () => ({
+              supervisorPid: process.pid,
+              node: nodeId && config2.node ? { instanceKey: config2.node.instanceKey, id: nodeId } : null,
+              children: fleet.snapshot()
+            }),
+            restart: (instanceKey) => fleet.restartChild(instanceKey),
+            stop: () => void fleet.shutdown("SIGINT")
+          },
+          { log }
+        );
+        log(`control socket \u2192 ${controlServer.socketPath}`);
+      } catch (e) {
+        log(
+          `control socket unavailable (${String(e)}) \u2014 status/restart/stop verbs cannot reach this supervisor (SIGTERM to the pid still drains it)`
+        );
+      }
+    }
+    const stop = () => {
+      void nodeRouter?.stop();
+      void fleet.shutdown("SIGINT");
+    };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
     try {
@@ -3441,6 +4978,10 @@ function registerExecutorRunCommand(executor) {
     } finally {
       process.off("SIGINT", stop);
       process.off("SIGTERM", stop);
+      await nodeRouter?.stop().catch(() => {
+      });
+      await controlServer?.close().catch(() => {
+      });
       stopNodeHeartbeat?.();
       if (nodeId) {
         try {
@@ -3452,6 +4993,93 @@ function registerExecutorRunCommand(executor) {
           );
         }
       }
+      if (isDetachedChild) removePidFileIfOwned(pidFile, process.pid, log);
+    }
+  });
+  fleetCommand.command("status").description(
+    "Report a detached fleet's per-child state (live/exited/restarting), restart counts, and pids"
+  ).option(
+    "--pid-file <file>",
+    "Supervisor pid-file to adopt (default .sechroom/fleet.pid)"
+  ).action(async (_opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const pidFile = resolveFleetPidFile(globals.pidFile);
+    requireLiveSupervisor(pidFile);
+    const reply = await sendFleetCommand(pidFile, { command: "status" });
+    if (!reply.ok || reply.command !== "status")
+      fail(
+        `fleet status failed: ${reply.ok ? "unexpected reply" : reply.error}`
+      );
+    if (globals.json) {
+      process.stdout.write(`${JSON.stringify(reply.status, null, 2)}
+`);
+      return;
+    }
+    renderFleetStatus(reply.status);
+  });
+  fleetCommand.command("restart").description(
+    "Bounce exactly one child of a detached fleet by instanceKey, leaving its siblings untouched"
+  ).argument("<instanceKey>", "The child instanceKey to restart").option(
+    "--pid-file <file>",
+    "Supervisor pid-file to adopt (default .sechroom/fleet.pid)"
+  ).action(async (instanceKey, _opts, cmd) => {
+    const pidFile = resolveFleetPidFile(cmd.optsWithGlobals().pidFile);
+    requireLiveSupervisor(pidFile);
+    const reply = await sendFleetCommand(pidFile, {
+      command: "restart",
+      instanceKey
+    });
+    if (!reply.ok) fail(`fleet restart failed: ${reply.error}`);
+    const message = reply.command === "restart" ? reply.message : "restarted";
+    process.stdout.write(
+      `${style.green("restarted")} ${instanceKey} \u2014 ${message}
+`
+    );
+  });
+  fleetCommand.command("stop").description(
+    "Drain a detached fleet's children, retire the node last, then stop the supervisor"
+  ).option(
+    "--pid-file <file>",
+    "Supervisor pid-file to adopt (default .sechroom/fleet.pid)"
+  ).option(
+    "--timeout <seconds>",
+    "Seconds to wait for the supervisor to exit before reporting a slow drain",
+    "60"
+  ).action(async (opts, cmd) => {
+    const pidFile = resolveFleetPidFile(cmd.optsWithGlobals().pidFile);
+    const pid = requireLiveSupervisor(pidFile);
+    try {
+      const reply = await sendControlCommand(controlSocketPath(pidFile), {
+        command: "stop"
+      });
+      if (!reply.ok) fail(`fleet stop failed: ${reply.error}`);
+    } catch (e) {
+      if (e instanceof FleetControlUnreachableError) {
+        process.stderr.write(
+          `control socket unreachable (${e.message}); sending SIGTERM to pid ${pid}
+`
+        );
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch (killErr) {
+          fail(`could not signal supervisor pid ${pid}: ${String(killErr)}`);
+        }
+      } else {
+        fail(`fleet stop failed: ${String(e)}`);
+      }
+    }
+    const timeoutMs = Number.parseInt(String(opts.timeout), 10) * 1e3;
+    const drained = await waitForSupervisorExit(pidFile, pid, timeoutMs);
+    if (drained) {
+      process.stdout.write(
+        `${style.green("stopped")} \u2014 children drained, node retired, supervisor exited
+`
+      );
+    } else {
+      process.stderr.write(
+        `${style.yellow("warning")}: supervisor pid ${pid} still running after ${opts.timeout}s \u2014 it may be finishing an in-flight turn; re-check with \`fleet status\`
+`
+      );
     }
   });
   executor.command("run").description(
@@ -3476,6 +5104,14 @@ function registerExecutorRunCommand(executor) {
   ).option(
     "--parent-id <id>",
     "Fleet node this child enrolls under (D-WLP-55 containment; set by the fleet supervisor)"
+  ).option(
+    "--fleet-child",
+    "Internal: accept node-routed claims over the fleet supervisor IPC channel",
+    false
+  ).option(
+    "--activation-mode <mode>",
+    "attached | detached \u2014 set by the fleet supervisor so a detached service's children read honestly on the roster (default attached)",
+    "attached"
   ).option("--ttl <seconds>", "Advertisement TTL (30-600)").option("--once", "Process a single task, then exit", false).option(
     "--no-deliver",
     "Skip driver-side delivery (branch/commit/push of the turn's changes)"
@@ -3483,7 +5119,11 @@ function registerExecutorRunCommand(executor) {
     "--allow-dirty-root",
     "Claim even when the root has uncommitted changes (they are fenced out of the delivery commit)",
     false
-  ).option("--no-pr", "Deliver without raising a PR (branch + push only)").option("--poll-interval <seconds>", "Offer reconciliation interval", "5").option("--heartbeat-interval <seconds>", "Lease heartbeat cadence", "30").option("--turn-timeout <seconds>", "Fresh turn timeout", "300").option("--resume-turn-timeout <seconds>", "Resumed turn timeout", "1200").option(
+  ).option("--no-pr", "Deliver without raising a PR (branch + push only)").option("--poll-interval <seconds>", "Offer reconciliation interval", "5").option(
+    "--capacity-interval <seconds>",
+    "Codex account-capacity snapshot cadence",
+    "300"
+  ).option("--heartbeat-interval <seconds>", "Lease heartbeat cadence", "30").option("--turn-timeout <seconds>", "Fresh turn timeout", "300").option("--resume-turn-timeout <seconds>", "Resumed turn timeout", "1200").option(
     "--drain-timeout <seconds>",
     "On shutdown, seconds to let an in-flight turn finish before interrupting",
     "30"
@@ -3491,12 +5131,15 @@ function registerExecutorRunCommand(executor) {
     "--usage-reserve <percent>",
     "Rate-limit reserve: defer claiming new tasks while remaining is at or below this percent",
     "2"
+  ).option(
+    "--exclude-tag <tag...>",
+    "Skip claiming any offer whose task carries this tag (exact match, e.g. lane:ux); driver-side filter, repeatable"
   ).action(async (opts, cmd) => {
     if (String(opts.runtime).toLowerCase() !== "codex")
       fail(
         "executor run drives runtime codex only (claude-code stays attached)"
       );
-    const located = readExecutorState();
+    const located = readExecutorState(resolve3(String(opts.root)));
     if (!located)
       fail(
         "executor run requires an installed executor advertisement; run `sechroom executor install` first."
@@ -3511,7 +5154,11 @@ function registerExecutorRunCommand(executor) {
       laneId: opts.lane ? String(opts.lane) : located.state.laneId,
       connectorId: opts.connector ? String(opts.connector) : located.state.connectorId,
       parentId: opts.parentId ? String(opts.parentId) : located.state.parentId,
-      ttlSeconds: opts.ttl ? Number.parseInt(String(opts.ttl), 10) : located.state.ttlSeconds
+      ttlSeconds: opts.ttl ? Number.parseInt(String(opts.ttl), 10) : located.state.ttlSeconds,
+      // Driver-side claim exclusion: the flag (repeatable) overlays the installed
+      // state (flag wins when present), else the persisted excludeTags carry through.
+      // Local-only — never sent in the advertisement (server schema untouched).
+      excludeTags: opts.excludeTag ?? located.state.excludeTags
     };
     const heartbeatMs = Number.parseInt(String(opts.heartbeatInterval), 10) * 1e3;
     if (heartbeatMs >= 12e4)
@@ -3519,13 +5166,25 @@ function registerExecutorRunCommand(executor) {
     const usageReserve = Number.parseFloat(String(opts.usageReserve));
     if (!Number.isFinite(usageReserve) || usageReserve < 0 || usageReserve >= 100)
       fail("--usage-reserve must be a percent in [0, 100)");
+    const capacityIntervalMs = Number.parseInt(String(opts.capacityInterval), 10) * 1e3;
+    if (!Number.isFinite(capacityIntervalMs) || capacityIntervalMs < 6e4)
+      fail("--capacity-interval must be at least 60 seconds");
     const cfg = resolveConfig(cmd.optsWithGlobals());
-    const instance = await ensureExecutorInstance(cfg, located);
+    const activationMode = parseActivationMode(String(opts.activationMode));
+    const instance = await ensureExecutorInstance(
+      cfg,
+      located,
+      activationMode
+    );
     const log = (line) => process.stderr.write(style.dim(`[run] ${line}
 `));
     const request = createAuthedRequest(cfg);
-    const rootDir = resolve2(String(opts.root));
-    const usageLogPath = join9(
+    const excludeTags = located.state.excludeTags ?? [];
+    const skipLog = /* @__PURE__ */ new Set();
+    if (excludeTags.length)
+      log(`excluding offers tagged: ${excludeTags.join(", ")}`);
+    const rootDir = resolve3(String(opts.root));
+    const usageLogPath = join10(
       rootDir,
       ".sechroom",
       `executor-usage-${located.state.instanceKey.replace(/[^\w.-]/g, "-")}.jsonl`
@@ -3536,7 +5195,27 @@ function registerExecutorRunCommand(executor) {
       log,
       appendRecord: createUsageLogAppender(usageLogPath, log)
     });
-    const appServer = new CodexAppServer({
+    const fleetIpc = Boolean(opts.fleetChild && process.send);
+    let advertisementExpiresAtMs = Date.parse(instance.expiresAt);
+    if (!Number.isFinite(advertisementExpiresAtMs))
+      advertisementExpiresAtMs = 0;
+    let admission = { ok: true };
+    let activeRoutedLeaseId;
+    let appServer;
+    const fleetInbox = createFleetChildRouteInbox({
+      enabled: fleetIpc,
+      instanceKey: located.state.instanceKey,
+      instanceId: instance.id,
+      localStatus: () => ({ advertisementExpiresAtMs, admission }),
+      send: (message) => process.send?.(message),
+      subscribe: (listener) => process.on("message", listener),
+      unsubscribe: (listener) => process.off("message", listener),
+      onClaimRelease: (leaseId, reason) => {
+        log(`fleet route ${leaseId} released by node (${reason})`);
+        if (activeRoutedLeaseId === leaseId) void appServer.interrupt();
+      }
+    });
+    appServer = new CodexAppServer({
       codexBin: String(opts.codexBin),
       cwd: rootDir,
       model: opts.model ? String(opts.model) : void 0,
@@ -3551,6 +5230,12 @@ function registerExecutorRunCommand(executor) {
     });
     await appServer.start();
     log(`codex app-server up (${String(opts.codexBin)})`);
+    let signalCapacityTerminal;
+    const capacityTerminal = new Promise((resolve6) => {
+      signalCapacityTerminal = resolve6;
+    });
+    let stopCapacityCapture = () => {
+    };
     let stopping = false;
     let turnInFlight = false;
     const requestStop = () => {
@@ -3567,8 +5252,8 @@ function registerExecutorRunCommand(executor) {
     process.once("SIGTERM", requestStop);
     let wake = () => {
     };
-    const wakeSignal = () => new Promise((resolve5) => {
-      wake = resolve5;
+    const wakeSignal = () => new Promise((resolve6) => {
+      wake = resolve6;
     });
     let connStop = async () => {
     };
@@ -3579,13 +5264,19 @@ function registerExecutorRunCommand(executor) {
       log(`SignalR wake leg unavailable (${String(e)}) \u2014 poll-only`);
     }
     const stopAdvertisementHeartbeat = startExecutorHeartbeat(
-      () => request(
-        `/me/executor-instances/${encodeURIComponent(instance.id)}/refresh`,
-        {
-          method: "POST",
-          body: JSON.stringify({ ttlSeconds: located.state.ttlSeconds })
-        }
-      ),
+      async () => {
+        const refreshed = await request(
+          `/me/executor-instances/${encodeURIComponent(instance.id)}/refresh`,
+          {
+            method: "POST",
+            body: JSON.stringify({ ttlSeconds: located.state.ttlSeconds })
+          }
+        );
+        advertisementExpiresAtMs = Date.parse(refreshed.expiresAt);
+        if (!Number.isFinite(advertisementExpiresAtMs))
+          advertisementExpiresAtMs = 0;
+        fleetInbox.report();
+      },
       located.state.refreshAfterSeconds * 1e3,
       { onError: (e) => log(`advertisement refresh failed: ${String(e)}`) }
     );
@@ -3600,8 +5291,9 @@ function registerExecutorRunCommand(executor) {
         rootSnapshot = ready.snapshot;
         return { ok: ready.ok, reason: ready.reason };
       },
-      deliver: (claim, task, verdict) => deliverTurn(gitRunner, {
+      deliver: (claim, task, verdict, turnFileChangeCount) => deliverTurn(gitRunner, {
         taskId: claim.memoryId,
+        turnFileChangeCount,
         title: task.title,
         verdict,
         snapshot: rootSnapshot ?? {
@@ -3615,8 +5307,12 @@ function registerExecutorRunCommand(executor) {
     };
     const ports = {
       ...deliveryPorts,
-      checkAdmission: async () => usageTracker.admission(),
-      claimNext: () => claimNext(request, instance.id, log),
+      checkAdmission: async () => {
+        admission = usageTracker.admission();
+        fleetInbox.report();
+        return admission;
+      },
+      claimNext: async () => await fleetInbox.waitForClaim() ?? await claimNext(request, instance.id, log, excludeTags, skipLog),
       loadTask: (memoryId) => loadTask(request, memoryId, log),
       startLeaseHeartbeat: (claim) => startLeaseHeartbeat(
         () => request(
@@ -3633,18 +5329,29 @@ function registerExecutorRunCommand(executor) {
         heartbeatMs
       ),
       runTurn: async (task, claim) => {
+        if (fleetInbox.consumeClaimRelease(claim.leaseId))
+          throw new Error(
+            `fleet route ${claim.leaseId} was released before execution`
+          );
         if (!appServer.alive) {
           log("codex app-server died between tasks \u2014 respawning");
           await appServer.start();
         }
+        activeRoutedLeaseId = claim.executorInstanceId ? claim.leaseId : void 0;
         turnInFlight = true;
         try {
-          return await appServer.runTask(taskPrompt(task), {
+          const result = await appServer.runTask(taskPrompt(task), {
             taskId: claim.memoryId,
             leaseId: claim.leaseId,
             decompositionId: claim.decompositionId
           });
+          if (fleetInbox.consumeClaimRelease(claim.leaseId))
+            throw new Error(
+              `fleet route ${claim.leaseId} was released during execution`
+            );
+          return result;
         } finally {
+          activeRoutedLeaseId = void 0;
           turnInFlight = false;
         }
       },
@@ -3653,7 +5360,7 @@ function registerExecutorRunCommand(executor) {
         {
           method: "POST",
           body: JSON.stringify({
-            executorInstanceId: instance.id,
+            executorInstanceId: claim.executorInstanceId ?? instance.id,
             claimToken: claim.claimToken,
             tokenVersion: claim.tokenVersion,
             verdict,
@@ -3665,8 +5372,8 @@ function registerExecutorRunCommand(executor) {
       ),
       log,
       waitForWake: (ms) => Promise.race([
-        new Promise((resolve5) => {
-          setTimeout(resolve5, ms).unref?.();
+        new Promise((resolve6) => {
+          setTimeout(resolve6, ms).unref?.();
         }),
         wakeSignal()
       ])
@@ -3674,14 +5381,27 @@ function registerExecutorRunCommand(executor) {
     log(
       `driven executor live \u2014 instance ${located.state.instanceKey}, lane ${located.state.laneId ?? located.state.instanceKey}${opts.once ? ", single-task mode" : ""}`
     );
+    fleetInbox.report();
     log(`usage log \u2192 ${usageLogPath}; admission reserve ${usageReserve}%`);
     try {
-      const summary = await runDriverLoop(ports, {
-        once: Boolean(opts.once),
-        pollMs: Number.parseInt(String(opts.pollInterval), 10) * 1e3,
-        stopping: () => stopping,
-        source: located.state.laneId ?? located.state.instanceKey
+      stopCapacityCapture = startCodexAccountCapacityCapture({
+        read: () => appServer.readAccountCapacitySignal(),
+        persist: (snapshot) => postCodexAccountCapacity(request, snapshot),
+        log,
+        onTerminal: signalCapacityTerminal,
+        intervalMs: capacityIntervalMs
       });
+      const summary = await Promise.race([
+        runDriverLoop(ports, {
+          once: Boolean(opts.once),
+          pollMs: Number.parseInt(String(opts.pollInterval), 10) * 1e3,
+          stopping: () => stopping,
+          source: located.state.laneId ?? located.state.instanceKey
+        }),
+        capacityTerminal.then((error) => {
+          throw error;
+        })
+      ]);
       log(
         `done \u2014 processed ${summary.processed}, completed ${summary.completed}, abandoned ${summary.abandoned}`
       );
@@ -3692,10 +5412,16 @@ function registerExecutorRunCommand(executor) {
 `)
         );
         process.exitCode = 1;
+      } else if (error instanceof BackoffCeilingExhaustedError) {
+        process.stderr.write(style.dim(`[run] ${error.message}
+`));
+        process.exitCode = 1;
       } else {
         throw error;
       }
     } finally {
+      stopCapacityCapture();
+      fleetInbox.close();
       stopAdvertisementHeartbeat();
       await connStop().catch(() => {
       });
@@ -3714,11 +5440,80 @@ function registerExecutorRunCommand(executor) {
     }
   });
 }
-async function claimNext(request, instanceId, log) {
+function resolveFleetPidFile(flag) {
+  return resolve3(
+    flag ? String(flag) : join10(process.cwd(), ".sechroom", "fleet.pid")
+  );
+}
+function requireLiveSupervisor(pidFile) {
+  const pid = readPidFile(pidFile);
+  if (pid === void 0)
+    fail(
+      `no fleet supervisor pid-file at ${pidFile}. Start one with \`sechroom executor fleet --config <file>\`, or pass --pid-file.`
+    );
+  if (!isProcessAlive(pid))
+    fail(
+      `pid-file ${pidFile} names pid ${pid}, which is not running \u2014 the supervisor crashed or was killed. Remove the stale pid-file or start a fresh fleet.`
+    );
+  return pid;
+}
+async function sendFleetCommand(pidFile, request) {
+  try {
+    return await sendControlCommand(controlSocketPath(pidFile), request);
+  } catch (e) {
+    if (e instanceof FleetControlUnreachableError)
+      fail(
+        `${e.message}. The supervisor is running but not serving its control socket; check its log.`
+      );
+    throw e;
+  }
+}
+function renderFleetStatus(report) {
+  const out = (line) => process.stdout.write(`${line}
+`);
+  out(style.bold(`fleet supervisor pid ${report.supervisorPid}`));
+  if (report.node) out(`node: ${report.node.instanceKey} (${report.node.id})`);
+  const paint = (state) => {
+    const cell = state.padEnd(10);
+    if (state === "live") return style.green(cell);
+    if (state === "restarting" || state === "stopping")
+      return style.yellow(cell);
+    return style.dim(cell);
+  };
+  if (report.children.length === 0) {
+    out(style.dim("(no children)"));
+    return;
+  }
+  const keyWidth = Math.max(
+    ...report.children.map((c) => c.instanceKey.length),
+    "instanceKey".length
+  );
+  out(
+    `${"instanceKey".padEnd(keyWidth)}  ${"state".padEnd(10)}  ${"pid".padEnd(7)}  restarts`
+  );
+  for (const child of report.children)
+    out(
+      `${child.instanceKey.padEnd(keyWidth)}  ${paint(child.state)}  ${String(child.pid ?? "\u2014").padEnd(7)}  ${child.restarts}`
+    );
+}
+async function waitForSupervisorExit(pidFile, pid, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const sleep = (ms) => new Promise((res) => {
+    setTimeout(res, ms).unref?.();
+  });
+  for (; ; ) {
+    if (readPidFile(pidFile) !== pid || !isProcessAlive(pid)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleep(200);
+  }
+}
+async function claimNext(request, instanceId, log, excludeTags, skipLog) {
   const claimed = await claimNextTask({
     request,
     executorInstanceId: instanceId,
-    log
+    log,
+    excludeTags,
+    skipLog
   });
   if (!claimed) return void 0;
   return {
@@ -3785,13 +5580,13 @@ function executorSubscriptionInput(name) {
     filter: { tags: ["kind:task"], workspaceScope: [] }
   };
 }
-function executorRegistrationInput(state, deliverySubscriptionId) {
+function executorRegistrationInput(state, deliverySubscriptionId, activationMode = "Attached") {
   return {
     relayId: state.relayId,
     instanceKey: state.instanceKey,
     laneId: state.laneId ?? state.instanceKey,
     runtimeKind: parseRuntimeKind(state.runtime),
-    activationMode: "Attached",
+    activationMode,
     deliverySubscriptionId,
     connectorId: state.connectorId,
     claimedCapabilityKeys: state.capabilityKeys,
@@ -3840,6 +5635,9 @@ function registerExecutor(program2) {
   ).option(
     "--claim-tag <tag...>",
     "Task tag this instance accepts under --claim-policy restricted"
+  ).option(
+    "--exclude-tag <tag...>",
+    "Driver-side claim exclusion: `executor run` skips any offer whose task carries this tag (exact match, e.g. lane:ux)"
   ).option(
     "--relay <id>",
     "Relay identity shared by sibling instances",
@@ -3916,8 +5714,8 @@ function registerExecutor(program2) {
     if (opts.refreshAfter >= opts.ttl)
       fail("refresh-after must be shorter than the TTL");
     const sem = readSem();
-    const checkout = sem ? dirname7(dirname7(sem.path)) : process.cwd();
-    const statePath = join10(checkout, ".sechroom", EXECUTOR_STATE);
+    const checkout = sem ? dirname8(dirname8(sem.path)) : process.cwd();
+    const statePath = join11(checkout, ".sechroom", EXECUTOR_STATE);
     const state = {
       schemaVersion: 1,
       instanceKey,
@@ -3927,20 +5725,21 @@ function registerExecutor(program2) {
       capabilityKeys: capabilities ?? [],
       claimPolicy: (opts.claimPolicy ?? "open").toLowerCase() === "restricted" ? "restricted" : "open",
       claimTags: opts.claimTag ?? [],
+      excludeTags: opts.excludeTag ?? [],
       relayId: opts.relay,
       subscriptionName: opts.subscriptionName,
       ttlSeconds: opts.ttl,
       refreshAfterSeconds: opts.refreshAfter
     };
     if (!opts.dryRun) {
-      mkdirSync8(dirname7(statePath), { recursive: true });
-      writeFileSync7(statePath, JSON.stringify(state, null, 2) + "\n");
+      mkdirSync9(dirname8(statePath), { recursive: true });
+      writeFileSync8(statePath, JSON.stringify(state, null, 2) + "\n");
       ensureStateDirIgnored(checkout);
     }
     const configuredClaudeDirs = globals.claudeConfigDir || process.env.CLAUDE_CONFIG_DIR ? resolveClaudeTargets({ override: globals.claudeConfigDir }).map(
       (target) => target.dir
-    ) : [join10(checkout, ".claude")];
-    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join10(checkout, ".codex")];
+    ) : [join11(checkout, ".claude")];
+    const configuredCodexHomes = globals.codexHome || process.env.CODEX_HOME ? resolveCodexHomes({ override: globals.codexHome }) : [join11(checkout, ".codex")];
     const hookTargets = surface === "claude" ? configuredClaudeDirs : configuredCodexHomes;
     for (const target of hookTargets) {
       const results = surface === "claude" ? [
@@ -3984,7 +5783,7 @@ function registerExecutor(program2) {
       );
       delete located.state.instanceId;
       delete located.state.lastRefreshAt;
-      writeFileSync7(
+      writeFileSync8(
         located.path,
         JSON.stringify(located.state, null, 2) + "\n"
       );
@@ -4050,6 +5849,10 @@ function registerExecutor(program2) {
   ).option("--tool-set-ref <ref>", "Optional governed tool-set reference").option(
     "--parent-id <id>",
     "Fleet node this instance enrolls under (D-WLP-55 containment; sets the roster parentId)"
+  ).option(
+    "--activation-mode <mode>",
+    "attached | detached \u2014 detached marks a fleet run as a service that outlives its shell (default attached)",
+    "attached"
   ).option("--ttl <seconds>", "Advertisement TTL (30-600)", parseInteger, 120).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const subscription = await api(
@@ -4076,7 +5879,7 @@ function registerExecutor(program2) {
           instanceKey: opts.instanceKey,
           laneId: opts.laneId ?? opts.instanceKey,
           runtimeKind: parseRuntimeKind(opts.runtime),
-          activationMode: "Attached",
+          activationMode: parseActivationMode(opts.activationMode),
           deliverySubscriptionId: subscription.id,
           connectorId: opts.connector,
           claimedCapabilityKeys: opts.capability ?? [],
@@ -4124,6 +5927,96 @@ function registerExecutor(program2) {
     );
     emit(data, Boolean(cmd.optsWithGlobals().json));
   });
+  executor.command("proxy-claim <generationId>").description(
+    "Node-held proxy claim: hold a task lease on a child's behalf so an attended/harness session is board-visible (node = holder-of-record, child = worker)"
+  ).requiredOption(
+    "--node-instance <id>",
+    "This node's executor-instance id (xins_\u2026) \u2014 the holder-of-record"
+  ).requiredOption(
+    "--proxied-for <id>",
+    "The child executor-instance id (xins_\u2026) the node holds the lease for"
+  ).action(async (generationId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(cfg, "/me/executor-task-proxy-claims", {
+      method: "POST",
+      body: JSON.stringify({
+        generationId,
+        nodeInstanceId: opts.nodeInstance,
+        proxiedForInstanceId: opts.proxiedFor
+      })
+    });
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+    if (!cmd.optsWithGlobals().json)
+      process.stderr.write(
+        style.dim(
+          "keep alive with: sechroom executor proxy-heartbeat <leaseId> --claim-token <token>\n"
+        )
+      );
+  });
+  executor.command("proxy-heartbeat <leaseId>").description(
+    "Heartbeat a node-held task lease (keeps a proxied claim alive)"
+  ).requiredOption(
+    "--claim-token <token>",
+    "The claim token returned by proxy-claim"
+  ).option(
+    "--token-version <n>",
+    "Lease token version (default 1)",
+    parseInteger,
+    1
+  ).action(async (leaseId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-task-leases/${encodeURIComponent(leaseId)}/heartbeat`,
+      {
+        method: "POST",
+        body: JSON.stringify({
+          claimToken: opts.claimToken,
+          tokenVersion: opts.tokenVersion
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
+  executor.command("proxy-complete <leaseId>").description(
+    "Complete a node-held task lease holder-bound (the closeout carries the child's identity via --source)"
+  ).requiredOption(
+    "--node-instance <id>",
+    "The holder-of-record executor-instance id (this node)"
+  ).requiredOption(
+    "--claim-token <token>",
+    "The claim token returned by proxy-claim"
+  ).requiredOption(
+    "--verdict <verdict>",
+    "pass | soft-fail | plan-invalid | blocked"
+  ).requiredOption("--text <text>", "Closeout memory text").requiredOption(
+    "--source <lane>",
+    "Closeout source lane \u2014 the child/worker identity (Gate resolution 3)"
+  ).option("--title <title>", "Optional closeout title").option(
+    "--token-version <n>",
+    "Lease token version (default 1)",
+    parseInteger,
+    1
+  ).action(async (leaseId, opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await api(
+      cfg,
+      `/me/executor-task-leases/${encodeURIComponent(leaseId)}/complete`,
+      {
+        method: "POST",
+        body: JSON.stringify({
+          executorInstanceId: opts.nodeInstance,
+          claimToken: opts.claimToken,
+          tokenVersion: opts.tokenVersion,
+          verdict: opts.verdict,
+          text: opts.text,
+          source: opts.source,
+          title: opts.title ?? null
+        })
+      }
+    );
+    emit(data, Boolean(cmd.optsWithGlobals().json));
+  });
   executor.command("deregister <id>").description("Stop advertising this executor instance").action(async (id, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await api(
@@ -4160,6 +6053,17 @@ function parseClaimPolicy(value) {
       return fail("claim-policy must be open or restricted");
   }
 }
+function parseActivationMode(value) {
+  switch ((value ?? "attached").trim().toLowerCase()) {
+    case "":
+    case "attached":
+      return "Attached";
+    case "detached":
+      return "Detached";
+    default:
+      return fail("activation-mode must be attached or detached");
+  }
+}
 function parseTransport(value) {
   switch (value.trim().toLowerCase()) {
     case "push":
@@ -4180,7 +6084,7 @@ async function refreshExecutorInstance(cfg, id, ttlSeconds) {
     }
   );
 }
-async function registerInstance(cfg, state) {
+async function registerInstance(cfg, state, activationMode = "Attached") {
   const subscription = await api(
     cfg,
     "/me/delivery-subscriptions/signalr",
@@ -4191,10 +6095,12 @@ async function registerInstance(cfg, state) {
   );
   return api(cfg, "/me/executor-instances", {
     method: "POST",
-    body: JSON.stringify(executorRegistrationInput(state, subscription.id))
+    body: JSON.stringify(
+      executorRegistrationInput(state, subscription.id, activationMode)
+    )
   });
 }
-async function registerFleetNode(cfg, node) {
+async function registerFleetNode(cfg, node, activationMode = "Attached") {
   const subscriptionName = node.subscriptionName ?? "executor-dispatch";
   const subscription = await api(
     cfg,
@@ -4211,7 +6117,7 @@ async function registerFleetNode(cfg, node) {
       instanceKey: node.instanceKey,
       laneId: node.lane ?? node.instanceKey,
       runtimeKind: "Node",
-      activationMode: "Attached",
+      activationMode,
       deliverySubscriptionId: subscription.id,
       connectorId: node.connector,
       claimedCapabilityKeys: [],
@@ -4229,25 +6135,25 @@ async function deregisterInstance(cfg, id) {
     body: JSON.stringify({})
   });
 }
-async function ensureExecutorInstance(cfg, located) {
+async function ensureExecutorInstance(cfg, located, activationMode = "Attached") {
   const { state, path } = located;
   state.laneId ??= state.instanceKey;
-  const data = await registerInstance(cfg, state);
+  const data = await registerInstance(cfg, state, activationMode);
   state.instanceId = data.id;
   state.lastRefreshAt = (/* @__PURE__ */ new Date()).toISOString();
-  writeFileSync7(path, JSON.stringify(state, null, 2) + "\n");
+  writeFileSync8(path, JSON.stringify(state, null, 2) + "\n");
   return data;
 }
 function readExecutorState(start = process.cwd()) {
   const semPath = resolveSemPathForRead(start);
   const sem = semPath ? readSem(semPath) : void 0;
-  const path = join10(
-    sem ? dirname7(sem.path) : join10(start, ".sechroom"),
+  const path = join11(
+    sem ? dirname8(sem.path) : join11(start, ".sechroom"),
     EXECUTOR_STATE
   );
   if (!existsSync8(path)) return void 0;
   return {
-    state: JSON.parse(readFileSync6(path, "utf8")),
+    state: JSON.parse(readFileSync7(path, "utf8")),
     path
   };
 }
@@ -4279,11 +6185,11 @@ function parseInteger(value) {
   return parsed;
 }
 function holdHeartbeat(tick, intervalMs) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const timer = setInterval(() => void tick().catch(reject), intervalMs);
     const stop = () => {
       clearInterval(timer);
-      resolve5();
+      resolve6();
     };
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
@@ -4434,7 +6340,7 @@ function registerChannel(program2) {
     "MCP server + subscription name (idempotent per name)",
     "sechroom-channel"
   ).option("--dry-run", "Print what would change; write nothing").action((opts) => {
-    const path = join11(process.cwd(), ".mcp.json");
+    const path = join12(process.cwd(), ".mcp.json");
     const dryRun = Boolean(opts.dryRun);
     const args = ["channel", "mcp"];
     const entry = { command: "sechroom", args };
@@ -4444,8 +6350,8 @@ function registerChannel(program2) {
     const status = JSON.stringify(existing) === JSON.stringify(entry) ? "current" : existing ? "updated" : "created";
     if (status !== "current" && !dryRun) {
       config2.mcpServers[opts.name] = entry;
-      mkdirSync9(dirname8(path), { recursive: true });
-      writeFileSync8(path, JSON.stringify(config2, null, 2) + "\n");
+      mkdirSync10(dirname9(path), { recursive: true });
+      writeFileSync9(path, JSON.stringify(config2, null, 2) + "\n");
     }
     const verb = status === "current" ? "already configured" : dryRun ? `would ${status === "created" ? "create" : "update"}` : status;
     process.stdout.write(`${style.green("channel")} ${path} (${verb})
@@ -4536,7 +6442,7 @@ function startExecutorHeartbeat(refresh, intervalMilliseconds, dependencies = {}
 }
 async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {}) {
   const request = dependencies.request ?? api;
-  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
+  const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)));
   const idempotencyKey = dependencies.idempotencyKey ?? ((offer) => `channel:${offer.generationId}`);
   const state = dependencies.state ?? {};
   for (; ; ) {
@@ -4582,7 +6488,7 @@ async function drainClaims(cfg, executorInstanceId, deliver, dependencies = {})
 }
 function readMcpConfig(path) {
   if (!existsSync9(path)) return {};
-  const raw = readFileSync7(path, "utf8");
+  const raw = readFileSync8(path, "utf8");
   if (!raw.trim()) return {};
   try {
     return JSON.parse(raw);
@@ -4610,9 +6516,9 @@ async function openConnection(cfg, onEvent, executorInstanceId) {
   return conn;
 }
 function holdOpen(conn) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const stop = () => {
-      void conn.stop().finally(resolve5);
+      void conn.stop().finally(resolve6);
     };
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
@@ -4738,13 +6644,13 @@ Examples:
 }
 
 // src/commands/checkpoint.ts
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname10, join as join13 } from "path";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname11, join as join14 } from "path";
 
 // src/commands/hook.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync8, statSync as statSync2, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, join as join12 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync11, readFileSync as readFileSync9, statSync as statSync2, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname10, join as join13 } from "path";
 async function readStdin2() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
@@ -4768,13 +6674,13 @@ function resolveLane(flagLane, cwd) {
   if (!base) return void 0;
   return applyWorktreeLaneSuffix(base, start);
 }
-var INTENT_FILE = join12(".sechroom", "continuity.json");
+var INTENT_FILE = join13(".sechroom", "continuity.json");
 function resolveIntentPath(start) {
   let dir = start;
   for (; ; ) {
-    const candidate = join12(dir, INTENT_FILE);
+    const candidate = join13(dir, INTENT_FILE);
     if (existsSync10(candidate)) return candidate;
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -4783,7 +6689,7 @@ function readIntent(start) {
   const path = resolveIntentPath(start);
   if (!path) return void 0;
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync9(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -4825,14 +6731,14 @@ async function saveSnapshotFromIntent(cmd, cwd, laneFlag, scopeFlag, defaultScop
 }
 function ledgerPath(start) {
   const intent = resolveIntentPath(start);
-  const dir = intent ? dirname9(intent) : join12(start, ".sechroom");
-  return join12(dir, ".checkpoint-state.json");
+  const dir = intent ? dirname10(intent) : join13(start, ".sechroom");
+  return join13(dir, ".checkpoint-state.json");
 }
 function readLedger(start) {
   try {
     const p = ledgerPath(start);
     if (!existsSync10(p)) return {};
-    return JSON.parse(readFileSync8(p, "utf8"));
+    return JSON.parse(readFileSync9(p, "utf8"));
   } catch {
     return {};
   }
@@ -4851,7 +6757,7 @@ function intentHash(i) {
     artifacts: i.artifacts ?? [],
     confidence: i.confidence ?? null
   });
-  return createHash2("sha256").update(canonical, "utf8").digest("hex");
+  return createHash3("sha256").update(canonical, "utf8").digest("hex");
 }
 function recentlyCheckpointed(start, minutes) {
   const { lastEpochMs } = readLedger(start);
@@ -4879,13 +6785,13 @@ function recordPush(start, intent) {
     } catch {
       mtimeMs = void 0;
     }
-    mkdirSync10(dirname9(p), { recursive: true });
+    mkdirSync11(dirname10(p), { recursive: true });
     const ledger = {
       lastEpochMs: Date.now(),
       lastMtimeMs: mtimeMs,
       lastHash: intentHash(intent)
     };
-    writeFileSync9(p, JSON.stringify(ledger) + "\n");
+    writeFileSync10(p, JSON.stringify(ledger) + "\n");
   } catch {
   }
 }
@@ -5138,10 +7044,10 @@ Examples:
       const client = await makeClient(cfg);
       return client.POST("/continuity/snapshots", { body });
     });
-    const path = resolveIntentPath(cwd) ?? join13(cwd, INTENT_FILE);
+    const path = resolveIntentPath(cwd) ?? join14(cwd, INTENT_FILE);
     const fileBody = { ...merged, scope, lastSnapshotId: data.snapshotId };
-    mkdirSync11(dirname10(path), { recursive: true });
-    writeFileSync10(path, JSON.stringify(fileBody, null, 2) + "\n");
+    mkdirSync12(dirname11(path), { recursive: true });
+    writeFileSync11(path, JSON.stringify(fileBody, null, 2) + "\n");
     recordPush(cwd, merged);
     if (json) {
       emit({ snapshotId: data.snapshotId, lane, scope, file: path }, true);
@@ -5155,7 +7061,7 @@ Examples:
 }
 
 // src/commands/close.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 var VERDICTS = ["pass", "soft-fail", "plan-invalid", "blocked"];
 function registerClose(program2) {
   program2.command("close").description(
@@ -5196,7 +7102,7 @@ Examples:
       );
     let bodyText;
     try {
-      bodyText = opts.file ? readFileSync9(opts.file, "utf8") : readFileSync9(0, "utf8");
+      bodyText = opts.file ? readFileSync10(opts.file, "utf8") : readFileSync10(0, "utf8");
     } catch {
       fail(
         opts.file ? `could not read --file ${opts.file}` : "no closeout body \u2014 pass --file <path> or pipe it on stdin"
@@ -5619,6 +7525,26 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
+  workPlan.command("accept-context-drift <decompositionId>").description(
+    "Accept a parked run's exact stale-context delta, re-snapshot its task context pack, and resume dispatch"
+  ).action(async (decompositionId, _opts, cmd) => {
+    const cfg = resolveConfig(cmd.optsWithGlobals());
+    const data = await runApi("Accepting context drift", async () => {
+      const client = await makeClient(cfg);
+      return client.POST(
+        "/decompositions/{id}/accept-context-drift",
+        {
+          params: { path: { id: decompositionId } },
+          body: {}
+        }
+      );
+    });
+    emitAction(
+      `accepted context drift for ${style.bold(decompositionId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
+  });
   workPlan.command("resume <decompositionId>").description(
     "Resume a failed work-plan decomposition (POST /decompositions/{id}/resume)"
   ).action(async (decompositionId, _opts, cmd) => {
@@ -5948,6 +7874,22 @@ Examples:
 }
 
 // src/commands/memory.ts
+import { readFileSync as readFileSync11 } from "fs";
+import { basename as basename2 } from "path";
+function resolveCreateBody(textOpt, fileOpt) {
+  if (textOpt == null === (fileOpt == null)) {
+    fail("Provide exactly one of --text or --file.");
+  }
+  if (textOpt != null) return { text: textOpt, defaultTitle: null };
+  const fromStdin = fileOpt === "-";
+  const text2 = fromStdin ? readFileSync11(0, "utf8") : readFileSync11(String(fileOpt), "utf8");
+  if (text2.trim().length === 0) {
+    fail(fromStdin ? "Stdin was empty." : `File is empty: ${fileOpt}`);
+  }
+  const heading = text2.match(/^#\s+(.+?)\s*$/m)?.[1];
+  const defaultTitle = heading ?? (fromStdin ? null : basename2(String(fileOpt)).replace(/\.(md|markdown|txt)$/i, ""));
+  return { text: text2, defaultTitle };
+}
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
   memory.addHelpText(
@@ -5956,6 +7898,8 @@ function registerMemory(program2) {
 Examples:
   $ sechroom memory create --text "first note" --type reference --tag idea --tag cli
   $ sechroom memory create --text "filed note" --owner-type Workspace --owner-id wsp_XXXX
+  $ sechroom memory create --file docs/conventions.md --owner-type Workspace --owner-id wsp_XXXX
+  $ cat NOTES.md | sechroom memory create --file - --tag kind:reference
   $ sechroom memory search "rate limiting" --limit 5 --tag kind:decision
   $ sechroom memory search "auth flow" --workspace wsp_XXXX --json
   $ sechroom memory get mem_XXXX --json
@@ -5966,39 +7910,65 @@ Examples:
   $ sechroom memory list-archived --workspace wsp_XXXX --json
   $ sechroom memory tags --json`
   );
-  memory.command("create").description("Create a memory (POST /memories)").requiredOption("--text <text>", "Memory body text").option("--type <type>", "Memory type", "reference").option("--title <title>", "Optional title").option("--tag <tag...>", "Tags (repeatable)").option("--owner-type <ownerType>", "Workspace | Project | Unfiled", "Unfiled").option("--owner-id <ownerId>", "Owner id (required for Workspace/Project)").option("--source <source>", "Source / lane stamp", "cli").option("--confidence <n>", "Confidence 0..1", "1.0").action(async (opts, cmd) => {
+  memory.command("create").description("Create a memory (POST /memories)").option("--text <text>", "Memory body text").option(
+    "--file <path>",
+    "Read the body from a file (use - for stdin); .md files as-is"
+  ).option("--type <type>", "Memory type", "reference").option(
+    "--title <title>",
+    "Optional title (with --file, defaults to the first # heading, else the filename)"
+  ).option("--tag <tag...>", "Tags (repeatable)").option(
+    "--owner-type <ownerType>",
+    "Workspace | Project | Unfiled",
+    "Unfiled"
+  ).option("--owner-id <ownerId>", "Owner id (required for Workspace/Project)").option("--source <source>", "Source / lane stamp", "cli").option("--confidence <n>", "Confidence 0..1", "1.0").action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
+    const { text: text2, defaultTitle } = resolveCreateBody(opts.text, opts.file);
+    const title = opts.title ?? defaultTitle;
     const unfiled = String(opts.ownerType).toLowerCase() === "unfiled";
     const data = await runApi("Creating memory", async () => {
       const client = await makeClient(cfg);
       return client.POST("/memories", {
         body: {
-          text: opts.text,
+          text: text2,
           type: opts.type,
           content: "{}",
           confidence: Number(opts.confidence),
           source: opts.source,
           archetype: "Document",
-          title: opts.title ?? null,
+          title: title ?? null,
           tags: opts.tag ?? null,
-          owner: unfiled ? null : { type: opts.ownerType, id: String(opts.ownerId ?? "") }
+          owner: unfiled ? null : {
+            type: opts.ownerType,
+            id: String(opts.ownerId ?? "")
+          }
         }
       });
     });
-    const titlePart = opts.title ? ` ${style.dim(`"${opts.title}"`)}` : "";
+    const titlePart = title ? ` ${style.dim(`"${title}"`)}` : "";
     const view = resolveViewUrl(cfg.baseUrl, data.url);
     const urlPart = view ? ` ${style.dim("\u2192")} ${view}` : "";
-    emitAction(`created memory ${style.bold(data.id)}${titlePart}${urlPart}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `created memory ${style.bold(data.id)}${titlePart}${urlPart}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
   memory.command("get <memoryId>").description("Fetch a memory by id (GET /memories/{memoryId})").action(async (memoryId, _opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching memory", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/memories/{memoryId}", { params: { path: { memoryId } } });
+      return client.GET("/memories/{memoryId}", {
+        params: { path: { memoryId } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  memory.command("search <query>").description("Hybrid search (POST /memories/search; SemanticQuery -> vector+FTS RRF)").option("--limit <n>", "Max results", "10").option("--tag <tag...>", "Require all listed tags").option("--workspace <workspaceId>", "Scope to a workspace (cascades to its projects)").option("--include-archived", "Include archived memories", false).action(async (query, opts, cmd) => {
+  memory.command("search <query>").description(
+    "Hybrid search (POST /memories/search; SemanticQuery -> vector+FTS RRF)"
+  ).option("--limit <n>", "Max results", "10").option("--tag <tag...>", "Require all listed tags").option(
+    "--workspace <workspaceId>",
+    "Scope to a workspace (cascades to its projects)"
+  ).option("--include-archived", "Include archived memories", false).action(async (query, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Searching", async () => {
       const client = await makeClient(cfg);
@@ -6018,7 +7988,13 @@ Examples:
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  memory.command("edit-text <memoryId>").description("Find/replace one substring (POST /memories/{memoryId}/edit-text)").requiredOption("--old <text>", "Text to find").requiredOption("--new <text>", "Replacement text").option("--replace-all", "Replace every occurrence (default: first only)", false).option("--regenerate-filing", "Re-run filing after the edit", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("edit-text <memoryId>").description(
+    "Find/replace one substring (POST /memories/{memoryId}/edit-text)"
+  ).requiredOption("--old <text>", "Text to find").requiredOption("--new <text>", "Replacement text").option(
+    "--replace-all",
+    "Replace every occurrence (default: first only)",
+    false
+  ).option("--regenerate-filing", "Re-run filing after the edit", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Editing memory text", async () => {
       const client = await makeClient(cfg);
@@ -6034,19 +8010,31 @@ Examples:
         }
       });
     });
-    emitAction(`edited ${style.bold(memoryId)} \u2192 v${style.bold(String(data.version))}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `edited ${style.bold(memoryId)} \u2192 v${style.bold(String(data.version))}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  memory.command("edit-text-batch <memoryId>").description("Apply many find/replace edits (POST /memories/{memoryId}/edit-text-batch)").requiredOption("--edit <old=>new...>", "Edit as 'old=>new' (repeatable)").option("--replace-all", "Apply replaceAll to every edit", false).option("--regenerate-filing", "Re-run filing after the edits", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("edit-text-batch <memoryId>").description(
+    "Apply many find/replace edits (POST /memories/{memoryId}/edit-text-batch)"
+  ).requiredOption("--edit <old=>new...>", "Edit as 'old=>new' (repeatable)").option("--replace-all", "Apply replaceAll to every edit", false).option("--regenerate-filing", "Re-run filing after the edits", false).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const replaceAll = Boolean(opts.replaceAll);
     const edits = opts.edit.map((spec) => {
       const idx = spec.indexOf("=>");
       if (idx < 0) {
-        process.stderr.write(`error: --edit must be 'old=>new', got: ${spec}
-`);
+        process.stderr.write(
+          `error: --edit must be 'old=>new', got: ${spec}
+`
+        );
         process.exit(1);
       }
-      return { oldText: spec.slice(0, idx), newText: spec.slice(idx + 2), replaceAll };
+      return {
+        oldText: spec.slice(0, idx),
+        newText: spec.slice(idx + 2),
+        replaceAll
+      };
     });
     const data = await runApi("Applying batch edits", async () => {
       const client = await makeClient(cfg);
@@ -6066,22 +8054,44 @@ Examples:
       cmd.optsWithGlobals().json
     );
   });
-  memory.command("update <memoryId>").description("Update metadata only \u2014 title/tags/type/confidence (PATCH /memories/{memoryId}/metadata; omitted = unchanged)").option("--title <text>", "Set the title").option("--tag <tag...>", "Set the full tag list (replaces existing); repeatable").option("--add-tag <tag...>", "Add tag(s) to the existing set (repeatable)").option("--remove-tag <tag...>", "Remove tag(s) from the existing set (repeatable)").option("--type <type>", "Set the memory type (e.g. reference, note, document)").option("--confidence <n>", "Set confidence (0..1)", (v) => Number(v)).option("--memory-source <src>", "Set the memory's own Source field").option("--bump-version", "Bump the version chain (use for a content reinterpretation, e.g. a type promotion)", false).option("--source <source>", "Contributing lane stamp (attribution)", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("update <memoryId>").description(
+    "Update metadata only \u2014 title/tags/type/confidence (PATCH /memories/{memoryId}/metadata; omitted = unchanged)"
+  ).option("--title <text>", "Set the title").option(
+    "--tag <tag...>",
+    "Set the full tag list (replaces existing); repeatable"
+  ).option("--add-tag <tag...>", "Add tag(s) to the existing set (repeatable)").option(
+    "--remove-tag <tag...>",
+    "Remove tag(s) from the existing set (repeatable)"
+  ).option(
+    "--type <type>",
+    "Set the memory type (e.g. reference, note, document)"
+  ).option("--confidence <n>", "Set confidence (0..1)", (v) => Number(v)).option("--memory-source <src>", "Set the memory's own Source field").option(
+    "--bump-version",
+    "Bump the version chain (use for a content reinterpretation, e.g. a type promotion)",
+    false
+  ).option("--source <source>", "Contributing lane stamp (attribution)", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const json = cmd.optsWithGlobals().json;
     const hasTagOps = Boolean(opts.tag || opts.addTag || opts.removeTag);
     const hasAny = opts.title !== void 0 || hasTagOps || opts.type !== void 0 || opts.confidence !== void 0 || opts.memorySource !== void 0 || Boolean(opts.bumpVersion);
     if (!hasAny)
-      fail("nothing to update \u2014 pass at least one of --title / --tag / --add-tag / --remove-tag / --type / --confidence / --memory-source.");
+      fail(
+        "nothing to update \u2014 pass at least one of --title / --tag / --add-tag / --remove-tag / --type / --confidence / --memory-source."
+      );
     let tags;
     if (hasTagOps) {
       let base;
       if (opts.tag) base = opts.tag;
       else {
-        const current = await runApi("Reading current tags", async () => {
-          const client = await makeClient(cfg);
-          return client.GET("/memories/{memoryId}", { params: { path: { memoryId } } });
-        });
+        const current = await runApi(
+          "Reading current tags",
+          async () => {
+            const client = await makeClient(cfg);
+            return client.GET("/memories/{memoryId}", {
+              params: { path: { memoryId } }
+            });
+          }
+        );
         base = current?.item?.tags ?? current?.tags ?? [];
       }
       const set = new Set(base);
@@ -6098,7 +8108,8 @@ Examples:
     if (tags !== void 0) body.tags = tags;
     if (opts.type !== void 0) body.type = opts.type;
     if (opts.confidence !== void 0) body.confidence = opts.confidence;
-    if (opts.memorySource !== void 0) body.memorySource = opts.memorySource;
+    if (opts.memorySource !== void 0)
+      body.memorySource = opts.memorySource;
     const data = await runApi("Updating metadata", async () => {
       const client = await makeClient(cfg);
       return client.PATCH("/memories/{memoryId}/metadata", {
@@ -6108,7 +8119,11 @@ Examples:
     });
     const changed = data?.changed ?? [];
     const summary = changed.length > 0 ? `updated ${changed.join(", ")}` : "no changes";
-    emitAction(`${summary} on ${style.bold(memoryId)} \u2192 v${style.bold(String(data?.version ?? "?"))}`, data, json);
+    emitAction(
+      `${summary} on ${style.bold(memoryId)} \u2192 v${style.bold(String(data?.version ?? "?"))}`,
+      data,
+      json
+    );
   });
   memory.command("archive <memoryId>").description("Archive a memory (POST /memories/{memoryId}/archive)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -6119,9 +8134,15 @@ Examples:
         body: { source: opts.source }
       });
     });
-    emitAction(`archived ${style.bold(memoryId)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `archived ${style.bold(memoryId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  memory.command("restore <memoryId>").description("Restore an archived memory (POST /memories/{memoryId}/restore)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("restore <memoryId>").description(
+    "Restore an archived memory (POST /memories/{memoryId}/restore)"
+  ).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Restoring memory", async () => {
       const client = await makeClient(cfg);
@@ -6130,9 +8151,18 @@ Examples:
         body: { source: opts.source }
       });
     });
-    emitAction(`restored ${style.bold(memoryId)}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `restored ${style.bold(memoryId)}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
-  memory.command("move <memoryId>").description("Move a memory to a new owner (POST /memories/{memoryId}/move)").requiredOption("--owner-type <ownerType>", "Unfiled | Workspace | Project | Candidate").option("--owner-id <ownerId>", "Owner id (required unless Unfiled)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("move <memoryId>").description(
+    "Move a memory to a new owner (POST /memories/{memoryId}/move)"
+  ).requiredOption(
+    "--owner-type <ownerType>",
+    "Unfiled | Workspace | Project | Candidate"
+  ).option("--owner-id <ownerId>", "Owner id (required unless Unfiled)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Moving memory", async () => {
       const client = await makeClient(cfg);
@@ -6147,7 +8177,11 @@ Examples:
         }
       });
     });
-    emitAction(`moved ${style.bold(memoryId)} \u2192 ${opts.ownerType}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `moved ${style.bold(memoryId)} \u2192 ${opts.ownerType}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
   memory.command("list-archived").description("List archived memories (GET /memories/archived)").option("--workspace <workspaceId>", "Scope to a workspace").option("--project <projectId>", "Scope to a project").option("--page <n>", "Page number").option("--page-size <n>", "Page size").action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -6170,11 +8204,21 @@ Examples:
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Fetching versions", async () => {
       const client = await makeClient(cfg);
-      return client.GET("/memories/{memoryId}/versions", { params: { path: { memoryId } } });
+      return client.GET("/memories/{memoryId}/versions", {
+        params: { path: { memoryId } }
+      });
     });
     emit(data, cmd.optsWithGlobals().json);
   });
-  memory.command("revert <memoryId>").description("Revert a memory to an earlier version (POST /memories/{memoryId}/revert)").requiredOption("--from-version <n>", "Version to revert from").requiredOption("--text <text>", "Reverted text (the target version's text)").requiredOption("--content <content>", "Reverted content JSON (the target version's content)").option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
+  memory.command("revert <memoryId>").description(
+    "Revert a memory to an earlier version (POST /memories/{memoryId}/revert)"
+  ).requiredOption("--from-version <n>", "Version to revert from").requiredOption(
+    "--text <text>",
+    "Reverted text (the target version's text)"
+  ).requiredOption(
+    "--content <content>",
+    "Reverted content JSON (the target version's content)"
+  ).option("--source <source>", "Source / lane stamp", "cli").action(async (memoryId, opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
     const data = await runApi("Reverting memory", async () => {
       const client = await makeClient(cfg);
@@ -6188,7 +8232,11 @@ Examples:
         }
       });
     });
-    emitAction(`reverted ${style.bold(memoryId)} from v${opts.fromVersion}`, data, cmd.optsWithGlobals().json);
+    emitAction(
+      `reverted ${style.bold(memoryId)} from v${opts.fromVersion}`,
+      data,
+      cmd.optsWithGlobals().json
+    );
   });
   memory.command("owners").description("List owners with memory counts (GET /memories/owners)").option("--include-archived", "Include archived memories in counts", false).action(async (opts, cmd) => {
     const cfg = resolveConfig(cmd.optsWithGlobals());
@@ -6260,16 +8308,16 @@ Examples:
 }
 
 // src/setup/apply.ts
-import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync11, existsSync as existsSync11 } from "fs";
-import { dirname as dirname11 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync11 } from "fs";
+import { dirname as dirname12 } from "path";
 var MARKER_BEGIN = "<!-- @sechroom/cli:begin";
 var MARKER_END = "<!-- @sechroom/cli:end";
 function normalizeBody(s) {
   return s.replace(/\r\n/g, "\n").trim();
 }
 function bodySha256(body) {
-  return createHash3("sha256").update(normalizeBody(body), "utf8").digest("hex");
+  return createHash4("sha256").update(normalizeBody(body), "utf8").digest("hex");
 }
 function renderBlock(write) {
   const body = normalizeBody(write.body);
@@ -6315,11 +8363,11 @@ function parseManagedBlock(content, block) {
   return null;
 }
 function ensureDir2(path) {
-  mkdirSync12(dirname11(path), { recursive: true });
+  mkdirSync13(dirname12(path), { recursive: true });
 }
 function readOr(path, fallback) {
   try {
-    return readFileSync10(path, "utf8");
+    return readFileSync12(path, "utf8");
   } catch {
     return fallback;
   }
@@ -6330,7 +8378,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   let current = {};
   if (existed) {
     try {
-      current = JSON.parse(readFileSync10(path, "utf8"));
+      current = JSON.parse(readFileSync12(path, "utf8"));
     } catch {
       return { kind: "mcp", path, status: "skipped", note: "existing file isn't valid JSON \u2014 left untouched" };
     }
@@ -6338,7 +8386,7 @@ function mergeMcpJson(path, snippet, dryRun) {
   current.mcpServers = { ...current.mcpServers ?? {}, ...incoming.mcpServers ?? {} };
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync11(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  writeFileSync12(path, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function mergeCodexToml(path, snippet, dryRun) {
@@ -6349,7 +8397,7 @@ function mergeCodexToml(path, snippet, dryRun) {
   const next = (trimmed.length > 0 ? trimmed + "\n\n" : "") + snippet.trim() + "\n";
   if (dryRun) return { kind: "mcp", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync11(path, next, { mode: 384 });
+  writeFileSync12(path, next, { mode: 384 });
   return { kind: "mcp", path, status: existed ? "merged" : "created" };
 }
 function writeInstructionBlock(path, write, dryRun) {
@@ -6357,7 +8405,7 @@ function writeInstructionBlock(path, write, dryRun) {
   const next = computeBlockFile(readOr(path, ""), write);
   if (dryRun) return { kind: "instruction", path, status: "dry-run" };
   ensureDir2(path);
-  writeFileSync11(path, next);
+  writeFileSync12(path, next);
   return { kind: "instruction", path, status: existed ? "merged" : "created" };
 }
 function computeBlockFile(current, write) {
@@ -6398,7 +8446,7 @@ function applyBlock(path, write, mode, dryRun) {
     const next = computeBlockFile(current, write);
     if (!dryRun) {
       ensureDir2(proposedPath);
-      writeFileSync11(proposedPath, next);
+      writeFileSync12(proposedPath, next);
     }
     return {
       kind: "instruction",
@@ -6528,8 +8576,8 @@ auto-resumes where you left off and checkpoints working state before compacting.
 }
 
 // src/setup/skills-offer.ts
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync12 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync13 } from "fs";
+import { join as join15 } from "path";
 
 // src/setup/lane-pin.ts
 var CODE_LANE_PREFIX_BY_CLIENT = {
@@ -6645,8 +8693,8 @@ Found ${summary} available to you for ${surface}.
   if (skills.length > 0) {
     const written = [];
     for (const s of skills) {
-      mkdirSync13(join14(sDir, s.name), { recursive: true });
-      writeFileSync12(join14(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
+      mkdirSync14(join15(sDir, s.name), { recursive: true });
+      writeFileSync13(join15(sDir, s.name, "SKILL.md"), s.body.endsWith("\n") ? s.body : s.body + "\n");
       written.push(s.name);
     }
     recordMaterialisedSkills(sDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -6654,11 +8702,11 @@ Found ${summary} available to you for ${surface}.
 `);
   }
   if (agents.length > 0) {
-    mkdirSync13(aDir, { recursive: true });
+    mkdirSync14(aDir, { recursive: true });
     const written = [];
     for (const a of agents) {
       const file = `${a.name}.md`;
-      writeFileSync12(join14(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
+      writeFileSync13(join15(aDir, file), a.body.endsWith("\n") ? a.body : a.body + "\n");
       written.push(file);
     }
     recordMaterialisedSkills(aDir, DEFAULT_SKILLS_SLUG, written, { surface });
@@ -7042,12 +9090,12 @@ Wired to namespace '${slug2}'. Restart your AI client (or reload MCP) to pick it
 
 // src/commands/onboard.ts
 import { existsSync as existsSync13 } from "fs";
-import { basename as basename2, join as join16 } from "path";
+import { basename as basename3, join as join17 } from "path";
 
 // src/commands/fanout.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join15, resolve as resolve3 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync13, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join16, resolve as resolve4 } from "path";
 var ICON = {
   refresh: "\u21BB",
   bind: "+",
@@ -7055,7 +9103,7 @@ var ICON = {
   "skip-unbound": "\u26A0"
 };
 function resolveChildDir(path, root) {
-  return isAbsolute(path) ? path : resolve3(root, path);
+  return isAbsolute(path) ? path : resolve4(root, path);
 }
 function discoverChildren(root) {
   let names;
@@ -7067,13 +9115,13 @@ function discoverChildren(root) {
   const out = [];
   for (const name of names.sort()) {
     if (name.startsWith(".") || name === "node_modules") continue;
-    const dir = join15(root, name);
+    const dir = join16(root, name);
     try {
       if (!statSync3(dir).isDirectory()) continue;
     } catch {
       continue;
     }
-    if (existsSync12(join15(dir, ".git")) || committedBindingPath(dir)) out.push(name);
+    if (existsSync12(join16(dir, ".git")) || committedBindingPath(dir)) out.push(name);
   }
   return out;
 }
@@ -7081,7 +9129,7 @@ function readManifest(path) {
   if (!existsSync12(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(path, "utf8"));
+    parsed = JSON.parse(readFileSync13(path, "utf8"));
   } catch (err2) {
     throw new Error(`couldn't parse ${path}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -7251,7 +9299,7 @@ function personalSubtreeIds(personalId, all) {
 }
 async function pickWorkspace(client, opts = {}) {
   const promptLabel = opts.promptLabel ?? "Bind this directory to a workspace:";
-  const dirName = opts.dirName ?? basename2(process.cwd());
+  const dirName = opts.dirName ?? basename3(process.cwd());
   const all = await withSpinner("Listing your workspaces", () => fetchWorkspaces(client));
   if (all.length === 0) {
     process.stderr.write(`no workspaces found \u2014 skipping workspace binding (you can set it later with \`sechroom config set --local workspaceId <id>\`)
@@ -7302,7 +9350,7 @@ async function resolveWorkspaceBinding(client, existing, opts) {
   }
   if (existing) return existing;
   if (!canPrompt() || opts.yes) return void 0;
-  return pickWorkspace(client, { dirName: basename2(process.cwd()) });
+  return pickWorkspace(client, { dirName: basename3(process.cwd()) });
 }
 async function ensureTenant(baseUrl, g, opts) {
   const persisted = readPersisted();
@@ -7450,7 +9498,7 @@ async function planRecurseChild(entry, root, client, opts) {
   if (!existsSync13(dir)) {
     return { label: entry.path, dir, disposition: "skip-missing", argv: [], reason: "directory does not exist" };
   }
-  if (existsSync13(join16(dir, ".sechroom.json"))) {
+  if (existsSync13(join17(dir, ".sechroom.json"))) {
     return {
       label: entry.path,
       dir,
@@ -7479,7 +9527,7 @@ ${style.bold(entry.path)} ${style.dim("is not bound yet.")}
 `);
   const ws = await pickWorkspace(client, {
     promptLabel: `Bind ${style.cyan(entry.path)} to a workspace:`,
-    dirName: basename2(entry.path)
+    dirName: basename3(entry.path)
   });
   if (!ws) {
     return { label: entry.path, dir, disposition: "skip-unbound", argv: [], reason: "unbound \u2014 no workspace chosen (skipped)" };
@@ -7523,7 +9571,7 @@ This fan-out will pin the same lane in every repo:
 async function runRecurse(cfg, g, opts) {
   const { yes, dryRun, json } = opts;
   const root = process.cwd();
-  const manifestPath = join16(root, ".sechroom", "repos.json");
+  const manifestPath = join17(root, ".sechroom", "repos.json");
   const fromManifest = readManifest(manifestPath);
   const entries = fromManifest ?? discoverChildren(root).map((path) => ({ path }));
   const sourceLabel = fromManifest ? `manifest ${manifestPath}` : `auto-discovered under ${root}`;
@@ -8055,32 +10103,32 @@ Examples:
 }
 
 // src/commands/reset.ts
-import { homedir as homedir4 } from "os";
-import { join as join17 } from "path";
-import { existsSync as existsSync14, readFileSync as readFileSync12, rmSync as rmSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join18 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync14, rmSync as rmSync5 } from "fs";
 var SKILLS_LOCK2 = ".sechroom-skills.json";
-var localSkillsDir = () => join17(process.cwd(), ".claude", "skills");
-var globalSkillsDir = () => join17(homedir4(), ".claude", "skills");
-var localAgentsDir = () => join17(process.cwd(), ".claude", "agents");
-var globalAgentsDir = () => join17(homedir4(), ".claude", "agents");
+var localSkillsDir = () => join18(process.cwd(), ".claude", "skills");
+var globalSkillsDir = () => join18(homedir5(), ".claude", "skills");
+var localAgentsDir = () => join18(process.cwd(), ".claude", "agents");
+var globalAgentsDir = () => join18(homedir5(), ".claude", "agents");
 function removeMaterialisedSkills(dir) {
   const removed = [];
-  const lockPath = join17(dir, SKILLS_LOCK2);
+  const lockPath = join18(dir, SKILLS_LOCK2);
   if (!existsSync14(lockPath)) return removed;
   try {
-    const lock = JSON.parse(readFileSync12(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync14(lockPath, "utf8"));
     for (const entry of Object.values(lock)) {
       for (const name of entry.skills ?? []) {
-        const p = join17(dir, name);
+        const p = join18(dir, name);
         if (existsSync14(p)) {
-          rmSync4(p, { recursive: true, force: true });
+          rmSync5(p, { recursive: true, force: true });
           removed.push(p);
         }
       }
     }
   } catch {
   }
-  rmSync4(lockPath, { force: true });
+  rmSync5(lockPath, { force: true });
   removed.push(lockPath);
   return removed;
 }
@@ -8117,19 +10165,19 @@ function registerReset(program2) {
       }
     }
     const removed = [];
-    const stateDir = join17(process.cwd(), ".sechroom");
+    const stateDir = join18(process.cwd(), ".sechroom");
     if (existsSync14(stateDir)) {
-      rmSync4(stateDir, { recursive: true, force: true });
+      rmSync5(stateDir, { recursive: true, force: true });
       removed.push(stateDir);
     }
-    const legacyCfg = join17(process.cwd(), ".sechroom.json");
+    const legacyCfg = join18(process.cwd(), ".sechroom.json");
     if (existsSync14(legacyCfg)) {
-      rmSync4(legacyCfg, { force: true });
+      rmSync5(legacyCfg, { force: true });
       removed.push(legacyCfg);
     }
-    const legacySem = join17(process.cwd(), ".sem");
+    const legacySem = join18(process.cwd(), ".sem");
     if (existsSync14(legacySem)) {
-      rmSync4(legacySem, { force: true });
+      rmSync5(legacySem, { force: true });
       removed.push(legacySem);
     }
     removed.push(...removeMaterialisedSkills(localSkillsDir()));
@@ -8154,8 +10202,8 @@ function registerReset(program2) {
 }
 
 // src/commands/skills.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync14, statSync as statSync4, writeFileSync as writeFileSync13 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync15, statSync as statSync4, writeFileSync as writeFileSync14 } from "fs";
+import { join as join19 } from "path";
 function filenameFromDisposition(header) {
   if (!header) return void 0;
   const m = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(header);
@@ -8163,11 +10211,11 @@ function filenameFromDisposition(header) {
 }
 function resolveOutputPath(output, serverFilename) {
   const filename = serverFilename || "skills.zip";
-  if (!output) return join18(process.cwd(), filename);
+  if (!output) return join19(process.cwd(), filename);
   const looksLikeDir = output.endsWith("/") || existsSync15(output) && statSync4(output).isDirectory();
   if (looksLikeDir) {
-    mkdirSync14(output, { recursive: true });
-    return join18(output, filename);
+    mkdirSync15(output, { recursive: true });
+    return join19(output, filename);
   }
   return output;
 }
@@ -8198,7 +10246,7 @@ async function downloadZip(label, call, output) {
   const buf = Buffer.from(res.data);
   const filename = filenameFromDisposition(res.response.headers.get("content-disposition")) ?? "skills.zip";
   const path = resolveOutputPath(output, filename);
-  writeFileSync13(path, buf);
+  writeFileSync14(path, buf);
   return { path, bytes: buf.length, filename };
 }
 function registerSkills(program2) {
@@ -8373,8 +10421,8 @@ clients select all; an unconfigured machine preserves the legacy Claude default.
 
 // src/commands/sweep.ts
 import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname12, join as join19, resolve as resolve4 } from "path";
-var DEFAULT_MANIFEST = join19(".sechroom", "repos.json");
+import { dirname as dirname13, join as join20, resolve as resolve5 } from "path";
+var DEFAULT_MANIFEST = join20(".sechroom", "repos.json");
 function planEntry(entry, root) {
   const dir = resolveChildDir(entry.path, root);
   if (!existsSync16(dir)) {
@@ -8437,7 +10485,7 @@ Examples:
     const g = cmd.optsWithGlobals();
     const json = Boolean(g.json);
     const dryRun = Boolean(opts.dryRun);
-    const manifestPath = resolve4(opts.manifest);
+    const manifestPath = resolve5(opts.manifest);
     let repos;
     try {
       repos = readManifest(manifestPath);
@@ -8453,7 +10501,7 @@ Examples:
 `);
       return;
     }
-    const root = dirname12(dirname12(manifestPath));
+    const root = dirname13(dirname13(manifestPath));
     const plans = repos.map((entry) => planEntry(entry, root));
     if (!json) {
       process.stderr.write(
@@ -8873,7 +10921,7 @@ async function readStdin4() {
 function resolveVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync13(new URL("../package.json", import.meta.url), "utf8")
+      readFileSync15(new URL("../package.json", import.meta.url), "utf8")
     );
     return pkg.version ?? "0.0.0";
   } catch {