@securecoms/agent-bridge 0.29.0 → 0.30.1

package/dist/index.js

@@ -13317,17 +13317,17 @@ async function makeNobleSignatureImpl(alg) {
         };
       }
       try {
-        const { ed25519: ed255194 } = await Promise.resolve().then(() => (init_ed25519(), ed25519_exports));
+        const { ed25519: ed255197 } = await Promise.resolve().then(() => (init_ed25519(), ed25519_exports));
         return {
           async sign(signKey, message) {
-            return ed255194.sign(message, signKey);
+            return ed255197.sign(message, signKey);
           },
           async verify(publicKey, message, signature) {
-            return ed255194.verify(signature, message, publicKey);
+            return ed255197.verify(signature, message, publicKey);
           },
           async keygen() {
-            const signKey = ed255194.utils.randomSecretKey();
-            return { signKey, publicKey: ed255194.getPublicKey(signKey) };
+            const signKey = ed255197.utils.randomSecretKey();
+            return { signKey, publicKey: ed255197.getPublicKey(signKey) };
           }
         };
       } catch (err) {
@@ -17605,11 +17605,11 @@ var MlsOperationQueue = class _MlsOperationQueue {
     const prev = this.chains.get(channelId) ?? Promise.resolve();
     const entry = { group: this.group, kind: this.kind, key: channelId, released: false };
     const parentHeld = als?.getStore() ?? [];
-    const guarded = als ? () => als.run([...parentHeld, entry], op) : op;
+    const guarded2 = als ? () => als.run([...parentHeld, entry], op) : op;
     const settle = (p) => p.finally(() => {
       entry.released = true;
     });
-    const next = settle(prev.then(guarded, guarded));
+    const next = settle(prev.then(guarded2, guarded2));
     this.chains.set(channelId, next);
     this.inFlight.set(channelId, (this.inFlight.get(channelId) ?? 0) + 1);
     try {
@@ -23342,7 +23342,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         retryCount: 0,
         expires_at: row.expires_at,
         voiceMode: row.voice_mode ?? void 0,
-        voiceDefaultResponder: row.voice_default_responder ?? void 0
+        voiceDefaultResponder: row.voice_default_responder ?? void 0,
+        ...typeof row.identity_signature === "string" && row.identity_signature ? { identitySignature: row.identity_signature } : {},
+        payloadHex: row.payload
       };
       const custodiedAt = this.nowMs();
       this.custody.set(row.queue_id, entry);
@@ -24089,6 +24091,7 @@ function base64UrlNoPad(s) {
 }
 var BEARER_SUBPROTOCOL = "securecoms.bearer.v1";
 var WS_CLOSE_IDENTITY_REVOKED = 4006;
+var WS_CLOSE_SESSION_SUPERSEDED = 4409;
 function isIdentityRevokedClose(code, reason) {
   return code === WS_CLOSE_IDENTITY_REVOKED || reason === "identity_revoked";
 }
@@ -24304,7 +24307,7 @@ function openDeliveryPings(o) {
         end();
       };
       if (!hardened) {
-        if (code === 4001 || isIdentityRevokedClose(code, reason)) {
+        if (code === 4001 || code === WS_CLOSE_SESSION_SUPERSEDED || isIdentityRevokedClose(code, reason)) {
           terminalClose();
           return;
         }
@@ -24313,7 +24316,7 @@ function openDeliveryPings(o) {
       }
       const tr = terminalReason;
       terminalReason = void 0;
-      if (code === 4006 || tr && code === 4001) {
+      if (code === 4006 || code === WS_CLOSE_SESSION_SUPERSEDED || tr && code === 4001) {
         lifecycle("terminal", tr ?? `code ${code}`);
         terminalClose();
         return;
@@ -24470,10 +24473,14 @@ var RestTransport = class {
   f;
   ws;
   tokenProvider;
-  /** The most recent device-wide WS send handle, captured on subscribe and
-   * cleared on its close. Control frames (status keepalive) route through it;
-   * a no-op when no subscription is active. */
+  /** The shared delivery-ping socket's send, set while that socket is open and
+   * cleared when it closes (last subscriber gone, or terminal). Control frames
+   * (status keepalive) route through it; a no-op when no subscription is active. */
   _controlSend = null;
+  /** P-5: the one delivery-ping stream this transport holds, shared by every subscriber. */
+  pingHub = null;
+  /** Set once the shared stream ends on a terminal close; no socket is ever reopened. */
+  pingsTerminal = false;
   constructor(opts) {
     this.opts = opts;
     this.f = opts.fetchImpl ?? fetch;
@@ -24575,25 +24582,52 @@ var RestTransport = class {
       idempotentReplay: j.idempotent_replay === true
     };
   }
+  /** One device-wide delivery-ping socket per transport (P-5): the backend
+   * supersedes a second socket for the same device, so every subscriber shares
+   * one `openDeliveryPings` handle. Each gets its own bounded queue; its close()
+   * detaches only itself; the socket closes with the last subscriber and a later
+   * subscribe opens a fresh one. After a terminal close the transport is
+   * terminal: later calls open no socket and get an already-ended iterator. */
   subscribeDeliveryPings(_channelId) {
+    if (this.pingsTerminal) {
+      const ended = new PingSubscriber();
+      ended.end();
+      return { pings: ended.pings, close: () => {
+      }, send: () => {
+      } };
+    }
+    const hub = this.pingHub ??= this.openPingHub();
+    const sub = hub.attach();
+    return { pings: sub.pings, close: () => hub.detach(sub), send: hub.send };
+  }
+  openPingHub() {
     let wsUrl = this.opts.baseUrl.replace(/^http/, "ws").replace(/\/$/, "") + "/api/v1/ws";
     if (this.opts.connectIdentityId) {
       wsUrl += `?connect_identity_id=${encodeURIComponent(this.opts.connectIdentityId)}`;
     }
-    const handle = openDeliveryPings({
+    const hub = new PingHub(openDeliveryPings({
       url: wsUrl,
       tokenProvider: this.tokenProvider,
       wsImpl: this.ws,
       hardened: this.opts.hardenedReconnect ?? false,
-      onLifecycle: this.opts.onWsLifecycle
-    });
-    this._controlSend = handle.send;
-    const close = () => {
-      if (this._controlSend === handle.send)
-        this._controlSend = null;
-      handle.close();
-    };
-    return { pings: handle.pings, close, send: handle.send };
+      onLifecycle: this.opts.onWsLifecycle,
+      // Any terminal close (4001, 4006, 4409, hardened war-cap) of the shared
+      // socket makes this transport terminal. The shared iterator ends right
+      // after this call, so the pump exit tears down every subscriber.
+      onTerminalClose: (close) => {
+        this.pingsTerminal = true;
+        this.opts.onTerminalClose?.(close);
+      }
+    }), () => this.dropPingHub(hub));
+    this._controlSend = hub.send;
+    return hub;
+  }
+  dropPingHub(hub) {
+    if (this.pingHub === hub) {
+      this.pingHub = null;
+      this._controlSend = null;
+    }
+    hub.shutdown();
   }
   sendControlFrame(_channelId, frame) {
     try {
@@ -24621,6 +24655,90 @@ var RestTransport = class {
     }));
   }
 };
+var SUBSCRIBER_QUEUE_MAX = 8;
+var PingSubscriber = class {
+  queue = [];
+  waiter;
+  ended = false;
+  started = false;
+  pings = {
+    [Symbol.asyncIterator]: () => {
+      if (this.started)
+        throw new Error("subscribeDeliveryPings: single-use async iterable");
+      this.started = true;
+      return {
+        next: () => {
+          if (this.ended)
+            return Promise.resolve({ value: void 0, done: true });
+          if (this.queue.length)
+            return Promise.resolve({ value: this.queue.shift(), done: false });
+          return new Promise((resolve) => {
+            this.waiter = resolve;
+          });
+        }
+      };
+    }
+  };
+  push(p) {
+    if (this.ended)
+      return;
+    if (this.waiter) {
+      const w = this.waiter;
+      this.waiter = void 0;
+      w({ value: p, done: false });
+    } else if (this.queue.length < SUBSCRIBER_QUEUE_MAX) {
+      this.queue.push(p);
+    }
+  }
+  end() {
+    this.ended = true;
+    this.queue.length = 0;
+    if (this.waiter) {
+      const w = this.waiter;
+      this.waiter = void 0;
+      w({ value: void 0, done: true });
+    }
+  }
+};
+var PingHub = class {
+  handle;
+  onGone;
+  subs = /* @__PURE__ */ new Set();
+  send;
+  constructor(handle, onGone) {
+    this.handle = handle;
+    this.onGone = onGone;
+    this.send = handle.send;
+    void this.pump();
+  }
+  /** `openDeliveryPings` iterables never reject and push() never throws, so
+   * this loop only ends when the shared stream ends (our close, or terminal). */
+  async pump() {
+    for await (const p of this.handle.pings)
+      for (const s of this.subs)
+        s.push(p);
+    this.onGone();
+  }
+  attach() {
+    const s = new PingSubscriber();
+    this.subs.add(s);
+    return s;
+  }
+  /** Idempotent: detaches and ends only `s`; the last one out closes the socket. */
+  detach(s) {
+    this.subs.delete(s);
+    s.end();
+    if (this.subs.size === 0)
+      this.onGone();
+  }
+  /** Idempotent: `openDeliveryPings().close()` is, and the set is empty after. */
+  shutdown() {
+    for (const s of this.subs)
+      s.end();
+    this.subs.clear();
+    this.handle.close();
+  }
+};
 
 // ../connect-sdk-ts/dist/mls/rest-backend.js
 function describeType(v) {
@@ -25542,7 +25660,9 @@ var FakeConnectBackend = class _FakeConnectBackend {
         epoch: p.epoch,
         payload: bytesToHex22(canonical),
         connect_channel_id: p.channelId,
-        created_at: ""
+        created_at: "",
+        identity_signature: null
+        // the envelope above is unsigned
       });
     }
   }
@@ -25554,7 +25674,11 @@ var FakeConnectBackend = class _FakeConnectBackend {
   // edge stores the canonical envelope bytes (hex) and fans out one delivery row
   // per active member device except the sender's. We resolve the sender's device
   // from sender_id (recorded at registerDevice); if unknown, every member gets it.
-  async ingestApplication(envelope) {
+  //
+  // Owner-signed tool grants (spec §7.0): like Plan 0's backend, each row carries
+  // the envelope's `identity_proof.signature` as `identity_signature` beside the
+  // unsigned canonical payload. `omitSignature` models a pre-Plan-0 row.
+  async ingestApplication(envelope, opts) {
     const channelId = envelope.channel_id;
     const canonical = await canonicalEnvelopeBytes(envelope);
     const members = this.membersByChannel.get(channelId) ?? [];
@@ -25572,7 +25696,8 @@ var FakeConnectBackend = class _FakeConnectBackend {
         epoch: envelope.mls_group_epoch,
         payload: bytesToHex22(canonical),
         connect_channel_id: channelId,
-        created_at: ""
+        created_at: "",
+        identity_signature: opts?.omitSignature ? null : envelope.identity_proof.signature || null
       });
     }
   }
@@ -25944,11 +26069,15 @@ function openSchema(db) {
   ensureUnifiedDmOwner(db);
   ensureConversationLastAbsentAt(db);
   ensureRecallForgetTables(db);
+  ensureAgentMemoryOrigin(db);
   ensureRuntimeInboxDeliveryAttempts(db);
   ensureRuntimeReplyIntent(db);
   ensureRuntimeReplyIntentEnvelopeGroup(db);
   ensureGroupLink(db);
   ensureMlsCustody(db);
+  ensureToolGrantTables(db);
+  ensureToolGrantAppliedTable(db);
+  ensureRoomSearchCapTable(db);
   db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
 }
 function ensureMlsCustody(db) {
@@ -26043,6 +26172,11 @@ function ensureRecallStateColumns(db) {
     }
   }
 }
+function ensureAgentMemoryOrigin(db) {
+  const cols = db.prepare("PRAGMA table_info(agent_memory)").all();
+  if (cols.length > 0 && !cols.some((c) => c.name === "origin"))
+    db.exec("ALTER TABLE agent_memory ADD COLUMN origin TEXT");
+}
 function ensureRecallForgetTables(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS agent_memory_recall_forgotten (
@@ -26118,6 +26252,67 @@ function ensureUnifiedStateColumns(db) {
     }
   }
 }
+function ensureToolGrantAppliedTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS tool_grant_applied (
+      identity_id    TEXT NOT NULL,
+      pin_key_b64    TEXT NOT NULL,
+      sealed_applied BLOB NOT NULL,
+      updated_at     INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, pin_key_b64)
+    );
+  `);
+}
+function ensureRoomSearchCapTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS room_search_cap (
+      identity_id   TEXT NOT NULL,
+      channel_id    TEXT NOT NULL,
+      utc_day       TEXT NOT NULL,
+      granted_turns INTEGER NOT NULL,
+      reached_by    TEXT,
+      notice_posted INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, channel_id)
+    );
+  `);
+}
+function ensureToolGrantTables(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS tool_grant_manifest (
+      identity_id     TEXT NOT NULL,
+      pin_key_b64     TEXT NOT NULL,
+      counter         INTEGER NOT NULL,
+      sealed_manifest BLOB NOT NULL,
+      updated_at      INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, pin_key_b64)
+    );
+    CREATE TABLE IF NOT EXISTS owner_replay (
+      identity_id  TEXT NOT NULL,
+      channel_id   TEXT NOT NULL,
+      message_id   TEXT NOT NULL,
+      group_id     TEXT NOT NULL,
+      epoch        INTEGER NOT NULL,
+      processed_at INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, channel_id, message_id)
+    );
+    CREATE INDEX IF NOT EXISTS owner_replay_age ON owner_replay (identity_id, channel_id, processed_at);
+    CREATE TABLE IF NOT EXISTS owner_verify_failed (
+      identity_id TEXT NOT NULL,
+      channel_id  TEXT NOT NULL,
+      message_id  TEXT NOT NULL,
+      failed_at   INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, message_id)
+    );
+    CREATE TABLE IF NOT EXISTS owner_replay_closed_epoch (
+      identity_id TEXT NOT NULL,
+      channel_id  TEXT NOT NULL,
+      group_id    TEXT NOT NULL,
+      epoch       INTEGER NOT NULL,
+      closed_at   INTEGER NOT NULL,
+      PRIMARY KEY (identity_id, channel_id, group_id, epoch)
+    );
+  `);
+}
 
 // ../connect-mls-store/dist/errors.js
 var MlsStoreCorruptError = class extends Error {
@@ -26272,7 +26467,16 @@ function itemVecAad(identityId, f, modelId) {
   return enc4.encode(["agent_memory_item_vec", identityId, f.scopeKind, f.scopeId, f.originId, String(f.chunkIndex), modelId].join(NUL));
 }
 function encodeItemRecord(r) {
-  return enc4.encode(JSON.stringify({ v: 1, t: r.text, s: r.source, tr: r.trust, ...r.sourceRef !== void 0 ? { sr: r.sourceRef } : {}, ...r.chunks !== void 0 ? { c: r.chunks } : {} }));
+  return enc4.encode(JSON.stringify({
+    v: 1,
+    t: r.text,
+    s: r.source,
+    tr: r.trust,
+    ...r.sourceRef !== void 0 ? { sr: r.sourceRef } : {},
+    ...r.chunks !== void 0 ? { c: r.chunks } : {},
+    ...r.role !== void 0 ? { ro: r.role } : {},
+    ...r.origin !== void 0 ? { or: r.origin } : {}
+  }));
 }
 function decodeItemRecord(b) {
   let o;
@@ -26283,7 +26487,7 @@ function decodeItemRecord(b) {
   }
   if (!o || typeof o !== "object" || Array.isArray(o))
     return null;
-  const { v, t, s, tr, sr, c } = o;
+  const { v, t, s, tr, sr, c, ro, or } = o;
   if (v !== 1 || typeof t !== "string" || typeof s !== "string" || !ITEM_SOURCES.includes(s))
     return null;
   if (tr !== "owner" && tr !== "reference")
@@ -26294,7 +26498,19 @@ function decodeItemRecord(b) {
     return null;
   if (c !== void 0 && (typeof c !== "number" || !Number.isSafeInteger(c) || c < 1))
     return null;
-  return { text: t, source: s, trust: tr, ...sr !== void 0 ? { sourceRef: sr } : {}, ...c !== void 0 ? { chunks: c } : {} };
+  if (ro !== void 0 && ro !== "peer" && ro !== "agent")
+    return null;
+  if (or !== void 0 && or !== "fast_path" && or !== "reply" && or !== "untrusted")
+    return null;
+  return {
+    text: t,
+    source: s,
+    trust: tr,
+    ...sr !== void 0 ? { sourceRef: sr } : {},
+    ...c !== void 0 ? { chunks: c } : {},
+    ...ro !== void 0 ? { role: ro } : {},
+    ...or !== void 0 ? { origin: or } : {}
+  };
 }
 var noteSourceRef = (conversationId, noteId) => `agent_memory_note:${conversationId}:${noteId}`;
 var recallSourceRef = (conversationId, messageId) => `agent_memory_recall:${conversationId}:${messageId}`;
@@ -26338,6 +26554,14 @@ function bytesEqual(a, b) {
 function sameTag(prior, tag) {
   return prior !== null && prior.groupId === tag.groupId && prior.epoch === tag.epoch;
 }
+function metaOf(r) {
+  return {
+    ...r.message_id !== null ? { messageId: r.message_id } : {},
+    modality: r.modality,
+    ...isOrigin(r.origin) ? { origin: r.origin } : {}
+  };
+}
+var isOrigin = (v) => v === "fast_path" || v === "reply" || v === "untrusted";
 var UTF8 = new TextDecoder();
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_MEMORY_RETENTION_MS = 30 * DAY_MS;
@@ -26386,6 +26610,8 @@ function cachePreparedStatements(db) {
     return st;
   };
 }
+var OWNER_REPLAY_MAX_PER_CHANNEL = 1e4;
+var OWNER_REPLAY_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var SqliteMlsStateStore = class _SqliteMlsStateStore {
   db;
   id;
@@ -26759,7 +26985,13 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
    * same message (the bridge's ingest stamp). The staged row is never
    * rewritten: on a match the FIRST staging stays authoritative.
    */
-  async stageRuntimeInbox(messageId, payload, receivedAt = Date.now(), samePayload = bytesEqual) {
+  /**
+   * Owner-signed tool grants (P-3, plan 1 task 4): when `ownerReplay` is given,
+   * the owner replay entry and the runtime_inbox row are written in ONE
+   * BEGIN IMMEDIATE transaction, so a failed stage records no replay entry and a
+   * recorded replay entry always has its staged message.
+   */
+  async stageRuntimeInbox(messageId, payload, receivedAt = Date.now(), samePayload = bytesEqual, ownerReplay) {
     const prior = this.db.prepare("SELECT sealed_message FROM runtime_inbox WHERE identity_id=? AND message_id=?").get(this.id, messageId);
     if (prior) {
       const priorPayload = await this.openRuntimeInboxPayload(prior.sealed_message);
@@ -26769,9 +27001,20 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       return false;
     }
     const sealed = await this.cipher.seal(payload);
-    const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_inbox
-         (identity_id, message_id, sealed_message, received_at)
-       VALUES (?, ?, ?, ?)`).run(this.id, messageId, sealed, receivedAt);
+    const info = this.immediate(() => {
+      if (ownerReplay) {
+        this.db.prepare(`INSERT OR IGNORE INTO owner_replay
+             (identity_id, channel_id, message_id, group_id, epoch, processed_at)
+           VALUES (?, ?, ?, ?, ?, ?)`).run(this.id, ownerReplay.channelId, messageId, ownerReplay.groupId, ownerReplay.epoch, ownerReplay.processedAt);
+      }
+      if (this.failNextRuntimeInboxInsert) {
+        this.failNextRuntimeInboxInsert = false;
+        throw new Error("runtime_inbox insert failed (test)");
+      }
+      return this.db.prepare(`INSERT OR IGNORE INTO runtime_inbox
+           (identity_id, message_id, sealed_message, received_at)
+         VALUES (?, ?, ?, ?)`).run(this.id, messageId, sealed, receivedAt);
+    });
     if (info.changes === 0) {
       const raced = this.db.prepare("SELECT sealed_message FROM runtime_inbox WHERE identity_id=? AND message_id=?").get(this.id, messageId);
       const racedPayload = await this.openRuntimeInboxPayload(raced.sealed_message);
@@ -27054,10 +27297,10 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       return { seq: 0, deduped: false, dropped: true };
     }
     const info = this.db.prepare(`INSERT OR IGNORE INTO agent_memory
-         (identity_id, conversation_id, seq, role, peer_id, sealed_text, modality, message_id, idempotency_key, dedup_key, recorded_at)
+         (identity_id, conversation_id, seq, role, peer_id, sealed_text, modality, message_id, idempotency_key, dedup_key, recorded_at, origin)
        VALUES (?, ?,
          (SELECT COALESCE(MAX(seq),0)+1 FROM agent_memory WHERE identity_id=? AND conversation_id=?),
-         ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, now);
+         ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(this.id, input.conversationId, this.id, input.conversationId, input.role, input.peerId ?? null, sealed, input.modality, input.messageId ?? null, input.idempotencyKey ?? null, dedupKey, now, isOrigin(input.origin) ? input.origin : null);
     if (info.changes === 0) {
       const row2 = this.db.prepare("SELECT seq FROM agent_memory WHERE identity_id=? AND conversation_id=? AND dedup_key=?").get(this.id, input.conversationId, dedupKey);
       return { seq: row2.seq, deduped: true };
@@ -27081,6 +27324,29 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       facts.push(new TextDecoder().decode(await this.cipher.open(f.sealed_fact)));
     return { recent, facts };
   }
+  /** Owner grants plan 4 Task 16: message id, modality and origin of the given lines (clear columns only, no text). */
+  memoryLineMeta(conversationId, seqs) {
+    const out = /* @__PURE__ */ new Map();
+    const stmt = this.db.prepare("SELECT message_id, modality, origin FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq=?");
+    for (const seq of seqs) {
+      const r = stmt.get(this.id, conversationId, seq);
+      if (r)
+        out.set(seq, metaOf(r));
+    }
+    return out;
+  }
+  /** Owner grants plan 4 Task 16 (audit r2 M-1): every peer row's message id in the conversation, not the 50-row window. */
+  memoryPeerMessageIds(conversationId) {
+    return this.db.prepare("SELECT message_id FROM agent_memory WHERE identity_id=? AND conversation_id=? AND role='peer' AND message_id IS NOT NULL").all(this.id, conversationId).map((r) => r.message_id);
+  }
+  /** Owner grants plan 4 Task 16 (OQ-9): the history row an imported_history item came from, or null when it is gone. */
+  memoryRowForTrace(conversationId, at) {
+    const cols = "role, peer_id, message_id, modality, origin, recorded_at";
+    const r = at.seq !== void 0 ? this.db.prepare(`SELECT ${cols} FROM agent_memory WHERE identity_id=? AND conversation_id=? AND seq=?`).get(this.id, conversationId, at.seq) : at.messageId !== void 0 ? this.db.prepare(`SELECT ${cols} FROM agent_memory WHERE identity_id=? AND conversation_id=? AND message_id=?`).get(this.id, conversationId, at.messageId) : void 0;
+    if (!r)
+      return null;
+    return { role: r.role === "agent" ? "agent" : "peer", ts: Number(r.recorded_at), ...r.peer_id ? { peerId: r.peer_id } : {}, ...metaOf(r) };
+  }
   async recordMemoryFact(conversationId, fact) {
     const now = this.memoryNow();
     const sealed = await this.cipher.seal(new TextEncoder().encode(fact));
@@ -28108,7 +28374,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   }
   /** §14.1 (R-U12): one conversation's history in seq order, opened under the EMPTY AAD. Batched by `afterSeq`; `next` is {at: recorded_at, id: seq}. */
   async readHistoryForMigration(conversationId, sinceMs, afterSeq, limit) {
-    const raw = this.db.prepare(`SELECT seq, message_id, role, sealed_text, recorded_at FROM agent_memory WHERE identity_id=? AND conversation_id=? AND recorded_at>=? AND seq>?
+    const raw = this.db.prepare(`SELECT seq, message_id, role, sealed_text, recorded_at, modality, origin FROM agent_memory WHERE identity_id=? AND conversation_id=? AND recorded_at>=? AND seq>?
        ORDER BY seq ASC LIMIT ?`).all(this.id, conversationId, sinceMs, afterSeq, limit);
     const rows = [];
     let unreadable = 0;
@@ -28117,7 +28383,15 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
         await yieldToLoop();
       try {
         const text = UTF8.decode(await this.cipher.open(r.sealed_text));
-        rows.push({ seq: Number(r.seq), messageId: r.message_id ?? null, role: r.role === "agent" ? "agent" : "peer", text, recordedAt: Number(r.recorded_at) });
+        rows.push({
+          seq: Number(r.seq),
+          messageId: r.message_id ?? null,
+          role: r.role === "agent" ? "agent" : "peer",
+          text,
+          recordedAt: Number(r.recorded_at),
+          modality: r.modality,
+          ...isOrigin(r.origin) ? { origin: r.origin } : {}
+        });
       } catch {
         unreadable++;
       }
@@ -28519,6 +28793,156 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     const res = expectCreatedAt === void 0 ? this.db.prepare("DELETE FROM mls_owed_followup WHERE identity_id=? AND channel_id=?").run(this.id, channelId) : this.db.prepare("DELETE FROM mls_owed_followup WHERE identity_id=? AND channel_id=? AND created_at=?").run(this.id, channelId, expectCreatedAt);
     return Number(res.changes) > 0;
   }
+  // ---------------------------------------------------------------------------
+  // Owner-signed tool grants, step 1 (plan 1 task 4; spec §7.3, §7.11; D-2).
+  /** The last good manifest wrapper stored for this pinned public key, or null. */
+  async loadToolGrantManifest(pinKeyB64) {
+    const row = this.db.prepare("SELECT counter, sealed_manifest FROM tool_grant_manifest WHERE identity_id=? AND pin_key_b64=?").get(this.id, pinKeyB64);
+    if (!row)
+      return null;
+    return { counter: Number(row.counter), wrapper: await this.unsealJson(row.sealed_manifest) };
+  }
+  /** Stores a verified wrapper. The counter can never fall or repeat, whatever the
+   *  caller does: the upsert's WHERE refuses it and this throws. */
+  async saveToolGrantManifest(pinKeyB64, counter, wrapper) {
+    const sealed = await this.sealJson(wrapper);
+    const info = this.db.prepare(`INSERT INTO tool_grant_manifest (identity_id, pin_key_b64, counter, sealed_manifest, updated_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(identity_id, pin_key_b64) DO UPDATE SET
+         counter = excluded.counter, sealed_manifest = excluded.sealed_manifest, updated_at = excluded.updated_at
+       WHERE excluded.counter > tool_grant_manifest.counter`).run(this.id, pinKeyB64, counter, sealed, Date.now());
+    if (Number(info.changes) === 0)
+      throw new Error("tool grant counter not increasing");
+  }
+  /** Counter rule §6.6: state is per pinned key; a new key starts a new counter. */
+  dropToolGrantManifestsExcept(pinKeyB64) {
+    return Number(this.db.prepare("DELETE FROM tool_grant_manifest WHERE identity_id=? AND pin_key_b64<>?").run(this.id, pinKeyB64).changes);
+  }
+  // Owner-signed tool grants plan 4, Task 12 (spec §7.5): the room web_search backstop, per room per UTC day.
+  /** A row of another day reads as zero. */
+  roomSearchCapState(channelId, utcDay) {
+    const row = this.db.prepare("SELECT granted_turns, reached_by, notice_posted FROM room_search_cap WHERE identity_id=? AND channel_id=? AND utc_day=?").get(this.id, channelId, utcDay);
+    if (!row)
+      return { grantedTurns: 0, reachedBy: null, noticePosted: false };
+    const by = row.reached_by === "bridge" || row.reached_by === "runtime" ? row.reached_by : null;
+    return { grantedTurns: Number(row.granted_turns), reachedBy: by, noticePosted: Number(row.notice_posted) === 1 };
+  }
+  /** One statement: a row of an earlier day is reset, then +1. Returns the new count. */
+  countRoomSearchGrant(channelId, utcDay) {
+    const row = this.db.prepare(`INSERT INTO room_search_cap (identity_id, channel_id, utc_day, granted_turns, reached_by, notice_posted)
+       VALUES (?, ?, ?, 1, NULL, 0)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET
+         granted_turns = CASE WHEN room_search_cap.utc_day = excluded.utc_day THEN room_search_cap.granted_turns + 1 ELSE 1 END,
+         reached_by    = CASE WHEN room_search_cap.utc_day = excluded.utc_day THEN room_search_cap.reached_by ELSE NULL END,
+         notice_posted = CASE WHEN room_search_cap.utc_day = excluded.utc_day THEN room_search_cap.notice_posted ELSE 0 END,
+         utc_day       = excluded.utc_day
+       RETURNING granted_turns`).get(this.id, channelId, utcDay);
+    return Number(row.granted_turns);
+  }
+  /** True when this call set the flag (the first time today). */
+  markRoomSearchCapReached(channelId, utcDay, by) {
+    const info = this.db.prepare(`INSERT INTO room_search_cap (identity_id, channel_id, utc_day, granted_turns, reached_by, notice_posted)
+       VALUES (?, ?, ?, 0, ?, 0)
+       ON CONFLICT(identity_id, channel_id) DO UPDATE SET
+         granted_turns = CASE WHEN room_search_cap.utc_day = excluded.utc_day THEN room_search_cap.granted_turns ELSE 0 END,
+         notice_posted = CASE WHEN room_search_cap.utc_day = excluded.utc_day THEN room_search_cap.notice_posted ELSE 0 END,
+         reached_by    = excluded.reached_by,
+         utc_day       = excluded.utc_day
+       WHERE room_search_cap.utc_day <> excluded.utc_day OR room_search_cap.reached_by IS NULL`).run(this.id, channelId, utcDay, by);
+    return Number(info.changes) > 0;
+  }
+  markRoomSearchCapNoticePosted(channelId, utcDay) {
+    this.db.prepare("UPDATE room_search_cap SET notice_posted = 1 WHERE identity_id=? AND channel_id=? AND utc_day=?").run(this.id, channelId, utcDay);
+  }
+  /** Deletes rows of earlier days; called at start(). */
+  pruneRoomSearchCap(utcDay) {
+    return Number(this.db.prepare("DELETE FROM room_search_cap WHERE identity_id=? AND utc_day < ?").run(this.id, utcDay).changes);
+  }
+  // Owner-signed tool grants plan 4, Task 11 (rulings item 3): the last applied good search block.
+  /** The applied record for this pinned key, or null. `search: null` means "applied with no search block". */
+  async loadToolGrantApplied(pinKeyB64) {
+    const row = this.db.prepare("SELECT sealed_applied FROM tool_grant_applied WHERE identity_id=? AND pin_key_b64=?").get(this.id, pinKeyB64);
+    if (!row)
+      return null;
+    return await this.unsealJson(row.sealed_applied);
+  }
+  async saveToolGrantApplied(pinKeyB64, applied) {
+    const sealed = await this.sealJson({ counter: applied.counter, search: applied.search });
+    this.db.prepare(`INSERT INTO tool_grant_applied (identity_id, pin_key_b64, sealed_applied, updated_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(identity_id, pin_key_b64) DO UPDATE SET
+         sealed_applied = excluded.sealed_applied, updated_at = excluded.updated_at`).run(this.id, pinKeyB64, sealed, Date.now());
+  }
+  /** Counter rule §6.6: a new pinned key drops the old key's applied record. */
+  dropToolGrantAppliedExcept(pinKeyB64) {
+    return Number(this.db.prepare("DELETE FROM tool_grant_applied WHERE identity_id=? AND pin_key_b64<>?").run(this.id, pinKeyB64).changes);
+  }
+  hasOwnerMessage(channelId, messageId) {
+    return this.db.prepare("SELECT 1 FROM owner_replay WHERE identity_id=? AND channel_id=? AND message_id=?").get(this.id, channelId, messageId) !== void 0;
+  }
+  isOwnerEpochClosed(channelId, groupId, epoch) {
+    return this.db.prepare("SELECT 1 FROM owner_replay_closed_epoch WHERE identity_id=? AND channel_id=? AND group_id=? AND epoch=?").get(this.id, channelId, groupId, epoch) !== void 0;
+  }
+  recordOwnerVerifyFailure(channelId, messageId, failedAt = Date.now()) {
+    this.db.prepare("INSERT OR IGNORE INTO owner_verify_failed (identity_id, channel_id, message_id, failed_at) VALUES (?, ?, ?, ?)").run(this.id, channelId, messageId, failedAt);
+  }
+  isOwnerVerifyFailed(messageId) {
+    return this.db.prepare("SELECT 1 FROM owner_verify_failed WHERE identity_id=? AND message_id=?").get(this.id, messageId) !== void 0;
+  }
+  listOwnerReplayChannels() {
+    return this.db.prepare("SELECT DISTINCT channel_id FROM owner_replay WHERE identity_id=? ORDER BY channel_id").all(this.id).map((r) => r.channel_id);
+  }
+  /**
+   * Decision D-2. Per channel with a known current (group, epoch): rows of the
+   * current pair are never pruned; among the others, drop rows older than
+   * `maxAgeMs`, then every row past the newest `maxPerChannel`, oldest first.
+   * Every pair that lost a row is recorded closed. A channel with no current
+   * position is skipped this pass. Old `owner_verify_failed` rows go too.
+   * Returns the number of owner_replay rows removed.
+   */
+  pruneOwnerReplay(nowMs, currentOf, opts = {}) {
+    const maxPerChannel = opts.maxPerChannel ?? OWNER_REPLAY_MAX_PER_CHANNEL;
+    const maxAgeMs = opts.maxAgeMs ?? OWNER_REPLAY_MAX_AGE_MS;
+    const cutoff = nowMs - maxAgeMs;
+    return this.immediate(() => {
+      let removed = 0;
+      for (const channelId of this.listOwnerReplayChannels()) {
+        const cur = currentOf.get(channelId);
+        if (!cur)
+          continue;
+        const others = this.db.prepare(`SELECT rowid AS rid, group_id, epoch, processed_at FROM owner_replay
+           WHERE identity_id=? AND channel_id=? AND NOT (group_id=? AND epoch=?)
+           ORDER BY processed_at DESC, rowid DESC`).all(this.id, channelId, cur.groupId, cur.epoch);
+        const young = others.filter((r) => Number(r.processed_at) >= cutoff);
+        const victims = [...others.filter((r) => Number(r.processed_at) < cutoff), ...young.slice(maxPerChannel)];
+        const closed = /* @__PURE__ */ new Map();
+        const del = this.db.prepare("DELETE FROM owner_replay WHERE rowid=?");
+        for (const v of victims) {
+          removed += Number(del.run(v.rid).changes);
+          closed.set(`${v.group_id}\0${v.epoch}`, { groupId: v.group_id, epoch: Number(v.epoch) });
+        }
+        const close = this.db.prepare(`INSERT OR IGNORE INTO owner_replay_closed_epoch (identity_id, channel_id, group_id, epoch, closed_at)
+           VALUES (?, ?, ?, ?, ?)`);
+        for (const p of closed.values()) {
+          if (p.groupId === cur.groupId && p.epoch === cur.epoch)
+            continue;
+          close.run(this.id, channelId, p.groupId, p.epoch, nowMs);
+        }
+      }
+      this.db.prepare("DELETE FROM owner_verify_failed WHERE identity_id=? AND failed_at < ?").run(this.id, cutoff);
+      return removed;
+    });
+  }
+  failNextRuntimeInboxInsert = false;
+  /** @internal test-only: the next runtime_inbox INSERT inside the staging transaction throws once. */
+  _failNextRuntimeInboxInsertForTest() {
+    this.failNextRuntimeInboxInsert = true;
+  }
+  /** @internal test-only */
+  _insertOwnerReplayForTest(channelId, messageId, groupId, epoch, processedAt) {
+    this.db.prepare(`INSERT INTO owner_replay (identity_id, channel_id, message_id, group_id, epoch, processed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`).run(this.id, channelId, messageId, groupId, epoch, processedAt);
+  }
   /** @internal test-only */
   _rawMainForTest(identityId, channelId) {
     const row = this.db.prepare("SELECT sealed_main FROM mls_group_state WHERE identity_id=? AND channel_id=?").get(identityId, channelId);
@@ -28671,8 +29095,8 @@ function loadPackageMeta(importMetaUrl) {
 }
 
 // src/bridge-agent.ts
-import { promises as fsp, statSync as statSync4 } from "node:fs";
-import { join as join16, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync5, promises as fsp, statSync as statSync4 } from "node:fs";
+import { join as join17, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/latency.ts
@@ -29263,8 +29687,8 @@ async function prepareAttachment(filePath2, caption, channelId, deps) {
 async function materializeAttachment(body, ctx, deps) {
   await deps.ready();
   const ciphertext = await deps.downloadBlob(body.blobId);
-  const sha25611 = await deps.computeFileDigest(ciphertext);
-  if (sha25611 !== body.digest) {
+  const sha25612 = await deps.computeFileDigest(ciphertext);
+  if (sha25612 !== body.digest) {
     throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
   }
   const plain = await deps.decryptFile(
@@ -29277,7 +29701,7 @@ async function materializeAttachment(body, ctx, deps) {
   const path = `${dir}/${ctx.messageId}-${safeName}`;
   await deps.mkdirp(dir);
   await deps.writeFile(path, plain);
-  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha25611 };
+  return { filename: safeName, mime: body.mime, size: plain.length, path, sha256: sha25612 };
 }
 
 // src/sodium-ready.ts
@@ -29866,11 +30290,11 @@ function quoteFromMessage(note, record) {
 }
 function renderNotes(notes) {
   if (notes.length === 0) return void 0;
-  const lines = notes.map((n) => {
+  const lines2 = notes.map((n) => {
     const one = oneLine(n.text);
     return `- [n${n.id}] ${/^[#\-\[]/.test(one) ? `\\${one}` : one}`;
   });
-  return [NOTES_HEADING, ...lines].join("\n");
+  return [NOTES_HEADING, ...lines2].join("\n");
 }
 
 // src/memory/secret-scan.ts
@@ -30619,7 +31043,7 @@ function gcModels(root3, keepModelIds, now, maxAgeMs = THIRTY_DAYS) {
 
 // src/memory/embedder/manifest.ts
 var MODEL_ORIGIN = "https://downloads.securecoms.ai";
-var file = (modelId, name, sha25611, size) => Object.freeze({ name, urlPath: `/models/embeddings/${modelId}/${sha25611}/${name}`, sha256: sha25611, size });
+var file = (modelId, name, sha25612, size) => Object.freeze({ name, urlPath: `/models/embeddings/${modelId}/${sha25612}/${name}`, sha256: sha25612, size });
 var MODEL_ID = "minilm-l6-v2-int8";
 var EMBEDDING_MANIFEST = Object.freeze({
   modelId: MODEL_ID,
@@ -30963,8 +31387,8 @@ import { join as join11, win32 } from "node:path";
 var WINDOWS_SEMANTIC_ENABLED = false;
 var windowsSemanticOn = (platform, enabled = WINDOWS_SEMANTIC_ENABLED) => platform !== "win32" || enabled;
 function parseSaveSddl(saveFile) {
-  const lines = saveFile.toString("utf16le").replace(/^\uFEFF/, "").split(/\r?\n/);
-  return (lines[1] ?? "").trim();
+  const lines2 = saveFile.toString("utf16le").replace(/^\uFEFF/, "").split(/\r?\n/);
+  return (lines2[1] ?? "").trim();
 }
 function aclAllows(sddl, ownerSid) {
   const allowed = /* @__PURE__ */ new Set([ownerSid, "SY", "BA"]);
@@ -32359,7 +32783,15 @@ var ItemBook = class {
         originAt: r.originAt,
         storedAt
       });
-      const rec = (text, chunks) => ({ text, source: r.source, trust: r.trust, ...r.sourceRef !== void 0 ? { sourceRef: r.sourceRef } : {}, ...chunks ? { chunks } : {} });
+      const rec = (text, chunks) => ({
+        text,
+        source: r.source,
+        trust: r.trust,
+        ...r.sourceRef !== void 0 ? { sourceRef: r.sourceRef } : {},
+        ...chunks ? { chunks } : {},
+        ...r.role !== void 0 ? { role: r.role } : {},
+        ...r.origin !== void 0 ? { origin: r.origin } : {}
+      });
       if (chunked) parts.push({ itemId: first, chunkIndex: 0, parentId: null, parentOriginId: "", sealedRecord: await this.d.store.sealItemRecord(fields(0), rec("", texts.length)), sealedVec: null, modelId: null, tokenMacs: [], embeddable: false });
       const inlineOk = r.pendingOnly !== true && !this.d.paused() && this.d.embedOn() && this.d.embedder.state().state === "ready";
       for (const [i, text] of texts.entries()) {
@@ -32638,7 +33070,7 @@ var UnifiedReadBook = class {
     this.entries.set(p.messageId, { channelId: p.channelId, scopeId: p.scopeId, capture, pins: pins?.pins ?? [], pinnedMore: pins?.more ?? 0, items });
   }
   /** ws flush (synchronous): the entry's own channel and owner scope, its capture still current (H-4, U11). */
-  deliverable(messageId, channelId, scopeIdNow) {
+  deliverable(messageId, channelId, scopeIdNow, keep = () => true) {
     const e = this.entries.get(messageId);
     if (!e || e.channelId !== channelId || e.scopeId !== scopeIdNow) return void 0;
     if (!same(e.capture, this.d.store.itemCapture(channelId))) {
@@ -32647,8 +33079,9 @@ var UnifiedReadBook = class {
     }
     const at = (i) => ({ id: i.itemId, source: i.source, at: i.originAt, text: clampText(i.text) });
     const all = [
-      ...e.pins.map((i) => ({ block: "pinned", ...at(i) })),
-      ...e.items.map((i) => ({ block: i.trust === "owner" ? "owner" : "reference", ...at(i) }))
+      // Owner grants plan 4 Task 16: `keep` is the voice fence on a pinned agent (never a SQL read here; the bridge supplies it).
+      ...e.pins.filter(keep).map((i) => ({ block: "pinned", ...at(i) })),
+      ...e.items.filter(keep).map((i) => ({ block: i.trust === "owner" ? "owner" : "reference", ...at(i) }))
     ];
     const items = all.slice(0, FRAME_ITEMS_MAX);
     const pinsCut = Math.max(0, e.pins.length - FRAME_ITEMS_MAX);
@@ -32693,6 +33126,56 @@ var UnifiedReadBook = class {
   }
 };
 
+// src/grants/voice-fence.ts
+import { createHash as createHash4 } from "node:crypto";
+var FAST_ID_EPOCH_MS = 17887392e5;
+function legacyFastReplyId(messageId) {
+  const h = createHash4("sha256").update(`fast:${messageId}`).digest();
+  h[6] = h[6] & 15 | 64;
+  h[8] = h[8] & 63 | 128;
+  const x = h.subarray(0, 16).toString("hex");
+  return `${x.slice(0, 8)}-${x.slice(8, 12)}-${x.slice(12, 16)}-${x.slice(16, 20)}-${x.slice(20, 32)}`;
+}
+function classifyAgentLine(line, ctx) {
+  if (line.origin === "fast_path" || line.origin === "reply" || line.origin === "untrusted") return line.origin;
+  if (line.modality === "voice") return "fast_path";
+  if (line.messageId !== void 0 && ctx.fastIds.has(line.messageId)) return "fast_path";
+  if (line.ts !== void 0 && line.ts < FAST_ID_EPOCH_MS) return "fast_path";
+  if (line.modality === "text") return "reply";
+  return "fast_path";
+}
+function isRelayClassPeer(line, ownerId) {
+  return line.modality === "voice" || line.peerId !== ownerId;
+}
+function parseHistoryRef(ref) {
+  const m = /^agent_memory:(.+):(\d+)$/.exec(ref);
+  return m ? { conversationId: m[1], seq: Number(m[2]) } : null;
+}
+function classifyUnifiedItem(item, trace, ctx, strict, keepUntrusted = false) {
+  if (strict?.turnChannelId !== void 0 && item.channelId !== strict.turnChannelId) {
+    if (item.source === "owner_typed") return "keep";
+    if (item.source !== "imported_history") return "exclude";
+    const row2 = traceItem(item, trace);
+    return row2 !== null && row2.role === "peer" && !isRelayClassPeer(row2, strict.ownerId) ? "keep" : "exclude";
+  }
+  if (strict && item.source === "owner_voice") return "exclude";
+  if (item.role === "peer" && !(strict && item.source === "imported_history")) return "keep";
+  if (item.role !== "peer" && item.origin !== void 0) return item.origin === "reply" || keepUntrusted && item.origin === "untrusted" ? "keep" : "exclude";
+  if (item.source === "agent_reply") return "keep";
+  if (item.source !== "imported_history") return "keep";
+  const row = traceItem(item, trace);
+  if (row === null) return "exclude";
+  if (row.role === "peer") return strict && isRelayClassPeer(row, strict.ownerId) ? "exclude" : "keep";
+  const origin = classifyAgentLine(row, ctx);
+  return origin === "reply" || keepUntrusted && origin === "untrusted" ? "keep" : "exclude";
+}
+function traceItem(item, trace) {
+  const ref = item.sourceRef !== void 0 ? parseHistoryRef(item.sourceRef) : null;
+  if (ref !== null) return trace(ref.conversationId, { seq: ref.seq });
+  const seqForm = /^seq:(\d+)$/.exec(item.originId);
+  return seqForm ? trace(item.channelId, { seq: Number(seqForm[1]) }) : trace(item.channelId, { messageId: item.originId });
+}
+
 // src/memory/unified/migrate.ts
 var OLD_TABLES_PRESENT = true;
 var MIGRATION_BATCH = 100;
@@ -32845,7 +33328,10 @@ async function runMigration(d, o = {}) {
           text: r.text,
           sourceRef: historySourceRef(c, r.seq),
           pendingOnly: true,
-          expect
+          expect,
+          // Owner grants plan 4 Task 16: the row's role and, for an agent row, its classified origin.
+          role: r.role,
+          ...r.role === "agent" ? { origin: d.classifyHistoryOrigin ? d.classifyHistoryOrigin(c, r) : classifyAgentLine({ origin: r.origin, modality: r.modality, ...r.messageId ? { messageId: r.messageId } : {}, ts: r.recordedAt }, { fastIds: /* @__PURE__ */ new Set() }) } : {}
         }),
         (r) => r.recordedAt,
         t
@@ -32903,9 +33389,9 @@ async function recordInboundMemory(sink, channelId, senderId, text, messageId, m
   } catch {
   }
 }
-async function recordOutboundMemory(sink, channelId, text, messageId, modality = "text", expectPurgeEpoch) {
+async function recordOutboundMemory(sink, channelId, text, messageId, modality = "text", expectPurgeEpoch, origin) {
   try {
-    await sink.record({ conversationId: channelId, role: "agent", text, modality, messageId, ...expectPurgeEpoch === void 0 ? {} : { expectPurgeEpoch } });
+    await sink.record({ conversationId: channelId, role: "agent", text, modality, messageId, ...expectPurgeEpoch === void 0 ? {} : { expectPurgeEpoch }, ...origin ? { origin } : {} });
   } catch {
   }
 }
@@ -33261,10 +33747,10 @@ function splitFastReply(raw, maxChars = 200, maxSentences = 2) {
   return { reply: normalizeFastReply(raw.replace(DEFER_RE, " "), maxChars, maxSentences), defer };
 }
 function normalizeFastReply(raw, maxChars = 200, maxSentences = 2) {
-  const lines = raw.split(/\r?\n+/).map(
+  const lines2 = raw.split(/\r?\n+/).map(
     (l) => l.replace(/^\s*(?:[-*•]|\d+[.)])\s+/, "").replace(/^\s*#{1,6}\s+/, "").replace(/[*_`]+/g, "").trim()
   ).filter(Boolean);
-  const sentences = lines.flatMap((l) => l.split(SENTENCE_END)).map((s) => s.trim()).filter(Boolean);
+  const sentences = lines2.flatMap((l) => l.split(SENTENCE_END)).map((s) => s.trim()).filter(Boolean);
   return sentences.slice(0, maxSentences).join(" ").slice(0, maxChars);
 }
 
@@ -33476,18 +33962,18 @@ function parseSummarizeBody(parsed, selfIdentityId, log = () => {
 function transcriptToPrompt(transcript) {
   const names = /* @__PURE__ */ new Map();
   for (const p of transcript.participants ?? []) names.set(p.identity_id, p.display_name);
-  const lines = transcript.turns.map(
+  const lines2 = transcript.turns.map(
     (t) => `${names.get(t.speaker_identity_id) ?? t.speaker_identity_id}: ${t.text}`
   );
-  return `${SUMMARY_PROMPT}${lines.join("\n")}
+  return `${SUMMARY_PROMPT}${lines2.join("\n")}
 `;
 }
 function parseSummaryOutput(text) {
-  const lines = text.split("\n");
-  const idx = lines.findIndex((line) => /^\s*Action items:\s*$/i.test(line));
+  const lines2 = text.split("\n");
+  const idx = lines2.findIndex((line) => /^\s*Action items:\s*$/i.test(line));
   if (idx < 0) return { paragraph: text.trim(), actionItems: [] };
-  const paragraph = lines.slice(0, idx).join("\n").trim();
-  const actionItems = lines.slice(idx + 1).map((line) => line.replace(/^\s*(?:[-*]|\d+[.)])\s*/, "").trim()).filter((line) => line.length > 0);
+  const paragraph = lines2.slice(0, idx).join("\n").trim();
+  const actionItems = lines2.slice(idx + 1).map((line) => line.replace(/^\s*(?:[-*]|\d+[.)])\s*/, "").trim()).filter((line) => line.length > 0);
   return { paragraph, actionItems };
 }
 function buildSummaryBody(request, out, now) {
@@ -33527,7 +34013,7 @@ async function runSummarize(opts) {
 }
 
 // src/service/runtime-config-dir.ts
-import { createHash as createHash4, randomUUID } from "node:crypto";
+import { createHash as createHash5, randomUUID } from "node:crypto";
 import {
   chmodSync as chmodSync4,
   existsSync as existsSync4,
@@ -33562,7 +34048,24 @@ function assertManagedName(name) {
 }
 function isLocalOnlyName(name) {
   const n = name.toLowerCase().replace(/[. ]+$/, "");
-  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets";
+  return n === "llm.key" || n.startsWith("llm.key.") || n === "local-config.json" || n === "secrets" || n === MANIFEST_POLICY_FILE;
+}
+var MANIFEST_POLICY_FILE = "manifest-policy.json";
+function removeManagedLlmSource(home, identityId, deps = REAL_FS) {
+  try {
+    deps.unlink(join15(runtimeConfigDir(home, identityId), "llm-source.json"));
+  } catch (e) {
+    if (e?.code !== "ENOENT") throw e;
+  }
+}
+function writeManifestPolicy(home, identityId, policy, deps = REAL_FS) {
+  const parent3 = join15(home, ".securecoms", "runtime-config");
+  const dir = runtimeConfigDir(home, identityId);
+  for (const d of [join15(home, ".securecoms"), parent3, dir]) {
+    deps.mkdir(d, 448);
+    deps.chmod(d, 448);
+  }
+  atomicWrite(join15(dir, MANIFEST_POLICY_FILE), JSON.stringify(policy) + "\n", deps);
 }
 function atomicWrite(path, body, deps) {
   const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -33618,7 +34121,7 @@ function checkConfiguredPaths(skillsJson, statFn = (p) => {
   });
 }
 function lineHash(line) {
-  return createHash4("sha256").update(line.trim(), "utf8").digest("hex");
+  return createHash5("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
 var SECRET_PATH_COUNT_MAX = 1e4;
@@ -33647,7 +34150,7 @@ var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
 var LEGACY_MEMORY_FACT_MAX_BYTES = 1024;
 var LEGACY_MEMORY_FACT_DECISION_MAX = 500;
 function legacySourceId(source, bytes) {
-  return createHash4("sha256").update(source.kind).update("\0").update(source.channel_id ?? "").update("\0").update(source.path).update("\0").update(bytes).digest("hex");
+  return createHash5("sha256").update(source.kind).update("\0").update(source.channel_id ?? "").update("\0").update(source.path).update("\0").update(bytes).digest("hex");
 }
 function localLegacySources(doc) {
   if (!Array.isArray(doc.legacy_memory)) return [];
@@ -33819,6 +34322,568 @@ function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   return removed;
 }
 
+// src/grants/binding.ts
+import { sha256 as sha25611 } from "@noble/hashes/sha256";
+
+// src/grants/manifest.ts
+import { ed25519 as ed255195 } from "@noble/curves/ed25519";
+
+// src/grants/pin.ts
+import { lstatSync as lstatSync7, readFileSync as readFileSync9 } from "node:fs";
+import { ed25519 as ed255194 } from "@noble/curves/ed25519";
+import { dirname as dirname4, join as join16 } from "node:path";
+var PIN_FILE_NAME = "owner-signing-key.json";
+var UUID_LOWER = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var PIN_KEYS = ["key_algo", "owner_identity_id", "public_key"];
+function canonicalBase64Bytes(v, len) {
+  if (typeof v !== "string" || v.length === 0) return null;
+  const buf = Buffer.from(v, "base64");
+  if (buf.length !== len || buf.toString("base64") !== v) return null;
+  return new Uint8Array(buf);
+}
+function parsePinObject(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return { ok: false, state: "malformed" };
+  const keys = Object.keys(v).sort();
+  if (keys.length !== PIN_KEYS.length || keys.some((k, i) => k !== PIN_KEYS[i])) return { ok: false, state: "malformed" };
+  const o = v;
+  if (typeof o.key_algo !== "string") return { ok: false, state: "malformed" };
+  if (o.key_algo !== "ed25519") return { ok: false, state: "unsupported_algo" };
+  if (typeof o.owner_identity_id !== "string" || !UUID_LOWER.test(o.owner_identity_id)) return { ok: false, state: "malformed" };
+  const publicKey = canonicalBase64Bytes(o.public_key, 32);
+  if (!publicKey) return { ok: false, state: "malformed" };
+  try {
+    if (ed255194.ExtendedPoint.fromHex(publicKey).isSmallOrder()) return { ok: false, state: "malformed" };
+  } catch {
+    return { ok: false, state: "malformed" };
+  }
+  return {
+    ok: true,
+    pin: Object.freeze({ ownerIdentityId: o.owner_identity_id, keyAlgo: "ed25519", publicKey, publicKeyB64: o.public_key })
+  };
+}
+var NODE_FS = { lstat: (p) => lstatSync7(p), readFile: (p) => readFileSync9(p, "utf8") };
+function fromValue(v) {
+  const r = parsePinObject(v);
+  return r.ok ? { kind: "ok", pin: r.pin } : { kind: "bad", state: r.state };
+}
+function readPinFile(path, fs) {
+  let st;
+  try {
+    st = fs.lstat(path);
+  } catch (e) {
+    if (e?.code === "ENOENT") return { kind: "absent" };
+    return { kind: "bad", state: "unreadable" };
+  }
+  if (st.isSymbolicLink()) return { kind: "bad", state: "symlink_refused" };
+  let text;
+  try {
+    text = fs.readFile(path);
+  } catch {
+    return { kind: "bad", state: "unreadable" };
+  }
+  if (st.mode & 63) writeServiceLog2("warn", "config.pin_permissions_unsafe");
+  let json2;
+  try {
+    json2 = JSON.parse(text);
+  } catch {
+    return { kind: "bad", state: "malformed" };
+  }
+  return fromValue(json2);
+}
+function samePin(a, b) {
+  return a.ownerIdentityId === b.ownerIdentityId && a.keyAlgo === b.keyAlgo && a.publicKeyB64 === b.publicKeyB64;
+}
+function loadOwnerGrantPin(opts) {
+  const fs = opts.fs ?? NODE_FS;
+  const file2 = readPinFile(join16(dirname4(opts.credentialPath), PIN_FILE_NAME), fs);
+  const field = "owner_signing_key" in opts.credentialJson && opts.credentialJson.owner_signing_key !== void 0 ? fromValue(opts.credentialJson.owner_signing_key) : { kind: "absent" };
+  if (file2.kind === "bad") return { state: file2.state, pin: null };
+  if (field.kind === "bad") return { state: field.state, pin: null };
+  if (file2.kind === "absent" && field.kind === "absent") return { state: "no_pin", pin: null };
+  if (file2.kind === "ok" && field.kind === "ok") {
+    return samePin(file2.pin, field.pin) ? { state: "ok", pin: file2.pin } : { state: "pin_conflict", pin: null };
+  }
+  const one = file2.kind === "ok" ? file2.pin : field.pin;
+  return { state: "ok", pin: one };
+}
+
+// src/grants/manifest.ts
+var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
+var MANIFEST_KNOWN_TOOLS = Object.freeze({
+  owner_dm: Object.freeze(["web_search", "fetch_url", "http_request", "sql_query"]),
+  team_room: Object.freeze(["web_search"])
+});
+function manifestSignedBytes(manifest) {
+  const domain = new TextEncoder().encode(TOOL_GRANTS_DOMAIN);
+  const body = canonicalize(manifest);
+  const out = new Uint8Array(domain.length + body.length);
+  out.set(domain, 0);
+  out.set(body, domain.length);
+  return out;
+}
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function wellTyped(v) {
+  if (typeof v === "string") return true;
+  if (typeof v === "number") return Number.isSafeInteger(v) && v >= 0;
+  if (Array.isArray(v)) return v.every(wellTyped);
+  if (isPlainObject(v)) return Object.values(v).every(wellTyped);
+  return false;
+}
+var WRAPPER_KEYS = ["algo", "manifest", "signature"];
+var HEX64 = /^[0-9a-f]{64}$/;
+var PRINTABLE_ASCII = /^[\x21-\x7e]+$/;
+var absolutePath = (v) => typeof v === "string" && v.startsWith("/") && PRINTABLE_ASCII.test(v);
+var exactKeys = (o, required, optional = []) => required.every((k) => k in o) && Object.keys(o).every((k) => required.includes(k) || optional.includes(k));
+var isStringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+function parseEndpoints(v) {
+  if (v === void 0) return {};
+  if (!isPlainObject(v)) return null;
+  const out = {};
+  for (const [name, raw] of Object.entries(v)) {
+    if (!isPlainObject(raw)) return null;
+    const e = { ...raw };
+    if (e.headersFile === "") delete e.headersFile;
+    if (!exactKeys(e, ["baseUrl"], ["headersFile"])) return null;
+    if (typeof e.baseUrl !== "string" || e.baseUrl === "" || !PRINTABLE_ASCII.test(e.baseUrl)) return null;
+    let url;
+    try {
+      url = new URL(e.baseUrl);
+    } catch {
+      return null;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    if (url.username !== "" || url.password !== "" || url.href !== e.baseUrl) return null;
+    if ("headersFile" in e && !absolutePath(e.headersFile)) return null;
+    out[name] = Object.freeze({ baseUrl: e.baseUrl, ...typeof e.headersFile === "string" ? { headersFile: e.headersFile } : {} });
+  }
+  return out;
+}
+function parseDatabases(v) {
+  if (v === void 0) return {};
+  if (!isPlainObject(v)) return null;
+  const out = {};
+  for (const [name, d] of Object.entries(v)) {
+    if (!isPlainObject(d)) return null;
+    const keys = Object.keys(d);
+    if (keys.length !== 1 || keys[0] !== "sqlite" && keys[0] !== "postgresUrlFile") return null;
+    const path = d[keys[0]];
+    if (!absolutePath(path)) return null;
+    out[name] = Object.freeze(keys[0] === "sqlite" ? { sqlite: path } : { postgresUrlFile: path });
+  }
+  return out;
+}
+function parseConfig(v) {
+  if (!isPlainObject(v)) return null;
+  if (!exactKeys(v, ["persona_sha256", "flags", "memory", "legacy_assign_sha256"], ["llm", "search", "tools_allow"])) return null;
+  if (typeof v.persona_sha256 !== "string" || !HEX64.test(v.persona_sha256)) return null;
+  if (typeof v.legacy_assign_sha256 !== "string" || !HEX64.test(v.legacy_assign_sha256)) return null;
+  if (!isStringArray(v.flags)) return null;
+  if ("tools_allow" in v && !isStringArray(v.tools_allow)) return null;
+  if ("llm" in v) {
+    const l = v.llm;
+    if (!isPlainObject(l) || !exactKeys(l, ["provider", "model"]) || typeof l.provider !== "string" || !l.provider || typeof l.model !== "string" || !l.model) return null;
+  }
+  if ("search" in v) {
+    const sr = v.search;
+    if (!isPlainObject(sr) || !exactKeys(sr, ["provider"]) || sr.provider !== "brave" && sr.provider !== "tavily") return null;
+  }
+  const mem = v.memory;
+  if (!isPlainObject(mem) || !exactKeys(mem, ["mode"], ["recall_days"])) return null;
+  if (mem.mode !== "markdown" && mem.mode !== "semantic" && mem.mode !== "off") return null;
+  if (mem.mode === "semantic" !== "recall_days" in mem) return null;
+  if ("recall_days" in mem && mem.recall_days !== 30 && mem.recall_days !== 90 && mem.recall_days !== 365) return null;
+  return Object.freeze({
+    persona_sha256: v.persona_sha256,
+    ...isPlainObject(v.llm) ? { llm: Object.freeze({ provider: v.llm.provider, model: v.llm.model }) } : {},
+    ...isPlainObject(v.search) ? { search: Object.freeze({ provider: v.search.provider }) } : {},
+    ...isStringArray(v.tools_allow) ? { tools_allow: Object.freeze([...v.tools_allow]) } : {},
+    flags: Object.freeze([...v.flags]),
+    memory: Object.freeze({ mode: mem.mode, ..."recall_days" in mem ? { recall_days: mem.recall_days } : {} }),
+    legacy_assign_sha256: v.legacy_assign_sha256
+  });
+}
+function verifyToolGrantManifest(raw, ctx) {
+  if (!isPlainObject(raw)) return { state: "malformed" };
+  const keys = Object.keys(raw).sort();
+  if (keys.length !== WRAPPER_KEYS.length || keys.some((k, i) => k !== WRAPPER_KEYS[i])) return { state: "malformed" };
+  if (typeof raw.algo !== "string") return { state: "malformed" };
+  if (raw.algo !== "ed25519") return { state: "unsupported_algo" };
+  const m = raw.manifest;
+  if (!isPlainObject(m)) return { state: "malformed" };
+  if (m.type !== "securecoms.tool-grants" || m.v !== 1) return { state: "malformed" };
+  if (!wellTyped(m)) return { state: "malformed" };
+  if (typeof m.agent_identity_id !== "string" || typeof m.owner_identity_id !== "string") return { state: "malformed" };
+  for (const k of ["owner_dm_channel_id", "owner_dm_relay_identity_id"]) {
+    if (k in m && typeof m[k] !== "string") return { state: "malformed" };
+  }
+  if (!isPlainObject(m.grants)) return { state: "malformed" };
+  for (const list of Object.values(m.grants)) {
+    if (!Array.isArray(list) || !list.every((t) => typeof t === "string")) return { state: "malformed" };
+  }
+  const endpoints = parseEndpoints(m.endpoints);
+  const databases = parseDatabases(m.databases);
+  const config = parseConfig(m.config);
+  if (endpoints === null || databases === null || config === null) return { state: "malformed" };
+  const sig = canonicalBase64Bytes(raw.signature, 64);
+  if (!sig) return { state: "malformed" };
+  let good;
+  try {
+    good = ed255195.verify(sig, manifestSignedBytes(m), ctx.pin.publicKey, { zip215: false });
+  } catch {
+    return { state: "malformed" };
+  }
+  if (!good) return { state: "bad_signature" };
+  if (m.agent_identity_id !== ctx.agentIdentityId) return { state: "wrong_agent" };
+  if (m.owner_identity_id !== ctx.pin.ownerIdentityId) return { state: "wrong_owner" };
+  const counter = m.counter;
+  if (typeof counter !== "number" || !Number.isSafeInteger(counter) || counter < 1) return { state: "malformed" };
+  if (ctx.storedCounter !== null) {
+    if (counter === ctx.storedCounter) return { state: "unchanged" };
+    if (counter < ctx.storedCounter) return { state: "rollback" };
+  }
+  let droppedUnknown = false;
+  const grants = {};
+  for (const [audience, list] of Object.entries(m.grants)) {
+    if (audience !== "owner_dm" && audience !== "team_room") {
+      droppedUnknown = true;
+      continue;
+    }
+    const known = MANIFEST_KNOWN_TOOLS[audience];
+    const kept = list.filter((t) => known.includes(t));
+    if (kept.length !== list.length) droppedUnknown = true;
+    grants[audience] = Object.freeze(kept);
+  }
+  const manifest = Object.freeze({
+    type: "securecoms.tool-grants",
+    v: 1,
+    agent_identity_id: m.agent_identity_id,
+    owner_identity_id: m.owner_identity_id,
+    ...typeof m.owner_dm_channel_id === "string" ? { owner_dm_channel_id: m.owner_dm_channel_id } : {},
+    ...typeof m.owner_dm_relay_identity_id === "string" ? { owner_dm_relay_identity_id: m.owner_dm_relay_identity_id } : {},
+    counter,
+    grants: Object.freeze(grants),
+    endpoints: Object.freeze(endpoints),
+    databases: Object.freeze(databases),
+    config
+  });
+  return { state: "ok", manifest, droppedUnknown, wrapper: raw };
+}
+
+// src/grants/persona-render.ts
+var PERSONA_MAX_BYTES = 8192;
+var TONE_FIELD_ORDER = ["humor", "length", "warmth", "formality"];
+var TONE_WORDS = Object.freeze({
+  warmth: { reserved: "Be plain and businesslike.", plain: "Be plain and businesslike.", warm: "Be warm.", friendly: "Be friendly." },
+  length: { brief: "Keep answers short.", thorough: "Give the full picture when it matters." },
+  formality: { casual: "Write casually.", formal: "Write formally." },
+  humor: { none: "Do not use humor.", light: "Use light humor when it fits.", playful: "Be playful." }
+});
+var HANDOFF_TEXT = Object.freeze({
+  money: "money is moving",
+  legal: "someone wants a legal commitment",
+  upset: "the person is upset"
+});
+var TOOL_PARAGRAPH = "Use a tool when the answer depends on something you cannot know. Which tools you have depends on the channel, so rely only on the tools offered in this turn, not on anything said earlier in a conversation. When a request needs a tool you were not offered, say so plainly and never claim you looked something up. When you searched or fetched a page, answer from what it says and name the source; never reply with only a link, and never read a URL aloud.";
+var PY_SPACE = /* @__PURE__ */ new Set([
+  9,
+  10,
+  11,
+  12,
+  13,
+  28,
+  29,
+  30,
+  31,
+  32,
+  133,
+  160,
+  5760,
+  8192,
+  8193,
+  8194,
+  8195,
+  8196,
+  8197,
+  8198,
+  8199,
+  8200,
+  8201,
+  8202,
+  8232,
+  8233,
+  8239,
+  8287,
+  12288
+]);
+function pyStrip(s) {
+  let a = 0;
+  let b = s.length;
+  while (a < b && PY_SPACE.has(s.charCodeAt(a))) a++;
+  while (b > a && PY_SPACE.has(s.charCodeAt(b - 1))) b--;
+  return s.slice(a, b);
+}
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var optString = (v) => v === void 0 || v === null || typeof v === "string";
+var optStrings = (v) => v === void 0 || v === null || Array.isArray(v) && v.every((x) => typeof x === "string");
+function lines(items) {
+  return (items ?? []).map(pyStrip).filter((x) => x !== "").map((x) => `- ${x}`).join("\n");
+}
+function renderPersonaFiles(persona) {
+  if (!isObj(persona)) return { ok: false, reason: "shape" };
+  const p = persona;
+  for (const k of ["name", "business", "role", "manner"]) if (!optString(p[k])) return { ok: false, reason: "shape" };
+  for (const k of ["can", "cannot", "handoff"]) if (!optStrings(p[k])) return { ok: false, reason: "shape" };
+  const toneRaw = p.tone;
+  if (!(toneRaw === void 0 || toneRaw === null || isObj(toneRaw) && Object.values(toneRaw).every((v) => typeof v === "string"))) {
+    return { ok: false, reason: "shape" };
+  }
+  const name = pyStrip(p.name || "");
+  const business = pyStrip(p.business || "");
+  const role = pyStrip(p.role || "");
+  const identity = [];
+  if (name && business) identity.push(`You are ${name}, an agent for ${business}.`);
+  else if (name) identity.push(`You are ${name}.`);
+  if (role) identity.push(role);
+  const identityMd = identity.join("\n\n");
+  const tone = toneRaw ?? {};
+  const soul = [];
+  for (const k of TONE_FIELD_ORDER) {
+    if (!Object.prototype.hasOwnProperty.call(tone, k)) continue;
+    const words = TONE_WORDS[k];
+    const v = tone[k];
+    if (Object.prototype.hasOwnProperty.call(words, v)) soul.push(words[v]);
+  }
+  const manner = pyStrip(p.manner || "");
+  let soulMd = soul.join(" ");
+  if (manner) soulMd = pyStrip(`${soulMd}
+
+${manner}`);
+  const agents = [];
+  const can = lines(p.can);
+  if (can) agents.push(`What you can do:
+${can}`);
+  const cannot = lines(p.cannot);
+  if (cannot) agents.push(`What you cannot do:
+${cannot}`);
+  const handoff = (p.handoff ?? []).filter((h) => pyStrip(h) !== "").map((h) => Object.prototype.hasOwnProperty.call(HANDOFF_TEXT, h) ? HANDOFF_TEXT[h] : pyStrip(h));
+  if (handoff.length > 0) agents.push("Hand off to a person when " + handoff.join("; when ") + ". Say plainly that you are doing so.");
+  agents.push(TOOL_PARAGRAPH);
+  const agentsMd = agents.join("\n\n");
+  const files = { "IDENTITY.md": identityMd, "SOUL.md": soulMd, "AGENTS.md": agentsMd };
+  for (const body of Object.values(files)) {
+    if (Buffer.byteLength(body, "utf8") > PERSONA_MAX_BYTES) return { ok: false, reason: "over_cap" };
+  }
+  return { ok: true, files };
+}
+
+// src/grants/binding.ts
+var CONFIG_BINDING_FIELDS = ["persona", "memory", "search", "tools_allow", "flags", "llm", "files", "legacy_assign"];
+var ASSIGN_PREFIX = "legacy-fact-assign:";
+function legacyAssignSha256(prunes) {
+  const set = [...new Set(prunes.filter((p) => typeof p === "string" && p.startsWith(ASSIGN_PREFIX)))].sort();
+  return sha256Hex(canonicalize(set));
+}
+function legacyAssignToken(d) {
+  return `${ASSIGN_PREFIX}${d.source_id}:${d.fact_hash}:${d.channel_id}`;
+}
+var PERSONA_FILES = ["IDENTITY.md", "SOUL.md", "AGENTS.md"];
+var LLM_SOURCE = "llm-source.json";
+var FAIL = Symbol("bind_fail");
+function guarded(f) {
+  try {
+    return f();
+  } catch {
+    return FAIL;
+  }
+}
+var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string") ? [...v] : void 0;
+var sameStrings = (a, b) => a === void 0 || b === void 0 ? a === b : a.length === b.length && a.every((x, i) => x === b[i]);
+var sha256Hex = (bytes) => Buffer.from(sha25611(bytes)).toString("hex");
+function endpointEquals(raw, signed) {
+  if (!isObj2(raw)) return false;
+  const e = { ...raw };
+  if (e.headersFile === "") delete e.headersFile;
+  const keys = Object.keys(e).sort().join(",");
+  const want = "headersFile" in signed ? "baseUrl,headersFile" : "baseUrl";
+  return keys === want && e.baseUrl === signed.baseUrl && e.headersFile === signed.headersFile;
+}
+function databaseEquals(raw, signed) {
+  if (!isObj2(raw)) return false;
+  const keys = Object.keys(raw);
+  if (keys.length !== 1) return false;
+  return "sqlite" in signed ? raw.sqlite === signed.sqlite : raw.postgresUrlFile === signed.postgresUrlFile;
+}
+function bindTargets(raw, signed, equals) {
+  if (raw === void 0) return { written: {}, mismatches: 0 };
+  if (!isObj2(raw)) return { written: {}, mismatches: 1 };
+  const written = {};
+  let mismatches = 0;
+  for (const [name, entry] of Object.entries(raw)) {
+    const s = Object.prototype.hasOwnProperty.call(signed, name) ? signed[name] : void 0;
+    if (s !== void 0 && equals(entry, s)) written[name] = s;
+    else mismatches++;
+  }
+  return { written, mismatches };
+}
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }) {
+  const mismatches = /* @__PURE__ */ new Set();
+  const cfg = manifest.config;
+  const out = {};
+  const files = isObj2(payload.files) ? payload.files : {};
+  const personaOk = guarded(() => sha256Hex(canonicalize(payload.persona)) === cfg.persona_sha256);
+  const render = guarded(() => renderPersonaFiles(payload.persona));
+  if (personaOk === true && render !== FAIL && render.ok) {
+    for (const f of PERSONA_FILES) out[f] = render.files[f];
+  } else {
+    mismatches.add("persona");
+  }
+  const delivered = files[LLM_SOURCE];
+  const llmSame = guarded(() => {
+    if (delivered === void 0) return cfg.llm === void 0;
+    if (typeof delivered !== "string") return false;
+    const parsed = JSON.parse(delivered);
+    if (!isObj2(parsed)) return false;
+    if (cfg.llm === void 0) return parsed.provider === void 0 && parsed.model === void 0;
+    return parsed.provider === cfg.llm.provider && parsed.model === cfg.llm.model;
+  });
+  if (llmSame !== true) mismatches.add("llm");
+  if (cfg.llm !== void 0) {
+    out[LLM_SOURCE] = JSON.stringify({ provider: cfg.llm.provider, model: cfg.llm.model, version: payload.version }) + "\n";
+  }
+  if (!isObj2(payload.files) && payload.files !== void 0) mismatches.add("files");
+  for (const name of Object.keys(files)) {
+    if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
+  }
+  const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
+  const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
+  const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
+  const payloadFlags = strings(sj?.flags);
+  if (!sameStrings(payloadFlags, cfg.flags)) mismatches.add("flags");
+  const tools = isObj2(sj?.tools) ? sj.tools : void 0;
+  if (!sameStrings(strings(tools?.allow), cfg.tools_allow)) mismatches.add("tools_allow");
+  const deny = strings(tools?.deny);
+  const ps = isObj2(sj?.search) ? sj.search : void 0;
+  const payloadProvider = ps?.provider;
+  let searchBlock;
+  let appliedSearch;
+  if (payloadProvider === cfg.search?.provider && ps === void 0 === (cfg.search === void 0)) {
+    searchBlock = ps === void 0 ? null : Object.freeze({ provider: ps.provider, ...typeof ps.keyFile === "string" ? { keyFile: ps.keyFile } : {} });
+    appliedSearch = searchBlock;
+  } else {
+    mismatches.add("search");
+    searchBlock = (prior.search?.provider ?? void 0) === cfg.search?.provider ? prior.search : void 0;
+  }
+  const skillsDoc = {
+    endpoints: eps.written,
+    databases: dbs.written,
+    flags: [...cfg.flags],
+    ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
+    ...searchBlock ? { search: searchBlock } : {}
+  };
+  out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
+  const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
+  let memory;
+  if (isObj2(payload.memory)) {
+    const pm = payload.memory;
+    const sameMode = pm.mode === cfg.memory.mode;
+    const sameDays = cfg.memory.mode === "semantic" ? pm.recall_days === cfg.memory.recall_days : !("recall_days" in pm);
+    if (!sameMode || !sameDays) mismatches.add("memory");
+    const { recall_days: _r, mode: _m, ...rest } = pm;
+    memory = { ...signedMemory, ...rest };
+  } else {
+    mismatches.add("memory");
+    memory = { ...signedMemory };
+  }
+  const prunes = payload.memory_prunes === void 0 ? [] : payload.memory_prunes;
+  const decisions = Array.isArray(payload.legacy_memory_fact_decisions) ? payload.legacy_memory_fact_decisions : [];
+  const assignMatch = guarded(() => Array.isArray(prunes) && legacyAssignSha256(prunes) === cfg.legacy_assign_sha256);
+  let legacyDecisions;
+  if (assignMatch === true) {
+    const verified = new Set(prunes.filter((p) => typeof p === "string" && p.startsWith(ASSIGN_PREFIX)));
+    legacyDecisions = decisions.filter((d) => {
+      if (!isObj2(d) || d.action !== "assign") return true;
+      if (typeof d.source_id !== "string" || typeof d.fact_hash !== "string" || typeof d.channel_id !== "string") return false;
+      return verified.has(legacyAssignToken({ source_id: d.source_id, fact_hash: d.fact_hash, channel_id: d.channel_id }));
+    });
+  } else {
+    mismatches.add("legacy_assign");
+    legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
+  }
+  const signedTools = (a) => MANIFEST_KNOWN_TOOLS[a].filter((t) => (manifest.grants[a] ?? []).includes(t));
+  const policy = {
+    v: 1,
+    manifest_tools: [.../* @__PURE__ */ new Set([...switches.ownerDm ? signedTools("owner_dm") : [], ...switches.room ? signedTools("team_room") : []])].sort(),
+    secret_path_mode: "enforce"
+  };
+  return {
+    mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
+    targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
+    files: out,
+    memory,
+    signedTargets: { endpoints: Object.keys(eps.written).length, databases: Object.keys(dbs.written).length },
+    policy,
+    appliedSearch,
+    legacyDecisions
+  };
+}
+
+// src/grants/room-search-cap.ts
+var ROOM_SEARCH_DAILY_CAP = 50;
+var ROOM_SEARCH_CAP_ENV = "SECURECOMS_ROOM_SEARCH_DAILY_CAP";
+function parseRoomSearchCap(v, warn) {
+  if (v === void 0) return ROOM_SEARCH_DAILY_CAP;
+  if (/^\d+$/.test(v)) {
+    const n = Number(v);
+    if (n <= ROOM_SEARCH_DAILY_CAP) return n;
+  }
+  warn?.();
+  return ROOM_SEARCH_DAILY_CAP;
+}
+var AGENT_ROOM_SEARCH_DAILY_CAP = 200;
+var AGENT_ROOM_SEARCH_CAP_ENV = "SECURECOMS_AGENT_ROOM_SEARCH_DAILY_CAP";
+function parseAgentRoomSearchCap(v, warn) {
+  if (v === void 0) return AGENT_ROOM_SEARCH_DAILY_CAP;
+  if (/^\d+$/.test(v)) {
+    const n = Number(v);
+    if (n <= AGENT_ROOM_SEARCH_DAILY_CAP) return n;
+  }
+  warn?.();
+  return AGENT_ROOM_SEARCH_DAILY_CAP;
+}
+var AGENT_TOTAL_KEY = "agent-total";
+
+// src/grants/effective.ts
+var TOOL_GRANT_CODE_CEILING = MANIFEST_KNOWN_TOOLS;
+var CURRENT_TIME = Object.freeze({ tool: "current_time", mode: "read" });
+function effectiveToolGrants(i) {
+  if (i.base.length === 0) return { grants: i.base, source: "none", withheldBySearchCap: false };
+  if (i.manifest === null) return { grants: i.base, source: "constant", withheldBySearchCap: false };
+  const ceiling = TOOL_GRANT_CODE_CEILING[i.audience];
+  const listed = new Set(i.manifest.grants[i.audience] ?? []);
+  const signed = ceiling.filter((t) => listed.has(t));
+  if (!i.eligible || !i.manifestSwitchOn) {
+    const fallback = i.base.filter((g) => g.tool !== "current_time" && signed.includes(g.tool));
+    return { grants: Object.freeze([CURRENT_TIME, ...fallback]), source: "fallback", withheldBySearchCap: false };
+  }
+  let withheld = false;
+  const tools = signed.filter((t) => {
+    if (i.disabled.has(t)) return false;
+    if (t === "http_request" && i.signedTargets.endpoints === 0) return false;
+    if (t === "sql_query" && i.signedTargets.databases === 0) return false;
+    if (i.audience === "team_room" && t === "web_search" && i.roomSearchCapped) {
+      withheld = true;
+      return false;
+    }
+    return true;
+  });
+  return {
+    grants: Object.freeze([CURRENT_TIME, ...tools.map((tool) => Object.freeze({ tool, mode: "read", source: "manifest" }))]),
+    source: "manifest",
+    withheldBySearchCap: withheld
+  };
+}
+
 // src/bridge-agent.ts
 import { homedir as homedir4 } from "node:os";
 
@@ -33907,6 +34972,50 @@ function roomIsCrossOrg(rows) {
   return unknown ? null : false;
 }
 
+// src/grants/owner-turn.ts
+import { ed25519 as ed255196 } from "@noble/curves/ed25519";
+var HEX = /^(?:[0-9a-fA-F]{2})+$/;
+function verifyOwnerSignature(entry, pin) {
+  if (!entry.identitySignature || !entry.payloadHex) return { state: "no_signature" };
+  if (!HEX.test(entry.payloadHex)) return { state: "malformed" };
+  const sig = canonicalBase64Bytes(entry.identitySignature, 64);
+  if (!sig) return { state: "malformed" };
+  const bytes = new Uint8Array(Buffer.from(entry.payloadHex, "hex"));
+  let envelope;
+  try {
+    envelope = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return { state: "malformed" };
+  }
+  const algo = envelope?.identity_proof?.algo;
+  if (typeof envelope !== "object" || envelope === null || algo === void 0 || algo === null) return { state: "malformed" };
+  if (algo !== "ed25519") return { state: "unknown_algo" };
+  let good;
+  try {
+    good = ed255196.verify(sig, bytes, pin.publicKey, { zip215: false });
+  } catch {
+    return { state: "malformed" };
+  }
+  return good ? { state: "ok", envelope } : { state: "bad_signature" };
+}
+function classifyOwnerDmLeaves(leaves, allowed) {
+  if (leaves.some((l) => !l.basic || l.identity === null)) return "foreign";
+  if (!leaves.some((l) => l.identity === allowed.ownerIdentityId)) return "foreign";
+  const unexpected = /* @__PURE__ */ new Set();
+  for (const l of leaves) {
+    const id = l.identity;
+    if (id === allowed.ownerIdentityId || id === allowed.agentIdentityId) continue;
+    if (allowed.relayIdentityId !== void 0 && id === allowed.relayIdentityId) continue;
+    unexpected.add(id);
+  }
+  if (unexpected.size === 0) return "ok";
+  if (unexpected.size === 1) {
+    const [only] = unexpected;
+    if (allowed.isServerRelay(only)) return "unsigned_relay";
+  }
+  return "foreign";
+}
+
 // src/bridge-agent.ts
 function logSendSupersededAdoption(kind2) {
   switch (kind2) {
@@ -33959,6 +35068,9 @@ var ROOM_DEFAULT_READ_GRANTS = Object.freeze([
   Object.freeze({ tool: "current_time", mode: "read" })
 ]);
 var NO_TOOL_GRANTS = Object.freeze([]);
+var WS_CLOSE_SESSION_SUPERSEDED2 = 4409;
+var OWNER_REPLAY_PRUNE_INTERVAL_MS = 5 * 60 * 1e3;
+var OWNER_TURN_UNCHECKED = Object.freeze({ kind: "unchecked" });
 function ownerDmDefaultGrantsEnabled(env = process.env) {
   const v = env.SECURECOMS_OWNER_DM_DEFAULT_GRANTS;
   return v === void 0 || v === "on";
@@ -33967,6 +35079,14 @@ function roomDefaultGrantsEnabled(env = process.env) {
   const v = env.SECURECOMS_ROOM_DEFAULT_GRANTS;
   return v === void 0 || v === "on";
 }
+function ownerDmManifestGrantsEnabled(env = process.env) {
+  const v = env.SECURECOMS_OWNER_DM_MANIFEST_GRANTS;
+  return v === void 0 || v === "on";
+}
+function roomManifestGrantsEnabled(env = process.env) {
+  const v = env.SECURECOMS_ROOM_MANIFEST_GRANTS;
+  return v === void 0 || v === "on";
+}
 var MAX_PENDING_NOTE_REQUESTS = 8;
 var INGEST_STAMP_KEY = "_sc_notes_ingest_generation";
 function validIngestStamp(v) {
@@ -34053,6 +35173,17 @@ function redeliveryDelayMs(attempts) {
   return 2 ** Math.min(Math.max(attempts, 0), 16) * REDELIVERY_BACKOFF_BASE_MS;
 }
 var DEAD_LETTER_NOTICE = "I couldn't process a message. Please resend it.";
+function holdsManifestGrant(a) {
+  return a?.tool_grants?.some((g) => g.mode === "read" && g.source === "manifest") ?? false;
+}
+function greetingAuthorization(a) {
+  const { memory_write: _w, ...rest } = a;
+  return Object.freeze({ ...rest, tool_grants: NO_TOOL_GRANTS });
+}
+function utcDayOf(ms) {
+  return new Date(ms).toISOString().slice(0, 10);
+}
+var ROOM_SEARCH_CAP_NOTICE = "I've used today's web searches for this room. I can still help without searching. Searches are available again tomorrow (UTC).";
 var DEAD_LETTER_NOTICE_INTERVAL_MS = 60 * 6e4;
 var PAUSE_RECHECK_MS = 3e4;
 var SUPERSEDE_RECHECK_MS = 3e4;
@@ -34181,7 +35312,7 @@ var FileOwnerAuthorityStore = class {
   async save(enclaveId, pin) {
     const all = await this.readAll();
     all[enclaveId] = pin;
-    await fsp.mkdir(dirname4(this.path), { recursive: true });
+    await fsp.mkdir(dirname5(this.path), { recursive: true });
     await fsp.writeFile(this.path, JSON.stringify(all), "utf8");
   }
 };
@@ -34212,6 +35343,12 @@ function rosterFreshAt(entry, heldEpoch, heldGroupId) {
 var RoomGrantEpochMovedError = class extends Error {
 };
 var ROOM_GRANT_TRACK_MAX = 4096;
+var SessionSupersededError = class extends Error {
+  constructor() {
+    super("session_superseded: another copy of this agent took its session during start()");
+    this.name = "SessionSupersededError";
+  }
+};
 var GroupSupersededSendError = class extends Error {
   constructor(channelId, activeGroupId) {
     super(`send refused for channel ${channelId}: the channel moved to a new secure group; not sent`);
@@ -34251,9 +35388,18 @@ var BridgeAgent = class _BridgeAgent {
     const seed = hexToBytes4(cfg.signingPrivateKey);
     this.custody = SoftwareKeyCustody.fromPrivateKey("ed25519", seed);
     this.replyIdKey = deriveReplyIdKey(seed);
+    const base = deps.fetchImpl ?? fetch;
+    this.fetchImpl = (input, init) => this.sessionSuperseded ? Promise.reject(new Error("session_superseded")) : base(input, init);
     this.transport = deps.transport ?? new RestTransport({
       baseUrl: cfg.apiBase,
       bearerToken: cfg.apiKey,
+      fetchImpl: this.fetchImpl,
+      wsImpl: deps.wsImpl,
+      // A 4409 close means another copy of this agent took the session.
+      // Every other terminal close keeps today's behaviour.
+      onTerminalClose: (close) => {
+        if (close.code === WS_CLOSE_SESSION_SUPERSEDED2) this.onSessionSuperseded();
+      },
       connectIdentityId: cfg.identityId,
       // P1b: hardened delivery-ping reconnect (verify-before-terminal +
       // half-open + wake + auth war-cap). On by default for the daemon;
@@ -34267,7 +35413,7 @@ var BridgeAgent = class _BridgeAgent {
         else writeServiceLog2("warn", "transport.delivery_ping_lifecycle_unknown");
       }
     });
-    this.backend = deps.backend ?? new RestMlsBackend({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey });
+    this.backend = deps.backend ?? new RestMlsBackend({ baseUrl: cfg.apiBase, bearerToken: cfg.apiKey, fetchImpl: this.fetchImpl });
     this.store = new SqliteMlsStateStore({
       dbPath: cfg.storePath,
       identityId: cfg.identityId,
@@ -34338,8 +35484,13 @@ var BridgeAgent = class _BridgeAgent {
       // throws (mirrors the divergence-heal signal path).
       onSupersedeUnopenable: (channelId, groupId) => this.healSupersedeUnopenable(channelId, groupId, this.drainExemptionAtCallIn())
     });
-    this.fetchImpl = deps.fetchImpl ?? fetch;
     this.home = deps.home ?? homedir4();
+    this.grantWriters = {
+      writeManifestPolicy: deps.grantWriters?.writeManifestPolicy ?? writeManifestPolicy,
+      writeManagedFiles: deps.grantWriters?.writeManagedFiles ?? writeManagedFiles,
+      bindRuntimeConfig: deps.grantWriters?.bindRuntimeConfig ?? bindRuntimeConfig,
+      removeManagedLlmSource: deps.grantWriters?.removeManagedLlmSource ?? removeManagedLlmSource
+    };
     this.platform = deps.platform ?? process.platform;
     this.machinePaths = deps.hostMachine === true || deps.home !== void 0;
     this.unifiedOn = unifiedPart1On(deps.unifiedMemoryPart1);
@@ -34354,7 +35505,7 @@ var BridgeAgent = class _BridgeAgent {
           threshold: EMBEDDING_MANIFEST.similarityThreshold,
           warm: windowsSemanticOn(this.platform)
         };
-        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname4(fileURLToPath2(import.meta.url)));
+        return deps.rankingTransport ? deps.rankingTransport(init) : workerTransport(init, dirname5(fileURLToPath2(import.meta.url)));
       }
     });
     this.embedder = deps.embedder ?? (deps.hostMachine === true && deps.home === void 0 ? new EmbedderClient({ identityId: cfg.identityId, home: homedir4(), source: cfg.modelSource, fetchImpl: this.fetchImpl, platform: this.platform }) : INERT_EMBEDDER);
@@ -34365,7 +35516,7 @@ var BridgeAgent = class _BridgeAgent {
       modelId: EMBEDDING_MANIFEST.modelId,
       threshold: EMBEDDING_MANIFEST.similarityThreshold
     });
-    this.heartbeat = new CallHeartbeat(this.machinePaths ? join16(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
+    this.heartbeat = new CallHeartbeat(this.machinePaths ? join17(this.home, ".securecoms", "run", "voice-call") : null, cfg.identityId, VOICE_LIVE_WINDOW_MS);
     this.reembed = new ReembedQueue({
       store: this.store,
       embedder: this.embedder,
@@ -34447,8 +35598,8 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join16(dirname4(cfg.storePath), "attachments");
-    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join16(dirname4(cfg.storePath), "vault-owner-pins.json"));
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join17(dirname5(cfg.storePath), "attachments");
+    this.vaultOwnerStoreImpl = deps.vaultOwnerStore ?? new FileOwnerAuthorityStore(join17(dirname5(cfg.storePath), "vault-owner-pins.json"));
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -34464,8 +35615,39 @@ var BridgeAgent = class _BridgeAgent {
   // stored for peek-then-join in ingestOnce
   custody;
   fetchImpl;
+  /** P-1: set once a 4409 close says another copy took this agent's session.
+   *  The gated fetch built in the constructor refuses every request after it. */
+  sessionSuperseded = false;
+  /** C9: who hears `session_superseded` (runMode's quiesce). */
+  sessionSupersededListeners = /* @__PURE__ */ new Set();
+  /** C9 (spec §4.1.6, low 3): the one close() run every caller shares. */
+  closing = null;
   /** Round 5: home for the managed runtime-config directory (test seam). */
   home;
+  grantWriters;
+  /** Owner grants (spec §7.5, OQ-2): the operator cap, read once; the same variable the runtime reads. 0 = no room search. */
+  roomSearchDailyCap = parseRoomSearchCap(process.env[ROOM_SEARCH_CAP_ENV], () => writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("cap_invalid", ["cap_invalid"]) }));
+  /** Review M-3 (ERIC APPROVALS 3): the per-agent total across rooms, read once; the same variable the runtime reads. */
+  agentRoomSearchDailyCap = parseAgentRoomSearchCap(process.env[AGENT_ROOM_SEARCH_CAP_ENV], () => writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("agent_cap_invalid", ["agent_cap_invalid"]) }));
+  /** `${day}\n${channel}` keys already logged reached today (in memory; the store holds the durable flag). */
+  roomCapLogged = /* @__PURE__ */ new Set();
+  /** Rooms whose K-14 send is in flight: a second frame posts nothing more. */
+  roomCapNoticePending = /* @__PURE__ */ new Set();
+  /** Held entries whose staged copy lost web_search to the backstop; applied again at release. */
+  backstopStripped = /* @__PURE__ */ new Set();
+  /**
+   * Owner grants plan 4 Task 11 (P-4, P-6): what the managed directory holds under the current manifest.
+   * Manifest grants require state "bound" at the applied counter (Task 13). null at startup, while a
+   * refetch narrows it, and after any throw (the fallback).
+   */
+  manifestBinding = null;
+  /** skills.json tools.deny from the latest fetch, manifest or not (spec §5.2 `disabled`). */
+  payloadToolDeny = /* @__PURE__ */ new Set();
+  /** Spec §7.7 (OQ-5): the latest fetch's binding outcome, reported in tool_grant_status (Task 15). */
+  configBindingMismatches = [];
+  targetMismatches = { endpoint: 0, database: 0 };
+  /** P-5 (Task 14): the legacy fact decisions the latest bound fetch may apply (assigns verified against the signed set). */
+  boundLegacyDecisions = [];
   joinState = /* @__PURE__ */ new Map();
   /**
    * Phase 2: lazy channel-metadata cache (channel_id → { is_dm, name, at }) used
@@ -34769,11 +35951,29 @@ var BridgeAgent = class _BridgeAgent {
   ownerDmDefaultGrants = ownerDmDefaultGrantsEnabled();
   /** Read once at startup; see roomDefaultGrantsEnabled. */
   roomDefaultGrants = roomDefaultGrantsEnabled();
+  /** Owner grants (spec §7.4): the two manifest switches, read once at construction. */
+  ownerDmManifestGrants = ownerDmManifestGrantsEnabled();
+  roomManifestGrants = roomManifestGrantsEnabled();
   /**
    * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
    * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
    */
   ownerDmCycleFresh = /* @__PURE__ */ new Set();
+  // Owner-signed tool grants, step 1 (plan 1 task 7). The verified manifest is
+  // RECORDED here and in the sealed store; no grant code reads it in step 1.
+  toolGrantManifest = null;
+  toolGrantCounter = null;
+  manifestState = "no_manifest";
+  /** Failed owner-turn checks since the last successful runtime-config report (§7.7). */
+  ownerVerifyFailures = 0;
+  /** Verified owner turns of this ingest cycle, recorded in owner_replay when staged (P-3). */
+  ownerReplayPending = /* @__PURE__ */ new Map();
+  /** D-9: ids of owner turns that failed verification (never `replay`, audit E-3), id -> channel. Persisted too. */
+  ownerVerifyFailedIds = /* @__PURE__ */ new Map();
+  serverOwnerMismatchLogged = false;
+  /** Audit L-2: the replay prune runs at most once per interval, on a monotonic clock. */
+  monoNow = () => performance.now();
+  lastOwnerReplayPruneAt = -Infinity;
   /**
    * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
    * channel, MLS group and epoch the room was classified at (review I-1: an
@@ -34897,6 +36097,12 @@ var BridgeAgent = class _BridgeAgent {
   action;
   waiters = [];
   pingHandle;
+  /** C10 (P-15): the delivery-ping subscription start() opens at its top,
+   *  held unconsumed until startReceivePump() takes it. */
+  earlyPings = null;
+  /** C10 fix round 1: settles (never rejects) when start()'s body does; close()
+   *  awaits it, bounded, so the store never closes under a start() step. */
+  startInFlight = null;
   safetyTimer;
   /** The ingest cycle now running, if any (see ingestOnce: single-flight). */
   ingestInFlight = null;
@@ -35216,14 +36422,38 @@ var BridgeAgent = class _BridgeAgent {
         return;
       }
       const version = payload.version;
-      await this.applyPayloadMemory(payload.memory);
+      const skillsForDeny = payload.skills_json;
+      const denyRaw = skillsForDeny?.tools?.deny;
+      this.payloadToolDeny = new Set(Array.isArray(denyRaw) ? denyRaw.filter((t) => typeof t === "string") : []);
+      let manifestStepThrew = false;
+      try {
+        await this.applyToolGrantManifest(payload.tool_grant_manifest);
+      } catch (e) {
+        manifestStepThrew = true;
+        writeServiceLog2("warn", "authz.config_binding", { state: ServiceLogEnum.of("bind_failed", ["bind_failed"]) }, e);
+      }
+      const pin = this.cfg.ownerGrantPin?.pin ?? null;
+      const inForce = pin !== null ? this.toolGrantManifest : null;
+      if (inForce !== null && pin !== null) {
+        const applied = manifestStepThrew ? await this.bindFailed(inForce, payload.memory, void 0) : await this.applyUnderManifest(inForce, pin.publicKeyB64, payload, version);
+        if (!applied) {
+          await this.postRuntimeConfigReport(base, version, payload.skills_json ?? {});
+          return;
+        }
+      } else {
+        this.manifestBinding = null;
+        this.configBindingMismatches = [];
+        this.targetMismatches = { endpoint: 0, database: 0 };
+        await this.applyPayloadMemory(payload.memory);
+        this.overwriteStalePolicy();
+      }
       if (!version) {
         writeManagedFiles(this.home, this.cfg.identityId, {});
         writeServiceLog2("info", "runtime_config.not_saved");
       }
       const skillsJson = payload.skills_json ?? {};
-      if (version) {
-        writeManagedFiles(this.home, this.cfg.identityId, {
+      if (version && inForce === null) {
+        this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, {
           ...payload.files ?? {},
           "skills.json": `${JSON.stringify(skillsJson, null, 2)}
 `
@@ -35235,12 +36465,13 @@ var BridgeAgent = class _BridgeAgent {
       if (payload.legacy_memory_deletes?.length) {
         deleteLegacyMemorySources(this.home, this.cfg.identityId, payload.legacy_memory_deletes);
       }
-      if (payload.legacy_memory_fact_decisions?.length) {
+      const legacyDecisions = inForce !== null ? this.boundLegacyDecisions : payload.legacy_memory_fact_decisions;
+      if (legacyDecisions?.length) {
         const provider = this.cfg.memoryProvider ?? "securecoms";
         const result = await applyLegacyMemoryFactDecisions(
           this.home,
           this.cfg.identityId,
-          payload.legacy_memory_fact_decisions,
+          legacyDecisions,
           async (channelId, fact, assignmentKey) => {
             if (provider === "none" || provider === "hermes") {
               throw new Error("configured memory provider has no protected channel-fact import path");
@@ -35259,72 +36490,177 @@ var BridgeAgent = class _BridgeAgent {
           });
         }
       }
-      const local = readLocalReport(this.home, this.cfg.identityId);
-      const report = {
-        applied_version: version,
-        paths: checkConfiguredPaths(skillsJson),
-        // Read AFTER the prunes above, so the owner's next view of memory is
-        // the file as it now stands, not the one they just pruned from.
-        memory: readManagedMemory(this.home, this.cfg.identityId),
-        // E13: pass through what the runtime reported. The daemon does not
-        // interpret any of it.
-        local_persona: local?.persona ?? null,
-        // Only the runtime knows whether a search key file is configured — it
-        // is an environment value on that process, invisible to the daemon and
-        // to the backend. The backend needs it to generate a truthful tool
-        // paragraph, so it rides along here.
-        has_search_key: local?.has_search_key ?? false,
-        // Same idea, for the BYOK LLM key file: only the runtime can see
-        // whether one is configured in its own environment.
-        has_llm_key: local?.has_llm_key ?? false,
-        // The backend uses this only to expose target channels compatible with
-        // the actual protected-memory adapter. It is an enum, never a path or
-        // provider credential.
-        memory_provider: this.cfg.memoryProvider ?? "securecoms",
-        // Spec §11.1-11.2 (OQ-E): flat keys; the string `memory` above is
-        // unchanged. memory_notes is true only when notes are actually on (the
-        // provider is securecoms and the parsed payload.memory keeps them on);
-        // the generation is the store's applied value, never the payload's.
-        // Final review I-1: and only once a notes-reading runtime said hello.
-        memory_notes: this.notesProviderOn() && this.notesConsumerSeen,
-        // Unified memory (plan Task 31): only while the compiled part 1 switch is on, so a
-        // 0.28-equivalent bridge never makes the web show the unified panel. Numbers and
-        // booleans only (U1).
-        ...this.reportedUnified(),
-        ...this.reportedClearGeneration(),
-        // 7b spec §9.2 (Task 19): capability versus state. Read-only: the report never starts the embedder.
-        ...this.reportedRecall(),
-        // Inert legacy files only. `readLocalReport` revalidates the current
-        // regular-file bytes and strips every local path before this leaves the
-        // machine.
-        legacy_memory: local?.legacy_memory ?? [],
-        // §B.4: counts of server-named secret paths inside / allowlisted /
-        // outside the secrets directory, and the runtime's mode. Numbers and
-        // one enum only; readLocalReport rebuilds it so no path rides along.
-        secret_paths: local?.secret_paths ?? null
-      };
-      const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${this.cfg.apiKey}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(report)
-      });
-      if (!posted.ok) {
-        if (version) {
-          writeServiceLog2("warn", "runtime_config.report_failed", { status: posted.status, version });
-        } else {
-          writeServiceLog2("warn", "runtime_config.legacy_memory_report_failed", { status: posted.status });
-        }
-        return;
-      }
-      if (version) writeServiceLog2("info", "runtime_config.applied", { version });
-      else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
+      await this.postRuntimeConfigReport(base, version, skillsJson);
     } catch (e) {
       writeServiceLog2("warn", "runtime_config.refetch_failed", {}, e);
     }
   }
+  /**
+   * Plan 4 Task 11: the refetch under a manifest in force. Returns false when the binding failed (H-4),
+   * after the memory was applied; the caller then writes nothing else. Throws only from a file write, with
+   * the binding left null.
+   */
+  async applyUnderManifest(manifest, pinKeyB64, payload, version) {
+    let prior;
+    try {
+      prior = (await this.store.loadToolGrantApplied(pinKeyB64))?.search;
+    } catch (e) {
+      prior = void 0;
+      writeServiceLog2("warn", "authz.config_binding", { state: ServiceLogEnum.of("applied_read_failed", ["applied_read_failed"]) }, e);
+    }
+    let bound;
+    try {
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants });
+    } catch (e) {
+      bound = null;
+      return this.bindFailed(manifest, payload.memory, e);
+    }
+    const counter = manifest.counter;
+    const state = bound.mismatches.length === 0 ? "bound" : "mismatch";
+    const old = this.manifestBinding;
+    if (!(old !== null && old.state === "bound" && old.counter === counter && state === "bound")) this.manifestBinding = null;
+    this.configBindingMismatches = bound.mismatches;
+    this.boundLegacyDecisions = bound.legacyDecisions;
+    this.logConfigBinding(bound);
+    this.targetMismatches = { endpoint: bound.targetMismatches.endpoint, database: bound.targetMismatches.database };
+    await this.applyPayloadMemory(bound.memory);
+    if (!version) {
+      this.manifestBinding = null;
+      return true;
+    }
+    try {
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, bound.policy);
+      this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
+      if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
+    } catch (e) {
+      this.manifestBinding = null;
+      throw e;
+    }
+    this.manifestBinding = { counter, state, signedTargets: { ...bound.signedTargets } };
+    if (bound.appliedSearch !== void 0) {
+      try {
+        await this.store.saveToolGrantApplied(pinKeyB64, { counter, search: bound.appliedSearch });
+      } catch (e) {
+        writeServiceLog2("warn", "authz.config_binding", { state: ServiceLogEnum.of("applied_save_failed", ["applied_save_failed"]) }, e);
+      }
+    }
+    return true;
+  }
+  /** Spec §7.6 (plan 4 Task 15): content-free. One line per mismatched field, one per dropped target. */
+  logConfigBinding(bound) {
+    if (bound.mismatches.length === 0) {
+      writeServiceLog2("info", "authz.config_binding", { state: ServiceLogEnum.of("ok", ["ok"]) });
+    }
+    for (const field of bound.mismatches) {
+      writeServiceLog2("warn", "authz.config_binding", {
+        state: ServiceLogEnum.of("mismatch", ["mismatch"]),
+        field: ServiceLogEnum.of(field, ["persona", "memory", "search", "tools_allow", "flags", "llm", "files", "legacy_assign"])
+      });
+    }
+    for (const kind2 of ["endpoint", "database"]) {
+      for (let i = 0; i < bound.targetMismatches[kind2]; i++) {
+        writeServiceLog2("warn", "authz.target_mismatch", { kind: ServiceLogEnum.of(kind2, ["endpoint", "database"]) });
+      }
+    }
+  }
+  /** H-4: the binding could not be computed. The memory still applies, with the signed mode; nothing else is written. */
+  async bindFailed(manifest, rawMemory, e) {
+    this.manifestBinding = null;
+    writeServiceLog2("warn", "authz.config_binding", { state: ServiceLogEnum.of("bind_failed", ["bind_failed"]) }, e);
+    const signed = { mode: manifest.config.memory.mode, ...manifest.config.memory.recall_days !== void 0 ? { recall_days: manifest.config.memory.recall_days } : {} };
+    let memory = signed;
+    if (rawMemory !== null && typeof rawMemory === "object" && !Array.isArray(rawMemory)) {
+      const { mode: _m, recall_days: _r, ...rest } = rawMemory;
+      memory = { ...signed, ...rest };
+    }
+    await this.applyPayloadMemory(memory);
+    return false;
+  }
+  /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
+  overwriteStalePolicy() {
+    if (!existsSync5(join17(runtimeConfigDir(this.home, this.cfg.identityId), "manifest-policy.json"))) return;
+    this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, { v: 1, manifest_tools: [], secret_path_mode: "enforce" });
+  }
+  /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
+  async postRuntimeConfigReport(base, version, skillsJson) {
+    const local = readLocalReport(this.home, this.cfg.identityId);
+    const report = {
+      applied_version: version,
+      paths: checkConfiguredPaths(skillsJson),
+      // Read AFTER the prunes above, so the owner's next view of memory is
+      // the file as it now stands, not the one they just pruned from.
+      memory: readManagedMemory(this.home, this.cfg.identityId),
+      // E13: pass through what the runtime reported. The daemon does not
+      // interpret any of it.
+      local_persona: local?.persona ?? null,
+      // Only the runtime knows whether a search key file is configured — it
+      // is an environment value on that process, invisible to the daemon and
+      // to the backend. The backend needs it to generate a truthful tool
+      // paragraph, so it rides along here.
+      has_search_key: local?.has_search_key ?? false,
+      // Same idea, for the BYOK LLM key file: only the runtime can see
+      // whether one is configured in its own environment.
+      has_llm_key: local?.has_llm_key ?? false,
+      // The backend uses this only to expose target channels compatible with
+      // the actual protected-memory adapter. It is an enum, never a path or
+      // provider credential.
+      memory_provider: this.cfg.memoryProvider ?? "securecoms",
+      // Spec §11.1-11.2 (OQ-E): flat keys; the string `memory` above is
+      // unchanged. memory_notes is true only when notes are actually on (the
+      // provider is securecoms and the parsed payload.memory keeps them on);
+      // the generation is the store's applied value, never the payload's.
+      // Final review I-1: and only once a notes-reading runtime said hello.
+      memory_notes: this.notesProviderOn() && this.notesConsumerSeen,
+      // Unified memory (plan Task 31): only while the compiled part 1 switch is on, so a
+      // 0.28-equivalent bridge never makes the web show the unified panel. Numbers and
+      // booleans only (U1).
+      ...this.reportedUnified(),
+      ...this.reportedClearGeneration(),
+      // 7b spec §9.2 (Task 19): capability versus state. Read-only: the report never starts the embedder.
+      ...this.reportedRecall(),
+      // Inert legacy files only. `readLocalReport` revalidates the current
+      // regular-file bytes and strips every local path before this leaves the
+      // machine.
+      legacy_memory: local?.legacy_memory ?? [],
+      // §B.4: counts of server-named secret paths inside / allowlisted /
+      // outside the secrets directory, and the runtime's mode. Numbers and
+      // one enum only; readLocalReport rebuilds it so no path rides along.
+      secret_paths: local?.secret_paths ?? null,
+      // Owner-signed tool grants (spec §7.7, D-6): enums and numbers only. It
+      // authorizes nothing and a compromised backend can forge what it shows
+      // (residual 9). The backend drops it until Plan 2 or 3 stores it.
+      tool_grant_status: {
+        pin: this.cfg.ownerGrantPin?.state ?? "no_pin",
+        manifest: this.manifestState,
+        applied_counter: this.toolGrantCounter,
+        owner_dm_verify_failures: this.ownerVerifyFailures,
+        // Plan 4 Task 15 (OQ-5): sorted, unique enums; capability is the latest hello's class.
+        config_binding_mismatches: [...this.configBindingMismatches],
+        target_mismatches: ["database", "endpoint"].filter((k) => this.targetMismatches[k] > 0),
+        capability: this.lastConsumerCapability
+      }
+    };
+    const reportedVerifyFailures = this.ownerVerifyFailures;
+    const posted = await this.fetchBounded("runtime_config_report", "control", `${base}/report`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${this.cfg.apiKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(report)
+    });
+    if (!posted.ok) {
+      if (version) {
+        writeServiceLog2("warn", "runtime_config.report_failed", { status: posted.status, version });
+      } else {
+        writeServiceLog2("warn", "runtime_config.legacy_memory_report_failed", { status: posted.status });
+      }
+      return;
+    }
+    this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
+    if (version) writeServiceLog2("info", "runtime_config.applied", { version });
+    else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
+  }
   /**
    * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
    *
@@ -35344,9 +36680,58 @@ var BridgeAgent = class _BridgeAgent {
       this.droppedMessages += overflow;
     }
   }
+  /**
+   * C10 (spec P-15, OQ-8 (b)): subscribe early, consume late. The
+   * delivery-ping socket opens here, before anything else, so this copy claims
+   * the device's session (and another copy gets its 4409) BEFORE this copy's
+   * boot drain runs. The pings it carries are NOT consumed until
+   * startReceivePump(), the same place as before: starting the pump first is
+   * still forbidden (DRAIN BEFORE ROTATE, startBody).
+   *
+   * A 4409 during start() (audit H-3): the gated fetch is already set (C9 step
+   * 0). start() then arms nothing more (supersededDuringStart before each
+   * timer and before the pump), runs the memoized close() quiesce, and rejects
+   * with SessionSupersededError. A step that FAILED because of the supersede
+   * (a refused fetch, a store the quiesce closed) is the same outcome.
+   */
   async start() {
+    const early = this.transport.subscribeDeliveryPings("");
+    this.earlyPings = early;
+    this.pingHandle = { close: early.close };
+    const body = this.startBody();
+    this.startInFlight = body.then(() => {
+    }, () => {
+    });
+    try {
+      await body;
+    } catch (e) {
+      if (!this.sessionSuperseded) {
+        if (this.earlyPings) {
+          this.earlyPings.close();
+          this.earlyPings = null;
+          this.pingHandle = void 0;
+        }
+        throw e;
+      }
+      if (!(e instanceof SessionSupersededError)) writeServiceLog2("warn", "startup.superseded_start_error", {}, e);
+      await this.close().catch(() => {
+      });
+      throw new SessionSupersededError();
+    }
+  }
+  /** C10: true once a 4409 landed; checked before each arming step of start(). */
+  supersededDuringStart() {
+    return this.sessionSuperseded;
+  }
+  async startBody() {
     this.startedAt = Date.now();
     await this.restoreRuntimeInbox();
+    await this.loadToolGrantState();
+    try {
+      this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
+    } catch (e) {
+      writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("store_failed", ["store_failed"]) }, e);
+    }
     try {
       this.store.pruneRecall();
       this.store.reconcileRecallClearGeneration();
@@ -35398,10 +36783,12 @@ var BridgeAgent = class _BridgeAgent {
     await this.warmRestoredNotes();
     await this.reindexRestoredTurns();
     if (this.unifiedOn) await this.reindexUnifiedRestored();
+    if (this.supersededDuringStart()) throw new SessionSupersededError();
     this.runtimeConfigTimer = setInterval(() => {
       void this.refetchRuntimeConfig();
     }, 6 * 60 * 60 * 1e3);
     this.runtimeConfigTimer.unref?.();
+    if (this.supersededDuringStart()) throw new SessionSupersededError();
     this.membershipSweepTimer = setInterval(() => {
       if (this.closingDown || this.membershipSweepWork) return;
       this.membershipSweepWork = this.runMembershipSweeps().finally(() => {
@@ -35409,6 +36796,7 @@ var BridgeAgent = class _BridgeAgent {
       });
     }, PURGE_SWEEP_INTERVAL_MS);
     this.membershipSweepTimer.unref?.();
+    if (this.supersededDuringStart()) throw new SessionSupersededError();
     this.recallPruneTimer = setInterval(() => {
       if (this.closingDown || this.recallPruneWork) return;
       this.recallPruneWork = this.runRecallPruneTick().finally(() => {
@@ -35416,6 +36804,7 @@ var BridgeAgent = class _BridgeAgent {
       });
     }, 60 * 60 * 1e3);
     this.recallPruneTimer.unref?.();
+    if (this.supersededDuringStart()) throw new SessionSupersededError();
     if (this.machinePaths) this.recallMaintenanceTimer = setInterval(() => {
       if (this.closingDown) return;
       const n = ++this.maintenanceTickN;
@@ -35426,6 +36815,7 @@ var BridgeAgent = class _BridgeAgent {
       });
     }, 1e3);
     this.recallMaintenanceTimer?.unref?.();
+    if (this.supersededDuringStart()) throw new SessionSupersededError();
     this.startReceivePump();
     if (drainedInTime) {
       this.armSelfHealSweeps();
@@ -36480,8 +37870,10 @@ var BridgeAgent = class _BridgeAgent {
     if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
     const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
     const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(body.text);
-    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch);
-    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null);
+    if (opts.inReplyTo !== void 0 && this.isOwnerVerifyFailed(opts.inReplyTo)) return;
+    const origin = this.spokenReplyIds.has(id) ? "fast_path" : !this.taintScope(channelId) ? "reply" : opts.inReplyTo !== void 0 && this.cleanTurns.has(opts.inReplyTo) && !this.taintedTurns.has(opts.inReplyTo) ? "reply" : "untrusted";
+    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch, origin);
+    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null, origin);
   }
   /**
    * Final review bridge I-1 (ledger T25): the agent reply's U11 capture, taken BEFORE the publish await. The clear generation
@@ -36496,8 +37888,9 @@ var BridgeAgent = class _BridgeAgent {
     return { ...this.store.itemCapture(channelId), clearGeneration: stamp };
   }
   /** Section 7.1 agent reply, section 24.2: the owner-DM predicate for the channel at write (no sender), else nothing. Reference trust always (U18). OQ-P2: bridge-authored Pinned:/Forgot: lines are filtered by the caller. */
-  spawnUnifiedReply(channelId, text, messageId, expect) {
+  spawnUnifiedReply(channelId, text, messageId, expect, origin) {
     if (expect === null) return;
+    if (origin === "fast_path") return;
     const work = (async () => {
       try {
         if (!this.unifiedProviderOn()) return;
@@ -36513,7 +37906,9 @@ var BridgeAgent = class _BridgeAgent {
           source: "agent_reply",
           trust: "reference",
           text,
-          expect
+          expect,
+          role: "agent",
+          origin
         });
       } catch {
         writeServiceLog2("warn", "memory.unified_reply_failed", {});
@@ -37239,6 +38634,13 @@ var BridgeAgent = class _BridgeAgent {
     );
     return humanCounterparts.length === 1 && humanCounterparts[0][1].is_agent_owner;
   }
+  /**
+   * Decision D-9 (audit H-3): a turn that failed owner verification gets only
+   * its own text, never the prior-turn history snapshot, for every provider.
+   */
+  mayReadHistoryForTurn(messageId, authorization) {
+    return !this.isOwnerVerifyFailed(messageId) && this.mayReadOpenClawMemoryForTurn(authorization);
+  }
   /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
   mayReadOpenClawMemoryForTurn(authorization) {
     return this.cfg.memoryProvider !== "openclaw" || authorization.sender_membership === "active" && authorization.audience === "owner_dm";
@@ -37248,16 +38650,119 @@ var BridgeAgent = class _BridgeAgent {
    * stays owner-DM-only; every provider failure degrades to empty context and
    * never falls back to the runtime's retired plaintext JSON files.
    */
-  async memoryForTurn(channelId, authorization, limit = 50) {
-    if (!this.mayReadOpenClawMemoryForTurn(authorization)) {
+  async memoryForTurn(channelId, messageId, authorization, limit = 50) {
+    if (!this.mayReadHistoryForTurn(messageId, authorization)) {
       return { recent: [], facts: [] };
     }
     try {
-      return await this.memory.context(channelId, limit);
+      return this.fenceMemory(channelId, await this.memory.context(channelId, limit), holdsManifestGrant(authorization));
     } catch {
       return { recent: [], facts: [] };
     }
   }
+  /**
+   * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
+   * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
+   */
+  voiceFenceOn() {
+    return this.cfg.ownerGrantPin?.pin != null;
+  }
+  /** The keyed and legacy fast-reply ids of every peer row of the conversation (audit r2 M-1; never the 50-row window). */
+  fenceContext(channelId) {
+    let ids;
+    const build = () => {
+      const out = /* @__PURE__ */ new Set();
+      for (const p of this.store.memoryPeerMessageIds(channelId)) {
+        out.add(fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, p));
+        out.add(legacyFastReplyId(p));
+      }
+      return out;
+    };
+    return { get fastIds() {
+      return ids ??= build();
+    } };
+  }
+  /**
+   * Drop agent lines classified fast_path, untrusted or unknown from a turn's memory (every turn of a pinned agent).
+   * `strict` (review H-3, a turn that holds a manifest grant): relay-class peer lines go too (sender not the pinned
+   * owner, or voice modality). Otherwise peer lines are never dropped.
+   */
+  fenceMemory(channelId, ctx, manifestTurn = false) {
+    if (!this.voiceFenceOn()) return ctx;
+    const scoped = this.taintScope(channelId);
+    const strict = manifestTurn && scoped;
+    if (!strict && !ctx.recent.some((t) => t.role === "agent")) return ctx;
+    const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
+    const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
+    const meta = securecoms ? this.store.memoryLineMeta(channelId, ctx.recent.filter((t) => strict || t.role === "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    const fence = this.fenceContext(channelId);
+    const recent = ctx.recent.filter((t) => {
+      const m = meta.get(t.seq);
+      if (t.role !== "agent") return !(strict && isRelayClassPeer({ peerId: t.peerId, modality: m?.modality }, ownerId));
+      const origin = classifyAgentLine({ ...m ?? {}, ts: t.ts }, fence);
+      return origin === "reply" || origin === "untrusted" && !scoped;
+    });
+    return recent.length === ctx.recent.length ? ctx : { ...ctx, recent };
+  }
+  /**
+   * Review H-3: true when a delivered frame holds a line a manifest turn would exclude (a relay-class peer line; agent
+   * lines in a frame are already fenced). Such a turn's reply is recorded "untrusted".
+   */
+  frameHoldsRelayClass(m) {
+    const recent = m.memory?.recent ?? [];
+    if (recent.length === 0) return false;
+    const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
+    const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
+    const meta = securecoms ? this.store.memoryLineMeta(m.channel_id, recent.filter((t) => t.role !== "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    return recent.some((t) => t.role !== "agent" && isRelayClassPeer({ peerId: t.peerId, modality: meta.get(t.seq)?.modality }, ownerId));
+  }
+  /**
+   * Review H-3 attribution: message ids of turns delivered on a pinned agent whose frame held no relay-class line.
+   * A reply is recorded "reply" only when its in-reply-to is here; anything else (tainted, unknown after a restart,
+   * no in-reply-to) is "untrusted". Bounded; the oldest are forgotten first (forgetting only makes a reply untrusted).
+   */
+  cleanTurns = /* @__PURE__ */ new Set();
+  noteDeliveredFrame(m, unifiedTainted = false) {
+    if (!this.taintScope(m.channel_id)) return;
+    const tainted = unifiedTainted || this.turnIsRelayClass(m) || !holdsManifestGrant(m.authorization) && this.frameHoldsRelayClass(m);
+    if (tainted) {
+      this.cleanTurns.delete(m.message_id);
+      this.taintedTurns.add(m.message_id);
+      if (this.taintedTurns.size > 5e3) this.taintedTurns.delete(this.taintedTurns.values().next().value);
+      return;
+    }
+    if (this.taintedTurns.has(m.message_id)) return;
+    this.cleanTurns.add(m.message_id);
+    if (this.cleanTurns.size > 5e3) this.cleanTurns.delete(this.cleanTurns.values().next().value);
+  }
+  taintedTurns = /* @__PURE__ */ new Set();
+  /**
+   * Review R2-H2: on a pinned agent a 7a note or a unified memory_note is written only from a turn delivered with a clean
+   * frame in the owner DM (cleanTurns, not taintedTurns), so a tainted fallback turn cannot plant a note that a later
+   * manifest turn reads. Taint is noted at delivery, before any note frame for the turn can arrive.
+   */
+  noteTurnClean(messageId) {
+    return !this.voiceFenceOn() || this.cleanTurns.has(messageId) && !this.taintedTurns.has(messageId);
+  }
+  /**
+   * Review R2-H1: the turn itself is relay-class (its frame memory is prior-turn only, so its own sender is never in it):
+   * a sender that is not the pinned owner, a relay speaker claim, or a voice turn.
+   */
+  turnIsRelayClass(m) {
+    const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId;
+    return m.sender_id !== ownerId || m.authorization?.relay_speaker !== void 0 || m.voice === true || m.transcribed === true || m.speaker !== void 0;
+  }
+  /**
+   * R2-M1 ruling: the channel where the H-3 taint and the `untrusted` exclusion apply, on a pinned agent: the signed
+   * owner_dm_channel_id of the manifest in force. Before any manifest is held there is no signed DM, so every channel
+   * not known to be a room counts (fail closed: a reply recorded there before the first manifest must not reach it).
+   */
+  taintScope(channelId) {
+    if (!this.voiceFenceOn()) return false;
+    const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
+    if (signedDm !== void 0) return signedDm === channelId;
+    return (this.freshMeta(channelId)?.is_dm ?? this.store.getChannelMeta(channelId)?.isDm) !== false;
+  }
   /**
    * Spec §11.2 (OQ-L), §6.5: apply one parsed `payload.memory`. An unreadable
    * value turns notes off and deletes nothing. A readable one goes through
@@ -37713,10 +39218,16 @@ var BridgeAgent = class _BridgeAgent {
         if (isDm !== true || ownerId === void 0) return { kind: "unknown" };
         return this.store.recordDmOwner(c, ownerId) ? { kind: "owner", ownerId } : { kind: "unknown" };
       };
+      const fences = /* @__PURE__ */ new Map();
+      const classifyHistoryOrigin = (c, r) => {
+        const f = fences.get(c) ?? (fences.set(c, this.fenceContext(c)), fences.get(c));
+        return classifyAgentLine({ origin: r.origin, modality: r.modality, ...r.messageId ? { messageId: r.messageId } : {}, ts: r.recordedAt }, f);
+      };
       const out = await runMigration({
         store: this.store,
         items: this.items,
         classify,
+        classifyHistoryOrigin,
         stopping: () => this.closingDown,
         pinsChanged: () => this.notes.exclusive(async () => {
           this.unifiedReads?.bumpGeneration();
@@ -37736,7 +39247,24 @@ var BridgeAgent = class _BridgeAgent {
     const a = m.authorization;
     if (!(a?.memory_write === true || a?.relay_speaker === "owner")) return void 0;
     const scopeId = this.ownerScopeNow(m.channel_id);
-    return scopeId === null ? void 0 : this.unifiedReads.deliverable(m.message_id, m.channel_id, scopeId);
+    if (scopeId === null) return void 0;
+    if (!this.voiceFenceOn()) return this.unifiedReads.deliverable(m.message_id, m.channel_id, scopeId);
+    const contexts = /* @__PURE__ */ new Map();
+    const ctxFor = (c) => contexts.get(c) ?? (contexts.set(c, this.fenceContext(c)), contexts.get(c));
+    const trace = (c, at) => this.store.memoryRowForTrace(c, at);
+    const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
+    const scoped = this.taintScope(m.channel_id);
+    const strict = scoped && holdsManifestGrant(m.authorization);
+    const strictRule = { ownerId, turnChannelId: m.channel_id };
+    let tainted = false;
+    const out = this.unifiedReads.deliverable(m.message_id, m.channel_id, scopeId, (i) => {
+      const facts = { channelId: i.channelId, source: i.source, originId: i.originId, role: i.role, origin: i.origin, sourceRef: i.sourceRef };
+      const keep = classifyUnifiedItem(facts, trace, ctxFor(i.channelId), strict ? strictRule : void 0, !scoped) === "keep";
+      if (keep && scoped && !strict && classifyUnifiedItem(facts, trace, ctxFor(i.channelId), strictRule) === "exclude") tainted = true;
+      return keep;
+    });
+    if (tainted) this.noteDeliveredFrame(m, true);
+    return out;
   }
   /** ws-server: the hello echoes memory_unified only with the part 1 switch compiled on. */
   unifiedFeatureOn() {
@@ -38038,6 +39566,7 @@ var BridgeAgent = class _BridgeAgent {
       if (rec === void 0) return refuse("message");
       const channelId = rec.channel_id;
       if (rec.authorization?.memory_write !== true) return refuse("audience");
+      if (!this.noteTurnClean(rec.message_id)) return refuse("audience");
       const held = await this.heldPosition(channelId);
       const now = this.authorizationFor(channelId, rec.sender_id, void 0, held.epoch, held.groupId, { log: false });
       if (now.memory_write !== true) return refuse("audience");
@@ -38141,6 +39670,7 @@ var BridgeAgent = class _BridgeAgent {
       if (rec === void 0) return refuse("message");
       const channelId = rec.channel_id;
       if (rec.authorization?.memory_write !== true) return refuse("audience");
+      if (!this.noteTurnClean(rec.message_id)) return refuse("audience");
       const held = await this.heldPosition(channelId);
       if (this.authorizationFor(channelId, rec.sender_id, void 0, held.epoch, held.groupId, { log: false }).memory_write !== true) return refuse("audience");
       const scopeId = this.ownerScopeNow(channelId);
@@ -38224,6 +39754,9 @@ var BridgeAgent = class _BridgeAgent {
     return { type: "memory_note_result", request_id: f.request_id, message_id: f.message_id, ok: true };
   }
   async memoryContext(conversationId, limit) {
+    for (const [id, channelId] of this.ownerVerifyFailedIds) {
+      if (channelId === conversationId && this.runtimePendingIds.has(id)) return { recent: [], facts: [] };
+    }
     if (!await this.mayReadOpenClawMemory(conversationId)) {
       return { recent: [], facts: [] };
     }
@@ -38371,7 +39904,7 @@ var BridgeAgent = class _BridgeAgent {
       const fastLlm = this.fastLlm;
       if (!fastLlm || !this.cfg.voice) return "failed";
       let memory;
-      if (!this.mayReadOpenClawMemoryForTurn(m.authorization)) {
+      if (!this.mayReadHistoryForTurn(m.messageId, m.authorization)) {
         memory = { recent: [], facts: [] };
       } else {
         try {
@@ -38419,15 +39952,17 @@ var BridgeAgent = class _BridgeAgent {
    * frame (the "fast path failed" semantics), so a crash mid-call never loses
    * the turn.
    */
-  async stageHeldRuntimeMessage(message) {
-    if (this.runtimePendingIds.has(message.message_id)) return true;
+  async stageHeldRuntimeMessage(held, opts = {}) {
+    if (this.runtimePendingIds.has(held.message_id)) return true;
     if (this.runtimePendingIds.size >= this.maxBuffer) {
       writeServiceLog2("warn", "runtime_inbox.full");
       return false;
     }
+    const message = opts.absorbed ? held : this.applyRoomSearchBackstop(held);
     try {
       await this.stageSealed(message);
       this.runtimePendingIds.add(message.message_id);
+      if (message !== held) this.backstopStripped.add(message.message_id);
       return true;
     } catch (error) {
       writeServiceLog2("error", "runtime_inbox.stage_failed", {}, error);
@@ -38443,7 +39978,8 @@ var BridgeAgent = class _BridgeAgent {
     }
     const memory = await this.memoryAtRelease(message);
     if (this.closingDown || !this.runtimePendingIds.has(message.message_id)) return;
-    this.buffer.push(memory === message.memory ? message : { ...message, memory });
+    const out = this.backstopStripped.delete(message.message_id) ? this.withoutWebSearch(message) : message;
+    this.buffer.push(memory === message.memory ? out : { ...out, memory });
     this.wakeListeners();
   }
   /**
@@ -38461,7 +39997,7 @@ var BridgeAgent = class _BridgeAgent {
    */
   async memoryAtRelease(message) {
     const prior = message.memory;
-    if (!prior || !this.mayReadOpenClawMemoryForTurn(message.authorization)) return prior;
+    if (!prior || !this.mayReadHistoryForTurn(message.message_id, message.authorization)) return prior;
     let fresh;
     try {
       fresh = await this.memory.context(message.channel_id, _BridgeAgent.TURN_MEMORY_LIMIT);
@@ -38469,7 +40005,7 @@ var BridgeAgent = class _BridgeAgent {
       return prior;
     }
     const after = prior.recent.reduce((max, turn) => Math.max(max, turn.ts ?? 0), message.ts);
-    const spoken = fresh.recent.filter((turn) => turn.role === "agent" && turn.ts !== void 0 && turn.ts > after);
+    const spoken = this.fenceMemory(message.channel_id, fresh, holdsManifestGrant(message.authorization)).recent.filter((turn) => turn.role === "agent" && turn.ts !== void 0 && turn.ts > after);
     if (spoken.length === 0) return prior;
     return {
       recent: [...prior.recent, ...spoken].slice(-_BridgeAgent.TURN_MEMORY_LIMIT),
@@ -38752,6 +40288,11 @@ var BridgeAgent = class _BridgeAgent {
         });
       }
       this.channelRoster.set(channelId, { members, at: Date.now(), epoch, groupId, crossOrg: roomIsCrossOrg(rows) });
+      const grantPin = this.cfg.ownerGrantPin?.pin;
+      if (grantPin && !this.serverOwnerMismatchLogged && liveRows.some((r) => r.is_agent_owner === true && !r.is_agent && r.identity_id !== grantPin.ownerIdentityId)) {
+        this.serverOwnerMismatchLogged = true;
+        writeServiceLog2("warn", "authz.pin", { state: ServiceLogEnum.of("server_owner_mismatch", ["server_owner_mismatch"]) });
+      }
       const self = members.get(this.cfg.identityId);
       if (self?.name) this.lastOwnDisplayName = self.name;
       await this.resolveAndPinOwner(channelId, liveRows);
@@ -38778,11 +40319,200 @@ var BridgeAgent = class _BridgeAgent {
       }
     }
   }
+  /**
+   * Owner-signed tool grants, step 1 (spec §7.2; decisions D-1, D-2, D-4, D-8,
+   * D-9; audits H-1, M-2, M-4, E-1..E-3). The verdict for one delivered turn.
+   *
+   * `unchecked` when no pin is loaded or the sender is not the pinned owner.
+   * Otherwise, in order, the first failure wins: the identity signature over the
+   * raw payload bytes with the pinned key; the verified bytes must be the
+   * decrypted envelope; in a DM only (D-1), the signed DM channel and the MLS
+   * leaf set; then the replay set and closed epochs, keyed by the agent's OWN
+   * held group (never the backend's row label, M-2). NEVER throws (M-4): any
+   * exception is `failed verify_error`, and the row is acked like any other turn.
+   */
+  async verifyOwnerTurn(m) {
+    const pin = this.cfg.ownerGrantPin?.pin ?? null;
+    if (!pin || m.envelope.sender_id !== pin.ownerIdentityId) return OWNER_TURN_UNCHECKED;
+    try {
+      const sig = verifyOwnerSignature({ payloadHex: m.payloadHex, identitySignature: m.identitySignature }, pin);
+      if (sig.state !== "ok") return this.ownerTurnFailed(m, this.isAckedOwnerOriginal(m) ? "replay" : sig.state);
+      const v = sig.envelope;
+      if (v.message_id !== m.envelope.message_id || v.channel_id !== m.envelope.channel_id || v.sender_id !== m.envelope.sender_id || v.mls_group_epoch !== m.envelope.mls_group_epoch || v.payload_encrypted !== m.envelope.payload_encrypted) {
+        return this.ownerTurnFailed(m, "malformed");
+      }
+      if (v.sender_id !== pin.ownerIdentityId) return this.ownerTurnFailed(m, "malformed");
+      let leafClass = "ok";
+      if (this.freshMeta(m.channelId)?.is_dm === true) {
+        const signedDm = this.toolGrantManifest?.owner_dm_channel_id;
+        if (signedDm !== void 0 && signedDm !== m.channelId) return this.ownerTurnFailed(m, "wrong_dm_channel");
+        leafClass = classifyOwnerDmLeaves((await this.provider.leafTreeSummary(m.channelId)).leaves, {
+          ownerIdentityId: pin.ownerIdentityId,
+          agentIdentityId: this.cfg.identityId,
+          relayIdentityId: this.toolGrantManifest?.owner_dm_relay_identity_id,
+          isServerRelay: (id) => this.freshRoster(m.channelId)?.get(id)?.is_relay === true
+        });
+        if (leafClass === "foreign") return this.ownerTurnFailed(m, "not_owner_dm_leaves");
+      }
+      const held = await this.heldPosition(m.channelId);
+      if (held.groupId === null) return this.ownerTurnFailed(m, "verify_error");
+      if (!this.runtimePendingIds.has(m.messageId) && (this.store.hasOwnerMessage(m.channelId, m.messageId) || this.store.isOwnerEpochClosed(m.channelId, held.groupId, v.mls_group_epoch))) {
+        return this.ownerTurnFailed(m, "replay");
+      }
+      const replay = Object.freeze({ channelId: m.channelId, groupId: held.groupId, epoch: v.mls_group_epoch });
+      this.ownerReplayPending.set(m.messageId, replay);
+      return Object.freeze({ kind: leafClass === "unsigned_relay" ? "constants_only" : "verified", replay });
+    } catch {
+      return this.ownerTurnFailed(m, "verify_error");
+    }
+  }
+  /** Log, count and (except a replay, audit E-3) record one failed owner-turn check. Never throws (audit E-2). */
+  ownerTurnFailed(m, reason) {
+    writeServiceLog2("warn", "authz.owner_dm_verify", {
+      state: ServiceLogEnum.of(reason, [
+        "bad_signature",
+        "malformed",
+        "unknown_algo",
+        "no_signature",
+        "not_owner_dm_leaves",
+        "wrong_dm_channel",
+        "replay",
+        "verify_error"
+      ])
+    });
+    this.ownerVerifyFailures += 1;
+    if (reason !== "replay" && !this.isVerifiedOwnerOriginal(m)) {
+      this.ownerVerifyFailedIds.set(m.messageId, m.channelId);
+      try {
+        this.store.recordOwnerVerifyFailure(m.channelId, m.messageId, Date.now());
+      } catch {
+        writeServiceLog2("warn", "authz.owner_verify_record_failed");
+      }
+    }
+    return Object.freeze({ kind: "failed", reason });
+  }
+  /** Review M-A: a verified original of this id was staged and is still pending, or was recorded in the replay set. */
+  isVerifiedOwnerOriginal(m) {
+    return this.runtimePendingIds.has(m.messageId) || this.isAckedOwnerOriginal(m);
+  }
+  /** Review M-A: a verified original of this id was staged and acked (it is in the replay set, no longer pending). */
+  isAckedOwnerOriginal(m) {
+    if (this.runtimePendingIds.has(m.messageId)) return false;
+    try {
+      return this.store.hasOwnerMessage(m.channelId, m.messageId);
+    } catch {
+      return false;
+    }
+  }
+  /** D-9: memory first, then the store (a restart before the reply). Unpinned: never. A store read that throws withholds (fail closed). */
+  isOwnerVerifyFailed(messageId) {
+    if (this.ownerVerifyFailedIds.has(messageId)) return true;
+    if (!this.cfg.ownerGrantPin?.pin) return false;
+    try {
+      return this.store.isOwnerVerifyFailed(messageId);
+    } catch {
+      return true;
+    }
+  }
+  /**
+   * Decision D-2, audit L-2: prune the owner replay set at most once per
+   * OWNER_REPLAY_PRUNE_INTERVAL_MS, keeping each channel's current (group,
+   * epoch). A channel whose held position is unknown is left out (not pruned).
+   */
+  async maybePruneOwnerReplay() {
+    if (!this.cfg.ownerGrantPin?.pin) return;
+    const now = this.monoNow();
+    if (now - this.lastOwnerReplayPruneAt < OWNER_REPLAY_PRUNE_INTERVAL_MS) return;
+    this.lastOwnerReplayPruneAt = now;
+    try {
+      const currentOf = /* @__PURE__ */ new Map();
+      for (const channelId of this.store.listOwnerReplayChannels()) {
+        const held = await this.heldPosition(channelId);
+        if (held.groupId !== null && held.epoch !== null) currentOf.set(channelId, { groupId: held.groupId, epoch: held.epoch });
+      }
+      this.store.pruneOwnerReplay(Date.now(), currentOf);
+    } catch (e) {
+      writeServiceLog2("warn", "authz.replay_prune_failed", {}, e);
+    }
+  }
+  /** start(): drop other keys' manifest state, re-verify the stored one for the pinned key, and prune. */
+  async loadToolGrantState() {
+    const pin = this.cfg.ownerGrantPin?.pin;
+    if (!pin) return;
+    try {
+      this.store.dropToolGrantManifestsExcept(pin.publicKeyB64);
+      this.store.dropToolGrantAppliedExcept(pin.publicKeyB64);
+      const saved = await this.store.loadToolGrantManifest(pin.publicKeyB64);
+      if (saved) {
+        const v = verifyToolGrantManifest(saved.wrapper, { pin, agentIdentityId: this.cfg.identityId, storedCounter: null });
+        if (v.state === "ok") {
+          this.toolGrantManifest = v.manifest;
+          this.toolGrantCounter = v.manifest.counter;
+        } else {
+          this.logManifest("malformed");
+        }
+      }
+    } catch (e) {
+      writeServiceLog2("warn", "authz.manifest_load_failed", {}, e);
+    }
+    await this.maybePruneOwnerReplay();
+  }
+  /**
+   * Spec §7.1: verify and record a served manifest. Never writes a file and
+   * never changes a grant in step 1. A save that throws keeps the old state.
+   */
+  async applyToolGrantManifest(raw) {
+    const pin = this.cfg.ownerGrantPin?.pin;
+    if (!pin) {
+      this.logManifest("no_pin");
+      return;
+    }
+    if (raw === void 0 || raw === null) {
+      this.logManifest("no_manifest");
+      return;
+    }
+    const v = verifyToolGrantManifest(raw, { pin, agentIdentityId: this.cfg.identityId, storedCounter: this.toolGrantCounter });
+    if (v.state === "ok") {
+      try {
+        await this.store.saveToolGrantManifest(pin.publicKeyB64, v.manifest.counter, v.wrapper);
+      } catch {
+        this.logManifest("kept_last_good");
+        return;
+      }
+      this.toolGrantManifest = v.manifest;
+      this.toolGrantCounter = v.manifest.counter;
+      this.logManifest("ok");
+      if (v.droppedUnknown) this.logManifest("unknown_entry");
+      return;
+    }
+    this.logManifest(v.state);
+    if (v.state !== "unchanged" && this.toolGrantManifest) this.logManifest("kept_last_good");
+  }
+  logManifest(state) {
+    this.manifestState = state;
+    const quiet = state === "ok" || state === "unchanged" || state === "no_pin" || state === "no_manifest";
+    writeServiceLog2(quiet ? "info" : "warn", "authz.manifest", {
+      state: ServiceLogEnum.of(state, [
+        "ok",
+        "unchanged",
+        "no_pin",
+        "no_manifest",
+        "malformed",
+        "unsupported_algo",
+        "bad_signature",
+        "wrong_agent",
+        "wrong_owner",
+        "rollback",
+        "unknown_entry",
+        "kept_last_good"
+      ])
+    });
+  }
   /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
-  async authorizeTurn(channelId, messageId, senderId, relaySpeakerId) {
+  async authorizeTurn(channelId, messageId, senderId, ownerVerdict, relaySpeakerId) {
     const held = await this.heldPosition(channelId);
-    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId);
-    if (auth.tool_grants !== ROOM_DEFAULT_READ_GRANTS) return auth;
+    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId, { ownerVerdict });
+    if (!(auth.audience === "team_room" && auth.tool_grants.length > 0)) return auth;
     if (this.roomGrantEpochs.size >= ROOM_GRANT_TRACK_MAX || held.epoch === null || held.groupId === null) {
       writeServiceLog2("warn", "room_grant.untracked");
       return Object.freeze({ ...auth, tool_grants: NO_TOOL_GRANTS });
@@ -38864,9 +40594,48 @@ var BridgeAgent = class _BridgeAgent {
     if (this.roomDefaultGrants && this.perToolConsumer !== null && epochFresh && meta?.is_dm === false && audience === "team_room" && entry.crossOrg === false) {
       tool_grants = ROOM_DEFAULT_READ_GRANTS;
     }
+    let grantSource = tool_grants.length ? "constant" : "none";
+    const manifest = this.cfg.ownerGrantPin?.pin ? this.toolGrantManifest : null;
+    const binding = this.manifestBinding;
+    const boundNow = binding !== null && binding.state === "bound" && binding.counter === this.toolGrantCounter;
+    const signedTargets = boundNow ? binding.signedTargets : { endpoints: 0, databases: 0 };
+    if (tool_grants === OWNER_DM_DEFAULT_READ_GRANTS) {
+      const eligible = relaySpeakerId === void 0 && opts.ownerVerdict?.kind === "verified" && manifest?.owner_dm_channel_id === channelId && boundNow && this.manifestConsumer !== null;
+      const r = effectiveToolGrants({
+        audience: "owner_dm",
+        base: OWNER_DM_DEFAULT_READ_GRANTS,
+        manifest,
+        eligible,
+        manifestSwitchOn: this.ownerDmManifestGrants,
+        disabled: this.payloadToolDeny,
+        signedTargets,
+        roomSearchCapped: false
+      });
+      tool_grants = r.grants;
+      grantSource = r.source;
+    } else if (tool_grants === ROOM_DEFAULT_READ_GRANTS) {
+      const r = effectiveToolGrants({
+        audience: "team_room",
+        base: ROOM_DEFAULT_READ_GRANTS,
+        manifest,
+        eligible: boundNow && this.manifestConsumer !== null,
+        manifestSwitchOn: this.roomManifestGrants,
+        disabled: this.payloadToolDeny,
+        signedTargets,
+        roomSearchCapped: manifest !== null && this.roomSearchCapped(channelId)
+      });
+      tool_grants = r.grants;
+      grantSource = r.source;
+    }
+    if (opts.ownerVerdict?.kind === "failed") {
+      tool_grants = NO_TOOL_GRANTS;
+      memoryWrite = false;
+      relaySpeaker = void 0;
+      grantSource = "none";
+    }
     const roomClass = meta?.is_dm !== false ? "na" : entry?.crossOrg === false ? "internal" : entry?.crossOrg === true ? "cross_org" : "unknown";
     if (opts.log !== false) {
-      this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length, roomClass, epochFresh, memoryWrite);
+      this.logAuthzDecision(channelId, senderId, relaySpeakerId, audience, tool_grants.length, roomClass, epochFresh, memoryWrite, grantSource);
     }
     return Object.freeze({
       version: 1,
@@ -38902,8 +40671,10 @@ var BridgeAgent = class _BridgeAgent {
    *                            enforcement is attached
    *   memory_write             the turn carries memory_write (Markdown memory
    *                            7a, spec §8.3): a boolean, never content
+   *   grant_source             where the grants came from: constant | none in
+   *                            step 1 (owner-signed tool grants §7.6)
    */
-  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants, roomClass, epochFresh, memoryWrite) {
+  logAuthzDecision(channelId, senderId, relaySpeakerId, audience, grants, roomClass, epochFresh, memoryWrite, grantSource) {
     const meta = this.freshMeta(channelId);
     const roster = this.freshRoster(channelId);
     const sender = roster?.get(senderId);
@@ -38936,7 +40707,8 @@ var BridgeAgent = class _BridgeAgent {
       epoch_fresh: epochFresh,
       room_kill_switch: ServiceLogEnum.of(this.roomDefaultGrants ? "on" : "off", ["on", "off"]),
       per_tool_consumer: this.perToolConsumer !== null,
-      memory_write: memoryWrite
+      memory_write: memoryWrite,
+      grant_source: ServiceLogEnum.of(grantSource, ["constant", "manifest", "fallback", "none"])
     });
   }
   /**
@@ -39307,7 +41079,8 @@ var BridgeAgent = class _BridgeAgent {
     }
   }
   startReceivePump() {
-    const sub = this.transport.subscribeDeliveryPings("");
+    const sub = this.earlyPings ?? this.transport.subscribeDeliveryPings("");
+    this.earlyPings = null;
     this.pingHandle = { close: sub.close };
     void (async () => {
       try {
@@ -39529,6 +41302,7 @@ var BridgeAgent = class _BridgeAgent {
       this.joinState.set(cid, "JOINED");
     }
     if (!entries.length) return;
+    await this.maybePruneOwnerReplay();
     const receivedAt = Date.now();
     const purgeEpochAtReceipt = /* @__PURE__ */ new Map();
     const itemCaptureAtReceipt = /* @__PURE__ */ new Map();
@@ -39621,7 +41395,7 @@ var BridgeAgent = class _BridgeAgent {
               acked.push(m.queueId);
               continue;
             }
-            const refAuth = await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id);
+            const refAuth = await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id, await this.verifyOwnerTurn(m));
             await this.prepareNotesForTurn(m.channelId, refAuth);
             const vaultRefMessage = {
               channel_id: m.channelId,
@@ -39681,7 +41455,7 @@ var BridgeAgent = class _BridgeAgent {
                 { attachmentsDir: this.attachmentsDirImpl, channelId: m.channelId, messageId: m.messageId },
                 this.receiveDeps()
               );
-              const shareAuth = await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id);
+              const shareAuth = await this.authorizeTurn(m.channelId, m.messageId, m.envelope.sender_id, await this.verifyOwnerTurn(m));
               await this.prepareNotesForTurn(m.channelId, shareAuth);
               const runtimeMessage = {
                 channel_id: m.channelId,
@@ -39749,14 +41523,16 @@ var BridgeAgent = class _BridgeAgent {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
             )?.name;
+            const ownerVerdict = await this.verifyOwnerTurn(m);
             const turnAuthorization = await this.authorizeTurn(
               m.channelId,
               m.messageId,
               m.envelope.sender_id,
+              ownerVerdict,
               speaker?.identityId
             );
             await this.prepareNotesForTurn(m.channelId, turnAuthorization);
-            const runtimeMemory = this.memoryForTurn(m.channelId, turnAuthorization);
+            const runtimeMemory = this.memoryForTurn(m.channelId, m.messageId, turnAuthorization);
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
             const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
@@ -39787,7 +41563,9 @@ var BridgeAgent = class _BridgeAgent {
               sender_id: m.envelope.sender_id,
               text: turnText,
               ts: m.receivedAt,
-              authorization: turnAuthorization,
+              // Owner grants plan 4 Task 16 (M-6): under a manifest a call-start greeting entry carries no grants and no
+              // memory_write, on every branch (skip, held, heldAfterAck spreads held). Unpinned agents unchanged (G-4).
+              authorization: fastGreeting && this.toolGrantManifest !== null ? greetingAuthorization(turnAuthorization) : turnAuthorization,
               memory,
               // A relay-attributed turn is the SPEAKER's message to the runtime:
               // name it after them and never flag it as agent-authored.
@@ -39811,7 +41589,7 @@ var BridgeAgent = class _BridgeAgent {
                 open2.ids.push(m.messageId);
                 open2.parts.push(turnText);
                 const staging = (async () => {
-                  const ok = await this.stageHeldRuntimeMessage(runtimeEntry(false, await runtimeMemory));
+                  const ok = await this.stageHeldRuntimeMessage(runtimeEntry(false, await runtimeMemory), { absorbed: true });
                   if (!ok) {
                     const i = open2.ids.indexOf(m.messageId);
                     if (i > 0) {
@@ -39950,11 +41728,11 @@ var BridgeAgent = class _BridgeAgent {
                   void work.finally(() => this.unifiedWork.delete(work));
                 }
               }
-            } else if (this.recallProviderOn()) {
+            } else if (this.recallProviderOn() && ownerVerdict.kind !== "failed") {
               const recallTap = this.captureRecallTap(m.messageId, m.channelId);
               this.spawnRecallTap({ message: runtimeEntry(false, { recent: [], facts: [] }), captured: recallTap });
             }
-            void recordInboundMemory(
+            if (ownerVerdict.kind !== "failed") void recordInboundMemory(
               this.memory,
               m.channelId,
               m.envelope.sender_id,
@@ -39977,6 +41755,7 @@ var BridgeAgent = class _BridgeAgent {
       } catch {
       }
     }
+    this.ownerReplayPending.clear();
     this.latency.record("recv.cycle", performance.now() - cycleStart);
     if (this.buffer.length) {
       for (const l of this.listeners) l();
@@ -40015,7 +41794,46 @@ var BridgeAgent = class _BridgeAgent {
     return () => this.listeners.delete(listener);
   }
   /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
+  /** Review H-1: every buffer exit narrows manifest grants again to the state at delivery. */
   takeBuffered(channelId) {
+    return this.takeBufferedRaw(channelId).map((m) => this.delivering(m));
+  }
+  takeDeliverable(busyChannels) {
+    return this.takeDeliverableRaw(busyChannels).map((m) => this.delivering(m));
+  }
+  /** Every buffer exit: re-narrow manifest grants (review H-1), then note the frame's attribution class (review H-3). */
+  delivering(m) {
+    const out = this.renarrowManifestGrants(m);
+    this.noteDeliveredFrame(out);
+    return out;
+  }
+  /**
+   * Review H-1 (kill switches reach staged and restored turns): a grant marked source "manifest" survives delivery
+   * only while its audience's manifest switch is on, the binding is bound at the applied counter, and the current
+   * manifest still signs the tool. Otherwise it becomes the fallback: kept unmarked if it is a constant of the
+   * audience that is still signed, else dropped. Only narrows; an unchanged message is returned by reference.
+   */
+  renarrowManifestGrants(m) {
+    const a = m.authorization;
+    if (!a || !a.tool_grants.some((g) => g.mode === "read" && g.source === "manifest")) return m;
+    const audience = a.audience === "owner_dm" || a.audience === "team_room" ? a.audience : null;
+    const manifest = this.cfg.ownerGrantPin?.pin ? this.toolGrantManifest : null;
+    const b = this.manifestBinding;
+    const bound = b !== null && b.state === "bound" && b.counter === this.toolGrantCounter;
+    const switchOn = audience === "owner_dm" ? this.ownerDmManifestGrants : audience === "team_room" ? this.roomManifestGrants : false;
+    const signedNow = new Set(audience && manifest ? manifest.grants[audience] ?? [] : []);
+    const constants4 = new Set(audience === "owner_dm" ? OWNER_DM_DEFAULT_READ_GRANTS.map((g) => g.tool) : audience === "team_room" ? ROOM_DEFAULT_READ_GRANTS.map((g) => g.tool) : []);
+    let changed = false;
+    const out = a.tool_grants.flatMap((g) => {
+      if (!(g.mode === "read" && g.source === "manifest")) return [g];
+      if (switchOn && bound && signedNow.has(g.tool)) return [g];
+      changed = true;
+      return constants4.has(g.tool) && signedNow.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+    });
+    if (!changed) return m;
+    return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(out) }) };
+  }
+  takeBufferedRaw(channelId) {
     if (channelId === void 0 && this.pausedChannels.size === 0 && this.supersededChannels.size === 0) {
       return this.buffer.splice(0);
     }
@@ -40038,7 +41856,7 @@ var BridgeAgent = class _BridgeAgent {
    * working on — which it used to refuse with a "busy" reply and ack — and a
    * backlog replays one message per channel at a time after a restart.
    */
-  takeDeliverable(busyChannels) {
+  takeDeliverableRaw(busyChannels) {
     const picked = /* @__PURE__ */ new Set();
     const out = [];
     const keep = [];
@@ -40198,6 +42016,107 @@ var BridgeAgent = class _BridgeAgent {
     }
     this.noticeDeadLetter(message.channel_id);
   }
+  /** Spec §7.5: the room is capped today: cap 0, reached (by the runtime or the backstop), or at the cap. Fails closed. */
+  roomSearchCapped(channelId) {
+    if (this.roomSearchDailyCap === 0 || this.agentRoomSearchDailyCap === 0) return true;
+    try {
+      const day = utcDayOf(Date.now());
+      const st = this.store.roomSearchCapState(channelId, day);
+      if (this.store.roomSearchCapState(AGENT_TOTAL_KEY, day).grantedTurns >= this.agentRoomSearchDailyCap) return true;
+      return st.reachedBy !== null || st.grantedTurns >= this.roomSearchDailyCap;
+    } catch {
+      return true;
+    }
+  }
+  /** Spec §7.5 (T-14c, M-4): the runtime reports an executed-call cap for a room. Never throws. */
+  noteRoomCapReached(channelId) {
+    if (typeof channelId !== "string" || this.closingDown) return;
+    if (this.roomSearchDailyCap === 0) return;
+    if (this.freshMeta(channelId)?.is_dm !== false || this.channelRoster.get(channelId)?.crossOrg !== false) return;
+    const day = utcDayOf(Date.now());
+    try {
+      if (this.store.markRoomSearchCapReached(channelId, day, "runtime")) this.logRoomCap(day, channelId, "runtime");
+      if (this.store.roomSearchCapState(channelId, day).noticePosted) return;
+    } catch (e) {
+      writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("store_failed", ["store_failed"]) }, e);
+      return;
+    }
+    this.noticeRoomSearchCap(channelId, day);
+  }
+  /** K-14, once per room per UTC day; the flag is persisted only after the send resolves. Called only from noteRoomCapReached. */
+  noticeRoomSearchCap(channelId, day) {
+    const key = `${day}
+${channelId}`;
+    if (this.roomCapNoticePending.has(key)) return;
+    this.roomCapNoticePending.add(key);
+    let pending;
+    try {
+      pending = this.send(channelId, ROOM_SEARCH_CAP_NOTICE, void 0, { agentTurn: false });
+    } catch (e) {
+      pending = Promise.reject(e);
+    }
+    void pending.then(
+      () => {
+        try {
+          this.store.markRoomSearchCapNoticePosted(channelId, day);
+        } catch (e) {
+          writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("store_failed", ["store_failed"]) }, e);
+        }
+        writeServiceLog2("info", "authz.room_cap", { state: ServiceLogEnum.of("notice_sent", ["notice_sent"]) });
+      },
+      (e) => writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("notice_failed", ["notice_failed"]) }, e)
+    ).finally(() => this.roomCapNoticePending.delete(key));
+  }
+  logRoomCap(day, channelId, by) {
+    const key = `${day}
+${channelId}`;
+    if (this.roomCapLogged.has(key)) return;
+    if (this.roomCapLogged.size > 5e3) this.roomCapLogged.clear();
+    this.roomCapLogged.add(key);
+    writeServiceLog2("info", "authz.room_cap", {
+      state: ServiceLogEnum.of("reached", ["reached"]),
+      by: ServiceLogEnum.of(by, ["runtime", "bridge", "operator"])
+    });
+  }
+  /**
+   * Spec §7.5 (T-14b, audit r1 H-3): the silent bridge backstop. Counts a team_room turn that actually goes out
+   * to the runtime with web_search, once per message id (callers run it after their runtimePendingIds early
+   * return). Past the cap, and on a store failure (fail closed), the entry loses web_search. Never posts K-14.
+   */
+  applyRoomSearchBackstop(entry) {
+    const a = entry.authorization;
+    if (!a || a.audience !== "team_room" || !a.tool_grants.some((g) => g.tool === "web_search")) return entry;
+    const day = utcDayOf(Date.now());
+    if (this.roomSearchDailyCap === 0) {
+      this.logRoomCap(day, entry.channel_id, "operator");
+      return this.withoutWebSearch(entry);
+    }
+    if (this.agentRoomSearchDailyCap === 0) {
+      this.logRoomCap(day, AGENT_TOTAL_KEY, "operator");
+      return this.withoutWebSearch(entry);
+    }
+    try {
+      const n = this.store.countRoomSearchGrant(entry.channel_id, day);
+      if (n === this.roomSearchDailyCap && this.store.markRoomSearchCapReached(entry.channel_id, day, "bridge")) {
+        this.logRoomCap(day, entry.channel_id, "bridge");
+      }
+      if (n > this.roomSearchDailyCap) return this.withoutWebSearch(entry);
+      const total = this.store.countRoomSearchGrant(AGENT_TOTAL_KEY, day);
+      if (total === this.agentRoomSearchDailyCap) this.logRoomCap(day, AGENT_TOTAL_KEY, "bridge");
+      if (total > this.agentRoomSearchDailyCap) return this.withoutWebSearch(entry);
+      return entry;
+    } catch (e) {
+      writeServiceLog2("warn", "authz.room_cap", { state: ServiceLogEnum.of("count_failed", ["count_failed"]) }, e);
+      return this.withoutWebSearch(entry);
+    }
+  }
+  withoutWebSearch(entry) {
+    const a = entry.authorization;
+    return {
+      ...entry,
+      authorization: Object.freeze({ ...a, tool_grants: Object.freeze(a.tool_grants.filter((g) => g.tool !== "web_search")) })
+    };
+  }
   noticeDeadLetter(channelId) {
     if (this.closingDown) return;
     const now = Date.now();
@@ -40419,13 +42338,18 @@ var BridgeAgent = class _BridgeAgent {
       modeEpoch: this.store.recallState().modeEpoch
     };
     let persisted = { stamp, recallPurgeEpoch: recall.purgeEpoch, recallModeEpoch: recall.modeEpoch };
-    await this.store.stageRuntimeInbox(message.message_id, this.stagedPayload(message, stamp, recall), message.ts, (prior, next) => {
-      const a = splitIngestStamp(prior);
-      const b = splitIngestStamp(next);
-      if (a === null || b === null || a.message !== b.message) return false;
-      persisted = a.marks;
-      return true;
-    });
+    const replay = this.ownerReplayPending.get(message.message_id);
+    try {
+      await this.store.stageRuntimeInbox(message.message_id, this.stagedPayload(message, stamp, recall), message.ts, (prior, next) => {
+        const a = splitIngestStamp(prior);
+        const b = splitIngestStamp(next);
+        if (a === null || b === null || a.message !== b.message) return false;
+        persisted = a.marks;
+        return true;
+      }, replay ? { ...replay, processedAt: Date.now() } : void 0);
+    } finally {
+      this.ownerReplayPending.delete(message.message_id);
+    }
     this.applyStagedMarks(message.message_id, persisted);
   }
   /** In-memory mirror of the persisted marks (staging and restore). */
@@ -40445,6 +42369,9 @@ var BridgeAgent = class _BridgeAgent {
       const message = rest;
       this.applyStagedMarks(message.message_id, marks);
       this.runtimePendingIds.add(message.message_id);
+      if (this.cfg.ownerGrantPin?.pin && this.isOwnerVerifyFailed(message.message_id)) {
+        this.ownerVerifyFailedIds.set(message.message_id, message.channel_id);
+      }
       if (this.unifiedOn) this.deferredUnifiedIds.add(message.message_id);
       else this.deferredRecallIds.add(message.message_id);
       if (row.deliveryAttempts > 0) {
@@ -40461,12 +42388,13 @@ var BridgeAgent = class _BridgeAgent {
    * Returning false is backpressure: the caller leaves the backend row unacked
    * so it remains the durable queue rather than shedding accepted work.
    */
-  async stageRuntimeMessage(message) {
-    if (this.runtimePendingIds.has(message.message_id)) return true;
+  async stageRuntimeMessage(staging, opts = {}) {
+    if (this.runtimePendingIds.has(staging.message_id)) return true;
     if (this.runtimePendingIds.size >= this.maxBuffer) {
       writeServiceLog2("warn", "runtime_inbox.full");
       return false;
     }
+    const message = opts.absorbed ? staging : this.applyRoomSearchBackstop(staging);
     try {
       await this.stageSealed(message);
       this.runtimePendingIds.add(message.message_id);
@@ -40572,6 +42500,37 @@ var BridgeAgent = class _BridgeAgent {
   perToolConsumerAttached() {
     return this.perToolConsumer !== null;
   }
+  /**
+   * Owner grants (spec §7.9, plan 4 Task 5): the attached per-tool runtime socket whose hello
+   * declared manifest_grants_v1, or null. A manifest grant is issued only while one is attached
+   * (Task 13); every other socket receives manifest grants narrowed to the constants.
+   * Newest wins, like perToolConsumer.
+   */
+  manifestConsumer = null;
+  /** OQ-5: the latest hello's class; "missing" until any hello. Reported in tool_grant_status (Task 15). */
+  lastConsumerCapability = "missing";
+  noteManifestConsumer(token) {
+    this.manifestConsumer = token;
+  }
+  clearManifestConsumer(token) {
+    if (this.manifestConsumer === token) this.manifestConsumer = null;
+  }
+  manifestConsumerAttached() {
+    return this.manifestConsumer !== null;
+  }
+  noteConsumerCapability(state) {
+    this.lastConsumerCapability = state;
+    if (state !== "ok") {
+      writeServiceLog2("info", "authz.capability", { state: ServiceLogEnum.of(state, ["missing", "harness_consumer"]) });
+    }
+  }
+  /**
+   * Harness re-rule (2026-10-12, audit r2 H-3): true exactly when this agent has a pin loaded and a good
+   * manifest. A harness consumer then receives [] in every audience (consumer-grants.ts withHarnessGrants).
+   */
+  harnessGrantsWithheld() {
+    return this.cfg.ownerGrantPin?.pin != null && this.toolGrantManifest !== null;
+  }
   health() {
     let joined = 0;
     for (const s of this.joinState.values()) if (s === "JOINED") joined++;
@@ -40706,7 +42665,42 @@ var BridgeAgent = class _BridgeAgent {
       build: BRIDGE_VERSION
     };
   }
-  async close() {
+  /** C9: `session_superseded` once a 4409 said another copy took this
+   *  agent's session (the gated fetch already refuses every request). The
+   *  local HTTP routes read it: every route but `/healthz` answers 503. */
+  get sessionState() {
+    return this.sessionSuperseded ? "session_superseded" : "live";
+  }
+  /** C9: subscribe to `session_superseded`. runMode subscribes right after
+   *  construction, before start(), so a 4409 during start() is heard too. */
+  on(event, listener) {
+    this.sessionSupersededListeners.add(listener);
+    return () => this.sessionSupersededListeners.delete(listener);
+  }
+  /** P-1 step 0, then the event (spec §4.1.6): another copy of this agent took
+   *  the session (4409). The gated-fetch switch is set FIRST, so no HTTP
+   *  request leaves the process after this, whatever a listener does. */
+  onSessionSuperseded() {
+    this.sessionSuperseded = true;
+    for (const listener of [...this.sessionSupersededListeners]) {
+      try {
+        listener();
+      } catch (e) {
+        writeServiceLog2("error", "transport.session_superseded_listener_failed", {}, e);
+      }
+    }
+  }
+  /**
+   * Idempotent (C9, spec §4.1.6 low 3): every call returns the FIRST call's
+   * promise, so a SIGTERM during or after the supersede quiesce never runs
+   * store.close() twice. A rejected close stays rejected: a retry would close
+   * the store a second time.
+   */
+  close() {
+    this.closing ??= this.closeOnce();
+    return this.closing;
+  }
+  async closeOnce() {
     this.closingDown = true;
     this.statusGate.close();
     for (const t of this.pauseRecheckTimers.values()) clearTimeout(t);
@@ -40719,6 +42713,28 @@ var BridgeAgent = class _BridgeAgent {
     if (this.safetyTimer) clearInterval(this.safetyTimer);
     if (this.runtimeConfigTimer) clearInterval(this.runtimeConfigTimer);
     if (this.membershipSweepTimer) clearInterval(this.membershipSweepTimer);
+    const ingest = this.ingestInFlight;
+    if (ingest) {
+      let timer;
+      await Promise.race([
+        ingest.released,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        })
+      ]);
+      if (timer) clearTimeout(timer);
+    }
+    const starting = this.startInFlight;
+    if (starting) {
+      let timer;
+      await Promise.race([
+        starting,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, _BridgeAgent.GRACEFUL_DRAIN_MS);
+        })
+      ]);
+      if (timer) clearTimeout(timer);
+    }
     if (this.membershipSweepWork) {
       let timer;
       await Promise.race([
@@ -40802,11 +42818,11 @@ var BridgeAgent = class _BridgeAgent {
 };
 
 // src/config.ts
-import { readFileSync as readFileSync9, statSync as statSync5 } from "node:fs";
-import { dirname as dirname5, join as join17 } from "node:path";
+import { readFileSync as readFileSync10, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, join as join18 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 function loadConfig(opts) {
-  const raw = readFileSync9(opts.credentialPath, "utf8");
+  const raw = readFileSync10(opts.credentialPath, "utf8");
   try {
     const mode = statSync5(opts.credentialPath).mode & 511;
     if (mode & 63) writeServiceLog2("warn", "config.credential_permissions_unsafe");
@@ -40819,7 +42835,11 @@ function loadConfig(opts) {
     throw new Error("credential file is not valid JSON");
   }
   for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
-  const storePath = opts.storePath ?? join17(dirname5(opts.credentialPath), "bridge-state.db");
+  const storePath = opts.storePath ?? join18(dirname6(opts.credentialPath), "bridge-state.db");
+  const ownerGrantPin = loadOwnerGrantPin({ credentialPath: opts.credentialPath, credentialJson: json2 });
+  writeServiceLog2(ownerGrantPin.state === "ok" || ownerGrantPin.state === "no_pin" ? "info" : "warn", "authz.pin", {
+    state: ServiceLogEnum.of(ownerGrantPin.state, ["ok", "no_pin", "pin_conflict", "malformed", "unsupported_algo", "symlink_refused", "unreadable"])
+  });
   const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
   const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
   const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
@@ -40877,7 +42897,8 @@ function loadConfig(opts) {
     voice,
     voiceFastPathMode: parseFastPathMode(json2.voice_fast_path_mode),
     modelSource,
-    memoryEnabled
+    memoryEnabled,
+    ownerGrantPin
   };
 }
 function arg(argv, flag) {
@@ -40921,11 +42942,11 @@ import { z as z3 } from "zod";
 
 // src/auth.ts
 import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync2 } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync5(f)) return readFileSync10(f, "utf8").trim();
+  if (f && existsSync6(f)) return readFileSync11(f, "utf8").trim();
   const tok = randomBytes11(32).toString("base64url");
   if (f) writeFileSync2(f, tok, { mode: 384 });
   return tok;
@@ -40990,6 +43011,9 @@ var BRIDGE_ERRORS = {
   // longer holds the shared bytes or key. Terminal for that link: never fall
   // back to the current version. `detail.pin` names the refused pin.
   vault_ref_changed: { http: 422, message: "this file changed in Files after it was shared; not opened" },
+  // C9 (spec §4.1.6 step 1): another copy of this agent took its SecureComs
+  // session (WS 4409), so this copy stopped. Every local route but /healthz.
+  session_superseded: { http: 503, message: "another copy of this agent took its session; this copy stopped" },
   internal: { http: 500, message: "internal error" }
 };
 function errorBody(code, detail) {
@@ -41017,6 +43041,29 @@ function withConsumerGrants(m, perToolConsumer) {
   const { memory_write: _dropped, ...rest } = a;
   return { ...m, authorization: Object.freeze({ ...rest, ...stripGrants ? { tool_grants: NO_GRANTS } : {} }) };
 }
+var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+var CONSTANT_TOOL_NAMES = Object.freeze({
+  owner_dm: Object.freeze(["current_time", "web_search"]),
+  team_room: Object.freeze(["current_time"])
+});
+var isManifestGrant = (g) => g.mode === "read" && g.source === "manifest";
+function withManifestCapability(m, manifestConsumer) {
+  if (manifestConsumer) return m;
+  const a = m.authorization;
+  if (!a || !a.tool_grants.some(isManifestGrant)) return m;
+  const constants4 = new Set(a.audience === "owner_dm" || a.audience === "team_room" ? CONSTANT_TOOL_NAMES[a.audience] : []);
+  const narrowed = a.tool_grants.flatMap((g) => {
+    if (!isManifestGrant(g)) return [g];
+    return constants4.has(g.tool) ? [Object.freeze({ tool: g.tool, mode: "read" })] : [];
+  });
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: Object.freeze(narrowed) }) };
+}
+function withHarnessGrants(m, withheld) {
+  if (!withheld) return m;
+  const a = m.authorization;
+  if (!a || a.tool_grants.length === 0) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: NO_GRANTS }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -41038,7 +43085,8 @@ data: ${JSON.stringify(msgs[i])}
   return [];
 }
 function deliverSseBatch(res, batch, agent, onWriteError) {
-  const left3 = writeSse(res, batch.map((m) => withConsumerGrants(m, false)), onWriteError);
+  const withheld = agent.harnessGrantsWithheld();
+  const left3 = writeSse(res, batch.map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -41196,6 +43244,10 @@ function createHttpServer(agent, opts) {
       const url = new URL(req.url ?? "/", "http://localhost");
       const path = url.pathname;
       const method = req.method ?? "GET";
+      if (agent.sessionState === "session_superseded") {
+        if (method === "GET" && path === "/healthz") return json(res, 200, { state: "session_superseded" });
+        return jsonError(res, "session_superseded");
+      }
       if (method === "GET" && path === "/healthz") {
         return json(res, 200, { ...agent.health(), capabilities: capabilities(opts) });
       }
@@ -41305,7 +43357,7 @@ function createHttpServer(agent, opts) {
       if (method === "GET" && path === "/v1/messages") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
         const wait = Math.max(0, Math.min(50, Number(url.searchParams.get("wait") ?? 0)));
-        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withConsumerGrants(m, false)));
+        return json(res, 200, (await agent.drain(channel, wait)).map((m) => withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), agent.harnessGrantsWithheld()), false)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -41407,6 +43459,7 @@ var PING_INTERVAL_MS = 3e4;
 var INFLIGHT_STALE_SWEEP_MS = 6e4;
 var INFLIGHT_STALE_AFTER_MS = 15 * 6e4;
 var HELLO_WAIT_MS = 2e3;
+var WS_CLOSE_SESSION_SUPERSEDED3 = 4409;
 var MEMORY_NOTES_FEATURE = "memory_notes";
 var MEMORY_RECALL_FEATURE = "memory_recall";
 var MEMORY_UNIFIED_FEATURE = "memory_unified";
@@ -41427,7 +43480,12 @@ function authedUpgrade(req, opts) {
   return true;
 }
 function attachAgentWebSocket(server, agent, opts) {
-  const wss = new WebSocketServer({ server, path: "/v1/ws" });
+  let sessionSuperseded = false;
+  const wss = new WebSocketServer({
+    server,
+    path: "/v1/ws",
+    verifyClient: (_info, done) => sessionSuperseded ? done(false, 503, "session_superseded") : done(true)
+  });
   const keepalive = setInterval(() => {
     for (const client of wss.clients) {
       const sock = client;
@@ -41472,6 +43530,7 @@ function attachAgentWebSocket(server, agent, opts) {
     const session = {
       consumer: "unknown",
       perToolGrants: false,
+      manifestGrants: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -41524,7 +43583,15 @@ function attachAgentWebSocket(server, agent, opts) {
             retired = true;
             continue;
           }
-          const out = withConsumerNotes(withConsumerGrants(batch[i], session.perToolGrants), batch[i], session, agent);
+          const out = withConsumerNotes(
+            withManifestCapability(
+              withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
+              session.manifestGrants
+            ),
+            batch[i],
+            session,
+            agent
+          );
           const recallOut = withConsumerRecall(out.message, batch[i], session, agent);
           const unifiedOut = withConsumerUnified(recallOut.message, batch[i], session, agent);
           const frame = { type: "message", ...unifiedOut.message };
@@ -41558,6 +43625,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (helloTimer) clearTimeout(helloTimer);
       agent.noteSessionClose();
       unsubscribe();
+      if (sessionSuperseded) inflight.clear();
       if (inflight.size) {
         agent.requeueFailedRuntimeDeliveries(
           [...inflight.values()].filter((m) => !agent.isRuntimeMessageRetired(m.message_id))
@@ -41573,12 +43641,16 @@ function attachAgentWebSocket(server, agent, opts) {
       if (current?.sock === sock) current = null;
       if (session.harness) agent.clearHarnessReport(session.harness);
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
+      if (session.manifestGrants) agent.clearManifestConsumer(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
     sock.on("error", cleanup);
     sock.on("message", (data) => {
-      void handleInbound(sock, agent, data, inflight, flush, session);
+      if (sessionSuperseded) return;
+      handleInbound(sock, agent, data, inflight, flush, session).catch((e) => {
+        writeServiceLog2("error", "ws.inbound_failed", {}, e);
+      });
     });
     flush();
   });
@@ -41593,6 +43665,13 @@ function attachAgentWebSocket(server, agent, opts) {
         }
       }
       wss.close();
+    },
+    /** C9 (spec §4.1.6 step 1, OQ-9): close every open socket with 4409 /
+     *  `session_superseded`, and answer every later upgrade with 503. The
+     *  runtime's reconnect backoff does the rest; idempotent. */
+    enterSessionSuperseded() {
+      sessionSuperseded = true;
+      for (const client of wss.clients) client.close(WS_CLOSE_SESSION_SUPERSEDED3, "session_superseded");
     }
   };
 }
@@ -41652,6 +43731,15 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       session.perToolGrants = false;
       agent.clearPerToolConsumer(session);
     }
+    const manifest = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(MANIFEST_GRANTS_FEATURE);
+    if (manifest && !session.manifestGrants) {
+      session.manifestGrants = true;
+      agent.noteManifestConsumer(session);
+    } else if (!manifest && session.manifestGrants) {
+      session.manifestGrants = false;
+      agent.clearManifestConsumer(session);
+    }
+    agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -41659,7 +43747,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : []] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -41872,8 +43960,17 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     return;
   }
+  if (m.type === "room_cap_reached") {
+    if (!session.manifestGrants || typeof m.channel_id !== "string" || !LOWER_UUID.test(m.channel_id)) {
+      sendJson(sock, wsErrorFrame("invalid_request"));
+      return;
+    }
+    agent.noteRoomCapReached(m.channel_id);
+    return;
+  }
   sendJson(sock, wsErrorFrame("invalid_request"));
 }
+var LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 export {
   BRIDGE_ERRORS,
   BRIDGE_VERSION,