@securecoms/agent-runtime 0.6.0 → 0.9.0

package/dist/bin.js

@@ -3,15 +3,373 @@
 // src/index.ts
 import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { dirname as dirname6, join as join8 } from "node:path";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync7, mkdirSync as mkdirSync3, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6, mkdirSync as mkdirSync3, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir4, userInfo } from "node:os";
 
 // src/config.ts
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname as dirname2, join } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/service-log.ts
+var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+function errorClass(error) {
+  if (error === null) return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog(level, event, fields = {}, error) {
+  const safeEvent = TOKEN.test(event) ? event : "invalid_event";
+  const parts = [`[runtime] ${level} ${safeEvent}`];
+  for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN.test(key)) continue;
+    if (typeof value === "boolean") parts.push(`${key}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+  }
+  if (error !== void 0) parts.push(`error_class=${errorClass(error)}`);
+  return parts.join(" ");
+}
+function failureEpisodeReporter(warn) {
+  let lastClass = null;
+  return {
+    failed(error) {
+      const cls = errorClass(error);
+      if (cls === lastClass) return;
+      lastClass = cls;
+      try {
+        warn(error);
+      } catch {
+      }
+    },
+    succeeded() {
+      lastClass = null;
+    }
+  };
+}
+function writeServiceLog(level, event, fields, error) {
+  const line = formatServiceLog(level, event, fields, error);
+  if (level === "error") console.error(line);
+  else if (level === "warn") console.warn(line);
+  else console.log(line);
+}
+
+// src/llm-dispatch.ts
+var LLM_REQUEST_MAX_BYTES = 128 * 1024;
+var LLM_RESPONSE_MAX_BYTES = 128 * 1024;
+var LLM_REQUEST_TIMEOUT_MS = 18e4;
+var DEFAULT_MAX_OUTPUT_TOKENS = 8192;
+var CAP_REJECTED_MAX = 256;
+var capRejectedModels = /* @__PURE__ */ new Set();
+var CAP_ERROR_SCAN_BYTES = 16 * 1024;
+var CAP_FIELD_NAMED = /max_(?:completion_|output_)?tokens/i;
+var CONTEXT_OVERFLOW_NAMED = /prompt|context|input[\s_-]*(?:length|tokens)/i;
+async function errorNamesOutputCap(resp) {
+  const reader = resp.body?.getReader();
+  if (!reader) return false;
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < CAP_ERROR_SCAN_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } catch {
+    return false;
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+  const text = new TextDecoder().decode(Buffer.concat(chunks).subarray(0, CAP_ERROR_SCAN_BYTES));
+  return CAP_FIELD_NAMED.test(text) && !CONTEXT_OVERFLOW_NAMED.test(text);
+}
+function outputCapField(endpoint) {
+  try {
+    return new URL(endpoint).hostname === "api.openai.com" ? "max_completion_tokens" : "max_tokens";
+  } catch {
+    return "max_tokens";
+  }
+}
+function normalizeEndpoint(endpoint) {
+  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+var LLMDispatcher = class {
+  endpoint;
+  model;
+  apiKey;
+  chatPath;
+  chatAuth;
+  authHeaderName;
+  fetch;
+  timeoutMs;
+  requestMaxBytes;
+  responseMaxBytes;
+  maxOutputTokens;
+  log;
+  constructor(endpoint, model, opts = {}) {
+    this.endpoint = normalizeEndpoint(endpoint);
+    this.model = model;
+    this.apiKey = opts.apiKey;
+    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
+    this.chatAuth = opts.chatAuth ?? "bearer";
+    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
+    this.fetch = opts.fetch ?? fetch;
+    this.timeoutMs = opts.timeoutMs ?? LLM_REQUEST_TIMEOUT_MS;
+    this.requestMaxBytes = opts.requestMaxBytes ?? LLM_REQUEST_MAX_BYTES;
+    this.responseMaxBytes = opts.responseMaxBytes ?? LLM_RESPONSE_MAX_BYTES;
+    this.maxOutputTokens = opts.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
+    this.log = opts.log ?? writeServiceLog;
+  }
+  async complete(messages, tools, options = {}) {
+    const body = {
+      model: this.model,
+      messages,
+      stream: false
+    };
+    const capKey = `${this.endpoint}\0${this.model}`;
+    const capField = outputCapField(this.endpoint);
+    if (tools && tools.length > 0) {
+      body.tools = tools;
+    }
+    const url = `${this.endpoint}${this.chatPath}`;
+    const headers = { "Content-Type": "application/json" };
+    if (this.apiKey && this.chatAuth === "bearer") {
+      headers.Authorization = `Bearer ${this.apiKey}`;
+    } else if (this.apiKey && this.chatAuth === "x-api-key") {
+      headers[this.authHeaderName] = this.apiKey;
+    }
+    const encode = (withCap2) => {
+      const encoded = JSON.stringify(withCap2 ? { ...body, [capField]: this.maxOutputTokens } : body);
+      if (Buffer.byteLength(encoded, "utf8") > this.requestMaxBytes) {
+        throw new Error("LLM request exceeded the size limit");
+      }
+      return encoded;
+    };
+    let withCap = !capRejectedModels.has(capKey);
+    let encodedBody = encode(withCap);
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(options.signal?.reason);
+    if (options.signal?.aborted) cancel();
+    else options.signal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("LLM request deadline exceeded"));
+    }, this.timeoutMs);
+    try {
+      const post = () => this.fetch(url, {
+        method: "POST",
+        headers,
+        body: encodedBody,
+        signal: controller.signal,
+        redirect: "error"
+      });
+      let resp = await post();
+      if (resp.status === 400 && withCap && await errorNamesOutputCap(resp)) {
+        if (capRejectedModels.size >= CAP_REJECTED_MAX) {
+          const oldest = capRejectedModels.values().next();
+          if (!oldest.done) capRejectedModels.delete(oldest.value);
+        }
+        capRejectedModels.add(capKey);
+        this.log("warn", "llm.output_cap_rejected", {});
+        withCap = false;
+        encodedBody = encode(false);
+        resp = await post();
+      }
+      if (!resp.ok) {
+        await resp.body?.cancel();
+        throw new Error(`LLM request failed (${resp.status})`);
+      }
+      const data = await readJsonCapped(resp, this.responseMaxBytes);
+      const choice = data.choices?.[0];
+      if (!choice) throw new Error("LLM returned no choices");
+      const totalTokens = data.usage?.total_tokens;
+      return {
+        content: choice.message.content,
+        toolCalls: choice.message.tool_calls || [],
+        finishReason: choice.finish_reason,
+        ...typeof totalTokens === "number" && Number.isFinite(totalTokens) && totalTokens >= 0 ? { usage: { totalTokens } } : {}
+      };
+    } catch (error) {
+      if (timedOut) throw new Error(`LLM request timed out after ${this.timeoutMs}ms`);
+      if (options.signal?.aborted) throw new Error("LLM request cancelled");
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", cancel);
+    }
+  }
+};
+async function readJsonCapped(resp, maxBytes) {
+  const reader = resp.body?.getReader();
+  if (!reader) throw new Error("LLM returned an empty response");
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => {
+        });
+        throw new Error("LLM response exceeded the size limit");
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {
+    });
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const joined = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    joined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(joined));
+}
+
+// src/llm-budget.ts
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+var DEFAULT_DAILY_CALL_LIMIT = 2e3;
+var DEFAULT_DAILY_TOKEN_LIMIT = 5e6;
+var DailyLimitReachedError = class extends Error {
+  constructor(day) {
+    super("daily LLM budget reached");
+    this.day = day;
+    this.name = "DailyLimitReachedError";
+  }
+};
+function utcDay(d) {
+  return d.toISOString().slice(0, 10);
+}
+var DailyLlmBudget = class {
+  callLimit;
+  tokenLimit;
+  statePath;
+  now;
+  log;
+  state;
+  exhaustionLoggedFor = null;
+  constructor(opts) {
+    this.callLimit = opts.callLimit;
+    this.tokenLimit = opts.tokenLimit;
+    this.statePath = opts.statePath;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+    this.log = opts.log ?? (() => {
+    });
+    this.state = this.load();
+  }
+  /**
+   * Reserve one provider call against today's budget, or throw
+   * {@link DailyLimitReachedError} without reserving anything.
+   */
+  beginCall() {
+    this.roll();
+    const { calls, tokens, day } = this.state;
+    const callsSpent = this.callLimit > 0 && calls >= this.callLimit;
+    const tokensSpent = this.tokenLimit > 0 && tokens >= this.tokenLimit;
+    if (callsSpent || tokensSpent) {
+      if (this.exhaustionLoggedFor !== day) {
+        this.exhaustionLoggedFor = day;
+        this.log("warn", "llm.daily_budget_exhausted", {
+          calls,
+          tokens,
+          call_limit: this.callLimit,
+          token_limit: this.tokenLimit
+        });
+      }
+      throw new DailyLimitReachedError(day);
+    }
+    this.state.calls++;
+    this.save();
+  }
+  /** Add provider-reported tokens to today's total. */
+  recordTokens(totalTokens) {
+    if (!Number.isFinite(totalTokens) || totalTokens <= 0) return;
+    this.roll();
+    this.state.tokens += Math.floor(totalTokens);
+    this.save();
+  }
+  snapshot() {
+    this.roll();
+    return { ...this.state };
+  }
+  roll() {
+    const today = utcDay(this.now());
+    if (this.state.day !== today) this.state = { day: today, calls: 0, tokens: 0 };
+  }
+  load() {
+    const fresh = { day: utcDay(this.now()), calls: 0, tokens: 0 };
+    if (!this.statePath) return fresh;
+    let raw;
+    try {
+      raw = readFileSync(this.statePath, "utf8");
+    } catch {
+      return fresh;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.day === fresh.day && Number.isInteger(parsed.calls) && parsed.calls >= 0 && Number.isInteger(parsed.tokens) && parsed.tokens >= 0) {
+        return { day: fresh.day, calls: parsed.calls, tokens: parsed.tokens };
+      }
+      return fresh;
+    } catch (error) {
+      this.log("warn", "llm.budget_state_unreadable", {}, error);
+      return fresh;
+    }
+  }
+  save() {
+    if (!this.statePath) return;
+    try {
+      mkdirSync(dirname(this.statePath), { recursive: true });
+      const tmp = `${this.statePath}.tmp`;
+      writeFileSync(tmp, JSON.stringify(this.state), { mode: 384 });
+      renameSync(tmp, this.statePath);
+    } catch (error) {
+      this.log("warn", "llm.budget_state_write_failed", {}, error);
+    }
+  }
+};
+function withDailyBudget(llm, budget) {
+  return {
+    async complete(messages, tools, options) {
+      budget.beginCall();
+      const result = await llm.complete(messages, tools, options);
+      if (result.usage) budget.recordTokens(result.usage.totalTokens);
+      return result;
+    }
+  };
+}
+
+// src/config.ts
 var MISSING_IDENTITY_MESSAGE = "Missing agent identity: pass --identity <id> or set SECURECOMS_IDENTITY";
 var LOG_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var TOOL_DEFAULTS = /* @__PURE__ */ new Set(["allow", "deny"]);
@@ -48,8 +406,16 @@ function parseList(value) {
   const items = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
   return items.length > 0 ? items : void 0;
 }
+function parseIntSetting(env, name, fallback, min) {
+  const raw = env[name]?.trim();
+  if (!raw) return fallback;
+  if (!/^\d+$/.test(raw) || Number(raw) < min || !Number.isSafeInteger(Number(raw))) {
+    throw new Error(`Invalid ${name} "${raw}": expected a whole number >= ${min}`);
+  }
+  return Number(raw);
+}
 function defaultSkillsDir() {
-  return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+  return join(dirname2(fileURLToPath(import.meta.url)), "..", "skills");
 }
 var DEFAULT_TOOL_ALLOW = [
   "echo",
@@ -57,8 +423,7 @@ var DEFAULT_TOOL_ALLOW = [
   "fetch_url",
   "http_request",
   "sql_query",
-  "current_time",
-  "remember"
+  "current_time"
 ];
 function loadConfig(argv, env) {
   const identityId = parseIdentity(argv, env);
@@ -100,7 +465,10 @@ function loadConfig(argv, env) {
     toolGateEnv: {
       ...parsedAllow !== void 0 ? { allow: parsedAllow } : {},
       ...deny !== void 0 ? { deny } : {}
-    }
+    },
+    llmMaxOutputTokens: parseIntSetting(env, "SECURECOMS_LLM_MAX_OUTPUT_TOKENS", DEFAULT_MAX_OUTPUT_TOKENS, 1),
+    llmDailyCallLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_CALL_LIMIT", DEFAULT_DAILY_CALL_LIMIT, 0),
+    llmDailyTokenLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_TOKEN_LIMIT", DEFAULT_DAILY_TOKEN_LIMIT, 0)
   };
 }
 
@@ -155,9 +523,23 @@ function parsePersonaVerb(argv) {
   const sub = argv[3];
   return sub === "init" || sub === "show" ? sub : null;
 }
+function parseSideEffectsVerb(argv) {
+  if (argv[2] !== "side-effects") return null;
+  const sub = argv[3];
+  return sub === "list" || sub === "resolve" ? sub : null;
+}
+function parseSideEffectResolveFlags(argv) {
+  const outcome = flagOrEnv(argv, "--outcome", {});
+  return {
+    idempotencyKey: flagOrEnv(argv, "--idempotency-key", {}),
+    operationSha256: flagOrEnv(argv, "--operation-sha256", {}),
+    confirmationId: flagOrEnv(argv, "--confirmation-id", {}),
+    outcome: outcome === "completed" || outcome === "not_applied" ? outcome : void 0
+  };
+}
 
 // src/service/install.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 
 // src/service/config.ts
 import { isAbsolute, resolve } from "node:path";
@@ -389,8 +771,8 @@ function installService(input, deps) {
   const plan = prepareInstall(input, deps.platform, deps);
   const keyFile = plan.keyFile;
   if (deps.platform === "darwin") {
-    deps.mkdirp(dirname2(cfg.plistPath));
-    deps.mkdirp(dirname2(cfg.logPath));
+    deps.mkdirp(dirname3(cfg.plistPath));
+    deps.mkdirp(dirname3(cfg.logPath));
     deps.writeFile(cfg.plistPath, plan.contents);
     deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
     requireOk(deps.run("launchctl", ["bootstrap", `gui/${cfg.uid}`, cfg.plistPath]), "launchctl bootstrap");
@@ -398,7 +780,7 @@ function installService(input, deps) {
     return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, ...keyFile ? { keyFile } : {} };
   }
   if (deps.platform === "linux") {
-    deps.mkdirp(dirname2(cfg.unitPath));
+    deps.mkdirp(dirname3(cfg.unitPath));
     deps.writeFile(cfg.unitPath, plan.contents);
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
@@ -432,63 +814,6 @@ function uninstallService(input, deps) {
   throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
 }
 
-// src/llm-dispatch.ts
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
-}
-var LLMDispatcher = class {
-  endpoint;
-  model;
-  apiKey;
-  chatPath;
-  chatAuth;
-  authHeaderName;
-  constructor(endpoint, model, opts = {}) {
-    this.endpoint = normalizeEndpoint(endpoint);
-    this.model = model;
-    this.apiKey = opts.apiKey;
-    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
-    this.chatAuth = opts.chatAuth ?? "bearer";
-    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
-  }
-  async complete(messages, tools) {
-    const body = {
-      model: this.model,
-      messages,
-      stream: false
-    };
-    if (tools && tools.length > 0) {
-      body.tools = tools;
-    }
-    const url = `${this.endpoint}${this.chatPath}`;
-    const headers = { "Content-Type": "application/json" };
-    if (this.apiKey && this.chatAuth === "bearer") {
-      headers.Authorization = `Bearer ${this.apiKey}`;
-    } else if (this.apiKey && this.chatAuth === "x-api-key") {
-      headers[this.authHeaderName] = this.apiKey;
-    }
-    const resp = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
-    });
-    if (!resp.ok) {
-      const text = await resp.text();
-      throw new Error(`LLM request failed (${resp.status}): ${text}`);
-    }
-    const data = await resp.json();
-    const choice = data.choices?.[0];
-    if (!choice) {
-      throw new Error("LLM returned no choices");
-    }
-    return {
-      content: choice.message.content,
-      toolCalls: choice.message.tool_calls || [],
-      finishReason: choice.finish_reason
-    };
-  }
-};
-
 // src/llm-source.ts
 import { join as join2 } from "node:path";
 
@@ -662,146 +987,75 @@ function resolveLlmSource(cfg, explicit, deps) {
 }
 
 // src/llm-shim.ts
-function endpointHost(endpoint) {
-  try {
-    return new URL(endpoint).host;
-  } catch {
-    return "(unparseable endpoint)";
-  }
-}
 function buildLlmShim(cfg, explicit, deps) {
   return {
-    async complete(messages, tools) {
+    async complete(messages, tools, options) {
       const src = resolveLlmSource(cfg, explicit, deps);
       const dispatcher = new LLMDispatcher(src.endpoint, src.model, {
         apiKey: src.apiKey,
         chatPath: src.chatPath,
-        chatAuth: src.chatAuth
+        chatAuth: src.chatAuth,
+        maxOutputTokens: cfg.llmMaxOutputTokens
       });
-      return dispatcher.complete(messages, tools);
+      return dispatcher.complete(messages, tools, options);
     }
   };
 }
-function bootLine(cfg, explicit, deps) {
-  try {
-    const src = resolveLlmSource(cfg, explicit, deps);
-    return `securecoms-agent ${cfg.identityId.slice(0, 8)} \u2192 llm source=${src.origin} ${endpointHost(src.endpoint)} (${src.model})`;
-  } catch (e) {
-    return `llm: source unavailable \u2014 ${e instanceof Error ? e.message : String(e)}`;
-  }
-}
 
 // src/memory.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { join as join3 } from "node:path";
 var MAX_HISTORY = 50;
+var MAX_FACTS = 200;
 var AgentMemory = class {
   history = [];
-  memories = [];
-  dataDir;
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    this.loadHistory();
-    this.loadMemories();
-  }
-  /** Add a message to conversation history. */
+  facts = [];
+  constructor(snapshot) {
+    if (snapshot) this.replace(snapshot);
+  }
+  /** Replace the working view at the start of every authenticated turn. */
+  replace(snapshot) {
+    this.history = snapshot.recent.slice(-MAX_HISTORY).map((turn) => ({
+      role: turn.role === "peer" ? "user" : "assistant",
+      content: turn.text
+    }));
+    this.facts = snapshot.facts.slice(-MAX_FACTS);
+  }
+  /** Add a message to this turn's in-process history only. */
   addMessage(msg) {
     this.history.push(msg);
     if (this.history.length > MAX_HISTORY * 2) {
       this.history = this.history.slice(-MAX_HISTORY);
     }
-    this.saveHistory();
   }
   /** Get recent conversation history for LLM context. */
   getHistory() {
     return this.history.slice(-MAX_HISTORY);
   }
-  /** Clear conversation history. */
+  /** Clear this process-local view; durable deletion belongs to the bridge. */
   clear() {
     this.history = [];
-    this.saveHistory();
+    this.facts = [];
   }
-  /**
-   * Recall relevant memories to prepend to the LLM context.
-   * Case-insensitive keyword-overlap match over captured entries: query is
-   * split into words of length >= 3, entries are scored by number of
-   * matching words, and the top 5 with score > 0 are returned.
-   */
+  /** Case-insensitive keyword-overlap recall over protected channel facts. */
   async recall(query) {
-    const queryWords = query.toLowerCase().split(/\W+/).filter((w) => w.length >= 3);
+    const queryWords = query.toLowerCase().split(/\W+/).filter((word) => word.length >= 3);
     if (queryWords.length === 0) return null;
-    const scored = this.memories.map((m) => {
-      const contentLower = m.content.toLowerCase();
+    const scored = this.facts.map((content) => {
+      const contentLower = content.toLowerCase();
       const score = queryWords.reduce(
-        (acc, w) => contentLower.includes(w) ? acc + 1 : acc,
+        (acc, word) => contentLower.includes(word) ? acc + 1 : acc,
         0
       );
-      return { memory: m, score };
-    }).filter((s) => s.score > 0).sort((a, b) => b.score - a.score).slice(0, 5);
+      return { content, score };
+    }).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score).slice(0, 5);
     if (scored.length === 0) return null;
-    const memories = scored.map((s) => `- ${s.memory.content}`).join("\n");
     return `Relevant context from memory:
-${memories}`;
-  }
-  /**
-   * Capture a notable fact to local memory (best-effort).
-   */
-  async capture(content, kind) {
-    try {
-      this.memories.push({
-        content,
-        category: kind,
-        capturedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      this.saveMemories();
-    } catch {
-    }
-  }
-  get historyPath() {
-    return join3(this.dataDir, "conversation-history.json");
-  }
-  get memoriesPath() {
-    return join3(this.dataDir, "memories.json");
-  }
-  loadHistory() {
-    try {
-      if (existsSync(this.historyPath)) {
-        const raw = readFileSync(this.historyPath, "utf-8");
-        this.history = JSON.parse(raw);
-      }
-    } catch {
-      this.history = [];
-    }
-  }
-  saveHistory() {
-    try {
-      mkdirSync(this.dataDir, { recursive: true });
-      writeFileSync(this.historyPath, JSON.stringify(this.history));
-    } catch {
-    }
-  }
-  loadMemories() {
-    try {
-      if (existsSync(this.memoriesPath)) {
-        const raw = readFileSync(this.memoriesPath, "utf-8");
-        this.memories = JSON.parse(raw);
-      }
-    } catch {
-      this.memories = [];
-    }
-  }
-  saveMemories() {
-    try {
-      mkdirSync(this.dataDir, { recursive: true });
-      writeFileSync(this.memoriesPath, JSON.stringify(this.memories));
-    } catch {
-    }
+${scored.map((entry) => `- ${entry.content}`).join("\n")}`;
   }
 };
 
 // src/skill-invoker.ts
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, statSync } from "node:fs";
-import { join as join6 } from "node:path";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync3, statSync } from "node:fs";
+import { join as join4 } from "node:path";
 
 // src/skill-md.ts
 var SkillMdError = class extends Error {
@@ -924,16 +1178,35 @@ ${guidance}` : description,
 }
 
 // src/requires.ts
-function hasReadableKeyFile(paths, read) {
+function hasReadableKeyFile(paths, read, onReadError) {
   return paths.some((path) => {
     if (!path) return false;
     try {
       return read(path).trim() !== "";
-    } catch {
+    } catch (error) {
+      try {
+        onReadError?.(path, error);
+      } catch {
+      }
       return false;
     }
   });
 }
+function searchKeyGateReporter(log, isBravePath) {
+  const logged = /* @__PURE__ */ new Set();
+  return (path, error) => {
+    if (error?.code === "ENOENT") return;
+    const signature = `${path}|${errorClass(error)}`;
+    if (logged.has(signature)) return;
+    logged.add(signature);
+    log(
+      "warn",
+      "runtime.search_key_unreadable",
+      { at_gate: true, provider_brave: isBravePath(path) },
+      error
+    );
+  };
+}
 function requiresEnvFrom(cfg, hasSearchKey) {
   return {
     hasSearchKey,
@@ -956,23 +1229,23 @@ function resolveRequires(req, env) {
 }
 
 // src/skills-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // src/config-dirs.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 function managedConfigDir(identityId, home = homedir2()) {
-  return join4(home, ".securecoms", "runtime-config", identityId);
+  return join3(home, ".securecoms", "runtime-config", identityId);
 }
 function configSearchPath(identityId, dataDir, home = homedir2()) {
   return [managedConfigDir(identityId, home), dataDir];
 }
 function findConfigFile(name, dirs) {
   for (const dir of dirs) {
-    const path = join4(dir, name);
-    if (existsSync2(path)) return path;
+    const path = join3(dir, name);
+    if (existsSync(path)) return path;
   }
   return null;
 }
@@ -982,16 +1255,16 @@ var EMPTY_SKILLS_CONFIG = { endpoints: {}, databases: {}, flags: [] };
 var empty = () => ({ endpoints: {}, databases: {}, flags: [] });
 var abs2 = (p, dataDir) => isAbsolute2(p) ? p : resolve2(dataDir, p);
 function loadSkillsConfigFile(path, dataDir) {
-  if (!existsSync3(path)) return empty();
+  if (!existsSync2(path)) return empty();
   let raw;
   try {
     raw = JSON.parse(readFileSync2(path, "utf8"));
   } catch (e) {
-    console.warn(`[skills-config] ignoring ${path}: ${e instanceof Error ? e.message : String(e)}`);
+    writeServiceLog("warn", "skills_config.parse_failed", {}, e);
     return empty();
   }
   if (typeof raw !== "object" || raw === null) {
-    console.warn(`[skills-config] ignoring ${path}: expected a JSON object`);
+    writeServiceLog("warn", "skills_config.root_invalid");
     return empty();
   }
   const src = raw;
@@ -999,7 +1272,7 @@ function loadSkillsConfigFile(path, dataDir) {
   for (const [name, v] of Object.entries(src.endpoints ?? {})) {
     const e = v;
     if (typeof e?.baseUrl !== "string" || e.baseUrl === "") {
-      console.warn(`[skills-config] endpoint "${name}" in ${path} has no baseUrl; skipped`);
+      writeServiceLog("warn", "skills_config.endpoint_invalid");
       continue;
     }
     endpoints[name] = {
@@ -1013,7 +1286,7 @@ function loadSkillsConfigFile(path, dataDir) {
     if (typeof d?.sqlite === "string" && d.sqlite !== "") databases[name] = { sqlite: abs2(d.sqlite, dataDir) };
     else if (typeof d?.postgresUrlFile === "string" && d.postgresUrlFile !== "") {
       databases[name] = { postgresUrlFile: abs2(d.postgresUrlFile, dataDir) };
-    } else console.warn(`[skills-config] database "${name}" in ${path} needs sqlite or postgresUrlFile; skipped`);
+    } else writeServiceLog("warn", "skills_config.database_invalid");
   }
   const flags = Array.isArray(src.flags) ? src.flags.filter((f) => typeof f === "string") : [];
   const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
@@ -1026,9 +1299,9 @@ function loadSkillsConfigFile(path, dataDir) {
   const s = src.search;
   if (s && typeof s === "object") {
     if (s.provider !== "brave" && s.provider !== "tavily") {
-      console.warn(`[skills-config] search in ${path} has an unknown provider; skipped`);
+      writeServiceLog("warn", "skills_config.search_provider_invalid");
     } else if (typeof s.keyFile !== "string" || s.keyFile === "") {
-      console.warn(`[skills-config] search in ${path} has no keyFile; skipped`);
+      writeServiceLog("warn", "skills_config.search_key_file_missing");
     } else {
       search = { provider: s.provider, keyFile: abs2(s.keyFile, dataDir) };
     }
@@ -1060,12 +1333,30 @@ function htmlToText(html) {
 }
 
 // src/net-guard.ts
-import { lookup } from "node:dns/promises";
+import { Resolver as DnsResolver } from "node:dns/promises";
 import { isIPv4, isIPv6 } from "node:net";
 var BlockedAddressError = class extends Error {
 };
 function systemResolver() {
-  return async (host) => (await lookup(host, { all: true, verbatim: true })).map((a) => a.address);
+  return async (host, signal) => {
+    if (isIPv4(host) || isIPv6(host)) return [host];
+    if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+    const resolver = new DnsResolver();
+    const cancel = () => resolver.cancel();
+    signal?.addEventListener("abort", cancel, { once: true });
+    try {
+      const results = await Promise.allSettled([resolver.resolve4(host), resolver.resolve6(host)]);
+      if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+      const addresses = results.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+      if (addresses.length === 0) {
+        const rejected = results.find((result) => result.status === "rejected");
+        throw rejected?.reason ?? new Error("DNS lookup returned no addresses");
+      }
+      return addresses;
+    } finally {
+      signal?.removeEventListener("abort", cancel);
+    }
+  };
 }
 function v4Parts(ip) {
   if (!isIPv4(ip)) return null;
@@ -1112,7 +1403,7 @@ function isPrivateAddress(ip) {
   }
   return (v6[0] & 65024) === 64512 || (v6[0] & 65472) === 65152;
 }
-async function assertPublicHost(url, resolve3) {
+async function assertPublicHost(url, resolve3, signal) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new BlockedAddressError(`refused ${url.protocol}//: only http and https are allowed`);
   }
@@ -1122,7 +1413,9 @@ async function assertPublicHost(url, resolve3) {
   }
   let addresses;
   try {
-    addresses = await resolve3(host);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
+    addresses = await resolve3(host, signal);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
   } catch (e) {
     throw new BlockedAddressError(`refused ${url.hostname}: cannot resolve (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -1140,14 +1433,20 @@ async function safeFetch(url, opts) {
   const maxRedirects = opts.maxRedirects ?? 3;
   const maxBytes = opts.maxBytes ?? 2e6;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1e4);
+  const cancel = () => controller.abort(opts.signal?.reason);
+  if (opts.signal?.aborted) cancel();
+  else opts.signal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(
+    () => controller.abort(new Error("network request deadline exceeded")),
+    opts.timeoutMs ?? 1e4
+  );
   try {
     let current = new URL(url);
     let method = opts.method ?? "GET";
     let headers = opts.headers;
     let body = opts.body;
     for (let hop = 0; hop <= maxRedirects; hop++) {
-      await assertPublicHost(current, opts.resolve);
+      await assertPublicHost(current, opts.resolve, controller.signal);
       const res = await opts.fetch(current.toString(), {
         method,
         headers,
@@ -1180,6 +1479,7 @@ async function safeFetch(url, opts) {
     throw new BlockedAddressError(`too many redirects (>${maxRedirects})`);
   } finally {
     clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", cancel);
   }
 }
 function headerMap(res) {
@@ -1229,7 +1529,8 @@ var fetchUrl = async (args, ctx) => {
       fetch: ctx.fetch,
       maxRedirects: 3,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     const type = res.headers["content-type"] ?? "";
     const text = /html|xml/i.test(type) ? htmlToText(res.text) : res.text.replace(/\s+/g, " ").trim();
@@ -1300,7 +1601,8 @@ var httpRequest = async (args, ctx) => {
       headers,
       body,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     return JSON.stringify({ status: res.status, body: capTo(res.text, FETCH_TEXT_CAP) });
   } catch (e) {
@@ -1308,59 +1610,9 @@ var httpRequest = async (args, ctx) => {
   }
 };
 
-// src/long-term-memory.ts
-import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-var MEMORY_FILE = "MEMORY.md";
-var MEMORY_MAX_BYTES = 8192;
-var FACT_MAX_CHARS = 300;
-function readLongTermMemory(dirs) {
-  const p = findConfigFile(MEMORY_FILE, dirs);
-  if (!p) return null;
-  const body = readFileSync4(p, "utf8").trim();
-  return body || null;
-}
-function memoryTarget(dirs) {
-  for (const d of dirs) if (existsSync4(join5(d, MEMORY_FILE))) return d;
-  for (const d of dirs) if (existsSync4(d)) return d;
-  return dirs[dirs.length - 1];
-}
-function migrateMemoryIntoManaged(managedDir, dataDir) {
-  const managed = join5(managedDir, MEMORY_FILE);
-  const local = join5(dataDir, MEMORY_FILE);
-  if (!existsSync4(managedDir) || existsSync4(managed) || !existsSync4(local)) return false;
-  copyFileSync(local, managed);
-  return true;
-}
-function rememberFact(dirs, fact, now) {
-  const clean = fact.replace(/\s+/g, " ").trim().slice(0, FACT_MAX_CHARS);
-  if (!clean) throw new Error("remember needs a non-empty fact");
-  const line = `- ${now.toISOString().slice(0, 10)} ${clean}`;
-  const dir = memoryTarget(dirs);
-  mkdirSync2(dir, { recursive: true });
-  const existing = readLongTermMemory(dirs);
-  let lines = existing ? existing.split("\n") : [];
-  lines.push(line);
-  while (Buffer.byteLength(`${lines.join("\n")}
-`, "utf8") > MEMORY_MAX_BYTES && lines.length > 1) {
-    lines = lines.slice(1);
-  }
-  writeFileSync2(join5(dir, MEMORY_FILE), `${lines.join("\n")}
-`, { mode: 384 });
-  return line;
-}
-
-// src/builtins/remember.ts
-var remember = async (args, ctx) => {
-  try {
-    return JSON.stringify({ remembered: rememberFact(ctx.configDirs, String(args.fact ?? ""), ctx.now()) });
-  } catch (e) {
-    return toolError(e instanceof Error ? e.message : String(e));
-  }
-};
-
 // src/builtins/sql-query.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { spawn } from "node:child_process";
 
 // src/sql-guard.ts
 var SqlNotReadOnlyError = class extends Error {
@@ -1414,24 +1666,168 @@ function assertReadOnlySelect(sql) {
 }
 
 // src/builtins/sql-query.ts
-function envelope(columns, rows, truncated) {
-  let kept = rows;
-  let cut = truncated;
-  let out = JSON.stringify({ columns, rows: kept, truncated: cut });
-  while (out.length > FETCH_TEXT_CAP && kept.length > 0) {
-    kept = kept.slice(0, Math.floor(kept.length / 2));
-    cut = true;
-    out = JSON.stringify({ columns, rows: kept, truncated: cut });
-  }
-  return capResult(out);
-}
-var sqlQuery = async (args, ctx) => {
-  const name = typeof args.name === "string" ? args.name : "";
-  const db = ctx.skillsConfig.databases[name];
-  if (!db) {
-    return toolError(
-      `unknown database "${name}": configured databases are ${Object.keys(ctx.skillsConfig.databases).join(", ") || "(none)"}`
-    );
+var SQLITE_PROCESS_SOURCE = String.raw`
+  const { DatabaseSync } = require("node:sqlite");
+
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => { input += chunk; });
+  process.stdin.on("end", () => {
+    let handle;
+    try {
+      const request = JSON.parse(input);
+      handle = new DatabaseSync(request.path, {
+        readOnly: true,
+        timeout: request.busyTimeoutMs,
+      });
+      // Keep SQLite-owned allocations bounded too, not only V8's heap. Temp
+      // work stays in the limited heap instead of consuming unbounded disk,
+      // and mmap is disabled so reads cannot bypass the allocation ceiling.
+      const heapLimit = handle.prepare(
+        "PRAGMA hard_heap_limit = " + request.sqliteHeapLimitBytes
+      ).get();
+      const effectiveHeapLimit = Number(Object.values(heapLimit ?? {})[0]);
+      if (!(effectiveHeapLimit > 0 && effectiveHeapLimit <= request.sqliteHeapLimitBytes)) {
+        throw new Error("SQLite heap limit could not be enforced");
+      }
+      handle.exec("PRAGMA temp_store = MEMORY; PRAGMA mmap_size = 0");
+      const statement = handle.prepare(request.sql);
+      const rows = [];
+      let columns = [];
+      let truncated = false;
+
+      for (const record of statement.iterate()) {
+        if (rows.length === request.rowCap) {
+          truncated = true;
+          break;
+        }
+        if (rows.length === 0) columns = Object.keys(record);
+        rows.push(columns.map((column) => record[column]));
+      }
+
+      process.stdout.write(JSON.stringify({
+        ok: true,
+        result: { columns, rows, truncated },
+      }));
+    } catch (error) {
+      process.stdout.write(JSON.stringify({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    } finally {
+      if (handle) handle.close();
+    }
+  });
+`;
+var SQLITE_IPC_CAP_BYTES = 1024 * 1024;
+var SQLITE_HEAP_CAP_BYTES = 32 * 1024 * 1024;
+function executeSqliteQuery(path, sql, options = {}) {
+  const timeoutMs = options.timeoutMs ?? SQL_TIMEOUT_MS;
+  if (options.signal?.aborted) return Promise.reject(new Error("SQLite query cancelled"));
+  return new Promise((resolve3, reject) => {
+    const child = spawn(process.execPath, [
+      "--no-warnings",
+      "--max-old-space-size=32",
+      "--input-type=commonjs",
+      "--eval",
+      SQLITE_PROCESS_SOURCE
+    ], {
+      // The query process needs no credentials or runtime configuration.
+      // In particular, do not let NODE_OPTIONS weaken its heap boundary.
+      env: {},
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let settled = false;
+    let stopError;
+    let stdout = "";
+    let stdoutBytes = 0;
+    const cleanup = () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+    };
+    const stop = (error) => {
+      if (settled || stopError) return;
+      stopError = error;
+      cleanup();
+      child.kill("SIGKILL");
+    };
+    const onAbort = () => stop(new Error("SQLite query cancelled"));
+    const timer = setTimeout(
+      () => stop(new Error(`SQLite query timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (stopError) return;
+      stdoutBytes += Buffer.byteLength(chunk);
+      if (stdoutBytes > SQLITE_IPC_CAP_BYTES) {
+        stop(new Error("SQLite query result exceeded the materialization limit"));
+        return;
+      }
+      stdout += chunk;
+    });
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (stopError) {
+        reject(stopError);
+        return;
+      }
+      if (code !== 0) {
+        reject(new Error(`SQLite query process exited before returning a result (code ${code})`));
+        return;
+      }
+      try {
+        const message = JSON.parse(stdout);
+        if (message.ok && message.result) resolve3(message.result);
+        else reject(new Error(message.error ?? "SQLite query process failed"));
+      } catch {
+        reject(new Error("SQLite query process returned an invalid result"));
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(JSON.stringify({
+      path,
+      sql,
+      rowCap: SQL_ROW_CAP,
+      busyTimeoutMs: timeoutMs,
+      sqliteHeapLimitBytes: SQLITE_HEAP_CAP_BYTES
+    }));
+  });
+}
+function envelope(columns, rows, truncated) {
+  let kept = rows;
+  let cut = truncated;
+  try {
+    let out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    while (resultBytes(out) > RESULT_CAP && kept.length > 0) {
+      kept = kept.slice(0, Math.floor(kept.length / 2));
+      cut = true;
+      out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    }
+    if (resultBytes(out) <= RESULT_CAP) return out;
+  } catch {
+    return toolError("database result could not be serialized");
+  }
+  return toolError("database result metadata exceeded the response limit");
+}
+var sqlQuery = async (args, ctx) => {
+  const name = typeof args.name === "string" ? args.name : "";
+  const db = ctx.skillsConfig.databases[name];
+  if (!db) {
+    return toolError(
+      `unknown database "${name}": configured databases are ${Object.keys(ctx.skillsConfig.databases).join(", ") || "(none)"}`
+    );
   }
   let sql;
   try {
@@ -1441,16 +1837,8 @@ var sqlQuery = async (args, ctx) => {
   }
   try {
     if ("sqlite" in db) {
-      const { DatabaseSync } = await import("node:sqlite");
-      const handle = new DatabaseSync(db.sqlite, { readOnly: true, timeout: SQL_TIMEOUT_MS });
-      try {
-        const rows = handle.prepare(sql).all();
-        const capped = rows.slice(0, SQL_ROW_CAP);
-        const columns = capped.length ? Object.keys(capped[0]) : [];
-        return envelope(columns, capped.map((r) => columns.map((c) => r[c])), rows.length > SQL_ROW_CAP);
-      } finally {
-        handle.close();
-      }
+      const result = await executeSqliteQuery(db.sqlite, sql, { signal: ctx.signal });
+      return envelope(result.columns, result.rows, result.truncated);
     }
     let pg;
     try {
@@ -1461,19 +1849,32 @@ var sqlQuery = async (args, ctx) => {
     const Client = pg.Client ?? pg.default?.Client;
     if (!Client) return toolError(`the installed "pg" module does not export a Client`);
     const client = new Client({
-      connectionString: readFileSync5(db.postgresUrlFile, "utf8").trim(),
+      connectionString: readFileSync4(db.postgresUrlFile, "utf8").trim(),
       // never logged (D4)
-      statement_timeout: SQL_TIMEOUT_MS
+      statement_timeout: SQL_TIMEOUT_MS,
+      connectionTimeoutMillis: SQL_TIMEOUT_MS,
+      query_timeout: SQL_TIMEOUT_MS
     });
-    await client.connect();
+    let cancelled = ctx.signal?.aborted ?? false;
+    const cancel = () => {
+      cancelled = true;
+      void client.end().catch(() => {
+      });
+    };
+    if (cancelled) throw new Error("Postgres query cancelled");
+    ctx.signal?.addEventListener("abort", cancel, { once: true });
     try {
+      await client.connect();
+      if (cancelled) throw new Error("Postgres query cancelled");
       await client.query("BEGIN; SET TRANSACTION READ ONLY;");
       const res = await client.query({ text: sql, rowMode: "array" });
+      if (cancelled) throw new Error("Postgres query cancelled");
       const columns = res.fields.map((f) => f.name);
       const rows = res.rows.slice(0, SQL_ROW_CAP);
       return envelope(columns, rows, res.rows.length > SQL_ROW_CAP);
     } finally {
-      await client.query("ROLLBACK").catch(() => {
+      ctx.signal?.removeEventListener("abort", cancel);
+      if (!cancelled) await client.query("ROLLBACK").catch(() => {
       });
       await client.end().catch(() => {
       });
@@ -1496,13 +1897,14 @@ var webSearch = async (args, ctx) => {
   try {
     let hits;
     if (brave) {
-      ctx.log("debug", `web_search via brave (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: true });
       const url = `https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${count}`;
       const res = await safeFetch(url, {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         headers: { accept: "application/json", "X-Subscription-Token": brave }
       });
       if (res.status !== 200) return toolError(`brave search returned HTTP ${res.status}`);
@@ -1513,12 +1915,13 @@ var webSearch = async (args, ctx) => {
         snippet: r.description ?? ""
       }));
     } else {
-      ctx.log("debug", `web_search via tavily (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: false });
       const res = await safeFetch("https://api.tavily.com/search", {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ api_key: tavily, query, max_results: count })
@@ -1541,14 +1944,70 @@ var webSearch = async (args, ctx) => {
 var RESULT_CAP = 2e4;
 var TRUNCATION_MARKER = "\u2026[truncated]";
 var FETCH_TEXT_CAP = RESULT_CAP - 4096;
+function resultBytes(s) {
+  return Buffer.byteLength(s, "utf8");
+}
+function utf8Prefix(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  const bytes = Buffer.from(s, "utf8");
+  if (bytes.length <= maxBytes) return s;
+  let end = maxBytes;
+  while (end > 0) {
+    const candidate = bytes.subarray(0, end).toString("utf8");
+    if (!candidate.endsWith("\uFFFD") && resultBytes(candidate) <= maxBytes) return candidate;
+    end--;
+  }
+  return "";
+}
+function fitJsonString(value, build) {
+  const codePoints = Array.from(value);
+  let low = 0;
+  let high = codePoints.length;
+  let best = build("");
+  while (low <= high) {
+    const middle = Math.floor((low + high) / 2);
+    const candidate = build(codePoints.slice(0, middle).join(""));
+    if (resultBytes(candidate) <= RESULT_CAP) {
+      best = candidate;
+      low = middle + 1;
+    } else {
+      high = middle - 1;
+    }
+  }
+  return best;
+}
 function capTo(s, limit) {
-  return s.length <= limit ? s : s.slice(0, limit) + TRUNCATION_MARKER;
+  if (resultBytes(s) <= limit) return s;
+  const markerBytes = resultBytes(TRUNCATION_MARKER);
+  return utf8Prefix(s, Math.max(0, limit - markerBytes)) + TRUNCATION_MARKER;
 }
 function capResult(s) {
   return capTo(s, RESULT_CAP);
 }
+function boundToolResult(content) {
+  if (resultBytes(content) <= RESULT_CAP) return content;
+  try {
+    const parsed = JSON.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const record = parsed;
+      if (typeof record.error === "string") {
+        const message = typeof record.message === "string" ? record.message : record.error;
+        return toolError(message);
+      }
+    }
+    return fitJsonString(content, (result) => JSON.stringify({ result, truncated: true }));
+  } catch {
+    return capResult(content);
+  }
+}
 function toolError(message) {
-  return JSON.stringify({ error: "tool_failed", message });
+  const plain = JSON.stringify({ error: "tool_failed", message });
+  if (resultBytes(plain) <= RESULT_CAP) return plain;
+  return fitJsonString(message, (prefix) => JSON.stringify({
+    error: "tool_failed",
+    message: prefix,
+    truncated: true
+  }));
 }
 var NO_CONTEXT = "no runtime context: this built-in needs the runtime's network context";
 function offlineContext() {
@@ -1573,16 +2032,151 @@ var BUILTINS = {
   fetch_url: fetchUrl,
   web_search: webSearch,
   http_request: httpRequest,
-  sql_query: sqlQuery,
-  remember
+  sql_query: sqlQuery
+};
+
+// src/side-effect-ledger.ts
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES = 1e4;
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("operation arguments must be finite JSON values");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map(
+      (key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`
+    ).join(",")}}`;
+  }
+  throw new Error("operation arguments must be JSON values");
+}
+function operationSha256(tool, args) {
+  const normalized = tool === "http_request" && typeof args.method === "string" ? { ...args, method: args.method.toUpperCase() } : args;
+  return createHash("sha256").update(`${tool}
+${canonicalJson(normalized)}`, "utf8").digest("hex");
+}
+var SideEffectLedger = class {
+  constructor(path, maxEntries = DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES) {
+    this.maxEntries = maxEntries;
+    mkdirSync2(dirname4(path), { recursive: true, mode: 448 });
+    this.db = new DatabaseSync(path);
+    chmodSync(path, 384);
+    this.db.exec("PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA busy_timeout=1000;");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS side_effect_claims (
+        idempotency_key TEXT PRIMARY KEY,
+        operation_sha256 TEXT NOT NULL,
+        confirmation_id TEXT NOT NULL UNIQUE,
+        expires_at TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('in_progress', 'completed')),
+        created_at TEXT NOT NULL,
+        completed_at TEXT
+      ) STRICT
+    `);
+  }
+  db;
+  claim(grant, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const prior = this.db.prepare(`
+        SELECT idempotency_key, operation_sha256, confirmation_id, state
+        FROM side_effect_claims WHERE idempotency_key = ? OR confirmation_id = ?
+      `).get(grant.idempotency_key, grant.confirmation_id);
+      if (prior) {
+        this.db.exec("COMMIT");
+        if (prior.operation_sha256 !== grant.operation_sha256 || prior.confirmation_id !== grant.confirmation_id || prior.idempotency_key !== grant.idempotency_key) return { kind: "conflict" };
+        return { kind: prior.state === "completed" ? "completed" : "ambiguous" };
+      }
+      const count = this.db.prepare("SELECT COUNT(*) AS count FROM side_effect_claims").get();
+      if (count.count >= this.maxEntries) {
+        this.db.exec("COMMIT");
+        return { kind: "full" };
+      }
+      this.db.prepare(`
+        INSERT INTO side_effect_claims
+          (idempotency_key, operation_sha256, confirmation_id, expires_at, state, created_at)
+        VALUES (?, ?, ?, ?, 'in_progress', ?)
+      `).run(
+        grant.idempotency_key,
+        grant.operation_sha256,
+        grant.confirmation_id,
+        grant.expires_at,
+        now.toISOString()
+      );
+      this.db.exec("COMMIT");
+      return { kind: "execute" };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  complete(grant, now) {
+    const result = this.db.prepare(`
+      UPDATE side_effect_claims SET state = 'completed', completed_at = ?
+      WHERE idempotency_key = ? AND operation_sha256 = ? AND confirmation_id = ?
+        AND state = 'in_progress'
+    `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+    if (result.changes !== 1) throw new Error("side-effect claim could not be completed");
+  }
+  /** Content-free inventory for an operator investigating an interrupted effect. */
+  listAmbiguous() {
+    return this.db.prepare(`
+      SELECT idempotency_key, operation_sha256, confirmation_id, expires_at, created_at
+      FROM side_effect_claims WHERE state='in_progress' ORDER BY created_at, idempotency_key
+    `).all();
+  }
+  /**
+   * Record the operator's external reconciliation result. `completed` prevents
+   * replay; `not_applied` removes the pre-effect claim so the exact confirmed
+   * operation may be retried. Every binding field must match the durable row.
+   */
+  reconcile(grant, outcome, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.db.prepare(`
+        SELECT state FROM side_effect_claims
+        WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=?
+      `).get(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      if (!row) throw new Error("ambiguous side-effect claim not found or binding mismatch");
+      if (row.state !== "in_progress") throw new Error("side-effect claim is already completed");
+      if (outcome === "completed") {
+        this.db.prepare(`
+          UPDATE side_effect_claims SET state='completed', completed_at=?
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      } else {
+        this.db.prepare(`
+          DELETE FROM side_effect_claims
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      }
+      this.db.exec("COMMIT");
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  close() {
+    this.db.close();
+  }
 };
 
 // src/skill-invoker.ts
 var SkillInvoker = class {
-  skills = /* @__PURE__ */ new Map();
-  sources = /* @__PURE__ */ new Map();
-  skillsDir;
-  ctx;
   /**
    * `ctx` carries everything a built-in may touch: the network, DNS, the clock
    * and the key files. A caller that has no runtime (the loader tests, and any
@@ -1590,67 +2184,70 @@ var SkillInvoker = class {
    * that need nothing still run and the ones that need the network fail as a
    * tool_failed result instead of throwing.
    */
-  constructor(skillsDir, ctx) {
+  constructor(skillsDir, ctx, sideEffectLedger) {
+    this.sideEffectLedger = sideEffectLedger;
     this.skillsDir = skillsDir;
     this.ctx = ctx ?? offlineContext();
   }
+  skills = /* @__PURE__ */ new Map();
+  sources = /* @__PURE__ */ new Map();
+  skillsDir;
+  ctx;
   /**
    * Load all skill manifests from the skills directory. Supports two
    * layouts: flat `<skillsDir>/*.json` files, and one level of nesting via
    * `<skillsDir>/<subdir>/manifest.json`.
    */
   loadSkills() {
-    if (!existsSync5(this.skillsDir)) {
-      console.warn(`[SkillInvoker] Skills directory not found: ${this.skillsDir}`);
+    if (!existsSync3(this.skillsDir)) {
+      writeServiceLog("warn", "skills.directory_missing");
       return;
     }
     const flat = [], manifests = [], skillMds = [];
     for (const entry of readdirSync(this.skillsDir, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.endsWith(".json")) {
-        flat.push(join6(this.skillsDir, entry.name));
+        flat.push(join4(this.skillsDir, entry.name));
       } else if (entry.isDirectory()) {
-        const m = join6(this.skillsDir, entry.name, "manifest.json");
-        if (existsSync5(m) && statSync(m).isFile()) manifests.push(m);
-        const s = join6(this.skillsDir, entry.name, "SKILL.md");
-        if (existsSync5(s) && statSync(s).isFile()) skillMds.push(s);
+        const m = join4(this.skillsDir, entry.name, "manifest.json");
+        if (existsSync3(m) && statSync(m).isFile()) manifests.push(m);
+        const s = join4(this.skillsDir, entry.name, "SKILL.md");
+        if (existsSync3(s) && statSync(s).isFile()) skillMds.push(s);
       }
     }
     for (const p of [...flat.sort(), ...manifests.sort()]) this.loadManifestFile(p);
     for (const p of skillMds.sort()) this.loadSkillMdFile(p);
-    console.log(`[SkillInvoker] Loaded ${this.skills.size} skills`);
+    writeServiceLog("info", "skills.loaded", { count: this.skills.size });
   }
   /** Later file wins, with a warning naming both paths (spec §3). */
   register(manifest, path) {
     const prior = this.sources.get(manifest.name);
-    if (prior) console.warn(`[SkillInvoker] Duplicate skill "${manifest.name}": ${path} overrides ${prior}`);
+    if (prior) writeServiceLog("warn", "skills.duplicate_replaced");
     this.skills.set(manifest.name, manifest);
     this.sources.set(manifest.name, path);
   }
   loadSkillMdFile(path) {
     try {
-      this.register(parseSkillMd(readFileSync6(path, "utf-8"), path), path);
+      this.register(parseSkillMd(readFileSync5(path, "utf-8"), path), path);
     } catch (err) {
-      console.warn(`[SkillInvoker] Skipping ${path}: ${err instanceof Error ? err.message : String(err)}`);
+      writeServiceLog("warn", "skills.skill_md_invalid", {}, err);
     }
   }
   loadManifestFile(path) {
     try {
-      const raw = readFileSync6(path, "utf-8");
+      const raw = readFileSync5(path, "utf-8");
       const manifest = JSON.parse(raw);
       if (typeof manifest.handler !== "string" || !(manifest.handler.startsWith("builtin:") || manifest.handler.startsWith("script:"))) {
-        console.warn(
-          `[SkillInvoker] Skipping manifest with invalid handler ${path}: expected "builtin:<name>" or "script:<path>"`
-        );
+        writeServiceLog("warn", "skills.manifest_handler_invalid");
         return;
       }
       if (manifest.name && manifest.description) {
         this.register(manifest, path);
       } else {
         const missing = !manifest.name ? "name" : "description";
-        console.warn(`[SkillInvoker] Skipping manifest ${path}: missing "${missing}"`);
+        writeServiceLog("warn", "skills.manifest_field_missing", { name_missing: missing === "name" });
       }
     } catch (err) {
-      console.warn(`[SkillInvoker] Failed to load skill ${path}:`, err);
+      writeServiceLog("warn", "skills.manifest_load_failed", {}, err);
     }
   }
   /** Convert loaded skills to OpenAI tool definitions for LLM dispatch. */
@@ -1690,27 +2287,76 @@ var SkillInvoker = class {
   async invoke(name, args, context) {
     const skill = this.skills.get(name);
     if (!skill) {
-      return JSON.stringify({ error: `Unknown skill: ${name}` });
+      return boundToolResult(JSON.stringify({ error: `Unknown skill: ${name}` }));
+    }
+    const execute = async () => {
+      const handler = skill.handler;
+      if (handler.startsWith("builtin:")) {
+        return this.invokeBuiltin(handler.slice(8), args, context?.signal);
+      }
+      if (handler.startsWith("script:")) {
+        return this.invokeScript(handler.slice(7), args, context?.signal);
+      }
+      return boundToolResult(JSON.stringify({ error: `Unknown handler type: ${handler}` }));
+    };
+    return context?.sideEffect ? this.invokeSideEffect(name, args, context.sideEffect, execute) : execute();
+  }
+  async invokeSideEffect(name, args, grant, execute) {
+    const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
+    if (name !== "http_request" || !(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+      return toolError("This tool has no supported side-effect replay contract");
+    }
+    if (grant.tool !== name || operationSha256(name, args) !== grant.operation_sha256) {
+      return toolError("Confirmed operation digest does not match this tool call");
+    }
+    const now = this.ctx.now();
+    const expiresAt = Date.parse(grant.expires_at);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+      return toolError("Confirmed operation grant is expired or invalid");
+    }
+    if (!this.sideEffectLedger) {
+      return toolError("Side-effect replay protection is unavailable");
+    }
+    let claim;
+    try {
+      claim = this.sideEffectLedger.claim(grant, now);
+    } catch {
+      return toolError("Side-effect replay claim could not be persisted");
+    }
+    if (claim.kind === "completed") return JSON.stringify({ status: "already_applied" });
+    if (claim.kind === "ambiguous") {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
     }
-    const handler = skill.handler;
-    if (handler.startsWith("builtin:")) {
-      return this.invokeBuiltin(handler.slice(8), args);
+    if (claim.kind === "conflict") {
+      return toolError("Idempotency key was already bound to a different confirmed operation");
     }
-    if (handler.startsWith("script:")) {
-      return this.invokeScript(handler.slice(7), args);
+    if (claim.kind === "full") {
+      return toolError("Side-effect replay ledger is full; reconcile it before running new operations");
+    }
+    let result;
+    try {
+      result = await execute();
+    } catch {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
     }
-    return JSON.stringify({ error: `Unknown handler type: ${handler}` });
+    if (isToolFailure(result)) return result;
+    try {
+      this.sideEffectLedger.complete(grant, this.ctx.now());
+    } catch {
+      return toolError("Side-effect completed but replay state is ambiguous; reconcile before retrying");
+    }
+    return result;
   }
-  async invokeBuiltin(name, args) {
+  async invokeBuiltin(name, args, signal) {
     const builtin = BUILTINS[name];
     if (!builtin) return JSON.stringify({ error: `Unknown builtin: ${name}` });
     try {
-      return capResult(await builtin(args, this.ctx));
+      return boundToolResult(await builtin(args, { ...this.ctx, signal }));
     } catch (e) {
       return toolError(e instanceof Error ? e.message : String(e));
     }
   }
-  async invokeScript(scriptPath, args) {
+  async invokeScript(scriptPath, args, signal) {
     const { resolve: resolve3, relative } = await import("node:path");
     const resolved = resolve3(this.skillsDir, scriptPath);
     const rel = relative(this.skillsDir, resolved);
@@ -1730,26 +2376,82 @@ var SkillInvoker = class {
     try {
       accessSync2(resolved, constants2.X_OK);
     } catch {
-      return JSON.stringify({ error: `Script not found or not executable: ${scriptPath}` });
+      return toolError(`Script not found or not executable: ${scriptPath}`);
     }
-    const { execSync } = await import("node:child_process");
-    try {
-      const result = execSync(resolved, {
-        input: JSON.stringify(args),
-        timeout: 3e4,
-        maxBuffer: 1024 * 1024,
-        encoding: "utf-8",
+    if (signal?.aborted) return toolError("Script execution cancelled");
+    const { spawn: spawn2 } = await import("node:child_process");
+    return new Promise((resolveResult) => {
+      const child = spawn2(resolved, [], {
         cwd: this.skillsDir,
-        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" }
+        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" },
+        stdio: ["pipe", "pipe", "ignore"],
+        windowsHide: true,
+        // A script may launch children. On POSIX, make one process group so
+        // cancellation kills the whole operation rather than orphaning them.
+        detached: process.platform !== "win32"
       });
-      return result;
-    } catch (err) {
-      return JSON.stringify({
-        error: `Script execution failed: ${err instanceof Error ? err.message : String(err)}`
+      let stdout = "";
+      let stdoutBytes = 0;
+      let stopMessage = null;
+      let settled = false;
+      const cleanup = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      };
+      const stop = (message) => {
+        if (settled || stopMessage) return;
+        stopMessage = message;
+        if (process.platform !== "win32" && child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+            child.kill("SIGKILL");
+          }
+        } else {
+          child.kill("SIGKILL");
+        }
+      };
+      const onAbort = () => stop("Script execution cancelled");
+      const timer = setTimeout(() => stop("Script execution timed out after 30000ms"), 3e4);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        if (stopMessage) return;
+        stdoutBytes += Buffer.byteLength(chunk);
+        if (stdoutBytes > 1024 * 1024) {
+          stop("Script output exceeded the materialization limit");
+          return;
+        }
+        stdout += chunk;
       });
-    }
+      child.once("error", () => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolveResult(toolError("Script execution failed"));
+      });
+      child.once("close", (code) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        if (stopMessage) resolveResult(toolError(stopMessage));
+        else if (code !== 0) resolveResult(toolError(`Script execution failed (code ${code ?? "unknown"})`));
+        else resolveResult(boundToolResult(stdout));
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(JSON.stringify(args));
+    });
   }
 };
+function isToolFailure(result) {
+  try {
+    const parsed = JSON.parse(result);
+    return parsed.error === "tool_failed";
+  } catch {
+    return false;
+  }
+}
 
 // src/tool-gate.ts
 function createLocalToolGate(policy) {
@@ -1798,14 +2500,80 @@ function createDynamicToolGate(policyFor) {
 }
 
 // src/data-plane.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { WebSocket } from "node:http";
 import { homedir as homedir3 } from "node:os";
-import { join as join7 } from "node:path";
-var SEEN_MAX = 5e3;
-function errText(e) {
-  return e instanceof Error ? e.message : String(e);
+import { join as join5 } from "node:path";
+var NO_TURN_MEMORY = Object.freeze({
+  recent: Object.freeze([]),
+  facts: Object.freeze([])
+});
+function parseTurnMemory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_MEMORY;
+  const raw = value;
+  if (!Array.isArray(raw.recent) || !Array.isArray(raw.facts)) return NO_TURN_MEMORY;
+  const recent = [];
+  for (const value2 of raw.recent.slice(-50)) {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_MEMORY;
+    const turn = value2;
+    if (turn.role !== "peer" && turn.role !== "agent" || typeof turn.text !== "string") {
+      return NO_TURN_MEMORY;
+    }
+    recent.push(Object.freeze({ role: turn.role, text: turn.text }));
+  }
+  const facts = [];
+  for (const fact of raw.facts.slice(-200)) {
+    if (typeof fact !== "string") return NO_TURN_MEMORY;
+    facts.push(fact);
+  }
+  return Object.freeze({ recent: Object.freeze(recent), facts: Object.freeze(facts) });
+}
+var AUDIENCES = /* @__PURE__ */ new Set([
+  "owner_dm",
+  "team_room",
+  "partner_room",
+  "other_human_dm",
+  "agent_to_agent",
+  "unknown"
+]);
+var NO_TURN_AUTHORIZATION = Object.freeze({
+  version: 1,
+  audience: "unknown",
+  sender_membership: "unknown",
+  tool_grants: Object.freeze([])
+});
+function parseTurnAuthorization(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_AUTHORIZATION;
+  const raw = value;
+  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants) || raw.tool_grants.length > 100) return NO_TURN_AUTHORIZATION;
+  const grants = [];
+  for (const value2 of raw.tool_grants) {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_AUTHORIZATION;
+    const grant = value2;
+    if (typeof grant.tool !== "string" || !grant.tool || grant.tool.length > 100) return NO_TURN_AUTHORIZATION;
+    if (grant.mode === "read") {
+      grants.push(Object.freeze({ tool: grant.tool, mode: "read" }));
+      continue;
+    }
+    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || grant.confirmation_id.length > 200 || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || grant.idempotency_key.length > 200 || typeof grant.expires_at !== "string" || !grant.expires_at || grant.expires_at.length > 40) return NO_TURN_AUTHORIZATION;
+    grants.push(Object.freeze({
+      tool: grant.tool,
+      mode: "side_effect",
+      operation_sha256: grant.operation_sha256,
+      confirmation_id: grant.confirmation_id,
+      idempotency_key: grant.idempotency_key,
+      expires_at: grant.expires_at
+    }));
+  }
+  return Object.freeze({
+    version: 1,
+    audience: raw.audience,
+    sender_membership: raw.sender_membership,
+    tool_grants: Object.freeze(grants)
+  });
 }
+var SEEN_MAX = 5e3;
+var TERMINAL_REPLY_ERRORS = /* @__PURE__ */ new Set(["agent_paused", "send_forbidden"]);
 var SecureComsDataPlane = class {
   identityId;
   connectionPath;
@@ -1815,7 +2583,18 @@ var SecureComsDataPlane = class {
   log;
   sleep;
   random;
+  healthTimeoutMs;
   onMessage;
+  noticeReplies;
+  /**
+   * Final-wave I1(b): sockets whose daemon advertised the `nack` feature. On
+   * those a failed turn is NACKED — only that message is retried, behind the
+   * daemon's backoff, and the socket (with every other channel's turn) stays
+   * up. Anywhere else a failed turn still closes the socket, as before.
+   */
+  nackCapable = /* @__PURE__ */ new WeakSet();
+  /** Sockets whose hello is unanswered: a refusal there is expected, not an error. */
+  helloPending = /* @__PURE__ */ new WeakSet();
   seen = /* @__PURE__ */ new Set();
   stopped = false;
   running = false;
@@ -1842,17 +2621,24 @@ var SecureComsDataPlane = class {
    * generation is current, so a restart can never end up with two live loops.
    */
   generation = 0;
+  /** Turn controllers grouped by the socket whose result would receive them. */
+  turns = /* @__PURE__ */ new Map();
+  /**
+   * Phase 3 F2: per-channel processing chains. A channel's messages are
+   * handled strictly one after another in arrival order (the receipt lookup,
+   * the turn and the reply), never concurrently — even when a daemon flushes a
+   * whole backlog at once. Different channels still run alongside each other.
+   */
+  channelChains = /* @__PURE__ */ new Map();
+  healthController = null;
   constructor(cfg, onMessage) {
     this.identityId = cfg.identityId;
-    const dir = cfg.connectionsDir ?? join7(homedir3(), ".securecoms", "connections");
-    this.connectionPath = join7(dir, `${cfg.identityId}.json`);
+    const dir = cfg.connectionsDir ?? join5(homedir3(), ".securecoms", "connections");
+    this.connectionPath = join5(dir, `${cfg.identityId}.json`);
     this.establishedMs = cfg.establishedMs ?? 5e3;
     this.initialDelayMs = cfg.initialDelayMs ?? 250;
     this.maxDelayMs = cfg.maxDelayMs ?? 3e4;
-    this.log = cfg.log ?? ((level, msg) => {
-      if (level === "info") console.log(msg);
-      else console.error(msg);
-    });
+    this.log = cfg.log ?? writeServiceLog;
     this.sleep = cfg.sleep ?? ((ms) => new Promise((resolve3) => {
       this.sleepTimer = setTimeout(() => {
         this.sleepTimer = null;
@@ -1860,7 +2646,9 @@ var SecureComsDataPlane = class {
       }, ms);
     }));
     this.random = cfg.random ?? Math.random;
+    this.healthTimeoutMs = cfg.healthTimeoutMs ?? 2e3;
     this.onMessage = onMessage;
+    this.noticeReplies = cfg.noticeReplies ?? /* @__PURE__ */ new Set();
   }
   /**
    * Resolves once the reconnect loop is running — NOT once attached. The loop
@@ -1879,13 +2667,19 @@ var SecureComsDataPlane = class {
     this.generation++;
     this.clearSettle();
     this.cancelSleep();
+    this.healthController?.abort(new Error("transport stopped"));
+    this.healthController = null;
+    for (const controllers of this.turns.values()) {
+      for (const controller of controllers) controller.abort(new Error("transport stopped"));
+    }
+    this.turns.clear();
     const ws = this.socket;
     this.socket = null;
     if (ws) {
       try {
         ws.close();
       } catch (e) {
-        this.log("warn", `error closing socket: ${errText(e)}`);
+        this.log("warn", "transport.socket_close_failed", {}, e);
       }
     }
   }
@@ -1939,7 +2733,7 @@ var SecureComsDataPlane = class {
         await this.attemptOnce();
         delay = this.initialDelayMs;
       } catch (e) {
-        this.log("error", errText(e));
+        this.log("error", "transport.connection_attempt_failed", {}, e);
       }
       if (!live()) break;
       await this.wait(this.random() * delay);
@@ -1948,10 +2742,22 @@ var SecureComsDataPlane = class {
     if (this.generation === generation) this.running = false;
   }
   async attemptOnce() {
-    const conn = JSON.parse(readFileSync7(this.connectionPath, "utf8"));
+    const conn = JSON.parse(readFileSync6(this.connectionPath, "utf8"));
     const httpBase = conn.bridge_url.replace(/^ws/, "http").replace(/\/v1\/ws$/, "");
-    const token = readFileSync7(conn.token_file, "utf8").trim();
-    const health = await (await fetch(`${httpBase}/healthz`)).json();
+    const token = readFileSync6(conn.token_file, "utf8").trim();
+    const healthController = new AbortController();
+    this.healthController = healthController;
+    const healthTimer = setTimeout(
+      () => healthController.abort(new Error("health gate deadline exceeded")),
+      this.healthTimeoutMs
+    );
+    let health;
+    try {
+      health = await (await fetch(`${httpBase}/healthz`, { signal: healthController.signal })).json();
+    } finally {
+      clearTimeout(healthTimer);
+      if (this.healthController === healthController) this.healthController = null;
+    }
     if (conn.identity_id !== health.identity_id || this.identityId !== health.identity_id) {
       throw new Error(
         `gate refused: expected ${this.identityId}, connection file says ${conn.identity_id}, daemon on this port is ${health.identity_id}`
@@ -1965,7 +2771,7 @@ var SecureComsDataPlane = class {
     try {
       await new Promise((resolve3, reject) => {
         ws.addEventListener("error", (e) => {
-          reject(new Error(`socket error: ${errText(e?.message ?? e)}`));
+          reject(Object.assign(new Error("socket_error"), { cause: e }));
         });
         ws.addEventListener("close", (e) => {
           if (established) resolve3();
@@ -1978,19 +2784,29 @@ var SecureComsDataPlane = class {
           }
         });
         ws.addEventListener("open", () => {
+          this.helloPending.add(ws);
+          try {
+            ws.send(JSON.stringify({ type: "hello", features: ["nack"] }));
+          } catch {
+          }
           settle = setTimeout(() => {
             established = true;
-            this.log("info", `attached to ${conn.bridge_url}`);
+            this.log("info", "transport.attached");
           }, this.establishedMs);
           this.settle = settle;
         });
         ws.addEventListener("message", (ev) => {
-          void this.handleFrame(ws, ev.data).catch((e) => {
-            this.log("error", `frame handling failed: ${errText(e)}`);
+          void this.handleFrame(ws, ev.data, httpBase, token).catch((e) => {
+            this.log("error", "transport.frame_handling_failed", {}, e);
           });
         });
       });
     } finally {
+      const controllers = this.turns.get(ws);
+      if (controllers) {
+        for (const controller of controllers) controller.abort(new Error("transport disconnected"));
+        this.turns.delete(ws);
+      }
       if (settle !== null) clearTimeout(settle);
       if (this.settle === settle) this.settle = null;
       try {
@@ -2000,45 +2816,133 @@ var SecureComsDataPlane = class {
       if (this.socket === ws) this.socket = null;
     }
   }
-  async handleFrame(ws, data) {
+  /**
+   * Final-wave I1(b): fail ONE message. Against a nack-capable daemon, send a
+   * `nack` — only this message is retried and the socket stays up for every
+   * other channel's turn. Otherwise close the socket, the only failure
+   * signal an older daemon understands (it re-buffers what was in flight).
+   */
+  failTurn(ws, messageId, reason) {
+    if (this.nackCapable.has(ws) && ws.readyState === ws.OPEN) {
+      try {
+        ws.send(JSON.stringify({ type: "nack", message_id: messageId, reason }));
+        return;
+      } catch {
+      }
+    }
+    try {
+      ws.close();
+    } catch {
+    }
+  }
+  async handleFrame(ws, data, httpBase, token) {
     let frame;
     try {
       frame = JSON.parse(String(data));
     } catch (e) {
-      this.log("error", `ignoring unparseable frame: ${errText(e)}`);
+      this.log("error", "transport.frame_parse_failed", {}, e);
+      return;
+    }
+    if (frame?.type === "hello") {
+      this.helloPending.delete(ws);
+      if (Array.isArray(frame.features) && frame.features.includes("nack")) this.nackCapable.add(ws);
       return;
     }
     if (frame?.type === "error") {
-      this.log("error", `daemon error frame: ${String(frame.error)}: ${String(frame.message)}`);
+      if (frame.in_reply_to === void 0 && this.helloPending.has(ws)) {
+        this.helloPending.delete(ws);
+        this.log("info", "transport.daemon_without_nack");
+        return;
+      }
+      if (typeof frame.in_reply_to === "string" && TERMINAL_REPLY_ERRORS.has(String(frame.error))) {
+        this.log("warn", "transport.reply_terminal", { paused: frame.error === "agent_paused" });
+        this.remember(frame.in_reply_to);
+        ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
+        return;
+      }
+      this.log("error", "transport.daemon_error_frame");
+      if (typeof frame.in_reply_to === "string") this.failTurn(ws, frame.in_reply_to, "reply_failed");
+      return;
+    }
+    if (frame?.type === "sent" && typeof frame.in_reply_to === "string") {
+      this.remember(frame.in_reply_to);
+      ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
       return;
     }
     if (frame?.type !== "message") return;
     const messageId = frame.message_id;
     if (typeof messageId !== "string") {
-      this.log("error", "ignoring message frame with no message_id");
+      this.log("error", "transport.message_id_missing");
       return;
     }
     const channelId = String(frame.channel_id);
+    const previous = this.channelChains.get(channelId) ?? Promise.resolve();
+    const run = () => this.handleMessage(ws, frame, messageId, channelId, httpBase, token);
+    const mine = previous.then(run, run);
+    this.channelChains.set(channelId, mine);
+    try {
+      await mine;
+    } finally {
+      if (this.channelChains.get(channelId) === mine) this.channelChains.delete(channelId);
+    }
+  }
+  async handleMessage(ws, frame, messageId, channelId, httpBase, token) {
+    if (ws.readyState !== ws.OPEN) return;
+    let turnController = null;
     try {
       if (!this.seen.has(messageId)) {
-        this.remember(messageId);
+        const receipt = await fetch(
+          `${httpBase}/v1/reply-receipt?in_reply_to=${encodeURIComponent(messageId)}`,
+          {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(this.healthTimeoutMs)
+          }
+        );
+        if (!receipt.ok) throw new Error(`reply receipt lookup failed: HTTP ${receipt.status}`);
+        if ((await receipt.json()).found === true) {
+          this.remember(messageId);
+          ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+          return;
+        }
+        turnController = new AbortController();
+        let socketTurns = this.turns.get(ws);
+        if (!socketTurns) {
+          socketTurns = /* @__PURE__ */ new Set();
+          this.turns.set(ws, socketTurns);
+        }
+        socketTurns.add(turnController);
         const reply = await this.onMessage({
           text: String(frame.text ?? ""),
           senderId: String(frame.sender_id ?? ""),
           channelId,
-          messageId
-        });
+          messageId,
+          authorization: parseTurnAuthorization(frame.authorization),
+          memory: parseTurnMemory(frame.memory)
+        }, turnController.signal);
         if (reply != null) {
-          ws.send(JSON.stringify({ type: "send", channel_id: channelId, text: String(reply) }));
+          const text = String(reply);
+          ws.send(JSON.stringify({
+            type: "send",
+            channel_id: channelId,
+            text,
+            in_reply_to: messageId,
+            ...this.noticeReplies.has(text) ? { notice: true } : {}
+          }));
+          return;
         }
+        this.remember(messageId);
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+      } else {
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
       }
     } catch (e) {
-      this.log("error", `handler threw: ${errText(e)}`);
+      this.log("error", "transport.handler_failed", {}, e);
+      this.failTurn(ws, messageId, "turn_failed");
     } finally {
-      try {
-        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
-      } catch (e) {
-        this.log("error", `could not ack ${messageId}: ${errText(e)}`);
+      if (turnController) {
+        const socketTurns = this.turns.get(ws);
+        socketTurns?.delete(turnController);
+        if (socketTurns?.size === 0) this.turns.delete(ws);
       }
     }
   }
@@ -2051,6 +2955,14 @@ function createSecureComsDataPlane(cfg, onMessage) {
 async function runToolCalls(toolCalls, skills, context) {
   const out = [];
   for (const call of toolCalls) {
+    if (context?.signal?.aborted) {
+      out.push({
+        role: "tool",
+        content: toolError("Tool execution cancelled"),
+        tool_call_id: call.id
+      });
+      continue;
+    }
     let args;
     try {
       args = JSON.parse(call.function.arguments);
@@ -2059,12 +2971,14 @@ async function runToolCalls(toolCalls, skills, context) {
     }
     let content;
     try {
-      content = await skills.invoke(call.function.name, args, context);
+      content = boundToolResult(await skills.invoke(call.function.name, args, {
+        roomId: context?.roomId,
+        groupId: context?.groupId,
+        signal: context?.signal,
+        sideEffect: context?.sideEffects?.get(call.id)
+      }));
     } catch (err) {
-      content = JSON.stringify({
-        error: "tool_failed",
-        message: String(err instanceof Error ? err.message : err)
-      });
+      content = toolError(String(err instanceof Error ? err.message : err));
     }
     out.push({ role: "tool", content, tool_call_id: call.id });
   }
@@ -2074,29 +2988,203 @@ async function runToolCalls(toolCalls, skills, context) {
 // src/turn-loop.ts
 var DEFAULT_SYSTEM_PROMPT = "You are a SecureComs agent. Respond helpfully and concisely.";
 var DEFAULT_MAX_ITERATIONS = 5;
+var DEFAULT_MAX_CONCURRENT_TURNS = 4;
+var DEFAULT_TURN_TIMEOUT_MS = 3e5;
+var DAILY_LIMIT_RESPONSE = "This agent has reached its daily usage limit and will respond again after 00:00 UTC.";
+var READ_ONLY_TOOLS = /* @__PURE__ */ new Set(["echo", "web_search", "fetch_url", "sql_query", "current_time"]);
+function hasReadGrant(auth, toolName) {
+  return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "read");
+}
+function hasSideEffectGrant(auth, toolName) {
+  return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "side_effect");
+}
+function toolIsOffered(auth, toolName) {
+  if (READ_ONLY_TOOLS.has(toolName)) return hasReadGrant(auth, toolName);
+  if (toolName === "http_request") {
+    return hasReadGrant(auth, toolName) || hasSideEffectGrant(auth, toolName);
+  }
+  return false;
+}
+function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames, now = /* @__PURE__ */ new Date()) {
+  if (auth.sender_membership !== "active") {
+    return { allowed: false, reason: "Sender membership is not active" };
+  }
+  if (!offeredNames.has(toolName) || !toolIsOffered(auth, toolName)) {
+    return { allowed: false, reason: `Tool "${toolName}" has no active channel read grant` };
+  }
+  if (toolName === "http_request") {
+    try {
+      const args = JSON.parse(argumentsJson);
+      const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
+      if (method === "GET") {
+        if (!hasReadGrant(auth, toolName)) {
+          return { allowed: false, reason: `Tool "${toolName}" has no active channel read grant` };
+        }
+      } else {
+        if (!(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+          return { allowed: false, reason: `HTTP method "${method}" is not supported` };
+        }
+        const digest = operationSha256(toolName, args);
+        const grant = auth.tool_grants.find(
+          (candidate) => candidate.mode === "side_effect" && candidate.tool === toolName && candidate.operation_sha256 === digest
+        );
+        if (!grant) {
+          return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+        }
+        const expiresAt = Date.parse(grant.expires_at);
+        if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+          return { allowed: false, reason: "The confirmed operation grant is expired or invalid" };
+        }
+        return { allowed: true, reason: `Tool "${toolName}" has an exact confirmed operation grant`, sideEffect: grant };
+      }
+    } catch {
+      return { allowed: false, reason: "Tool arguments are not valid JSON" };
+    }
+  }
+  return { allowed: true, reason: `Tool "${toolName}" has an active channel read grant` };
+}
 function buildHandler(deps) {
   const maxIterations = deps.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+  const maxConcurrentTurns = deps.maxConcurrentTurns ?? DEFAULT_MAX_CONCURRENT_TURNS;
+  const turnTimeoutMs = deps.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
   const log = deps.log ?? (() => {
   });
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const { llm, memoryFor, skills, gate } = deps;
-  return async (m) => {
+  const channelTails = /* @__PURE__ */ new Map();
+  const slotWaiters = [];
+  let activeTurns = 0;
+  const limitNotified = /* @__PURE__ */ new Map();
+  function cancelledError() {
+    return new Error("Agent turn cancelled");
+  }
+  function waitUnlessAborted(gate2, signal) {
+    if (!signal) return gate2;
+    if (signal.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const onAbort = () => reject(cancelledError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      void gate2.then(() => {
+        signal.removeEventListener("abort", onAbort);
+        resolve3();
+      });
+    });
+  }
+  async function lockChannel(channelId, signal) {
+    const previous = channelTails.get(channelId) ?? Promise.resolve();
+    let release;
+    const mine = new Promise((resolve3) => {
+      release = resolve3;
+    });
+    const tail = previous.then(() => mine);
+    channelTails.set(channelId, tail);
+    let released = false;
+    const done = () => {
+      if (released) return;
+      released = true;
+      release();
+      if (channelTails.get(channelId) === tail) channelTails.delete(channelId);
+    };
+    try {
+      await waitUnlessAborted(previous, signal);
+    } catch (error) {
+      done();
+      throw error;
+    }
+    return done;
+  }
+  function acquireSlot(signal) {
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      activeTurns--;
+      slotWaiters.shift()?.();
+    };
+    if (activeTurns < maxConcurrentTurns) {
+      activeTurns++;
+      return Promise.resolve(release);
+    }
+    if (signal?.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const grant = () => {
+        signal?.removeEventListener("abort", onAbort);
+        activeTurns++;
+        resolve3(release);
+      };
+      const onAbort = () => {
+        const i = slotWaiters.indexOf(grant);
+        if (i >= 0) slotWaiters.splice(i, 1);
+        reject(cancelledError());
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      slotWaiters.push(grant);
+    });
+  }
+  function dailyLimitReply(channelId, day) {
+    if (limitNotified.get(channelId) === day) return null;
+    for (const [ch, d] of limitNotified) if (d !== day) limitNotified.delete(ch);
+    limitNotified.set(channelId, day);
+    log("warn", "turn.daily_limit_reply");
+    return DAILY_LIMIT_RESPONSE;
+  }
+  return async (m, upstreamSignal) => {
     const text = m.text?.trim() ? m.text : "";
     if (!text) return null;
-    log("info", `message from ${m.senderId.slice(0, 8)}: ${text.slice(0, 80)}`);
+    const mustWait = channelTails.has(m.channelId) || activeTurns >= maxConcurrentTurns;
+    if (mustWait) {
+      log("info", "turn.queued", {
+        same_channel: channelTails.has(m.channelId),
+        active_turns: activeTurns
+      });
+    }
+    const releaseChannel = await lockChannel(m.channelId, upstreamSignal);
+    let releaseSlot;
+    try {
+      releaseSlot = await acquireSlot(upstreamSignal);
+    } catch (error) {
+      releaseChannel();
+      throw error;
+    }
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(upstreamSignal?.reason);
+    if (upstreamSignal?.aborted) cancel();
+    else upstreamSignal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("turn deadline exceeded"));
+    }, turnTimeoutMs);
+    try {
+      return await runTurn(m, controller.signal);
+    } catch (error) {
+      if (error instanceof DailyLimitReachedError) return dailyLimitReply(m.channelId, error.day);
+      if (timedOut) throw new Error(`Agent turn timed out after ${turnTimeoutMs}ms`);
+      if (upstreamSignal?.aborted) throw cancelledError();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      upstreamSignal?.removeEventListener("abort", cancel);
+      releaseSlot();
+      releaseChannel();
+    }
+  };
+  async function runTurn(m, signal) {
+    const text = m.text;
+    log("info", "turn.message_received", { chars: text.length });
     const memory = memoryFor(m.channelId);
+    memory.replace(m.memory);
     const messages = [{ role: "system", content: deps.systemPromptFor() }];
     const recalled = await memory.recall(text);
     if (recalled) messages.push({ role: "system", content: recalled });
-    const longTerm = deps.longTermMemory?.() ?? null;
-    if (longTerm) messages.push({ role: "system", content: `Things you have remembered:
-${longTerm}` });
     messages.push(...memory.getHistory());
     messages.push({ role: "user", content: text });
     memory.addMessage({ role: "user", content: text });
-    const tools = deps.tools();
+    const tools = deps.tools().filter((tool) => toolIsOffered(m.authorization, tool.function.name));
+    const offeredNames = new Set(tools.map((tool) => tool.function.name));
     let response = null;
     for (let iteration = 0; iteration < maxIterations; iteration++) {
-      const result = await llm.complete(messages, tools.length > 0 ? tools : void 0);
+      const result = await llm.complete(messages, tools.length > 0 ? tools : void 0, { signal });
       if (result.toolCalls.length === 0) {
         response = result.content;
         break;
@@ -2106,23 +3194,43 @@ ${longTerm}` });
         content: result.content ?? "",
         tool_calls: result.toolCalls
       });
-      const verdicts = result.toolCalls.map((call) => ({
-        call,
-        verdict: gate.gate(call.function.name)
-      }));
+      const verdicts = result.toolCalls.map((call) => {
+        const channelVerdict = authorizeToolExecution(
+          m.authorization,
+          call.function.name,
+          call.function.arguments,
+          offeredNames,
+          now()
+        );
+        const localVerdict = channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict;
+        return {
+          call,
+          verdict: {
+            ...localVerdict,
+            ...localVerdict.allowed && channelVerdict.sideEffect ? { sideEffect: channelVerdict.sideEffect } : {}
+          }
+        };
+      });
       const allowed = verdicts.filter((v) => v.verdict.allowed).map((v) => v.call);
+      const sideEffects = new Map(
+        verdicts.flatMap(({ call, verdict }) => verdict.allowed && verdict.sideEffect ? [[call.id, verdict.sideEffect]] : [])
+      );
       for (const v of verdicts) {
         if (!v.verdict.allowed) {
-          log("warn", `tool call denied: ${v.call.function.name} \u2014 ${v.verdict.reason}`);
+          log("warn", "turn.tool_call_denied");
         }
       }
-      const executed = await runToolCalls(allowed, skills, { roomId: m.channelId });
+      const executed = await runToolCalls(allowed, skills, {
+        roomId: m.channelId,
+        signal,
+        sideEffects
+      });
       const byId = new Map(executed.map((r) => [r.tool_call_id, r]));
       for (const { call, verdict } of verdicts) {
         if (verdict.allowed) {
           const done = byId.get(call.id);
           if (done) {
-            messages.push({ role: "tool", content: capResult(done.content), tool_call_id: done.tool_call_id });
+            messages.push({ role: "tool", content: done.content, tool_call_id: done.tool_call_id });
             continue;
           }
           messages.push({
@@ -2140,29 +3248,172 @@ ${longTerm}` });
       }
     }
     if (!response) {
-      log("warn", `no final answer after ${maxIterations} iterations; dropping the turn`);
+      log("warn", "turn.no_final_answer", { iterations: maxIterations });
       return null;
     }
     memory.addMessage({ role: "assistant", content: response });
-    if (response.length > 50) {
-      try {
-        await memory.capture(
-          `User asked: "${text.slice(0, 100)}". Agent responded: "${response.slice(0, 200)}"`,
-          "conversation"
-        );
-      } catch (e) {
-        log("warn", `memory capture failed: ${e instanceof Error ? e.message : String(e)}`);
-      }
-    }
-    log("info", `response: ${response.slice(0, 80)}`);
+    log("info", "turn.response_ready", { chars: response.length });
     return response;
-  };
+  }
 }
 
 // src/persona.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync8, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/long-term-memory.ts
+import { createHash as createHash2 } from "node:crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync4, lstatSync, readFileSync as readFileSync7, readdirSync as readdirSync2, renameSync as renameSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+var MEMORY_FILE = "MEMORY.md";
+var QUARANTINE_MEMORY_FILE = "MEMORY.quarantined.md";
+var LEGACY_MEMORY_SOURCE_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_BYTES = 4 * 1024 * 1024;
+var LEGACY_MEMORY_REPORT_MAX_SOURCES = 100;
+function quarantineOrder(a, b) {
+  const index = (name) => {
+    const match = /^MEMORY\.quarantined(?:\.(\d+))?\.md$/.exec(name);
+    return match?.[1] ? Number(match[1]) + 1 : 0;
+  };
+  return index(a) - index(b) || a.localeCompare(b);
+}
+function sourceId(kind, channelId, path, bytes) {
+  return createHash2("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
+}
+function readLegacySource(path, kind, contentBudget, channelId) {
+  try {
+    let st = lstatSync(path);
+    if (st.isSymbolicLink() || !st.isFile()) return null;
+    if ((st.mode & 511) !== 384) {
+      chmodSync2(path, 384);
+      st = lstatSync(path);
+    }
+    if (st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES) {
+      const marker = Buffer.from(`oversize:${st.size}:${st.mtimeMs}:${st.ctimeMs}`, "utf8");
+      return {
+        id: sourceId(kind, channelId, path, marker),
+        kind,
+        ...channelId ? { channelId } : {},
+        path,
+        content: null,
+        bytes: st.size,
+        exportable: false
+      };
+    }
+    if (st.size > contentBudget) return null;
+    const bytes = readFileSync7(path);
+    if (bytes.byteLength > LEGACY_MEMORY_SOURCE_MAX_BYTES || bytes.byteLength > contentBudget) return null;
+    return {
+      id: sourceId(kind, channelId, path, bytes),
+      kind,
+      ...channelId ? { channelId } : {},
+      path,
+      content: bytes.toString("utf8"),
+      bytes: bytes.byteLength,
+      exportable: true
+    };
+  } catch {
+    return null;
+  }
+}
+function collectLegacyMemorySources(managedDir, dataDir) {
+  const sources = [];
+  const seen = /* @__PURE__ */ new Set();
+  let contentBudget = LEGACY_MEMORY_REPORT_MAX_BYTES;
+  const add = (path, kind, channelId) => {
+    if (sources.length >= LEGACY_MEMORY_REPORT_MAX_SOURCES) return;
+    const source = readLegacySource(path, kind, contentBudget, channelId);
+    if (!source) return;
+    sources.push(source);
+    if (source.exportable) contentBudget -= source.bytes;
+  };
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    let names;
+    try {
+      names = readdirSync2(dir);
+    } catch {
+      continue;
+    }
+    for (const name of names.sort(quarantineOrder)) {
+      if (!/^MEMORY\.quarantined(?:\.\d+)?\.md$/.test(name)) continue;
+      const path = join6(dir, name);
+      if (seen.has(path)) continue;
+      seen.add(path);
+      add(path, "global-memory");
+    }
+  }
+  const channelsDir = join6(dataDir, "channels");
+  let channelNames;
+  try {
+    channelNames = readdirSync2(channelsDir);
+  } catch {
+    channelNames = [];
+  }
+  for (const channelId of channelNames.sort()) {
+    const channelDir = join6(channelsDir, channelId);
+    for (const [name, kind] of [
+      ["conversation-history.json", "conversation-history"],
+      ["memories.json", "captured-memory"]
+    ]) {
+      add(join6(channelDir, name), kind, channelId);
+    }
+  }
+  return sources;
+}
+function legacyMemoryFingerprint(managedDir, dataDir) {
+  const metadata = [];
+  const add = (path) => {
+    try {
+      const st = lstatSync(path);
+      if (!st.isFile() || st.isSymbolicLink()) return;
+      metadata.push(`${path}\0${st.size}\0${st.mtimeMs}\0${st.ctimeMs}`);
+    } catch {
+    }
+  };
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    try {
+      for (const name of readdirSync2(dir).sort(quarantineOrder)) {
+        if (/^MEMORY\.quarantined(?:\.\d+)?\.md$/.test(name)) add(join6(dir, name));
+      }
+    } catch {
+    }
+  }
+  try {
+    const channelsDir = join6(dataDir, "channels");
+    for (const channelId of readdirSync2(channelsDir).sort()) {
+      add(join6(channelsDir, channelId, "conversation-history.json"));
+      add(join6(channelsDir, channelId, "memories.json"));
+    }
+  } catch {
+  }
+  return createHash2("sha256").update(metadata.join("\n")).digest("hex");
+}
+function nextQuarantinePath(dir) {
+  const first = join6(dir, QUARANTINE_MEMORY_FILE);
+  if (!existsSync4(first)) return first;
+  for (let n = 1; ; n++) {
+    const candidate = join6(dir, `MEMORY.quarantined.${n}.md`);
+    if (!existsSync4(candidate)) return candidate;
+  }
+}
+function quarantineLegacyMemory(managedDir, dataDir) {
+  const moved = [];
+  for (const dir of /* @__PURE__ */ new Set([managedDir, dataDir])) {
+    const source = join6(dir, MEMORY_FILE);
+    if (!existsSync4(source)) continue;
+    if (lstatSync(source).isSymbolicLink()) {
+      throw new Error(`refusing to quarantine symlinked legacy memory: ${source}`);
+    }
+    const target = nextQuarantinePath(dir);
+    renameSync2(source, target);
+    chmodSync2(target, 384);
+    moved.push(target);
+  }
+  return moved;
+}
+
+// src/persona.ts
 var PERSONA_MAX_BYTES = 8192;
 var PERSONA_SOURCES = [
   { file: "IDENTITY.md", heading: "## Identity" },
@@ -2177,7 +3428,7 @@ var SAFETY_PREAMBLE = [
   "- Only use the tools you were given; do not invent capabilities."
 ].join("\n");
 function defaultPersonaDir() {
-  return join8(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
+  return join7(dirname5(fileURLToPath2(import.meta.url)), "..", "persona");
 }
 function assemblePrompt(parts) {
   return parts.map((p) => `${p.heading}
@@ -2191,12 +3442,12 @@ function loadPersona(dirs) {
     let body;
     try {
       body = readFileSync8(path, "utf8");
-    } catch {
-      console.warn(`[persona] cannot read ${path}; ignoring it`);
+    } catch (error) {
+      writeServiceLog("warn", "persona.read_failed", {}, error);
       continue;
     }
     if (Buffer.byteLength(body, "utf8") > PERSONA_MAX_BYTES) {
-      console.warn(`[persona] ${path} is larger than ${PERSONA_MAX_BYTES} bytes; truncating`);
+      writeServiceLog("warn", "persona.truncated", { max_bytes: PERSONA_MAX_BYTES });
       body = body.slice(0, PERSONA_MAX_BYTES);
     }
     const trimmed = body.trim();
@@ -2210,29 +3461,32 @@ function systemPromptFor(dirs, fallback) {
 ${SAFETY_PREAMBLE}`;
 }
 function writeLocalConfigReport(managedDir, dataDir, now, flags) {
-  if (!existsSync6(managedDir)) return false;
+  if (!existsSync5(managedDir)) return false;
   const persona = {};
   for (const { file } of PERSONA_SOURCES) {
-    const path2 = join8(dataDir, file);
-    if (!existsSync6(path2)) continue;
+    const path2 = join7(dataDir, file);
+    if (!existsSync5(path2)) continue;
     try {
       persona[file] = readFileSync8(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
     } catch {
     }
   }
   const doc = {
-    schema: "securecoms.local-config/1",
+    schema: "securecoms.local-config/2",
     written_at: now.toISOString(),
     has_search_key: flags.hasSearchKey,
     has_llm_key: flags.hasLlmKey,
-    persona
+    persona,
+    // Paths stay in this owner-only local handoff file. The daemon validates
+    // each source again and strips `path` before reporting anything upstream.
+    legacy_memory: collectLegacyMemorySources(managedDir, dataDir)
   };
-  const path = join8(managedDir, "local-config.json");
+  const path = join7(managedDir, "local-config.json");
   const tmp = `${path}.${process.pid}.tmp`;
   try {
-    writeFileSync3(tmp, `${JSON.stringify(doc, null, 2)}
+    writeFileSync2(tmp, `${JSON.stringify(doc, null, 2)}
 `, { mode: 384 });
-    renameSync(tmp, path);
+    renameSync3(tmp, path);
   } catch (e) {
     try {
       unlinkSync(tmp);
@@ -2246,12 +3500,12 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
   const written = [];
   const skipped = [];
   for (const { file } of PERSONA_SOURCES) {
-    const target = join8(dataDir, file);
+    const target = join7(dataDir, file);
     if (exists(target)) {
       skipped.push(target);
       continue;
     }
-    writeFile(target, readFileSync8(join8(defaultsDir, file), "utf8"));
+    writeFile(target, readFileSync8(join7(defaultsDir, file), "utf8"));
     written.push(target);
   }
   return { written, skipped };
@@ -2259,11 +3513,17 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
 function createLocalConfigReporter(managedDir, dataDir, now) {
   let lastWritten = null;
   return (flags) => {
-    if (lastWritten !== null && lastWritten.hasSearchKey === flags.hasSearchKey && lastWritten.hasLlmKey === flags.hasLlmKey) {
+    const legacyFingerprint = legacyMemoryFingerprint(managedDir, dataDir);
+    if (lastWritten !== null && lastWritten.hasSearchKey === flags.hasSearchKey && lastWritten.hasLlmKey === flags.hasLlmKey && lastWritten.legacyFingerprint === legacyFingerprint) {
       return false;
     }
     const wrote = writeLocalConfigReport(managedDir, dataDir, now(), flags);
-    if (wrote) lastWritten = { ...flags };
+    if (wrote) {
+      lastWritten = {
+        ...flags,
+        legacyFingerprint: legacyMemoryFingerprint(managedDir, dataDir)
+      };
+    }
     return wrote;
   };
 }
@@ -2277,36 +3537,34 @@ function installWarningFilter(proc = process) {
     proc.removeListener("warning", listener);
   }
   proc.on("warning", (w) => {
-    if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
-    console.error(w.stack ?? `${w.name}: ${w.message}`);
+    try {
+      if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
+    } catch {
+    }
+    writeServiceLog("warn", "runtime.node_warning", {}, w);
   });
 }
 
 // src/index.ts
 if (process.argv.includes("--version")) {
-  const pkg = JSON.parse(readFileSync9(join9(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync9(join8(dirname6(dirname6(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
   console.log(pkg.version);
   process.exit(0);
 }
 var LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
 function makeLogger(cfg) {
   const floor = LEVEL_RANK[cfg.logLevel];
-  return (level, msg) => {
+  return (level, event, fields, error) => {
     if (LEVEL_RANK[level] < floor) return;
-    const line = `[runtime] ${level}: ${msg}`;
-    if (level === "warn" || level === "error") console.error(line);
-    else console.log(line);
+    writeServiceLog(level, event, fields, error);
   };
 }
-function safeChannelSegment(channelId) {
-  return channelId.replace(/[^A-Za-z0-9_-]/g, "_") || "_";
-}
 function realLlmSourceDeps() {
   return {
     home: homedir4(),
     readFile: (p) => readFileSync9(p, "utf8"),
     statFile: (p) => ({ mode: statSync2(p).mode }),
-    exists: (p) => existsSync7(p)
+    exists: (p) => existsSync6(p)
   };
 }
 function realServiceDeps() {
@@ -2316,10 +3574,10 @@ function realServiceDeps() {
       const r = spawnSync(cmd, args, { encoding: "utf8" });
       return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
     },
-    writeFile: (p, data) => writeFileSync4(p, data, { mode: 420 }),
+    writeFile: (p, data) => writeFileSync3(p, data, { mode: 420 }),
     removeFile: (p) => rmSync(p, { force: true }),
     mkdirp: (p) => mkdirSync3(p, { recursive: true }),
-    fileExists: (p) => existsSync7(p),
+    fileExists: (p) => existsSync6(p),
     canRead: (p) => {
       try {
         accessSync(p, constants.R_OK);
@@ -2334,7 +3592,7 @@ function realServiceDeps() {
 function realResolveNodeDeps() {
   return {
     realpath: (p) => realpathSync(p),
-    fileExists: (p) => existsSync7(p),
+    fileExists: (p) => existsSync6(p),
     nodeMajorOf: (p) => {
       const r = spawnSync(p, ["--version"], { encoding: "utf8" });
       if (r.status !== 0) return null;
@@ -2415,6 +3673,46 @@ async function main() {
   installWarningFilter();
   const verb = parseVerb(process.argv);
   if (verb) runServiceVerb(verb);
+  const sideEffectsVerb = parseSideEffectsVerb(process.argv);
+  if (process.argv[2] === "side-effects" && !sideEffectsVerb) {
+    console.error("securecoms-agent: side-effects requires list or resolve");
+    process.exit(2);
+  }
+  if (sideEffectsVerb) {
+    let cfgForLedger;
+    try {
+      cfgForLedger = loadConfig(process.argv.slice(2), process.env);
+    } catch (e) {
+      console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+      process.exit(2);
+      return;
+    }
+    const ledger = new SideEffectLedger(join8(cfgForLedger.dataDir, "side-effect-ledger.sqlite"));
+    try {
+      if (sideEffectsVerb === "list") {
+        console.log(JSON.stringify({ ambiguous: ledger.listAmbiguous() }, null, 2));
+      } else {
+        const flags = parseSideEffectResolveFlags(process.argv);
+        if (!flags.idempotencyKey || !flags.operationSha256 || !/^[0-9a-f]{64}$/.test(flags.operationSha256) || !flags.confirmationId || !flags.outcome) {
+          throw new Error(
+            "resolve requires --idempotency-key, --operation-sha256, --confirmation-id, and --outcome completed|not_applied"
+          );
+        }
+        ledger.reconcile({
+          idempotency_key: flags.idempotencyKey,
+          operation_sha256: flags.operationSha256,
+          confirmation_id: flags.confirmationId
+        }, flags.outcome, /* @__PURE__ */ new Date());
+        console.log(JSON.stringify({ reconciled: true, outcome: flags.outcome }));
+      }
+    } catch (e) {
+      console.error(`securecoms-agent: side-effects ${sideEffectsVerb} failed: ${e instanceof Error ? e.message : String(e)}`);
+      process.exitCode = 1;
+    } finally {
+      ledger.close();
+    }
+    process.exit(process.exitCode ?? 0);
+  }
   const personaVerb = parsePersonaVerb(process.argv);
   if (personaVerb) {
     let cfgForPersona;
@@ -2430,8 +3728,8 @@ async function main() {
       const r = personaInit(
         cfgForPersona.dataDir,
         defaultPersonaDir(),
-        (p, d) => writeFileSync4(p, d, { mode: 384 }),
-        (p) => existsSync7(p)
+        (p, d) => writeFileSync3(p, d, { mode: 384 }),
+        (p) => existsSync6(p)
       );
       for (const p of r.written) console.log(`wrote ${p}`);
       for (const p of r.skipped) console.log(`kept ${p} (already exists)`);
@@ -2449,17 +3747,32 @@ async function main() {
   try {
     cfg = loadConfig(process.argv.slice(2), process.env);
   } catch (e) {
-    console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+    const argv = process.argv.slice(2);
+    const hasIdentityArg = argv.some(
+      (arg, index) => arg === "--identity" && !!argv[index + 1] || arg.startsWith("--identity=") && arg.length > 11
+    );
+    writeServiceLog(
+      "error",
+      !hasIdentityArg && !process.env.SECURECOMS_IDENTITY ? "runtime.identity_required.use_--identity" : "runtime.config_invalid",
+      {},
+      e
+    );
     process.exit(2);
     return;
   }
   const log = makeLogger(cfg);
-  const llm = buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+  const budget = new DailyLlmBudget({
+    callLimit: cfg.llmDailyCallLimit ?? DEFAULT_DAILY_CALL_LIMIT,
+    tokenLimit: cfg.llmDailyTokenLimit ?? DEFAULT_DAILY_TOKEN_LIMIT,
+    statePath: join8(cfg.dataDir, `llm-budget-${cfg.identityId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`),
+    log
+  });
+  const llm = withDailyBudget(buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()), budget);
   const memories = /* @__PURE__ */ new Map();
   const memoryFor = (channelId) => {
     let mem = memories.get(channelId);
     if (!mem) {
-      mem = new AgentMemory(join9(cfg.dataDir, "channels", safeChannelSegment(channelId)));
+      mem = new AgentMemory();
       memories.set(channelId, mem);
     }
     return mem;
@@ -2479,21 +3792,32 @@ async function main() {
     if (!path) return null;
     try {
       return readFileSync9(path, "utf8").trim() || null;
-    } catch {
-      log("warn", `cannot read the ${which} key file ${path}`);
+    } catch (e) {
+      log("warn", "runtime.search_key_unreadable", { provider_brave: which === "brave" }, e);
       return null;
     }
   };
   const configDirs = configSearchPath(cfg.identityId, cfg.dataDir);
-  const hasSearchKey = () => hasReadableKeyFile([keyFilePath("brave"), keyFilePath("tavily")], (p) => readFileSync9(p, "utf8"));
+  const reportSearchKeyGate = searchKeyGateReporter(log, (p) => p === keyFilePath("brave"));
+  const hasSearchKey = () => hasReadableKeyFile(
+    [keyFilePath("brave"), keyFilePath("tavily")],
+    (p) => readFileSync9(p, "utf8"),
+    reportSearchKeyGate
+  );
+  const reportLlmSourceUnresolved = failureEpisodeReporter(
+    (e) => log("warn", "runtime.llm_source_unresolved", {}, e)
+  );
   const hasLlmKey = () => {
     try {
-      return hasLlmKeyFor(resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()));
-    } catch {
+      const source = resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+      reportLlmSourceUnresolved.succeeded();
+      return hasLlmKeyFor(source);
+    } catch (e) {
+      reportLlmSourceUnresolved.failed(e);
       return false;
     }
   };
-  migrateMemoryIntoManaged(managedDir, cfg.dataDir);
+  quarantineLegacyMemory(managedDir, cfg.dataDir);
   const reportLocalConfig = createLocalConfigReporter(managedDir, cfg.dataDir, () => /* @__PURE__ */ new Date());
   reportLocalConfig({ hasSearchKey: hasSearchKey(), hasLlmKey: hasLlmKey() });
   const builtinCtx = {
@@ -2508,49 +3832,54 @@ async function main() {
     now: () => /* @__PURE__ */ new Date(),
     log
   };
-  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx);
+  const sideEffectLedger = new SideEffectLedger(join8(cfg.dataDir, "side-effect-ledger.sqlite"));
+  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx, sideEffectLedger);
   skills.loadSkills();
   const policyFor = () => resolveToolPolicy(cfg.toolGateEnv, currentSkillsConfig().tools, {
     default: cfg.toolGate.default,
     allow: DEFAULT_TOOL_ALLOW
   });
   const gate = createDynamicToolGate(policyFor);
-  const offeredTools = () => {
+  const installationEligibleTools = () => {
     const sc = currentSkillsConfig();
     const g = createLocalToolGate(policyFor());
     const searchKey = hasSearchKey();
     reportLocalConfig({ hasSearchKey: searchKey, hasLlmKey: hasLlmKey() });
     return skills.available(requiresEnvFrom(sc, searchKey)).filter((t) => g.gate(t.function.name).allowed);
   };
-  for (const held of skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey()))) {
-    console.log(`unavailable: ${held.name} (missing ${held.missing.join(", ")})`);
-  }
+  const unavailableCount = skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey())).length;
+  if (unavailableCount > 0) log("info", "runtime.skills_unavailable", { count: unavailableCount });
   const plane = createSecureComsDataPlane(
-    { identityId: cfg.identityId, log: (level, msg) => log(level, msg) },
+    // Final-wave I2: the daily-limit reply is a notice, not an agent turn.
+    { identityId: cfg.identityId, log, noticeReplies: /* @__PURE__ */ new Set([DAILY_LIMIT_RESPONSE]) },
     buildHandler({
       llm,
       memoryFor,
       skills,
       gate,
       log,
-      // All of these are read PER TURN: a persona edit, a new remembered fact, a
-      // key file dropped in, or configuration saved in the web app takes effect
-      // on the next message, with no restart.
+      // All of these are read PER TURN: a persona edit, a key file dropped in,
+      // or configuration saved in the web app takes effect on the next message,
+      // with no restart.
       systemPromptFor: () => systemPromptFor(configDirs, DEFAULT_SYSTEM_PROMPT),
-      longTermMemory: () => readLongTermMemory(configDirs),
-      tools: offeredTools
+      tools: installationEligibleTools
     })
   );
-  console.log(
-    `${bootLine(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps())}, ${offeredTools().length} skills, tool gate default=${cfg.toolGate.default}`
-  );
+  log("info", "runtime.started", {
+    configured_skills: installationEligibleTools().length,
+    tool_gate_default_deny: cfg.toolGate.default === "deny"
+  });
   await plane.start();
   const shutdown = () => {
-    log("info", "shutting down");
+    log("info", "runtime.shutting_down");
     plane.stop();
+    sideEffectLedger.close();
     process.exit(0);
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 }
-void main();
+void main().catch((error) => {
+  writeServiceLog("error", "runtime.fatal", {}, error);
+  process.exit(1);
+});