@securecoms/agent-runtime 0.7.0 → 0.9.0

package/dist/bin.js

@@ -1,17 +1,375 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname6, join as join8 } from "node:path";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync6, mkdirSync, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6, mkdirSync as mkdirSync3, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir4, userInfo } from "node:os";
 
 // src/config.ts
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname as dirname2, join } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/service-log.ts
+var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+function errorClass(error) {
+  if (error === null) return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog(level, event, fields = {}, error) {
+  const safeEvent = TOKEN.test(event) ? event : "invalid_event";
+  const parts = [`[runtime] ${level} ${safeEvent}`];
+  for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN.test(key)) continue;
+    if (typeof value === "boolean") parts.push(`${key}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+  }
+  if (error !== void 0) parts.push(`error_class=${errorClass(error)}`);
+  return parts.join(" ");
+}
+function failureEpisodeReporter(warn) {
+  let lastClass = null;
+  return {
+    failed(error) {
+      const cls = errorClass(error);
+      if (cls === lastClass) return;
+      lastClass = cls;
+      try {
+        warn(error);
+      } catch {
+      }
+    },
+    succeeded() {
+      lastClass = null;
+    }
+  };
+}
+function writeServiceLog(level, event, fields, error) {
+  const line = formatServiceLog(level, event, fields, error);
+  if (level === "error") console.error(line);
+  else if (level === "warn") console.warn(line);
+  else console.log(line);
+}
+
+// src/llm-dispatch.ts
+var LLM_REQUEST_MAX_BYTES = 128 * 1024;
+var LLM_RESPONSE_MAX_BYTES = 128 * 1024;
+var LLM_REQUEST_TIMEOUT_MS = 18e4;
+var DEFAULT_MAX_OUTPUT_TOKENS = 8192;
+var CAP_REJECTED_MAX = 256;
+var capRejectedModels = /* @__PURE__ */ new Set();
+var CAP_ERROR_SCAN_BYTES = 16 * 1024;
+var CAP_FIELD_NAMED = /max_(?:completion_|output_)?tokens/i;
+var CONTEXT_OVERFLOW_NAMED = /prompt|context|input[\s_-]*(?:length|tokens)/i;
+async function errorNamesOutputCap(resp) {
+  const reader = resp.body?.getReader();
+  if (!reader) return false;
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < CAP_ERROR_SCAN_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } catch {
+    return false;
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+  const text = new TextDecoder().decode(Buffer.concat(chunks).subarray(0, CAP_ERROR_SCAN_BYTES));
+  return CAP_FIELD_NAMED.test(text) && !CONTEXT_OVERFLOW_NAMED.test(text);
+}
+function outputCapField(endpoint) {
+  try {
+    return new URL(endpoint).hostname === "api.openai.com" ? "max_completion_tokens" : "max_tokens";
+  } catch {
+    return "max_tokens";
+  }
+}
+function normalizeEndpoint(endpoint) {
+  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+var LLMDispatcher = class {
+  endpoint;
+  model;
+  apiKey;
+  chatPath;
+  chatAuth;
+  authHeaderName;
+  fetch;
+  timeoutMs;
+  requestMaxBytes;
+  responseMaxBytes;
+  maxOutputTokens;
+  log;
+  constructor(endpoint, model, opts = {}) {
+    this.endpoint = normalizeEndpoint(endpoint);
+    this.model = model;
+    this.apiKey = opts.apiKey;
+    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
+    this.chatAuth = opts.chatAuth ?? "bearer";
+    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
+    this.fetch = opts.fetch ?? fetch;
+    this.timeoutMs = opts.timeoutMs ?? LLM_REQUEST_TIMEOUT_MS;
+    this.requestMaxBytes = opts.requestMaxBytes ?? LLM_REQUEST_MAX_BYTES;
+    this.responseMaxBytes = opts.responseMaxBytes ?? LLM_RESPONSE_MAX_BYTES;
+    this.maxOutputTokens = opts.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
+    this.log = opts.log ?? writeServiceLog;
+  }
+  async complete(messages, tools, options = {}) {
+    const body = {
+      model: this.model,
+      messages,
+      stream: false
+    };
+    const capKey = `${this.endpoint}\0${this.model}`;
+    const capField = outputCapField(this.endpoint);
+    if (tools && tools.length > 0) {
+      body.tools = tools;
+    }
+    const url = `${this.endpoint}${this.chatPath}`;
+    const headers = { "Content-Type": "application/json" };
+    if (this.apiKey && this.chatAuth === "bearer") {
+      headers.Authorization = `Bearer ${this.apiKey}`;
+    } else if (this.apiKey && this.chatAuth === "x-api-key") {
+      headers[this.authHeaderName] = this.apiKey;
+    }
+    const encode = (withCap2) => {
+      const encoded = JSON.stringify(withCap2 ? { ...body, [capField]: this.maxOutputTokens } : body);
+      if (Buffer.byteLength(encoded, "utf8") > this.requestMaxBytes) {
+        throw new Error("LLM request exceeded the size limit");
+      }
+      return encoded;
+    };
+    let withCap = !capRejectedModels.has(capKey);
+    let encodedBody = encode(withCap);
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(options.signal?.reason);
+    if (options.signal?.aborted) cancel();
+    else options.signal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("LLM request deadline exceeded"));
+    }, this.timeoutMs);
+    try {
+      const post = () => this.fetch(url, {
+        method: "POST",
+        headers,
+        body: encodedBody,
+        signal: controller.signal,
+        redirect: "error"
+      });
+      let resp = await post();
+      if (resp.status === 400 && withCap && await errorNamesOutputCap(resp)) {
+        if (capRejectedModels.size >= CAP_REJECTED_MAX) {
+          const oldest = capRejectedModels.values().next();
+          if (!oldest.done) capRejectedModels.delete(oldest.value);
+        }
+        capRejectedModels.add(capKey);
+        this.log("warn", "llm.output_cap_rejected", {});
+        withCap = false;
+        encodedBody = encode(false);
+        resp = await post();
+      }
+      if (!resp.ok) {
+        await resp.body?.cancel();
+        throw new Error(`LLM request failed (${resp.status})`);
+      }
+      const data = await readJsonCapped(resp, this.responseMaxBytes);
+      const choice = data.choices?.[0];
+      if (!choice) throw new Error("LLM returned no choices");
+      const totalTokens = data.usage?.total_tokens;
+      return {
+        content: choice.message.content,
+        toolCalls: choice.message.tool_calls || [],
+        finishReason: choice.finish_reason,
+        ...typeof totalTokens === "number" && Number.isFinite(totalTokens) && totalTokens >= 0 ? { usage: { totalTokens } } : {}
+      };
+    } catch (error) {
+      if (timedOut) throw new Error(`LLM request timed out after ${this.timeoutMs}ms`);
+      if (options.signal?.aborted) throw new Error("LLM request cancelled");
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", cancel);
+    }
+  }
+};
+async function readJsonCapped(resp, maxBytes) {
+  const reader = resp.body?.getReader();
+  if (!reader) throw new Error("LLM returned an empty response");
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => {
+        });
+        throw new Error("LLM response exceeded the size limit");
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {
+    });
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const joined = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    joined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(joined));
+}
+
+// src/llm-budget.ts
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+var DEFAULT_DAILY_CALL_LIMIT = 2e3;
+var DEFAULT_DAILY_TOKEN_LIMIT = 5e6;
+var DailyLimitReachedError = class extends Error {
+  constructor(day) {
+    super("daily LLM budget reached");
+    this.day = day;
+    this.name = "DailyLimitReachedError";
+  }
+};
+function utcDay(d) {
+  return d.toISOString().slice(0, 10);
+}
+var DailyLlmBudget = class {
+  callLimit;
+  tokenLimit;
+  statePath;
+  now;
+  log;
+  state;
+  exhaustionLoggedFor = null;
+  constructor(opts) {
+    this.callLimit = opts.callLimit;
+    this.tokenLimit = opts.tokenLimit;
+    this.statePath = opts.statePath;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+    this.log = opts.log ?? (() => {
+    });
+    this.state = this.load();
+  }
+  /**
+   * Reserve one provider call against today's budget, or throw
+   * {@link DailyLimitReachedError} without reserving anything.
+   */
+  beginCall() {
+    this.roll();
+    const { calls, tokens, day } = this.state;
+    const callsSpent = this.callLimit > 0 && calls >= this.callLimit;
+    const tokensSpent = this.tokenLimit > 0 && tokens >= this.tokenLimit;
+    if (callsSpent || tokensSpent) {
+      if (this.exhaustionLoggedFor !== day) {
+        this.exhaustionLoggedFor = day;
+        this.log("warn", "llm.daily_budget_exhausted", {
+          calls,
+          tokens,
+          call_limit: this.callLimit,
+          token_limit: this.tokenLimit
+        });
+      }
+      throw new DailyLimitReachedError(day);
+    }
+    this.state.calls++;
+    this.save();
+  }
+  /** Add provider-reported tokens to today's total. */
+  recordTokens(totalTokens) {
+    if (!Number.isFinite(totalTokens) || totalTokens <= 0) return;
+    this.roll();
+    this.state.tokens += Math.floor(totalTokens);
+    this.save();
+  }
+  snapshot() {
+    this.roll();
+    return { ...this.state };
+  }
+  roll() {
+    const today = utcDay(this.now());
+    if (this.state.day !== today) this.state = { day: today, calls: 0, tokens: 0 };
+  }
+  load() {
+    const fresh = { day: utcDay(this.now()), calls: 0, tokens: 0 };
+    if (!this.statePath) return fresh;
+    let raw;
+    try {
+      raw = readFileSync(this.statePath, "utf8");
+    } catch {
+      return fresh;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.day === fresh.day && Number.isInteger(parsed.calls) && parsed.calls >= 0 && Number.isInteger(parsed.tokens) && parsed.tokens >= 0) {
+        return { day: fresh.day, calls: parsed.calls, tokens: parsed.tokens };
+      }
+      return fresh;
+    } catch (error) {
+      this.log("warn", "llm.budget_state_unreadable", {}, error);
+      return fresh;
+    }
+  }
+  save() {
+    if (!this.statePath) return;
+    try {
+      mkdirSync(dirname(this.statePath), { recursive: true });
+      const tmp = `${this.statePath}.tmp`;
+      writeFileSync(tmp, JSON.stringify(this.state), { mode: 384 });
+      renameSync(tmp, this.statePath);
+    } catch (error) {
+      this.log("warn", "llm.budget_state_write_failed", {}, error);
+    }
+  }
+};
+function withDailyBudget(llm, budget) {
+  return {
+    async complete(messages, tools, options) {
+      budget.beginCall();
+      const result = await llm.complete(messages, tools, options);
+      if (result.usage) budget.recordTokens(result.usage.totalTokens);
+      return result;
+    }
+  };
+}
+
+// src/config.ts
 var MISSING_IDENTITY_MESSAGE = "Missing agent identity: pass --identity <id> or set SECURECOMS_IDENTITY";
 var LOG_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var TOOL_DEFAULTS = /* @__PURE__ */ new Set(["allow", "deny"]);
@@ -48,8 +406,16 @@ function parseList(value) {
   const items = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
   return items.length > 0 ? items : void 0;
 }
+function parseIntSetting(env, name, fallback, min) {
+  const raw = env[name]?.trim();
+  if (!raw) return fallback;
+  if (!/^\d+$/.test(raw) || Number(raw) < min || !Number.isSafeInteger(Number(raw))) {
+    throw new Error(`Invalid ${name} "${raw}": expected a whole number >= ${min}`);
+  }
+  return Number(raw);
+}
 function defaultSkillsDir() {
-  return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+  return join(dirname2(fileURLToPath(import.meta.url)), "..", "skills");
 }
 var DEFAULT_TOOL_ALLOW = [
   "echo",
@@ -99,7 +465,10 @@ function loadConfig(argv, env) {
     toolGateEnv: {
       ...parsedAllow !== void 0 ? { allow: parsedAllow } : {},
       ...deny !== void 0 ? { deny } : {}
-    }
+    },
+    llmMaxOutputTokens: parseIntSetting(env, "SECURECOMS_LLM_MAX_OUTPUT_TOKENS", DEFAULT_MAX_OUTPUT_TOKENS, 1),
+    llmDailyCallLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_CALL_LIMIT", DEFAULT_DAILY_CALL_LIMIT, 0),
+    llmDailyTokenLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_TOKEN_LIMIT", DEFAULT_DAILY_TOKEN_LIMIT, 0)
   };
 }
 
@@ -154,9 +523,23 @@ function parsePersonaVerb(argv) {
   const sub = argv[3];
   return sub === "init" || sub === "show" ? sub : null;
 }
+function parseSideEffectsVerb(argv) {
+  if (argv[2] !== "side-effects") return null;
+  const sub = argv[3];
+  return sub === "list" || sub === "resolve" ? sub : null;
+}
+function parseSideEffectResolveFlags(argv) {
+  const outcome = flagOrEnv(argv, "--outcome", {});
+  return {
+    idempotencyKey: flagOrEnv(argv, "--idempotency-key", {}),
+    operationSha256: flagOrEnv(argv, "--operation-sha256", {}),
+    confirmationId: flagOrEnv(argv, "--confirmation-id", {}),
+    outcome: outcome === "completed" || outcome === "not_applied" ? outcome : void 0
+  };
+}
 
 // src/service/install.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 
 // src/service/config.ts
 import { isAbsolute, resolve } from "node:path";
@@ -388,8 +771,8 @@ function installService(input, deps) {
   const plan = prepareInstall(input, deps.platform, deps);
   const keyFile = plan.keyFile;
   if (deps.platform === "darwin") {
-    deps.mkdirp(dirname2(cfg.plistPath));
-    deps.mkdirp(dirname2(cfg.logPath));
+    deps.mkdirp(dirname3(cfg.plistPath));
+    deps.mkdirp(dirname3(cfg.logPath));
     deps.writeFile(cfg.plistPath, plan.contents);
     deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
     requireOk(deps.run("launchctl", ["bootstrap", `gui/${cfg.uid}`, cfg.plistPath]), "launchctl bootstrap");
@@ -397,7 +780,7 @@ function installService(input, deps) {
     return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, ...keyFile ? { keyFile } : {} };
   }
   if (deps.platform === "linux") {
-    deps.mkdirp(dirname2(cfg.unitPath));
+    deps.mkdirp(dirname3(cfg.unitPath));
     deps.writeFile(cfg.unitPath, plan.contents);
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
@@ -431,63 +814,6 @@ function uninstallService(input, deps) {
   throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
 }
 
-// src/llm-dispatch.ts
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
-}
-var LLMDispatcher = class {
-  endpoint;
-  model;
-  apiKey;
-  chatPath;
-  chatAuth;
-  authHeaderName;
-  constructor(endpoint, model, opts = {}) {
-    this.endpoint = normalizeEndpoint(endpoint);
-    this.model = model;
-    this.apiKey = opts.apiKey;
-    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
-    this.chatAuth = opts.chatAuth ?? "bearer";
-    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
-  }
-  async complete(messages, tools) {
-    const body = {
-      model: this.model,
-      messages,
-      stream: false
-    };
-    if (tools && tools.length > 0) {
-      body.tools = tools;
-    }
-    const url = `${this.endpoint}${this.chatPath}`;
-    const headers = { "Content-Type": "application/json" };
-    if (this.apiKey && this.chatAuth === "bearer") {
-      headers.Authorization = `Bearer ${this.apiKey}`;
-    } else if (this.apiKey && this.chatAuth === "x-api-key") {
-      headers[this.authHeaderName] = this.apiKey;
-    }
-    const resp = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
-    });
-    if (!resp.ok) {
-      await resp.body?.cancel();
-      throw new Error(`LLM request failed (${resp.status})`);
-    }
-    const data = await resp.json();
-    const choice = data.choices?.[0];
-    if (!choice) {
-      throw new Error("LLM returned no choices");
-    }
-    return {
-      content: choice.message.content,
-      toolCalls: choice.message.tool_calls || [],
-      finishReason: choice.finish_reason
-    };
-  }
-};
-
 // src/llm-source.ts
 import { join as join2 } from "node:path";
 
@@ -661,34 +987,20 @@ function resolveLlmSource(cfg, explicit, deps) {
 }
 
 // src/llm-shim.ts
-function endpointHost(endpoint) {
-  try {
-    return new URL(endpoint).host;
-  } catch {
-    return "(unparseable endpoint)";
-  }
-}
 function buildLlmShim(cfg, explicit, deps) {
   return {
-    async complete(messages, tools) {
+    async complete(messages, tools, options) {
       const src = resolveLlmSource(cfg, explicit, deps);
       const dispatcher = new LLMDispatcher(src.endpoint, src.model, {
         apiKey: src.apiKey,
         chatPath: src.chatPath,
-        chatAuth: src.chatAuth
+        chatAuth: src.chatAuth,
+        maxOutputTokens: cfg.llmMaxOutputTokens
       });
-      return dispatcher.complete(messages, tools);
+      return dispatcher.complete(messages, tools, options);
     }
   };
 }
-function bootLine(cfg, explicit, deps) {
-  try {
-    const src = resolveLlmSource(cfg, explicit, deps);
-    return `securecoms-agent ${cfg.identityId.slice(0, 8)} \u2192 llm source=${src.origin} ${endpointHost(src.endpoint)} (${src.model})`;
-  } catch (e) {
-    return `llm: source unavailable \u2014 ${e instanceof Error ? e.message : String(e)}`;
-  }
-}
 
 // src/memory.ts
 var MAX_HISTORY = 50;
@@ -742,7 +1054,7 @@ ${scored.map((entry) => `- ${entry.content}`).join("\n")}`;
 };
 
 // src/skill-invoker.ts
-import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync3, statSync } from "node:fs";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync3, statSync } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/skill-md.ts
@@ -866,16 +1178,35 @@ ${guidance}` : description,
 }
 
 // src/requires.ts
-function hasReadableKeyFile(paths, read) {
+function hasReadableKeyFile(paths, read, onReadError) {
   return paths.some((path) => {
     if (!path) return false;
     try {
       return read(path).trim() !== "";
-    } catch {
+    } catch (error) {
+      try {
+        onReadError?.(path, error);
+      } catch {
+      }
       return false;
     }
   });
 }
+function searchKeyGateReporter(log, isBravePath) {
+  const logged = /* @__PURE__ */ new Set();
+  return (path, error) => {
+    if (error?.code === "ENOENT") return;
+    const signature = `${path}|${errorClass(error)}`;
+    if (logged.has(signature)) return;
+    logged.add(signature);
+    log(
+      "warn",
+      "runtime.search_key_unreadable",
+      { at_gate: true, provider_brave: isBravePath(path) },
+      error
+    );
+  };
+}
 function requiresEnvFrom(cfg, hasSearchKey) {
   return {
     hasSearchKey,
@@ -898,7 +1229,7 @@ function resolveRequires(req, env) {
 }
 
 // src/skills-config.ts
-import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // src/config-dirs.ts
@@ -927,13 +1258,13 @@ function loadSkillsConfigFile(path, dataDir) {
   if (!existsSync2(path)) return empty();
   let raw;
   try {
-    raw = JSON.parse(readFileSync(path, "utf8"));
+    raw = JSON.parse(readFileSync2(path, "utf8"));
   } catch (e) {
-    console.warn(`[skills-config] ignoring ${path}: ${e instanceof Error ? e.message : String(e)}`);
+    writeServiceLog("warn", "skills_config.parse_failed", {}, e);
     return empty();
   }
   if (typeof raw !== "object" || raw === null) {
-    console.warn(`[skills-config] ignoring ${path}: expected a JSON object`);
+    writeServiceLog("warn", "skills_config.root_invalid");
     return empty();
   }
   const src = raw;
@@ -941,7 +1272,7 @@ function loadSkillsConfigFile(path, dataDir) {
   for (const [name, v] of Object.entries(src.endpoints ?? {})) {
     const e = v;
     if (typeof e?.baseUrl !== "string" || e.baseUrl === "") {
-      console.warn(`[skills-config] endpoint "${name}" in ${path} has no baseUrl; skipped`);
+      writeServiceLog("warn", "skills_config.endpoint_invalid");
       continue;
     }
     endpoints[name] = {
@@ -955,7 +1286,7 @@ function loadSkillsConfigFile(path, dataDir) {
     if (typeof d?.sqlite === "string" && d.sqlite !== "") databases[name] = { sqlite: abs2(d.sqlite, dataDir) };
     else if (typeof d?.postgresUrlFile === "string" && d.postgresUrlFile !== "") {
       databases[name] = { postgresUrlFile: abs2(d.postgresUrlFile, dataDir) };
-    } else console.warn(`[skills-config] database "${name}" in ${path} needs sqlite or postgresUrlFile; skipped`);
+    } else writeServiceLog("warn", "skills_config.database_invalid");
   }
   const flags = Array.isArray(src.flags) ? src.flags.filter((f) => typeof f === "string") : [];
   const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
@@ -968,9 +1299,9 @@ function loadSkillsConfigFile(path, dataDir) {
   const s = src.search;
   if (s && typeof s === "object") {
     if (s.provider !== "brave" && s.provider !== "tavily") {
-      console.warn(`[skills-config] search in ${path} has an unknown provider; skipped`);
+      writeServiceLog("warn", "skills_config.search_provider_invalid");
     } else if (typeof s.keyFile !== "string" || s.keyFile === "") {
-      console.warn(`[skills-config] search in ${path} has no keyFile; skipped`);
+      writeServiceLog("warn", "skills_config.search_key_file_missing");
     } else {
       search = { provider: s.provider, keyFile: abs2(s.keyFile, dataDir) };
     }
@@ -1002,12 +1333,30 @@ function htmlToText(html) {
 }
 
 // src/net-guard.ts
-import { lookup } from "node:dns/promises";
+import { Resolver as DnsResolver } from "node:dns/promises";
 import { isIPv4, isIPv6 } from "node:net";
 var BlockedAddressError = class extends Error {
 };
 function systemResolver() {
-  return async (host) => (await lookup(host, { all: true, verbatim: true })).map((a) => a.address);
+  return async (host, signal) => {
+    if (isIPv4(host) || isIPv6(host)) return [host];
+    if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+    const resolver = new DnsResolver();
+    const cancel = () => resolver.cancel();
+    signal?.addEventListener("abort", cancel, { once: true });
+    try {
+      const results = await Promise.allSettled([resolver.resolve4(host), resolver.resolve6(host)]);
+      if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+      const addresses = results.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+      if (addresses.length === 0) {
+        const rejected = results.find((result) => result.status === "rejected");
+        throw rejected?.reason ?? new Error("DNS lookup returned no addresses");
+      }
+      return addresses;
+    } finally {
+      signal?.removeEventListener("abort", cancel);
+    }
+  };
 }
 function v4Parts(ip) {
   if (!isIPv4(ip)) return null;
@@ -1054,7 +1403,7 @@ function isPrivateAddress(ip) {
   }
   return (v6[0] & 65024) === 64512 || (v6[0] & 65472) === 65152;
 }
-async function assertPublicHost(url, resolve3) {
+async function assertPublicHost(url, resolve3, signal) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new BlockedAddressError(`refused ${url.protocol}//: only http and https are allowed`);
   }
@@ -1064,7 +1413,9 @@ async function assertPublicHost(url, resolve3) {
   }
   let addresses;
   try {
-    addresses = await resolve3(host);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
+    addresses = await resolve3(host, signal);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
   } catch (e) {
     throw new BlockedAddressError(`refused ${url.hostname}: cannot resolve (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -1082,14 +1433,20 @@ async function safeFetch(url, opts) {
   const maxRedirects = opts.maxRedirects ?? 3;
   const maxBytes = opts.maxBytes ?? 2e6;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1e4);
+  const cancel = () => controller.abort(opts.signal?.reason);
+  if (opts.signal?.aborted) cancel();
+  else opts.signal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(
+    () => controller.abort(new Error("network request deadline exceeded")),
+    opts.timeoutMs ?? 1e4
+  );
   try {
     let current = new URL(url);
     let method = opts.method ?? "GET";
     let headers = opts.headers;
     let body = opts.body;
     for (let hop = 0; hop <= maxRedirects; hop++) {
-      await assertPublicHost(current, opts.resolve);
+      await assertPublicHost(current, opts.resolve, controller.signal);
       const res = await opts.fetch(current.toString(), {
         method,
         headers,
@@ -1122,6 +1479,7 @@ async function safeFetch(url, opts) {
     throw new BlockedAddressError(`too many redirects (>${maxRedirects})`);
   } finally {
     clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", cancel);
   }
 }
 function headerMap(res) {
@@ -1171,7 +1529,8 @@ var fetchUrl = async (args, ctx) => {
       fetch: ctx.fetch,
       maxRedirects: 3,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     const type = res.headers["content-type"] ?? "";
     const text = /html|xml/i.test(type) ? htmlToText(res.text) : res.text.replace(/\s+/g, " ").trim();
@@ -1182,7 +1541,7 @@ var fetchUrl = async (args, ctx) => {
 };
 
 // src/builtins/http-request.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE"]);
 var httpRequest = async (args, ctx) => {
   const name = typeof args.name === "string" ? args.name : "";
@@ -1225,7 +1584,7 @@ var httpRequest = async (args, ctx) => {
   const headers = { accept: "application/json" };
   if (endpoint.headersFile) {
     try {
-      for (const [k, v] of Object.entries(JSON.parse(readFileSync2(endpoint.headersFile, "utf8")))) {
+      for (const [k, v] of Object.entries(JSON.parse(readFileSync3(endpoint.headersFile, "utf8")))) {
         if (typeof v === "string") headers[k] = v;
       }
     } catch {
@@ -1242,7 +1601,8 @@ var httpRequest = async (args, ctx) => {
       headers,
       body,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     return JSON.stringify({ status: res.status, body: capTo(res.text, FETCH_TEXT_CAP) });
   } catch (e) {
@@ -1251,7 +1611,8 @@ var httpRequest = async (args, ctx) => {
 };
 
 // src/builtins/sql-query.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { spawn } from "node:child_process";
 
 // src/sql-guard.ts
 var SqlNotReadOnlyError = class extends Error {
@@ -1305,16 +1666,160 @@ function assertReadOnlySelect(sql) {
 }
 
 // src/builtins/sql-query.ts
+var SQLITE_PROCESS_SOURCE = String.raw`
+  const { DatabaseSync } = require("node:sqlite");
+
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => { input += chunk; });
+  process.stdin.on("end", () => {
+    let handle;
+    try {
+      const request = JSON.parse(input);
+      handle = new DatabaseSync(request.path, {
+        readOnly: true,
+        timeout: request.busyTimeoutMs,
+      });
+      // Keep SQLite-owned allocations bounded too, not only V8's heap. Temp
+      // work stays in the limited heap instead of consuming unbounded disk,
+      // and mmap is disabled so reads cannot bypass the allocation ceiling.
+      const heapLimit = handle.prepare(
+        "PRAGMA hard_heap_limit = " + request.sqliteHeapLimitBytes
+      ).get();
+      const effectiveHeapLimit = Number(Object.values(heapLimit ?? {})[0]);
+      if (!(effectiveHeapLimit > 0 && effectiveHeapLimit <= request.sqliteHeapLimitBytes)) {
+        throw new Error("SQLite heap limit could not be enforced");
+      }
+      handle.exec("PRAGMA temp_store = MEMORY; PRAGMA mmap_size = 0");
+      const statement = handle.prepare(request.sql);
+      const rows = [];
+      let columns = [];
+      let truncated = false;
+
+      for (const record of statement.iterate()) {
+        if (rows.length === request.rowCap) {
+          truncated = true;
+          break;
+        }
+        if (rows.length === 0) columns = Object.keys(record);
+        rows.push(columns.map((column) => record[column]));
+      }
+
+      process.stdout.write(JSON.stringify({
+        ok: true,
+        result: { columns, rows, truncated },
+      }));
+    } catch (error) {
+      process.stdout.write(JSON.stringify({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    } finally {
+      if (handle) handle.close();
+    }
+  });
+`;
+var SQLITE_IPC_CAP_BYTES = 1024 * 1024;
+var SQLITE_HEAP_CAP_BYTES = 32 * 1024 * 1024;
+function executeSqliteQuery(path, sql, options = {}) {
+  const timeoutMs = options.timeoutMs ?? SQL_TIMEOUT_MS;
+  if (options.signal?.aborted) return Promise.reject(new Error("SQLite query cancelled"));
+  return new Promise((resolve3, reject) => {
+    const child = spawn(process.execPath, [
+      "--no-warnings",
+      "--max-old-space-size=32",
+      "--input-type=commonjs",
+      "--eval",
+      SQLITE_PROCESS_SOURCE
+    ], {
+      // The query process needs no credentials or runtime configuration.
+      // In particular, do not let NODE_OPTIONS weaken its heap boundary.
+      env: {},
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let settled = false;
+    let stopError;
+    let stdout = "";
+    let stdoutBytes = 0;
+    const cleanup = () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+    };
+    const stop = (error) => {
+      if (settled || stopError) return;
+      stopError = error;
+      cleanup();
+      child.kill("SIGKILL");
+    };
+    const onAbort = () => stop(new Error("SQLite query cancelled"));
+    const timer = setTimeout(
+      () => stop(new Error(`SQLite query timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (stopError) return;
+      stdoutBytes += Buffer.byteLength(chunk);
+      if (stdoutBytes > SQLITE_IPC_CAP_BYTES) {
+        stop(new Error("SQLite query result exceeded the materialization limit"));
+        return;
+      }
+      stdout += chunk;
+    });
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (stopError) {
+        reject(stopError);
+        return;
+      }
+      if (code !== 0) {
+        reject(new Error(`SQLite query process exited before returning a result (code ${code})`));
+        return;
+      }
+      try {
+        const message = JSON.parse(stdout);
+        if (message.ok && message.result) resolve3(message.result);
+        else reject(new Error(message.error ?? "SQLite query process failed"));
+      } catch {
+        reject(new Error("SQLite query process returned an invalid result"));
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(JSON.stringify({
+      path,
+      sql,
+      rowCap: SQL_ROW_CAP,
+      busyTimeoutMs: timeoutMs,
+      sqliteHeapLimitBytes: SQLITE_HEAP_CAP_BYTES
+    }));
+  });
+}
 function envelope(columns, rows, truncated) {
   let kept = rows;
   let cut = truncated;
-  let out = JSON.stringify({ columns, rows: kept, truncated: cut });
-  while (out.length > FETCH_TEXT_CAP && kept.length > 0) {
-    kept = kept.slice(0, Math.floor(kept.length / 2));
-    cut = true;
-    out = JSON.stringify({ columns, rows: kept, truncated: cut });
+  try {
+    let out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    while (resultBytes(out) > RESULT_CAP && kept.length > 0) {
+      kept = kept.slice(0, Math.floor(kept.length / 2));
+      cut = true;
+      out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    }
+    if (resultBytes(out) <= RESULT_CAP) return out;
+  } catch {
+    return toolError("database result could not be serialized");
   }
-  return capResult(out);
+  return toolError("database result metadata exceeded the response limit");
 }
 var sqlQuery = async (args, ctx) => {
   const name = typeof args.name === "string" ? args.name : "";
@@ -1332,16 +1837,8 @@ var sqlQuery = async (args, ctx) => {
   }
   try {
     if ("sqlite" in db) {
-      const { DatabaseSync } = await import("node:sqlite");
-      const handle = new DatabaseSync(db.sqlite, { readOnly: true, timeout: SQL_TIMEOUT_MS });
-      try {
-        const rows = handle.prepare(sql).all();
-        const capped = rows.slice(0, SQL_ROW_CAP);
-        const columns = capped.length ? Object.keys(capped[0]) : [];
-        return envelope(columns, capped.map((r) => columns.map((c) => r[c])), rows.length > SQL_ROW_CAP);
-      } finally {
-        handle.close();
-      }
+      const result = await executeSqliteQuery(db.sqlite, sql, { signal: ctx.signal });
+      return envelope(result.columns, result.rows, result.truncated);
     }
     let pg;
     try {
@@ -1352,19 +1849,32 @@ var sqlQuery = async (args, ctx) => {
     const Client = pg.Client ?? pg.default?.Client;
     if (!Client) return toolError(`the installed "pg" module does not export a Client`);
     const client = new Client({
-      connectionString: readFileSync3(db.postgresUrlFile, "utf8").trim(),
+      connectionString: readFileSync4(db.postgresUrlFile, "utf8").trim(),
       // never logged (D4)
-      statement_timeout: SQL_TIMEOUT_MS
+      statement_timeout: SQL_TIMEOUT_MS,
+      connectionTimeoutMillis: SQL_TIMEOUT_MS,
+      query_timeout: SQL_TIMEOUT_MS
     });
-    await client.connect();
+    let cancelled = ctx.signal?.aborted ?? false;
+    const cancel = () => {
+      cancelled = true;
+      void client.end().catch(() => {
+      });
+    };
+    if (cancelled) throw new Error("Postgres query cancelled");
+    ctx.signal?.addEventListener("abort", cancel, { once: true });
     try {
+      await client.connect();
+      if (cancelled) throw new Error("Postgres query cancelled");
       await client.query("BEGIN; SET TRANSACTION READ ONLY;");
       const res = await client.query({ text: sql, rowMode: "array" });
+      if (cancelled) throw new Error("Postgres query cancelled");
       const columns = res.fields.map((f) => f.name);
       const rows = res.rows.slice(0, SQL_ROW_CAP);
       return envelope(columns, rows, res.rows.length > SQL_ROW_CAP);
     } finally {
-      await client.query("ROLLBACK").catch(() => {
+      ctx.signal?.removeEventListener("abort", cancel);
+      if (!cancelled) await client.query("ROLLBACK").catch(() => {
       });
       await client.end().catch(() => {
       });
@@ -1387,13 +1897,14 @@ var webSearch = async (args, ctx) => {
   try {
     let hits;
     if (brave) {
-      ctx.log("debug", `web_search via brave (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: true });
       const url = `https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${count}`;
       const res = await safeFetch(url, {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         headers: { accept: "application/json", "X-Subscription-Token": brave }
       });
       if (res.status !== 200) return toolError(`brave search returned HTTP ${res.status}`);
@@ -1404,12 +1915,13 @@ var webSearch = async (args, ctx) => {
         snippet: r.description ?? ""
       }));
     } else {
-      ctx.log("debug", `web_search via tavily (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: false });
       const res = await safeFetch("https://api.tavily.com/search", {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ api_key: tavily, query, max_results: count })
@@ -1432,14 +1944,70 @@ var webSearch = async (args, ctx) => {
 var RESULT_CAP = 2e4;
 var TRUNCATION_MARKER = "\u2026[truncated]";
 var FETCH_TEXT_CAP = RESULT_CAP - 4096;
+function resultBytes(s) {
+  return Buffer.byteLength(s, "utf8");
+}
+function utf8Prefix(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  const bytes = Buffer.from(s, "utf8");
+  if (bytes.length <= maxBytes) return s;
+  let end = maxBytes;
+  while (end > 0) {
+    const candidate = bytes.subarray(0, end).toString("utf8");
+    if (!candidate.endsWith("\uFFFD") && resultBytes(candidate) <= maxBytes) return candidate;
+    end--;
+  }
+  return "";
+}
+function fitJsonString(value, build) {
+  const codePoints = Array.from(value);
+  let low = 0;
+  let high = codePoints.length;
+  let best = build("");
+  while (low <= high) {
+    const middle = Math.floor((low + high) / 2);
+    const candidate = build(codePoints.slice(0, middle).join(""));
+    if (resultBytes(candidate) <= RESULT_CAP) {
+      best = candidate;
+      low = middle + 1;
+    } else {
+      high = middle - 1;
+    }
+  }
+  return best;
+}
 function capTo(s, limit) {
-  return s.length <= limit ? s : s.slice(0, limit) + TRUNCATION_MARKER;
+  if (resultBytes(s) <= limit) return s;
+  const markerBytes = resultBytes(TRUNCATION_MARKER);
+  return utf8Prefix(s, Math.max(0, limit - markerBytes)) + TRUNCATION_MARKER;
 }
 function capResult(s) {
   return capTo(s, RESULT_CAP);
 }
+function boundToolResult(content) {
+  if (resultBytes(content) <= RESULT_CAP) return content;
+  try {
+    const parsed = JSON.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const record = parsed;
+      if (typeof record.error === "string") {
+        const message = typeof record.message === "string" ? record.message : record.error;
+        return toolError(message);
+      }
+    }
+    return fitJsonString(content, (result) => JSON.stringify({ result, truncated: true }));
+  } catch {
+    return capResult(content);
+  }
+}
 function toolError(message) {
-  return JSON.stringify({ error: "tool_failed", message });
+  const plain = JSON.stringify({ error: "tool_failed", message });
+  if (resultBytes(plain) <= RESULT_CAP) return plain;
+  return fitJsonString(message, (prefix) => JSON.stringify({
+    error: "tool_failed",
+    message: prefix,
+    truncated: true
+  }));
 }
 var NO_CONTEXT = "no runtime context: this built-in needs the runtime's network context";
 function offlineContext() {
@@ -1467,12 +2035,148 @@ var BUILTINS = {
   sql_query: sqlQuery
 };
 
+// src/side-effect-ledger.ts
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES = 1e4;
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("operation arguments must be finite JSON values");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map(
+      (key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`
+    ).join(",")}}`;
+  }
+  throw new Error("operation arguments must be JSON values");
+}
+function operationSha256(tool, args) {
+  const normalized = tool === "http_request" && typeof args.method === "string" ? { ...args, method: args.method.toUpperCase() } : args;
+  return createHash("sha256").update(`${tool}
+${canonicalJson(normalized)}`, "utf8").digest("hex");
+}
+var SideEffectLedger = class {
+  constructor(path, maxEntries = DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES) {
+    this.maxEntries = maxEntries;
+    mkdirSync2(dirname4(path), { recursive: true, mode: 448 });
+    this.db = new DatabaseSync(path);
+    chmodSync(path, 384);
+    this.db.exec("PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA busy_timeout=1000;");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS side_effect_claims (
+        idempotency_key TEXT PRIMARY KEY,
+        operation_sha256 TEXT NOT NULL,
+        confirmation_id TEXT NOT NULL UNIQUE,
+        expires_at TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('in_progress', 'completed')),
+        created_at TEXT NOT NULL,
+        completed_at TEXT
+      ) STRICT
+    `);
+  }
+  db;
+  claim(grant, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const prior = this.db.prepare(`
+        SELECT idempotency_key, operation_sha256, confirmation_id, state
+        FROM side_effect_claims WHERE idempotency_key = ? OR confirmation_id = ?
+      `).get(grant.idempotency_key, grant.confirmation_id);
+      if (prior) {
+        this.db.exec("COMMIT");
+        if (prior.operation_sha256 !== grant.operation_sha256 || prior.confirmation_id !== grant.confirmation_id || prior.idempotency_key !== grant.idempotency_key) return { kind: "conflict" };
+        return { kind: prior.state === "completed" ? "completed" : "ambiguous" };
+      }
+      const count = this.db.prepare("SELECT COUNT(*) AS count FROM side_effect_claims").get();
+      if (count.count >= this.maxEntries) {
+        this.db.exec("COMMIT");
+        return { kind: "full" };
+      }
+      this.db.prepare(`
+        INSERT INTO side_effect_claims
+          (idempotency_key, operation_sha256, confirmation_id, expires_at, state, created_at)
+        VALUES (?, ?, ?, ?, 'in_progress', ?)
+      `).run(
+        grant.idempotency_key,
+        grant.operation_sha256,
+        grant.confirmation_id,
+        grant.expires_at,
+        now.toISOString()
+      );
+      this.db.exec("COMMIT");
+      return { kind: "execute" };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  complete(grant, now) {
+    const result = this.db.prepare(`
+      UPDATE side_effect_claims SET state = 'completed', completed_at = ?
+      WHERE idempotency_key = ? AND operation_sha256 = ? AND confirmation_id = ?
+        AND state = 'in_progress'
+    `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+    if (result.changes !== 1) throw new Error("side-effect claim could not be completed");
+  }
+  /** Content-free inventory for an operator investigating an interrupted effect. */
+  listAmbiguous() {
+    return this.db.prepare(`
+      SELECT idempotency_key, operation_sha256, confirmation_id, expires_at, created_at
+      FROM side_effect_claims WHERE state='in_progress' ORDER BY created_at, idempotency_key
+    `).all();
+  }
+  /**
+   * Record the operator's external reconciliation result. `completed` prevents
+   * replay; `not_applied` removes the pre-effect claim so the exact confirmed
+   * operation may be retried. Every binding field must match the durable row.
+   */
+  reconcile(grant, outcome, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.db.prepare(`
+        SELECT state FROM side_effect_claims
+        WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=?
+      `).get(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      if (!row) throw new Error("ambiguous side-effect claim not found or binding mismatch");
+      if (row.state !== "in_progress") throw new Error("side-effect claim is already completed");
+      if (outcome === "completed") {
+        this.db.prepare(`
+          UPDATE side_effect_claims SET state='completed', completed_at=?
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      } else {
+        this.db.prepare(`
+          DELETE FROM side_effect_claims
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      }
+      this.db.exec("COMMIT");
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  close() {
+    this.db.close();
+  }
+};
+
 // src/skill-invoker.ts
 var SkillInvoker = class {
-  skills = /* @__PURE__ */ new Map();
-  sources = /* @__PURE__ */ new Map();
-  skillsDir;
-  ctx;
   /**
    * `ctx` carries everything a built-in may touch: the network, DNS, the clock
    * and the key files. A caller that has no runtime (the loader tests, and any
@@ -1480,10 +2184,15 @@ var SkillInvoker = class {
    * that need nothing still run and the ones that need the network fail as a
    * tool_failed result instead of throwing.
    */
-  constructor(skillsDir, ctx) {
+  constructor(skillsDir, ctx, sideEffectLedger) {
+    this.sideEffectLedger = sideEffectLedger;
     this.skillsDir = skillsDir;
     this.ctx = ctx ?? offlineContext();
   }
+  skills = /* @__PURE__ */ new Map();
+  sources = /* @__PURE__ */ new Map();
+  skillsDir;
+  ctx;
   /**
    * Load all skill manifests from the skills directory. Supports two
    * layouts: flat `<skillsDir>/*.json` files, and one level of nesting via
@@ -1491,7 +2200,7 @@ var SkillInvoker = class {
    */
   loadSkills() {
     if (!existsSync3(this.skillsDir)) {
-      console.warn(`[SkillInvoker] Skills directory not found: ${this.skillsDir}`);
+      writeServiceLog("warn", "skills.directory_missing");
       return;
     }
     const flat = [], manifests = [], skillMds = [];
@@ -1507,40 +2216,38 @@ var SkillInvoker = class {
     }
     for (const p of [...flat.sort(), ...manifests.sort()]) this.loadManifestFile(p);
     for (const p of skillMds.sort()) this.loadSkillMdFile(p);
-    console.log(`[SkillInvoker] Loaded ${this.skills.size} skills`);
+    writeServiceLog("info", "skills.loaded", { count: this.skills.size });
   }
   /** Later file wins, with a warning naming both paths (spec §3). */
   register(manifest, path) {
     const prior = this.sources.get(manifest.name);
-    if (prior) console.warn(`[SkillInvoker] Duplicate skill "${manifest.name}": ${path} overrides ${prior}`);
+    if (prior) writeServiceLog("warn", "skills.duplicate_replaced");
     this.skills.set(manifest.name, manifest);
     this.sources.set(manifest.name, path);
   }
   loadSkillMdFile(path) {
     try {
-      this.register(parseSkillMd(readFileSync4(path, "utf-8"), path), path);
+      this.register(parseSkillMd(readFileSync5(path, "utf-8"), path), path);
     } catch (err) {
-      console.warn(`[SkillInvoker] Skipping ${path}: ${err instanceof Error ? err.message : String(err)}`);
+      writeServiceLog("warn", "skills.skill_md_invalid", {}, err);
     }
   }
   loadManifestFile(path) {
     try {
-      const raw = readFileSync4(path, "utf-8");
+      const raw = readFileSync5(path, "utf-8");
       const manifest = JSON.parse(raw);
       if (typeof manifest.handler !== "string" || !(manifest.handler.startsWith("builtin:") || manifest.handler.startsWith("script:"))) {
-        console.warn(
-          `[SkillInvoker] Skipping manifest with invalid handler ${path}: expected "builtin:<name>" or "script:<path>"`
-        );
+        writeServiceLog("warn", "skills.manifest_handler_invalid");
         return;
       }
       if (manifest.name && manifest.description) {
         this.register(manifest, path);
       } else {
         const missing = !manifest.name ? "name" : "description";
-        console.warn(`[SkillInvoker] Skipping manifest ${path}: missing "${missing}"`);
+        writeServiceLog("warn", "skills.manifest_field_missing", { name_missing: missing === "name" });
       }
     } catch (err) {
-      console.warn(`[SkillInvoker] Failed to load skill ${path}:`, err);
+      writeServiceLog("warn", "skills.manifest_load_failed", {}, err);
     }
   }
   /** Convert loaded skills to OpenAI tool definitions for LLM dispatch. */
@@ -1580,27 +2287,76 @@ var SkillInvoker = class {
   async invoke(name, args, context) {
     const skill = this.skills.get(name);
     if (!skill) {
-      return JSON.stringify({ error: `Unknown skill: ${name}` });
+      return boundToolResult(JSON.stringify({ error: `Unknown skill: ${name}` }));
+    }
+    const execute = async () => {
+      const handler = skill.handler;
+      if (handler.startsWith("builtin:")) {
+        return this.invokeBuiltin(handler.slice(8), args, context?.signal);
+      }
+      if (handler.startsWith("script:")) {
+        return this.invokeScript(handler.slice(7), args, context?.signal);
+      }
+      return boundToolResult(JSON.stringify({ error: `Unknown handler type: ${handler}` }));
+    };
+    return context?.sideEffect ? this.invokeSideEffect(name, args, context.sideEffect, execute) : execute();
+  }
+  async invokeSideEffect(name, args, grant, execute) {
+    const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
+    if (name !== "http_request" || !(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+      return toolError("This tool has no supported side-effect replay contract");
+    }
+    if (grant.tool !== name || operationSha256(name, args) !== grant.operation_sha256) {
+      return toolError("Confirmed operation digest does not match this tool call");
+    }
+    const now = this.ctx.now();
+    const expiresAt = Date.parse(grant.expires_at);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+      return toolError("Confirmed operation grant is expired or invalid");
+    }
+    if (!this.sideEffectLedger) {
+      return toolError("Side-effect replay protection is unavailable");
+    }
+    let claim;
+    try {
+      claim = this.sideEffectLedger.claim(grant, now);
+    } catch {
+      return toolError("Side-effect replay claim could not be persisted");
     }
-    const handler = skill.handler;
-    if (handler.startsWith("builtin:")) {
-      return this.invokeBuiltin(handler.slice(8), args);
+    if (claim.kind === "completed") return JSON.stringify({ status: "already_applied" });
+    if (claim.kind === "ambiguous") {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
     }
-    if (handler.startsWith("script:")) {
-      return this.invokeScript(handler.slice(7), args);
+    if (claim.kind === "conflict") {
+      return toolError("Idempotency key was already bound to a different confirmed operation");
     }
-    return JSON.stringify({ error: `Unknown handler type: ${handler}` });
+    if (claim.kind === "full") {
+      return toolError("Side-effect replay ledger is full; reconcile it before running new operations");
+    }
+    let result;
+    try {
+      result = await execute();
+    } catch {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
+    }
+    if (isToolFailure(result)) return result;
+    try {
+      this.sideEffectLedger.complete(grant, this.ctx.now());
+    } catch {
+      return toolError("Side-effect completed but replay state is ambiguous; reconcile before retrying");
+    }
+    return result;
   }
-  async invokeBuiltin(name, args) {
+  async invokeBuiltin(name, args, signal) {
     const builtin = BUILTINS[name];
     if (!builtin) return JSON.stringify({ error: `Unknown builtin: ${name}` });
     try {
-      return capResult(await builtin(args, this.ctx));
+      return boundToolResult(await builtin(args, { ...this.ctx, signal }));
     } catch (e) {
       return toolError(e instanceof Error ? e.message : String(e));
     }
   }
-  async invokeScript(scriptPath, args) {
+  async invokeScript(scriptPath, args, signal) {
     const { resolve: resolve3, relative } = await import("node:path");
     const resolved = resolve3(this.skillsDir, scriptPath);
     const rel = relative(this.skillsDir, resolved);
@@ -1620,26 +2376,82 @@ var SkillInvoker = class {
     try {
       accessSync2(resolved, constants2.X_OK);
     } catch {
-      return JSON.stringify({ error: `Script not found or not executable: ${scriptPath}` });
+      return toolError(`Script not found or not executable: ${scriptPath}`);
     }
-    const { execSync } = await import("node:child_process");
-    try {
-      const result = execSync(resolved, {
-        input: JSON.stringify(args),
-        timeout: 3e4,
-        maxBuffer: 1024 * 1024,
-        encoding: "utf-8",
+    if (signal?.aborted) return toolError("Script execution cancelled");
+    const { spawn: spawn2 } = await import("node:child_process");
+    return new Promise((resolveResult) => {
+      const child = spawn2(resolved, [], {
         cwd: this.skillsDir,
-        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" }
+        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" },
+        stdio: ["pipe", "pipe", "ignore"],
+        windowsHide: true,
+        // A script may launch children. On POSIX, make one process group so
+        // cancellation kills the whole operation rather than orphaning them.
+        detached: process.platform !== "win32"
       });
-      return result;
-    } catch (err) {
-      return JSON.stringify({
-        error: `Script execution failed: ${err instanceof Error ? err.message : String(err)}`
+      let stdout = "";
+      let stdoutBytes = 0;
+      let stopMessage = null;
+      let settled = false;
+      const cleanup = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      };
+      const stop = (message) => {
+        if (settled || stopMessage) return;
+        stopMessage = message;
+        if (process.platform !== "win32" && child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+            child.kill("SIGKILL");
+          }
+        } else {
+          child.kill("SIGKILL");
+        }
+      };
+      const onAbort = () => stop("Script execution cancelled");
+      const timer = setTimeout(() => stop("Script execution timed out after 30000ms"), 3e4);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        if (stopMessage) return;
+        stdoutBytes += Buffer.byteLength(chunk);
+        if (stdoutBytes > 1024 * 1024) {
+          stop("Script output exceeded the materialization limit");
+          return;
+        }
+        stdout += chunk;
       });
-    }
+      child.once("error", () => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolveResult(toolError("Script execution failed"));
+      });
+      child.once("close", (code) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        if (stopMessage) resolveResult(toolError(stopMessage));
+        else if (code !== 0) resolveResult(toolError(`Script execution failed (code ${code ?? "unknown"})`));
+        else resolveResult(boundToolResult(stdout));
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(JSON.stringify(args));
+    });
   }
 };
+function isToolFailure(result) {
+  try {
+    const parsed = JSON.parse(result);
+    return parsed.error === "tool_failed";
+  } catch {
+    return false;
+  }
+}
 
 // src/tool-gate.ts
 function createLocalToolGate(policy) {
@@ -1688,7 +2500,7 @@ function createDynamicToolGate(policyFor) {
 }
 
 // src/data-plane.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { WebSocket } from "node:http";
 import { homedir as homedir3 } from "node:os";
 import { join as join5 } from "node:path";
@@ -1733,7 +2545,7 @@ var NO_TURN_AUTHORIZATION = Object.freeze({
 function parseTurnAuthorization(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_AUTHORIZATION;
   const raw = value;
-  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants)) return NO_TURN_AUTHORIZATION;
+  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants) || raw.tool_grants.length > 100) return NO_TURN_AUTHORIZATION;
   const grants = [];
   for (const value2 of raw.tool_grants) {
     if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_AUTHORIZATION;
@@ -1743,7 +2555,7 @@ function parseTurnAuthorization(value) {
       grants.push(Object.freeze({ tool: grant.tool, mode: "read" }));
       continue;
     }
-    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || typeof grant.expires_at !== "string" || !grant.expires_at) return NO_TURN_AUTHORIZATION;
+    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || grant.confirmation_id.length > 200 || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || grant.idempotency_key.length > 200 || typeof grant.expires_at !== "string" || !grant.expires_at || grant.expires_at.length > 40) return NO_TURN_AUTHORIZATION;
     grants.push(Object.freeze({
       tool: grant.tool,
       mode: "side_effect",
@@ -1761,9 +2573,7 @@ function parseTurnAuthorization(value) {
   });
 }
 var SEEN_MAX = 5e3;
-function errText(e) {
-  return e instanceof Error ? e.message : String(e);
-}
+var TERMINAL_REPLY_ERRORS = /* @__PURE__ */ new Set(["agent_paused", "send_forbidden"]);
 var SecureComsDataPlane = class {
   identityId;
   connectionPath;
@@ -1773,7 +2583,18 @@ var SecureComsDataPlane = class {
   log;
   sleep;
   random;
+  healthTimeoutMs;
   onMessage;
+  noticeReplies;
+  /**
+   * Final-wave I1(b): sockets whose daemon advertised the `nack` feature. On
+   * those a failed turn is NACKED — only that message is retried, behind the
+   * daemon's backoff, and the socket (with every other channel's turn) stays
+   * up. Anywhere else a failed turn still closes the socket, as before.
+   */
+  nackCapable = /* @__PURE__ */ new WeakSet();
+  /** Sockets whose hello is unanswered: a refusal there is expected, not an error. */
+  helloPending = /* @__PURE__ */ new WeakSet();
   seen = /* @__PURE__ */ new Set();
   stopped = false;
   running = false;
@@ -1800,6 +2621,16 @@ var SecureComsDataPlane = class {
    * generation is current, so a restart can never end up with two live loops.
    */
   generation = 0;
+  /** Turn controllers grouped by the socket whose result would receive them. */
+  turns = /* @__PURE__ */ new Map();
+  /**
+   * Phase 3 F2: per-channel processing chains. A channel's messages are
+   * handled strictly one after another in arrival order (the receipt lookup,
+   * the turn and the reply), never concurrently — even when a daemon flushes a
+   * whole backlog at once. Different channels still run alongside each other.
+   */
+  channelChains = /* @__PURE__ */ new Map();
+  healthController = null;
   constructor(cfg, onMessage) {
     this.identityId = cfg.identityId;
     const dir = cfg.connectionsDir ?? join5(homedir3(), ".securecoms", "connections");
@@ -1807,10 +2638,7 @@ var SecureComsDataPlane = class {
     this.establishedMs = cfg.establishedMs ?? 5e3;
     this.initialDelayMs = cfg.initialDelayMs ?? 250;
     this.maxDelayMs = cfg.maxDelayMs ?? 3e4;
-    this.log = cfg.log ?? ((level, msg) => {
-      if (level === "info") console.log(msg);
-      else console.error(msg);
-    });
+    this.log = cfg.log ?? writeServiceLog;
     this.sleep = cfg.sleep ?? ((ms) => new Promise((resolve3) => {
       this.sleepTimer = setTimeout(() => {
         this.sleepTimer = null;
@@ -1818,7 +2646,9 @@ var SecureComsDataPlane = class {
       }, ms);
     }));
     this.random = cfg.random ?? Math.random;
+    this.healthTimeoutMs = cfg.healthTimeoutMs ?? 2e3;
     this.onMessage = onMessage;
+    this.noticeReplies = cfg.noticeReplies ?? /* @__PURE__ */ new Set();
   }
   /**
    * Resolves once the reconnect loop is running — NOT once attached. The loop
@@ -1837,13 +2667,19 @@ var SecureComsDataPlane = class {
     this.generation++;
     this.clearSettle();
     this.cancelSleep();
+    this.healthController?.abort(new Error("transport stopped"));
+    this.healthController = null;
+    for (const controllers of this.turns.values()) {
+      for (const controller of controllers) controller.abort(new Error("transport stopped"));
+    }
+    this.turns.clear();
     const ws = this.socket;
     this.socket = null;
     if (ws) {
       try {
         ws.close();
       } catch (e) {
-        this.log("warn", `error closing socket: ${errText(e)}`);
+        this.log("warn", "transport.socket_close_failed", {}, e);
       }
     }
   }
@@ -1897,7 +2733,7 @@ var SecureComsDataPlane = class {
         await this.attemptOnce();
         delay = this.initialDelayMs;
       } catch (e) {
-        this.log("error", errText(e));
+        this.log("error", "transport.connection_attempt_failed", {}, e);
       }
       if (!live()) break;
       await this.wait(this.random() * delay);
@@ -1906,10 +2742,22 @@ var SecureComsDataPlane = class {
     if (this.generation === generation) this.running = false;
   }
   async attemptOnce() {
-    const conn = JSON.parse(readFileSync5(this.connectionPath, "utf8"));
+    const conn = JSON.parse(readFileSync6(this.connectionPath, "utf8"));
     const httpBase = conn.bridge_url.replace(/^ws/, "http").replace(/\/v1\/ws$/, "");
-    const token = readFileSync5(conn.token_file, "utf8").trim();
-    const health = await (await fetch(`${httpBase}/healthz`)).json();
+    const token = readFileSync6(conn.token_file, "utf8").trim();
+    const healthController = new AbortController();
+    this.healthController = healthController;
+    const healthTimer = setTimeout(
+      () => healthController.abort(new Error("health gate deadline exceeded")),
+      this.healthTimeoutMs
+    );
+    let health;
+    try {
+      health = await (await fetch(`${httpBase}/healthz`, { signal: healthController.signal })).json();
+    } finally {
+      clearTimeout(healthTimer);
+      if (this.healthController === healthController) this.healthController = null;
+    }
     if (conn.identity_id !== health.identity_id || this.identityId !== health.identity_id) {
       throw new Error(
         `gate refused: expected ${this.identityId}, connection file says ${conn.identity_id}, daemon on this port is ${health.identity_id}`
@@ -1923,7 +2771,7 @@ var SecureComsDataPlane = class {
     try {
       await new Promise((resolve3, reject) => {
         ws.addEventListener("error", (e) => {
-          reject(new Error(`socket error: ${errText(e?.message ?? e)}`));
+          reject(Object.assign(new Error("socket_error"), { cause: e }));
         });
         ws.addEventListener("close", (e) => {
           if (established) resolve3();
@@ -1936,19 +2784,29 @@ var SecureComsDataPlane = class {
           }
         });
         ws.addEventListener("open", () => {
+          this.helloPending.add(ws);
+          try {
+            ws.send(JSON.stringify({ type: "hello", features: ["nack"] }));
+          } catch {
+          }
           settle = setTimeout(() => {
             established = true;
-            this.log("info", `attached to ${conn.bridge_url}`);
+            this.log("info", "transport.attached");
           }, this.establishedMs);
           this.settle = settle;
         });
         ws.addEventListener("message", (ev) => {
-          void this.handleFrame(ws, ev.data).catch((e) => {
-            this.log("error", `frame handling failed: ${errText(e)}`);
+          void this.handleFrame(ws, ev.data, httpBase, token).catch((e) => {
+            this.log("error", "transport.frame_handling_failed", {}, e);
           });
         });
       });
     } finally {
+      const controllers = this.turns.get(ws);
+      if (controllers) {
+        for (const controller of controllers) controller.abort(new Error("transport disconnected"));
+        this.turns.delete(ws);
+      }
       if (settle !== null) clearTimeout(settle);
       if (this.settle === settle) this.settle = null;
       try {
@@ -1958,28 +2816,101 @@ var SecureComsDataPlane = class {
       if (this.socket === ws) this.socket = null;
     }
   }
-  async handleFrame(ws, data) {
+  /**
+   * Final-wave I1(b): fail ONE message. Against a nack-capable daemon, send a
+   * `nack` — only this message is retried and the socket stays up for every
+   * other channel's turn. Otherwise close the socket, the only failure
+   * signal an older daemon understands (it re-buffers what was in flight).
+   */
+  failTurn(ws, messageId, reason) {
+    if (this.nackCapable.has(ws) && ws.readyState === ws.OPEN) {
+      try {
+        ws.send(JSON.stringify({ type: "nack", message_id: messageId, reason }));
+        return;
+      } catch {
+      }
+    }
+    try {
+      ws.close();
+    } catch {
+    }
+  }
+  async handleFrame(ws, data, httpBase, token) {
     let frame;
     try {
       frame = JSON.parse(String(data));
     } catch (e) {
-      this.log("error", `ignoring unparseable frame: ${errText(e)}`);
+      this.log("error", "transport.frame_parse_failed", {}, e);
+      return;
+    }
+    if (frame?.type === "hello") {
+      this.helloPending.delete(ws);
+      if (Array.isArray(frame.features) && frame.features.includes("nack")) this.nackCapable.add(ws);
       return;
     }
     if (frame?.type === "error") {
-      this.log("error", `daemon error frame: ${String(frame.error)}: ${String(frame.message)}`);
+      if (frame.in_reply_to === void 0 && this.helloPending.has(ws)) {
+        this.helloPending.delete(ws);
+        this.log("info", "transport.daemon_without_nack");
+        return;
+      }
+      if (typeof frame.in_reply_to === "string" && TERMINAL_REPLY_ERRORS.has(String(frame.error))) {
+        this.log("warn", "transport.reply_terminal", { paused: frame.error === "agent_paused" });
+        this.remember(frame.in_reply_to);
+        ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
+        return;
+      }
+      this.log("error", "transport.daemon_error_frame");
+      if (typeof frame.in_reply_to === "string") this.failTurn(ws, frame.in_reply_to, "reply_failed");
+      return;
+    }
+    if (frame?.type === "sent" && typeof frame.in_reply_to === "string") {
+      this.remember(frame.in_reply_to);
+      ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
       return;
     }
     if (frame?.type !== "message") return;
     const messageId = frame.message_id;
     if (typeof messageId !== "string") {
-      this.log("error", "ignoring message frame with no message_id");
+      this.log("error", "transport.message_id_missing");
       return;
     }
     const channelId = String(frame.channel_id);
+    const previous = this.channelChains.get(channelId) ?? Promise.resolve();
+    const run = () => this.handleMessage(ws, frame, messageId, channelId, httpBase, token);
+    const mine = previous.then(run, run);
+    this.channelChains.set(channelId, mine);
+    try {
+      await mine;
+    } finally {
+      if (this.channelChains.get(channelId) === mine) this.channelChains.delete(channelId);
+    }
+  }
+  async handleMessage(ws, frame, messageId, channelId, httpBase, token) {
+    if (ws.readyState !== ws.OPEN) return;
+    let turnController = null;
     try {
       if (!this.seen.has(messageId)) {
-        this.remember(messageId);
+        const receipt = await fetch(
+          `${httpBase}/v1/reply-receipt?in_reply_to=${encodeURIComponent(messageId)}`,
+          {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(this.healthTimeoutMs)
+          }
+        );
+        if (!receipt.ok) throw new Error(`reply receipt lookup failed: HTTP ${receipt.status}`);
+        if ((await receipt.json()).found === true) {
+          this.remember(messageId);
+          ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+          return;
+        }
+        turnController = new AbortController();
+        let socketTurns = this.turns.get(ws);
+        if (!socketTurns) {
+          socketTurns = /* @__PURE__ */ new Set();
+          this.turns.set(ws, socketTurns);
+        }
+        socketTurns.add(turnController);
         const reply = await this.onMessage({
           text: String(frame.text ?? ""),
           senderId: String(frame.sender_id ?? ""),
@@ -1987,23 +2918,31 @@ var SecureComsDataPlane = class {
           messageId,
           authorization: parseTurnAuthorization(frame.authorization),
           memory: parseTurnMemory(frame.memory)
-        });
+        }, turnController.signal);
         if (reply != null) {
+          const text = String(reply);
           ws.send(JSON.stringify({
             type: "send",
             channel_id: channelId,
-            text: String(reply),
-            in_reply_to: messageId
+            text,
+            in_reply_to: messageId,
+            ...this.noticeReplies.has(text) ? { notice: true } : {}
           }));
+          return;
         }
+        this.remember(messageId);
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+      } else {
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
       }
     } catch (e) {
-      this.log("error", `handler threw: ${errText(e)}`);
+      this.log("error", "transport.handler_failed", {}, e);
+      this.failTurn(ws, messageId, "turn_failed");
     } finally {
-      try {
-        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
-      } catch (e) {
-        this.log("error", `could not ack ${messageId}: ${errText(e)}`);
+      if (turnController) {
+        const socketTurns = this.turns.get(ws);
+        socketTurns?.delete(turnController);
+        if (socketTurns?.size === 0) this.turns.delete(ws);
       }
     }
   }
@@ -2016,6 +2955,14 @@ function createSecureComsDataPlane(cfg, onMessage) {
 async function runToolCalls(toolCalls, skills, context) {
   const out = [];
   for (const call of toolCalls) {
+    if (context?.signal?.aborted) {
+      out.push({
+        role: "tool",
+        content: toolError("Tool execution cancelled"),
+        tool_call_id: call.id
+      });
+      continue;
+    }
     let args;
     try {
       args = JSON.parse(call.function.arguments);
@@ -2024,12 +2971,14 @@ async function runToolCalls(toolCalls, skills, context) {
     }
     let content;
     try {
-      content = await skills.invoke(call.function.name, args, context);
+      content = boundToolResult(await skills.invoke(call.function.name, args, {
+        roomId: context?.roomId,
+        groupId: context?.groupId,
+        signal: context?.signal,
+        sideEffect: context?.sideEffects?.get(call.id)
+      }));
     } catch (err) {
-      content = JSON.stringify({
-        error: "tool_failed",
-        message: String(err instanceof Error ? err.message : err)
-      });
+      content = toolError(String(err instanceof Error ? err.message : err));
     }
     out.push({ role: "tool", content, tool_call_id: call.id });
   }
@@ -2039,14 +2988,24 @@ async function runToolCalls(toolCalls, skills, context) {
 // src/turn-loop.ts
 var DEFAULT_SYSTEM_PROMPT = "You are a SecureComs agent. Respond helpfully and concisely.";
 var DEFAULT_MAX_ITERATIONS = 5;
+var DEFAULT_MAX_CONCURRENT_TURNS = 4;
+var DEFAULT_TURN_TIMEOUT_MS = 3e5;
+var DAILY_LIMIT_RESPONSE = "This agent has reached its daily usage limit and will respond again after 00:00 UTC.";
 var READ_ONLY_TOOLS = /* @__PURE__ */ new Set(["echo", "web_search", "fetch_url", "sql_query", "current_time"]);
 function hasReadGrant(auth, toolName) {
   return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "read");
 }
+function hasSideEffectGrant(auth, toolName) {
+  return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "side_effect");
+}
 function toolIsOffered(auth, toolName) {
-  return hasReadGrant(auth, toolName) && (READ_ONLY_TOOLS.has(toolName) || toolName === "http_request");
+  if (READ_ONLY_TOOLS.has(toolName)) return hasReadGrant(auth, toolName);
+  if (toolName === "http_request") {
+    return hasReadGrant(auth, toolName) || hasSideEffectGrant(auth, toolName);
+  }
+  return false;
 }
-function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
+function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames, now = /* @__PURE__ */ new Date()) {
   if (auth.sender_membership !== "active") {
     return { allowed: false, reason: "Sender membership is not active" };
   }
@@ -2057,8 +3016,26 @@ function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
     try {
       const args = JSON.parse(argumentsJson);
       const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
-      if (method !== "GET") {
-        return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+      if (method === "GET") {
+        if (!hasReadGrant(auth, toolName)) {
+          return { allowed: false, reason: `Tool "${toolName}" has no active channel read grant` };
+        }
+      } else {
+        if (!(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+          return { allowed: false, reason: `HTTP method "${method}" is not supported` };
+        }
+        const digest = operationSha256(toolName, args);
+        const grant = auth.tool_grants.find(
+          (candidate) => candidate.mode === "side_effect" && candidate.tool === toolName && candidate.operation_sha256 === digest
+        );
+        if (!grant) {
+          return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+        }
+        const expiresAt = Date.parse(grant.expires_at);
+        if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+          return { allowed: false, reason: "The confirmed operation grant is expired or invalid" };
+        }
+        return { allowed: true, reason: `Tool "${toolName}" has an exact confirmed operation grant`, sideEffect: grant };
       }
     } catch {
       return { allowed: false, reason: "Tool arguments are not valid JSON" };
@@ -2068,16 +3045,133 @@ function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
 }
 function buildHandler(deps) {
   const maxIterations = deps.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+  const maxConcurrentTurns = deps.maxConcurrentTurns ?? DEFAULT_MAX_CONCURRENT_TURNS;
+  const turnTimeoutMs = deps.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
   const log = deps.log ?? (() => {
   });
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const { llm, memoryFor, skills, gate } = deps;
-  return async (m) => {
+  const channelTails = /* @__PURE__ */ new Map();
+  const slotWaiters = [];
+  let activeTurns = 0;
+  const limitNotified = /* @__PURE__ */ new Map();
+  function cancelledError() {
+    return new Error("Agent turn cancelled");
+  }
+  function waitUnlessAborted(gate2, signal) {
+    if (!signal) return gate2;
+    if (signal.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const onAbort = () => reject(cancelledError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      void gate2.then(() => {
+        signal.removeEventListener("abort", onAbort);
+        resolve3();
+      });
+    });
+  }
+  async function lockChannel(channelId, signal) {
+    const previous = channelTails.get(channelId) ?? Promise.resolve();
+    let release;
+    const mine = new Promise((resolve3) => {
+      release = resolve3;
+    });
+    const tail = previous.then(() => mine);
+    channelTails.set(channelId, tail);
+    let released = false;
+    const done = () => {
+      if (released) return;
+      released = true;
+      release();
+      if (channelTails.get(channelId) === tail) channelTails.delete(channelId);
+    };
+    try {
+      await waitUnlessAborted(previous, signal);
+    } catch (error) {
+      done();
+      throw error;
+    }
+    return done;
+  }
+  function acquireSlot(signal) {
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      activeTurns--;
+      slotWaiters.shift()?.();
+    };
+    if (activeTurns < maxConcurrentTurns) {
+      activeTurns++;
+      return Promise.resolve(release);
+    }
+    if (signal?.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const grant = () => {
+        signal?.removeEventListener("abort", onAbort);
+        activeTurns++;
+        resolve3(release);
+      };
+      const onAbort = () => {
+        const i = slotWaiters.indexOf(grant);
+        if (i >= 0) slotWaiters.splice(i, 1);
+        reject(cancelledError());
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      slotWaiters.push(grant);
+    });
+  }
+  function dailyLimitReply(channelId, day) {
+    if (limitNotified.get(channelId) === day) return null;
+    for (const [ch, d] of limitNotified) if (d !== day) limitNotified.delete(ch);
+    limitNotified.set(channelId, day);
+    log("warn", "turn.daily_limit_reply");
+    return DAILY_LIMIT_RESPONSE;
+  }
+  return async (m, upstreamSignal) => {
     const text = m.text?.trim() ? m.text : "";
     if (!text) return null;
-    log(
-      "info",
-      `message received (sender=${m.senderId.slice(0, 8)}, channel=${m.channelId.slice(0, 8)}, chars=${text.length})`
-    );
+    const mustWait = channelTails.has(m.channelId) || activeTurns >= maxConcurrentTurns;
+    if (mustWait) {
+      log("info", "turn.queued", {
+        same_channel: channelTails.has(m.channelId),
+        active_turns: activeTurns
+      });
+    }
+    const releaseChannel = await lockChannel(m.channelId, upstreamSignal);
+    let releaseSlot;
+    try {
+      releaseSlot = await acquireSlot(upstreamSignal);
+    } catch (error) {
+      releaseChannel();
+      throw error;
+    }
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(upstreamSignal?.reason);
+    if (upstreamSignal?.aborted) cancel();
+    else upstreamSignal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("turn deadline exceeded"));
+    }, turnTimeoutMs);
+    try {
+      return await runTurn(m, controller.signal);
+    } catch (error) {
+      if (error instanceof DailyLimitReachedError) return dailyLimitReply(m.channelId, error.day);
+      if (timedOut) throw new Error(`Agent turn timed out after ${turnTimeoutMs}ms`);
+      if (upstreamSignal?.aborted) throw cancelledError();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      upstreamSignal?.removeEventListener("abort", cancel);
+      releaseSlot();
+      releaseChannel();
+    }
+  };
+  async function runTurn(m, signal) {
+    const text = m.text;
+    log("info", "turn.message_received", { chars: text.length });
     const memory = memoryFor(m.channelId);
     memory.replace(m.memory);
     const messages = [{ role: "system", content: deps.systemPromptFor() }];
@@ -2090,7 +3184,7 @@ function buildHandler(deps) {
     const offeredNames = new Set(tools.map((tool) => tool.function.name));
     let response = null;
     for (let iteration = 0; iteration < maxIterations; iteration++) {
-      const result = await llm.complete(messages, tools.length > 0 ? tools : void 0);
+      const result = await llm.complete(messages, tools.length > 0 ? tools : void 0, { signal });
       if (result.toolCalls.length === 0) {
         response = result.content;
         break;
@@ -2105,26 +3199,38 @@ function buildHandler(deps) {
           m.authorization,
           call.function.name,
           call.function.arguments,
-          offeredNames
+          offeredNames,
+          now()
         );
+        const localVerdict = channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict;
         return {
           call,
-          verdict: channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict
+          verdict: {
+            ...localVerdict,
+            ...localVerdict.allowed && channelVerdict.sideEffect ? { sideEffect: channelVerdict.sideEffect } : {}
+          }
         };
       });
       const allowed = verdicts.filter((v) => v.verdict.allowed).map((v) => v.call);
+      const sideEffects = new Map(
+        verdicts.flatMap(({ call, verdict }) => verdict.allowed && verdict.sideEffect ? [[call.id, verdict.sideEffect]] : [])
+      );
       for (const v of verdicts) {
         if (!v.verdict.allowed) {
-          log("warn", `tool call denied: ${v.call.function.name} \u2014 ${v.verdict.reason}`);
+          log("warn", "turn.tool_call_denied");
         }
       }
-      const executed = await runToolCalls(allowed, skills, { roomId: m.channelId });
+      const executed = await runToolCalls(allowed, skills, {
+        roomId: m.channelId,
+        signal,
+        sideEffects
+      });
       const byId = new Map(executed.map((r) => [r.tool_call_id, r]));
       for (const { call, verdict } of verdicts) {
         if (verdict.allowed) {
           const done = byId.get(call.id);
           if (done) {
-            messages.push({ role: "tool", content: capResult(done.content), tool_call_id: done.tool_call_id });
+            messages.push({ role: "tool", content: done.content, tool_call_id: done.tool_call_id });
             continue;
           }
           messages.push({
@@ -2142,23 +3248,23 @@ function buildHandler(deps) {
       }
     }
     if (!response) {
-      log("warn", `no final answer after ${maxIterations} iterations; dropping the turn`);
+      log("warn", "turn.no_final_answer", { iterations: maxIterations });
       return null;
     }
     memory.addMessage({ role: "assistant", content: response });
-    log("info", `response ready (chars=${response.length})`);
+    log("info", "turn.response_ready", { chars: response.length });
     return response;
-  };
+  }
 }
 
 // src/persona.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7, renameSync as renameSync2, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync8, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/long-term-memory.ts
-import { createHash } from "node:crypto";
-import { chmodSync, existsSync as existsSync4, lstatSync, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync4, lstatSync, readFileSync as readFileSync7, readdirSync as readdirSync2, renameSync as renameSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 var MEMORY_FILE = "MEMORY.md";
 var QUARANTINE_MEMORY_FILE = "MEMORY.quarantined.md";
@@ -2173,14 +3279,14 @@ function quarantineOrder(a, b) {
   return index(a) - index(b) || a.localeCompare(b);
 }
 function sourceId(kind, channelId, path, bytes) {
-  return createHash("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
+  return createHash2("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
 }
 function readLegacySource(path, kind, contentBudget, channelId) {
   try {
     let st = lstatSync(path);
     if (st.isSymbolicLink() || !st.isFile()) return null;
     if ((st.mode & 511) !== 384) {
-      chmodSync(path, 384);
+      chmodSync2(path, 384);
       st = lstatSync(path);
     }
     if (st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES) {
@@ -2196,7 +3302,7 @@ function readLegacySource(path, kind, contentBudget, channelId) {
       };
     }
     if (st.size > contentBudget) return null;
-    const bytes = readFileSync6(path);
+    const bytes = readFileSync7(path);
     if (bytes.byteLength > LEGACY_MEMORY_SOURCE_MAX_BYTES || bytes.byteLength > contentBudget) return null;
     return {
       id: sourceId(kind, channelId, path, bytes),
@@ -2281,7 +3387,7 @@ function legacyMemoryFingerprint(managedDir, dataDir) {
     }
   } catch {
   }
-  return createHash("sha256").update(metadata.join("\n")).digest("hex");
+  return createHash2("sha256").update(metadata.join("\n")).digest("hex");
 }
 function nextQuarantinePath(dir) {
   const first = join6(dir, QUARANTINE_MEMORY_FILE);
@@ -2300,8 +3406,8 @@ function quarantineLegacyMemory(managedDir, dataDir) {
       throw new Error(`refusing to quarantine symlinked legacy memory: ${source}`);
     }
     const target = nextQuarantinePath(dir);
-    renameSync(source, target);
-    chmodSync(target, 384);
+    renameSync2(source, target);
+    chmodSync2(target, 384);
     moved.push(target);
   }
   return moved;
@@ -2322,7 +3428,7 @@ var SAFETY_PREAMBLE = [
   "- Only use the tools you were given; do not invent capabilities."
 ].join("\n");
 function defaultPersonaDir() {
-  return join7(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
+  return join7(dirname5(fileURLToPath2(import.meta.url)), "..", "persona");
 }
 function assemblePrompt(parts) {
   return parts.map((p) => `${p.heading}
@@ -2335,13 +3441,13 @@ function loadPersona(dirs) {
     if (!path) continue;
     let body;
     try {
-      body = readFileSync7(path, "utf8");
-    } catch {
-      console.warn(`[persona] cannot read ${path}; ignoring it`);
+      body = readFileSync8(path, "utf8");
+    } catch (error) {
+      writeServiceLog("warn", "persona.read_failed", {}, error);
       continue;
     }
     if (Buffer.byteLength(body, "utf8") > PERSONA_MAX_BYTES) {
-      console.warn(`[persona] ${path} is larger than ${PERSONA_MAX_BYTES} bytes; truncating`);
+      writeServiceLog("warn", "persona.truncated", { max_bytes: PERSONA_MAX_BYTES });
       body = body.slice(0, PERSONA_MAX_BYTES);
     }
     const trimmed = body.trim();
@@ -2361,7 +3467,7 @@ function writeLocalConfigReport(managedDir, dataDir, now, flags) {
     const path2 = join7(dataDir, file);
     if (!existsSync5(path2)) continue;
     try {
-      persona[file] = readFileSync7(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
+      persona[file] = readFileSync8(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
     } catch {
     }
   }
@@ -2378,9 +3484,9 @@ function writeLocalConfigReport(managedDir, dataDir, now, flags) {
   const path = join7(managedDir, "local-config.json");
   const tmp = `${path}.${process.pid}.tmp`;
   try {
-    writeFileSync(tmp, `${JSON.stringify(doc, null, 2)}
+    writeFileSync2(tmp, `${JSON.stringify(doc, null, 2)}
 `, { mode: 384 });
-    renameSync2(tmp, path);
+    renameSync3(tmp, path);
   } catch (e) {
     try {
       unlinkSync(tmp);
@@ -2399,7 +3505,7 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
       skipped.push(target);
       continue;
     }
-    writeFile(target, readFileSync7(join7(defaultsDir, file), "utf8"));
+    writeFile(target, readFileSync8(join7(defaultsDir, file), "utf8"));
     written.push(target);
   }
   return { written, skipped };
@@ -2431,31 +3537,32 @@ function installWarningFilter(proc = process) {
     proc.removeListener("warning", listener);
   }
   proc.on("warning", (w) => {
-    if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
-    console.error(w.stack ?? `${w.name}: ${w.message}`);
+    try {
+      if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
+    } catch {
+    }
+    writeServiceLog("warn", "runtime.node_warning", {}, w);
   });
 }
 
 // src/index.ts
 if (process.argv.includes("--version")) {
-  const pkg = JSON.parse(readFileSync8(join8(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync9(join8(dirname6(dirname6(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
   console.log(pkg.version);
   process.exit(0);
 }
 var LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
 function makeLogger(cfg) {
   const floor = LEVEL_RANK[cfg.logLevel];
-  return (level, msg) => {
+  return (level, event, fields, error) => {
     if (LEVEL_RANK[level] < floor) return;
-    const line = `[runtime] ${level}: ${msg}`;
-    if (level === "warn" || level === "error") console.error(line);
-    else console.log(line);
+    writeServiceLog(level, event, fields, error);
   };
 }
 function realLlmSourceDeps() {
   return {
     home: homedir4(),
-    readFile: (p) => readFileSync8(p, "utf8"),
+    readFile: (p) => readFileSync9(p, "utf8"),
     statFile: (p) => ({ mode: statSync2(p).mode }),
     exists: (p) => existsSync6(p)
   };
@@ -2467,9 +3574,9 @@ function realServiceDeps() {
       const r = spawnSync(cmd, args, { encoding: "utf8" });
       return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
     },
-    writeFile: (p, data) => writeFileSync2(p, data, { mode: 420 }),
+    writeFile: (p, data) => writeFileSync3(p, data, { mode: 420 }),
     removeFile: (p) => rmSync(p, { force: true }),
-    mkdirp: (p) => mkdirSync(p, { recursive: true }),
+    mkdirp: (p) => mkdirSync3(p, { recursive: true }),
     fileExists: (p) => existsSync6(p),
     canRead: (p) => {
       try {
@@ -2566,6 +3673,46 @@ async function main() {
   installWarningFilter();
   const verb = parseVerb(process.argv);
   if (verb) runServiceVerb(verb);
+  const sideEffectsVerb = parseSideEffectsVerb(process.argv);
+  if (process.argv[2] === "side-effects" && !sideEffectsVerb) {
+    console.error("securecoms-agent: side-effects requires list or resolve");
+    process.exit(2);
+  }
+  if (sideEffectsVerb) {
+    let cfgForLedger;
+    try {
+      cfgForLedger = loadConfig(process.argv.slice(2), process.env);
+    } catch (e) {
+      console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+      process.exit(2);
+      return;
+    }
+    const ledger = new SideEffectLedger(join8(cfgForLedger.dataDir, "side-effect-ledger.sqlite"));
+    try {
+      if (sideEffectsVerb === "list") {
+        console.log(JSON.stringify({ ambiguous: ledger.listAmbiguous() }, null, 2));
+      } else {
+        const flags = parseSideEffectResolveFlags(process.argv);
+        if (!flags.idempotencyKey || !flags.operationSha256 || !/^[0-9a-f]{64}$/.test(flags.operationSha256) || !flags.confirmationId || !flags.outcome) {
+          throw new Error(
+            "resolve requires --idempotency-key, --operation-sha256, --confirmation-id, and --outcome completed|not_applied"
+          );
+        }
+        ledger.reconcile({
+          idempotency_key: flags.idempotencyKey,
+          operation_sha256: flags.operationSha256,
+          confirmation_id: flags.confirmationId
+        }, flags.outcome, /* @__PURE__ */ new Date());
+        console.log(JSON.stringify({ reconciled: true, outcome: flags.outcome }));
+      }
+    } catch (e) {
+      console.error(`securecoms-agent: side-effects ${sideEffectsVerb} failed: ${e instanceof Error ? e.message : String(e)}`);
+      process.exitCode = 1;
+    } finally {
+      ledger.close();
+    }
+    process.exit(process.exitCode ?? 0);
+  }
   const personaVerb = parsePersonaVerb(process.argv);
   if (personaVerb) {
     let cfgForPersona;
@@ -2577,11 +3724,11 @@ async function main() {
       return;
     }
     if (personaVerb === "init") {
-      mkdirSync(cfgForPersona.dataDir, { recursive: true });
+      mkdirSync3(cfgForPersona.dataDir, { recursive: true });
       const r = personaInit(
         cfgForPersona.dataDir,
         defaultPersonaDir(),
-        (p, d) => writeFileSync2(p, d, { mode: 384 }),
+        (p, d) => writeFileSync3(p, d, { mode: 384 }),
         (p) => existsSync6(p)
       );
       for (const p of r.written) console.log(`wrote ${p}`);
@@ -2600,12 +3747,27 @@ async function main() {
   try {
     cfg = loadConfig(process.argv.slice(2), process.env);
   } catch (e) {
-    console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+    const argv = process.argv.slice(2);
+    const hasIdentityArg = argv.some(
+      (arg, index) => arg === "--identity" && !!argv[index + 1] || arg.startsWith("--identity=") && arg.length > 11
+    );
+    writeServiceLog(
+      "error",
+      !hasIdentityArg && !process.env.SECURECOMS_IDENTITY ? "runtime.identity_required.use_--identity" : "runtime.config_invalid",
+      {},
+      e
+    );
     process.exit(2);
     return;
   }
   const log = makeLogger(cfg);
-  const llm = buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+  const budget = new DailyLlmBudget({
+    callLimit: cfg.llmDailyCallLimit ?? DEFAULT_DAILY_CALL_LIMIT,
+    tokenLimit: cfg.llmDailyTokenLimit ?? DEFAULT_DAILY_TOKEN_LIMIT,
+    statePath: join8(cfg.dataDir, `llm-budget-${cfg.identityId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`),
+    log
+  });
+  const llm = withDailyBudget(buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()), budget);
   const memories = /* @__PURE__ */ new Map();
   const memoryFor = (channelId) => {
     let mem = memories.get(channelId);
@@ -2629,18 +3791,29 @@ async function main() {
     const path = keyFilePath(which);
     if (!path) return null;
     try {
-      return readFileSync8(path, "utf8").trim() || null;
-    } catch {
-      log("warn", `cannot read the ${which} key file ${path}`);
+      return readFileSync9(path, "utf8").trim() || null;
+    } catch (e) {
+      log("warn", "runtime.search_key_unreadable", { provider_brave: which === "brave" }, e);
       return null;
     }
   };
   const configDirs = configSearchPath(cfg.identityId, cfg.dataDir);
-  const hasSearchKey = () => hasReadableKeyFile([keyFilePath("brave"), keyFilePath("tavily")], (p) => readFileSync8(p, "utf8"));
+  const reportSearchKeyGate = searchKeyGateReporter(log, (p) => p === keyFilePath("brave"));
+  const hasSearchKey = () => hasReadableKeyFile(
+    [keyFilePath("brave"), keyFilePath("tavily")],
+    (p) => readFileSync9(p, "utf8"),
+    reportSearchKeyGate
+  );
+  const reportLlmSourceUnresolved = failureEpisodeReporter(
+    (e) => log("warn", "runtime.llm_source_unresolved", {}, e)
+  );
   const hasLlmKey = () => {
     try {
-      return hasLlmKeyFor(resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()));
-    } catch {
+      const source = resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+      reportLlmSourceUnresolved.succeeded();
+      return hasLlmKeyFor(source);
+    } catch (e) {
+      reportLlmSourceUnresolved.failed(e);
       return false;
     }
   };
@@ -2659,7 +3832,8 @@ async function main() {
     now: () => /* @__PURE__ */ new Date(),
     log
   };
-  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx);
+  const sideEffectLedger = new SideEffectLedger(join8(cfg.dataDir, "side-effect-ledger.sqlite"));
+  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx, sideEffectLedger);
   skills.loadSkills();
   const policyFor = () => resolveToolPolicy(cfg.toolGateEnv, currentSkillsConfig().tools, {
     default: cfg.toolGate.default,
@@ -2673,11 +3847,11 @@ async function main() {
     reportLocalConfig({ hasSearchKey: searchKey, hasLlmKey: hasLlmKey() });
     return skills.available(requiresEnvFrom(sc, searchKey)).filter((t) => g.gate(t.function.name).allowed);
   };
-  for (const held of skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey()))) {
-    console.log(`unavailable: ${held.name} (missing ${held.missing.join(", ")})`);
-  }
+  const unavailableCount = skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey())).length;
+  if (unavailableCount > 0) log("info", "runtime.skills_unavailable", { count: unavailableCount });
   const plane = createSecureComsDataPlane(
-    { identityId: cfg.identityId, log: (level, msg) => log(level, msg) },
+    // Final-wave I2: the daily-limit reply is a notice, not an agent turn.
+    { identityId: cfg.identityId, log, noticeReplies: /* @__PURE__ */ new Set([DAILY_LIMIT_RESPONSE]) },
     buildHandler({
       llm,
       memoryFor,
@@ -2691,16 +3865,21 @@ async function main() {
       tools: installationEligibleTools
     })
   );
-  console.log(
-    `${bootLine(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps())}, ${installationEligibleTools().length} configured skills (channel grant required), tool gate default=${cfg.toolGate.default}`
-  );
+  log("info", "runtime.started", {
+    configured_skills: installationEligibleTools().length,
+    tool_gate_default_deny: cfg.toolGate.default === "deny"
+  });
   await plane.start();
   const shutdown = () => {
-    log("info", "shutting down");
+    log("info", "runtime.shutting_down");
     plane.stop();
+    sideEffectLedger.close();
     process.exit(0);
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 }
-void main();
+void main().catch((error) => {
+  writeServiceLog("error", "runtime.fatal", {}, error);
+  process.exit(1);
+});