@securecoms/agent-runtime 0.7.0 → 0.9.1

package/dist/bin.js

@@ -1,17 +1,1052 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname7, join as join8 } from "node:path";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync6, mkdirSync, realpathSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6, mkdirSync as mkdirSync4, realpathSync, rmSync, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir4, userInfo } from "node:os";
 
 // src/config.ts
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname as dirname3, join } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/service-log.ts
+var LogLabel = class _LogLabel {
+  constructor(value) {
+    this.value = value;
+  }
+  static of(value) {
+    return new _LogLabel(LABEL.test(value) ? value : "invalid");
+  }
+};
+function logLabel(value) {
+  return LogLabel.of(value);
+}
+var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+var LABEL = /^[A-Za-z0-9][A-Za-z0-9_.:/@+-]{0,127}$/;
+function errorClass(error) {
+  if (error === null) return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog(level, event, fields = {}, error) {
+  const safeEvent = TOKEN.test(event) ? event : "invalid_event";
+  const parts = [`[runtime] ${level} ${safeEvent}`];
+  for (const [key, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN.test(key)) continue;
+    if (typeof value === "boolean") parts.push(`${key}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key}=${value}`);
+    else if (value instanceof LogLabel) parts.push(`${key}=${LABEL.test(value.value) ? value.value : "invalid"}`);
+  }
+  if (error !== void 0) parts.push(`error_class=${errorClass(error)}`);
+  return parts.join(" ");
+}
+function failureEpisodeReporter(warn) {
+  let lastClass = null;
+  return {
+    failed(error) {
+      const cls = errorClass(error);
+      if (cls === lastClass) return;
+      lastClass = cls;
+      try {
+        warn(error);
+      } catch {
+      }
+    },
+    succeeded() {
+      lastClass = null;
+    }
+  };
+}
+function writeServiceLog(level, event, fields, error) {
+  const line = formatServiceLog(level, event, fields, error);
+  if (level === "error") console.error(line);
+  else if (level === "warn") console.warn(line);
+  else console.log(line);
+}
+
+// src/llm-dispatch.ts
+var MAX_REPORTED_TOKENS_PER_CALL = 1e7;
+function requestTokenBound(encodedBody, cap) {
+  return Math.min(Buffer.byteLength(encodedBody, "utf8") + cap.cap, MAX_REPORTED_TOKENS_PER_CALL);
+}
+function tokenCount(value, max) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
+  return Math.min(Math.floor(value), max);
+}
+var NEVER_SENT_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN", "ECONNREFUSED"]);
+function neverSent(error) {
+  const cause = error?.cause;
+  if (!cause || typeof cause !== "object") return false;
+  if (typeof cause.code === "string" && NEVER_SENT_CODES.has(cause.code)) return true;
+  const errors = cause.errors;
+  return Array.isArray(errors) && errors.length > 0 && errors.every((e) => typeof e?.code === "string" && NEVER_SENT_CODES.has(e.code));
+}
+var failedCallTokens = /* @__PURE__ */ new WeakMap();
+function reportedTokensOf(error) {
+  return typeof error === "object" && error !== null ? failedCallTokens.get(error) : void 0;
+}
+var LLM_REQUEST_MAX_BYTES = 128 * 1024;
+var LLM_RESPONSE_MAX_BYTES = 128 * 1024;
+var LLM_REQUEST_TIMEOUT_MS = 18e4;
+var DEFAULT_MAX_OUTPUT_TOKENS = 8192;
+var CAP_RETRY_FALLBACK_TOKENS = 4096;
+var MIN_PARSED_OUTPUT_LIMIT = 256;
+var CAP_REJECTED_MAX = 256;
+var capOverrides = /* @__PURE__ */ new Map();
+function remember(key, cap) {
+  if (capOverrides.size >= CAP_REJECTED_MAX && !capOverrides.has(key)) {
+    const oldest = capOverrides.keys().next();
+    if (!oldest.done) capOverrides.delete(oldest.value);
+  }
+  capOverrides.set(key, cap);
+}
+var CAP_ERROR_SCAN_BYTES = 16 * 1024;
+var CAP_FIELD_NAMED = /max_(?:completion_|output_)?tokens/i;
+var CONTEXT_OVERFLOW_NAMED = /prompt|context|input[\s_-]*(?:length|tokens)/i;
+async function readCapRejection(resp, sent, maxTokens) {
+  const none = { retry: null, tokens: void 0 };
+  const reader = resp.body?.getReader();
+  if (!reader) return none;
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < CAP_ERROR_SCAN_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } catch {
+    return none;
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+  const text = new TextDecoder().decode(Buffer.concat(chunks).subarray(0, CAP_ERROR_SCAN_BYTES));
+  let tokens;
+  try {
+    const parsed = JSON.parse(text);
+    tokens = tokenCount(parsed?.usage?.total_tokens, maxTokens);
+  } catch {
+  }
+  if (!CAP_FIELD_NAMED.test(text) || CONTEXT_OVERFLOW_NAMED.test(text)) return { retry: null, tokens };
+  let stated;
+  for (const match of text.matchAll(STATED_LIMIT)) {
+    const n = Number(match[1]);
+    if (n >= MIN_PARSED_OUTPUT_LIMIT && n < sent.cap && (stated === void 0 || n > stated)) stated = n;
+  }
+  const other = sent.field === "max_tokens" ? "max_completion_tokens" : "max_tokens";
+  const namesOther = other === "max_tokens" ? /(?<![a-z_])max_tokens/i.test(text) : /max_completion_tokens/i.test(text);
+  if (namesOther) return { retry: { field: other, cap: stated ?? sent.cap }, tokens };
+  const cap = stated ?? capFallback(sent.cap);
+  return { retry: cap >= 1 ? { field: sent.field, cap } : null, tokens };
+}
+var STATED_LIMIT = /(?:>|<=|≤|at most|up to|no more than|not exceed|less than or equal to|maximum(?: of| is|:)?|limit(?: of| is|:)?)\s*[`'"]?(\d{1,9})(?![\d.])/gi;
+function capFallback(rejected) {
+  return Math.min(CAP_RETRY_FALLBACK_TOKENS, Math.floor(rejected / 2));
+}
+function outputCapField(endpoint) {
+  try {
+    return new URL(endpoint).hostname === "api.openai.com" ? "max_completion_tokens" : "max_tokens";
+  } catch {
+    return "max_tokens";
+  }
+}
+function normalizeEndpoint(endpoint) {
+  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
+}
+var LLMDispatcher = class {
+  endpoint;
+  model;
+  apiKey;
+  chatPath;
+  chatAuth;
+  authHeaderName;
+  fetch;
+  timeoutMs;
+  requestMaxBytes;
+  responseMaxBytes;
+  maxOutputTokens;
+  log;
+  constructor(endpoint, model, opts = {}) {
+    this.endpoint = normalizeEndpoint(endpoint);
+    this.model = model;
+    this.apiKey = opts.apiKey;
+    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
+    this.chatAuth = opts.chatAuth ?? "bearer";
+    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
+    this.fetch = opts.fetch ?? fetch;
+    this.timeoutMs = opts.timeoutMs ?? LLM_REQUEST_TIMEOUT_MS;
+    this.requestMaxBytes = opts.requestMaxBytes ?? LLM_REQUEST_MAX_BYTES;
+    this.responseMaxBytes = opts.responseMaxBytes ?? LLM_RESPONSE_MAX_BYTES;
+    this.maxOutputTokens = opts.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
+    this.log = opts.log ?? writeServiceLog;
+  }
+  async complete(messages, tools, options = {}) {
+    const body = {
+      model: this.model,
+      messages,
+      stream: false
+    };
+    const capKey = `${this.endpoint}\0${this.model}`;
+    if (tools && tools.length > 0) {
+      body.tools = tools;
+    }
+    const url = `${this.endpoint}${this.chatPath}`;
+    const headers = { "Content-Type": "application/json" };
+    if (this.apiKey && this.chatAuth === "bearer") {
+      headers.Authorization = `Bearer ${this.apiKey}`;
+    } else if (this.apiKey && this.chatAuth === "x-api-key") {
+      headers[this.authHeaderName] = this.apiKey;
+    }
+    const encode = (cap2) => {
+      const encoded = JSON.stringify({ ...body, [cap2.field]: cap2.cap });
+      if (Buffer.byteLength(encoded, "utf8") > this.requestMaxBytes) {
+        throw new Error("LLM request exceeded the size limit");
+      }
+      return encoded;
+    };
+    const override = capOverrides.get(capKey);
+    let cap = override ? { field: override.field, cap: Math.min(override.cap, this.maxOutputTokens) } : { field: outputCapField(this.endpoint), cap: this.maxOutputTokens };
+    let encodedBody = encode(cap);
+    let reportedTokens = 0;
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(options.signal?.reason);
+    if (options.signal?.aborted) cancel();
+    else options.signal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("LLM request deadline exceeded"));
+    }, this.timeoutMs);
+    let settle;
+    let abortedAtDispatch = false;
+    const settleWith = (outcome) => {
+      const s = settle;
+      settle = void 0;
+      s?.(outcome);
+    };
+    const usageOutcome = (tokens) => tokens !== void 0 ? { kind: "reported", tokens } : { kind: "unreported" };
+    try {
+      const post = () => {
+        settle = options.meter?.(requestTokenBound(encodedBody, cap));
+        abortedAtDispatch = controller.signal.aborted;
+        return this.fetch(url, {
+          method: "POST",
+          headers,
+          body: encodedBody,
+          signal: controller.signal,
+          redirect: "error"
+        });
+      };
+      let resp = await post();
+      if (resp.status === 400) {
+        const rejection = await readCapRejection(resp, cap, requestTokenBound(encodedBody, cap));
+        reportedTokens += rejection.tokens ?? 0;
+        settleWith(usageOutcome(rejection.tokens));
+        if (rejection.retry) {
+          const retry = rejection.retry;
+          this.log("warn", "llm.output_cap_rejected", {
+            retry_cap: retry.cap,
+            field_switched: retry.field !== cap.field
+          });
+          const rejected = cap;
+          cap = retry;
+          encodedBody = encode(cap);
+          options.beforeRetry?.();
+          resp = await post();
+          if (resp.ok) remember(capKey, retry);
+          else if (resp.status === 400) {
+            remember(capKey, { field: retry.field, cap: Math.min(retry.cap, capFallback(rejected.cap)) });
+          }
+          if (resp.status === 400) {
+            const second = (await readCapRejection(resp, cap, requestTokenBound(encodedBody, cap))).tokens;
+            reportedTokens += second ?? 0;
+            settleWith(usageOutcome(second));
+            throw new Error("LLM request failed (400)");
+          }
+        } else {
+          throw new Error("LLM request failed (400)");
+        }
+      }
+      if (!resp.ok) {
+        await resp.body?.cancel();
+        settleWith({ kind: "unreported" });
+        throw new Error(`LLM request failed (${resp.status})`);
+      }
+      const data = await readJsonCapped(resp, this.responseMaxBytes);
+      const maxTokens = requestTokenBound(encodedBody, cap);
+      const totalTokens = tokenCount(data?.usage?.total_tokens, maxTokens);
+      const promptTokens = tokenCount(data?.usage?.prompt_tokens, maxTokens);
+      const completionTokens = tokenCount(data?.usage?.completion_tokens, maxTokens);
+      if (totalTokens !== void 0) reportedTokens += totalTokens;
+      settleWith(usageOutcome(totalTokens));
+      const choice = data?.choices?.[0];
+      if (!choice?.message) throw new Error("LLM returned no choices");
+      return {
+        content: choice.message.content,
+        toolCalls: choice.message.tool_calls || [],
+        finishReason: choice.finish_reason,
+        ...reportedTokens > 0 || totalTokens !== void 0 ? {
+          usage: {
+            // Every attempt's reported tokens: a rejected first attempt
+            // was billed too.
+            totalTokens: reportedTokens,
+            ...promptTokens !== void 0 ? { promptTokens } : {},
+            ...completionTokens !== void 0 ? { completionTokens } : {}
+          }
+        } : {}
+      };
+    } catch (error) {
+      if (settle) {
+        const provablyNotSent = abortedAtDispatch || !timedOut && !options.signal?.aborted && neverSent(error);
+        settleWith(provablyNotSent ? { kind: "not_sent" } : { kind: "unreported" });
+      }
+      const failure = timedOut ? new Error(`LLM request timed out after ${this.timeoutMs}ms`) : options.signal?.aborted ? new Error("LLM request cancelled") : error;
+      if (reportedTokens > 0 && typeof failure === "object" && failure !== null) {
+        failedCallTokens.set(failure, reportedTokens);
+      }
+      throw failure;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", cancel);
+    }
+  }
+};
+async function readJsonCapped(resp, maxBytes) {
+  const reader = resp.body?.getReader();
+  if (!reader) throw new Error("LLM returned an empty response");
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => {
+        });
+        throw new Error("LLM response exceeded the size limit");
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {
+    });
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const joined = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    joined.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(joined));
+}
+
+// src/llm-budget.ts
+import { closeSync as closeSync2, fsyncSync as fsyncSync2, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync2, renameSync, writeSync as writeSync2 } from "node:fs";
+import { basename, dirname as dirname2 } from "node:path";
+
+// src/llm-budget-lock.ts
+import { execFileSync } from "node:child_process";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, utimesSync, writeSync } from "node:fs";
+import { hostname, uptime } from "node:os";
+import { dirname } from "node:path";
+var LOCK_PARTIAL_WRITE_GRACE_MS = 1e4;
+var LOCK_TAKEOVER_GUARD_STALE_MS = 3e4;
+var BOOT_TOLERANCE_SEC = 120;
+var LOCK_HEARTBEAT_MS = 6e4;
+var LOCK_FOREIGN_STALE_MS = 10 * LOCK_HEARTBEAT_MS;
+function errno(error) {
+  const code = error?.code;
+  return typeof code === "string" ? code : void 0;
+}
+function readTrimmed(path) {
+  try {
+    const v = readFileSync(path, "utf8").trim();
+    return v === "" ? void 0 : v;
+  } catch {
+    return void 0;
+  }
+}
+function procStartFromStat(stat) {
+  const close = stat.lastIndexOf(")");
+  if (close < 0) return void 0;
+  const rest = stat.slice(close + 1).trim().split(/\s+/);
+  const v = rest[19];
+  return v !== void 0 && /^\d+$/.test(v) ? v : void 0;
+}
+function pidAliveByKill(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errno(error) === "EPERM";
+  }
+}
+var bootIdCache;
+function readBootId() {
+  if (bootIdCache) return bootIdCache.v;
+  let v = readTrimmed("/proc/sys/kernel/random/boot_id");
+  if (v === void 0 && process.platform === "darwin") {
+    try {
+      const out = execFileSync("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"], {
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      v = /^[0-9A-Fa-f-]{16,64}$/.test(out) ? out : void 0;
+    } catch {
+      v = void 0;
+    }
+  }
+  bootIdCache = { v };
+  return v;
+}
+var realLockEnv = {
+  pid: process.pid,
+  hostname: () => hostname(),
+  bootId: readBootId,
+  bootEpochSec: () => Math.round(Date.now() / 1e3 - uptime()),
+  procStart: (pid) => {
+    const stat = readTrimmed(`/proc/${pid}/stat`);
+    return stat ? procStartFromStat(stat) : void 0;
+  },
+  pidAlive: pidAliveByKill
+};
+function parseBody(raw) {
+  try {
+    const b = JSON.parse(raw);
+    if (b && b.v === 2 && Number.isInteger(b.pid) && b.pid > 0 && typeof b.host === "string" && Number.isFinite(b.boot)) {
+      return b;
+    }
+  } catch {
+  }
+  return void 0;
+}
+var BudgetLock = class {
+  constructor(path, env = realLockEnv, log = () => {
+  }, heartbeatMs = LOCK_HEARTBEAT_MS) {
+    this.path = path;
+    this.env = env;
+    this.log = log;
+    this.heartbeatMs = heartbeatMs;
+  }
+  held = false;
+  /** The exact body this process wrote (#808 N1): release and the ownership
+   *  check compare the file against THIS, never against live machine facts
+   *  (a hostname can change under a running process). */
+  written;
+  heartbeat;
+  /** The error behind the last `unreadable` / `failed`, for the caller's one
+   *  log line (the lock itself never logs a refusal: it is retried per call). */
+  lastError;
+  body() {
+    const bootId = this.env.bootId();
+    const start = this.env.procStart(this.env.pid);
+    const b = {
+      v: 2,
+      pid: this.env.pid,
+      host: this.env.hostname(),
+      ...bootId !== void 0 ? { boot_id: bootId } : {},
+      boot: this.env.bootEpochSec(),
+      ...start !== void 0 ? { start } : {}
+    };
+    return JSON.stringify(b);
+  }
+  /** Try to hold the lock. Never throws (#808 L-e: machine reads included). */
+  acquire() {
+    try {
+      return this.acquireUnguarded();
+    } catch (error) {
+      this.lastError = error;
+      return "failed";
+    }
+  }
+  /**
+   * True while the file is still exactly the body this process wrote. Read
+   * before every reserve (one small read), so a holder whose lock was taken
+   * while it was frozen stops before it spends (#808 N1). A lost lock is
+   * dropped: the caller then refuses, and later calls try to re-acquire.
+   */
+  stillHeld() {
+    if (!this.held) return false;
+    let current;
+    try {
+      current = readFileSync(this.path, "utf8");
+    } catch {
+      current = void 0;
+    }
+    if (current !== void 0 && current === this.written) return true;
+    this.drop();
+    this.log("warn", "llm.budget_lock_lost", {});
+    return false;
+  }
+  acquireUnguarded() {
+    if (this.held) return "acquired";
+    const created = this.create();
+    if (created === "created") return this.took();
+    if (created === "failed") return "failed";
+    let raw;
+    let ageMs;
+    this.env.beforeLockRead?.();
+    try {
+      raw = readFileSync(this.path, "utf8");
+      ageMs = Date.now() - statSync(this.path).mtimeMs;
+    } catch (error) {
+      if (errno(error) === "ENOENT") {
+        const again = this.create();
+        return again === "created" ? this.took() : again === "failed" ? "failed" : "busy";
+      }
+      this.lastError = error;
+      return "unreadable";
+    }
+    const b = parseBody(raw);
+    if (!b) {
+      if (ageMs < LOCK_PARTIAL_WRITE_GRACE_MS) return "busy";
+      return this.takeOver(raw, void 0);
+    }
+    if (b.host !== this.env.hostname()) {
+      const bootId = this.env.bootId();
+      const sameKernel = b.boot_id !== void 0 && bootId !== void 0 && b.boot_id === bootId;
+      if (sameKernel && ageMs > LOCK_FOREIGN_STALE_MS) return this.takeOver(raw, b.pid);
+      return "foreign_host";
+    }
+    if (!this.sameBoot(b)) return this.takeOver(raw, b.pid);
+    const liveStart = this.env.procStart(b.pid);
+    const reused = b.start !== void 0 && liveStart !== void 0 && liveStart !== b.start;
+    if (b.pid === this.env.pid) {
+      if (!reused) return this.took();
+      return this.takeOver(raw, b.pid);
+    }
+    if (this.env.pidAlive(b.pid) && !reused) return "held";
+    return this.takeOver(raw, b.pid);
+  }
+  /** Remove the lock only while it is still exactly the body this process
+   *  wrote (#808 N1: not the live hostname, which can change under us). */
+  release() {
+    if (!this.held) return;
+    const written = this.written;
+    this.drop();
+    try {
+      if (written !== void 0 && readFileSync(this.path, "utf8") === written) unlinkSync(this.path);
+    } catch {
+    }
+  }
+  drop() {
+    this.held = false;
+    if (this.heartbeat) clearInterval(this.heartbeat);
+    this.heartbeat = void 0;
+  }
+  /** We hold it: remember what we wrote (the file as it is now, ours) and
+   *  start the heartbeat. */
+  took() {
+    this.held = true;
+    try {
+      this.written = readFileSync(this.path, "utf8");
+    } catch {
+      this.written = void 0;
+    }
+    if (!this.heartbeat && this.heartbeatMs > 0) {
+      this.heartbeat = setInterval(() => this.beat(), this.heartbeatMs);
+      this.heartbeat.unref?.();
+    }
+    return "acquired";
+  }
+  /** Refresh the mtime while the file is still ours; stop if it is not. */
+  beat() {
+    if (!this.stillHeld()) return;
+    try {
+      const now = /* @__PURE__ */ new Date();
+      utimesSync(this.path, now, now);
+    } catch {
+    }
+  }
+  sameBoot(b) {
+    const bootId = this.env.bootId();
+    if (b.boot_id !== void 0 && bootId !== void 0) return b.boot_id === bootId;
+    return Math.abs(b.boot - this.env.bootEpochSec()) <= BOOT_TOLERANCE_SEC;
+  }
+  /** O_EXCL create with our body. A write failure removes the half-written
+   *  file (it is ours: we created it) and reports `failed`, never throws. */
+  create() {
+    let fd;
+    try {
+      mkdirSync(dirname(this.path), { recursive: true });
+      fd = openSync(this.path, "wx", 384);
+    } catch (error) {
+      if (errno(error) === "EEXIST") return "exists";
+      this.lastError = error;
+      return "failed";
+    }
+    try {
+      writeSync(fd, this.body());
+      fsyncSync(fd);
+    } catch (error) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+      try {
+        unlinkSync(this.path);
+      } catch {
+      }
+      this.lastError = error;
+      return "failed";
+    }
+    closeSync(fd);
+    return "created";
+  }
+  /**
+   * Replace a stale lock. Only the holder of the O_EXCL takeover guard may
+   * remove a lock, and only after re-reading it UNCHANGED, so two runtimes
+   * that both saw the same stale lock cannot each delete the other's new one.
+   * A fresh guard means a takeover is in progress: busy this time.
+   */
+  takeOver(staleRaw, stalePid, retryGuard = true) {
+    const guard = `${this.path}.takeover`;
+    let fd;
+    try {
+      fd = openSync(guard, "wx", 384);
+    } catch (error) {
+      if (errno(error) !== "EEXIST") return "failed";
+      let crashed = false;
+      try {
+        crashed = Date.now() - statSync(guard).mtimeMs > LOCK_TAKEOVER_GUARD_STALE_MS;
+        if (crashed) unlinkSync(guard);
+      } catch {
+        crashed = false;
+      }
+      if (crashed && retryGuard) return this.takeOver(staleRaw, stalePid, false);
+      return "busy";
+    }
+    closeSync(fd);
+    try {
+      this.env.beforeTakeoverReread?.();
+      let current;
+      try {
+        current = readFileSync(this.path, "utf8");
+      } catch {
+        current = void 0;
+      }
+      if (current !== void 0 && current !== staleRaw) return "held";
+      if (current !== void 0) unlinkSync(this.path);
+      this.env.beforeTakeoverCreate?.();
+      const created = this.create();
+      if (created !== "created") return created === "failed" ? "failed" : "held";
+      this.log("warn", "llm.budget_lock_stale_taken_over", stalePid !== void 0 ? { stale_pid: stalePid } : {});
+      return this.took();
+    } catch (error) {
+      this.lastError = error;
+      return "failed";
+    } finally {
+      try {
+        unlinkSync(guard);
+      } catch {
+      }
+    }
+  }
+};
+
+// src/llm-budget.ts
+var DEFAULT_DAILY_CALL_LIMIT = 2e3;
+var DEFAULT_DAILY_TOKEN_LIMIT = 5e6;
+var DailyLimitReachedError = class extends Error {
+  constructor(day) {
+    super("daily LLM budget reached");
+    this.day = day;
+    this.name = "DailyLimitReachedError";
+  }
+};
+var RequestExceedsDailyTokenCapError = class extends Error {
+  constructor(reserve, tokenLimit) {
+    super("one LLM request's worst case exceeds the daily token limit");
+    this.reserve = reserve;
+    this.tokenLimit = tokenLimit;
+    this.name = "RequestExceedsDailyTokenCapError";
+  }
+};
+var BudgetLockHeldError = class extends Error {
+  constructor(reason = "held") {
+    super("this runtime does not hold its identity's LLM budget lock");
+    this.reason = reason;
+    this.name = "BudgetLockHeldError";
+  }
+};
+function logLockRefusal(log, level, reason, lockPath, cause) {
+  const where = lockPath ? { lock_file: logLabel(basename(lockPath)), lock_path: logLabel(lockPath.replace(/^\/+/, "")) } : {};
+  switch (reason) {
+    case "held":
+      return log(level, "llm.budget_lock_held", where, cause);
+    case "foreign_host":
+      return log(level, "llm.budget_lock_foreign_host", {
+        ...where,
+        remedy: logLabel("remove_the_lock_file_if_no_other_host_uses_this_data_dir")
+      }, cause);
+    case "unreadable":
+      return log(level, "llm.budget_lock_unreadable", {
+        ...where,
+        remedy: logLabel("fix_the_lock_file_permissions_or_remove_it")
+      }, cause);
+    case "busy":
+      return log(level, "llm.budget_lock_busy", where, cause);
+    case "failed":
+      return log(level, "llm.budget_lock_failed", where, cause);
+  }
+}
+var BudgetStateReadError = class extends Error {
+  constructor() {
+    super("the LLM budget state could not be read");
+    this.name = "BudgetStateReadError";
+  }
+};
+var BudgetStateWriteError = class extends Error {
+  constructor() {
+    super("the LLM budget state could not be saved");
+    this.name = "BudgetStateWriteError";
+  }
+};
+function minimumDailyTokenLimit(maxOutputTokens = DEFAULT_MAX_OUTPUT_TOKENS, requestMaxBytes = LLM_REQUEST_MAX_BYTES) {
+  return Math.min(requestMaxBytes + maxOutputTokens, MAX_REPORTED_TOKENS_PER_CALL);
+}
+function budgetBootRefusal(budget, tokenLimit, maxOutputTokens, log) {
+  const min = dailyTokenLimitTooSmall(tokenLimit, maxOutputTokens);
+  if (min !== null) {
+    log("error", "runtime.config_invalid.llm_daily_token_limit_below_request_bound", {
+      llm_daily_token_limit: tokenLimit,
+      minimum: min
+    });
+    return 2;
+  }
+  const reason = budget.lockRefusal();
+  if (reason !== null) {
+    logLockRefusal(log, "error", reason, budget.lockPath(), budget.lockError());
+    return 3;
+  }
+  return null;
+}
+function dailyTokenLimitTooSmall(tokenLimit, maxOutputTokens) {
+  const min = minimumDailyTokenLimit(maxOutputTokens);
+  return tokenLimit > 0 && tokenLimit < min ? min : null;
+}
+function utcDay(d) {
+  return d.toISOString().slice(0, 10);
+}
+function nextUtcDay(day) {
+  return utcDay(new Date(Date.parse(`${day}T00:00:00Z`) + 864e5));
+}
+function errnoOf(error) {
+  const code = error?.code;
+  return typeof code === "string" ? code : void 0;
+}
+var DailyLlmBudget = class {
+  callLimit;
+  tokenLimit;
+  statePath;
+  lock;
+  lockRefusalLogged = null;
+  stateReadError;
+  now;
+  log;
+  state;
+  exhaustionLoggedFor = null;
+  constructor(opts) {
+    this.callLimit = opts.callLimit;
+    this.tokenLimit = opts.tokenLimit;
+    this.statePath = opts.statePath;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+    this.log = opts.log ?? (() => {
+    });
+    if (opts.lockPath) {
+      this.lock = new BudgetLock(opts.lockPath, opts.lockEnv ?? realLockEnv, this.log);
+      this.lock.acquire();
+    }
+    this.state = this.load();
+  }
+  /** True when this runtime may call the provider as far as the lock goes
+   *  (it holds the lock, or no lock is configured). index.ts checks it before
+   *  starting the data plane (#808 M2). */
+  holdsLock() {
+    return !this.lock || this.lock.held;
+  }
+  /** The error behind the last `unreadable` / `failed` lock refusal. */
+  lockError() {
+    return this.lock?.lastError;
+  }
+  lockPath() {
+    return this.lock?.path;
+  }
+  /** Why the lock is not held (retrying once), or null when it is / none is
+   *  configured. Never throws. */
+  lockRefusal() {
+    if (!this.lock || this.lock.held && this.lock.stillHeld()) return null;
+    const result = this.lock.acquire();
+    if (result === "acquired") {
+      this.state = this.load();
+      return null;
+    }
+    return result;
+  }
+  /**
+   * Refuse up front, without charging anything, when this runtime may not
+   * call the provider at all: another runtime holds the lock, or either daily
+   * limit is already spent. The provider is never reached.
+   */
+  assertOpen() {
+    this.assertLock();
+    this.assertStateReadable();
+    this.roll();
+    const { calls, tokens } = this.state;
+    const callsSpent = this.callLimit > 0 && calls >= this.callLimit;
+    const tokensSpent = this.tokenLimit > 0 && tokens >= this.tokenLimit;
+    if (callsSpent || tokensSpent) this.exhausted();
+  }
+  /**
+   * SEC-06 item 10: reserve ONE provider request — one call and its
+   * worst-case tokens (`reserve`, the dispatcher's request bound) — and save
+   * the charge before the request is sent. Throws, charging nothing, when the
+   * lock is held elsewhere ({@link BudgetLockHeldError}), when the reserve
+   * alone exceeds the whole token cap ({@link RequestExceedsDailyTokenCapError}),
+   * or when it does not fit what is left today ({@link DailyLimitReachedError}).
+   *
+   * Returns the request's settle function (idempotent): see {@link RequestOutcome}.
+   */
+  beginCall(reserve) {
+    if (typeof reserve !== "number" || !Number.isFinite(reserve) || reserve <= 0) {
+      throw new TypeError("LLM budget reserve must be a positive finite number");
+    }
+    this.assertLock();
+    this.assertStateReadable();
+    this.roll();
+    const bound = Math.ceil(reserve);
+    if (this.tokenLimit > 0 && bound > this.tokenLimit) {
+      this.log("warn", "llm.budget_request_exceeds_cap", { reserve: bound, token_limit: this.tokenLimit });
+      throw new RequestExceedsDailyTokenCapError(bound, this.tokenLimit);
+    }
+    const { calls, tokens } = this.state;
+    const callsSpent = this.callLimit > 0 && calls >= this.callLimit;
+    const tokensSpent = this.tokenLimit > 0 && tokens + bound > this.tokenLimit;
+    if (callsSpent || tokensSpent) this.exhausted();
+    this.state.calls++;
+    this.state.tokens += bound;
+    try {
+      this.persist();
+    } catch (error) {
+      this.state.calls--;
+      this.state.tokens -= bound;
+      this.log("warn", "llm.budget_state_write_failed", { refused: true }, error);
+      throw new BudgetStateWriteError();
+    }
+    const day = this.state.day;
+    let settled = false;
+    return (outcome) => {
+      if (settled) return;
+      settled = true;
+      this.roll();
+      if (this.state.day !== day) return;
+      if (outcome.kind === "not_sent") {
+        this.state.calls = Math.max(0, this.state.calls - 1);
+        this.state.tokens = Math.max(0, this.state.tokens - bound);
+      } else if (outcome.kind === "reported") {
+        const actual = Number.isFinite(outcome.tokens) && outcome.tokens > 0 ? Math.floor(outcome.tokens) : 0;
+        const charged = Math.min(actual, bound);
+        this.state.tokens = Math.max(0, this.state.tokens - (bound - charged));
+      } else {
+        return;
+      }
+      this.save();
+    };
+  }
+  /** Legacy, after the fact: charge one call a completer did not meter. */
+  chargeUnmeteredCall() {
+    this.roll();
+    this.state.calls++;
+    this.save();
+  }
+  /** Release the lock, if this runtime holds it and it is still ours. */
+  close() {
+    this.lock?.release();
+  }
+  exhausted() {
+    const { calls, tokens, day } = this.state;
+    if (this.exhaustionLoggedFor !== day) {
+      this.exhaustionLoggedFor = day;
+      this.log("warn", "llm.daily_budget_exhausted", {
+        calls,
+        tokens,
+        call_limit: this.callLimit,
+        token_limit: this.tokenLimit
+      });
+    }
+    throw new DailyLimitReachedError(day);
+  }
+  assertLock() {
+    if (!this.lock || this.lock.held && this.lock.stillHeld()) return;
+    const result = this.lock.acquire();
+    if (result === "acquired") {
+      this.state = this.load();
+      this.lockRefusalLogged = null;
+      return;
+    }
+    if (this.lockRefusalLogged !== result) {
+      this.lockRefusalLogged = result;
+      const cause = result === "unreadable" || result === "failed" ? this.lock.lastError : void 0;
+      logLockRefusal(this.log, "warn", result, this.lock.path, cause);
+    }
+    throw new BudgetLockHeldError(result);
+  }
+  /** #808 L-d: the state file exists but cannot be read. LLM calls are
+   *  refused until it can: starting a fresh day over it would re-grant the
+   *  whole cap, and the next save would overwrite the real counters. */
+  assertStateReadable() {
+    if (this.stateReadError === void 0) return;
+    this.state = this.load();
+    if (this.stateReadError === void 0) return;
+    throw new BudgetStateReadError();
+  }
+  /** Add provider-reported tokens to today's total. */
+  recordTokens(totalTokens) {
+    if (!Number.isFinite(totalTokens) || totalTokens <= 0) return;
+    this.roll();
+    this.state.tokens += Math.floor(totalTokens);
+    this.save();
+  }
+  snapshot() {
+    this.roll();
+    return { ...this.state };
+  }
+  /** Start a new day only when the clock moves FORWARD past the stored one:
+   *  a clock stepped back across 00:00 UTC must not wipe today's spend
+   *  (#808 L1). YYYY-MM-DD compares correctly as a string. */
+  roll() {
+    const today = utcDay(this.now());
+    if (today > this.state.day || this.state.day > nextUtcDay(today)) {
+      this.state = { day: today, calls: 0, tokens: 0 };
+    }
+  }
+  load() {
+    const fresh = { day: utcDay(this.now()), calls: 0, tokens: 0 };
+    if (!this.statePath) return fresh;
+    let raw;
+    try {
+      raw = readFileSync2(this.statePath, "utf8");
+      this.stateReadError = void 0;
+    } catch (error) {
+      if (errnoOf(error) === "ENOENT") {
+        this.stateReadError = void 0;
+        return fresh;
+      }
+      if (this.stateReadError === void 0) this.log("warn", "llm.budget_state_read_failed", {}, error);
+      this.stateReadError = error;
+      return fresh;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.day === "string" && /^\d{4}-\d{2}-\d{2}$/.test(parsed.day) && parsed.day >= fresh.day && parsed.day <= nextUtcDay(fresh.day) && Number.isInteger(parsed.calls) && parsed.calls >= 0 && Number.isInteger(parsed.tokens) && parsed.tokens >= 0) {
+        return { day: parsed.day, calls: parsed.calls, tokens: parsed.tokens };
+      }
+      if (typeof parsed.day === "string" && parsed.day > nextUtcDay(fresh.day)) {
+        this.log("warn", "llm.budget_state_future_day", {});
+      }
+      return fresh;
+    } catch (error) {
+      this.log("warn", "llm.budget_state_unreadable", {}, error);
+      return fresh;
+    }
+  }
+  /** Write the counters durably: tmp file, fsync, rename (#808 L2). Throws. */
+  persist() {
+    if (!this.statePath) return;
+    mkdirSync2(dirname2(this.statePath), { recursive: true });
+    const tmp = `${this.statePath}.tmp`;
+    const fd = openSync2(tmp, "w", 384);
+    try {
+      writeSync2(fd, JSON.stringify(this.state));
+      fsyncSync2(fd);
+    } finally {
+      closeSync2(fd);
+    }
+    renameSync(tmp, this.statePath);
+  }
+  /** Best effort, for writes that only ever LOWER what is on disk relative to
+   *  the truth (a settle's refund) or add after the fact: a failure leaves the
+   *  file conservative, and the in-memory counters still bound this process. */
+  save() {
+    if (this.stateReadError !== void 0) return;
+    try {
+      this.persist();
+    } catch (error) {
+      this.log("warn", "llm.budget_state_write_failed", {}, error);
+    }
+  }
+};
+function withDailyBudget(llm, budget) {
+  return {
+    async complete(messages, tools, options) {
+      budget.assertOpen();
+      let metered = false;
+      const meter = (bound) => {
+        metered = true;
+        const outer = options?.meter?.(bound);
+        let settle;
+        try {
+          settle = budget.beginCall(bound);
+        } catch (error) {
+          outer?.({ kind: "not_sent" });
+          throw error;
+        }
+        return (outcome) => {
+          settle(outcome);
+          outer?.(outcome);
+        };
+      };
+      let result;
+      try {
+        result = await llm.complete(messages, tools, { ...options, meter });
+      } catch (error) {
+        if (!metered) {
+          budget.chargeUnmeteredCall();
+          const spent = reportedTokensOf(error);
+          if (spent !== void 0) budget.recordTokens(spent);
+        }
+        throw error;
+      }
+      if (!metered) {
+        budget.chargeUnmeteredCall();
+        if (result.usage) budget.recordTokens(result.usage.totalTokens);
+      }
+      return result;
+    }
+  };
+}
+
+// src/config.ts
 var MISSING_IDENTITY_MESSAGE = "Missing agent identity: pass --identity <id> or set SECURECOMS_IDENTITY";
 var LOG_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var TOOL_DEFAULTS = /* @__PURE__ */ new Set(["allow", "deny"]);
@@ -48,8 +1083,16 @@ function parseList(value) {
   const items = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
   return items.length > 0 ? items : void 0;
 }
+function parseIntSetting(env, name, fallback, min) {
+  const raw = env[name]?.trim();
+  if (!raw) return fallback;
+  if (!/^\d+$/.test(raw) || Number(raw) < min || !Number.isSafeInteger(Number(raw))) {
+    throw new Error(`Invalid ${name} "${raw}": expected a whole number >= ${min}`);
+  }
+  return Number(raw);
+}
 function defaultSkillsDir() {
-  return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+  return join(dirname3(fileURLToPath(import.meta.url)), "..", "skills");
 }
 var DEFAULT_TOOL_ALLOW = [
   "echo",
@@ -99,7 +1142,10 @@ function loadConfig(argv, env) {
     toolGateEnv: {
       ...parsedAllow !== void 0 ? { allow: parsedAllow } : {},
       ...deny !== void 0 ? { deny } : {}
-    }
+    },
+    llmMaxOutputTokens: parseIntSetting(env, "SECURECOMS_LLM_MAX_OUTPUT_TOKENS", DEFAULT_MAX_OUTPUT_TOKENS, 1),
+    llmDailyCallLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_CALL_LIMIT", DEFAULT_DAILY_CALL_LIMIT, 0),
+    llmDailyTokenLimit: parseIntSetting(env, "SECURECOMS_LLM_DAILY_TOKEN_LIMIT", DEFAULT_DAILY_TOKEN_LIMIT, 0)
   };
 }
 
@@ -154,9 +1200,23 @@ function parsePersonaVerb(argv) {
   const sub = argv[3];
   return sub === "init" || sub === "show" ? sub : null;
 }
+function parseSideEffectsVerb(argv) {
+  if (argv[2] !== "side-effects") return null;
+  const sub = argv[3];
+  return sub === "list" || sub === "resolve" ? sub : null;
+}
+function parseSideEffectResolveFlags(argv) {
+  const outcome = flagOrEnv(argv, "--outcome", {});
+  return {
+    idempotencyKey: flagOrEnv(argv, "--idempotency-key", {}),
+    operationSha256: flagOrEnv(argv, "--operation-sha256", {}),
+    confirmationId: flagOrEnv(argv, "--confirmation-id", {}),
+    outcome: outcome === "completed" || outcome === "not_applied" ? outcome : void 0
+  };
+}
 
 // src/service/install.ts
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname4 } from "node:path";
 
 // src/service/config.ts
 import { isAbsolute, resolve } from "node:path";
@@ -388,8 +1448,8 @@ function installService(input, deps) {
   const plan = prepareInstall(input, deps.platform, deps);
   const keyFile = plan.keyFile;
   if (deps.platform === "darwin") {
-    deps.mkdirp(dirname2(cfg.plistPath));
-    deps.mkdirp(dirname2(cfg.logPath));
+    deps.mkdirp(dirname4(cfg.plistPath));
+    deps.mkdirp(dirname4(cfg.logPath));
     deps.writeFile(cfg.plistPath, plan.contents);
     deps.run("launchctl", ["bootout", `gui/${cfg.uid}/${cfg.label}`]);
     requireOk(deps.run("launchctl", ["bootstrap", `gui/${cfg.uid}`, cfg.plistPath]), "launchctl bootstrap");
@@ -397,7 +1457,7 @@ function installService(input, deps) {
     return { label: cfg.label, filePath: cfg.plistPath, logHint: cfg.logPath, ...keyFile ? { keyFile } : {} };
   }
   if (deps.platform === "linux") {
-    deps.mkdirp(dirname2(cfg.unitPath));
+    deps.mkdirp(dirname4(cfg.unitPath));
     deps.writeFile(cfg.unitPath, plan.contents);
     deps.run("systemctl", ["--user", "daemon-reload"]);
     deps.run("loginctl", ["enable-linger", deps.user]);
@@ -431,63 +1491,6 @@ function uninstallService(input, deps) {
   throw new ServiceUnsupportedError(`Service uninstall isn't supported on ${deps.platform} yet.`);
 }
 
-// src/llm-dispatch.ts
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "").replace(/\/v1$/, "").replace(/\/+$/, "");
-}
-var LLMDispatcher = class {
-  endpoint;
-  model;
-  apiKey;
-  chatPath;
-  chatAuth;
-  authHeaderName;
-  constructor(endpoint, model, opts = {}) {
-    this.endpoint = normalizeEndpoint(endpoint);
-    this.model = model;
-    this.apiKey = opts.apiKey;
-    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
-    this.chatAuth = opts.chatAuth ?? "bearer";
-    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
-  }
-  async complete(messages, tools) {
-    const body = {
-      model: this.model,
-      messages,
-      stream: false
-    };
-    if (tools && tools.length > 0) {
-      body.tools = tools;
-    }
-    const url = `${this.endpoint}${this.chatPath}`;
-    const headers = { "Content-Type": "application/json" };
-    if (this.apiKey && this.chatAuth === "bearer") {
-      headers.Authorization = `Bearer ${this.apiKey}`;
-    } else if (this.apiKey && this.chatAuth === "x-api-key") {
-      headers[this.authHeaderName] = this.apiKey;
-    }
-    const resp = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
-    });
-    if (!resp.ok) {
-      await resp.body?.cancel();
-      throw new Error(`LLM request failed (${resp.status})`);
-    }
-    const data = await resp.json();
-    const choice = data.choices?.[0];
-    if (!choice) {
-      throw new Error("LLM returned no choices");
-    }
-    return {
-      content: choice.message.content,
-      toolCalls: choice.message.tool_calls || [],
-      finishReason: choice.finish_reason
-    };
-  }
-};
-
 // src/llm-source.ts
 import { join as join2 } from "node:path";
 
@@ -661,34 +1664,21 @@ function resolveLlmSource(cfg, explicit, deps) {
 }
 
 // src/llm-shim.ts
-function endpointHost(endpoint) {
-  try {
-    return new URL(endpoint).host;
-  } catch {
-    return "(unparseable endpoint)";
-  }
-}
 function buildLlmShim(cfg, explicit, deps) {
   return {
-    async complete(messages, tools) {
+    async complete(messages, tools, options) {
       const src = resolveLlmSource(cfg, explicit, deps);
       const dispatcher = new LLMDispatcher(src.endpoint, src.model, {
         apiKey: src.apiKey,
         chatPath: src.chatPath,
-        chatAuth: src.chatAuth
+        chatAuth: src.chatAuth,
+        maxOutputTokens: cfg.llmMaxOutputTokens
       });
-      return dispatcher.complete(messages, tools);
+      const result = await dispatcher.complete(messages, tools, options);
+      return { ...result, source: { provider: src.provider, model: src.model } };
     }
   };
 }
-function bootLine(cfg, explicit, deps) {
-  try {
-    const src = resolveLlmSource(cfg, explicit, deps);
-    return `securecoms-agent ${cfg.identityId.slice(0, 8)} \u2192 llm source=${src.origin} ${endpointHost(src.endpoint)} (${src.model})`;
-  } catch (e) {
-    return `llm: source unavailable \u2014 ${e instanceof Error ? e.message : String(e)}`;
-  }
-}
 
 // src/memory.ts
 var MAX_HISTORY = 50;
@@ -742,7 +1732,7 @@ ${scored.map((entry) => `- ${entry.content}`).join("\n")}`;
 };
 
 // src/skill-invoker.ts
-import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync3, statSync } from "node:fs";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/skill-md.ts
@@ -866,16 +1856,35 @@ ${guidance}` : description,
 }
 
 // src/requires.ts
-function hasReadableKeyFile(paths, read) {
+function hasReadableKeyFile(paths, read, onReadError) {
   return paths.some((path) => {
     if (!path) return false;
     try {
       return read(path).trim() !== "";
-    } catch {
+    } catch (error) {
+      try {
+        onReadError?.(path, error);
+      } catch {
+      }
       return false;
     }
   });
 }
+function searchKeyGateReporter(log, isBravePath) {
+  const logged = /* @__PURE__ */ new Set();
+  return (path, error) => {
+    if (error?.code === "ENOENT") return;
+    const signature = `${path}|${errorClass(error)}`;
+    if (logged.has(signature)) return;
+    logged.add(signature);
+    log(
+      "warn",
+      "runtime.search_key_unreadable",
+      { at_gate: true, provider_brave: isBravePath(path) },
+      error
+    );
+  };
+}
 function requiresEnvFrom(cfg, hasSearchKey) {
   return {
     hasSearchKey,
@@ -898,7 +1907,7 @@ function resolveRequires(req, env) {
 }
 
 // src/skills-config.ts
-import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 
 // src/config-dirs.ts
@@ -927,13 +1936,13 @@ function loadSkillsConfigFile(path, dataDir) {
   if (!existsSync2(path)) return empty();
   let raw;
   try {
-    raw = JSON.parse(readFileSync(path, "utf8"));
+    raw = JSON.parse(readFileSync3(path, "utf8"));
   } catch (e) {
-    console.warn(`[skills-config] ignoring ${path}: ${e instanceof Error ? e.message : String(e)}`);
+    writeServiceLog("warn", "skills_config.parse_failed", {}, e);
     return empty();
   }
   if (typeof raw !== "object" || raw === null) {
-    console.warn(`[skills-config] ignoring ${path}: expected a JSON object`);
+    writeServiceLog("warn", "skills_config.root_invalid");
     return empty();
   }
   const src = raw;
@@ -941,7 +1950,7 @@ function loadSkillsConfigFile(path, dataDir) {
   for (const [name, v] of Object.entries(src.endpoints ?? {})) {
     const e = v;
     if (typeof e?.baseUrl !== "string" || e.baseUrl === "") {
-      console.warn(`[skills-config] endpoint "${name}" in ${path} has no baseUrl; skipped`);
+      writeServiceLog("warn", "skills_config.endpoint_invalid");
       continue;
     }
     endpoints[name] = {
@@ -955,7 +1964,7 @@ function loadSkillsConfigFile(path, dataDir) {
     if (typeof d?.sqlite === "string" && d.sqlite !== "") databases[name] = { sqlite: abs2(d.sqlite, dataDir) };
     else if (typeof d?.postgresUrlFile === "string" && d.postgresUrlFile !== "") {
       databases[name] = { postgresUrlFile: abs2(d.postgresUrlFile, dataDir) };
-    } else console.warn(`[skills-config] database "${name}" in ${path} needs sqlite or postgresUrlFile; skipped`);
+    } else writeServiceLog("warn", "skills_config.database_invalid");
   }
   const flags = Array.isArray(src.flags) ? src.flags.filter((f) => typeof f === "string") : [];
   const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
@@ -968,9 +1977,9 @@ function loadSkillsConfigFile(path, dataDir) {
   const s = src.search;
   if (s && typeof s === "object") {
     if (s.provider !== "brave" && s.provider !== "tavily") {
-      console.warn(`[skills-config] search in ${path} has an unknown provider; skipped`);
+      writeServiceLog("warn", "skills_config.search_provider_invalid");
     } else if (typeof s.keyFile !== "string" || s.keyFile === "") {
-      console.warn(`[skills-config] search in ${path} has no keyFile; skipped`);
+      writeServiceLog("warn", "skills_config.search_key_file_missing");
     } else {
       search = { provider: s.provider, keyFile: abs2(s.keyFile, dataDir) };
     }
@@ -997,17 +2006,193 @@ var currentTime = async (args, ctx) => {
 };
 
 // src/html-to-text.ts
+var HTML_TO_TEXT_MAX_INPUT = 2e6;
 function htmlToText(html) {
-  return html.replace(/<script\b[^>]*>[\s\S]*?<\/script\s*>/gi, " ").replace(/<style\b[^>]*>[\s\S]*?<\/style\s*>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<[^>]*>/g, " ").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&").replace(/\s+/g, " ").trim();
+  const n = Math.min(html.length, HTML_TO_TEXT_MAX_INPUT);
+  const b = new Uint16Array(n);
+  for (let i = 0; i < n; i++) b[i] = html.charCodeAt(i);
+  let len = stripRawTextElement(b, n, "script");
+  len = stripRawTextElement(b, len, "style");
+  len = stripComments(b, len);
+  len = stripTags(b, len);
+  len = decodeAndCollapse(b, len);
+  return fromCodes(b, len);
+}
+var LT = 60;
+var GT = 62;
+var SLASH = 47;
+var BANG = 33;
+var DASH = 45;
+var AMP = 38;
+var SPACE = 32;
+function lower(c) {
+  return c >= 65 && c <= 90 ? c | 32 : c;
+}
+function nameAt(b, len, at, name) {
+  if (at + name.length > len) return false;
+  for (let k = 0; k < name.length; k++) {
+    if (lower(b[at + k]) !== name.charCodeAt(k)) return false;
+  }
+  return true;
+}
+function isWordChar(c) {
+  return c >= 48 && c <= 57 || c >= 65 && c <= 90 || c >= 97 && c <= 122 || c === 95;
+}
+function isSpace(c) {
+  if (c <= 32) return c === 32 || c >= 9 && c <= 13;
+  if (c < 160) return false;
+  return c === 160 || c === 5760 || c >= 8192 && c <= 8202 || c === 8232 || c === 8233 || c === 8239 || c === 8287 || c === 12288 || c === 65279;
+}
+function indexIn(b, len, c, from) {
+  for (let k = from; k < len; k++) if (b[k] === c) return k;
+  return -1;
+}
+function keep(b, w, from, to) {
+  if (w === from) return to;
+  if (to - from > 32) b.copyWithin(w, from, to);
+  else for (let k = from; k < to; k++) b[w + k - from] = b[k];
+  return w + (to - from);
+}
+function stripRawTextElement(b, len, name) {
+  const first = name.charCodeAt(0);
+  let w = 0;
+  let copied = 0;
+  for (let i = 0; i + 1 < len; i++) {
+    if (b[i] !== LT || lower(b[i + 1]) !== first || !nameAt(b, len, i + 1, name)) continue;
+    const afterName = i + 1 + name.length;
+    if (afterName >= len || isWordChar(b[afterName])) continue;
+    const gt = indexIn(b, len, GT, afterName);
+    if (gt < 0) break;
+    const end = findCloseTag(b, len, gt + 1, name);
+    if (end < 0) break;
+    w = keep(b, w, copied, i);
+    b[w++] = SPACE;
+    copied = end;
+    i = end - 1;
+  }
+  return copied === 0 ? len : keep(b, w, copied, len);
+}
+function findCloseTag(b, len, from, name) {
+  for (let i = from; i + 1 < len; i++) {
+    if (b[i] !== LT || b[i + 1] !== SLASH || !nameAt(b, len, i + 2, name)) continue;
+    let j = i + 2 + name.length;
+    while (j < len && isSpace(b[j])) j++;
+    if (j < len && b[j] === GT) return j + 1;
+    i = j - 1;
+  }
+  return -1;
+}
+function stripComments(b, len) {
+  let w = 0;
+  let copied = 0;
+  for (let i = 0; i + 3 < len; i++) {
+    if (b[i] !== LT || b[i + 1] !== BANG || b[i + 2] !== DASH || b[i + 3] !== DASH) continue;
+    let end = -1;
+    for (let k = i + 4; k + 2 < len; k++) {
+      if (b[k] === DASH && b[k + 1] === DASH && b[k + 2] === GT) {
+        end = k + 3;
+        break;
+      }
+    }
+    if (end < 0) break;
+    w = keep(b, w, copied, i);
+    b[w++] = SPACE;
+    copied = end;
+    i = end - 1;
+  }
+  return copied === 0 ? len : keep(b, w, copied, len);
+}
+function stripTags(b, len) {
+  let w = 0;
+  let copied = 0;
+  for (; ; ) {
+    const lt = indexIn(b, len, LT, copied);
+    if (lt < 0) break;
+    const gt = indexIn(b, len, GT, lt + 1);
+    if (gt < 0) break;
+    w = keep(b, w, copied, lt);
+    b[w++] = SPACE;
+    copied = gt + 1;
+  }
+  return copied === 0 ? len : keep(b, w, copied, len);
+}
+function decodeAndCollapse(b, len) {
+  let i = 0;
+  while (i < len && isSpace(b[i])) i++;
+  let end = len;
+  while (end > i && isSpace(b[end - 1])) end--;
+  let w = 0;
+  while (i < end) {
+    const c = b[i];
+    if (c === AMP) {
+      const ent = entityAt(b, end, i);
+      if (ent !== 0) {
+        b[w++] = ent >>> 8;
+        i += ent & 255;
+        continue;
+      }
+    } else if (isSpace(c)) {
+      b[w++] = SPACE;
+      i++;
+      while (i < end && isSpace(b[i])) i++;
+      continue;
+    }
+    b[w++] = c;
+    i++;
+  }
+  return w;
+}
+var ENTITIES = [
+  ["lt;", 60],
+  ["gt;", 62],
+  ["quot;", 34],
+  ["#39;", 39],
+  ["amp;", 38]
+];
+function entityAt(b, end, i) {
+  const c1 = b[i + 1];
+  for (const [body, ch] of ENTITIES) {
+    if (body.charCodeAt(0) !== c1 || i + 1 + body.length > end) continue;
+    let k = 1;
+    while (k < body.length && b[i + 1 + k] === body.charCodeAt(k)) k++;
+    if (k === body.length) return ch << 8 | body.length + 1;
+  }
+  return 0;
+}
+function fromCodes(b, len) {
+  const CHUNK = 8192;
+  let out = "";
+  for (let at = 0; at < len; at += CHUNK) {
+    out += String.fromCharCode.apply(null, b.subarray(at, Math.min(at + CHUNK, len)));
+  }
+  return out;
 }
 
 // src/net-guard.ts
-import { lookup } from "node:dns/promises";
+import { Resolver as DnsResolver } from "node:dns/promises";
 import { isIPv4, isIPv6 } from "node:net";
 var BlockedAddressError = class extends Error {
 };
 function systemResolver() {
-  return async (host) => (await lookup(host, { all: true, verbatim: true })).map((a) => a.address);
+  return async (host, signal) => {
+    if (isIPv4(host) || isIPv6(host)) return [host];
+    if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+    const resolver = new DnsResolver();
+    const cancel = () => resolver.cancel();
+    signal?.addEventListener("abort", cancel, { once: true });
+    try {
+      const results = await Promise.allSettled([resolver.resolve4(host), resolver.resolve6(host)]);
+      if (signal?.aborted) throw signal.reason ?? new Error("DNS lookup cancelled");
+      const addresses = results.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+      if (addresses.length === 0) {
+        const rejected = results.find((result) => result.status === "rejected");
+        throw rejected?.reason ?? new Error("DNS lookup returned no addresses");
+      }
+      return addresses;
+    } finally {
+      signal?.removeEventListener("abort", cancel);
+    }
+  };
 }
 function v4Parts(ip) {
   if (!isIPv4(ip)) return null;
@@ -1054,7 +2239,7 @@ function isPrivateAddress(ip) {
   }
   return (v6[0] & 65024) === 64512 || (v6[0] & 65472) === 65152;
 }
-async function assertPublicHost(url, resolve3) {
+async function assertPublicHost(url, resolve3, signal) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new BlockedAddressError(`refused ${url.protocol}//: only http and https are allowed`);
   }
@@ -1064,7 +2249,9 @@ async function assertPublicHost(url, resolve3) {
   }
   let addresses;
   try {
-    addresses = await resolve3(host);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
+    addresses = await resolve3(host, signal);
+    if (signal?.aborted) throw signal.reason ?? new Error("network request cancelled");
   } catch (e) {
     throw new BlockedAddressError(`refused ${url.hostname}: cannot resolve (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -1082,14 +2269,20 @@ async function safeFetch(url, opts) {
   const maxRedirects = opts.maxRedirects ?? 3;
   const maxBytes = opts.maxBytes ?? 2e6;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 1e4);
+  const cancel = () => controller.abort(opts.signal?.reason);
+  if (opts.signal?.aborted) cancel();
+  else opts.signal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(
+    () => controller.abort(new Error("network request deadline exceeded")),
+    opts.timeoutMs ?? 1e4
+  );
   try {
     let current = new URL(url);
     let method = opts.method ?? "GET";
     let headers = opts.headers;
     let body = opts.body;
     for (let hop = 0; hop <= maxRedirects; hop++) {
-      await assertPublicHost(current, opts.resolve);
+      await assertPublicHost(current, opts.resolve, controller.signal);
       const res = await opts.fetch(current.toString(), {
         method,
         headers,
@@ -1122,6 +2315,7 @@ async function safeFetch(url, opts) {
     throw new BlockedAddressError(`too many redirects (>${maxRedirects})`);
   } finally {
     clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", cancel);
   }
 }
 function headerMap(res) {
@@ -1171,7 +2365,8 @@ var fetchUrl = async (args, ctx) => {
       fetch: ctx.fetch,
       maxRedirects: 3,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     const type = res.headers["content-type"] ?? "";
     const text = /html|xml/i.test(type) ? htmlToText(res.text) : res.text.replace(/\s+/g, " ").trim();
@@ -1182,7 +2377,7 @@ var fetchUrl = async (args, ctx) => {
 };
 
 // src/builtins/http-request.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE"]);
 var httpRequest = async (args, ctx) => {
   const name = typeof args.name === "string" ? args.name : "";
@@ -1225,7 +2420,7 @@ var httpRequest = async (args, ctx) => {
   const headers = { accept: "application/json" };
   if (endpoint.headersFile) {
     try {
-      for (const [k, v] of Object.entries(JSON.parse(readFileSync2(endpoint.headersFile, "utf8")))) {
+      for (const [k, v] of Object.entries(JSON.parse(readFileSync4(endpoint.headersFile, "utf8")))) {
         if (typeof v === "string") headers[k] = v;
       }
     } catch {
@@ -1242,7 +2437,8 @@ var httpRequest = async (args, ctx) => {
       headers,
       body,
       timeoutMs: 1e4,
-      maxBytes: 2e6
+      maxBytes: 2e6,
+      signal: ctx.signal
     });
     return JSON.stringify({ status: res.status, body: capTo(res.text, FETCH_TEXT_CAP) });
   } catch (e) {
@@ -1251,7 +2447,8 @@ var httpRequest = async (args, ctx) => {
 };
 
 // src/builtins/sql-query.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { spawn } from "node:child_process";
 
 // src/sql-guard.ts
 var SqlNotReadOnlyError = class extends Error {
@@ -1280,12 +2477,12 @@ var FORBIDDEN = [
   "EXECUTE",
   "INTO"
 ];
-function stripComments(sql) {
+function stripComments2(sql) {
   return sql.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/--[^\n]*/g, " ");
 }
 function assertReadOnlySelect(sql) {
   const statement = sql.trim().replace(/;\s*$/, "").trim();
-  const body = stripComments(sql).trim().replace(/;\s*$/, "").trim();
+  const body = stripComments2(sql).trim().replace(/;\s*$/, "").trim();
   if (!body) throw new SqlNotReadOnlyError("sql_query needs a SELECT statement");
   for (const text of [body, statement]) {
     if (text.includes(";")) {
@@ -1305,16 +2502,160 @@ function assertReadOnlySelect(sql) {
 }
 
 // src/builtins/sql-query.ts
+var SQLITE_PROCESS_SOURCE = String.raw`
+  const { DatabaseSync } = require("node:sqlite");
+
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => { input += chunk; });
+  process.stdin.on("end", () => {
+    let handle;
+    try {
+      const request = JSON.parse(input);
+      handle = new DatabaseSync(request.path, {
+        readOnly: true,
+        timeout: request.busyTimeoutMs,
+      });
+      // Keep SQLite-owned allocations bounded too, not only V8's heap. Temp
+      // work stays in the limited heap instead of consuming unbounded disk,
+      // and mmap is disabled so reads cannot bypass the allocation ceiling.
+      const heapLimit = handle.prepare(
+        "PRAGMA hard_heap_limit = " + request.sqliteHeapLimitBytes
+      ).get();
+      const effectiveHeapLimit = Number(Object.values(heapLimit ?? {})[0]);
+      if (!(effectiveHeapLimit > 0 && effectiveHeapLimit <= request.sqliteHeapLimitBytes)) {
+        throw new Error("SQLite heap limit could not be enforced");
+      }
+      handle.exec("PRAGMA temp_store = MEMORY; PRAGMA mmap_size = 0");
+      const statement = handle.prepare(request.sql);
+      const rows = [];
+      let columns = [];
+      let truncated = false;
+
+      for (const record of statement.iterate()) {
+        if (rows.length === request.rowCap) {
+          truncated = true;
+          break;
+        }
+        if (rows.length === 0) columns = Object.keys(record);
+        rows.push(columns.map((column) => record[column]));
+      }
+
+      process.stdout.write(JSON.stringify({
+        ok: true,
+        result: { columns, rows, truncated },
+      }));
+    } catch (error) {
+      process.stdout.write(JSON.stringify({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+      }));
+    } finally {
+      if (handle) handle.close();
+    }
+  });
+`;
+var SQLITE_IPC_CAP_BYTES = 1024 * 1024;
+var SQLITE_HEAP_CAP_BYTES = 32 * 1024 * 1024;
+function executeSqliteQuery(path, sql, options = {}) {
+  const timeoutMs = options.timeoutMs ?? SQL_TIMEOUT_MS;
+  if (options.signal?.aborted) return Promise.reject(new Error("SQLite query cancelled"));
+  return new Promise((resolve3, reject) => {
+    const child = spawn(process.execPath, [
+      "--no-warnings",
+      "--max-old-space-size=32",
+      "--input-type=commonjs",
+      "--eval",
+      SQLITE_PROCESS_SOURCE
+    ], {
+      // The query process needs no credentials or runtime configuration.
+      // In particular, do not let NODE_OPTIONS weaken its heap boundary.
+      env: {},
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let settled = false;
+    let stopError;
+    let stdout = "";
+    let stdoutBytes = 0;
+    const cleanup = () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+    };
+    const stop = (error) => {
+      if (settled || stopError) return;
+      stopError = error;
+      cleanup();
+      child.kill("SIGKILL");
+    };
+    const onAbort = () => stop(new Error("SQLite query cancelled"));
+    const timer = setTimeout(
+      () => stop(new Error(`SQLite query timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      if (stopError) return;
+      stdoutBytes += Buffer.byteLength(chunk);
+      if (stdoutBytes > SQLITE_IPC_CAP_BYTES) {
+        stop(new Error("SQLite query result exceeded the materialization limit"));
+        return;
+      }
+      stdout += chunk;
+    });
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (stopError) {
+        reject(stopError);
+        return;
+      }
+      if (code !== 0) {
+        reject(new Error(`SQLite query process exited before returning a result (code ${code})`));
+        return;
+      }
+      try {
+        const message = JSON.parse(stdout);
+        if (message.ok && message.result) resolve3(message.result);
+        else reject(new Error(message.error ?? "SQLite query process failed"));
+      } catch {
+        reject(new Error("SQLite query process returned an invalid result"));
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(JSON.stringify({
+      path,
+      sql,
+      rowCap: SQL_ROW_CAP,
+      busyTimeoutMs: timeoutMs,
+      sqliteHeapLimitBytes: SQLITE_HEAP_CAP_BYTES
+    }));
+  });
+}
 function envelope(columns, rows, truncated) {
   let kept = rows;
   let cut = truncated;
-  let out = JSON.stringify({ columns, rows: kept, truncated: cut });
-  while (out.length > FETCH_TEXT_CAP && kept.length > 0) {
-    kept = kept.slice(0, Math.floor(kept.length / 2));
-    cut = true;
-    out = JSON.stringify({ columns, rows: kept, truncated: cut });
+  try {
+    let out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    while (resultBytes(out) > RESULT_CAP && kept.length > 0) {
+      kept = kept.slice(0, Math.floor(kept.length / 2));
+      cut = true;
+      out = JSON.stringify({ columns, rows: kept, truncated: cut });
+    }
+    if (resultBytes(out) <= RESULT_CAP) return out;
+  } catch {
+    return toolError("database result could not be serialized");
   }
-  return capResult(out);
+  return toolError("database result metadata exceeded the response limit");
 }
 var sqlQuery = async (args, ctx) => {
   const name = typeof args.name === "string" ? args.name : "";
@@ -1332,16 +2673,8 @@ var sqlQuery = async (args, ctx) => {
   }
   try {
     if ("sqlite" in db) {
-      const { DatabaseSync } = await import("node:sqlite");
-      const handle = new DatabaseSync(db.sqlite, { readOnly: true, timeout: SQL_TIMEOUT_MS });
-      try {
-        const rows = handle.prepare(sql).all();
-        const capped = rows.slice(0, SQL_ROW_CAP);
-        const columns = capped.length ? Object.keys(capped[0]) : [];
-        return envelope(columns, capped.map((r) => columns.map((c) => r[c])), rows.length > SQL_ROW_CAP);
-      } finally {
-        handle.close();
-      }
+      const result = await executeSqliteQuery(db.sqlite, sql, { signal: ctx.signal });
+      return envelope(result.columns, result.rows, result.truncated);
     }
     let pg;
     try {
@@ -1352,19 +2685,32 @@ var sqlQuery = async (args, ctx) => {
     const Client = pg.Client ?? pg.default?.Client;
     if (!Client) return toolError(`the installed "pg" module does not export a Client`);
     const client = new Client({
-      connectionString: readFileSync3(db.postgresUrlFile, "utf8").trim(),
+      connectionString: readFileSync5(db.postgresUrlFile, "utf8").trim(),
       // never logged (D4)
-      statement_timeout: SQL_TIMEOUT_MS
+      statement_timeout: SQL_TIMEOUT_MS,
+      connectionTimeoutMillis: SQL_TIMEOUT_MS,
+      query_timeout: SQL_TIMEOUT_MS
     });
-    await client.connect();
+    let cancelled = ctx.signal?.aborted ?? false;
+    const cancel = () => {
+      cancelled = true;
+      void client.end().catch(() => {
+      });
+    };
+    if (cancelled) throw new Error("Postgres query cancelled");
+    ctx.signal?.addEventListener("abort", cancel, { once: true });
     try {
+      await client.connect();
+      if (cancelled) throw new Error("Postgres query cancelled");
       await client.query("BEGIN; SET TRANSACTION READ ONLY;");
       const res = await client.query({ text: sql, rowMode: "array" });
+      if (cancelled) throw new Error("Postgres query cancelled");
       const columns = res.fields.map((f) => f.name);
       const rows = res.rows.slice(0, SQL_ROW_CAP);
       return envelope(columns, rows, res.rows.length > SQL_ROW_CAP);
     } finally {
-      await client.query("ROLLBACK").catch(() => {
+      ctx.signal?.removeEventListener("abort", cancel);
+      if (!cancelled) await client.query("ROLLBACK").catch(() => {
       });
       await client.end().catch(() => {
       });
@@ -1387,13 +2733,14 @@ var webSearch = async (args, ctx) => {
   try {
     let hits;
     if (brave) {
-      ctx.log("debug", `web_search via brave (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: true });
       const url = `https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=${count}`;
       const res = await safeFetch(url, {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         headers: { accept: "application/json", "X-Subscription-Token": brave }
       });
       if (res.status !== 200) return toolError(`brave search returned HTTP ${res.status}`);
@@ -1404,12 +2751,13 @@ var webSearch = async (args, ctx) => {
         snippet: r.description ?? ""
       }));
     } else {
-      ctx.log("debug", `web_search via tavily (${count} results)`);
+      ctx.log("debug", "tool.web_search_requested", { count, provider_brave: false });
       const res = await safeFetch("https://api.tavily.com/search", {
         resolve: ctx.resolve,
         fetch: ctx.fetch,
         timeoutMs: 1e4,
         maxBytes: 2e6,
+        signal: ctx.signal,
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ api_key: tavily, query, max_results: count })
@@ -1432,14 +2780,70 @@ var webSearch = async (args, ctx) => {
 var RESULT_CAP = 2e4;
 var TRUNCATION_MARKER = "\u2026[truncated]";
 var FETCH_TEXT_CAP = RESULT_CAP - 4096;
+function resultBytes(s) {
+  return Buffer.byteLength(s, "utf8");
+}
+function utf8Prefix(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  const bytes = Buffer.from(s, "utf8");
+  if (bytes.length <= maxBytes) return s;
+  let end = maxBytes;
+  while (end > 0) {
+    const candidate = bytes.subarray(0, end).toString("utf8");
+    if (!candidate.endsWith("\uFFFD") && resultBytes(candidate) <= maxBytes) return candidate;
+    end--;
+  }
+  return "";
+}
+function fitJsonString(value, build, fits = (candidate) => resultBytes(candidate) <= RESULT_CAP) {
+  const codePoints = Array.from(value);
+  let low = 0;
+  let high = codePoints.length;
+  let best = build("");
+  while (low <= high) {
+    const middle = Math.floor((low + high) / 2);
+    const candidate = build(codePoints.slice(0, middle).join(""));
+    if (fits(candidate)) {
+      best = candidate;
+      low = middle + 1;
+    } else {
+      high = middle - 1;
+    }
+  }
+  return best;
+}
 function capTo(s, limit) {
-  return s.length <= limit ? s : s.slice(0, limit) + TRUNCATION_MARKER;
+  if (resultBytes(s) <= limit) return s;
+  const markerBytes = resultBytes(TRUNCATION_MARKER);
+  return utf8Prefix(s, Math.max(0, limit - markerBytes)) + TRUNCATION_MARKER;
 }
 function capResult(s) {
   return capTo(s, RESULT_CAP);
 }
+function boundToolResult(content) {
+  if (resultBytes(content) <= RESULT_CAP) return content;
+  try {
+    const parsed = JSON.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const record = parsed;
+      if (typeof record.error === "string") {
+        const message = typeof record.message === "string" ? record.message : record.error;
+        return toolError(message);
+      }
+    }
+    return fitJsonString(content, (result) => JSON.stringify({ result, truncated: true }));
+  } catch {
+    return capResult(content);
+  }
+}
 function toolError(message) {
-  return JSON.stringify({ error: "tool_failed", message });
+  const plain = JSON.stringify({ error: "tool_failed", message });
+  if (resultBytes(plain) <= RESULT_CAP) return plain;
+  return fitJsonString(message, (prefix) => JSON.stringify({
+    error: "tool_failed",
+    message: prefix,
+    truncated: true
+  }));
 }
 var NO_CONTEXT = "no runtime context: this built-in needs the runtime's network context";
 function offlineContext() {
@@ -1467,12 +2871,148 @@ var BUILTINS = {
   sql_query: sqlQuery
 };
 
+// src/side-effect-ledger.ts
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES = 1e4;
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("operation arguments must be finite JSON values");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map(
+      (key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`
+    ).join(",")}}`;
+  }
+  throw new Error("operation arguments must be JSON values");
+}
+function operationSha256(tool, args) {
+  const normalized = tool === "http_request" && typeof args.method === "string" ? { ...args, method: args.method.toUpperCase() } : args;
+  return createHash("sha256").update(`${tool}
+${canonicalJson(normalized)}`, "utf8").digest("hex");
+}
+var SideEffectLedger = class {
+  constructor(path, maxEntries = DEFAULT_SIDE_EFFECT_LEDGER_MAX_ENTRIES) {
+    this.maxEntries = maxEntries;
+    mkdirSync3(dirname5(path), { recursive: true, mode: 448 });
+    this.db = new DatabaseSync(path);
+    chmodSync(path, 384);
+    this.db.exec("PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA busy_timeout=1000;");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS side_effect_claims (
+        idempotency_key TEXT PRIMARY KEY,
+        operation_sha256 TEXT NOT NULL,
+        confirmation_id TEXT NOT NULL UNIQUE,
+        expires_at TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('in_progress', 'completed')),
+        created_at TEXT NOT NULL,
+        completed_at TEXT
+      ) STRICT
+    `);
+  }
+  db;
+  claim(grant, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const prior = this.db.prepare(`
+        SELECT idempotency_key, operation_sha256, confirmation_id, state
+        FROM side_effect_claims WHERE idempotency_key = ? OR confirmation_id = ?
+      `).get(grant.idempotency_key, grant.confirmation_id);
+      if (prior) {
+        this.db.exec("COMMIT");
+        if (prior.operation_sha256 !== grant.operation_sha256 || prior.confirmation_id !== grant.confirmation_id || prior.idempotency_key !== grant.idempotency_key) return { kind: "conflict" };
+        return { kind: prior.state === "completed" ? "completed" : "ambiguous" };
+      }
+      const count = this.db.prepare("SELECT COUNT(*) AS count FROM side_effect_claims").get();
+      if (count.count >= this.maxEntries) {
+        this.db.exec("COMMIT");
+        return { kind: "full" };
+      }
+      this.db.prepare(`
+        INSERT INTO side_effect_claims
+          (idempotency_key, operation_sha256, confirmation_id, expires_at, state, created_at)
+        VALUES (?, ?, ?, ?, 'in_progress', ?)
+      `).run(
+        grant.idempotency_key,
+        grant.operation_sha256,
+        grant.confirmation_id,
+        grant.expires_at,
+        now.toISOString()
+      );
+      this.db.exec("COMMIT");
+      return { kind: "execute" };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  complete(grant, now) {
+    const result = this.db.prepare(`
+      UPDATE side_effect_claims SET state = 'completed', completed_at = ?
+      WHERE idempotency_key = ? AND operation_sha256 = ? AND confirmation_id = ?
+        AND state = 'in_progress'
+    `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+    if (result.changes !== 1) throw new Error("side-effect claim could not be completed");
+  }
+  /** Content-free inventory for an operator investigating an interrupted effect. */
+  listAmbiguous() {
+    return this.db.prepare(`
+      SELECT idempotency_key, operation_sha256, confirmation_id, expires_at, created_at
+      FROM side_effect_claims WHERE state='in_progress' ORDER BY created_at, idempotency_key
+    `).all();
+  }
+  /**
+   * Record the operator's external reconciliation result. `completed` prevents
+   * replay; `not_applied` removes the pre-effect claim so the exact confirmed
+   * operation may be retried. Every binding field must match the durable row.
+   */
+  reconcile(grant, outcome, now) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.db.prepare(`
+        SELECT state FROM side_effect_claims
+        WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=?
+      `).get(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      if (!row) throw new Error("ambiguous side-effect claim not found or binding mismatch");
+      if (row.state !== "in_progress") throw new Error("side-effect claim is already completed");
+      if (outcome === "completed") {
+        this.db.prepare(`
+          UPDATE side_effect_claims SET state='completed', completed_at=?
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(now.toISOString(), grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      } else {
+        this.db.prepare(`
+          DELETE FROM side_effect_claims
+          WHERE idempotency_key=? AND operation_sha256=? AND confirmation_id=? AND state='in_progress'
+        `).run(grant.idempotency_key, grant.operation_sha256, grant.confirmation_id);
+      }
+      this.db.exec("COMMIT");
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  close() {
+    this.db.close();
+  }
+};
+
 // src/skill-invoker.ts
 var SkillInvoker = class {
-  skills = /* @__PURE__ */ new Map();
-  sources = /* @__PURE__ */ new Map();
-  skillsDir;
-  ctx;
   /**
    * `ctx` carries everything a built-in may touch: the network, DNS, the clock
    * and the key files. A caller that has no runtime (the loader tests, and any
@@ -1480,10 +3020,15 @@ var SkillInvoker = class {
    * that need nothing still run and the ones that need the network fail as a
    * tool_failed result instead of throwing.
    */
-  constructor(skillsDir, ctx) {
+  constructor(skillsDir, ctx, sideEffectLedger) {
+    this.sideEffectLedger = sideEffectLedger;
     this.skillsDir = skillsDir;
     this.ctx = ctx ?? offlineContext();
   }
+  skills = /* @__PURE__ */ new Map();
+  sources = /* @__PURE__ */ new Map();
+  skillsDir;
+  ctx;
   /**
    * Load all skill manifests from the skills directory. Supports two
    * layouts: flat `<skillsDir>/*.json` files, and one level of nesting via
@@ -1491,7 +3036,7 @@ var SkillInvoker = class {
    */
   loadSkills() {
     if (!existsSync3(this.skillsDir)) {
-      console.warn(`[SkillInvoker] Skills directory not found: ${this.skillsDir}`);
+      writeServiceLog("warn", "skills.directory_missing");
       return;
     }
     const flat = [], manifests = [], skillMds = [];
@@ -1500,47 +3045,45 @@ var SkillInvoker = class {
         flat.push(join4(this.skillsDir, entry.name));
       } else if (entry.isDirectory()) {
         const m = join4(this.skillsDir, entry.name, "manifest.json");
-        if (existsSync3(m) && statSync(m).isFile()) manifests.push(m);
+        if (existsSync3(m) && statSync2(m).isFile()) manifests.push(m);
         const s = join4(this.skillsDir, entry.name, "SKILL.md");
-        if (existsSync3(s) && statSync(s).isFile()) skillMds.push(s);
+        if (existsSync3(s) && statSync2(s).isFile()) skillMds.push(s);
       }
     }
     for (const p of [...flat.sort(), ...manifests.sort()]) this.loadManifestFile(p);
     for (const p of skillMds.sort()) this.loadSkillMdFile(p);
-    console.log(`[SkillInvoker] Loaded ${this.skills.size} skills`);
+    writeServiceLog("info", "skills.loaded", { count: this.skills.size });
   }
   /** Later file wins, with a warning naming both paths (spec §3). */
   register(manifest, path) {
     const prior = this.sources.get(manifest.name);
-    if (prior) console.warn(`[SkillInvoker] Duplicate skill "${manifest.name}": ${path} overrides ${prior}`);
+    if (prior) writeServiceLog("warn", "skills.duplicate_replaced");
     this.skills.set(manifest.name, manifest);
     this.sources.set(manifest.name, path);
   }
   loadSkillMdFile(path) {
     try {
-      this.register(parseSkillMd(readFileSync4(path, "utf-8"), path), path);
+      this.register(parseSkillMd(readFileSync6(path, "utf-8"), path), path);
     } catch (err) {
-      console.warn(`[SkillInvoker] Skipping ${path}: ${err instanceof Error ? err.message : String(err)}`);
+      writeServiceLog("warn", "skills.skill_md_invalid", {}, err);
     }
   }
   loadManifestFile(path) {
     try {
-      const raw = readFileSync4(path, "utf-8");
+      const raw = readFileSync6(path, "utf-8");
       const manifest = JSON.parse(raw);
       if (typeof manifest.handler !== "string" || !(manifest.handler.startsWith("builtin:") || manifest.handler.startsWith("script:"))) {
-        console.warn(
-          `[SkillInvoker] Skipping manifest with invalid handler ${path}: expected "builtin:<name>" or "script:<path>"`
-        );
+        writeServiceLog("warn", "skills.manifest_handler_invalid");
         return;
       }
       if (manifest.name && manifest.description) {
         this.register(manifest, path);
       } else {
         const missing = !manifest.name ? "name" : "description";
-        console.warn(`[SkillInvoker] Skipping manifest ${path}: missing "${missing}"`);
+        writeServiceLog("warn", "skills.manifest_field_missing", { name_missing: missing === "name" });
       }
     } catch (err) {
-      console.warn(`[SkillInvoker] Failed to load skill ${path}:`, err);
+      writeServiceLog("warn", "skills.manifest_load_failed", {}, err);
     }
   }
   /** Convert loaded skills to OpenAI tool definitions for LLM dispatch. */
@@ -1580,27 +3123,76 @@ var SkillInvoker = class {
   async invoke(name, args, context) {
     const skill = this.skills.get(name);
     if (!skill) {
-      return JSON.stringify({ error: `Unknown skill: ${name}` });
+      return boundToolResult(JSON.stringify({ error: `Unknown skill: ${name}` }));
+    }
+    const execute = async () => {
+      const handler = skill.handler;
+      if (handler.startsWith("builtin:")) {
+        return this.invokeBuiltin(handler.slice(8), args, context?.signal);
+      }
+      if (handler.startsWith("script:")) {
+        return this.invokeScript(handler.slice(7), args, context?.signal);
+      }
+      return boundToolResult(JSON.stringify({ error: `Unknown handler type: ${handler}` }));
+    };
+    return context?.sideEffect ? this.invokeSideEffect(name, args, context.sideEffect, execute) : execute();
+  }
+  async invokeSideEffect(name, args, grant, execute) {
+    const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
+    if (name !== "http_request" || !(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+      return toolError("This tool has no supported side-effect replay contract");
+    }
+    if (grant.tool !== name || operationSha256(name, args) !== grant.operation_sha256) {
+      return toolError("Confirmed operation digest does not match this tool call");
+    }
+    const now = this.ctx.now();
+    const expiresAt = Date.parse(grant.expires_at);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+      return toolError("Confirmed operation grant is expired or invalid");
+    }
+    if (!this.sideEffectLedger) {
+      return toolError("Side-effect replay protection is unavailable");
+    }
+    let claim;
+    try {
+      claim = this.sideEffectLedger.claim(grant, now);
+    } catch {
+      return toolError("Side-effect replay claim could not be persisted");
+    }
+    if (claim.kind === "completed") return JSON.stringify({ status: "already_applied" });
+    if (claim.kind === "ambiguous") {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
+    }
+    if (claim.kind === "conflict") {
+      return toolError("Idempotency key was already bound to a different confirmed operation");
+    }
+    if (claim.kind === "full") {
+      return toolError("Side-effect replay ledger is full; reconcile it before running new operations");
     }
-    const handler = skill.handler;
-    if (handler.startsWith("builtin:")) {
-      return this.invokeBuiltin(handler.slice(8), args);
+    let result;
+    try {
+      result = await execute();
+    } catch {
+      return toolError("Side-effect outcome is ambiguous; reconcile it before retrying");
     }
-    if (handler.startsWith("script:")) {
-      return this.invokeScript(handler.slice(7), args);
+    if (isToolFailure(result)) return result;
+    try {
+      this.sideEffectLedger.complete(grant, this.ctx.now());
+    } catch {
+      return toolError("Side-effect completed but replay state is ambiguous; reconcile before retrying");
     }
-    return JSON.stringify({ error: `Unknown handler type: ${handler}` });
+    return result;
   }
-  async invokeBuiltin(name, args) {
+  async invokeBuiltin(name, args, signal) {
     const builtin = BUILTINS[name];
     if (!builtin) return JSON.stringify({ error: `Unknown builtin: ${name}` });
     try {
-      return capResult(await builtin(args, this.ctx));
+      return boundToolResult(await builtin(args, { ...this.ctx, signal }));
     } catch (e) {
       return toolError(e instanceof Error ? e.message : String(e));
     }
   }
-  async invokeScript(scriptPath, args) {
+  async invokeScript(scriptPath, args, signal) {
     const { resolve: resolve3, relative } = await import("node:path");
     const resolved = resolve3(this.skillsDir, scriptPath);
     const rel = relative(this.skillsDir, resolved);
@@ -1620,26 +3212,82 @@ var SkillInvoker = class {
     try {
       accessSync2(resolved, constants2.X_OK);
     } catch {
-      return JSON.stringify({ error: `Script not found or not executable: ${scriptPath}` });
+      return toolError(`Script not found or not executable: ${scriptPath}`);
     }
-    const { execSync } = await import("node:child_process");
-    try {
-      const result = execSync(resolved, {
-        input: JSON.stringify(args),
-        timeout: 3e4,
-        maxBuffer: 1024 * 1024,
-        encoding: "utf-8",
+    if (signal?.aborted) return toolError("Script execution cancelled");
+    const { spawn: spawn2 } = await import("node:child_process");
+    return new Promise((resolveResult) => {
+      const child = spawn2(resolved, [], {
         cwd: this.skillsDir,
-        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" }
+        env: { PATH: "/usr/bin:/bin", HOME: "/tmp" },
+        stdio: ["pipe", "pipe", "ignore"],
+        windowsHide: true,
+        // A script may launch children. On POSIX, make one process group so
+        // cancellation kills the whole operation rather than orphaning them.
+        detached: process.platform !== "win32"
       });
-      return result;
-    } catch (err) {
-      return JSON.stringify({
-        error: `Script execution failed: ${err instanceof Error ? err.message : String(err)}`
+      let stdout = "";
+      let stdoutBytes = 0;
+      let stopMessage = null;
+      let settled = false;
+      const cleanup = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      };
+      const stop = (message) => {
+        if (settled || stopMessage) return;
+        stopMessage = message;
+        if (process.platform !== "win32" && child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+            child.kill("SIGKILL");
+          }
+        } else {
+          child.kill("SIGKILL");
+        }
+      };
+      const onAbort = () => stop("Script execution cancelled");
+      const timer = setTimeout(() => stop("Script execution timed out after 30000ms"), 3e4);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        if (stopMessage) return;
+        stdoutBytes += Buffer.byteLength(chunk);
+        if (stdoutBytes > 1024 * 1024) {
+          stop("Script output exceeded the materialization limit");
+          return;
+        }
+        stdout += chunk;
       });
-    }
+      child.once("error", () => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolveResult(toolError("Script execution failed"));
+      });
+      child.once("close", (code) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        if (stopMessage) resolveResult(toolError(stopMessage));
+        else if (code !== 0) resolveResult(toolError(`Script execution failed (code ${code ?? "unknown"})`));
+        else resolveResult(boundToolResult(stdout));
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.end(JSON.stringify(args));
+    });
   }
 };
+function isToolFailure(result) {
+  try {
+    const parsed = JSON.parse(result);
+    return parsed.error === "tool_failed";
+  } catch {
+    return false;
+  }
+}
 
 // src/tool-gate.ts
 function createLocalToolGate(policy) {
@@ -1688,7 +3336,7 @@ function createDynamicToolGate(policyFor) {
 }
 
 // src/data-plane.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { WebSocket } from "node:http";
 import { homedir as homedir3 } from "node:os";
 import { join as join5 } from "node:path";
@@ -1733,7 +3381,7 @@ var NO_TURN_AUTHORIZATION = Object.freeze({
 function parseTurnAuthorization(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return NO_TURN_AUTHORIZATION;
   const raw = value;
-  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants)) return NO_TURN_AUTHORIZATION;
+  if (raw.version !== 1 || typeof raw.audience !== "string" || !AUDIENCES.has(raw.audience) || raw.sender_membership !== "active" && raw.sender_membership !== "unknown" || !Array.isArray(raw.tool_grants) || raw.tool_grants.length > 100) return NO_TURN_AUTHORIZATION;
   const grants = [];
   for (const value2 of raw.tool_grants) {
     if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return NO_TURN_AUTHORIZATION;
@@ -1743,7 +3391,7 @@ function parseTurnAuthorization(value) {
       grants.push(Object.freeze({ tool: grant.tool, mode: "read" }));
       continue;
     }
-    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || typeof grant.expires_at !== "string" || !grant.expires_at) return NO_TURN_AUTHORIZATION;
+    if (grant.mode !== "side_effect" || typeof grant.operation_sha256 !== "string" || !/^[0-9a-f]{64}$/.test(grant.operation_sha256) || typeof grant.confirmation_id !== "string" || !grant.confirmation_id || grant.confirmation_id.length > 200 || typeof grant.idempotency_key !== "string" || !grant.idempotency_key || grant.idempotency_key.length > 200 || typeof grant.expires_at !== "string" || !grant.expires_at || grant.expires_at.length > 40) return NO_TURN_AUTHORIZATION;
     grants.push(Object.freeze({
       tool: grant.tool,
       mode: "side_effect",
@@ -1761,9 +3409,8 @@ function parseTurnAuthorization(value) {
   });
 }
 var SEEN_MAX = 5e3;
-function errText(e) {
-  return e instanceof Error ? e.message : String(e);
-}
+var PENDING_REPLY_MAX = 1e3;
+var TERMINAL_REPLY_ERRORS = /* @__PURE__ */ new Set(["agent_paused", "send_forbidden"]);
 var SecureComsDataPlane = class {
   identityId;
   connectionPath;
@@ -1773,7 +3420,18 @@ var SecureComsDataPlane = class {
   log;
   sleep;
   random;
+  healthTimeoutMs;
   onMessage;
+  noticeReplies;
+  /**
+   * Final-wave I1(b): sockets whose daemon advertised the `nack` feature. On
+   * those a failed turn is NACKED — only that message is retried, behind the
+   * daemon's backoff, and the socket (with every other channel's turn) stays
+   * up. Anywhere else a failed turn still closes the socket, as before.
+   */
+  nackCapable = /* @__PURE__ */ new WeakSet();
+  /** Sockets whose hello is unanswered: a refusal there is expected, not an error. */
+  helloPending = /* @__PURE__ */ new WeakSet();
   seen = /* @__PURE__ */ new Set();
   stopped = false;
   running = false;
@@ -1800,6 +3458,21 @@ var SecureComsDataPlane = class {
    * generation is current, so a restart can never end up with two live loops.
    */
   generation = 0;
+  /** Turn controllers grouped by the socket whose result would receive them. */
+  turns = /* @__PURE__ */ new Map();
+  /**
+   * Phase 3 F2: per-channel processing chains. A channel's messages are
+   * handled strictly one after another in arrival order (the receipt lookup,
+   * the turn and the reply), never concurrently — even when a daemon flushes a
+   * whole backlog at once. Different channels still run alongside each other.
+   */
+  channelChains = /* @__PURE__ */ new Map();
+  healthController = null;
+  clock;
+  /** Arrival counter behind InboundMessage.seq. */
+  seq = 0;
+  /** in_reply_to → timing of a reply handed to the daemon, until its `sent` frame. */
+  pendingReplies = /* @__PURE__ */ new Map();
   constructor(cfg, onMessage) {
     this.identityId = cfg.identityId;
     const dir = cfg.connectionsDir ?? join5(homedir3(), ".securecoms", "connections");
@@ -1807,18 +3480,28 @@ var SecureComsDataPlane = class {
     this.establishedMs = cfg.establishedMs ?? 5e3;
     this.initialDelayMs = cfg.initialDelayMs ?? 250;
     this.maxDelayMs = cfg.maxDelayMs ?? 3e4;
-    this.log = cfg.log ?? ((level, msg) => {
-      if (level === "info") console.log(msg);
-      else console.error(msg);
-    });
-    this.sleep = cfg.sleep ?? ((ms) => new Promise((resolve3) => {
+    this.log = cfg.log ?? writeServiceLog;
+    this.sleep = cfg.sleep ?? ((ms2) => new Promise((resolve3) => {
       this.sleepTimer = setTimeout(() => {
         this.sleepTimer = null;
         resolve3();
-      }, ms);
+      }, ms2);
     }));
     this.random = cfg.random ?? Math.random;
+    this.healthTimeoutMs = cfg.healthTimeoutMs ?? 2e3;
     this.onMessage = onMessage;
+    this.noticeReplies = cfg.noticeReplies ?? /* @__PURE__ */ new Set();
+    this.clock = cfg.clock ?? (() => performance.now());
+  }
+  elapsed(from, to = this.clock()) {
+    return Math.max(0, Math.round(to - from));
+  }
+  trackReply(messageId, reply) {
+    if (this.pendingReplies.size >= PENDING_REPLY_MAX) {
+      const oldest = this.pendingReplies.keys().next();
+      if (!oldest.done) this.pendingReplies.delete(oldest.value);
+    }
+    this.pendingReplies.set(messageId, reply);
   }
   /**
    * Resolves once the reconnect loop is running — NOT once attached. The loop
@@ -1837,13 +3520,19 @@ var SecureComsDataPlane = class {
     this.generation++;
     this.clearSettle();
     this.cancelSleep();
+    this.healthController?.abort(new Error("transport stopped"));
+    this.healthController = null;
+    for (const controllers of this.turns.values()) {
+      for (const controller of controllers) controller.abort(new Error("transport stopped"));
+    }
+    this.turns.clear();
     const ws = this.socket;
     this.socket = null;
     if (ws) {
       try {
         ws.close();
       } catch (e) {
-        this.log("warn", `error closing socket: ${errText(e)}`);
+        this.log("warn", "transport.socket_close_failed", {}, e);
       }
     }
   }
@@ -1862,7 +3551,7 @@ var SecureComsDataPlane = class {
     for (const release of this.sleepWaiters.splice(0)) release();
   }
   /** The backoff sleep, made interruptible by stop(). */
-  wait(ms) {
+  wait(ms2) {
     if (this.stopped) return Promise.resolve();
     return new Promise((resolve3) => {
       let settled = false;
@@ -1873,7 +3562,7 @@ var SecureComsDataPlane = class {
         resolve3();
       };
       this.sleepWaiters.push(finish);
-      void this.sleep(ms).then(finish, finish);
+      void this.sleep(ms2).then(finish, finish);
     });
   }
   clearSettle() {
@@ -1897,7 +3586,7 @@ var SecureComsDataPlane = class {
         await this.attemptOnce();
         delay = this.initialDelayMs;
       } catch (e) {
-        this.log("error", errText(e));
+        this.log("error", "transport.connection_attempt_failed", {}, e);
       }
       if (!live()) break;
       await this.wait(this.random() * delay);
@@ -1906,10 +3595,22 @@ var SecureComsDataPlane = class {
     if (this.generation === generation) this.running = false;
   }
   async attemptOnce() {
-    const conn = JSON.parse(readFileSync5(this.connectionPath, "utf8"));
+    const conn = JSON.parse(readFileSync7(this.connectionPath, "utf8"));
     const httpBase = conn.bridge_url.replace(/^ws/, "http").replace(/\/v1\/ws$/, "");
-    const token = readFileSync5(conn.token_file, "utf8").trim();
-    const health = await (await fetch(`${httpBase}/healthz`)).json();
+    const token = readFileSync7(conn.token_file, "utf8").trim();
+    const healthController = new AbortController();
+    this.healthController = healthController;
+    const healthTimer = setTimeout(
+      () => healthController.abort(new Error("health gate deadline exceeded")),
+      this.healthTimeoutMs
+    );
+    let health;
+    try {
+      health = await (await fetch(`${httpBase}/healthz`, { signal: healthController.signal })).json();
+    } finally {
+      clearTimeout(healthTimer);
+      if (this.healthController === healthController) this.healthController = null;
+    }
     if (conn.identity_id !== health.identity_id || this.identityId !== health.identity_id) {
       throw new Error(
         `gate refused: expected ${this.identityId}, connection file says ${conn.identity_id}, daemon on this port is ${health.identity_id}`
@@ -1923,7 +3624,7 @@ var SecureComsDataPlane = class {
     try {
       await new Promise((resolve3, reject) => {
         ws.addEventListener("error", (e) => {
-          reject(new Error(`socket error: ${errText(e?.message ?? e)}`));
+          reject(Object.assign(new Error("socket_error"), { cause: e }));
         });
         ws.addEventListener("close", (e) => {
           if (established) resolve3();
@@ -1936,19 +3637,29 @@ var SecureComsDataPlane = class {
           }
         });
         ws.addEventListener("open", () => {
+          this.helloPending.add(ws);
+          try {
+            ws.send(JSON.stringify({ type: "hello", features: ["nack"] }));
+          } catch {
+          }
           settle = setTimeout(() => {
             established = true;
-            this.log("info", `attached to ${conn.bridge_url}`);
+            this.log("info", "transport.attached");
           }, this.establishedMs);
           this.settle = settle;
         });
         ws.addEventListener("message", (ev) => {
-          void this.handleFrame(ws, ev.data).catch((e) => {
-            this.log("error", `frame handling failed: ${errText(e)}`);
+          void this.handleFrame(ws, ev.data, httpBase, token).catch((e) => {
+            this.log("error", "transport.frame_handling_failed", {}, e);
           });
         });
       });
     } finally {
+      const controllers = this.turns.get(ws);
+      if (controllers) {
+        for (const controller of controllers) controller.abort(new Error("transport disconnected"));
+        this.turns.delete(ws);
+      }
       if (settle !== null) clearTimeout(settle);
       if (this.settle === settle) this.settle = null;
       try {
@@ -1958,53 +3669,175 @@ var SecureComsDataPlane = class {
       if (this.socket === ws) this.socket = null;
     }
   }
-  async handleFrame(ws, data) {
+  /**
+   * Final-wave I1(b): fail ONE message. Against a nack-capable daemon, send a
+   * `nack` — only this message is retried and the socket stays up for every
+   * other channel's turn. Otherwise close the socket, the only failure
+   * signal an older daemon understands (it re-buffers what was in flight).
+   */
+  failTurn(ws, messageId, reason) {
+    if (this.nackCapable.has(ws) && ws.readyState === ws.OPEN) {
+      try {
+        ws.send(JSON.stringify({ type: "nack", message_id: messageId, reason }));
+        return;
+      } catch {
+      }
+    }
+    try {
+      ws.close();
+    } catch {
+    }
+  }
+  async handleFrame(ws, data, httpBase, token) {
     let frame;
     try {
       frame = JSON.parse(String(data));
     } catch (e) {
-      this.log("error", `ignoring unparseable frame: ${errText(e)}`);
+      this.log("error", "transport.frame_parse_failed", {}, e);
+      return;
+    }
+    if (frame?.type === "hello") {
+      this.helloPending.delete(ws);
+      if (Array.isArray(frame.features) && frame.features.includes("nack")) this.nackCapable.add(ws);
       return;
     }
     if (frame?.type === "error") {
-      this.log("error", `daemon error frame: ${String(frame.error)}: ${String(frame.message)}`);
+      if (frame.in_reply_to === void 0 && this.helloPending.has(ws)) {
+        this.helloPending.delete(ws);
+        this.log("info", "transport.daemon_without_nack");
+        return;
+      }
+      if (typeof frame.in_reply_to === "string") this.pendingReplies.delete(frame.in_reply_to);
+      if (typeof frame.in_reply_to === "string" && TERMINAL_REPLY_ERRORS.has(String(frame.error))) {
+        this.log("warn", "transport.reply_terminal", { paused: frame.error === "agent_paused" });
+        this.remember(frame.in_reply_to);
+        ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
+        return;
+      }
+      this.log("error", "transport.daemon_error_frame");
+      if (typeof frame.in_reply_to === "string") this.failTurn(ws, frame.in_reply_to, "reply_failed");
+      return;
+    }
+    if (frame?.type === "sent" && typeof frame.in_reply_to === "string") {
+      const pending = this.pendingReplies.get(frame.in_reply_to);
+      if (pending) {
+        this.pendingReplies.delete(frame.in_reply_to);
+        const now = this.clock();
+        this.log("info", "transport.reply_published", {
+          seq: pending.seq,
+          publish_ms: this.elapsed(pending.sentAt, now),
+          total_ms: this.elapsed(pending.arrived, now)
+        });
+      }
+      this.remember(frame.in_reply_to);
+      ws.send(JSON.stringify({ type: "ack", message_id: frame.in_reply_to }));
       return;
     }
     if (frame?.type !== "message") return;
     const messageId = frame.message_id;
     if (typeof messageId !== "string") {
-      this.log("error", "ignoring message frame with no message_id");
+      this.log("error", "transport.message_id_missing");
       return;
     }
     const channelId = String(frame.channel_id);
+    const arrival = { seq: ++this.seq, at: this.clock() };
+    const previous = this.channelChains.get(channelId) ?? Promise.resolve();
+    const run = () => this.handleMessage(ws, frame, messageId, channelId, httpBase, token, arrival);
+    const mine = previous.then(run, run);
+    this.channelChains.set(channelId, mine);
+    try {
+      await mine;
+    } finally {
+      if (this.channelChains.get(channelId) === mine) this.channelChains.delete(channelId);
+    }
+  }
+  async handleMessage(ws, frame, messageId, channelId, httpBase, token, arrival) {
+    if (ws.readyState !== ws.OPEN) return;
+    let turnController = null;
+    const startedAt = this.clock();
+    let receiptMs = 0;
+    let handlerMs = 0;
+    let sendMs = 0;
+    let outcome = "failed";
     try {
       if (!this.seen.has(messageId)) {
-        this.remember(messageId);
+        const receiptStart = this.clock();
+        const receipt = await fetch(
+          `${httpBase}/v1/reply-receipt?in_reply_to=${encodeURIComponent(messageId)}`,
+          {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(this.healthTimeoutMs)
+          }
+        );
+        if (!receipt.ok) throw new Error(`reply receipt lookup failed: HTTP ${receipt.status}`);
+        const found = (await receipt.json()).found === true;
+        receiptMs = this.elapsed(receiptStart);
+        if (found) {
+          outcome = "receipt_found";
+          this.remember(messageId);
+          ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+          return;
+        }
+        turnController = new AbortController();
+        let socketTurns = this.turns.get(ws);
+        if (!socketTurns) {
+          socketTurns = /* @__PURE__ */ new Set();
+          this.turns.set(ws, socketTurns);
+        }
+        socketTurns.add(turnController);
+        const handlerStart = this.clock();
         const reply = await this.onMessage({
           text: String(frame.text ?? ""),
           senderId: String(frame.sender_id ?? ""),
           channelId,
           messageId,
           authorization: parseTurnAuthorization(frame.authorization),
-          memory: parseTurnMemory(frame.memory)
-        });
+          memory: parseTurnMemory(frame.memory),
+          seq: arrival.seq
+        }, turnController.signal);
+        handlerMs = this.elapsed(handlerStart);
         if (reply != null) {
+          const text = String(reply);
+          const sendStart = this.clock();
           ws.send(JSON.stringify({
             type: "send",
             channel_id: channelId,
-            text: String(reply),
-            in_reply_to: messageId
+            text,
+            in_reply_to: messageId,
+            ...this.noticeReplies.has(text) ? { notice: true } : {}
           }));
+          const sentAt = this.clock();
+          sendMs = this.elapsed(sendStart, sentAt);
+          outcome = "replied";
+          this.trackReply(messageId, { seq: arrival.seq, arrived: arrival.at, sentAt });
+          return;
         }
+        outcome = "no_reply";
+        this.remember(messageId);
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
+      } else {
+        outcome = "duplicate";
+        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
       }
     } catch (e) {
-      this.log("error", `handler threw: ${errText(e)}`);
+      this.log("error", "transport.handler_failed", {}, e);
+      this.failTurn(ws, messageId, "turn_failed");
     } finally {
-      try {
-        ws.send(JSON.stringify({ type: "ack", message_id: messageId }));
-      } catch (e) {
-        this.log("error", `could not ack ${messageId}: ${errText(e)}`);
+      if (turnController) {
+        const socketTurns = this.turns.get(ws);
+        socketTurns?.delete(turnController);
+        if (socketTurns?.size === 0) this.turns.delete(ws);
       }
+      const end = this.clock();
+      this.log("info", "transport.message_handled", {
+        seq: arrival.seq,
+        chain_wait_ms: this.elapsed(arrival.at, startedAt),
+        receipt_ms: receiptMs,
+        handler_ms: handlerMs,
+        send_ms: sendMs,
+        total_ms: this.elapsed(arrival.at, end),
+        outcome: logLabel(outcome)
+      });
     }
   }
 };
@@ -2013,9 +3846,22 @@ function createSecureComsDataPlane(cfg, onMessage) {
 }
 
 // src/tool-runner.ts
+var ERROR_ENVELOPE = /^\{\s*"error"\s*:/;
 async function runToolCalls(toolCalls, skills, context) {
   const out = [];
+  const clock = context?.clock ?? (() => performance.now());
   for (const call of toolCalls) {
+    if (context?.signal?.aborted) {
+      out.push({
+        role: "tool",
+        content: toolError("Tool execution cancelled"),
+        tool_call_id: call.id
+      });
+      context.onTiming?.({ tool_call_id: call.id, ms: 0, ok: false, cancelled: true });
+      continue;
+    }
+    const started = clock();
+    let threw = false;
     let args;
     try {
       args = JSON.parse(call.function.arguments);
@@ -2024,13 +3870,22 @@ async function runToolCalls(toolCalls, skills, context) {
     }
     let content;
     try {
-      content = await skills.invoke(call.function.name, args, context);
+      content = boundToolResult(await skills.invoke(call.function.name, args, {
+        roomId: context?.roomId,
+        groupId: context?.groupId,
+        signal: context?.signal,
+        sideEffect: context?.sideEffects?.get(call.id)
+      }));
     } catch (err) {
-      content = JSON.stringify({
-        error: "tool_failed",
-        message: String(err instanceof Error ? err.message : err)
-      });
+      threw = true;
+      content = toolError(String(err instanceof Error ? err.message : err));
     }
+    context?.onTiming?.({
+      tool_call_id: call.id,
+      ms: clock() - started,
+      ok: !threw && !ERROR_ENVELOPE.test(content),
+      cancelled: false
+    });
     out.push({ role: "tool", content, tool_call_id: call.id });
   }
   return out;
@@ -2039,14 +3894,56 @@ async function runToolCalls(toolCalls, skills, context) {
 // src/turn-loop.ts
 var DEFAULT_SYSTEM_PROMPT = "You are a SecureComs agent. Respond helpfully and concisely.";
 var DEFAULT_MAX_ITERATIONS = 5;
+var DEFAULT_MAX_CONCURRENT_TURNS = 4;
+var DEFAULT_TURN_TIMEOUT_MS = 3e5;
+var DAILY_LIMIT_RESPONSE = "This agent has reached its daily usage limit and will respond again after 00:00 UTC.";
+var BUDGET_UNAVAILABLE_RESPONSE = "This agent cannot use its language model right now because of a problem on its host. Its owner can find the details in the runtime log.";
+function isBudgetUnavailable(error) {
+  return error instanceof RequestExceedsDailyTokenCapError || error instanceof BudgetLockHeldError || error instanceof BudgetStateWriteError || error instanceof BudgetStateReadError;
+}
+var MESSAGE_TOO_LARGE_RESPONSE = "This message is too large for this agent to process. Please send a shorter message.";
+var TURN_TOO_LARGE_RESPONSE = "This agent could not finish this request within its size limits.";
+var MAX_TOOL_CALLS_PER_RESPONSE = 8;
+var MAX_TOOL_CALLS_PER_TURN = 16;
+var MAX_TOOL_RESULT_BYTES_PER_TURN = 64 * 1024;
+var TOOL_RESULT_HEADROOM_BYTES = 12 * 1024;
+var DEFAULT_TURN_ABANDON_GRACE_MS = 1e4;
+var REQUEST_ENVELOPE_RESERVE_BYTES = 1024;
+var MIN_TRUNCATED_TOOL_RESULT_BYTES = 1024;
+var RESULT_BUDGET_EXCEEDED = JSON.stringify({ error: "tool_result_budget_exceeded" });
+function jsonBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function messageBytes(message) {
+  return jsonBytes(message) + 1;
+}
+var PromptTooLargeError = class extends Error {
+  constructor(initial, sizes = {}) {
+    super("prompt exceeds the request size budget");
+    this.initial = initial;
+    this.sizes = sizes;
+  }
+};
+var TurnAbandonedError = class extends Error {
+  constructor() {
+    super("Agent turn abandoned");
+  }
+};
 var READ_ONLY_TOOLS = /* @__PURE__ */ new Set(["echo", "web_search", "fetch_url", "sql_query", "current_time"]);
 function hasReadGrant(auth, toolName) {
   return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "read");
 }
+function hasSideEffectGrant(auth, toolName) {
+  return auth.sender_membership === "active" && auth.tool_grants.some((grant) => grant.tool === toolName && grant.mode === "side_effect");
+}
 function toolIsOffered(auth, toolName) {
-  return hasReadGrant(auth, toolName) && (READ_ONLY_TOOLS.has(toolName) || toolName === "http_request");
+  if (READ_ONLY_TOOLS.has(toolName)) return hasReadGrant(auth, toolName);
+  if (toolName === "http_request") {
+    return hasReadGrant(auth, toolName) || hasSideEffectGrant(auth, toolName);
+  }
+  return false;
 }
-function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
+function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames, now = /* @__PURE__ */ new Date()) {
   if (auth.sender_membership !== "active") {
     return { allowed: false, reason: "Sender membership is not active" };
   }
@@ -2057,8 +3954,26 @@ function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
     try {
       const args = JSON.parse(argumentsJson);
       const method = typeof args.method === "string" ? args.method.toUpperCase() : "GET";
-      if (method !== "GET") {
-        return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+      if (method === "GET") {
+        if (!hasReadGrant(auth, toolName)) {
+          return { allowed: false, reason: `Tool "${toolName}" has no active channel read grant` };
+        }
+      } else {
+        if (!(/* @__PURE__ */ new Set(["POST", "PUT", "DELETE"])).has(method)) {
+          return { allowed: false, reason: `HTTP method "${method}" is not supported` };
+        }
+        const digest = operationSha256(toolName, args);
+        const grant = auth.tool_grants.find(
+          (candidate) => candidate.mode === "side_effect" && candidate.tool === toolName && candidate.operation_sha256 === digest
+        );
+        if (!grant) {
+          return { allowed: false, reason: "State-changing HTTP calls require an exact confirmed operation grant" };
+        }
+        const expiresAt = Date.parse(grant.expires_at);
+        if (!Number.isFinite(expiresAt) || expiresAt <= now.getTime()) {
+          return { allowed: false, reason: "The confirmed operation grant is expired or invalid" };
+        }
+        return { allowed: true, reason: `Tool "${toolName}" has an exact confirmed operation grant`, sideEffect: grant };
       }
     } catch {
       return { allowed: false, reason: "Tool arguments are not valid JSON" };
@@ -2066,99 +3981,672 @@ function authorizeToolExecution(auth, toolName, argumentsJson, offeredNames) {
   }
   return { allowed: true, reason: `Tool "${toolName}" has an active channel read grant` };
 }
+var FINISH_REASONS = /* @__PURE__ */ new Set([
+  "stop",
+  "tool_calls",
+  "function_call",
+  "length",
+  "content_filter",
+  "end_turn",
+  "tool_use",
+  "max_tokens",
+  "stop_sequence"
+]);
+function finishReasonLabel(reason) {
+  if (typeof reason !== "string" || reason === "") return logLabel("none");
+  return logLabel(FINISH_REASONS.has(reason) ? reason : "other");
+}
+function ms(from, to) {
+  return Math.max(0, Math.round(to - from));
+}
 function buildHandler(deps) {
   const maxIterations = deps.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+  const maxConcurrentTurns = deps.maxConcurrentTurns ?? DEFAULT_MAX_CONCURRENT_TURNS;
+  const turnTimeoutMs = deps.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
+  const abandonGraceMs = deps.turnAbandonGraceMs ?? DEFAULT_TURN_ABANDON_GRACE_MS;
+  const requestMaxBytes = deps.requestMaxBytes ?? LLM_REQUEST_MAX_BYTES;
   const log = deps.log ?? (() => {
   });
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const clock = deps.clock ?? (() => performance.now());
   const { llm, memoryFor, skills, gate } = deps;
-  return async (m) => {
+  let localSeq = 0;
+  const channelTails = /* @__PURE__ */ new Map();
+  const slotWaiters = [];
+  let activeTurns = 0;
+  let abandonedUnsettled = 0;
+  let wedged = false;
+  let retiring = null;
+  let onIdle = null;
+  const limitNotified = /* @__PURE__ */ new Map();
+  function cancelledError() {
+    return new Error("Agent turn cancelled");
+  }
+  function wedgedError() {
+    return new Error("Agent runtime wedged: too many abandoned turns are still running");
+  }
+  function waitUnlessAborted(gate2, signal) {
+    if (!signal) return gate2;
+    if (signal.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const onAbort = () => reject(cancelledError());
+      signal.addEventListener("abort", onAbort, { once: true });
+      void gate2.then(() => {
+        signal.removeEventListener("abort", onAbort);
+        resolve3();
+      });
+    });
+  }
+  async function lockChannel(channelId, signal) {
+    const previous = channelTails.get(channelId) ?? Promise.resolve();
+    let release;
+    const mine = new Promise((resolve3) => {
+      release = resolve3;
+    });
+    const tail = previous.then(() => mine);
+    channelTails.set(channelId, tail);
+    let released = false;
+    const done = () => {
+      if (released) return;
+      released = true;
+      release();
+      if (channelTails.get(channelId) === tail) channelTails.delete(channelId);
+    };
+    try {
+      await waitUnlessAborted(previous, signal);
+    } catch (error) {
+      done();
+      throw error;
+    }
+    return done;
+  }
+  function acquireSlot(signal) {
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      activeTurns--;
+      slotWaiters.shift()?.();
+      if (activeTurns === 0) onIdle?.();
+    };
+    if (activeTurns < maxConcurrentTurns) {
+      activeTurns++;
+      return Promise.resolve(release);
+    }
+    if (signal?.aborted) return Promise.reject(cancelledError());
+    return new Promise((resolve3, reject) => {
+      const grant = () => {
+        signal?.removeEventListener("abort", onAbort);
+        activeTurns++;
+        resolve3(release);
+      };
+      const onAbort = () => {
+        const i = slotWaiters.indexOf(grant);
+        if (i >= 0) slotWaiters.splice(i, 1);
+        reject(cancelledError());
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      slotWaiters.push(grant);
+    });
+  }
+  const unavailableNotified = /* @__PURE__ */ new Map();
+  function budgetUnavailableReply(channelId, error) {
+    const day = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    log("warn", "turn.budget_unavailable", {
+      config: error instanceof RequestExceedsDailyTokenCapError,
+      lock: error instanceof BudgetLockHeldError,
+      state_write: error instanceof BudgetStateWriteError,
+      state_read: error instanceof BudgetStateReadError
+    });
+    if (unavailableNotified.get(channelId) === day) return null;
+    for (const [ch, d] of unavailableNotified) if (d !== day) unavailableNotified.delete(ch);
+    unavailableNotified.set(channelId, day);
+    return BUDGET_UNAVAILABLE_RESPONSE;
+  }
+  function dailyLimitReply(channelId, day) {
+    if (limitNotified.get(channelId) === day) return null;
+    for (const [ch, d] of limitNotified) if (d !== day) limitNotified.delete(ch);
+    limitNotified.set(channelId, day);
+    log("warn", "turn.daily_limit_reply");
+    return DAILY_LIMIT_RESPONSE;
+  }
+  function logCompleted(timing) {
+    const end = clock();
+    log("info", "turn.completed", {
+      seq: timing.seq,
+      total_ms: ms(timing.received, end),
+      queue_ms: ms(timing.received, timing.started ?? end),
+      run_ms: timing.started === void 0 ? 0 : ms(timing.started, end),
+      context_ms: timing.contextMs,
+      iterations: timing.iterations,
+      model_ms: timing.modelMs,
+      tool_ms: timing.toolMs,
+      tool_calls: timing.toolCalls,
+      tools_denied: timing.toolsDenied,
+      outcome: logLabel(timing.outcome)
+    });
+  }
+  return async (m, upstreamSignal) => {
     const text = m.text?.trim() ? m.text : "";
     if (!text) return null;
-    log(
-      "info",
-      `message received (sender=${m.senderId.slice(0, 8)}, channel=${m.channelId.slice(0, 8)}, chars=${text.length})`
-    );
+    const timing = {
+      seq: typeof m.seq === "number" && Number.isFinite(m.seq) ? m.seq : ++localSeq,
+      received: clock(),
+      contextMs: 0,
+      iterations: 0,
+      modelMs: 0,
+      toolMs: 0,
+      toolCalls: 0,
+      toolsDenied: 0,
+      // Until the turn holds both locks, the only way out is cancellation.
+      outcome: "cancelled"
+    };
+    try {
+      return await queuedTurn(m, upstreamSignal, timing);
+    } finally {
+      logCompleted(timing);
+    }
+  };
+  async function queuedTurn(m, upstreamSignal, timing) {
+    if (retiring) {
+      await retiring;
+      timing.outcome = "error";
+      throw wedgedError();
+    }
+    if (wedged) {
+      timing.outcome = "error";
+      throw wedgedError();
+    }
+    const sameChannel = channelTails.has(m.channelId);
+    const mustWait = sameChannel || activeTurns >= maxConcurrentTurns;
+    if (mustWait) {
+      log("info", "turn.queued", {
+        same_channel: channelTails.has(m.channelId),
+        active_turns: activeTurns
+      });
+    }
+    const releaseChannel = await lockChannel(m.channelId, upstreamSignal);
+    const channelReady = clock();
+    let releaseSlot;
+    try {
+      releaseSlot = await acquireSlot(upstreamSignal);
+    } catch (error) {
+      releaseChannel();
+      throw error;
+    }
+    if (retiring) {
+      releaseSlot();
+      releaseChannel();
+      await retiring;
+      timing.outcome = "error";
+      throw wedgedError();
+    }
+    timing.started = clock();
+    timing.outcome = "error";
+    log("info", "turn.started", {
+      seq: timing.seq,
+      queue_ms: ms(timing.received, timing.started),
+      channel_wait_ms: ms(timing.received, channelReady),
+      slot_wait_ms: ms(channelReady, timing.started),
+      queued: mustWait,
+      same_channel: sameChannel
+    });
+    const controller = new AbortController();
+    let timedOut = false;
+    const cancel = () => controller.abort(upstreamSignal?.reason);
+    if (upstreamSignal?.aborted) cancel();
+    else upstreamSignal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new Error("turn deadline exceeded"));
+    }, turnTimeoutMs);
+    const token = { abandoned: false };
+    let abandonTimer;
+    let turn;
+    const abandonment = new Promise((_resolve, reject) => {
+      const armGrace = () => {
+        abandonTimer = setTimeout(() => {
+          token.abandoned = true;
+          abandonedUnsettled++;
+          const abandonedAt = clock();
+          log("warn", "turn.abandoned", {
+            seq: timing.seq,
+            deadline_ms: turnTimeoutMs,
+            grace_ms: abandonGraceMs,
+            timed_out: timedOut,
+            abandoned_unsettled: abandonedUnsettled
+          });
+          if (abandonedUnsettled > maxConcurrentTurns && !wedged) {
+            wedged = true;
+            log("error", "turn.runtime_wedged", { abandoned_unsettled: abandonedUnsettled });
+            if (deps.onWedged && !retiring) {
+              retiring = new Promise((resolve3) => {
+                onIdle = resolve3;
+              });
+              deps.onWedged(retiring);
+            }
+          }
+          const settled = () => {
+            abandonedUnsettled--;
+            if (wedged && abandonedUnsettled <= maxConcurrentTurns) wedged = false;
+            log("info", "turn.abandoned_settled", {
+              seq: timing.seq,
+              settled_after_ms: ms(abandonedAt, clock()),
+              abandoned_unsettled: abandonedUnsettled
+            });
+          };
+          void turn?.then(settled, settled);
+          reject(new TurnAbandonedError());
+        }, abandonGraceMs);
+      };
+      if (controller.signal.aborted) armGrace();
+      else controller.signal.addEventListener("abort", armGrace, { once: true });
+    });
+    abandonment.catch(() => {
+    });
+    try {
+      turn = runTurn(m, controller.signal, timing, token);
+      turn.catch(() => {
+      });
+      const reply = await Promise.race([turn, abandonment]);
+      if (token.abandoned) throw new TurnAbandonedError();
+      timing.outcome = reply === null ? "no_final_answer" : "answered";
+      unavailableNotified.delete(m.channelId);
+      return reply;
+    } catch (error) {
+      if (error instanceof DailyLimitReachedError) {
+        timing.outcome = "daily_limit";
+        return dailyLimitReply(m.channelId, error.day);
+      }
+      if (isBudgetUnavailable(error)) {
+        timing.outcome = "budget_unavailable";
+        return budgetUnavailableReply(m.channelId, error);
+      }
+      if (error instanceof PromptTooLargeError) {
+        timing.outcome = "too_large";
+        if (error.initial) {
+          log("warn", "turn.message_too_large", { seq: timing.seq, ...error.sizes });
+          return MESSAGE_TOO_LARGE_RESPONSE;
+        }
+        log("warn", "turn.turn_too_large", { seq: timing.seq });
+        return TURN_TOO_LARGE_RESPONSE;
+      }
+      if (timedOut) {
+        timing.outcome = "timeout";
+        throw new Error(`Agent turn timed out after ${turnTimeoutMs}ms`);
+      }
+      if (upstreamSignal?.aborted) {
+        timing.outcome = "cancelled";
+        throw cancelledError();
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      clearTimeout(abandonTimer);
+      upstreamSignal?.removeEventListener("abort", cancel);
+      releaseSlot();
+      releaseChannel();
+    }
+  }
+  function logModelCall(timing, iteration, elapsed, result) {
+    const usage = result?.usage;
+    log("info", "turn.model_call", {
+      seq: timing.seq,
+      iteration,
+      ms: elapsed,
+      ok: result !== void 0,
+      tool_calls: result?.toolCalls.length ?? 0,
+      ...result?.source ? { provider: logLabel(result.source.provider), model: logLabel(result.source.model) } : {},
+      ...result ? { finish_reason: finishReasonLabel(result.finishReason) } : {},
+      ...usage ? { total_tokens: usage.totalTokens } : {},
+      ...usage?.promptTokens !== void 0 ? { prompt_tokens: usage.promptTokens } : {},
+      ...usage?.completionTokens !== void 0 ? { completion_tokens: usage.completionTokens } : {}
+    });
+  }
+  async function runTurn(m, signal, timing, token) {
+    const text = m.text;
+    const live = () => {
+      if (token.abandoned) throw new TurnAbandonedError();
+    };
+    log("info", "turn.message_received", { chars: text.length });
+    const contextStart = clock();
     const memory = memoryFor(m.channelId);
     memory.replace(m.memory);
-    const messages = [{ role: "system", content: deps.systemPromptFor() }];
-    const recalled = await memory.recall(text);
-    if (recalled) messages.push({ role: "system", content: recalled });
-    messages.push(...memory.getHistory());
-    messages.push({ role: "user", content: text });
-    memory.addMessage({ role: "user", content: text });
+    const promptStart = clock();
+    const system = { role: "system", content: deps.systemPromptFor() };
+    const recallStart = clock();
+    const recalledText = await memory.recall(text);
+    live();
+    const recalled = recalledText ? { role: "system", content: recalledText } : null;
+    const history = memory.getHistory();
+    const user = { role: "user", content: text };
+    const toolsStart = clock();
     const tools = deps.tools().filter((tool) => toolIsOffered(m.authorization, tool.function.name));
     const offeredNames = new Set(tools.map((tool) => tool.function.name));
+    const toolsBytes = tools.length > 0 ? jsonBytes(tools) + 1 : 0;
+    const budgetBytes = requestMaxBytes - REQUEST_ENVELOPE_RESERVE_BYTES - toolsBytes;
+    const historyBytes = history.map(messageBytes);
+    const recalledBytes = recalled ? messageBytes(recalled) : 0;
+    const requiredBytes = messageBytes(system) + messageBytes(user);
+    const headroomBytes = tools.length > 0 ? TOOL_RESULT_HEADROOM_BYTES : 0;
+    if (requiredBytes + headroomBytes > budgetBytes) {
+      throw new PromptTooLargeError(true, {
+        system_bytes: messageBytes(system),
+        tools_bytes: toolsBytes,
+        message_bytes: messageBytes(user),
+        budget_bytes: budgetBytes
+      });
+    }
+    let room = budgetBytes - requiredBytes - headroomBytes;
+    let keepRecalled = recalled !== null && recalledBytes <= room;
+    if (keepRecalled) room -= recalledBytes;
+    let historyStart = history.length;
+    let keptHistoryBytes = 0;
+    while (historyStart > 0 && keptHistoryBytes + historyBytes[historyStart - 1] <= room) {
+      historyStart--;
+      keptHistoryBytes += historyBytes[historyStart];
+    }
+    const dropLeadingAssistant = () => {
+      while (historyStart > 0 && historyStart < history.length && history[historyStart].role === "assistant") {
+        keptHistoryBytes -= historyBytes[historyStart];
+        historyStart++;
+      }
+    };
+    dropLeadingAssistant();
+    const turnMessages = [];
+    let turnMessageBytes = 0;
+    const promptBytes = () => requiredBytes + (keepRecalled ? recalledBytes : 0) + keptHistoryBytes + turnMessageBytes;
+    const logTrim = (iteration) => {
+      log("info", "turn.context_trimmed", {
+        seq: timing.seq,
+        iteration,
+        history_kept: history.length - historyStart,
+        history_dropped: historyStart,
+        recalled_dropped: recalled !== null && !keepRecalled,
+        prompt_bytes: promptBytes(),
+        budget_bytes: budgetBytes
+      });
+    };
+    if (historyStart > 0 || recalled !== null && !keepRecalled) logTrim(0);
+    const refit = (iteration) => {
+      let trimmed = false;
+      while (promptBytes() > budgetBytes) {
+        if (historyStart < history.length) {
+          keptHistoryBytes -= historyBytes[historyStart];
+          historyStart++;
+        } else if (keepRecalled) {
+          keepRecalled = false;
+        } else {
+          throw new PromptTooLargeError(false);
+        }
+        trimmed = true;
+      }
+      if (trimmed) {
+        dropLeadingAssistant();
+        logTrim(iteration);
+      }
+    };
+    const buildMessages = () => [
+      system,
+      ...keepRecalled && recalled ? [recalled] : [],
+      ...history.slice(historyStart),
+      user,
+      ...turnMessages
+    ];
+    const pushTurnMessage = (message) => {
+      turnMessages.push(message);
+      turnMessageBytes += messageBytes(message);
+    };
+    memory.addMessage({ role: "user", content: text });
+    const contextEnd = clock();
+    timing.contextMs = ms(contextStart, contextEnd);
+    log("info", "turn.context_built", {
+      seq: timing.seq,
+      ms: timing.contextMs,
+      memory_ms: ms(contextStart, promptStart),
+      prompt_ms: ms(promptStart, recallStart),
+      recall_ms: ms(recallStart, toolsStart),
+      tools_ms: ms(toolsStart, contextEnd),
+      history_messages: history.length - historyStart,
+      history_dropped: historyStart,
+      recalled: keepRecalled,
+      tools_offered: tools.length,
+      prompt_bytes: promptBytes()
+    });
+    let toolResultBytes = 0;
+    let turnToolCalls = 0;
+    const callModel = async (n, offer) => {
+      const started = clock();
+      let result;
+      try {
+        result = await llm.complete(buildMessages(), offer, { signal });
+      } finally {
+        const modelMs = ms(started, clock());
+        timing.iterations = n;
+        timing.modelMs += modelMs;
+        logModelCall(timing, n, modelMs, result);
+      }
+      live();
+      return result;
+    };
     let response = null;
     for (let iteration = 0; iteration < maxIterations; iteration++) {
-      const result = await llm.complete(messages, tools.length > 0 ? tools : void 0);
+      if (iteration > 0) refit(iteration + 1);
+      const iterationStart = clock();
+      const result = await callModel(iteration + 1, tools.length > 0 ? tools : void 0);
       if (result.toolCalls.length === 0) {
         response = result.content;
+        log("info", "turn.iteration", {
+          seq: timing.seq,
+          iteration: iteration + 1,
+          ms: ms(iterationStart, clock()),
+          tool_calls: 0,
+          tools_denied: 0,
+          tool_ms: 0,
+          final: true
+        });
         break;
       }
-      messages.push({
+      pushTurnMessage({
         role: "assistant",
         content: result.content ?? "",
         tool_calls: result.toolCalls
       });
-      const verdicts = result.toolCalls.map((call) => {
+      if (result.toolCalls.length > MAX_TOOL_CALLS_PER_RESPONSE) {
+        log("warn", "turn.tool_calls_capped", {
+          seq: timing.seq,
+          iteration: iteration + 1,
+          requested: result.toolCalls.length,
+          over_cap: result.toolCalls.length - MAX_TOOL_CALLS_PER_RESPONSE
+        });
+      }
+      const resultBudgetSpent = toolResultBytes >= MAX_TOOL_RESULT_BYTES_PER_TURN;
+      let turnCapDenied = 0;
+      const verdicts = result.toolCalls.map((call, index) => {
+        if (index >= MAX_TOOL_CALLS_PER_RESPONSE) {
+          return { call, verdict: { allowed: false, reason: "too_many_calls: this response asked for more tool calls than one response may run" } };
+        }
+        if (turnToolCalls >= MAX_TOOL_CALLS_PER_TURN) {
+          turnCapDenied++;
+          return { call, verdict: { allowed: false, reason: "too_many_calls: this turn has run as many tool calls as one turn may" } };
+        }
+        if (resultBudgetSpent) {
+          return { call, verdict: { allowed: false, reason: "tool_result_budget_exhausted: this turn's tool-result budget is spent" } };
+        }
         const channelVerdict = authorizeToolExecution(
           m.authorization,
           call.function.name,
           call.function.arguments,
-          offeredNames
+          offeredNames,
+          now()
         );
+        const localVerdict = channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict;
+        if (localVerdict.allowed) turnToolCalls++;
         return {
           call,
-          verdict: channelVerdict.allowed ? gate.gate(call.function.name) : channelVerdict
+          verdict: {
+            ...localVerdict,
+            ...localVerdict.allowed && channelVerdict.sideEffect ? { sideEffect: channelVerdict.sideEffect } : {}
+          }
         };
       });
       const allowed = verdicts.filter((v) => v.verdict.allowed).map((v) => v.call);
+      const sideEffects = new Map(
+        verdicts.flatMap(({ call, verdict }) => verdict.allowed && verdict.sideEffect ? [[call.id, verdict.sideEffect]] : [])
+      );
+      let denied = 0;
       for (const v of verdicts) {
         if (!v.verdict.allowed) {
-          log("warn", `tool call denied: ${v.call.function.name} \u2014 ${v.verdict.reason}`);
+          denied++;
+          log("warn", "turn.tool_call_denied");
+        }
+      }
+      if (turnCapDenied > 0) {
+        log("warn", "turn.turn_tool_calls_capped", {
+          seq: timing.seq,
+          iteration: iteration + 1,
+          denied: turnCapDenied
+        });
+      }
+      const deniedContent = (reason) => JSON.stringify({ error: "tool_call_denied", reason });
+      const minimalResultBytes = verdicts.map(({ call, verdict }) => messageBytes({
+        role: "tool",
+        content: verdict.allowed ? RESULT_BUDGET_EXCEEDED : deniedContent(verdict.reason),
+        tool_call_id: call.id
+      }));
+      const minimalTotal = minimalResultBytes.reduce((a, b) => a + b, 0);
+      if (requiredBytes + turnMessageBytes + minimalTotal > budgetBytes) {
+        if (iteration === 0) throw new PromptTooLargeError(false);
+        const unanswerable = turnMessages.pop();
+        turnMessageBytes -= messageBytes(unanswerable);
+        log("warn", "turn.final_without_tools", { seq: timing.seq, iteration: iteration + 1 });
+        let final;
+        try {
+          final = await callModel(iteration + 2, void 0);
+        } catch (error) {
+          if (error instanceof DailyLimitReachedError || isBudgetUnavailable(error) || error instanceof TurnAbandonedError || signal.aborted) throw error;
+          throw new PromptTooLargeError(false);
         }
+        if (!final.content) throw new PromptTooLargeError(false);
+        response = final.content;
+        break;
+      }
+      const toolTimings = [];
+      const toolsStartedAt = clock();
+      const executed = await runToolCalls(allowed, skills, {
+        roomId: m.channelId,
+        signal,
+        sideEffects,
+        clock,
+        onTiming: (t) => toolTimings.push(t)
+      });
+      live();
+      const toolsMs = ms(toolsStartedAt, clock());
+      const nameById = new Map(allowed.map((call) => [call.id, call.function.name]));
+      const indexById = new Map(result.toolCalls.map((call, index) => [call.id, index + 1]));
+      for (const t of toolTimings) {
+        const name = nameById.get(t.tool_call_id);
+        log("info", "turn.tool_call", {
+          seq: timing.seq,
+          iteration: iteration + 1,
+          index: indexById.get(t.tool_call_id) ?? 0,
+          tool: logLabel(name !== void 0 && offeredNames.has(name) ? name : "unoffered"),
+          ms: Math.max(0, Math.round(t.ms)),
+          ok: t.ok,
+          cancelled: t.cancelled
+        });
       }
-      const executed = await runToolCalls(allowed, skills, { roomId: m.channelId });
+      timing.toolMs += toolsMs;
+      timing.toolCalls += allowed.length;
+      timing.toolsDenied += denied;
       const byId = new Map(executed.map((r) => [r.tool_call_id, r]));
-      for (const { call, verdict } of verdicts) {
+      let resultsCut = 0;
+      let reserveAfter = minimalTotal;
+      const toolMessage = (id, content) => ({ role: "tool", content, tool_call_id: id });
+      const charged = (id, content) => {
+        const available = Math.min(
+          MAX_TOOL_RESULT_BYTES_PER_TURN - toolResultBytes,
+          budgetBytes - (requiredBytes + turnMessageBytes) - reserveAfter
+        );
+        const whole = toolMessage(id, content);
+        if (messageBytes(whole) <= available) {
+          toolResultBytes += messageBytes(whole);
+          return whole;
+        }
+        resultsCut++;
+        if (available >= MIN_TRUNCATED_TOOL_RESULT_BYTES) {
+          const cut = toolMessage(id, fitJsonString(
+            content,
+            (prefix) => JSON.stringify({ result: prefix, truncated: true }),
+            (candidate) => messageBytes(toolMessage(id, candidate)) <= available
+          ));
+          if (messageBytes(cut) <= available) {
+            toolResultBytes += messageBytes(cut);
+            return cut;
+          }
+        }
+        toolResultBytes = MAX_TOOL_RESULT_BYTES_PER_TURN;
+        return toolMessage(id, RESULT_BUDGET_EXCEEDED);
+      };
+      for (const [index, { call, verdict }] of verdicts.entries()) {
+        reserveAfter -= minimalResultBytes[index];
         if (verdict.allowed) {
           const done = byId.get(call.id);
           if (done) {
-            messages.push({ role: "tool", content: capResult(done.content), tool_call_id: done.tool_call_id });
+            pushTurnMessage(charged(done.tool_call_id, done.content));
             continue;
           }
-          messages.push({
+          pushTurnMessage({
             role: "tool",
             content: JSON.stringify({ error: "tool_call_no_result" }),
             tool_call_id: call.id
           });
           continue;
         }
-        messages.push({
+        pushTurnMessage({
           role: "tool",
-          content: JSON.stringify({ error: "tool_call_denied", reason: verdict.reason }),
+          content: deniedContent(verdict.reason),
           tool_call_id: call.id
         });
       }
+      if (resultsCut > 0) {
+        log("warn", "turn.tool_results_capped", {
+          seq: timing.seq,
+          iteration: iteration + 1,
+          results_cut: resultsCut,
+          result_bytes: toolResultBytes,
+          budget_bytes: MAX_TOOL_RESULT_BYTES_PER_TURN
+        });
+      }
+      log("info", "turn.iteration", {
+        seq: timing.seq,
+        iteration: iteration + 1,
+        ms: ms(iterationStart, clock()),
+        tool_calls: allowed.length,
+        tools_denied: denied,
+        tool_ms: toolsMs,
+        final: false
+      });
     }
+    live();
     if (!response) {
-      log("warn", `no final answer after ${maxIterations} iterations; dropping the turn`);
+      log("warn", "turn.no_final_answer", { iterations: maxIterations });
       return null;
     }
     memory.addMessage({ role: "assistant", content: response });
-    log("info", `response ready (chars=${response.length})`);
+    log("info", "turn.response_ready", { chars: response.length });
     return response;
-  };
+  }
 }
 
 // src/persona.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7, renameSync as renameSync2, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync9, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { dirname as dirname6, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/long-term-memory.ts
-import { createHash } from "node:crypto";
-import { chmodSync, existsSync as existsSync4, lstatSync, readFileSync as readFileSync6, readdirSync as readdirSync2, renameSync } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync4, lstatSync, readFileSync as readFileSync8, readdirSync as readdirSync2, renameSync as renameSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 var MEMORY_FILE = "MEMORY.md";
 var QUARANTINE_MEMORY_FILE = "MEMORY.quarantined.md";
@@ -2173,14 +4661,14 @@ function quarantineOrder(a, b) {
   return index(a) - index(b) || a.localeCompare(b);
 }
 function sourceId(kind, channelId, path, bytes) {
-  return createHash("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
+  return createHash2("sha256").update(kind).update("\0").update(channelId ?? "").update("\0").update(path).update("\0").update(bytes).digest("hex");
 }
 function readLegacySource(path, kind, contentBudget, channelId) {
   try {
     let st = lstatSync(path);
     if (st.isSymbolicLink() || !st.isFile()) return null;
     if ((st.mode & 511) !== 384) {
-      chmodSync(path, 384);
+      chmodSync2(path, 384);
       st = lstatSync(path);
     }
     if (st.size > LEGACY_MEMORY_SOURCE_MAX_BYTES) {
@@ -2196,7 +4684,7 @@ function readLegacySource(path, kind, contentBudget, channelId) {
       };
     }
     if (st.size > contentBudget) return null;
-    const bytes = readFileSync6(path);
+    const bytes = readFileSync8(path);
     if (bytes.byteLength > LEGACY_MEMORY_SOURCE_MAX_BYTES || bytes.byteLength > contentBudget) return null;
     return {
       id: sourceId(kind, channelId, path, bytes),
@@ -2281,7 +4769,7 @@ function legacyMemoryFingerprint(managedDir, dataDir) {
     }
   } catch {
   }
-  return createHash("sha256").update(metadata.join("\n")).digest("hex");
+  return createHash2("sha256").update(metadata.join("\n")).digest("hex");
 }
 function nextQuarantinePath(dir) {
   const first = join6(dir, QUARANTINE_MEMORY_FILE);
@@ -2300,8 +4788,8 @@ function quarantineLegacyMemory(managedDir, dataDir) {
       throw new Error(`refusing to quarantine symlinked legacy memory: ${source}`);
     }
     const target = nextQuarantinePath(dir);
-    renameSync(source, target);
-    chmodSync(target, 384);
+    renameSync2(source, target);
+    chmodSync2(target, 384);
     moved.push(target);
   }
   return moved;
@@ -2322,7 +4810,7 @@ var SAFETY_PREAMBLE = [
   "- Only use the tools you were given; do not invent capabilities."
 ].join("\n");
 function defaultPersonaDir() {
-  return join7(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
+  return join7(dirname6(fileURLToPath2(import.meta.url)), "..", "persona");
 }
 function assemblePrompt(parts) {
   return parts.map((p) => `${p.heading}
@@ -2335,13 +4823,13 @@ function loadPersona(dirs) {
     if (!path) continue;
     let body;
     try {
-      body = readFileSync7(path, "utf8");
-    } catch {
-      console.warn(`[persona] cannot read ${path}; ignoring it`);
+      body = readFileSync9(path, "utf8");
+    } catch (error) {
+      writeServiceLog("warn", "persona.read_failed", {}, error);
       continue;
     }
     if (Buffer.byteLength(body, "utf8") > PERSONA_MAX_BYTES) {
-      console.warn(`[persona] ${path} is larger than ${PERSONA_MAX_BYTES} bytes; truncating`);
+      writeServiceLog("warn", "persona.truncated", { max_bytes: PERSONA_MAX_BYTES });
       body = body.slice(0, PERSONA_MAX_BYTES);
     }
     const trimmed = body.trim();
@@ -2361,7 +4849,7 @@ function writeLocalConfigReport(managedDir, dataDir, now, flags) {
     const path2 = join7(dataDir, file);
     if (!existsSync5(path2)) continue;
     try {
-      persona[file] = readFileSync7(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
+      persona[file] = readFileSync9(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
     } catch {
     }
   }
@@ -2380,10 +4868,10 @@ function writeLocalConfigReport(managedDir, dataDir, now, flags) {
   try {
     writeFileSync(tmp, `${JSON.stringify(doc, null, 2)}
 `, { mode: 384 });
-    renameSync2(tmp, path);
+    renameSync3(tmp, path);
   } catch (e) {
     try {
-      unlinkSync(tmp);
+      unlinkSync2(tmp);
     } catch {
     }
     throw e;
@@ -2399,7 +4887,7 @@ function personaInit(dataDir, defaultsDir, writeFile, exists) {
       skipped.push(target);
       continue;
     }
-    writeFile(target, readFileSync7(join7(defaultsDir, file), "utf8"));
+    writeFile(target, readFileSync9(join7(defaultsDir, file), "utf8"));
     written.push(target);
   }
   return { written, skipped };
@@ -2431,32 +4919,33 @@ function installWarningFilter(proc = process) {
     proc.removeListener("warning", listener);
   }
   proc.on("warning", (w) => {
-    if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
-    console.error(w.stack ?? `${w.name}: ${w.message}`);
+    try {
+      if (w.name === "ExperimentalWarning" && /SQLite/i.test(w.message)) return;
+    } catch {
+    }
+    writeServiceLog("warn", "runtime.node_warning", {}, w);
   });
 }
 
 // src/index.ts
 if (process.argv.includes("--version")) {
-  const pkg = JSON.parse(readFileSync8(join8(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync10(join8(dirname7(dirname7(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
   console.log(pkg.version);
   process.exit(0);
 }
 var LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
 function makeLogger(cfg) {
   const floor = LEVEL_RANK[cfg.logLevel];
-  return (level, msg) => {
+  return (level, event, fields, error) => {
     if (LEVEL_RANK[level] < floor) return;
-    const line = `[runtime] ${level}: ${msg}`;
-    if (level === "warn" || level === "error") console.error(line);
-    else console.log(line);
+    writeServiceLog(level, event, fields, error);
   };
 }
 function realLlmSourceDeps() {
   return {
     home: homedir4(),
-    readFile: (p) => readFileSync8(p, "utf8"),
-    statFile: (p) => ({ mode: statSync2(p).mode }),
+    readFile: (p) => readFileSync10(p, "utf8"),
+    statFile: (p) => ({ mode: statSync3(p).mode }),
     exists: (p) => existsSync6(p)
   };
 }
@@ -2469,7 +4958,7 @@ function realServiceDeps() {
     },
     writeFile: (p, data) => writeFileSync2(p, data, { mode: 420 }),
     removeFile: (p) => rmSync(p, { force: true }),
-    mkdirp: (p) => mkdirSync(p, { recursive: true }),
+    mkdirp: (p) => mkdirSync4(p, { recursive: true }),
     fileExists: (p) => existsSync6(p),
     canRead: (p) => {
       try {
@@ -2566,6 +5055,46 @@ async function main() {
   installWarningFilter();
   const verb = parseVerb(process.argv);
   if (verb) runServiceVerb(verb);
+  const sideEffectsVerb = parseSideEffectsVerb(process.argv);
+  if (process.argv[2] === "side-effects" && !sideEffectsVerb) {
+    console.error("securecoms-agent: side-effects requires list or resolve");
+    process.exit(2);
+  }
+  if (sideEffectsVerb) {
+    let cfgForLedger;
+    try {
+      cfgForLedger = loadConfig(process.argv.slice(2), process.env);
+    } catch (e) {
+      console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+      process.exit(2);
+      return;
+    }
+    const ledger = new SideEffectLedger(join8(cfgForLedger.dataDir, "side-effect-ledger.sqlite"));
+    try {
+      if (sideEffectsVerb === "list") {
+        console.log(JSON.stringify({ ambiguous: ledger.listAmbiguous() }, null, 2));
+      } else {
+        const flags = parseSideEffectResolveFlags(process.argv);
+        if (!flags.idempotencyKey || !flags.operationSha256 || !/^[0-9a-f]{64}$/.test(flags.operationSha256) || !flags.confirmationId || !flags.outcome) {
+          throw new Error(
+            "resolve requires --idempotency-key, --operation-sha256, --confirmation-id, and --outcome completed|not_applied"
+          );
+        }
+        ledger.reconcile({
+          idempotency_key: flags.idempotencyKey,
+          operation_sha256: flags.operationSha256,
+          confirmation_id: flags.confirmationId
+        }, flags.outcome, /* @__PURE__ */ new Date());
+        console.log(JSON.stringify({ reconciled: true, outcome: flags.outcome }));
+      }
+    } catch (e) {
+      console.error(`securecoms-agent: side-effects ${sideEffectsVerb} failed: ${e instanceof Error ? e.message : String(e)}`);
+      process.exitCode = 1;
+    } finally {
+      ledger.close();
+    }
+    process.exit(process.exitCode ?? 0);
+  }
   const personaVerb = parsePersonaVerb(process.argv);
   if (personaVerb) {
     let cfgForPersona;
@@ -2577,7 +5106,7 @@ async function main() {
       return;
     }
     if (personaVerb === "init") {
-      mkdirSync(cfgForPersona.dataDir, { recursive: true });
+      mkdirSync4(cfgForPersona.dataDir, { recursive: true });
       const r = personaInit(
         cfgForPersona.dataDir,
         defaultPersonaDir(),
@@ -2600,12 +5129,36 @@ async function main() {
   try {
     cfg = loadConfig(process.argv.slice(2), process.env);
   } catch (e) {
-    console.error(`securecoms-agent: ${e instanceof Error ? e.message : String(e)}`);
+    const argv = process.argv.slice(2);
+    const hasIdentityArg = argv.some(
+      (arg, index) => arg === "--identity" && !!argv[index + 1] || arg.startsWith("--identity=") && arg.length > 11
+    );
+    writeServiceLog(
+      "error",
+      !hasIdentityArg && !process.env.SECURECOMS_IDENTITY ? "runtime.identity_required.use_--identity" : "runtime.config_invalid",
+      {},
+      e
+    );
     process.exit(2);
     return;
   }
   const log = makeLogger(cfg);
-  const llm = buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+  const budgetBase = join8(cfg.dataDir, `llm-budget-${cfg.identityId.replace(/[^A-Za-z0-9_-]/g, "_")}`);
+  const budgetOpts = {
+    callLimit: cfg.llmDailyCallLimit ?? DEFAULT_DAILY_CALL_LIMIT,
+    tokenLimit: cfg.llmDailyTokenLimit ?? DEFAULT_DAILY_TOKEN_LIMIT,
+    statePath: `${budgetBase}.json`,
+    lockPath: `${budgetBase}.lock`,
+    log
+  };
+  const budget = new DailyLlmBudget(budgetOpts);
+  process.once("exit", () => budget.close());
+  const refusal = budgetBootRefusal(budget, budgetOpts.tokenLimit, cfg.llmMaxOutputTokens, writeServiceLog);
+  if (refusal !== null) {
+    process.exit(refusal);
+    return;
+  }
+  const llm = withDailyBudget(buildLlmShim(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()), budget);
   const memories = /* @__PURE__ */ new Map();
   const memoryFor = (channelId) => {
     let mem = memories.get(channelId);
@@ -2629,18 +5182,29 @@ async function main() {
     const path = keyFilePath(which);
     if (!path) return null;
     try {
-      return readFileSync8(path, "utf8").trim() || null;
-    } catch {
-      log("warn", `cannot read the ${which} key file ${path}`);
+      return readFileSync10(path, "utf8").trim() || null;
+    } catch (e) {
+      log("warn", "runtime.search_key_unreadable", { provider_brave: which === "brave" }, e);
       return null;
     }
   };
   const configDirs = configSearchPath(cfg.identityId, cfg.dataDir);
-  const hasSearchKey = () => hasReadableKeyFile([keyFilePath("brave"), keyFilePath("tavily")], (p) => readFileSync8(p, "utf8"));
+  const reportSearchKeyGate = searchKeyGateReporter(log, (p) => p === keyFilePath("brave"));
+  const hasSearchKey = () => hasReadableKeyFile(
+    [keyFilePath("brave"), keyFilePath("tavily")],
+    (p) => readFileSync10(p, "utf8"),
+    reportSearchKeyGate
+  );
+  const reportLlmSourceUnresolved = failureEpisodeReporter(
+    (e) => log("warn", "runtime.llm_source_unresolved", {}, e)
+  );
   const hasLlmKey = () => {
     try {
-      return hasLlmKeyFor(resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps()));
-    } catch {
+      const source = resolveLlmSource(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps());
+      reportLlmSourceUnresolved.succeeded();
+      return hasLlmKeyFor(source);
+    } catch (e) {
+      reportLlmSourceUnresolved.failed(e);
       return false;
     }
   };
@@ -2659,7 +5223,8 @@ async function main() {
     now: () => /* @__PURE__ */ new Date(),
     log
   };
-  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx);
+  const sideEffectLedger = new SideEffectLedger(join8(cfg.dataDir, "side-effect-ledger.sqlite"));
+  const skills = new SkillInvoker(cfg.skillsDir, builtinCtx, sideEffectLedger);
   skills.loadSkills();
   const policyFor = () => resolveToolPolicy(cfg.toolGateEnv, currentSkillsConfig().tools, {
     default: cfg.toolGate.default,
@@ -2673,11 +5238,16 @@ async function main() {
     reportLocalConfig({ hasSearchKey: searchKey, hasLlmKey: hasLlmKey() });
     return skills.available(requiresEnvFrom(sc, searchKey)).filter((t) => g.gate(t.function.name).allowed);
   };
-  for (const held of skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey()))) {
-    console.log(`unavailable: ${held.name} (missing ${held.missing.join(", ")})`);
-  }
+  const unavailableCount = skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey())).length;
+  if (unavailableCount > 0) log("info", "runtime.skills_unavailable", { count: unavailableCount });
   const plane = createSecureComsDataPlane(
-    { identityId: cfg.identityId, log: (level, msg) => log(level, msg) },
+    // Final-wave I2: the daily-limit reply is a notice, not an agent turn.
+    // SEC-06 #9: so are the fixed size-limit replies.
+    {
+      identityId: cfg.identityId,
+      log,
+      noticeReplies: /* @__PURE__ */ new Set([DAILY_LIMIT_RESPONSE, MESSAGE_TOO_LARGE_RESPONSE, TURN_TOO_LARGE_RESPONSE])
+    },
     buildHandler({
       llm,
       memoryFor,
@@ -2688,19 +5258,42 @@ async function main() {
       // or configuration saved in the web app takes effect on the next message,
       // with no restart.
       systemPromptFor: () => systemPromptFor(configDirs, DEFAULT_SYSTEM_PROMPT),
-      tools: installationEligibleTools
+      tools: installationEligibleTools,
+      // SEC-06 #6: more abandoned turns still running than there are slots
+      // means something inside a turn ignores cancellation. Exit, so launchd
+      // (KeepAlive) / systemd (Restart=always) starts a clean process; the
+      // daemon redelivers what was in flight.
+      // #694 F2: first let the turns still working on other channels finish
+      // and send their replies (the handler starts nothing new meanwhile),
+      // then shut down as SIGTERM does.
+      onWedged: (drained) => {
+        log("error", "runtime.wedged_draining");
+        void drained.then(() => {
+          setImmediate(() => {
+            log("error", "runtime.wedged_exit");
+            plane.stop();
+            sideEffectLedger.close();
+            process.exit(1);
+          });
+        });
+      }
     })
   );
-  console.log(
-    `${bootLine(cfg, isExplicitSource(cfg, process.env), realLlmSourceDeps())}, ${installationEligibleTools().length} configured skills (channel grant required), tool gate default=${cfg.toolGate.default}`
-  );
+  log("info", "runtime.started", {
+    configured_skills: installationEligibleTools().length,
+    tool_gate_default_deny: cfg.toolGate.default === "deny"
+  });
   await plane.start();
   const shutdown = () => {
-    log("info", "shutting down");
+    log("info", "runtime.shutting_down");
     plane.stop();
+    sideEffectLedger.close();
     process.exit(0);
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 }
-void main();
+void main().catch((error) => {
+  writeServiceLog("error", "runtime.fatal", {}, error);
+  process.exit(1);
+});