@stratusagent/gateway 0.14.8 → 0.14.10

package/dist/index.js

@@ -7,17 +7,24 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash, randomUUID } from 'node:crypto';
-import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, InMemorySessionStore, MEMORY_PASS_MAX_MODEL_CALLS, MEMORY_PASS_RULES, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, PENDING_APPROVAL_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, resolveToolRisk, } from '@stratusagent/core';
-import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, createForgetTool, createPinTool, createMessageSendTool, createMessageSayTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
+import { filePathsOf, postOf, isUnaddressedTurn, carriesKey, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, sessionWriteTrust, AgentRegistry, AgentRunner, InMemorySessionStore, MEMORY_PASS_MAX_MODEL_CALLS, MEMORY_PASS_RULES, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, SESSION_TRUST_METADATA_KEY, latestTurnReply, conversationContextFrom, STRATUS_SKILL_ID, } from '@stratusagent/core';
+import { CREDENTIAL_REQUEST_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageSayTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_SESSION_ID_MARKER, loadStratusSkill, STRATUS_SKILL_PATH, } from '@stratusagent/agents';
+import { createApprovalBroker } from "./approvals.js";
+import { createCredentialRequests } from "./credential-requests.js";
+import { createDispatch } from "./dispatch.js";
 import { createFleetReader } from "./fleet.js";
 import { createMemoryPassHost } from "./memory-passes.js";
+import { createRecovery } from "./recovery.js";
 import { callShownWhole, readReviewReply, REVIEW_RULES, reviewCaseText } from "./review.js";
 import { createEventIntake, summarizeEvents, } from "./event-intake.js";
 import { SqliteEventStore } from "./events.js";
 import { createSchedulerRuntime, isScheduleSessionId, SqliteScheduleStore, SCHEDULE_SESSION_ID_PREFIX, } from "./schedules.js";
 import { ShardedSessionStore } from "./sessions.js";
-import { DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS, DEFAULT_PAUSED_MESSAGE, DEFAULT_RESTART_DRAIN_TIMEOUT_MS, DEFAULT_STOP_DRAIN_TIMEOUT_MS, GatewayStoppingError, HELD_MESSAGE, IntakePausedError, MAX_PAUSED_MESSAGE_LENGTH, PauseMessageError, readIntakeState, RESTARTING_TURN_ERROR, RestartUnsupportedError, STOPPING_TURN_ERROR, writeIntakeState, } from "./lifecycle.js";
-import { ABANDONED_TURN_ERROR, crossIdentityError, CrossIdentityError, DEFAULT_SUB_AGENTS_PER_TURN, EXECUTOR_METADATA_KEY, isSubAgentSession, ORPHANED_DELEGATION_ERROR, RESERVED_SESSION_METADATA_KEYS, reservedSessionMetadataKey, ROLLED_OVER_FROM_METADATA_KEY, ROLLED_OVER_SESSION_ID_MARKER, ROLLED_OVER_TO_METADATA_KEY, ROLLOVER_REPEAT_WINDOW_MS, SUB_AGENT_METADATA_KEY, SUB_AGENT_SESSION_ID_MARKER, subAgentNeverGets, } from "./session-keys.js";
+import { createSubAgents } from "./sub-agents.js";
+import { createSteering } from "./steering.js";
+import { createTurnDispatch } from "./turn-dispatch.js";
+import { DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS, DEFAULT_RESTART_DRAIN_TIMEOUT_MS, DEFAULT_STOP_DRAIN_TIMEOUT_MS, GatewayStoppingError, MAX_PAUSED_MESSAGE_LENGTH, PauseMessageError, readIntakeState, RESTARTING_TURN_ERROR, RestartUnsupportedError, STOPPING_TURN_ERROR, writeIntakeState, } from "./lifecycle.js";
+import { crossIdentityError, isSubAgentSession, RESERVED_SESSION_METADATA_KEYS, reservedSessionMetadataKey, ROLLED_OVER_FROM_METADATA_KEY, ROLLED_OVER_SESSION_ID_MARKER, ROLLED_OVER_TO_METADATA_KEY, SUB_AGENT_SESSION_ID_MARKER, } from "./session-keys.js";
 export { claimHome, homeLockPath, HomeClaimedError, } from "./lock.js";
 export { SqliteSessionStore, ShardedSessionStore, FleetSessionIndex, SessionIdTakenError, tightenSqliteFile, } from "./sessions.js";
 export { SqliteScheduleStore, createSchedulerRuntime, isScheduleSessionId, SCHEDULE_SESSION_ID_PREFIX, } from "./schedules.js";
@@ -29,7 +36,7 @@ export { REVIEW_RULES, readReviewReply, reviewCaseText } from "./review.js";
 export { createEventIntake, mapGithubDelivery, parseStandardWebhookEvent, verifyGithubSignature, verifyStandardWebhookSignature, DEFAULT_EVENT_MAX_BODY_BYTES, EVENT_SOURCE_REQUESTS_PER_MINUTE, } from "./event-intake.js";
 import { createLocalCommandExecutor } from '@stratusagent/executor-local';
 import { loadPlugins, } from '@stratusagent/plugins';
-import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, credentialValuesFor, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, grantSoulCredential, withSoulFileLock, addNamedCredential, appendCredentialAudit, replaceNamedCredential, NamedCredentialMissingError, namedCredentialSource, NamedCredentialExistsError, CREDENTIAL_NAME_PATTERN, quoteShellArg, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, unlistedToolsFor, stratusHomePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, } from '@stratusagent/state';
+import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, credentialValuesFor, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, withSoulFileLock, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, unlistedToolsFor, stratusHomePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, } from '@stratusagent/state';
 const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 /**
  * How long a parked call waits for a person. Long enough to survive a
@@ -53,75 +60,6 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647;
  * question even when the rule answering it is not gateway code.
  */
 export { applySoulPins } from '@stratusagent/state';
-/**
- * The most text one merged user message may hold (card 423). The runner's
- * overflow recovery can drop earlier transcript but never part of the
- * newest message, so a batch must not grow that message past what one
- * message could be on its own: this is Slack's own message-length limit.
- * A single message longer than this still runs, alone, as it would have
- * without merging.
- */
-const MERGED_TEXT_BUDGET_CHARS = 40_000;
-/** Separator between merged messages; counted against the text budget. */
-const MERGED_SEPARATOR = '\n\n';
-/**
- * Whether `images` all fit the replay budget together. A merged turn's
- * images are one message's, and the runner empties whatever falls outside
- * the budget before the provider sees it, so a batch that would overflow
- * must not take the message that overflows it (card 423).
- */
-const fitsReplayBudget = (images) => images.length === 0 || imagesWithinReplayBudget([{ id: '', createdAt: '', role: 'user', content: '', images: [...images] }]).size === images.length;
-/** A signal that aborts once every one of `signals` has. */
-const allAborted = (signals) => joinableSignal(signals).signal;
-/**
- * `allAborted` for callers that keep joining: a turn that takes in messages
- * at its tool steps (card 948) is cancelled only once every caller in it
- * is, the ones who joined late included. A caller joining with no signal
- * can never cancel, so from then on neither can the turn.
- */
-const joinableSignal = (initial) => {
-    const controller = new AbortController();
-    const signals = [...initial];
-    let uncancellable = false;
-    const check = () => {
-        if (!uncancellable && !controller.signal.aborted && signals.every((signal) => signal.aborted)) {
-            controller.abort(signals[signals.length - 1]?.reason);
-        }
-    };
-    for (const signal of signals) {
-        signal.addEventListener('abort', check, { once: true });
-    }
-    check();
-    return {
-        signal: controller.signal,
-        join: (signal) => {
-            if (signal === undefined) {
-                uncancellable = true;
-                return;
-            }
-            signals.push(signal);
-            signal.addEventListener('abort', check, { once: true });
-        },
-    };
-};
-/**
- * A value from a form, without the line breaks around it.
- *
- * Forms take multi-line values now, so a one-line key copied with the line
- * break after it would otherwise be stored with it, and fail later inside
- * whatever header or command it lands in. Only line breaks: a value's own
- * spaces are its own, as on the CLI.
- */
-const formCredentialValue = (value) => value.replace(/^[\r\n]+|[\r\n]+$/g, '');
-/**
- * A PEM block (a private key, a certificate) with no line breaks left, which
- * is what a one-line field makes of a pasted key file. PEM readers need the
- * line after the `-----BEGIN …-----` header, so storing it would only move
- * the failure to the first call that reads the key. Only a value that *is*
- * one: a PEM inside JSON (a service account file) escapes its line breaks,
- * so it has none of its own and is fine as sent.
- */
-const isFlattenedPem = (value) => /^\s*-----BEGIN [A-Z0-9 ]+-----/.test(value) && !value.includes('\n');
 /**
  * The always-on Stratus process. One gateway holds the roster, the durable
  * session store, the shared event bus, and a pool of runners keyed by
@@ -209,6 +147,7 @@ export const createGateway = (options = {}) => {
     if (Object.keys(eventSources).length > 0) {
         openEvents();
     }
+    const startedChannels = [];
     /**
      * The started adapter of one kind that speaks for an agent and has the
      * capability asked for. `carriesOthers` says there were capable adapters
@@ -316,307 +255,15 @@ export const createGateway = (options = {}) => {
     if (approvalTimeoutMs > MAX_TIMER_DELAY_MS) {
         warn(`approval timeout ${approvalTimeoutMs}ms is above Node's maximum timer delay; using ${MAX_TIMER_DELAY_MS}ms (~24.8 days)`);
     }
-    const pendingApprovals = new Map();
-    /**
-     * In-flight `tool.approval-resolved` emissions. `EventBus.emit` awaits its
-     * subscribers in order, so one async handler ahead of a channel adapter
-     * suspends the emission before the adapter ever sees it. Nothing today is
-     * async in front of one — which is exactly the problem: the shutdown
-     * guarantee below would rest on that staying true, and the first async
-     * subscriber anyone adds would silently leave live-looking buttons in a
-     * workspace the daemon has left.
-     */
-    const approvalEmissions = new Set();
-    /**
-     * Publishes one parked call and settles when somebody answers it, the
-     * request expires, or the turn is cancelled.
-     *
-     * All three endings run through the same `settle`, which removes the
-     * request from the registry BEFORE resolving. That ordering is the whole
-     * point: a request that is no longer pending cannot be resolved twice,
-     * so a click racing the timeout — or arriving after an abort — is refused
-     * rather than executing a tool for a turn that has already moved on.
-     */
-    /**
-     * The conversation a delegated sub-session's work was asked from, read
-     * from the store rather than from anything the caller wrote: the root
-     * session `agent.delegate` recorded, which is where the person waiting
-     * on the answer is. Undefined for an ordinary session, or a root that no
-     * longer exists — the request is then asked the way it always was.
-     */
-    const delegationOriginOf = async (session) => {
-        if (!isDelegatedSession(session)) {
-            return undefined;
-        }
-        const rootId = session.metadata?.[ROOT_SESSION_ID_METADATA_KEY];
-        if (typeof rootId !== 'string' || rootId === session.id) {
-            return undefined;
-        }
-        let root;
-        try {
-            root = await store.get(rootId);
-        }
-        catch (error) {
-            warn(`${session.id}: could not read the delegating session ${rootId} to route an approval (${error instanceof Error ? error.message : String(error)})`);
-            return undefined;
-        }
-        if (!root) {
-            return undefined;
-        }
-        return { agentId: root.agent.id, sessionId: root.id, ...(root.metadata ? { metadata: root.metadata } : {}) };
-    };
-    /**
-     * Which sessions are sub-agents, as the host knows it rather than as the
-     * session says (roadmap 24). Every tool in a slice is handed the same
-     * mutable Session, so the metadata marker and the id are claims a tool
-     * can rewrite. The ids are the ones `subAgents.run` minted, held while
-     * the sub-agent runs. A session object's id is read once, by the
-     * executor on its first tool call, before any tool has been handed it,
-     * so a session a tool renamed is still known by the id it ran under.
-     */
-    const liveSubAgentIds = new Set();
-    const idAtFirstCall = new WeakMap();
-    const hostIdOf = (session) => idAtFirstCall.get(session) ?? session.id;
-    const isHostSubAgent = (session) => liveSubAgentIds.has(hostIdOf(session)) || isSubAgentSession(session);
-    const requestApproval = async (request) => {
-        // A sub-agent asks no one (roadmap 24): its parent turn is the one a
-        // person is accountable for, and that turn gets the refusal back as a
-        // result and decides what to do. Denied as undeliverable, since nobody
-        // was asked, and announced only as a resolution, so no channel renders
-        // a question nobody may answer.
-        if (isHostSubAgent(request.session)) {
-            void bus.emit({
-                type: 'tool.approval-resolved',
-                sessionId: request.session.id,
-                requestId: randomUUID(),
-                answer: 'deny',
-                reason: 'undeliverable',
-            });
-            return { answer: 'deny' };
-        }
-        const delegatedFrom = await delegationOriginOf(request.session);
-        return requestApprovalFrom(request, delegatedFrom);
-    };
-    const requestApprovalFrom = (request, delegatedFrom) => new Promise((resolve) => {
-        // A shutdown denies what is parked once, at the top of stop(). Turns
-        // already running keep going through the drain, though, and one of them
-        // can reach a gated tool AFTER that snapshot — finishing a provider
-        // call, or moving to the next call in the same response. Parking it
-        // would deadlock the drain against a question nobody is left to answer:
-        // stop() waits for the turn, the turn waits for the approval, and the
-        // approval waits out its timeout — forever when there is none.
-        if (stopping) {
-            resolve({ answer: 'deny' });
-            void bus.emit({
-                type: 'tool.approval-resolved',
-                sessionId: request.session.id,
-                requestId: randomUUID(),
-                answer: 'deny',
-                reason: 'cancelled',
-            });
-            return;
-        }
-        const requestId = randomUUID();
-        let timer;
-        const onAbort = () => settle('deny', 'cancelled');
-        /**
-         * Settles once the request has finished being announced.
-         *
-         * Both emissions go through the same subscriber list, in order, and
-         * `EventBus.emit` awaits each one — so an async subscriber ahead of a
-         * channel can hold the announcement while a timeout or abort fires
-         * behind it, and the channel would hear that a request it has never
-         * heard of was resolved. It drops that, then renders the announcement
-         * when it finally arrives, leaving buttons for a settled request that
-         * nothing will ever retract.
-         *
-         * Chaining is the fix rather than remembering orphaned resolutions in
-         * the channel: a resolution that arrives before its request is not
-         * something a consumer can act on, so it should not be able to happen.
-         * Starts resolved, because a turn already aborted never announces at
-         * all and its denial should not wait on an emission that never runs.
-         */
-        let announced = Promise.resolve();
-        // Read when the request is made, from the scheduler's own records: a
-        // live firing of a schedule approved with a destination, nothing else.
-        // Delegated work is not included yet; its sub-session is not a firing.
-        const scheduleDestination = scheduler.approvalDestinationFor(request.session);
-        // Work one agent does for another is allowed one call at a time. The
-        // people asked are the delegating conversation's, and a standing grant
-        // would widen what the other agent may do on its own work for good —
-        // so nothing offers **Always allow** here, and an `always` that
-        // arrives anyway (the control API takes all three answers) runs the
-        // call once, recorded as exactly that.
-        const forAnotherAgent = delegatedFrom !== undefined && delegatedFrom.agentId !== request.session.agent.id;
-        const oneShot = request.oneShot === true || forAnotherAgent;
-        const always = forAnotherAgent ? undefined : request.always;
-        const settle = (given, reason, actor) => {
-            const answer = forAnotherAgent && given === 'always' ? 'once' : given;
-            // Identity, not presence: a request that already settled is gone from
-            // the registry, and comparing against this exact function is what
-            // makes every ending — click, timeout, abort, shutdown — idempotent.
-            if (pendingApprovals.get(requestId)?.settle !== settle) {
-                return;
-            }
-            pendingApprovals.delete(requestId);
-            if (timer) {
-                clearTimeout(timer);
-            }
-            request.signal?.removeEventListener('abort', onAbort);
-            resolve({ answer, ...(actor ? { actor } : {}) });
-            const emitted = announced.then(() => bus.emit({
-                type: 'tool.approval-resolved',
-                sessionId: request.session.id,
-                requestId,
-                answer,
-                reason,
-                ...(actor ? { actor } : {}),
-            }));
-            approvalEmissions.add(emitted);
-            void emitted.finally(() => approvalEmissions.delete(emitted));
-        };
-        // What is left of the window, not a fresh one: a re-asked request
-        // carries when it originally parked, and the elapsed time counts.
-        // Computed before registration because the summary below quotes the
-        // deadline, and a listing that disagreed with the announcing event about
-        // when a request expires would be worse than one that said nothing.
-        const alreadyWaitedMs = request.parkedAt ? Date.now() - Date.parse(request.parkedAt) : 0;
-        const remainingTimeoutMs = effectiveApprovalTimeoutMs > 0
-            ? effectiveApprovalTimeoutMs - (Number.isFinite(alreadyWaitedMs) ? Math.max(0, alreadyWaitedMs) : 0)
-            : 0;
-        const expiresAt = remainingTimeoutMs > 0
-            ? new Date(Date.now() + remainingTimeoutMs).toISOString()
-            : undefined;
-        pendingApprovals.set(requestId, {
-            settle,
-            pending: {
-                requestId,
-                sessionId: request.session.id,
-                agentId: request.session.agent.id,
-                call: request.call,
-                risk: request.risk,
-                ...(request.origin !== undefined ? { origin: request.origin } : {}),
-                ...(oneShot ? { oneShot: true } : {}),
-                ...(always !== undefined ? { always } : {}),
-                ...(request.reviewNote !== undefined ? { reviewNote: request.reviewNote } : {}),
-                parkedAt: request.parkedAt ?? new Date().toISOString(),
-                ...(expiresAt ? { expiresAt } : {}),
-                ...(request.session.metadata ? { metadata: request.session.metadata } : {}),
-                ...(delegatedFrom ? { delegatedFrom } : {}),
-                ...(scheduleDestination ? { scheduleDestination } : {}),
-            },
-        });
-        if (effectiveApprovalTimeoutMs > 0 && remainingTimeoutMs <= 0) {
-            // Nothing left to wait with. Settled here rather than armed with a
-            // zero timer, which `setTimeout` would still run a tick later — long
-            // enough to announce a request that is already over.
-            settle('deny', 'timeout');
-            return;
-        }
-        if (remainingTimeoutMs > 0) {
-            // Deliberately NOT unref'd. A parked turn is real outstanding work,
-            // and its timer is the only thing that will ever finish it — letting
-            // the process exit out from under one would abandon the turn instead
-            // of denying it. Shutdown is handled where it belongs, in stop(),
-            // which settles every outstanding request before draining.
-            timer = setTimeout(() => settle('deny', 'timeout'), remainingTimeoutMs);
-        }
-        // The abort listener is attached before the request is announced, so a
-        // turn cancelled while the event is still being delivered still ends
-        // the request rather than leaving it pending forever.
-        if (request.signal) {
-            if (request.signal.aborted) {
-                settle('deny', 'cancelled');
-                return;
-            }
-            request.signal.addEventListener('abort', onAbort, { once: true });
-        }
-        // `announced` is assigned BEFORE the emission starts, because emit runs
-        // its first subscribers synchronously — one of them settling the
-        // request inline would otherwise chain onto the already-resolved
-        // placeholder and race the very announcement it is answering.
-        let markAnnounced = () => { };
-        announced = new Promise((resolveAnnounced) => {
-            markAnnounced = resolveAnnounced;
-        });
-        const announcing = bus.emit({
-            type: 'tool.approval-requested',
-            sessionId: request.session.id,
-            agentId: request.session.agent.id,
-            requestId,
-            call: request.call,
-            risk: request.risk,
-            ...(request.origin !== undefined ? { origin: request.origin } : {}),
-            ...(oneShot ? { oneShot: true } : {}),
-            ...(always !== undefined ? { always } : {}),
-            ...(request.reviewNote !== undefined ? { reviewNote: request.reviewNote } : {}),
-            ...(request.session.metadata ? { metadata: request.session.metadata } : {}),
-            ...(delegatedFrom ? { delegatedFrom } : {}),
-            ...(scheduleDestination ? { scheduleDestination } : {}),
-            ...(expiresAt ? { expiresAt } : {}),
-        });
-        // Drained at shutdown alongside the resolutions: a channel that has not
-        // yet been told a request exists cannot be told it was denied either.
-        approvalEmissions.add(announcing);
-        void announcing.finally(() => {
-            approvalEmissions.delete(announcing);
-            markAnnounced();
-        });
+    // `stopping` is read late: it is declared further down, with shutdown.
+    const { pendingApprovals, approvalEmissions, liveSubAgentIds, idAtFirstCall, hostIdOf, isHostSubAgent, requestApproval, resolveApproval, suspendWatchdog, approvalWaits, holdApprovalWait, } = createApprovalBroker({
+        warn,
+        bus,
+        store,
+        scheduler,
+        effectiveApprovalTimeoutMs,
+        isStopping: () => stopping,
     });
-    const resolveApproval = (input) => {
-        const parked = pendingApprovals.get(input.requestId);
-        if (!parked) {
-            return false;
-        }
-        parked.settle(input.answer, input.reason ?? 'decided', input.actor);
-        return true;
-    };
-    /**
-     * How a turn's watchdog stops its own clock, registered while it runs.
-     *
-     * Recording that a tool phase is open is not enough on its own: the
-     * timer is only re-evaluated when an event arrives, so a phase opened by
-     * something that emits nothing — an approval policy handed straight to
-     * the gateway — would leave an already-armed timer running to fire
-     * mid-wait.
-     */
-    const suspendWatchdog = new Map();
-    /**
-     * Approval waits in progress, per session.
-     *
-     * Deliberately a balanced counter and not a set of call ids. An earlier
-     * shape had the approval wrapper *open* a phase that the watchdog's
-     * event observer was expected to close, and that handoff was wrong in
-     * every way it could be: the observer does not exist when no watchdog is
-     * armed, so nothing closed it; a policy that threw closed nothing; and a
-     * stale entry did not merely leak, it suppressed the watchdog for the
-     * next turn on that session. Four separate exits, each patched in turn.
-     *
-     * A counter incremented and decremented in one `finally` cannot have any
-     * of those bugs, because the thing that opens the phase is the thing
-     * that closes it, in the same scope, on every path out.
-     */
-    const approvalWaits = new Map();
-    const holdApprovalWait = (sessionId) => {
-        approvalWaits.set(sessionId, (approvalWaits.get(sessionId) ?? 0) + 1);
-        // Stop any clock already running: this wait produces no events, so
-        // nothing else would.
-        suspendWatchdog.get(sessionId)?.();
-        let released = false;
-        return () => {
-            if (released) {
-                return;
-            }
-            released = true;
-            const remaining = (approvalWaits.get(sessionId) ?? 1) - 1;
-            if (remaining > 0) {
-                approvalWaits.set(sessionId, remaining);
-            }
-            else {
-                approvalWaits.delete(sessionId);
-            }
-        };
-    };
     const configuredApprovals = typeof options.approvals === 'function'
         ? options.approvals({
             request: requestApproval,
@@ -1396,823 +1043,185 @@ export const createGateway = (options = {}) => {
             return own !== undefined && own === source.to ? undefined : directMessageReadRefusal(`${source.channel}:${source.to}`);
         },
     }));
+    const { provideCredential } = createCredentialRequests({
+        env,
+        warn,
+        bus,
+        startedChannels,
+        channelCarrying,
+        registry,
+        sources,
+        unlistedTools,
+        tools,
+    });
+    // dispatchInternal and onSessionChain are declared further down: late-bound.
+    const { bindToolCalls, subAgents } = createSubAgents({
+        options,
+        store,
+        registry,
+        unlistedTools,
+        tools,
+        dispatchInternal: (...args) => dispatchInternal(...args),
+        onSessionChain: (...args) => onSessionChain(...args),
+        liveSubAgentIds,
+        idAtFirstCall,
+        hostIdOf,
+        isHostSubAgent,
+    });
+    const runners = new Map();
+    // Every provider-construction input participates in the key — model,
+    // endpoint, credentials, system prompt, fallback config. A rotated
+    // credential therefore resolves to a NEW runner on the next dispatch
+    // instead of silently reusing a provider built with the old secret.
+    // (Hashed so raw secrets never sit in a map key; the soul is excluded
+    // because provider construction ignores it.)
+    const runnerKeyFor = (config) => {
+        const { soul: _soul, soulPath: _soulPath, fetch: _fetch, ...providerInputs } = config;
+        return createHash('sha256').update(JSON.stringify(providerInputs)).digest('hex');
+    };
+    // A sub-agent's runner has no memory store, so no turn of it injects or
+    // reads the agent's memory; no skill catalog, so its prompt is its
+    // instruction and its tools; and grants nothing to every agent, since
+    // the credential request asks a person.
+    const runnerFor = (config, agentId, subAgent = false) => {
+        // The budget is a provider-construction input too (the harness
+        // runtimes take it as their inner limit), so it is part of the key:
+        // two agents on one model with different budgets get their own runners.
+        const maxTurns = options.maxTurnsFor?.(agentId) ?? options.maxTurns;
+        const autoContinue = options.autoContinueFor?.(agentId);
+        const key = `${runnerKeyFor(config)}:${maxTurns ?? 'default'}:${autoContinue ?? 'off'}${subAgent ? ':sub' : ''}`;
+        const existing = runners.get(key);
+        if (existing) {
+            return existing;
+        }
+        // The Claude Code runtime executes kernel tools by calling back into
+        // the runner built just below — late-bound because the runner needs
+        // the provider first.
+        let hostedRunner;
+        const provider = createRuntimeProvider(config, (error) => warn(`default model failed (${error instanceof Error ? error.message : String(error)}); using the fallback model`), async (session, call, context) => {
+            if (!hostedRunner) {
+                throw new Error('The Stratus runtime is not ready to execute tools yet.');
+            }
+            return hostedRunner.executeHostedToolCall(session, call, context);
+        }, maxTurns, 
+        // The sticky-fallback switch is durable the moment it happens, not
+        // when the turn's next save lands — a daemon killed mid-fallback
+        // must not retry the primary on restart.
+        (session) => store.save(session), providerContributions);
+        const runner = new AgentRunner({
+            provider,
+            tools,
+            // Runners are built on dispatch, after the plugins loaded and the
+            // selection below ran, so a contributed executor is in place for
+            // the first turn.
+            executor: bindToolCalls(selectedExecutor ?? createLocalCommandExecutor()),
+            ...(approvals ? { approvals } : {}),
+            store,
+            bus,
+            agents: registry,
+            // Asking a person for a key is harmless to grant: they decide
+            // everything after the question, so no soul has to list it.
+            grantedToEveryAgent: subAgent ? [] : [CREDENTIAL_REQUEST_TOOL_NAME],
+            unlistedTools: unlistedTools(),
+            ...(subAgent ? {} : { skills: skillCatalog, memory }),
+            streaming: true,
+            ...(maxTurns !== undefined ? { maxTurns } : {}),
+            ...(autoContinue !== undefined
+                ? { autoContinue, waitingInput: (sessionId) => (waitingDispatches.get(sessionId) ?? 0) > 0 }
+                : {}),
+            providerCallGuards,
+        });
+        hostedRunner = runner;
+        runners.set(key, runner);
+        return runner;
+    };
     /**
-     * Credential requests waiting on a person, by request id.
+     * The runner that hears and never speaks. `observe` runs no turn, so it
+     * needs no provider — and resolving one anyway would refuse an overhear
+     * whenever the agent's runtime cannot currently be built: credentials
+     * missing after a restart, a sign-in that lapsed. That is precisely the
+     * window in which the agent cannot answer and the thread carries on
+     * without it, so it is the window in which hearing matters most, and
+     * what it heard is there once the configuration is repaired.
      *
-     * In memory on purpose: a request is a question somebody is being asked
-     * now, and a restart that forgot it only means the agent asks again. What
-     * matters is that the entry carries everything the answer needs, so a
-     * channel quoting the id back decides nothing about where the key goes.
+     * A runner rather than a store write, because the label a speaker
+     * lowers the session to is the runner's rule and there is one
+     * implementation of it. Same store and bus as every speaking runner, so
+     * a message it appends is the message the next turn reads, and its
+     * event goes where every other event goes.
      */
-    const credentialRequests = new Map();
-    tools.register(createCredentialRequestTool(async (request, session) => {
-        const agentId = session.agent.id;
-        const soulPath = sources.get(agentId)?.soulPath;
-        if (soulPath === undefined) {
-            throw new Error(`${session.agent.name} is the built-in agent and has no soul file to grant a credential in. `
-                + `Your operator can store one on the machine with \`stratus credential set ${request.name}\`.`);
-        }
-        if (!CREDENTIAL_NAME_PATTERN.test(request.name)) {
-            throw new Error(`${JSON.stringify(request.name)} is not a credential name. Use letters, digits, dots, dashes, or underscores, `
-                + 'starting with a letter, the way the tool that needs it spells it: search.apiKey, github.token.');
-        }
-        // The stricter rule, for a name the model picked: checked before anyone
-        // is asked, so an approver never sees a form whose binding the store
-        // would refuse, and so a variable that changes what a judged command
-        // does (NODE_OPTIONS) is never offered at all.
-        if (request.env !== undefined) {
-            const problem = credentialVariableProblem(request.env, { requested: true });
-            if (problem !== undefined) {
-                throw new Error(`${problem} Nothing is pending.`);
-            }
-        }
-        // A key already stored is not something to ask a person for again: the
-        // form only adds, so it could only fail. Say what is actually missing.
-        const source = await namedCredentialSource(env, agentId, request.name);
-        const stored = source !== undefined;
-        const granted = session.agent.credentials?.includes(request.name) === true;
-        // Binding a key the agent already holds asks for no value, and every
-        // form today has a value field, so phase 1 leaves it to the machine.
-        const bindOnMachine = request.env !== undefined
-            ? ` To have your shell read it as ${request.env}, ask your operator to run \`stratus credential env ${request.name} ${request.env} --agent ${quoteShellArg(agentId)}\` on the machine.`
-            : '';
-        if (request.replace === true) {
-            // Checked here, before anyone is asked, so an approver is never shown
-            // a form whose answer could only be refused.
-            if (!stored || !granted) {
-                throw new Error(`You don't hold ${request.name}, so there is nothing to replace. Ask for it without replace.`);
-            }
-            if (source === 'environment') {
-                throw new Error(`${request.name} comes from the daemon's environment, which a form can't change. `
-                    + 'Ask your operator to change it where that environment is set.');
-            }
-            if (source === 'shared' && request.scope !== 'shared') {
-                throw new Error(`${request.name} is a shared credential, so replacing it changes the key for every agent granted it. `
-                    + 'Ask again with scope "shared" if that is what you mean.');
+    const observer = new AgentRunner({
+        provider: {
+            name: 'observer',
+            async generate() {
+                throw new Error('The observing runner never runs a turn.');
+            },
+        },
+        store,
+        bus,
+    });
+    // ---- watchdog -----------------------------------------------------------
+    /**
+     * True when this configuration's provider actually emits deltas: the
+     * Anthropic API path streams; the Claude Code runtime, OpenAI-compatible
+     * adapters, and the demo provider resolve in one piece. An activity
+     * watchdog is only honest where activity signals exist — for
+     * non-streaming providers the idle timer would be a wall-clock timeout
+     * that kills slow-but-healthy turns, so it stays off for them (their
+     * tool phases are covered by executor timeouts regardless).
+     */
+    const fallbackStreamsDeltas = (fallback) => 
+    // The same two modes as a primary. A subscription fallback that is not
+    // recognised as streaming gets no watchdog at all once a session
+    // switches to it, so a stall there would run to the provider's own
+    // ten-minute timer instead of the idle timeout the operator set.
+    (fallback.provider === 'anthropic' && Boolean(fallback.apiKey || fallback.authToken))
+        // The codex harness streams item snapshots in every auth mode.
+        || fallback.provider === 'codex'
+        // A contributed fallback says for itself, exactly as a contributed
+        // primary does below; a session that switched to one must not lose
+        // the watchdog the plugin declared it could have.
+        || (isRegisteredProviderName(fallback.provider)
+            && providerContributions.get(registeredProviderNameOf(fallback.provider))?.streams === true);
+    const streamsDeltas = (config) => 
+    // Both Anthropic modes stream now: an API key through the Messages
+    // API, a subscription token through the Agent SDK's partial messages —
+    // and the codex harness streams item snapshots in every auth mode. A
+    // contributed provider says for itself, and one that did not say is
+    // read as not streaming: a watchdog armed over a silent-until-done
+    // call would abort every long turn.
+    (config.provider === 'anthropic' && Boolean(config.apiKey || config.authToken))
+        || config.provider === 'codex'
+        || (isRegisteredProviderName(config.provider)
+            && providerContributions.get(registeredProviderNameOf(config.provider))?.streams === true);
+    /**
+     * Progress-based abort, armed only while the turn is actually awaiting a
+     * streaming provider — the one phase where silence means a stall. Tool
+     * executions and approval waits emit no deltas (executor timeouts cover
+     * them), so the timer suspends at each provider.response and re-arms once
+     * every tool call from that response has settled and the loop heads back
+     * to the provider. A reset delta marks the mid-turn, session-sticky
+     * switch to the fallback provider, and the timer follows the active
+     * provider through it: switching to a non-streaming fallback suspends it
+     * for the rest of the turn (silence is healthy there), while a streaming
+     * fallback taking over from a non-streaming primary arms it for the
+     * first time.
+     */
+    const withWatchdog = async (sessionId, external, idleEnabled, fallbackStreams, run) => {
+        const effectiveIdleMs = idleEnabled || fallbackStreams ? idleTimeoutMs : 0;
+        if (effectiveIdleMs <= 0 && !external) {
+            // No watchdog and nobody outside to cancel it — but still a turn an
+            // announced restart must be able to cut short at the window.
+            const idle = new AbortController();
+            trackTurn(sessionId, idle);
+            if (abortingWith !== undefined) {
+                idle.abort(shutdownAbort());
             }
-            if (source === 'agent' && request.scope === 'shared') {
-                throw new Error(`${request.name} is your own credential, not a shared one. Ask again with scope "agent" to replace it.`);
+            try {
+                return await run(idle.signal);
             }
-            if (request.via === 'link') {
-                throw new Error('A replacement is asked for in a form an approver answers, never a link. Nothing is pending.');
-            }
-        }
-        else if (stored && granted) {
-            throw new Error(`You already hold ${request.name}; the tools that need it use it for you. To rotate it for a new value, ask again with replace: true.${bindOnMachine}`
-                + (request.env !== undefined ? ' Nothing is pending.' : ''));
-        }
-        else if (stored) {
-            throw new Error(`${request.name} is already ${source === 'environment' ? "supplied by the daemon's environment" : 'stored'} but not granted to you. `
-                + `Ask your operator to add it to the credentials list in your soul; a form would only refuse to store it again.${bindOnMachine}`);
-        }
-        const onMachine = request.env === undefined
-            ? `\`stratus credential set ${request.name}${request.scope === 'agent' ? ` --agent ${quoteShellArg(agentId)}` : ''}\``
-            : request.scope === 'agent'
-                ? `\`stratus credential set ${request.name} --agent ${quoteShellArg(agentId)} --env ${request.env}\``
-                : `\`stratus credential set ${request.name}\`, then \`stratus credential env ${request.name} ${request.env} --agent ${quoteShellArg(agentId)}\``;
-        const record = {
-            agentId,
-            sessionId: session.id,
-            name: request.name,
-            scope: request.scope,
-            soulPath,
-            ...(request.replace === true ? { replace: true } : {}),
-            ...(request.env !== undefined ? { env: request.env } : {}),
-        };
-        const announce = async (requestId, via) => {
-            await bus.emit({
-                type: 'credential.requested',
-                sessionId: session.id,
-                agentId,
-                requestId,
-                name: request.name,
-                scope: request.scope,
-                ...(request.reason !== undefined ? { reason: request.reason } : {}),
-                via,
-                ...(request.replace === true ? { replace: true } : {}),
-                ...(request.env !== undefined ? { env: request.env } : {}),
-                ...(session.metadata ? { metadata: session.metadata } : {}),
-            });
-        };
-        // A link only for an agent whose soul lists the tool. Every agent may
-        // ask through a form, because a form goes to an approver; a link is a
-        // bearer credential the model is handed, and whoever it reaches can
-        // store a key and amend the soul. That is the operator's to allow.
-        const allowlist = session.agent.tools ?? registry.get(agentId)?.tools;
-        // An omitted list grants the safe tools, this one among them, but a
-        // link is the operator's to allow by naming it, so only a list says yes.
-        // On a home an older build set up an omitted list is every tool, and
-        // has always allowed a link there.
-        const linkAllowed = allowlist === undefined
-            ? unlistedTools() === 'every'
-            : matchesToolAllowlist(CREDENTIAL_REQUEST_TOOL_NAME, allowlist);
-        // Why no form went up, said to the agent beside the link that replaces
-        // it, so it can tell the person why they are getting a link instead.
-        let formUnavailable;
-        if (request.via !== 'link') {
-            // Only a conversation a channel started has anywhere to show a form,
-            // and only a channel that renders one can show it: a scheduled or
-            // HTTP turn, or a channel with no form, would record a request nobody
-            // sees while the agent tells its user the operator was asked.
-            const kind = session.metadata?.channel;
-            const { adapter } = typeof kind === 'string'
-                ? channelCarrying(kind, agentId, (candidate) => candidate.requestCredential !== undefined
-                    && (request.replace !== true || candidate.credentialReplaceForms === true)
-                    // A form that can't say the key will be shell-readable must not
-                    // be the approval for it: a link says it instead.
-                    && (request.env === undefined || candidate.credentialEnvForms === true))
-                : { adapter: undefined };
-            if (!adapter?.requestCredential || !session.metadata) {
-                formUnavailable = typeof kind === 'string'
-                    ? `This conversation's channel (${kind}) cannot show your operator a ${request.replace === true ? 'replacement' : 'credential'} form here${request.env !== undefined ? ' that says which variable your shell will read it from' : ''}.`
-                    : 'This conversation is not in a channel that can show your operator a form.';
-            }
-            else {
-                const requestId = randomUUID();
-                credentialRequests.set(requestId, { ...record, via: 'form' });
-                // Delivered before it is announced, and dropped if delivery fails: a
-                // request whose post never landed has no button to answer it, so
-                // keeping it would leave it pending for good behind a tool result
-                // saying the operator was asked.
-                try {
-                    await adapter.requestCredential({
-                        sessionId: session.id,
-                        agentId,
-                        requestId,
-                        name: request.name,
-                        scope: request.scope,
-                        ...(request.reason !== undefined ? { reason: request.reason } : {}),
-                        ...(request.replace === true ? { replace: true } : {}),
-                        ...(request.env !== undefined ? { env: request.env } : {}),
-                        metadata: session.metadata,
-                    });
-                    await announce(requestId, 'form');
-                    return { requestId, via: 'form' };
-                }
-                catch (error) {
-                    credentialRequests.delete(requestId);
-                    formUnavailable = `The form could not be shown here: ${error instanceof Error ? error.message : String(error)}`;
-                }
-            }
-            if (request.replace === true) {
-                // Never a link: whoever holds one could change a key in use.
-                throw new Error(`${formUnavailable} Nothing is pending. A replacement needs a conversation that can show an approver a form.`);
-            }
-            if (request.via === 'form') {
-                throw new Error(`${formUnavailable} Nothing is pending. ${linkAllowed ? 'Ask for a link instead (via: "link"), or ask' : 'Ask'} your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
-            }
-        }
-        if (!linkAllowed) {
-            throw new Error(`${formUnavailable !== undefined ? `${formUnavailable} ` : ''}A one-time link needs ${CREDENTIAL_REQUEST_TOOL_NAME} in your soul's tools: list, and it is not there. Nothing is pending. `
-                + `Ask in a conversation that can show your operator a form, or ask your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
-        }
-        // A link where no form can go, from whichever adapter issues them: the
-        // control API, which is not tied to any one agent's transport.
-        const linker = startedChannels.find((candidate) => candidate.requestCredentialLink !== undefined);
-        if (!linker?.requestCredentialLink) {
-            throw new Error(`${formUnavailable !== undefined ? `${formUnavailable} ` : ''}No control API is running to issue a link either. `
-                + `Ask your operator to store ${request.name} on the machine with ${onMachine} and grant it to you.`);
-        }
-        const requestId = randomUUID();
-        credentialRequests.set(requestId, { ...record, via: 'link' });
-        let link;
-        try {
-            link = await linker.requestCredentialLink({
-                sessionId: session.id,
-                agentId,
-                agentName: session.agent.name,
-                requestId,
-                name: request.name,
-                scope: request.scope,
-                ...(request.reason !== undefined ? { reason: request.reason } : {}),
-                ...(request.env !== undefined ? { env: request.env } : {}),
-            });
-        }
-        catch (error) {
-            credentialRequests.delete(requestId);
-            throw new Error(`A link for ${request.name} could not be issued: ${error instanceof Error ? error.message : String(error)} `
-                + `Nothing is pending. Ask your operator to store it on the machine with ${onMachine}.`);
-        }
-        await announce(requestId, 'link');
-        return {
-            requestId,
-            via: 'link',
-            url: link.url,
-            expiresAt: link.expiresAt,
-            ...(link.localOnly === true ? { localOnly: true } : {}),
-            ...(formUnavailable !== undefined ? { formUnavailable } : {}),
-        };
-    }));
-    /**
-     * Requests an answer is being stored for now. Claimed before the first
-     * await: two approvers submitting one form at once would otherwise both
-     * start storing, and the second's add-only conflict would retire a
-     * request the first was about to settle as added.
-     */
-    const answering = new Set();
-    const provideCredential = async (input) => {
-        const request = credentialRequests.get(input.requestId);
-        if (!request) {
-            return { ok: false, retired: true, message: 'That credential request is no longer pending. Ask the agent to request it again.' };
-        }
-        if (answering.has(input.requestId)) {
-            return { ok: false, message: 'Someone else\'s answer to this request is being stored right now. Wait a moment before trying again.' };
-        }
-        answering.add(input.requestId);
-        try {
-            return await answerCredentialRequest(input, request);
-        }
-        finally {
-            answering.delete(input.requestId);
-        }
-    };
-    /**
-     * The audit line for a key changed from a chat or a link. After the
-     * store, since it records what happened; a line that can't be written is
-     * warned about rather than undoing a change that already landed.
-     */
-    const auditCredentialChange = async (action, request, actor) => {
-        try {
-            await appendCredentialAudit(env, {
-                action,
-                name: request.name,
-                ...(request.scope === 'agent' ? { agentId: request.agentId } : {}),
-                ...(actor !== undefined ? { actor } : {}),
-                via: request.via ?? 'form',
-                requestedBy: request.agentId,
-                ...(request.env !== undefined ? { env: request.env, bindingFor: request.agentId } : {}),
-            });
-        }
-        catch (error) {
-            warn(`credentials: ${request.name} was ${action === 'add' ? 'added' : 'replaced'}, but the audit line could not be written (${error instanceof Error ? error.message : String(error)}).`);
-        }
-    };
-    const answerCredentialRequest = async (input, request) => {
-        // The agent must still be served from the file the request captured: a
-        // repointed default soul (same id, another file) replaces the source,
-        // and a grant landing in the old file would report a key the agent now
-        // running cannot use.
-        const served = sources.get(request.agentId)?.soulPath;
-        if (served !== request.soulPath) {
-            credentialRequests.delete(input.requestId);
-            return {
-                ok: false,
-                retired: true,
-                message: `${request.agentId} is no longer served from ${request.soulPath}, so nothing was stored. Ask ${request.agentId} to request it again.`,
-            };
-        }
-        // The soul the grant will land in must still be the requester's, and is
-        // checked before anything is stored: a file reassigned to another agent
-        // while the request waited would otherwise receive a key nobody meant
-        // to give it. `grantSoulCredential` checks again as it writes.
-        let owner;
-        try {
-            owner = (await loadSoulFile(request.soulPath)).agent.id;
-        }
-        catch (error) {
-            return {
-                ok: false,
-                message: `${request.agentId}'s soul could not be read (${error instanceof Error ? error.message : String(error)}), so nothing was stored.`,
-            };
-        }
-        if (owner !== request.agentId) {
-            credentialRequests.delete(input.requestId);
-            return {
-                ok: false,
-                retired: true,
-                message: `${request.soulPath} now belongs to ${owner}, not ${request.agentId}, so nothing was stored. Ask ${request.agentId} to request it again.`,
-            };
-        }
-        const value = formCredentialValue(input.value);
-        if (isFlattenedPem(value)) {
-            // Refused, not retired: the same form can still take the key whole.
-            const command = request.scope === 'agent'
-                ? `stratus credential set ${request.name} --agent ${quoteShellArg(request.agentId)} < key.pem`
-                : `stratus credential set ${request.name} < key.pem`;
-            return {
-                ok: false,
-                message: 'That looks like a PEM key whose line breaks were lost, so nothing was stored: whatever reads it would fail. '
-                    + `Paste it again from the original file with its line breaks, or store it on the machine: ${command}.`,
-            };
-        }
-        const store = {
-            ...(request.scope === 'agent' ? { agentId: request.agentId } : {}),
-            // The binding the form promised, written with the value, always for
-            // the agent that asked: consent is per agent even for a shared key.
-            ...(request.env !== undefined ? { bind: { agentId: request.agentId, variable: request.env } } : {}),
-        };
-        if (request.replace === true) {
-            // Re-read under the soul lock, so a grant removed while the form
-            // waited (a shared key most of all) is never rotated on its behalf.
-            let stillGranted;
-            try {
-                stillGranted = await withSoulFileLock(async () => {
-                    const soul = await loadSoulFile(request.soulPath);
-                    if (soul.agent.id !== request.agentId || soul.agent.credentials?.includes(request.name) !== true) {
-                        return false;
-                    }
-                    await replaceNamedCredential(env, { name: request.name, value, ...store });
-                    return true;
-                });
-            }
-            catch (error) {
-                // Removed since the request was made: no value can land now.
-                if (error instanceof NamedCredentialMissingError) {
-                    credentialRequests.delete(input.requestId);
-                    return { ok: false, retired: true, message: error.message };
-                }
-                return { ok: false, message: error instanceof Error ? error.message : String(error) };
-            }
-            if (!stillGranted) {
-                credentialRequests.delete(input.requestId);
-                return {
-                    ok: false,
-                    retired: true,
-                    message: `${request.agentId} is no longer granted ${request.name} in ${request.soulPath}, so the stored key was kept. Ask ${request.agentId} to request it again if it still needs it.`,
-                };
-            }
-            credentialRequests.delete(input.requestId);
-            await auditCredentialChange('replace', request, input.actor);
-            await bus.emit({
-                type: 'credential.provided',
-                sessionId: request.sessionId,
-                agentId: request.agentId,
-                requestId: input.requestId,
-                name: request.name,
-                scope: request.scope,
-                replace: true,
-                ...(request.env !== undefined ? { env: request.env } : {}),
-                ...(input.actor !== undefined ? { actor: input.actor } : {}),
-            });
-            // The soul already lists it: a replace is only asked for a key held.
-            return { ok: true, name: request.name, scope: request.scope, agentId: request.agentId, granted: false };
-        }
-        try {
-            await addNamedCredential(env, {
-                name: request.name,
-                value,
-                ...store,
-            });
-        }
-        catch (error) {
-            // A name stored since the request was made (another form for the
-            // same shared key, or the machine) is final under add-only: no value
-            // typed into this form can ever land, so the request is retired
-            // rather than left answering every submission with the same refusal.
-            if (error instanceof NamedCredentialExistsError) {
-                credentialRequests.delete(input.requestId);
-                return { ok: false, retired: true, message: error.message };
-            }
-            // Otherwise refused, not failed: the request stays pending, so a
-            // person who typed an empty value can try again from the same form.
-            return { ok: false, message: error instanceof Error ? error.message : String(error) };
-        }
-        credentialRequests.delete(input.requestId);
-        await auditCredentialChange('add', request, input.actor);
-        // Stored first, granted second: a key nobody may use is recoverable by
-        // editing the soul, while a soul naming a key that was never stored
-        // fails every call that reaches for it. Announced either way, because
-        // the store already changed and a shared key is already usable.
-        //
-        // The served path is checked again under the soul lock, which roster
-        // reloads take too: a default repointed while the key was being
-        // written, or while the grant queued behind another soul edit, would
-        // otherwise be granted in a file the running agent no longer reads.
-        let granted = false;
-        let grantError;
-        try {
-            granted = await grantSoulCredential(request.soulPath, request.name, request.agentId, {
-                check: () => {
-                    const servedNow = sources.get(request.agentId)?.soulPath;
-                    if (servedNow !== request.soulPath) {
-                        throw new Error(`${request.agentId} is now served from ${servedNow ?? 'no soul file'}, not ${request.soulPath}`);
-                    }
-                },
-            });
-        }
-        catch (error) {
-            grantError = error instanceof Error ? error.message : String(error);
-        }
-        await bus.emit({
-            type: 'credential.provided',
-            sessionId: request.sessionId,
-            agentId: request.agentId,
-            requestId: input.requestId,
-            name: request.name,
-            scope: request.scope,
-            ...(request.env !== undefined ? { env: request.env } : {}),
-            ...(input.actor !== undefined ? { actor: input.actor } : {}),
-            ...(grantError !== undefined ? { grantError } : {}),
-        });
-        if (grantError !== undefined) {
-            return {
-                ok: false,
-                retired: true,
-                message: `${request.name} was stored, but could not be added to ${request.soulPath} `
-                    + `(${grantError}). Add it to the soul's credentials list by hand.`,
-            };
-        }
-        return { ok: true, name: request.name, scope: request.scope, agentId: request.agentId, granted };
-    };
-    tools.register(createDelegateTool({
-        registry,
-        dispatch: (input) => dispatchInternal({
-            sessionId: input.sessionId,
-            agentId: input.agent.id,
-            userMessage: input.userMessage,
-            metadata: input.metadata,
-            // A cancelled parent turn cancels its delegated runs too.
-            ...(input.signal ? { signal: input.signal } : {}),
-        }),
-    }));
-    // ---- sub-agents (roadmap 24) -------------------------------------------
-    /**
-     * Running sub-agents per parent session, and who waits for a slot. A
-     * parent session runs one turn at a time, so this is per turn.
-     */
-    const maxSubAgentsPerTurn = options.subAgents?.maxConcurrentPerTurn ?? DEFAULT_SUB_AGENTS_PER_TURN;
-    // NaN, 0, a fraction or Infinity would queue every sub-agent forever or
-    // defeat the cap, so refuse it here instead of failing later in a turn.
-    if (!Number.isInteger(maxSubAgentsPerTurn) || maxSubAgentsPerTurn < 1) {
-        throw new Error(`subAgents.maxConcurrentPerTurn must be a whole number of at least 1 (got ${String(maxSubAgentsPerTurn)}).`);
-    }
-    const subAgentSlots = new Map();
-    let subAgentCount = 0;
-    /**
-     * The session object each in-flight tool call was handed, with that
-     * call's turn signal. `subAgents.run` accepts only a parent found here:
-     * the session a running tool was given, by identity, never an id, so a
-     * plugin cannot start sub-agents of another turn (another agent's
-     * included) just because that turn is running. The signal is how the
-     * parent's cancel reaches its sub-agents whether or not the plugin
-     * passes one.
-     */
-    const toolCallsInFlight = new Map();
-    const bindToolCalls = (inner) => ({
-        async execute(call, tool, session, context) {
-            if (!idAtFirstCall.has(session)) {
-                idAtFirstCall.set(session, session.id);
-            }
-            const entry = toolCallsInFlight.get(session) ?? [];
-            toolCallsInFlight.set(session, entry);
-            const signal = context?.signal;
-            entry.push(signal);
-            try {
-                return await inner.execute(call, tool, session, context);
-            }
-            finally {
-                entry.splice(entry.indexOf(signal), 1);
-                if (entry.length === 0) {
-                    toolCallsInFlight.delete(session);
-                }
-            }
-        },
-    });
-    const subAgentSlot = (parentId, signal) => new Promise((resolve, reject) => {
-        const entry = subAgentSlots.get(parentId) ?? { running: 0, waiting: [] };
-        subAgentSlots.set(parentId, entry);
-        const release = () => {
-            entry.running -= 1;
-            const next = entry.waiting.shift();
-            if (next) {
-                next();
-            }
-            else if (entry.running === 0) {
-                subAgentSlots.delete(parentId);
-            }
-        };
-        const take = () => {
-            entry.running += 1;
-            resolve(release);
-        };
-        if (entry.running < maxSubAgentsPerTurn) {
-            take();
-            return;
-        }
-        const onAbort = () => {
-            const at = entry.waiting.indexOf(waiter);
-            if (at >= 0) {
-                entry.waiting.splice(at, 1);
-            }
-            reject(abortErrorFor(signal));
-        };
-        const waiter = () => {
-            signal?.removeEventListener('abort', onAbort);
-            take();
-        };
-        entry.waiting.push(waiter);
-        signal?.addEventListener('abort', onAbort, { once: true });
-    });
-    /** Why this slice cannot be a sub-agent's, or undefined when it can. */
-    const subAgentSliceProblem = (parent, requested) => {
-        if (!Array.isArray(requested) || requested.some((name) => typeof name !== 'string' || name.length === 0)) {
-            return 'A sub-agent\'s tools are a list of tool names.';
-        }
-        // Read the way the runner reads it for the parent's own calls: the
-        // session's copy, else the registered agent's.
-        const allowlist = parent.agent.tools ?? registry.get(parent.agent.id)?.tools;
-        for (const name of requested) {
-            if (/[*?]/.test(name)) {
-                return `A sub-agent's tools are exact names, and ${name} is a pattern.`;
-            }
-            if (subAgentNeverGets(name)) {
-                return `${name} is never given to a sub-agent, even by an agent that holds it.`;
-            }
-            const tool = tools.get(name);
-            if (!tool) {
-                return `There is no tool named ${name}.`;
-            }
-            // The parent's allowlist as its running turn holds it: a slice can
-            // only narrow what that turn may already do. With no list, that is
-            // the tools registered as safe (every tool on a home an older build
-            // set up), and the slice is held to the same rule: naming a gated
-            // tool must not hand it to the sub-agent.
-            if (allowlist === undefined) {
-                if (unlistedTools() !== 'every' && resolveToolRisk(tool) !== 'safe') {
-                    return `${name} is not a safe tool, and ${parent.agent.id}'s soul has no tools: list, so it gets only safe tools and a sub-agent of it cannot have ${name}.`;
-                }
-            }
-            else if (!matchesToolAllowlist(name, allowlist)) {
-                return `${name} is not one of ${parent.agent.id}'s tools, so a sub-agent of it cannot have it.`;
-            }
-        }
-        return undefined;
-    };
-    const subAgents = {
-        async run(request) {
-            // Copied before the first await, and only the copy is read from here
-            // on: the plugin keeps its own objects and can change them while this
-            // request is checked or waits for a slot, and a slice changed after
-            // it was checked must not be the slice the sub-agent runs with.
-            const handed = request?.parent;
-            const callSignals = handed ? toolCallsInFlight.get(handed) : undefined;
-            if (!callSignals) {
-                throw new Error('subAgents.run starts sub-agents only for the session your tool was handed, while that call is running. Pass that session object as "parent".');
-            }
-            // The parent turn's own stop, and the caller's as an extra one: a
-            // plugin that passes no signal still has its sub-agents cancelled
-            // with the turn.
-            const stops = [...callSignals, request.signal].filter((signal) => signal !== undefined);
-            const input = {
-                parent: { id: hostIdOf(handed) },
-                instruction: request?.instruction,
-                tools: Array.isArray(request?.tools) ? [...request.tools] : request?.tools,
-                model: request?.model,
-                signal: stops.length === 0 ? undefined : stops.length === 1 ? stops[0] : AbortSignal.any(stops),
-            };
-            const parentId = typeof input.parent.id === 'string' ? input.parent.id : '';
-            if (!parentId) {
-                throw new Error('subAgents.run needs the session of the turn asking.');
-            }
-            const instruction = typeof input.instruction === 'string' ? input.instruction.trim() : '';
-            if (!instruction) {
-                throw new Error('subAgents.run needs an instruction.');
-            }
-            if (input.model !== undefined) {
-                throw new Error('A sub-agent\'s model cannot be chosen yet: it runs on its parent\'s. Leave "model" out.');
-            }
-            const parent = await store.get(parentId);
-            if (!parent) {
-                throw new Error(`There is no session ${parentId} to start a sub-agent from.`);
-            }
-            if (isHostSubAgent(handed) || isSubAgentSession(parent)) {
-                throw new Error('A sub-agent cannot start sub-agents.');
-            }
-            if (parent.status !== 'running') {
-                throw new Error(`Session ${parentId} is not running a turn, and sub-agents start only from one.`);
-            }
-            const depth = typeof parent.metadata?.[DELEGATION_DEPTH_METADATA_KEY] === 'number'
-                ? parent.metadata[DELEGATION_DEPTH_METADATA_KEY]
-                : 0;
-            if (depth >= DEFAULT_MAX_DELEGATION_DEPTH) {
-                throw new Error(`Delegation depth limit reached (${DEFAULT_MAX_DELEGATION_DEPTH}).`);
-            }
-            const problem = subAgentSliceProblem(parent, input.tools);
-            if (problem) {
-                throw new Error(problem);
-            }
-            if (input.signal?.aborted) {
-                throw abortErrorFor(input.signal);
-            }
-            const release = await subAgentSlot(parent.id, input.signal);
-            subAgentCount += 1;
-            const sessionId = `${parent.id}${SUB_AGENT_SESSION_ID_MARKER}${depth + 1}:${subAgentCount}-${randomUUID().slice(0, 8)}`;
-            // The parent agent, narrowed: its id, provider and credentials, the
-            // slice for tools, and nothing else — no instructions (the persona),
-            // no skills, no delegates.
-            const definition = {
-                id: parent.agent.id,
-                name: parent.agent.name,
-                tools: [...new Set(input.tools)],
-                skills: [],
-                delegates: [],
-                ...(parent.agent.credentials !== undefined ? { credentials: [...parent.agent.credentials] } : {}),
-            };
-            let session;
-            liveSubAgentIds.add(sessionId);
-            try {
-                session = await onSessionChain(sessionId, () => dispatchInternal({
-                    sessionId,
-                    agentId: parent.agent.id,
-                    userMessage: instruction,
-                    metadata: {
-                        [SUB_AGENT_METADATA_KEY]: true,
-                        [DELEGATION_DEPTH_METADATA_KEY]: depth + 1,
-                        [DELEGATED_BY_METADATA_KEY]: parent.agent.id,
-                        [ROOT_SESSION_ID_METADATA_KEY]: typeof parent.metadata?.[ROOT_SESSION_ID_METADATA_KEY] === 'string'
-                            ? parent.metadata[ROOT_SESSION_ID_METADATA_KEY]
-                            : parent.id,
-                        // The instruction is the parent's text, at the parent's label:
-                        // a tainted parent must not hand a stranger's words to a
-                        // session that has seen nothing.
-                        [SENDER_TRUST_METADATA_KEY]: sessionWriteTrust(parent),
-                        // On the runtime serving the parent's turn: a parent that has
-                        // switched to its sticky fallback must not have its helpers
-                        // retry the primary it left.
-                        ...(parent.metadata?.[FALLBACK_ACTIVE_METADATA_KEY] === true ? { [FALLBACK_ACTIVE_METADATA_KEY]: true } : {}),
-                    },
-                    ...(input.signal ? { signal: input.signal } : {}),
-                }, [], definition));
-            }
-            catch (error) {
-                if (input.signal?.aborted) {
-                    throw error;
-                }
-                // The error text may be the provider quoting what it refused,
-                // which is this sub-agent's context: labelled as nobody can vouch.
-                return { status: 'error', error: error instanceof Error ? error.message : String(error), sessionId, trust: 'unknown' };
-            }
-            finally {
-                liveSubAgentIds.delete(sessionId);
-                release();
-            }
-            const trust = sessionTrustOf(session);
-            if (session.status === 'failed') {
-                return { status: 'error', error: session.lastError ?? 'The sub-agent failed.', sessionId, trust: 'unknown' };
-            }
-            const reply = [...session.messages]
-                .reverse()
-                .find((message) => message.role === 'assistant' && message.content.trim().length > 0);
-            const outcome = reply
-                ? { status: 'result', text: reply.content, sessionId, trust }
-                : { status: 'empty', sessionId, trust };
-            return outcome;
-        },
-    };
-    const runners = new Map();
-    // Every provider-construction input participates in the key — model,
-    // endpoint, credentials, system prompt, fallback config. A rotated
-    // credential therefore resolves to a NEW runner on the next dispatch
-    // instead of silently reusing a provider built with the old secret.
-    // (Hashed so raw secrets never sit in a map key; the soul is excluded
-    // because provider construction ignores it.)
-    const runnerKeyFor = (config) => {
-        const { soul: _soul, soulPath: _soulPath, fetch: _fetch, ...providerInputs } = config;
-        return createHash('sha256').update(JSON.stringify(providerInputs)).digest('hex');
-    };
-    // A sub-agent's runner has no memory store, so no turn of it injects or
-    // reads the agent's memory; no skill catalog, so its prompt is its
-    // instruction and its tools; and grants nothing to every agent, since
-    // the credential request asks a person.
-    const runnerFor = (config, agentId, subAgent = false) => {
-        // The budget is a provider-construction input too (the harness
-        // runtimes take it as their inner limit), so it is part of the key:
-        // two agents on one model with different budgets get their own runners.
-        const maxTurns = options.maxTurnsFor?.(agentId) ?? options.maxTurns;
-        const autoContinue = options.autoContinueFor?.(agentId);
-        const key = `${runnerKeyFor(config)}:${maxTurns ?? 'default'}:${autoContinue ?? 'off'}${subAgent ? ':sub' : ''}`;
-        const existing = runners.get(key);
-        if (existing) {
-            return existing;
-        }
-        // The Claude Code runtime executes kernel tools by calling back into
-        // the runner built just below — late-bound because the runner needs
-        // the provider first.
-        let hostedRunner;
-        const provider = createRuntimeProvider(config, (error) => warn(`default model failed (${error instanceof Error ? error.message : String(error)}); using the fallback model`), async (session, call, context) => {
-            if (!hostedRunner) {
-                throw new Error('The Stratus runtime is not ready to execute tools yet.');
-            }
-            return hostedRunner.executeHostedToolCall(session, call, context);
-        }, maxTurns, 
-        // The sticky-fallback switch is durable the moment it happens, not
-        // when the turn's next save lands — a daemon killed mid-fallback
-        // must not retry the primary on restart.
-        (session) => store.save(session), providerContributions);
-        const runner = new AgentRunner({
-            provider,
-            tools,
-            // Runners are built on dispatch, after the plugins loaded and the
-            // selection below ran, so a contributed executor is in place for
-            // the first turn.
-            executor: bindToolCalls(selectedExecutor ?? createLocalCommandExecutor()),
-            ...(approvals ? { approvals } : {}),
-            store,
-            bus,
-            agents: registry,
-            // Asking a person for a key is harmless to grant: they decide
-            // everything after the question, so no soul has to list it.
-            grantedToEveryAgent: subAgent ? [] : [CREDENTIAL_REQUEST_TOOL_NAME],
-            unlistedTools: unlistedTools(),
-            ...(subAgent ? {} : { skills: skillCatalog, memory }),
-            streaming: true,
-            ...(maxTurns !== undefined ? { maxTurns } : {}),
-            ...(autoContinue !== undefined
-                ? { autoContinue, waitingInput: (sessionId) => (waitingDispatches.get(sessionId) ?? 0) > 0 }
-                : {}),
-            providerCallGuards,
-        });
-        hostedRunner = runner;
-        runners.set(key, runner);
-        return runner;
-    };
-    /**
-     * The runner that hears and never speaks. `observe` runs no turn, so it
-     * needs no provider — and resolving one anyway would refuse an overhear
-     * whenever the agent's runtime cannot currently be built: credentials
-     * missing after a restart, a sign-in that lapsed. That is precisely the
-     * window in which the agent cannot answer and the thread carries on
-     * without it, so it is the window in which hearing matters most, and
-     * what it heard is there once the configuration is repaired.
-     *
-     * A runner rather than a store write, because the label a speaker
-     * lowers the session to is the runner's rule and there is one
-     * implementation of it. Same store and bus as every speaking runner, so
-     * a message it appends is the message the next turn reads, and its
-     * event goes where every other event goes.
-     */
-    const observer = new AgentRunner({
-        provider: {
-            name: 'observer',
-            async generate() {
-                throw new Error('The observing runner never runs a turn.');
-            },
-        },
-        store,
-        bus,
-    });
-    // ---- watchdog -----------------------------------------------------------
-    /**
-     * True when this configuration's provider actually emits deltas: the
-     * Anthropic API path streams; the Claude Code runtime, OpenAI-compatible
-     * adapters, and the demo provider resolve in one piece. An activity
-     * watchdog is only honest where activity signals exist — for
-     * non-streaming providers the idle timer would be a wall-clock timeout
-     * that kills slow-but-healthy turns, so it stays off for them (their
-     * tool phases are covered by executor timeouts regardless).
-     */
-    const fallbackStreamsDeltas = (fallback) => 
-    // The same two modes as a primary. A subscription fallback that is not
-    // recognised as streaming gets no watchdog at all once a session
-    // switches to it, so a stall there would run to the provider's own
-    // ten-minute timer instead of the idle timeout the operator set.
-    (fallback.provider === 'anthropic' && Boolean(fallback.apiKey || fallback.authToken))
-        // The codex harness streams item snapshots in every auth mode.
-        || fallback.provider === 'codex'
-        // A contributed fallback says for itself, exactly as a contributed
-        // primary does below; a session that switched to one must not lose
-        // the watchdog the plugin declared it could have.
-        || (isRegisteredProviderName(fallback.provider)
-            && providerContributions.get(registeredProviderNameOf(fallback.provider))?.streams === true);
-    const streamsDeltas = (config) => 
-    // Both Anthropic modes stream now: an API key through the Messages
-    // API, a subscription token through the Agent SDK's partial messages —
-    // and the codex harness streams item snapshots in every auth mode. A
-    // contributed provider says for itself, and one that did not say is
-    // read as not streaming: a watchdog armed over a silent-until-done
-    // call would abort every long turn.
-    (config.provider === 'anthropic' && Boolean(config.apiKey || config.authToken))
-        || config.provider === 'codex'
-        || (isRegisteredProviderName(config.provider)
-            && providerContributions.get(registeredProviderNameOf(config.provider))?.streams === true);
-    /**
-     * Progress-based abort, armed only while the turn is actually awaiting a
-     * streaming provider — the one phase where silence means a stall. Tool
-     * executions and approval waits emit no deltas (executor timeouts cover
-     * them), so the timer suspends at each provider.response and re-arms once
-     * every tool call from that response has settled and the loop heads back
-     * to the provider. A reset delta marks the mid-turn, session-sticky
-     * switch to the fallback provider, and the timer follows the active
-     * provider through it: switching to a non-streaming fallback suspends it
-     * for the rest of the turn (silence is healthy there), while a streaming
-     * fallback taking over from a non-streaming primary arms it for the
-     * first time.
-     */
-    const withWatchdog = async (sessionId, external, idleEnabled, fallbackStreams, run) => {
-        const effectiveIdleMs = idleEnabled || fallbackStreams ? idleTimeoutMs : 0;
-        if (effectiveIdleMs <= 0 && !external) {
-            // No watchdog and nobody outside to cancel it — but still a turn an
-            // announced restart must be able to cut short at the window.
-            const idle = new AbortController();
-            trackTurn(sessionId, idle);
-            if (abortingWith !== undefined) {
-                idle.abort(shutdownAbort());
-            }
-            try {
-                return await run(idle.signal);
-            }
-            finally {
-                untrackTurn(sessionId, idle);
+            finally {
+                untrackTurn(sessionId, idle);
             }
         }
         const controller = new AbortController();
@@ -2546,843 +1555,183 @@ export const createGateway = (options = {}) => {
      */
     const openBatches = new Map();
     /** The start-up snapshot `recoverParkedTurns` judges orphans from, for a repeat that gets there first. */
-    let orphanedAtStart = new Set();
-    /**
-     * The runtime one agent would run on right now — config snapshot, soul
-     * pins, degradation and all.
-     *
-     * Extracted so recovery resolves it exactly as a dispatch does. A second
-     * copy of this chain is the difference between a recovered turn finishing
-     * on its agent's provider and finishing on the daemon's default, and it
-     * would drift the first time either side gained a rule.
-     */
-    const runtimeForAgent = async (source) => {
-        // Config re-resolves per dispatch, so a changed model, credential, or
-        // soul pin applies without a restart. The pool dedupes runners by the
-        // resolved configuration. The gateway-wide selection and the daemon's
-        // environment are defaults, not overrides: resolveRuntimeConfig gives
-        // both higher precedence than the soul (they are explicit flags and
-        // env vars on the CLI), so any default the soul pins over is dropped
-        // here — an agent pinned to a provider keeps it whatever the gateway
-        // was started with, and a default model never rides along to a
-        // different provider than it was chosen for.
-        const selection = { ...options.selection };
-        let resolveEnv = env;
-        // One config read per dispatch, through a last-known-good cache: a
-        // config.json an operator saved mid-edit must neither fail dispatches
-        // (a daemon keeps serving) nor silently change what it configured —
-        // discarding a broken config wholesale would flip a config-provided
-        // provider back to the demo default, durably recording canned replies
-        // in a real conversation. With no known-good snapshot to fall back
-        // on, failing is the honest outcome. Credential and provider errors
-        // are never masked — only the file itself degrades.
-        let configSnapshot;
-        try {
-            const location = await resolveConfigLocation(options.selection?.configPath ? { configPath: options.selection.configPath } : {}, env);
-            configSnapshot = location
-                ? { config: await loadConfigFile(location.path), trusted: location.trusted, path: location.path }
-                : { config: {}, trusted: true };
-            lastGoodConfigSnapshot = configSnapshot;
-        }
-        catch (error) {
-            if (!(error instanceof ConfigFileError) || !lastGoodConfigSnapshot) {
-                throw error;
-            }
-            warn(`${error.message}; using the last known-good config`);
-            configSnapshot = lastGoodConfigSnapshot;
-        }
-        selection.presetConfig = configSnapshot;
-        const pins = source.soul;
-        if (pins) {
-            // One soul read per dispatch: resolution uses the exact snapshot
-            // refreshAgent just loaded and identity-checked. Handing the path
-            // to resolveRuntimeConfig instead would read the file a second
-            // time, racing a concurrent replacement — this turn could keep one
-            // agent's definition while adopting another's provider pins.
-            const normalized = applySoulPins(pins, selection, env, {
-                ...(options.selection?.provider !== undefined ? { selectionProvider: options.selection.provider } : {}),
-                ...(configSnapshot.config.provider !== undefined ? { configProvider: configSnapshot.config.provider } : {}),
-                configPresent: configSnapshot.path !== undefined,
-            });
-            resolveEnv = normalized.env;
-        }
-        else {
-            // A soul-less agent (the built-in default) resolves with no soul at
-            // all: the config file's default soul belongs to another identity —
-            // and when the default route degrades to the built-in, it is exactly
-            // because that file is currently unusable.
-            selection.presetSoul = null;
-        }
-        // The preset snapshot means resolution reads no config file — every
-        // failure from here is a credential or provider problem and surfaces.
-        return resolveRuntimeConfig(selection, resolveEnv);
-    };
-    /**
-     * Whether the turn about to run streams deltas, which arms the idle
-     * watchdog — on the sticky fallback when the session already switched to
-     * it, since that is the provider the turn will be served by.
-     */
-    const watchdogStreamsFor = (session, config) => {
-        const switchedToFallback = session?.metadata?.[FALLBACK_ACTIVE_METADATA_KEY] === true;
-        const fallbackStreams = config.provider !== 'demo' && config.fallback
-            ? fallbackStreamsDeltas(config.fallback)
-            : false;
-        const effectiveStreams = switchedToFallback && config.provider !== 'demo' && config.fallback
-            ? fallbackStreamsDeltas(config.fallback)
-            : streamsDeltas(config);
-        return { switchedToFallback, effectiveStreams, fallbackStreams };
-    };
-    /**
-     * Whether a turn on this config could be served by a harness
-     * (`runsOnHarness`): the primary or, since a turn can switch mid-run, the
-     * fallback. Once a session has switched for good the primary is never
-     * called again, and only the fallback counts.
-     */
-    const reachesHarness = (config, switchedToFallback) => {
-        const fallback = config.provider !== 'demo' ? config.fallback : undefined;
-        return switchedToFallback && fallback !== undefined
-            ? runsOnHarness(fallback)
-            : runsOnHarness(config) || (fallback !== undefined && runsOnHarness(fallback));
-    };
-    /**
-     * A keyed turn the shutdown cut short and the runner left for the next
-     * start (`leftForNextStart`): its caller is told so, the way a message
-     * refused at the door is, and keeps it for the next daemon, which
-     * continues the turn. Read back on the chain, so it is this dispatch's
-     * own message the session is still running on.
-     */
-    const settleLeftForNextStart = async (input, turn) => {
-        try {
-            return await turn;
-        }
-        catch (error) {
-            if (error instanceof RunAbortedError && error.resumable) {
-                const left = await store.get(input.sessionId).catch(() => undefined);
-                // The dispatch's own key, or, for an unkeyed one whose turn took
-                // keyed messages in at a tool step (card 948), the key the turn has
-                // from them: its steered callers are told what a keyed caller is.
-                const key = input.idempotencyKey ?? (left === undefined ? undefined : turnKeyOf(turnMessageOf(left)));
-                if (left !== undefined && key !== undefined && workItemState(left, key) === 'unfinished' && leftForNextStart(left, error)) {
-                    throw leftForNext();
-                }
-            }
-            throw error;
-        }
-    };
-    /**
-     * `subAgent` is the narrowed definition `subAgents.run` built: the turn
-     * runs as that, on the parent's resolved provider, with no memory and no
-     * soul. Only that path passes it.
-     */
-    const dispatchInternal = async (input, absorbedKeys = [], subAgent, 
-    /**
-     * See `RunInput.steer`; passed by `dispatch` for an opted-in caller.
-     * Handed the turn's own signal — the one the runner was given, which
-     * the watchdog, `abortTurns` and a restart's window abort as well as
-     * the callers — so it takes nothing into a turn that is already
-     * stopping (card 959).
-     */
-    steer) => {
-        // Re-read on every turn, not once at start: a newer build that stamps
-        // the home while this daemon is serving has formats this build does not
-        // understand, and a daemon that kept writing into them would be the
-        // downgrade the stamp exists to refuse — from the inside. Inside the
-        // session chain, so a turn already accepted is counted by the drain
-        // before anything else runs. One small file read per turn.
-        assertStateCompatible(env);
-        // A dispatch whose signal fired while it queued behind another turn
-        // must not touch durable state: without this check, the runner would
-        // load the session, append the cancelled user message, and save it as
-        // failed — polluting future model history with input never processed.
-        if (input.signal?.aborted) {
-            throw abortErrorFor(input.signal);
-        }
-        // A session pins its agent: when the caller names none, an existing
-        // conversation keeps the agent it was created with even if the
-        // configured default soul has changed since — only a brand-new session
-        // takes the current default. (Loaded here, before the watchdog, also
-        // because whether this turn streams depends on durable session state.)
-        const existing = await store.get(input.sessionId);
-        const agentId = input.agentId ?? existing?.agent.id ?? await defaultAgentId();
-        const source = await refreshAgent(agentId);
-        const agent = subAgent ?? source.definition;
-        if (subAgent !== undefined && existing) {
-            throw new Error(`Session ${input.sessionId} already exists; a sub-agent's session is new every time.`);
-        }
-        // An archived transcript is the record of a conversation that has moved
-        // on. Continuing it would revive a session the operator deliberately
-        // left behind, under an id nothing routes to any more.
-        const continuedAs = existing?.metadata?.[ROLLED_OVER_TO_METADATA_KEY];
-        if (typeof continuedAs === 'string') {
-            throw new Error(`Session ${input.sessionId} was rolled over; it is an archived transcript and the conversation continues as ${continuedAs}.`);
-        }
-        const config = await runtimeForAgent(source);
-        const runner = runnerFor(config, source.definition.id, subAgent !== undefined);
-        // Which executor the turn's tool calls run through — the built-in
-        // under the name `stratus run` has always recorded, a contributed one
-        // under its registered name — so a transcript says where a command
-        // ran, not only which model asked for it.
-        const executorRecord = selectedExecutor && options.executor !== undefined ? options.executor : 'local-command';
-        const metadata = {
-            provider: config.provider,
-            // A contributed provider may leave the model to its own default, in
-            // which case there is none to record.
-            ...(config.provider !== 'demo' && config.model !== undefined ? { model: config.model } : {}),
-            ...input.metadata,
-            // After the caller's metadata, and reserved besides: a dispatch that
-            // could write it could make a transcript claim a sandbox ran what
-            // the host ran.
-            [EXECUTOR_METADATA_KEY]: executorRecord,
-        };
-        if (existing && existing.agent.id !== agent.id) {
-            throw crossIdentityError(input.sessionId, existing.agent.id, agent.id);
-        }
-        // A sub-agent's session is new, but may start on its parent's fallback.
-        const { switchedToFallback, effectiveStreams, fallbackStreams } = watchdogStreamsFor(existing ?? (subAgent !== undefined ? { metadata } : undefined), config);
-        // Recorded with a keyed message so a restart judges the turn by what it
-        // could have run on, not by whatever the config resolves to by then.
-        // The fallback counts: a turn can switch to it mid-run. Once a session
-        // has switched for good, the primary is never called again, and only
-        // the fallback counts.
-        const hostedLoop = input.idempotencyKey !== undefined && reachesHarness(config, switchedToFallback);
-        return settleLeftForNextStart(input, onTurnRuntime(input.sessionId, { source, config }, () => withWatchdog(input.sessionId, input.signal, effectiveStreams, fallbackStreams, async (signal) => {
-            // The preflight above (agent refresh, config resolution, session
-            // load) awaited filesystem work; the entry check has long passed.
-            // Recheck before the runner touches durable state, or a dispatch
-            // cancelled mid-preflight would still persist its user message.
-            if (signal.aborted) {
-                throw abortErrorFor(signal);
-            }
-            if (existing) {
-                // Refresh the stored definition before resuming, so the turn runs
-                // with the current instructions, tools, and credentials.
-                existing.agent = agent;
-                // A sub-session reached here is being continued from outside — a
-                // delegation never resumes its own child; its ids are minted once.
-                // The delegating turn is over, so the markers come off: what is
-                // now an ordinary conversation must not be closed as an orphan if
-                // a later turn of it parks and the daemon dies.
-                if (isDelegatedSession(existing) && existing.metadata) {
-                    existing.metadata = withoutDelegation(existing.metadata);
-                }
-                // The same for a sub-agent's session, continued as the agent itself:
-                // the marker that denies its approvals unasked comes off with the
-                // delegation markers it carries.
-                if (isSubAgentSession(existing) && existing.metadata) {
-                    const { [SUB_AGENT_METADATA_KEY]: _subAgent, ...rest } = withoutDelegation(existing.metadata);
-                    existing.metadata = rest;
-                }
-                // The executor record follows the daemon, not the session's first
-                // turn: a restart that selected another executor runs this turn's
-                // commands there, and a session from before the record existed
-                // gets one now rather than never.
-                if (existing.metadata?.[EXECUTOR_METADATA_KEY] !== executorRecord) {
-                    existing.metadata = { ...existing.metadata, [EXECUTOR_METADATA_KEY]: executorRecord };
-                }
-                // The room rides on the turn, but two readers have only the
-                // session's: a turn parked on approval and recovered after a
-                // restart, and a turn that brings no room of its own (a schedule
-                // firing into the thread). Both get the latest room this way, not
-                // the first turn's, which a channel made public since would make
-                // read as more private than it is. A turn from a channel that
-                // could not tell the room (its lookup failed) clears it instead:
-                // no room is the generic line, and an old one is a claim.
-                if (typeof input.metadata?.channel === 'string') {
-                    const room = input.metadata[CONVERSATION_METADATA_KEY];
-                    const { [CONVERSATION_METADATA_KEY]: _stale, ...rest } = existing.metadata ?? {};
-                    existing.metadata = room !== undefined ? { ...rest, [CONVERSATION_METADATA_KEY]: room } : rest;
-                }
-                await store.save(existing);
-                // The turn's metadata rides along for the sender's trust: without
-                // it a resumed turn has no way to say who sent it, and a stranger
-                // mentioning the agent in a thread the operator opened would
-                // inherit the operator's label.
-                return runner.resume({
-                    sessionId: input.sessionId,
-                    userMessage: input.userMessage,
-                    ...(input.images !== undefined ? { images: input.images } : {}),
-                    ...(input.addressed !== undefined ? { addressed: input.addressed } : {}),
-                    ...(input.replyOptional === true ? { replyOptional: true } : {}),
-                    ...(input.idempotencyKey !== undefined ? { idempotencyKey: input.idempotencyKey } : {}),
-                    ...(absorbedKeys.length > 0 ? { absorbedKeys: [...absorbedKeys] } : {}),
-                    ...(hostedLoop ? { hostedLoop } : {}),
-                    ...(input.metadata ? { metadata: input.metadata } : {}),
-                    runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata),
-                    ...(steer !== undefined ? { steer: () => steer(signal) } : {}),
-                    signal,
-                });
-            }
-            return runner.run({
-                sessionId: input.sessionId,
-                agent,
-                userMessage: input.userMessage,
-                ...(input.images !== undefined ? { images: input.images } : {}),
-                ...(input.addressed !== undefined ? { addressed: input.addressed } : {}),
-                ...(input.replyOptional === true ? { replyOptional: true } : {}),
-                ...(input.idempotencyKey !== undefined ? { idempotencyKey: input.idempotencyKey } : {}),
-                ...(absorbedKeys.length > 0 ? { absorbedKeys: [...absorbedKeys] } : {}),
-                ...(hostedLoop ? { hostedLoop } : {}),
-                ...(input.earlier !== undefined && input.earlier.length > 0 ? { earlier: input.earlier } : {}),
-                metadata,
-                runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata, subAgent !== undefined),
-                ...(steer !== undefined ? { steer: () => steer(signal) } : {}),
-                signal,
-            });
-        })));
-    };
-    /**
-     * Finishes the turns that were parked on a human when this daemon last
-     * went down.
-     *
-     * Run after the channels are up, deliberately: recovery re-asks, and a
-     * request emitted into a gateway with no live adapter would be declined
-     * for want of anywhere to put it — turning "your approval survived the
-     * restart" into "your approval was denied by the restart".
-     *
-     * Each session is recovered independently and failures are per-session:
-     * one unrecoverable turn must not stop the daemon from serving, or from
-     * recovering the others.
-     */
-    const recoverParkedTurns = async (orphaned) => {
-        if (!store.listIdsByStatus) {
-            return;
-        }
-        const parked = await store.listIdsByStatus('pending_approval');
-        if (parked.length === 0) {
-            return;
-        }
-        log(`recovering ${parked.length} turn(s) parked on approval`);
-        // Started together, not one after another. Each recovery re-asks and
-        // then waits on a human, so awaiting them in sequence would mean the
-        // second parked turn is not even *announced* until the first is
-        // answered — fifteen minutes later by default, and never at all with a
-        // zero timeout. They are independent turns; only same-session work is
-        // ordered, and onSessionChain already guarantees that.
-        await Promise.allSettled(parked.map((sessionId) => recoverOne(sessionId, orphaned.has(sessionId))));
-    };
-    /**
-     * The parked sub-sessions whose delegating turn the last process was
-     * still inside — read BEFORE the channels start, for the same reason the
-     * abandoned list is.
-     *
-     * The proof is the parent's transcript: only the runner writes an
-     * assistant `agent.delegate` call, and only a delegation in flight leaves
-     * one with no result behind it. That evidence does not survive contact
-     * with a channel, though — a message for the parent arriving once the
-     * adapters are up resumes it, and the resume closes the dangling call as
-     * interrupted. Read live from the sweep, the parent would then look as if
-     * it awaited nothing and the child would be re-asked after all, which is
-     * the bug this exists to stop. So it is read while nothing can dispatch,
-     * and the sweep judges from the snapshot; a child whose parent is missing
-     * or not inside such a call is left to ordinary recovery.
-     *
-     * Matched call by call, not parent by parent: the call that awaits a
-     * child names it (see `outstandingDelegationFor`), and a call can await
-     * only one. Two parked children claiming the same call — one of them a
-     * sub-session continued from outside under a version that kept its
-     * markers, parked again on something of its own — is an ambiguity this
-     * cannot settle, and both are left to ordinary recovery rather than one
-     * of them being failed for a delegation that was never its.
-     */
-    const listOrphanedDelegations = async () => {
-        const claimants = new Map();
-        if (!store.listIdsByStatus) {
-            return new Set();
-        }
-        for (const sessionId of await store.listIdsByStatus('pending_approval')) {
-            const parentId = delegatingSessionIdOf(sessionId);
-            if (parentId === undefined) {
-                continue;
-            }
-            const session = await store.get(sessionId);
-            if (!session || !isDelegatedSession(session)) {
-                continue;
-            }
-            const parent = await store.get(parentId);
-            const callId = parent ? outstandingDelegationFor(parent, session) : undefined;
-            if (callId !== undefined) {
-                const key = `${parentId}\u0000${callId}`;
-                claimants.set(key, [...(claimants.get(key) ?? []), sessionId]);
-            }
-        }
-        return new Set([...claimants.values()].filter((ids) => ids.length === 1).map(([id]) => id));
-    };
-    const recoverOne = (sessionId, orphaned) => onSessionChain(sessionId, () => recoverParked(sessionId, orphaned));
-    /**
-     * `recoverOne`'s work, for a caller already on the session's chain: a
-     * repeated idempotency key that reached the chain before the parked sweep
-     * did, and would otherwise wait on a turn nothing is running yet.
-     */
-    const recoverParked = async (sessionId, orphaned) => {
-        if (stopping) {
-            return;
-        }
-        try {
-            const session = await store.get(sessionId);
-            if (!session) {
-                return;
-            }
-            const record = readPendingApproval(session);
-            // A delegated sub-session is only ever awaited by its parent's
-            // `agent.delegate` call, and that parent was running when the last
-            // process died — it is in the abandoned sweep, not in this one.
-            // Nothing will read the reply, so the parked call is not re-asked:
-            // a person would be approving a command that runs for no one.
-            //
-            // Judged on the re-read, on the chain: the channels are up before
-            // this sweep starts, so a message for this id can have taken the
-            // chain first and moved the session on — and a turn that finished
-            // normally must not be rewritten as failed. The delegation metadata
-            // is durable, so it proves what the session is, not what state it
-            // is in; the status and the checkpoint say that.
-            //
-            // Whether it IS an orphan was decided before the channels started
-            // (`listOrphanedDelegations`), from the parent's transcript, which
-            // a message arriving since may already have rewritten.
-            // A sub-agent never parks (nobody is asked for it), and if one ever
-            // did, its parent's turn died with the last process: nothing would
-            // read its answer, and recovering it would run it as the full agent.
-            if (isSubAgentSession(session) && session.status === 'pending_approval') {
-                log(`${sessionId}: a sub-agent parked when the last stratusd stopped; failing it`);
-                await failParked(session, ABANDONED_TURN_ERROR);
-                return;
-            }
-            if (orphaned && isDelegatedSession(session) && session.status === 'pending_approval' && record) {
-                log(`${sessionId}: parked on ${record.call.toolName} for a delegating turn the last stratusd was still running; failing it`);
-                await failOrphanedDelegation(session);
-                return;
-            }
-            // A wait that outlived its window while the daemon was down is
-            // honoured, not restarted: the request really did go unanswered for
-            // the whole time it was configured to wait, and downtime is not a
-            // reason to extend a security decision. Measured from when the turn
-            // parked against this daemon's timeout — the transport's original
-            // deadline was chosen after the checkpoint was written and is gone
-            // with the process that chose it. Denying goes through the same
-            // recovery path, so the queue behind it still drains.
-            const parkedAt = record ? Date.parse(record.parkedAt) : Number.NaN;
-            const expired = effectiveApprovalTimeoutMs > 0
-                && Number.isFinite(parkedAt)
-                && Date.now() - parkedAt >= effectiveApprovalTimeoutMs;
-            if (expired) {
-                log(`${sessionId}: the approval for ${record?.call.toolName} outlived its window while the daemon was down; denying it`);
-            }
-            // Resolved the way a dispatch for this agent would resolve it, so a
-            // recovered turn finishes on the same provider, model, and
-            // credentials it was parked on.
-            const source = await refreshAgent(session.agent.id);
-            // And on the CURRENT definition, saved before recovery reads the
-            // session back. An allowlist is a permission boundary: a soul that
-            // dropped a tool while the daemon was down must not have that tool
-            // executed by the turn that outlived the change, and
-            // `allowedToolsFor` reads the definition frozen into the session
-            // ahead of the registry. Dispatch refreshes it the same way before
-            // resuming.
-            session.agent = source.definition;
-            await store.save(session);
-            const recoveredConfig = await runtimeForAgent(source);
-            const runner = runnerFor(recoveredConfig, source.definition.id);
-            // Tracked like a dispatched turn's controller: a recovered turn that
-            // runs on past its approval is a turn like any other, so a restart's
-            // window has to be able to cut it short with the same reason (or it
-            // runs unseen to the second window and the restart reports
-            // undrained), and a stop for the session has to find it. Only once
-            // the checkpoint has been read on this chain, right before the runner
-            // takes it: a stop counted then always ends in the turn's own
-            // outcome. A stop sent during the reads above finds nothing running
-            // and reaches the session as an ordinary message, queued behind it.
-            const controller = new AbortController();
-            if (record) {
-                trackTurn(sessionId, controller);
-                if (abortingWith !== undefined) {
-                    controller.abort(shutdownAbort());
-                }
-            }
-            try {
-                await onTurnRuntime(sessionId, { source, config: recoveredConfig }, () => runner.recoverPendingApproval(sessionId, {
-                    denyPending: expired,
-                    runtime: runtimeContextFor(source, recoveredConfig, session.metadata?.[FALLBACK_ACTIVE_METADATA_KEY] === true, session.metadata),
-                    signal: controller.signal,
-                }));
-            }
-            finally {
-                untrackTurn(sessionId, controller);
-                // A recovered firing's row outlived the process that would have
-                // retired it, and the firing is over either way — a recovery that
-                // failed has durably failed its session, which is as finished as
-                // completing. The scheduler decides whether there is a row to
-                // retire, and only this firing's own.
-                const scheduleId = session.metadata?.[SCHEDULE_ID_METADATA_KEY];
-                if (typeof scheduleId === 'string') {
-                    scheduler.retireSpentOneShot(scheduleId, sessionId);
-                }
-            }
-        }
-        catch (error) {
-            warn(`could not recover parked session ${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
-            // A keyed item is a promise to its caller, and one whose recovery
-            // cannot even start (its agent gone, its provider unresolvable) would
-            // otherwise stay parked for every later start and redelivery to try
-            // again. An unkeyed one keeps waiting for a sweep that can, as before.
-            const after = await store.get(sessionId).catch(() => undefined);
-            const key = after === undefined ? undefined : turnKeyOf(turnMessageOf(after));
-            if (after !== undefined && key !== undefined && after.status === 'pending_approval' && workItemState(after, key) === 'unfinished') {
-                await failParked(after, ABANDONED_TURN_ERROR).catch(() => { });
-            }
-        }
-    };
-    /**
-     * Closes an orphaned sub-session the way the abandoned sweep closes its
-     * parent: durably failed, with the checkpoint retired so no later sweep
-     * can find a call to re-enter, and announced where surfaces can hear it.
-     */
-    const failOrphanedDelegation = (session) => failParked(session, ORPHANED_DELEGATION_ERROR);
-    const failParked = async (session, error) => {
-        const metadata = { ...(session.metadata ?? {}) };
-        delete metadata[PENDING_APPROVAL_METADATA_KEY];
-        session.metadata = metadata;
-        recordTurnFailure(session, error);
-        await store.save(session);
-        await bus.emit({ type: 'session.updated', sessionId: session.id, status: 'failed' });
-        await bus.emit({ type: 'session.failed', sessionId: session.id, error });
-    };
-    /**
-     * Turns the last process was still running when it stopped being able to
-     * finish them.
-     *
-     * `pending_approval` is the one window a turn can be picked up from, and
-     * it has its own sweep above. Everything else a turn does is saved as
-     * `running`: the provider call, the executor, and — on a provider that
-     * hosts its own loop — the approval wait too, since a hosted call is
-     * deliberately not checkpointed (`executeHostedToolCall` passes
-     * `recoverable: false`, because the SDK's inner loop is not something a
-     * restart can rebuild). None of those can be re-entered where they
-     * stopped, and nothing else sweeps them, so the record would go on
-     * claiming the turn is running for as long as the session exists. A turn
-     * whose caller gave it an idempotency key is continued from its
-     * transcript instead, with its dangling calls closed as interrupted
-     * (`settleAbandonedTurn`); the rest are failed.
-     *
-     * Note what this is *not* for. A graceful stop denies everything parked
-     * and drains the turns those denials release, so an operator restarting
-     * the daemon normally has nothing here. These are the turns a crash, a
-     * SIGKILL, or a lost machine left behind.
-     */
-    const listAbandonedTurns = async () => {
-        if (!store.listIdsByStatus) {
-            return [];
-        }
-        return store.listIdsByStatus('running');
-    };
-    /**
-     * Settles each of them — continued if keyed, otherwise marked failed with
-     * a reason that says what happened.
-     *
-     * Read BEFORE the channels start and applied after, which is the only
-     * ordering that is both honest and safe. Reading first means the list is
-     * exactly what the last process left, with no chance of a turn this
-     * process started being in it. Applying after means the failure is
-     * emitted into a gateway whose surfaces are listening, rather than into
-     * one where nothing is.
-     *
-     * The gap between the two is real, though: an inbound message for one of
-     * these sessions can arrive as soon as the channels are up. What makes
-     * that safe is single-flight — every writer of a session goes through
-     * `onSessionChain`, so this runs either wholly before that turn (it
-     * fails, and `resume()` then clears `lastError` and starts fresh) or
-     * wholly after it (the status has moved off `running`, and the re-read
-     * below leaves it alone). There is no interleaving in which this
-     * overwrites a live turn.
-     *
-     * What that invariant does NOT cover is a second daemon on the same
-     * database, whose turns are running with no chain of ours in front of
-     * them. Two processes sharing a session store is already unsupported —
-     * the parked sweep above would re-ask that daemon's approvals for the
-     * same reason — and no check here would make it supported.
-     */
-    const failAbandonedTurns = async (abandoned) => {
-        if (abandoned.length === 0) {
-            return;
-        }
-        log(`settling ${abandoned.length} turn(s) left running by the last stratusd`);
-        await Promise.allSettled(abandoned.map((id) => failAbandonedTurn(id)));
-    };
-    const failAbandonedTurn = (id) => onSessionChain(id, async () => {
-        if (stopping) {
-            return;
-        }
-        try {
-            const session = await store.get(id);
-            // Re-read on the chain, because the snapshot is from before the
-            // channels came up: a message that arrived since has already taken
-            // this session somewhere else, and that turn owns it now.
-            if (!session || session.status !== 'running') {
-                return;
-            }
-            await settleAbandonedTurn(session);
-        }
-        catch (error) {
-            warn(`could not settle abandoned turn ${id}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    });
-    /**
-     * A turn left `running` with nothing running it, read on its chain.
-     *
-     * One whose message carries an idempotency key is a work item its caller
-     * was promised would finish, so it is continued from the transcript
-     * (`AgentRunner.continueTurn`) — once. A turn that already was, and is
-     * here again, took the last process down with it, and continuing it again
-     * would do the same on every start; it is failed like an unkeyed one,
-     * whose caller was never promised anything and is told to send again.
-     */
-    const settleAbandonedTurn = async (session) => {
-        const message = turnMessageOf(session);
-        if (message === undefined || turnKeyOf(message) === undefined) {
-            return failAbandoned(session);
-        }
-        // An answer already in the transcript is completed whatever came before
-        // — a second crash, a harness, an agent or provider gone since —
-        // because completing it needs none of them and runs nothing again;
-        // failing it would throw away a finished reply.
-        if (lastResponseIsAnswer(session)) {
-            log(`${session.id}: a keyed turn the last stratusd was running had saved its answer; completing it`);
-            return completeAnsweredTurn(session, store, bus);
-        }
-        if (message.continuedAfterCrash === true) {
-            return failAbandoned(session);
-        }
-        if (message.hostedLoop === true) {
-            log(`${session.id}: a keyed turn the last stratusd was running could reach a harness, which cannot be continued; failing it`);
-            return failAbandoned(session);
-        }
-        return continueAbandonedTurn(session);
-    };
-    const failAbandoned = async (session) => {
-        recordTurnFailure(session, ABANDONED_TURN_ERROR);
-        await store.save(session);
-        await bus.emit({ type: 'session.updated', sessionId: session.id, status: 'failed' });
-        await bus.emit({ type: 'session.failed', sessionId: session.id, error: ABANDONED_TURN_ERROR });
-        return session;
-    };
+    let orphanedAtStart = new Set();
     /**
-     * Continues an abandoned turn on the configuration a dispatch for its
-     * agent would resolve now, and under the same watchdog — it is a provider
-     * call like any turn's. The definition is refreshed and saved first, as
-     * `recoverOne` does and for the same reason: an allowlist is a permission
-     * boundary, and a tool dropped while the daemon was down must not run.
+     * The runtime one agent would run on right now — config snapshot, soul
+     * pins, degradation and all.
      *
-     * Not on a harness (`runsOnHarness`) — neither one the turn could have
-     * run on (`Message.hostedLoop`, recorded when it was accepted) nor one it
-     * would continue on. A harness runs its own tool loop inside a single
-     * provider call and keeps its own conversation, so the prompt the dead
-     * turn sent may already have run tools there that the transcript never
-     * saw, and continuing would send it again. That turn is failed as an
-     * unkeyed one is — the same answer as before keys existed. (A turn whose
-     * answer is already saved never gets here: `settleAbandonedTurn`
-     * completes it first.)
+     * Extracted so recovery resolves it exactly as a dispatch does. A second
+     * copy of this chain is the difference between a recovered turn finishing
+     * on its agent's provider and finishing on the daemon's default, and it
+     * would drift the first time either side gained a rule.
      */
-    const continueAbandonedTurn = async (session) => {
-        // Its parent's turn died with the last process, and continuing it here
-        // would run it as the full agent. (Sub-agent turns carry no key today,
-        // so this is a guard, not a path.)
-        if (isSubAgentSession(session)) {
-            return failAbandoned(session);
-        }
-        // Settled either way: a turn whose agent left the roster, or whose
-        // provider no longer resolves, must not stay `running` for every later
-        // start and every redelivery to find unfinished and trip over again.
-        let source;
-        let config;
+    const runtimeForAgent = async (source) => {
+        // Config re-resolves per dispatch, so a changed model, credential, or
+        // soul pin applies without a restart. The pool dedupes runners by the
+        // resolved configuration. The gateway-wide selection and the daemon's
+        // environment are defaults, not overrides: resolveRuntimeConfig gives
+        // both higher precedence than the soul (they are explicit flags and
+        // env vars on the CLI), so any default the soul pins over is dropped
+        // here — an agent pinned to a provider keeps it whatever the gateway
+        // was started with, and a default model never rides along to a
+        // different provider than it was chosen for.
+        const selection = { ...options.selection };
+        let resolveEnv = env;
+        // One config read per dispatch, through a last-known-good cache: a
+        // config.json an operator saved mid-edit must neither fail dispatches
+        // (a daemon keeps serving) nor silently change what it configured —
+        // discarding a broken config wholesale would flip a config-provided
+        // provider back to the demo default, durably recording canned replies
+        // in a real conversation. With no known-good snapshot to fall back
+        // on, failing is the honest outcome. Credential and provider errors
+        // are never masked — only the file itself degrades.
+        let configSnapshot;
         try {
-            source = await refreshAgent(session.agent.id);
-            config = await runtimeForAgent(source);
+            const location = await resolveConfigLocation(options.selection?.configPath ? { configPath: options.selection.configPath } : {}, env);
+            configSnapshot = location
+                ? { config: await loadConfigFile(location.path), trusted: location.trusted, path: location.path }
+                : { config: {}, trusted: true };
+            lastGoodConfigSnapshot = configSnapshot;
         }
         catch (error) {
-            log(`${session.id}: a keyed turn the last stratusd was running cannot be continued (${error instanceof Error ? error.message : String(error)}); failing it`);
-            return failAbandoned(session);
-        }
-        const { switchedToFallback, effectiveStreams, fallbackStreams } = watchdogStreamsFor(session, config);
-        // The message's own record covers the runtimes the turn could have run
-        // on; this covers the ones it would continue on — a fallback included —
-        // which a changed config may make a harness.
-        if (reachesHarness(config, switchedToFallback)) {
-            log(`${session.id}: a keyed turn the last stratusd was running would continue on a harness; failing it`);
-            return failAbandoned(session);
-        }
-        log(`${session.id}: continuing a keyed turn the last stratusd was still running`);
-        session.agent = source.definition;
-        await store.save(session);
-        const runner = runnerFor(config, source.definition.id);
-        return onTurnRuntime(session.id, { source, config }, () => withWatchdog(session.id, undefined, effectiveStreams, fallbackStreams, async (signal) => await runner.continueTurn(session.id, {
-            runtime: runtimeContextFor(source, config, switchedToFallback, session.metadata),
-            signal,
-        }) ?? session));
-    };
-    /**
-     * A repeated idempotency key that reached the session's chain, so nothing
-     * else is running on the session. `undefined` means the key is new here
-     * and the dispatch runs as any other; otherwise this is the session to
-     * resolve with, and no new turn starts.
-     *
-     * An unfinished item here has no live turn — the live map would have
-     * answered first — so it is one the last process left, reached before
-     * the start-up sweep that would have settled it: settled now, the way
-     * that sweep would, which then finds it no longer needs anything.
-     */
-    const settleRepeat = async (sessionId, idempotencyKey, agentId, turnId, onRepeat) => {
-        const session = await store.get(sessionId);
-        if (session === undefined) {
-            return undefined;
-        }
-        // Before anything is returned: the turn a dispatch would run is refused
-        // for naming another agent, and the one it would repeat is no less that
-        // agent's — a repeat is not a way to read its transcript.
-        if (agentId !== undefined && session.agent.id !== agentId) {
-            throw crossIdentityError(sessionId, session.agent.id, agentId);
-        }
-        const state = workItemState(session, idempotencyKey);
-        if (state === undefined) {
-            const archived = await archivedRepeat(session, idempotencyKey);
-            if (archived !== undefined) {
-                onRepeat?.('finished');
+            if (!(error instanceof ConfigFileError) || !lastGoodConfigSnapshot) {
+                throw error;
             }
-            return archived;
-        }
-        if (state === 'finished') {
-            onRepeat?.('finished');
-            return session;
-        }
-        // Run now, on this caller's behalf, so its events are this caller's
-        // turn — the adapter waiting on them has no other way to claim them.
-        if (turnId !== undefined) {
-            activeTurns.set(sessionId, turnId);
+            warn(`${error.message}; using the last known-good config`);
+            configSnapshot = lastGoodConfigSnapshot;
         }
-        try {
-            return await settleUnfinished(session);
+        selection.presetConfig = configSnapshot;
+        const pins = source.soul;
+        if (pins) {
+            // One soul read per dispatch: resolution uses the exact snapshot
+            // refreshAgent just loaded and identity-checked. Handing the path
+            // to resolveRuntimeConfig instead would read the file a second
+            // time, racing a concurrent replacement — this turn could keep one
+            // agent's definition while adopting another's provider pins.
+            const normalized = applySoulPins(pins, selection, env, {
+                ...(options.selection?.provider !== undefined ? { selectionProvider: options.selection.provider } : {}),
+                ...(configSnapshot.config.provider !== undefined ? { configProvider: configSnapshot.config.provider } : {}),
+                configPresent: configSnapshot.path !== undefined,
+            });
+            resolveEnv = normalized.env;
         }
-        finally {
-            if (turnId !== undefined) {
-                activeTurns.delete(sessionId);
-            }
+        else {
+            // A soul-less agent (the built-in default) resolves with no soul at
+            // all: the config file's default soul belongs to another identity —
+            // and when the default route degrades to the built-in, it is exactly
+            // because that file is currently unusable.
+            selection.presetSoul = null;
         }
+        // The preset snapshot means resolution reads no config file — every
+        // failure from here is a credential or provider problem and surfaces.
+        return resolveRuntimeConfig(selection, resolveEnv);
     };
     /**
-     * The archived transcript holding a key the live row does not, when the
-     * row is a rollover's fresh one made inside `ROLLOVER_REPEAT_WINDOW_MS`.
-     * Only the one rollover back: a second inside the window is a redelivery
-     * outliving two deliberate resets, and the chain is not walked for it.
-     * Always finished — a rollover refuses a session with a turn in flight.
+     * Whether the turn about to run streams deltas, which arms the idle
+     * watchdog — on the sticky fallback when the session already switched to
+     * it, since that is the provider the turn will be served by.
      */
-    const archivedRepeat = async (session, idempotencyKey) => {
-        const archivedAs = session.metadata?.[ROLLED_OVER_FROM_METADATA_KEY];
-        if (typeof archivedAs !== 'string' || Date.now() - Date.parse(session.createdAt) > ROLLOVER_REPEAT_WINDOW_MS) {
-            return undefined;
-        }
-        const archived = await store.get(archivedAs);
-        return archived !== undefined && workItemState(archived, idempotencyKey) !== undefined ? archived : undefined;
-    };
-    /** An unfinished item with no live turn, settled the way the start-up sweeps would. */
-    const settleUnfinished = async (session) => {
-        if (session.status === 'pending_approval') {
-            await recoverParked(session.id, orphanedAtStart.has(session.id));
-            return (await store.get(session.id)) ?? session;
-        }
-        return settleAbandonedTurn(session);
+    const watchdogStreamsFor = (session, config) => {
+        const switchedToFallback = session?.metadata?.[FALLBACK_ACTIVE_METADATA_KEY] === true;
+        const fallbackStreams = config.provider !== 'demo' && config.fallback
+            ? fallbackStreamsDeltas(config.fallback)
+            : false;
+        const effectiveStreams = switchedToFallback && config.provider !== 'demo' && config.fallback
+            ? fallbackStreamsDeltas(config.fallback)
+            : streamsDeltas(config);
+        return { switchedToFallback, effectiveStreams, fallbackStreams };
     };
     /**
-     * What a running turn takes in at its next tool step (card 948): the
-     * merged-turn batch waiting behind it, whole — leader and absorbed alike
-     * — when it is for the same agent. The dispatches it takes join `into`,
-     * which the running turn settles with its own outcome (`runSteerable`).
-     *
-     * A part cancelled while it waited is refused, as `runMerged` refuses it.
-     * A part whose key this session (or the archive it rolled over from)
-     * already holds is a repeat, and judging a repeat can mean settling a
-     * turn — never something to do from inside one — so such a batch is not
-     * taken: it waits and runs next, merged, where that is judged. Nor while
-     * the gateway is stopping, when the batch is what the drain refuses.
+     * Whether a turn on this config could be served by a harness
+     * (`runsOnHarness`): the primary or, since a turn can switch mid-run, the
+     * fallback. Once a session has switched for good the primary is never
+     * called again, and only the fallback counts.
      */
-    const takeSteered = async (sessionId, agentId, into, 
+    const reachesHarness = (config, switchedToFallback) => {
+        const fallback = config.provider !== 'demo' ? config.fallback : undefined;
+        return switchedToFallback && fallback !== undefined
+            ? runsOnHarness(fallback)
+            : runsOnHarness(config) || (fallback !== undefined && runsOnHarness(fallback));
+    };
     /**
-     * Asked last, with nothing awaited after it: whether the running turn
-     * still takes these callers, joining them to its cancellation if so. A
-     * turn cancelled while the store was read takes nothing, and the batch
-     * waits and runs next, as it would have.
+     * A keyed turn the shutdown cut short and the runner left for the next
+     * start (`leftForNextStart`): its caller is told so, the way a message
+     * refused at the door is, and keeps it for the next daemon, which
+     * continues the turn. Read back on the chain, so it is this dispatch's
+     * own message the session is still running on.
      */
-    admit) => {
-        const batch = openBatches.get(sessionId);
-        if (stopping || batch === undefined || !batch.firstInLine || batch.agentId !== agentId) {
-            return undefined;
+    const settleLeftForNextStart = async (input, turn) => {
+        try {
+            return await turn;
         }
-        // Until every key in it is checked with nothing awaited since: a message
-        // can join while the store is read, and is checked on the next pass; a
-        // batch closed meanwhile is no longer this turn's to take.
-        const checked = new Set();
-        let session;
-        for (;;) {
-            if (stopping || openBatches.get(sessionId) !== batch) {
-                return undefined;
-            }
-            const unchecked = [batch.leader, ...batch.absorbed].flatMap((part) => (part.input.idempotencyKey !== undefined && !checked.has(part.input.idempotencyKey) ? [part.input.idempotencyKey] : []));
-            if (unchecked.length === 0) {
-                break;
-            }
-            session ??= await store.get(sessionId);
-            for (const key of unchecked) {
-                checked.add(key);
-                if (session !== undefined && (workItemState(session, key) !== undefined || await archivedRepeat(session, key) !== undefined)) {
-                    return undefined;
+        catch (error) {
+            if (error instanceof RunAbortedError && error.resumable) {
+                const left = await store.get(input.sessionId).catch(() => undefined);
+                // The dispatch's own key, or, for an unkeyed one whose turn took
+                // keyed messages in at a tool step (card 948), the key the turn has
+                // from them: its steered callers are told what a keyed caller is.
+                const key = input.idempotencyKey ?? (left === undefined ? undefined : turnKeyOf(turnMessageOf(left)));
+                if (left !== undefined && key !== undefined && workItemState(left, key) === 'unfinished' && leftForNextStart(left, error)) {
+                    throw leftForNext();
                 }
             }
+            throw error;
         }
-        const all = [batch.leader, ...batch.absorbed];
-        if (!admit(all.filter((part) => part.input.signal?.aborted !== true))) {
-            return undefined;
-        }
-        openBatches.delete(sessionId);
-        batch.steered = true;
-        // Its place on the chain runs nothing now, so it is not ahead of a batch
-        // opening behind it, which can then be steered at a later step.
-        releaseQueued(sessionId);
-        // Not waiting any more; the leader's place on the chain does not count it again.
-        const left = (waitingDispatches.get(sessionId) ?? all.length) - all.length;
-        if (left > 0) {
-            waitingDispatches.set(sessionId, left);
-        }
-        else {
-            waitingDispatches.delete(sessionId);
-        }
-        const runnable = [];
-        for (const part of all) {
-            if (part.input.signal?.aborted) {
-                part.reject(abortErrorFor(part.input.signal));
-                continue;
-            }
-            runnable.push(part);
-        }
-        if (runnable.length === 0) {
-            return undefined;
-        }
-        const keys = runnable.flatMap((part) => (part.input.idempotencyKey !== undefined ? [part.input.idempotencyKey] : []));
-        const items = liveWorkItems.get(sessionId);
-        for (const key of keys) {
-            const item = items?.get(key);
-            if (item !== undefined) {
-                item.confirmed = true;
-            }
-        }
-        into.push(...runnable);
-        const labelled = runnable.some((part) => part.input.metadata !== undefined && SENDER_TRUST_METADATA_KEY in part.input.metadata);
-        const lowest = leastTrusted(...runnable.map((part) => senderTrustOf(part.input.metadata)));
-        const images = runnable.flatMap((part) => part.input.images ?? []);
-        log(`${sessionId}: ${runnable.length} message(s) sent during the running turn reached it at its next step`);
-        return {
-            userMessage: runnable.map((part) => part.input.userMessage).join(MERGED_SEPARATOR),
-            ...(images.length > 0 ? { images } : {}),
-            ...(labelled ? { metadata: { [SENDER_TRUST_METADATA_KEY]: lowest } } : {}),
-            ...(keys.length > 0 ? { keys } : {}),
-        };
     };
+    // `selectedExecutor` is read late: plugins set it when they start.
+    const { dispatchInternal } = createTurnDispatch({
+        options,
+        env,
+        store,
+        getSelectedExecutor: () => selectedExecutor,
+        defaultAgentId,
+        refreshAgent,
+        runtimeContextFor,
+        runnerFor,
+        withWatchdog,
+        onTurnRuntime,
+        runtimeForAgent,
+        watchdogStreamsFor,
+        reachesHarness,
+        settleLeftForNextStart,
+    });
+    // `stopping`, `abortingWith` and `orphanedAtStart` are read late, and
+    // `onSessionChain` is declared further down.
+    const { recoverParkedTurns, listOrphanedDelegations, listAbandonedTurns, failAbandonedTurns, settleRepeat, archivedRepeat, settleUnfinished, } = createRecovery({
+        log,
+        warn,
+        bus,
+        store,
+        scheduler,
+        effectiveApprovalTimeoutMs,
+        refreshAgent,
+        runtimeContextFor,
+        runnerFor,
+        withWatchdog,
+        isStopping: () => stopping,
+        trackTurn,
+        untrackTurn,
+        getAbortingWith: () => abortingWith,
+        shutdownAbort,
+        activeTurns,
+        onTurnRuntime,
+        getOrphanedAtStart: () => orphanedAtStart,
+        runtimeForAgent,
+        watchdogStreamsFor,
+        reachesHarness,
+        onSessionChain: (...args) => onSessionChain(...args),
+    });
+    // `stopping` is read late: it is set at shutdown.
+    const { takeSteered } = createSteering({
+        log,
+        store,
+        releaseQueued,
+        waitingDispatches,
+        isStopping: () => stopping,
+        liveWorkItems,
+        openBatches,
+        archivedRepeat,
+    });
     /**
      * Settles a keyed item the last process left unfinished before any other
      * message joins its session. Channels are up before the sweeps reach it,
@@ -3661,448 +2010,25 @@ export const createGateway = (options = {}) => {
             return dispatchInternal(input);
         });
     };
-    const dispatch = async (input) => {
-        if (stopping) {
-            throw refusal();
-        }
-        // The reserved namespace is the scheduler's alone. A caller that could
-        // name a firing's session id — derivable from `GET /schedules` — would
-        // otherwise queue a turn of its own behind the firing (single-flight)
-        // and run inside the grant, using `message.send` to the schedule's
-        // approved destination without its own approval. Refused here, at the
-        // one door every external dispatch comes through.
-        if (isScheduleSessionId(input.sessionId)) {
-            throw new Error(`Session ids beginning with "${SCHEDULE_SESSION_ID_PREFIX}" are reserved for scheduled firings and cannot be dispatched externally.`);
-        }
-        // The daemon's own bookkeeping keys, by the same logic as the reserved
-        // id namespace above: what the runner, the scheduler, and delegation
-        // record about a session must be something only they can have written.
-        const reserved = reservedSessionMetadataKey(input.metadata);
-        if (reserved !== undefined) {
-            throw new Error(`Session metadata key "${reserved}" is reserved for the daemon's own records and cannot be supplied by a dispatch. Reserved keys: ${RESERVED_SESSION_METADATA_KEYS.join(', ')}.`);
-        }
-        const { turnId, idempotencyKey } = input;
-        if (idempotencyKey !== undefined && (idempotencyKey.length === 0 || idempotencyKey.length > MAX_IDEMPOTENCY_KEY_LENGTH)) {
-            throw new Error(`An idempotency key is 1 to ${MAX_IDEMPOTENCY_KEY_LENGTH} characters; this one is ${idempotencyKey.length}.`);
-        }
-        // A repeat of a dispatch still queued or running is that dispatch: it
-        // resolves with it rather than queueing behind it, which would let
-        // another caller's turn land in between and then find a finished item.
-        // Attached only when it names no other agent than the live dispatch
-        // did; otherwise it queues, and `settleRepeat` refuses it there.
-        const live = idempotencyKey !== undefined ? liveWorkItems.get(input.sessionId)?.get(idempotencyKey) : undefined;
-        // A claim naming an agent other than this delivery does, that the chain
-        // has not yet confirmed — this delivery naming nobody, or someone else.
-        // The claim may be refused for who it named, and then the item is still
-        // unowned: inheriting the refusal would drop a valid message, and
-        // queueing behind it would leave this delivery to find the turn that a
-        // later valid delivery runs `finished`, and answer it twice. So it
-        // waits for the claim to settle and decides then: a claim that stood
-        // is repeated, by a delivery naming its owner or nobody, and refuses
-        // anyone else; a claim that left the item unowned is dispatched again,
-        // where the first delivery to get there runs it and the rest attach.
-        if (live !== undefined && !live.confirmed && live.agentId !== undefined && input.agentId !== live.agentId) {
-            const claim = live.turn;
-            const claimedBy = input.agentId;
-            const repeatOf = (owner) => {
-                if (claimedBy !== undefined && claimedBy !== owner) {
-                    throw crossIdentityError(input.sessionId, owner, claimedBy);
-                }
-                input.onRepeat?.('live');
-            };
-            return claim.then((session) => {
-                repeatOf(session.agent.id);
-                return session;
-            }, async (error) => {
-                // Refused for who it named, or failed before its keyed message was
-                // ever written (an agent gone, a provider it could not build): the
-                // item is still unowned, and there is no turn to have repeated.
-                const stored = error instanceof CrossIdentityError || idempotencyKey === undefined ? undefined : await store.get(input.sessionId);
-                const owned = stored !== undefined && idempotencyKey !== undefined && workItemState(stored, idempotencyKey) !== undefined;
-                if (owned) {
-                    repeatOf(stored.agent.id);
-                    throw error;
-                }
-                // Its own cleanup runs a tick later; the dispatch below must not
-                // find the dead claim still standing and wait on it again.
-                const items = liveWorkItems.get(input.sessionId);
-                if (idempotencyKey !== undefined && items?.get(idempotencyKey)?.turn === claim) {
-                    items.delete(idempotencyKey);
-                    if (items.size === 0) {
-                        liveWorkItems.delete(input.sessionId);
-                    }
-                }
-                return dispatch(input);
-            });
-        }
-        if (live !== undefined && (input.agentId === undefined || input.agentId === live.agentId)) {
-            input.onRepeat?.('live');
-            return live.turn;
-        }
-        // The one door every external dispatch comes through, so a pause holds
-        // for every channel at once. Work already accepted is not behind this
-        // check: a turn running, a redelivery of a message whose turn is live
-        // (answered above), a message queued behind it, a delegation or
-        // an approval resuming a parked turn all go on.
-        if (intakeState.paused) {
-            throw new IntakePausedError(intakeState.message ?? DEFAULT_PAUSED_MESSAGE);
-        }
-        if (heldState) {
-            throw new IntakePausedError(HELD_MESSAGE);
-        }
-        // The live dispatch named no agent, so whose session it is is known
-        // only once its turn resolves. Queueing instead would make this a
-        // `finished` repeat of a turn the live caller is still rendering — two
-        // answers — so it attaches, and is held to the agent it named then:
-        // told it repeated only if that agent owns the session, refused if not.
-        const claimed = input.agentId;
-        if (live !== undefined && live.agentId === undefined && claimed !== undefined) {
-            const shared = live.turn;
-            // Whichever way the turn ends: a failed one is still that agent's,
-            // its owner read from the store, and a repeat of it is still told so
-            // — or refused, rather than handed another agent's error.
-            const attach = async () => {
-                let outcome;
-                try {
-                    outcome = { session: await shared };
-                }
-                catch (error) {
-                    outcome = { error };
-                }
-                const owner = 'session' in outcome ? outcome.session.agent.id : (await store.get(input.sessionId))?.agent.id;
-                if (owner !== undefined && owner !== claimed) {
-                    throw crossIdentityError(input.sessionId, owner, claimed);
-                }
-                // No owner means the dispatch failed before its session was ever
-                // written: there is no turn to have repeated, only its error.
-                if (owner !== undefined) {
-                    input.onRepeat?.('live');
-                }
-                if ('error' in outcome) {
-                    throw outcome.error;
-                }
-                return outcome.session;
-            };
-            return attach();
-        }
-        // Merged turns (card 423): an opted-in message behind a running turn
-        // joins the batch already waiting, if there is one for the same agent.
-        const mergeable = input.onAbsorbed !== undefined && input.addressed !== false;
-        const open = openBatches.get(input.sessionId);
-        if (mergeable &&
-            open !== undefined &&
-            open.agentId === input.agentId &&
-            fitsReplayBudget([...open.images, ...(input.images ?? [])]) &&
-            open.chars + MERGED_SEPARATOR.length + input.userMessage.length <= MERGED_TEXT_BUDGET_CHARS) {
-            open.images.push(...(input.images ?? []));
-            open.chars += MERGED_SEPARATOR.length + input.userMessage.length;
-            waitingDispatches.set(input.sessionId, (waitingDispatches.get(input.sessionId) ?? 0) + 1);
-            const joined = new Promise((resolve, reject) => {
-                open.absorbed.push({ input, resolve, reject });
-            });
-            if (idempotencyKey !== undefined) {
-                // Provisional, like a queued dispatch's: a redelivery while it waits
-                // attaches here; the merged turn confirms it once it owns the key.
-                const items = liveWorkItems.get(input.sessionId) ?? new Map();
-                if (!items.has(idempotencyKey)) {
-                    items.set(idempotencyKey, { turn: joined, agentId: input.agentId, confirmed: false, addressed: true });
-                    liveWorkItems.set(input.sessionId, items);
-                }
-                void joined.catch(() => { }).finally(() => {
-                    const current = liveWorkItems.get(input.sessionId);
-                    if (current?.get(idempotencyKey)?.turn === joined) {
-                        current.delete(idempotencyKey);
-                        if (current.size === 0) {
-                            liveWorkItems.delete(input.sessionId);
-                        }
-                    }
-                });
-            }
-            return joined;
-        }
-        // It cannot join (or its images or text would overflow the batch's
-        // budget), so the open batch takes no more: a message arriving
-        // after this one must not be answered ahead of it.
-        if (open !== undefined) {
-            openBatches.delete(input.sessionId);
-        }
-        // Otherwise it leads a new batch, if it is waiting behind a turn at all:
-        // a message to an idle session runs at once, alone.
-        const batch = mergeable && sessionChains.has(input.sessionId)
-            ? {
-                agentId: input.agentId,
-                // Settled through `settleLeader`, read when called: it is assigned below.
-                leader: { input, resolve: (session) => settleLeader({ session }), reject: (error) => settleLeader({ error }) },
-                firstInLine: (queuedWork.get(input.sessionId) ?? 0) === 0,
-                absorbed: [],
-                steered: false,
-                images: [...(input.images ?? [])],
-                chars: input.userMessage.length,
-            }
-            : undefined;
-        if (batch !== undefined) {
-            openBatches.set(input.sessionId, batch);
-        }
-        // Reads `turn` only once it is assigned: the registration below runs
-        // after it, and the chain's work runs in a later tick (`.then`).
-        const claimLiveItem = (key, confirmed) => {
-            const items = liveWorkItems.get(input.sessionId) ?? new Map();
-            items.set(key, { turn, agentId: input.agentId, confirmed, addressed: input.addressed !== false });
-            liveWorkItems.set(input.sessionId, items);
-        };
-        /**
-         * This dispatch's turn with the messages it absorbed (card 423). Each
-         * part is judged on its own first, as it would have been alone: one
-         * cancelled while it waited is refused, one that repeats a turn the
-         * session already holds is that turn. What is left runs as one turn.
-         */
-        const runMerged = async (absorbed) => {
-            const parts = [{ input }, ...absorbed.map((joiner) => ({ input: joiner.input, joiner }))];
-            let leader;
-            const settle = (part, outcome) => {
-                if (part.joiner === undefined) {
-                    // Settled the moment it is known, not when the chain moves on: a
-                    // leader cancelled or repeated while it waited must leave its
-                    // caller's queue before the turn it handed over starts rendering.
-                    leader = outcome;
-                    settleLeader(outcome);
-                }
-                else if ('session' in outcome) {
-                    part.joiner.resolve(outcome.session);
-                }
-                else {
-                    part.joiner.reject(outcome.error);
-                }
-            };
-            const runnable = [];
-            for (const part of parts) {
-                const own = part.input;
-                if (own.signal?.aborted) {
-                    settle(part, { error: abortErrorFor(own.signal) });
-                    continue;
-                }
-                if (own.idempotencyKey !== undefined) {
-                    try {
-                        const repeated = await settleRepeat(input.sessionId, own.idempotencyKey, own.agentId, own.turnId, own.onRepeat);
-                        if (repeated !== undefined) {
-                            settle(part, { session: repeated });
-                            continue;
-                        }
-                    }
-                    catch (error) {
-                        settle(part, { error });
-                        continue;
-                    }
-                }
-                runnable.push(part);
-            }
-            const head = runnable[0];
-            if (head === undefined) {
-                return finish(leader);
-            }
-            // Every runnable key now belongs to this turn.
-            const keys = runnable.flatMap((part) => (part.input.idempotencyKey !== undefined ? [part.input.idempotencyKey] : []));
-            const items = liveWorkItems.get(input.sessionId);
-            for (const key of keys) {
-                const item = items?.get(key);
-                if (item !== undefined) {
-                    item.confirmed = true;
-                }
-            }
-            // The turn runs at the least trusted sender in it: everyone's words
-            // are in its one message.
-            const labelled = runnable.some((part) => part.input.metadata !== undefined && SENDER_TRUST_METADATA_KEY in part.input.metadata);
-            const lowest = leastTrusted(...runnable.map((part) => senderTrustOf(part.input.metadata)));
-            const newest = runnable[runnable.length - 1].input;
-            const metadata = labelled ? { ...newest.metadata, [SENDER_TRUST_METADATA_KEY]: lowest } : newest.metadata;
-            const images = runnable.flatMap((part) => part.input.images ?? []);
-            const signals = runnable.map((part) => part.input.signal);
-            // Cancelled only when every caller in it is: one caller giving up
-            // must not take the others' answer with it.
-            const signal = signals.every((candidate) => candidate !== undefined)
-                ? allAborted(signals)
-                : undefined;
-            const [primaryKey, ...absorbedKeys] = keys;
-            const merged = {
-                sessionId: input.sessionId,
-                ...(head.input.agentId !== undefined ? { agentId: head.input.agentId } : {}),
-                userMessage: runnable.map((part) => part.input.userMessage).join(MERGED_SEPARATOR),
-                ...(images.length > 0 ? { images } : {}),
-                ...(runnable.every((part) => part.input.replyOptional === true) ? { replyOptional: true } : {}),
-                ...(head.input.earlier !== undefined ? { earlier: head.input.earlier } : {}),
-                ...(metadata !== undefined ? { metadata } : {}),
-                ...(signal !== undefined ? { signal } : {}),
-                ...(head.input.turnId !== undefined ? { turnId: head.input.turnId } : {}),
-                ...(primaryKey !== undefined ? { idempotencyKey: primaryKey } : {}),
-            };
-            await settleOrphanedItem(input.sessionId);
-            let outcome;
-            if (merged.turnId !== undefined) {
-                activeTurns.set(input.sessionId, merged.turnId);
-            }
-            try {
-                outcome = { session: await runSteerable(merged, absorbedKeys) };
-            }
-            catch (error) {
-                outcome = { error };
-            }
-            finally {
-                if (merged.turnId !== undefined) {
-                    activeTurns.delete(input.sessionId);
-                }
-            }
-            for (const part of runnable) {
-                if (part !== head) {
-                    part.input.onAbsorbed?.();
-                }
-                settle(part, outcome);
-            }
-            return finish(leader);
-        };
-        const finish = (outcome) => {
-            if (outcome === undefined) {
-                throw new Error('A merged turn settled without an outcome for its leader.');
-            }
-            if ('error' in outcome) {
-                throw outcome.error;
-            }
-            return outcome.session;
-        };
-        // What this caller is handed. It follows the chain's work, except that a
-        // batch leader settles it early (`settle` in `runMerged`).
-        let settleLeader = () => { };
-        const turn = new Promise((resolve, reject) => {
-            settleLeader = (outcome) => ('error' in outcome ? reject(outcome.error) : resolve(outcome.session));
-        });
-        waitingDispatches.set(input.sessionId, (waitingDispatches.get(input.sessionId) ?? 0) + 1);
-        /**
-         * Runs this dispatch's turn, handing it whatever queues behind it at
-         * each tool step (`takeSteered`), then settles every dispatch it took
-         * with the turn's outcome — the outcome they joined. Only for a caller
-         * that opted into merged turns: it is the one that renders an answer
-         * covering messages other than its own.
-         */
-        const runSteerable = async (turnInput, absorbedKeys = []) => {
-            const steered = [];
-            // Cancelled only when every caller in it is, as a merged turn is, the
-            // ones steered in later included: one caller giving up must not take
-            // the others' answer with it. A turn with a caller who cannot cancel
-            // has no signal to join.
-            const joint = turnInput.signal !== undefined ? joinableSignal([turnInput.signal]) : undefined;
-            // Admitted on the turn's own signal, not only the callers' joint one:
-            // the watchdog, `abortTurns` and a restart's window stop the turn
-            // without touching its callers, and a batch taken into a turn stopped
-            // while the store was read would share its failure instead of running
-            // next (card 959). The turn's signal follows the joint one, so this
-            // covers every caller giving up too.
-            const steer = mergeable
-                ? (turnSignal) => takeSteered(input.sessionId, input.agentId, steered, (parts) => {
-                    if (turnSignal.aborted) {
-                        return false;
-                    }
-                    for (const part of parts) {
-                        joint?.join(part.input.signal);
-                    }
-                    return true;
-                })
-                : undefined;
-            const running = joint !== undefined ? { ...turnInput, signal: joint.signal } : turnInput;
-            let outcome;
-            try {
-                outcome = { session: await dispatchInternal(running, absorbedKeys, undefined, steer) };
-            }
-            catch (error) {
-                outcome = { error };
-            }
-            for (const part of steered) {
-                part.input.onAbsorbed?.();
-                if ('session' in outcome) {
-                    part.resolve(outcome.session);
-                }
-                else {
-                    part.reject(outcome.error);
-                }
-            }
-            if ('error' in outcome) {
-                throw outcome.error;
-            }
-            return outcome.session;
-        };
-        const chained = onSessionChain(input.sessionId, async () => {
-            // Steered into the turn that ran ahead of it, which has answered and
-            // settled everyone in the batch already — this caller included.
-            if (batch?.steered === true) {
-                return turn;
-            }
-            // The batch closes here: anything arriving from now on waits behind
-            // this turn and leads the next one.
-            if (batch !== undefined && openBatches.get(input.sessionId) === batch) {
-                openBatches.delete(input.sessionId);
-            }
-            const absorbed = batch?.absorbed ?? [];
-            // No longer waiting once it reaches the head of the chain — nor is
-            // anything it absorbed.
-            const left = (waitingDispatches.get(input.sessionId) ?? 1) - 1 - absorbed.length;
-            if (left > 0) {
-                waitingDispatches.set(input.sessionId, left);
-            }
-            else {
-                waitingDispatches.delete(input.sessionId);
-            }
-            if (absorbed.length > 0) {
-                return runMerged(absorbed);
-            }
-            // Before `activeTurns` is touched: a repeat that runs nothing must
-            // not claim the session's turn id, even for the instant it takes.
-            const repeated = idempotencyKey !== undefined ? await settleRepeat(input.sessionId, idempotencyKey, input.agentId, turnId, input.onRepeat) : undefined;
-            if (repeated !== undefined) {
-                return repeated;
-            }
-            // Past the identity check with a key the session has not seen, so this
-            // dispatch owns the item: it becomes the live entry even if a claimant
-            // that was then refused registered first, or a repeat arriving while
-            // this turn runs would find nothing to attach to, queue, and read the
-            // turn as finished — a second answer beside this caller's.
-            if (idempotencyKey !== undefined) {
-                claimLiveItem(idempotencyKey, true);
-            }
-            await settleOrphanedItem(input.sessionId);
-            if (turnId === undefined) {
-                return runSteerable(input);
-            }
-            activeTurns.set(input.sessionId, turnId);
-            try {
-                return await runSteerable(input);
-            }
-            finally {
-                // Unconditional, and safe to be: the chain guarantees no other turn
-                // for this session ran between the set above and here, so this can
-                // only ever be clearing its own entry.
-                activeTurns.delete(input.sessionId);
-            }
-        }, () => batch?.steered === true);
-        // A second settle (a leader already settled early) is a no-op.
-        chained.then((session) => settleLeader({ session }), (error) => settleLeader({ error }));
-        if (idempotencyKey !== undefined) {
-            // A repeat that queued instead of attaching — it named another agent,
-            // and is about to be refused — must not displace the turn it repeats.
-            // The first registration is provisional; the chain confirms it
-            // (`claimLiveItem` above) once the dispatch is known to own the item.
-            if (liveWorkItems.get(input.sessionId)?.has(idempotencyKey) !== true) {
-                claimLiveItem(idempotencyKey, false);
-            }
-            void turn.catch(() => { }).finally(() => {
-                const current = liveWorkItems.get(input.sessionId);
-                if (current?.get(idempotencyKey)?.turn === turn) {
-                    current.delete(idempotencyKey);
-                    if (current.size === 0) {
-                        liveWorkItems.delete(input.sessionId);
-                    }
-                }
-            });
-        }
-        return turn;
-    };
+    // `stopping`, `intakeState` and `heldState` are read late.
+    const { dispatch } = createDispatch({
+        store,
+        sessionChains,
+        queuedWork,
+        waitingDispatches,
+        isStopping: () => stopping,
+        getIntakeState: () => intakeState,
+        isHeld: () => heldState,
+        refusal,
+        activeTurns,
+        liveWorkItems,
+        openBatches,
+        settleOrphanedItem,
+        onSessionChain,
+        dispatchInternal,
+        settleRepeat,
+        takeSteered,
+    });
     const observe = async (input) => {
         if (stopping) {
             throw refusal();
@@ -4584,7 +2510,6 @@ export const createGateway = (options = {}) => {
         loadedPlugins = [];
         return released;
     };
-    const startedChannels = [];
     /** Set once a shutdown has stopped the started channels; a start that finishes after it stops its own. */
     let channelsClosed = false;
     /** Resolves with `true` when `work` settles before `ms` elapse. */
@@ -4885,8 +2810,11 @@ export const createGateway = (options = {}) => {
             // placeholder by a process that died before saving its reply). It is
             // a new gateway seam, and it has to be ordered against the overhears
             // queued on the same session chain, so it is not built yet.
+            // A post a tool handed the thread (`postOf`, AGT-324) is speaking the
+            // same way a file is.
             const spoken = (message) => (message.role === 'assistant' && message.content.trim().length > 0)
-                || (message.role === 'tool' && message.toolResult !== undefined && filePathsOf(message.toolResult).length > 0);
+                || (message.role === 'tool' && message.toolResult !== undefined
+                    && (filePathsOf(message.toolResult).length > 0 || postOf(message.toolResult) !== undefined));
             const spokeIndex = session.messages.findLastIndex(spoken);
             const lastSpokeAt = spokeIndex >= 0 ? session.messages[spokeIndex]?.createdAt : undefined;
             return {