@wrongstack/core 0.302.0 → 0.303.0

package/dist/defaults/index.js

@@ -295,7 +295,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve21, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -314,7 +314,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve19,
+        resolve: resolve21,
         reject,
         timer
       });
@@ -663,13 +663,13 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus?.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve19(d);
+        resolve21(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
       const sessionId = this.currentSessionId();
@@ -1277,8 +1277,8 @@ function defaultFormatTaskInput(task) {
 }
 
 // src/coordination/agents/agent-prompts.ts
-import { readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
-import * as path5 from "node:path";
+import { readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import * as path6 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/utils/wstack-paths.ts
@@ -1421,8 +1421,8 @@ function resolveWstackPaths(opts) {
 }
 
 // src/coordination/agents/project-agent-identity.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "node:fs";
-import * as path4 from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
+import * as path5 from "node:path";
 
 // src/types/runtime-capability-manifest.ts
 var PLAYWRIGHT_ALIASES = {
@@ -1680,22 +1680,6 @@ function inferRuntimeCapabilities(toolNames) {
   return [...ids];
 }
 
-// src/coordination/agents/project-agent-consolidation.ts
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync as readFileSync2,
-  rmSync
-} from "node:fs";
-import * as path3 from "node:path";
-
-// src/coordination/agents/project-agent-learning-entries.ts
-function splitLearnedEntries(body) {
-  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
-    (entry) => entry.replace(/^# Learned wisdom for .+$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
-  ).filter(Boolean);
-}
-
 // src/coordination/agents/project-agent-paths.ts
 import * as path2 from "node:path";
 var AGENT_ROLE_PATTERN = /^[a-z0-9][a-z0-9._-]{0,95}$/i;
@@ -1717,6 +1701,190 @@ function learningPolicyPath(role, projectRoot) {
   return path2.join(roleDir(role, projectRoot), "learning.json");
 }
 
+// src/coordination/agents/project-agent-consolidation.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync } from "node:fs";
+import * as path3 from "node:path";
+
+// src/coordination/agents/project-agent-learning-entries.ts
+function splitLearnedEntries(body) {
+  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
+    (entry) => entry.replace(/^#\s+Learned (?:wisdom|instructions) for .+$/im, "").replace(/^>\s*Project-specific learning data for[\s\S]*?$/im, "").replace(/^_No learned entries yet\._$/im, "").replace(/^\*Last capture:[^\n]*\*$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
+  ).filter(Boolean);
+}
+
+// src/coordination/agents/project-agent-learning-normalize.ts
+var MIN_INSTRUCTIVE_LENGTH = 30;
+function classifyLearnedEntry(text) {
+  const lower = text.toLowerCase();
+  if (/\b(?:avoid|never|don'?t|do not|must not|prevent|watch out|beware|pitfall|gotcha|hazard|risk)\b/.test(
+    lower
+  ))
+    return "warning";
+  if (/\b(?:use|prefer|choose|adopt|leverage|apply|switch to|migrate to)\b/.test(lower) || /\b(?:pattern|approach|strategy|technique|idiom)\b/.test(lower))
+    return "pattern";
+  if (/\b(?:always|must|should|require|ensure|verify|check|run|execute|before|after|when)\b/.test(
+    lower
+  ))
+    return "convention";
+  return "fact";
+}
+function normalizeForComparison(text) {
+  return text.toLowerCase().replace(/[^\w\s]/g, " ").replace(/\s+/g, " ").trim().split(/\s+/).sort().join(" ");
+}
+
+// src/coordination/agents/project-agent-learning-structured.ts
+function parseLearnedEntryStamp(entry) {
+  const structuredMatch = entry.match(
+    /<!--\s*learned-stamp:\s*category=([\w-]+);\s*capturedAt=([^;]+?)\s*-->/
+  );
+  if (structuredMatch) {
+    const rawCategory = structuredMatch[1];
+    const candidate = parseLearnedCategory(rawCategory);
+    return {
+      capturedAt: typeof structuredMatch[2] === "string" ? structuredMatch[2].trim() : "",
+      category: candidate ?? null
+    };
+  }
+  const stampMatch = entry.match(/^>\s*(?:\[\s*([\w-]+)\s*\]\s+)?(?:Captured|Taught)\s+(\S+)/m);
+  if (!stampMatch) {
+    return { capturedAt: "", category: null };
+  }
+  return {
+    capturedAt: typeof stampMatch[2] === "string" ? stampMatch[2] : "",
+    category: parseLearnedCategory(stampMatch[1]) ?? null
+  };
+}
+function parseLearnedCategory(value) {
+  return value === "convention" || value === "pattern" || value === "warning" || value === "fact" ? value : void 0;
+}
+function stripStamp(entry) {
+  return entry.replace(/<!--\s*learned-stamp:[\s\S]*?-->/g, "").replace(/^>\s*(?:\[[\w-]+\]\s+)?(?:Captured|Taught)\s+.+$/m, "").replace(/\n{3,}/g, "\n\n").trim();
+}
+function directiveKey(text) {
+  return normalizeForComparison(text);
+}
+function decomposeLearnedEntry(text, category) {
+  const what = text;
+  const why = deriveWhy(category, text);
+  const how = extractHow(text);
+  return { what, why, how };
+}
+var WHY_BY_CATEGORY = {
+  convention: "Established convention for this codebase \u2014 skipping it risks regressions, merge friction, or out-of-sync state with peers.",
+  pattern: "This project's chosen approach \u2014 alternatives were considered and either conflict with existing architecture or were rejected for known reasons.",
+  warning: "Known failure mode \u2014 skipping this has caused real defects in this codebase. The cost of getting it wrong outweighs the cost of the check.",
+  fact: "Current state of the project \u2014 assumed by other conventions, build steps, or peers, so acting on a stale assumption wastes a cycle."
+};
+function deriveWhy(category, text) {
+  const base = WHY_BY_CATEGORY[category];
+  const signals = [];
+  const lower = text.toLowerCase();
+  if (/\bbefore\s+(?:merge|commit|deploy|release|shipping|publishing)\b/.test(lower))
+    signals.push("guard before shipping");
+  if (/\bto\s+avoid\b/.test(lower)) {
+    const m = text.match(/to avoid ([^.!?]+)/i);
+    if (m?.[1]) signals.push(`avoid ${m[1].trim()}`);
+  }
+  if (/\bso\s+(?:that|we|the project)\b/.test(lower)) {
+    const m = text.match(/so (?:that |we |the project )?([^.!?]+)/i);
+    if (m?.[1]) signals.push(`so ${m[1].trim()}`);
+  }
+  if (signals.length === 0) return base;
+  return `${base} Project signals: ${signals.join("; ")}.`;
+}
+function extractHow(text) {
+  const anchors = /* @__PURE__ */ new Set();
+  const backticked = text.match(/`([^`]+)`/g) ?? [];
+  for (const raw of backticked) {
+    const inner = raw.replace(/`/g, "").trim();
+    if (inner.length > 0 && inner.length <= 120) anchors.add(inner);
+  }
+  const pathMatches = text.match(
+    /(?:[a-zA-Z0-9_.-]+\/)+[a-zA-Z0-9_.-]+\.(?:tsx|jsonc|json|jsx|yaml|mjs|cjs|yml|ts|js|md)\b/g
+  ) ?? [];
+  for (const p of pathMatches) anchors.add(p);
+  const scoped = text.match(/@[a-z0-9][\w.-]*\/[a-z0-9][\w.-]*/gi) ?? [];
+  for (const p of scoped) anchors.add(p);
+  if (anchors.size === 0) return "";
+  return [...anchors].map((anchor) => `\`${anchor}\``).join("\n");
+}
+function cleanHowLine(line) {
+  let value = line.trim();
+  let previous;
+  do {
+    previous = value;
+    value = value.replace(/^[-*]\s+/, "").replace(/^\*How:\*\s*/i, "").trim();
+  } while (value !== previous);
+  return value;
+}
+function parseStampAttributes(body) {
+  const attributes = {};
+  for (const part of body.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key) attributes[key] = value;
+  }
+  return attributes;
+}
+function parseEntryBody(body) {
+  const lines = [];
+  for (const line of body.split("\n")) {
+    if (/^##\s/.test(line) || /^---\s*$/.test(line) || /^<!--/.test(line)) break;
+    lines.push(line);
+  }
+  const text = lines.join("\n");
+  const what = /^-\s+\*\*([\s\S]+?)\*\*\s*$/m.exec(text)?.[1]?.replace(/\s+/g, " ").trim() ?? "";
+  if (!what) return void 0;
+  const why = /^\s+-\s+\*Why:\*\s+(.+)$/m.exec(text)?.[1]?.trim() ?? "";
+  const how = lines.filter((line) => /^\s+-\s+\*How:\*/i.test(line)).map((line) => cleanHowLine(line)).filter(Boolean).join("\n");
+  return { what, why, how };
+}
+function parseStructuredLearnedEntriesFromContent(raw, legacyEntries = splitLearnedEntries(raw)) {
+  if (!raw) return [];
+  const structured = [];
+  const stampPattern = /<!--\s*learned-stamp:\s*([^>]*?)\s*-->/g;
+  const stamps = [...raw.matchAll(stampPattern)];
+  for (const [index, stamp] of stamps.entries()) {
+    const attributes = parseStampAttributes(stamp[1] ?? "");
+    const category = parseLearnedCategory(attributes["category"]) ?? "fact";
+    const capturedAt = attributes["capturedAt"] ?? "";
+    const skill = attributes["skill"];
+    const start = (stamp.index ?? 0) + stamp[0].length;
+    const end = stamps[index + 1]?.index ?? raw.length;
+    const parsed = parseEntryBody(raw.slice(start, end));
+    if (!parsed || parsed.what.length < MIN_INSTRUCTIVE_LENGTH) continue;
+    structured.push({
+      key: directiveKey(parsed.what),
+      category,
+      what: parsed.what,
+      why: parsed.why || WHY_BY_CATEGORY[category],
+      how: parsed.how,
+      capturedAt,
+      ...skill ? { skill } : {}
+    });
+  }
+  if (structured.length === 0) {
+    for (const chunk of legacyEntries) {
+      const stamp = parseLearnedEntryStamp(chunk);
+      const directive = stamp.capturedAt || stamp.category ? stripStamp(chunk) : chunk;
+      if (directive.length < MIN_INSTRUCTIVE_LENGTH) continue;
+      const category = stamp.category ?? classifyLearnedEntry(directive);
+      const { what, why, how } = decomposeLearnedEntry(directive, category);
+      structured.push({
+        key: directiveKey(directive),
+        category,
+        what,
+        why,
+        how,
+        capturedAt: stamp.capturedAt
+      });
+    }
+  }
+  return structured;
+}
+
 // src/coordination/agents/project-agent-consolidation.ts
 function consolidationPath(role, projectRoot) {
   return path3.join(roleDir(role, projectRoot), "consolidated.md");
@@ -1831,27 +1999,317 @@ function loadProjectAgentLearningPolicy(role, projectRoot) {
   }
 }
 
+// src/coordination/agents/project-agent-skill-layer.ts
+import { readdirSync, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
+import * as path4 from "node:path";
+
+// src/coordination/agents/role-skills.ts
+var skillSet = (...names) => names;
+var ROLE_SKILL_SETS = {
+  explore: skillSet("research-web", "node-modern", "typescript-strict"),
+  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
+  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
+  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
+  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
+  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
+  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
+  "refactor-planner": skillSet(
+    "refactor-planner",
+    "sdd",
+    "typescript-strict",
+    "testing",
+    "bug-hunter"
+  ),
+  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
+  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
+  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
+  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
+  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
+  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
+  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
+  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
+  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
+  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
+  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
+  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
+  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
+  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
+  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
+  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
+  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
+  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
+  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
+  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
+  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
+  database: skillSet("api-design", "testing", "security-scanner", "observability"),
+  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
+  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
+  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
+  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
+  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
+  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
+  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
+  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
+  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
+  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
+  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
+  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
+  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
+  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
+  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
+  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
+  "skill-manage": skillSet(
+    "skill-creator",
+    "prompt-engineering",
+    "security-scanner",
+    "output-standards"
+  ),
+  "self-improving": skillSet(
+    "audit-log",
+    "mnemosyne",
+    "prompt-engineering",
+    "bug-hunter",
+    "observability"
+  ),
+  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
+  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
+  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
+  // ── Wave 1: Platform and systems engineering ──────────────────────────
+  android: skillSet(
+    "react-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  desktop: skillSet(
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  realtime: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "tech-stack"
+  ),
+  "distributed-systems": skillSet(
+    "api-design",
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  concurrency: skillSet(
+    "bug-hunter",
+    "typescript-strict",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "platform-engineer": skillSet(
+    "node-modern",
+    "typescript-strict",
+    "git-flow",
+    "docker-deploy",
+    "tech-stack"
+  ),
+  // ── Wave 3: Product and data specialists ──────────────────────────────
+  payments: skillSet(
+    "api-design",
+    "security-scanner",
+    "audit-log",
+    "testing",
+    "typescript-strict",
+    "tech-stack"
+  ),
+  messaging: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "search-relevance": skillSet(
+    "api-design",
+    "observability",
+    "testing",
+    "typescript-strict",
+    "data-governance",
+    "tech-stack"
+  ),
+  storage: skillSet(
+    "api-design",
+    "security-scanner",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "ml-engineer": skillSet(
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "data-governance",
+    "tech-stack"
+  ),
+  "data-governance": skillSet(
+    "audit-log",
+    "security-scanner",
+    "observability",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  // ── Wave 4: Agent platform and quality ───────────────────────────────
+  "plugin-author": skillSet(
+    "plugin-author",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "tool-author": skillSet(
+    "typescript-strict",
+    "security-scanner",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  "prompt-evaluator": skillSet(
+    "prompt-engineering",
+    "testing",
+    "output-standards",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
+  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
+  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
+  // ── Wave 2: Security, resilience, governance and agent platform ────────
+  "threat-modeler": skillSet(
+    "security-scanner",
+    "api-design",
+    "tech-stack",
+    "audit-log",
+    "testing"
+  ),
+  "secure-coding-coach": skillSet(
+    "security-scanner",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "resilience-engineer": skillSet(
+    "observability",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "chaos-engineer": skillSet(
+    "observability",
+    "testing",
+    "security-scanner",
+    "git-flow",
+    "tech-stack"
+  ),
+  "compliance-auditor": skillSet(
+    "audit-log",
+    "security-scanner",
+    "output-standards",
+    "testing",
+    "tech-stack"
+  ),
+  "privacy-engineer": skillSet(
+    "security-scanner",
+    "audit-log",
+    "api-design",
+    "data-governance",
+    "tech-stack"
+  )
+};
+var SHADOW_AGENT_SKILLS = skillSet(
+  "wrongstack-mailbox",
+  "multi-agent",
+  "audit-log",
+  "observability",
+  "security-scanner"
+);
+var MAX_EAGER_ROSTER_SKILLS = 3;
+function assignSkillsToAgents(definitions) {
+  return definitions.map((definition) => {
+    const role = definition.config.role;
+    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
+      throw new Error(
+        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
+      );
+    }
+    const skills = ROLE_SKILL_SETS[role];
+    return {
+      ...definition,
+      config: {
+        ...definition.config,
+        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
+        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS),
+        skillPool: [...skills]
+      }
+    };
+  });
+}
+
+// src/coordination/agents/project-agent-skill-layer.ts
+var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function isProjectSkillName(name) {
+  return SKILL_NAME_PATTERN.test(name);
+}
+function projectSkillsDir(role, projectRoot) {
+  return path4.join(roleDir(role, projectRoot), "skills");
+}
+function listProjectSkillAugmentations(role, projectRoot) {
+  try {
+    return readdirSync(projectSkillsDir(role, projectRoot)).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -3)).filter(isProjectSkillName).sort();
+  } catch {
+    return [];
+  }
+}
+
+// src/types/blocks.ts
+function isTextBlock(b) {
+  return b.type === "text";
+}
+
 // src/coordination/agents/project-agent-identity.ts
 function loadProjectAgentIdentity(role, projectRoot) {
-  const identityPath = path4.join(roleDir(role, projectRoot), "identity.md");
+  const identityPath = path5.join(roleDir(role, projectRoot), "identity.md");
   try {
-    return readFileSync4(identityPath, "utf8").trim();
+    return readFileSync5(identityPath, "utf8").trim();
   } catch {
     return "";
   }
 }
 function loadProjectAgentLearned(role, projectRoot) {
-  const learnedPath = path4.join(roleDir(role, projectRoot), "learned.md");
+  const learnedPath = path5.join(roleDir(role, projectRoot), "learned.md");
   try {
-    return readFileSync4(learnedPath, "utf8").trim();
+    return readFileSync5(learnedPath, "utf8").trim();
   } catch {
     return "";
   }
 }
 function loadRoleKnowledgeManifest(role, projectRoot) {
-  const projectPath = path4.join(roleDir(role, projectRoot), "knowledge.json");
+  const projectPath = path5.join(roleDir(role, projectRoot), "knowledge.json");
   try {
-    const raw = readFileSync4(projectPath, "utf8");
+    const raw = readFileSync5(projectPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return BUILT_IN_KNOWLEDGE_MANIFESTS[role];
@@ -1879,31 +2337,35 @@ ${identity}`);
   let learnedLabel = "";
   if (learningPolicy.enabled) {
     const consolidated = loadProjectAgentConsolidated(role, projectRoot);
+    const rawLearned = loadProjectAgentLearned(role, projectRoot);
     if (consolidated) {
       const meta = loadConsolidationMetadata(role, projectRoot);
-      const rawLearned = loadProjectAgentLearned(role, projectRoot);
-      const rawEntries = splitLearnedEntries(rawLearned);
+      const rawEntries = parseStructuredLearnedEntriesFromContent(
+        rawLearned,
+        splitLearnedEntries(rawLearned)
+      );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const stale = meta === void 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
-      if (stale) {
-        if (meta !== void 0 && meta.sourceEntryCount < rawEntries.length) {
-          const deltaEntries = rawEntries.slice(meta.sourceEntryCount);
-          learnedContent = `${consolidated}
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
+      if (!stale) {
+        learnedContent = consolidated;
+        learnedLabel = "Consolidated knowledge for this project";
+      } else if (freshEntries.length > 0) {
+        const delta = freshEntries.map((entry) => `- **${entry.what}**`).join("\n");
+        learnedContent = `${consolidated}
 
 ---
 
 ## Recently captured (pending next optimization)
 
-${deltaEntries.join("\n\n---\n\n")}`;
-        } else {
-          learnedContent = rawLearned;
-        }
+${delta}`;
+        learnedLabel = "Consolidated knowledge for this project";
       } else {
-        learnedContent = consolidated;
+        learnedContent = rawLearned;
+        learnedLabel = "Learned instructions for this project (structured: what / why / how)";
       }
-      learnedLabel = "Consolidated knowledge for this project";
     } else {
-      learnedContent = loadProjectAgentLearned(role, projectRoot);
+      learnedContent = rawLearned;
       learnedLabel = "Learned instructions for this project (structured: what / why / how)";
     }
   }
@@ -1918,7 +2380,7 @@ ${learnedContent}`);
     }
   }
   const effectiveProjectRoot = projectRoot || process.cwd();
-  const learnedFilePath = path4.join(
+  const learnedFilePath = path5.join(
     effectiveProjectRoot,
     ".wrongstack",
     "agents",
@@ -1945,6 +2407,8 @@ The file below stores **learning data for this project's "${role}" agent** \u201
 - **Self-contained** \u2014 understandable without the surrounding session context.
 - **Front-load concrete anchors** \u2014 commands in backticks, package names like \`@wrongstack/core\`, file paths like \`packages/core/src/.../foo.ts\`. The structured-list renderer extracts these as the "how" for the entry.
 
+**Tag the skill you are developing.** When a directive refines one of your skills, mark it: \`## LEARNED [skill: testing]\`. Tagged directives are distilled into that skill's project addendum, so the lesson arrives as part of the skill itself on every future run instead of as a loose fact. Untagged directives are routed automatically when the wording makes the target obvious, and stay role-level otherwise.
+
 **Bad** (session log \u2014 rejected at capture time):
 
 \`\`\`
@@ -1963,15 +2427,40 @@ Capture only durable, cross-session knowledge \u2014 never ephemeral task detail
     );
   }
   const knowledge = loadRoleKnowledgeManifest(role, projectRoot);
-  if (knowledge && knowledge.checklist.length > 0) {
-    const checklist = knowledge.checklist.map((item) => `- ${item}`).join("\n");
+  if (knowledge) {
+    const knowledgeSections = [];
+    if (knowledge.checklist.length > 0) {
+      knowledgeSections.push(
+        `Verify these before answering:
+${knowledge.checklist.map((item) => `- ${item}`).join("\n")}`
+      );
+    }
+    const liveQueries = Object.entries(knowledge.liveQueries ?? {});
+    if (liveQueries.length > 0) {
+      const threshold = Number.isFinite(knowledge.verifyThreshold) ? knowledge.verifyThreshold : 0.5;
+      knowledgeSections.push(
+        `When your confidence in any of the following is below ${threshold}, fetch the live value rather than recalling it:
+` + liveQueries.map(
+          ([topic, query]) => `- **${topic}** \u2014 ${query.description}: \`${query.registry}\` \u2192 field \`${query.key}\``
+        ).join("\n")
+      );
+    }
+    if (knowledgeSections.length > 0) {
+      parts.push(`
+
+## Current knowledge requirements
+
+${knowledgeSections.join("\n\n")}`);
+    }
+  }
+  const developedSkills = listProjectSkillAugmentations(role, projectRoot);
+  if (developedSkills.length > 0) {
     parts.push(
       `
 
-## Current knowledge requirements
+## Project-developed skills
 
-Verify these before answering:
-${checklist}`
+These skills have been extended with practice learned in this project: ${developedSkills.map((skill) => `\`${skill}\``).join(", ")}. Their project addendum is attached to the skill body \u2014 follow it over the generic method when the two differ.`
     );
   }
   const additions = parts.slice(1).join("\n\n").trim();
@@ -2060,38 +2549,38 @@ function loadTechVersionPolicy() {
   return techVersionPolicyBody;
 }
 function policyCandidateDirs() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const profileInstructions = resolveWstackPaths({ projectRoot: process.cwd() }).globalInstructions;
   return [
-    path5.resolve(here, "../../../../instructions/agents"),
-    path5.resolve(here, "../../../instructions/agents"),
-    path5.resolve(here, "../../instructions/agents"),
-    path5.resolve(here, "../instructions/agents"),
-    path5.resolve(here, "instructions/agents"),
-    path5.join(profileInstructions, "agents"),
+    path6.resolve(here, "../../../../instructions/agents"),
+    path6.resolve(here, "../../../instructions/agents"),
+    path6.resolve(here, "../../instructions/agents"),
+    path6.resolve(here, "../instructions/agents"),
+    path6.resolve(here, "instructions/agents"),
+    path6.join(profileInstructions, "agents"),
     profileInstructions
   ].filter((dir, index, all) => all.indexOf(dir) === index);
 }
 function policyBody() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const roots = [
-    path5.resolve(here, "_policy/tech-version.md"),
-    path5.resolve(here, "../_policy/tech-version.md"),
-    path5.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "instructions/agents/_policy/tech-version.md")
+    path6.resolve(here, "_policy/tech-version.md"),
+    path6.resolve(here, "../_policy/tech-version.md"),
+    path6.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "instructions/agents/_policy/tech-version.md")
   ];
   for (const file of roots) {
     try {
-      return readFileSync5(file, "utf8").trim();
+      return readFileSync6(file, "utf8").trim();
     } catch {
     }
   }
   for (const dir of policyCandidateDirs()) {
     try {
-      return readFileSync5(path5.join(dir, "_policy", "tech-version.md"), "utf8").trim();
+      return readFileSync6(path6.join(dir, "_policy", "tech-version.md"), "utf8").trim();
     } catch {
     }
   }
@@ -2102,14 +2591,15 @@ function agentPrompt(id) {
   const envDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"] ?? "";
   const policyOn = process.env["WRONGSTACK_AGENT_POLICY"] === "on";
   const cacheBypass = globalThis.__WS_DISABLE_PROMPT_CACHE__ === true;
-  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${id}`;
+  const promptProjectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
+  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${promptProjectRoot}\0${id}`;
   const cached = cacheBypass ? void 0 : promptCache.get(cacheKey);
   if (cached !== void 0) return cached;
   const fileName = `${id}.md`;
   let resolved = "";
   for (const dir of agentPromptDirCandidates(envDir)) {
     try {
-      resolved = readFileSync5(path5.join(dir, fileName), "utf8").trim();
+      resolved = readFileSync6(path6.join(dir, fileName), "utf8").trim();
       break;
     } catch {
     }
@@ -2126,8 +2616,7 @@ function agentPrompt(id) {
 ${policy}`;
     }
   }
-  const projectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
-  resolved = buildProjectContextualizedPrompt(resolved, id, projectRoot);
+  resolved = buildProjectContextualizedPrompt(resolved, id, promptProjectRoot);
   if (!cacheBypass) promptCache.set(cacheKey, resolved);
   return resolved;
 }
@@ -2136,16 +2625,16 @@ function agentPromptDirCandidates(envDir) {
   const candKey = `${envDir}\0${profileInstructions}`;
   const cached = candidateCache.get(candKey);
   if (cached !== void 0) return cached;
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const explicitDir = envDir || void 0;
   const candidates = [
-    ...explicitDir ? [path5.resolve(explicitDir)] : [],
-    path5.join(profileInstructions, "agents"),
-    path5.resolve(here, "../../../../instructions/agents"),
-    path5.resolve(here, "../../../instructions/agents"),
-    path5.resolve(here, "../../instructions/agents"),
-    path5.resolve(here, "../instructions/agents"),
-    path5.resolve(here, "instructions/agents")
+    ...explicitDir ? [path6.resolve(explicitDir)] : [],
+    path6.join(profileInstructions, "agents"),
+    path6.resolve(here, "../../../../instructions/agents"),
+    path6.resolve(here, "../../../instructions/agents"),
+    path6.resolve(here, "../../instructions/agents"),
+    path6.resolve(here, "../instructions/agents"),
+    path6.resolve(here, "instructions/agents")
   ];
   const ordered = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   candidateCache.set(candKey, ordered);
@@ -4641,270 +5130,6 @@ var WAVE4_ROLE_METAS = {
 };
 var WAVE4_ROLES = new Set(Object.keys(WAVE4_ROLE_METAS));
 
-// src/coordination/agents/role-skills.ts
-var skillSet = (...names) => names;
-var ROLE_SKILL_SETS = {
-  explore: skillSet("research-web", "node-modern", "typescript-strict"),
-  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
-  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
-  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
-  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
-  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
-  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
-  "refactor-planner": skillSet(
-    "refactor-planner",
-    "sdd",
-    "typescript-strict",
-    "testing",
-    "bug-hunter"
-  ),
-  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
-  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
-  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
-  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
-  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
-  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
-  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
-  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
-  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
-  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
-  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
-  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
-  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
-  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
-  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
-  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
-  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
-  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
-  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
-  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
-  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
-  database: skillSet("api-design", "testing", "security-scanner", "observability"),
-  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
-  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
-  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
-  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
-  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
-  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
-  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
-  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
-  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
-  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
-  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
-  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
-  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
-  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
-  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
-  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
-  "skill-manage": skillSet(
-    "skill-creator",
-    "prompt-engineering",
-    "security-scanner",
-    "output-standards"
-  ),
-  "self-improving": skillSet(
-    "audit-log",
-    "mnemosyne",
-    "prompt-engineering",
-    "bug-hunter",
-    "observability"
-  ),
-  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
-  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
-  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
-  // ── Wave 1: Platform and systems engineering ──────────────────────────
-  android: skillSet(
-    "react-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  desktop: skillSet(
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  realtime: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "tech-stack"
-  ),
-  "distributed-systems": skillSet(
-    "api-design",
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  concurrency: skillSet(
-    "bug-hunter",
-    "typescript-strict",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "platform-engineer": skillSet(
-    "node-modern",
-    "typescript-strict",
-    "git-flow",
-    "docker-deploy",
-    "tech-stack"
-  ),
-  // ── Wave 3: Product and data specialists ──────────────────────────────
-  payments: skillSet(
-    "api-design",
-    "security-scanner",
-    "audit-log",
-    "testing",
-    "typescript-strict",
-    "tech-stack"
-  ),
-  messaging: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "search-relevance": skillSet(
-    "api-design",
-    "observability",
-    "testing",
-    "typescript-strict",
-    "data-governance",
-    "tech-stack"
-  ),
-  storage: skillSet(
-    "api-design",
-    "security-scanner",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "ml-engineer": skillSet(
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "data-governance",
-    "tech-stack"
-  ),
-  "data-governance": skillSet(
-    "audit-log",
-    "security-scanner",
-    "observability",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  // ── Wave 4: Agent platform and quality ───────────────────────────────
-  "plugin-author": skillSet(
-    "plugin-author",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "tool-author": skillSet(
-    "typescript-strict",
-    "security-scanner",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  "prompt-evaluator": skillSet(
-    "prompt-engineering",
-    "testing",
-    "output-standards",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
-  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
-  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
-  // ── Wave 2: Security, resilience, governance and agent platform ────────
-  "threat-modeler": skillSet(
-    "security-scanner",
-    "api-design",
-    "tech-stack",
-    "audit-log",
-    "testing"
-  ),
-  "secure-coding-coach": skillSet(
-    "security-scanner",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "resilience-engineer": skillSet(
-    "observability",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "chaos-engineer": skillSet(
-    "observability",
-    "testing",
-    "security-scanner",
-    "git-flow",
-    "tech-stack"
-  ),
-  "compliance-auditor": skillSet(
-    "audit-log",
-    "security-scanner",
-    "output-standards",
-    "testing",
-    "tech-stack"
-  ),
-  "privacy-engineer": skillSet(
-    "security-scanner",
-    "audit-log",
-    "api-design",
-    "data-governance",
-    "tech-stack"
-  )
-};
-var SHADOW_AGENT_SKILLS = skillSet(
-  "wrongstack-mailbox",
-  "multi-agent",
-  "audit-log",
-  "observability",
-  "security-scanner"
-);
-var MAX_EAGER_ROSTER_SKILLS = 3;
-function assignSkillsToAgents(definitions) {
-  return definitions.map((definition) => {
-    const role = definition.config.role;
-    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
-      throw new Error(
-        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
-      );
-    }
-    const skills = ROLE_SKILL_SETS[role];
-    return {
-      ...definition,
-      config: {
-        ...definition.config,
-        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
-        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS)
-      }
-    };
-  });
-}
-
 // src/coordination/agents/index.ts
 var ALL_AGENT_DEFINITIONS = assignSkillsToAgents([
   ...DISCOVERY_AGENTS,
@@ -5020,7 +5245,7 @@ function attachAutoExtend(events, policy = {}) {
 // src/coordination/delegate-tool.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import * as fsp from "node:fs/promises";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
@@ -5510,7 +5735,7 @@ function createDelegateTool(opts) {
   };
 }
 async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abortSignal) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve21) => {
     let settled = false;
     let timer;
     let offAbort = () => {
@@ -5523,7 +5748,7 @@ async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abo
       offIter();
       offProgress();
       offAbort();
-      resolve19(value);
+      resolve21(value);
     };
     const arm = () => {
       if (timer) clearTimeout(timer);
@@ -5683,13 +5908,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path6.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path7.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path6.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path7.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -5734,7 +5959,7 @@ async function readSubagentPartial(opts, subagentId) {
 }
 
 // src/coordination/director.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 import * as fsp19 from "node:fs/promises";
 
 // src/core/instruction-template.ts
@@ -6116,7 +6341,7 @@ var DirectorStateCheckpoint = class {
 
 // src/coordination/checkpoint-wiring.ts
 import * as fsp3 from "node:fs/promises";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 async function appendSessionEvent(host, event) {
   if (!host.sessionWriter) return;
   try {
@@ -6164,7 +6389,7 @@ async function writeManifest(host) {
     }),
     usage: host.usage.snapshot()
   };
-  await fsp3.mkdir(path7.dirname(host.manifestPath), { recursive: true });
+  await fsp3.mkdir(path8.dirname(host.manifestPath), { recursive: true });
   await atomicWrite(host.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
   return host.manifestPath;
 }
@@ -7524,10 +7749,10 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
         pending: taskIds.filter((id) => !done.has(id))
       });
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       const entry = {
         ids: new Set(taskIds),
-        resolve: (result) => resolve19({
+        resolve: (result) => resolve21({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         })
@@ -7535,7 +7760,7 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
       if (opts?.timeoutMs !== void 0) {
         entry.timer = setTimeout(() => {
           this.anyWaiters.delete(entry);
-          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve21({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.anyWaiters.add(entry);
@@ -7653,11 +7878,11 @@ ${JSON.stringify(result.result, null, 2)}
         this.makeStoppedResult(taskId, "director", `Unknown task id "${taskId}" \u2014 never assigned`)
       );
     }
-    let resolve19;
+    let resolve21;
     const promise = new Promise((done) => {
-      resolve19 = done;
+      resolve21 = done;
     });
-    this.taskWaiters.set(taskId, { promise, resolve: resolve19 });
+    this.taskWaiters.set(taskId, { promise, resolve: resolve21 });
     return promise;
   }
   recordAssignment(task) {
@@ -7918,8 +8143,8 @@ function ensureKanbanTool(tools) {
 }
 
 // src/utils/instruction-file.ts
-import { readFileSync as readFileSync6, statSync as statSync3 } from "node:fs";
-import * as path8 from "node:path";
+import { readFileSync as readFileSync7, statSync as statSync3 } from "node:fs";
+import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
@@ -7929,7 +8154,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync6(path8.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync7(path9.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -7945,11 +8170,11 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path8.dirname(fileURLToPath2(import.meta.url));
+  const here = path9.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path8.resolve(here, "../../instructions"),
-    path8.resolve(here, "../instructions"),
-    path8.resolve(here, "instructions")
+    path9.resolve(here, "../../instructions"),
+    path9.resolve(here, "../instructions"),
+    path9.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
   return rootCandidates;
@@ -9547,11 +9772,12 @@ function rosterSummaryFromConfigs(roster) {
 
 // src/coordination/director-session.ts
 import * as fsp18 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as path24 from "node:path";
 
 // src/storage/session-store.ts
+import { randomUUID as randomUUID10 } from "node:crypto";
 import * as fsp17 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as path23 from "node:path";
 
 // src/security/file-permissions.ts
 import { chmod } from "node:fs/promises";
@@ -9881,6 +10107,388 @@ var DefaultSecretScrubber = class {
   }
 };
 
+// src/session-catalog/client.ts
+import { spawn } from "node:child_process";
+import * as fs2 from "node:fs";
+import * as net from "node:net";
+import * as path11 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/session-catalog/endpoint.ts
+import { createHash as createHash2 } from "node:crypto";
+import * as os2 from "node:os";
+import * as path10 from "node:path";
+
+// src/session-catalog/protocol.ts
+var SESSION_CATALOG_PROTOCOL_VERSION = 1;
+var SESSION_CATALOG_MAX_FRAME_CHARS = 4 * 1024 * 1024;
+function encodeSessionCatalogMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+
+// src/session-catalog/endpoint.ts
+var SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
+function normalizedPath(value) {
+  const resolved = path10.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function sessionCatalogProjectServerKey(projectDir) {
+  return createHash2("sha256").update(normalizedPath(projectDir)).digest("hex").slice(0, 24);
+}
+function sessionCatalogProjectServerEndpoint(projectDir) {
+  const key = sessionCatalogProjectServerKey(projectDir);
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
+  }
+  return path10.join(os2.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
+}
+function sessionCatalogProjectServerMetadataPath(projectDir) {
+  return path10.join(projectDir, SESSION_CATALOG_METADATA_FILE);
+}
+
+// src/session-catalog/client.ts
+var CONNECT_TIMEOUT_MS = 750;
+var START_TIMEOUT_MS = 1e4;
+var CALL_TIMEOUT_MS = 3e4;
+var MAX_PENDING_REQUESTS = 1024;
+var MAX_EVENT_LISTENERS = 64;
+function locateServer(moduleUrl, exists) {
+  for (const candidate of [
+    "./project-server.js",
+    "../session-catalog/project-server.js",
+    "./session-catalog/project-server.js",
+    "../../dist/session-catalog/project-server.js"
+  ]) {
+    try {
+      const url = new URL(candidate, moduleUrl);
+      if (url.protocol === "file:" && exists(fileURLToPath3(url))) return url;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveSessionCatalogDaemonAvailability(moduleUrl = import.meta.url, exists = fs2.existsSync) {
+  if (process.env["WRONGSTACK_SESSION_CATALOG_INLINE"] || process.env["WRONGSTACK_SESSION_CATALOG_SERVER"] === "0")
+    return { kind: "inline-requested" };
+  const url = locateServer(moduleUrl, exists);
+  return url ? { kind: "available", url } : { kind: "missing-build" };
+}
+function resolveSessionCatalogProjectServerUrl(moduleUrl = import.meta.url, exists = fs2.existsSync) {
+  const availability = resolveSessionCatalogDaemonAvailability(moduleUrl, exists);
+  return availability.kind === "available" ? availability.url : null;
+}
+function normalize2(value) {
+  const resolved = path11.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function delay(ms) {
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
+}
+var SessionCatalogProjectClient = class {
+  constructor(options) {
+    this.options = options;
+    this.endpoint = sessionCatalogProjectServerEndpoint(options.projectDir);
+  }
+  options;
+  endpoint;
+  socket = null;
+  info = null;
+  buffer = "";
+  connecting = null;
+  connectResolve = null;
+  connectReject = null;
+  authToken;
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventListeners = /* @__PURE__ */ new Set();
+  reconnectTimer;
+  explicitlyClosed = false;
+  async call(op, args, options = {}) {
+    await this.ensureConnected(true);
+    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
+  }
+  /**
+   * Call an already-running project daemon without starting one.
+   *
+   * Cross-project discovery must use this path: observing another project is
+   * never sufficient authority to wake that project's IPC owner.
+   */
+  async callExisting(op, args, options = {}) {
+    await this.ensureConnected(false);
+    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
+  }
+  ping() {
+    return this.call("ping", {}, { timeoutMs: 3e3 });
+  }
+  async subscribe(listener) {
+    if (!this.eventListeners.has(listener) && this.eventListeners.size >= MAX_EVENT_LISTENERS) {
+      throw new Error(`Session Catalog listener limit reached (${MAX_EVENT_LISTENERS})`);
+    }
+    this.explicitlyClosed = false;
+    this.eventListeners.add(listener);
+    try {
+      await this.call("subscribe", {});
+    } catch (error2) {
+      this.eventListeners.delete(listener);
+      throw error2;
+    }
+    return async () => {
+      this.eventListeners.delete(listener);
+      if (this.eventListeners.size === 0)
+        await this.callExisting("unsubscribe", {}).catch(() => void 0);
+    };
+  }
+  async shutdown(reason) {
+    try {
+      await this.ensureConnected(false);
+    } catch {
+      return { stopped: false };
+    }
+    const result = await this.request({ type: "shutdown", ...reason !== void 0 ? { reason } : {} }, 5e3).catch(
+      () => ({ stopped: false })
+    );
+    if (result.stopped) {
+      const metadataPath = sessionCatalogProjectServerMetadataPath(this.options.projectDir);
+      const deadline = Date.now() + 5e3;
+      while (fs2.existsSync(metadataPath) && Date.now() < deadline) await delay(20);
+      if (result.pid && result.pid !== process.pid) {
+        while (Date.now() < deadline) {
+          try {
+            process.kill(result.pid, 0);
+            await delay(20);
+          } catch {
+            break;
+          }
+        }
+      }
+    }
+    return result;
+  }
+  async close() {
+    this.explicitlyClosed = true;
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = void 0;
+    const socket = this.socket;
+    this.socket = null;
+    this.info = null;
+    if (socket && !socket.destroyed)
+      await new Promise((resolve21) => {
+        socket.once("close", resolve21);
+        socket.end();
+      });
+  }
+  async ensureConnected(spawnIfMissing) {
+    if (this.socket && !this.socket.destroyed && this.info) return;
+    if (this.connecting) return this.connecting;
+    this.connecting = this.connectWithElection(spawnIfMissing).finally(() => {
+      this.connecting = null;
+    });
+    return this.connecting;
+  }
+  async connectWithElection(spawnIfMissing) {
+    const deadline = Date.now() + (spawnIfMissing ? START_TIMEOUT_MS : CONNECT_TIMEOUT_MS);
+    let spawned = false;
+    let lastError = new Error("Session Catalog project server unavailable");
+    while (Date.now() < deadline) {
+      try {
+        await this.connectOnce();
+        return;
+      } catch (error2) {
+        lastError = error2;
+      }
+      if (!spawnIfMissing) break;
+      if (!spawned) {
+        this.spawnDetached();
+        spawned = true;
+      }
+      await delay(75);
+    }
+    throw lastError;
+  }
+  connectOnce() {
+    this.socket?.destroy();
+    this.socket = null;
+    this.info = null;
+    this.authToken = void 0;
+    this.buffer = "";
+    return new Promise((resolve21, reject) => {
+      const socket = net.createConnection(this.endpoint);
+      this.socket = socket;
+      socket.setEncoding("utf8");
+      const timer = setTimeout(() => {
+        reject(new Error("Session Catalog handshake timed out"));
+        socket.destroy();
+      }, CONNECT_TIMEOUT_MS);
+      timer.unref?.();
+      this.connectResolve = () => {
+        clearTimeout(timer);
+        this.connectResolve = null;
+        this.connectReject = null;
+        resolve21();
+      };
+      this.connectReject = (error2) => {
+        clearTimeout(timer);
+        this.connectResolve = null;
+        this.connectReject = null;
+        reject(error2);
+      };
+      socket.on("data", (chunk) => this.onData(socket, chunk));
+      socket.on("error", (error2) => {
+        if (!this.info) this.connectReject?.(error2);
+      });
+      socket.on("close", () => this.onClose(socket));
+    });
+  }
+  currentAuthToken() {
+    if (this.authToken === void 0) {
+      try {
+        const parsed = JSON.parse(
+          fs2.readFileSync(sessionCatalogProjectServerMetadataPath(this.options.projectDir), "utf8")
+        );
+        if (typeof parsed.authToken === "string" && parsed.authToken)
+          this.authToken = parsed.authToken;
+      } catch {
+      }
+    }
+    return this.authToken;
+  }
+  request(message, timeoutMs) {
+    const socket = this.socket;
+    if (!socket || socket.destroyed)
+      return Promise.reject(new Error("Session Catalog connection is unavailable"));
+    const id = this.nextId++;
+    if (this.pending.size >= MAX_PENDING_REQUESTS) {
+      return Promise.reject(
+        new Error(`Session Catalog pending request limit reached (${MAX_PENDING_REQUESTS})`)
+      );
+    }
+    const encoded = encodeSessionCatalogMessage({
+      ...message,
+      id,
+      authToken: this.currentAuthToken()
+    });
+    if (encoded.length > SESSION_CATALOG_MAX_FRAME_CHARS)
+      return Promise.reject(new Error("Session Catalog request exceeded frame limit"));
+    return new Promise((resolve21, reject) => {
+      const timer = setTimeout(() => {
+        const pending = this.pending.get(id);
+        if (!pending) return;
+        this.pending.delete(id);
+        pending.reject(
+          new Error(
+            `Session Catalog ${message.type === "request" ? message.op : message.type} timed out`
+          )
+        );
+      }, timeoutMs);
+      timer.unref?.();
+      this.pending.set(id, { resolve: resolve21, reject, timer });
+      socket.write(encoded);
+    });
+  }
+  onData(socket, chunk) {
+    if (socket !== this.socket) return;
+    this.buffer += chunk;
+    if (this.buffer.length > SESSION_CATALOG_MAX_FRAME_CHARS) {
+      socket.destroy(new Error("Session Catalog response exceeded frame limit"));
+      return;
+    }
+    while (true) {
+      const newline = this.buffer.indexOf("\n");
+      if (newline < 0) return;
+      const line = this.buffer.slice(0, newline);
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line) continue;
+      try {
+        this.onMessage(JSON.parse(line));
+      } catch {
+        socket.destroy(new Error("Invalid Session Catalog response"));
+        return;
+      }
+    }
+  }
+  onMessage(message) {
+    if (message.type === "hello") {
+      if (message.protocolVersion !== SESSION_CATALOG_PROTOCOL_VERSION) {
+        this.connectReject?.(
+          new Error(
+            `Session Catalog protocol mismatch: client=${SESSION_CATALOG_PROTOCOL_VERSION}, server=${message.protocolVersion}`
+          )
+        );
+        this.socket?.destroy();
+        return;
+      }
+      if (normalize2(message.projectDir) !== normalize2(this.options.projectDir) || normalize2(message.projectRoot) !== normalize2(this.options.projectRoot)) {
+        this.connectReject?.(new Error("Session Catalog project identity mismatch"));
+        this.socket?.destroy();
+        return;
+      }
+      this.info = message;
+      this.connectResolve?.();
+      return;
+    }
+    if (message.type === "event") {
+      for (const listener of this.eventListeners) {
+        try {
+          listener(message.event);
+        } catch {
+        }
+      }
+      return;
+    }
+    const pending = this.pending.get(message.id);
+    if (!pending) return;
+    this.pending.delete(message.id);
+    clearTimeout(pending.timer);
+    if (message.ok) pending.resolve(message.result);
+    else {
+      const error2 = new Error(message.error);
+      if (message.errorName) error2.name = message.errorName;
+      pending.reject(error2);
+    }
+  }
+  onClose(socket) {
+    if (socket !== this.socket) return;
+    this.socket = null;
+    this.info = null;
+    this.authToken = void 0;
+    const error2 = new Error("Session Catalog connection closed");
+    this.connectReject?.(error2);
+    this.connectResolve = null;
+    this.connectReject = null;
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error2);
+    }
+    this.pending.clear();
+    this.scheduleSubscriptionReconnect();
+  }
+  scheduleSubscriptionReconnect() {
+    if (this.explicitlyClosed || this.eventListeners.size === 0 || this.reconnectTimer) return;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = void 0;
+      void this.call("subscribe", {}).catch(() => this.scheduleSubscriptionReconnect());
+    }, 250);
+    this.reconnectTimer.unref?.();
+  }
+  spawnDetached() {
+    const url = resolveSessionCatalogProjectServerUrl();
+    if (!url) throw new Error("Built Session Catalog project server is unavailable");
+    const child = spawn(
+      process.execPath,
+      [
+        fileURLToPath3(url),
+        "--project-dir",
+        this.options.projectDir,
+        "--project-root",
+        this.options.projectRoot
+      ],
+      { detached: true, stdio: "ignore", windowsHide: true, env: process.env }
+    );
+    child.unref();
+  }
+};
+
 // src/utils/assert-never.ts
 function assertNever(x, message) {
   const err = new Error(
@@ -10087,20 +10695,20 @@ var color = {
 };
 
 // src/utils/config-backup.ts
-import * as fs2 from "node:fs/promises";
-import * as path9 from "node:path";
+import * as fs3 from "node:fs/promises";
+import * as path12 from "node:path";
 function configHistoryDir(globalRoot) {
-  return path9.join(globalRoot, "config-history");
+  return path12.join(globalRoot, "config-history");
 }
 function configSlug(absolutePath, globalRoot) {
-  const rel = path9.relative(globalRoot, absolutePath);
+  const rel = path12.relative(globalRoot, absolutePath);
   const normalized = rel.replace(/\\/g, "/").replace(/\.json$/i, "");
   return normalized.replace(/\//g, "-");
 }
 async function backupConfigFile(filePath, paths) {
   let currentContent;
   try {
-    currentContent = await fs2.readFile(filePath, "utf8");
+    currentContent = await fs3.readFile(filePath, "utf8");
     if (!currentContent.trim()) return;
   } catch {
     return;
@@ -10109,10 +10717,10 @@ async function backupConfigFile(filePath, paths) {
   const ts = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
   const slug = configSlug(filePath, paths.globalRoot);
   const backupDir = configHistoryDir(paths.globalRoot);
-  const backupFile = path9.join(backupDir, `${slug}-${ts}.json`);
+  const backupFile = path12.join(backupDir, `${slug}-${ts}.json`);
   try {
-    await fs2.mkdir(backupDir, { recursive: true });
-    await fs2.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
+    await fs3.mkdir(backupDir, { recursive: true });
+    await fs3.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
   } catch {
   }
 }
@@ -10176,15 +10784,11 @@ function deepMerge(base, patch, options = {}) {
   return out;
 }
 
-// src/types/blocks.ts
-function isTextBlock(b) {
-  return b.type === "text";
-}
-
 // src/utils/context-evidence.ts
 var MAX_DIGEST_CHARS = 4e3;
 function createContextEvidenceState() {
   return {
+    recentUserTurns: [],
     sessionGoals: [],
     implicitFacts: [],
     activeErrors: [],
@@ -10201,6 +10805,11 @@ function buildContextEvidenceDigest(ctx) {
   if (state.currentIntent?.text) {
     lines.push(`intent: ${state.currentIntent.text}`);
   }
+  const priorTurns = (state.recentUserTurns ?? []).slice(-6, -1);
+  if (priorTurns.length > 0) {
+    lines.push("recent_human_instructions:");
+    for (const turn of priorTurns) lines.push(`- ${turn.text}`);
+  }
   const goals = state.sessionGoals.slice(-3);
   if (goals.length > 0) {
     lines.push("session_goals:");
@@ -10290,6 +10899,7 @@ function ensureEvidence(ctx) {
     ctx.contextEvidence = createContextEvidenceState();
   }
   ctx.contextEvidence.completedWork ??= [];
+  ctx.contextEvidence.recentUserTurns ??= [];
   return ctx.contextEvidence;
 }
 
@@ -10400,7 +11010,7 @@ function isEmptyMessage(msg) {
 }
 
 // src/core/context.ts
-import * as path10 from "node:path";
+import * as path13 from "node:path";
 
 // src/utils/tool-wire-compact.ts
 var TOOL_DESCRIPTION_MAX_CHARS = 400;
@@ -10804,12 +11414,11 @@ var ConversationState = class {
     }
     this.ctx.messages.splice(this.ctx.messages.length, 0, message);
     const overflow = this.overflowCount(this.ctx.messages);
+    this.emit({ kind: "message_appended", message });
     if (overflow > 0) {
       this.ctx.messages.splice(0, overflow);
       this.ctx.toolAdjacencyDirty = true;
-      this.emit({ kind: "messages_replaced", messages: [...this.ctx.messages] });
-    } else {
-      this.emit({ kind: "message_appended", message });
+      this.emit({ kind: "messages_dropped", count: overflow });
     }
   }
   /**
@@ -11307,6 +11916,11 @@ var Context = class _Context {
           ts,
           version: 1,
           messages: [...change.messages]
+        } : change.kind === "messages_dropped" ? {
+          type: "messages_dropped",
+          ts,
+          version: 1,
+          count: change.count
         } : null;
         if (!event) return;
         this.enqueueConversationJournal(event, this.session);
@@ -11499,6 +12113,12 @@ var Context = class _Context {
   setCurrentKanbanTask(taskId, boardId) {
     this.currentKanbanTaskId = taskId;
     this.currentKanbanBoardId = boardId;
+    const existing = this.meta["kanban"] && typeof this.meta["kanban"] === "object" ? this.meta["kanban"] : {};
+    this.state.setMeta("kanban", {
+      ...existing,
+      ...taskId ? { taskId } : { taskId: void 0 },
+      ...boardId ? { boardId } : { boardId: void 0 }
+    });
   }
   /**
    * Record a comprehensive file event for the audit trail.
@@ -11592,11 +12212,11 @@ var Context = class _Context {
    * Returns the resolved absolute path.
    */
   setWorkingDir(dir) {
-    const resolved = path10.isAbsolute(dir) ? path10.resolve(dir) : path10.resolve(this.projectRoot, dir);
+    const resolved = path13.isAbsolute(dir) ? path13.resolve(dir) : path13.resolve(this.projectRoot, dir);
     if (!this.allowOutsideProjectRoot) {
-      const root = path10.resolve(this.projectRoot);
-      const rel = path10.relative(root, resolved);
-      if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+      const root = path13.resolve(this.projectRoot);
+      const rel = path13.relative(root, resolved);
+      if (rel.startsWith("..") || path13.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
     }
@@ -12025,10 +12645,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path42, errors, depth) {
+function walk(value, schema, path45, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path42 || "<root>",
+      path: path45 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -12036,7 +12656,7 @@ function walk(value, schema, path42, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path42 || "<root>",
+        path: path45 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -12045,7 +12665,7 @@ function walk(value, schema, path42, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path42 || "<root>",
+        path: path45 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -12057,7 +12677,7 @@ function walk(value, schema, path42, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path42, req),
+          path: joinPath(path45, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -12065,14 +12685,14 @@ function walk(value, schema, path42, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path42, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path45, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path42}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path45}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -12432,14 +13052,14 @@ function compileUserRegex(pattern, flags) {
 var MAX_SUBJECT_LEN = 64 * 1024;
 
 // src/utils/session-scoped-path.ts
-import * as path11 from "node:path";
+import * as path14 from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path11.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path11.relative(path11.resolve(dir), resolved);
-  if (rel.startsWith("..") || path11.isAbsolute(rel)) {
+  const resolved = path14.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path14.relative(path14.resolve(dir), resolved);
+  if (rel.startsWith("..") || path14.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -12455,7 +13075,7 @@ function invalid(sessionId) {
 
 // src/utils/sleep.ts
 function sleep(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 
 // src/utils/slug.ts
@@ -13194,6 +13814,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
   const obj = input;
   if (subjectKey) {
     const value = obj[subjectKey];
+    if (Array.isArray(value)) {
+      return escapeGlobSubject(JSON.stringify(value));
+    }
     if (typeof value === "string") {
       if (isPathSubjectKey(subjectKey)) {
         const normalized = normalizePathSubject(value);
@@ -13238,7 +13861,7 @@ function subjectForToolInput(toolName, input, subjectKey) {
 // src/storage/file-session-writer.ts
 import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
 import * as fsp7 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path15 from "node:path";
 import { createInterface } from "node:readline";
 
 // src/storage/session-workspace-checkpoints.ts
@@ -13504,7 +14127,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path12.join(opts.dir, `${path12.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path15.join(opts.dir, `${path15.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
@@ -14393,10 +15016,10 @@ var FileSessionWriter = class _FileSessionWriter {
 };
 
 // src/storage/session-checkpoint-cas.ts
-import { spawn } from "node:child_process";
-import { createHash as createHash2, randomUUID as randomUUID9 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { createHash as createHash3, randomUUID as randomUUID9 } from "node:crypto";
 import * as fsp8 from "node:fs/promises";
-import * as path13 from "node:path";
+import * as path16 from "node:path";
 
 // src/storage/storage-concurrency.ts
 async function mapWithConcurrency(items, concurrency, mapper) {
@@ -14424,16 +15047,16 @@ var MAX_GIT_OUTPUT = 16 * 1024 * 1024;
 var MAX_BLOB_BYTES = 64 * 1024 * 1024;
 var MAX_CHECKPOINT_BYTES = 512 * 1024 * 1024;
 function sha256(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative8 = path13.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path13.isAbsolute(relative8);
+  const relative8 = path16.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path16.isAbsolute(relative8);
 }
 function normalizeRelative(input) {
-  if (!input || path13.isAbsolute(input)) return null;
+  if (!input || path16.isAbsolute(input)) return null;
   const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
-  const resolved = path13.posix.normalize(normalized);
+  const resolved = path16.posix.normalize(normalized);
   if (!resolved || resolved === "." || resolved === ".." || resolved.startsWith("../")) return null;
   return resolved;
 }
@@ -14448,8 +15071,8 @@ var SessionCheckpointCas = class {
   projectRoot;
   runGit;
   constructor(opts) {
-    this.rootDir = path13.resolve(opts.rootDir);
-    this.projectRoot = path13.resolve(opts.projectRoot);
+    this.rootDir = path16.resolve(opts.rootDir);
+    this.projectRoot = path16.resolve(opts.projectRoot);
     this.runGit = opts.runGit ?? defaultRunGit;
   }
   async capture(_sessionId, _promptIndex) {
@@ -14474,7 +15097,7 @@ var SessionCheckpointCas = class {
       relativePaths,
       CAPTURE_CONCURRENCY,
       async (relative8) => {
-        const absolute = path13.resolve(this.projectRoot, ...relative8.split("/"));
+        const absolute = path16.resolve(this.projectRoot, ...relative8.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
           unresolved.push({ path: relative8, reason: "path escapes project root" });
           return null;
@@ -14483,8 +15106,8 @@ var SessionCheckpointCas = class {
           const stat15 = await fsp8.lstat(absolute);
           if (stat15.isSymbolicLink()) {
             const linkTarget = await fsp8.readlink(absolute);
-            const resolvedLink = path13.resolve(path13.dirname(absolute), linkTarget);
-            if (path13.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
+            const resolvedLink = path16.resolve(path16.dirname(absolute), linkTarget);
+            if (path16.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
                 path: relative8,
                 reason: "symlink target escapes project root"
@@ -14546,7 +15169,7 @@ var SessionCheckpointCas = class {
     };
   }
   async materialize(checkpoint, targetRoot) {
-    const target = path13.resolve(targetRoot);
+    const target = path16.resolve(targetRoot);
     if (target === this.projectRoot) {
       throw new Error("Refusing to materialize a workspace checkpoint over the parent project root");
     }
@@ -14586,10 +15209,10 @@ var SessionCheckpointCas = class {
       try {
         const output = await this.safeOutputPath(target, realTarget, entry.path);
         if (entry.state === "symlink") {
-          if (path13.isAbsolute(entry.linkTarget)) {
+          if (path16.isAbsolute(entry.linkTarget)) {
             throw new Error("absolute symlink target refused");
           }
-          const resolvedLink = path13.resolve(path13.dirname(output), entry.linkTarget);
+          const resolvedLink = path16.resolve(path16.dirname(output), entry.linkTarget);
           if (!isInside(target, resolvedLink)) throw new Error("symlink target escapes checkpoint root");
         }
         prepared.push({
@@ -14617,7 +15240,7 @@ var SessionCheckpointCas = class {
           await fsp8.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
-          await fsp8.mkdir(path13.dirname(output), { recursive: true });
+          await fsp8.mkdir(path16.dirname(output), { recursive: true });
           await fsp8.symlink(entry.linkTarget, output);
           writtenFiles.push(entry.path);
           continue;
@@ -14634,15 +15257,15 @@ var SessionCheckpointCas = class {
   }
   objectPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid CAS object hash: ${hash2}`);
-    return path13.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
+    return path16.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
   }
   manifestPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid checkpoint manifest hash: ${hash2}`);
-    return path13.join(this.rootDir, "manifests", `${hash2}.json`);
+    return path16.join(this.rootDir, "manifests", `${hash2}.json`);
   }
   async putBlob(hash2, content) {
     const target = this.objectPath(hash2);
-    await fsp8.mkdir(path13.dirname(target), { recursive: true });
+    await fsp8.mkdir(path16.dirname(target), { recursive: true });
     try {
       const existing = await fsp8.readFile(target);
       if (sha256(existing) !== hash2) throw new Error(`Corrupt CAS object collision: ${hash2}`);
@@ -14650,9 +15273,9 @@ var SessionCheckpointCas = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    const temp = path13.join(
-      path13.dirname(target),
-      `.${path13.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
+    const temp = path16.join(
+      path16.dirname(target),
+      `.${path16.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
     );
     let handle;
     try {
@@ -14713,7 +15336,7 @@ var SessionCheckpointCas = class {
   async safeOutputPath(target, realTarget, relative8) {
     const normalized = normalizeRelative(relative8);
     if (!normalized) throw new Error("invalid relative path");
-    const output = path13.resolve(target, ...normalized.split("/"));
+    const output = path16.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
     let probe = output;
     for (; ; ) {
@@ -14723,7 +15346,7 @@ var SessionCheckpointCas = class {
         return output;
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
-        const parent = path13.dirname(probe);
+        const parent = path16.dirname(probe);
         if (parent === probe) throw err;
         probe = parent;
       }
@@ -14731,14 +15354,14 @@ var SessionCheckpointCas = class {
   }
 };
 function defaultRunGit(args, cwd) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve21) => {
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
     let stdoutTruncated = false;
     let stderrTruncated = false;
-    const child = spawn("git", args, {
+    const child = spawn2("git", args, {
       cwd,
       env: buildChildEnv(),
       stdio: ["ignore", "pipe", "pipe"],
@@ -14774,8 +15397,8 @@ function defaultRunGit(args, cwd) {
       stdoutTruncated,
       stderrTruncated
     });
-    child.on("error", (err) => resolve19(result(1, err.message)));
-    child.on("close", (code) => resolve19(result(code ?? 1)));
+    child.on("error", (err) => resolve21(result(1, err.message)));
+    child.on("close", (code) => resolve21(result(code ?? 1)));
   });
 }
 
@@ -14787,13 +15410,13 @@ function generateSessionId(startedAt, _model) {
 }
 
 // src/storage/session-id-resolver.ts
-import * as path14 from "node:path";
+import * as path17 from "node:path";
 function resolveSessionId(query, candidateIds) {
   const normalized = query.trim();
   if (!normalized) return { status: "missing", query: normalized };
   const uniqueIds = [...new Set(candidateIds)];
   if (uniqueIds.includes(normalized)) return { status: "resolved", id: normalized };
-  const leaf = (id) => path14.posix.basename(id.replace(/\\/g, "/"));
+  const leaf = (id) => path17.posix.basename(id.replace(/\\/g, "/"));
   const exactLeafMatches = uniqueIds.filter((id) => leaf(id) === normalized);
   if (exactLeafMatches.length === 1) {
     return { status: "resolved", id: exactLeafMatches[0] };
@@ -14845,15 +15468,15 @@ function scrubPersistedSessionSummary(summary, scrubber2) {
 }
 
 // src/storage/session-resume-validation.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import * as fsp9 from "node:fs/promises";
-import * as path15 from "node:path";
+import * as path18 from "node:path";
 var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative8 = path15.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path15.isAbsolute(relative8);
+  const relative8 = path18.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path18.isAbsolute(relative8);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -14864,7 +15487,7 @@ function latestObservations(events, projectRoot) {
     if (event.type !== "file_observation" || typeof event.path !== "string" || event.path.length === 0 || typeof event.hash !== "string" || !/^[a-f\d]{64}$/i.test(event.hash)) {
       continue;
     }
-    const normalized = path15.resolve(projectRoot, event.path);
+    const normalized = path18.resolve(projectRoot, event.path);
     latest.set(normalized, {
       path: normalized,
       hash: event.hash.toLowerCase(),
@@ -14913,7 +15536,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
       };
     }
     const content = await fsp9.readFile(realFile, "utf8");
-    const actualHash = createHash3("sha256").update(content, "utf8").digest("hex");
+    const actualHash = createHash4("sha256").update(content, "utf8").digest("hex");
     if (actualHash === observation.hash) return null;
     return { ...base, status: "modified", actualHash };
   } catch (err) {
@@ -14922,7 +15545,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
 }
 async function validateResumeFileObservations(events, projectRoot) {
-  const lexicalRoot = path15.resolve(projectRoot);
+  const lexicalRoot = path18.resolve(projectRoot);
   const realRoot = await fsp9.realpath(lexicalRoot).catch(() => lexicalRoot);
   const observations = latestObservations(events, lexicalRoot);
   const results = await mapWithConcurrency(
@@ -14938,9 +15561,9 @@ async function validateResumeFileObservations(events, projectRoot) {
 }
 function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
-  const root = path15.resolve(projectRoot);
+  const root = path18.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative8 = path15.relative(root, entry.path);
+    const relative8 = path18.relative(root, entry.path);
     const display = isInside2(root, entry.path) ? relative8 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
@@ -14965,22 +15588,22 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
 
 // src/storage/session-store/delete-session-artifacts.ts
 import * as fsp10 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as path20 from "node:path";
 
 // src/storage/session-store/paths.ts
-import * as path16 from "node:path";
+import * as path19 from "node:path";
 function sessionPath(storeDir, id, ext) {
   return sessionScopedPath(storeDir, id, ext);
 }
 function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path16.join(storeDir, shardKey, "_manifest.json") : path16.join(storeDir, "_manifest.json");
+  return shardKey ? path19.join(storeDir, shardKey, "_manifest.json") : path19.join(storeDir, "_manifest.json");
 }
 function shardKeyForSessionId(id) {
-  const dirName = path16.dirname(id);
+  const dirName = path19.dirname(id);
   return dirName === "." ? "" : dirName;
 }
 async function ensureShardDir(storeDir, id) {
-  const dirPath = path16.dirname(sessionScopedPath(storeDir, id, ""));
+  const dirPath = path19.dirname(sessionScopedPath(storeDir, id, ""));
   await ensureDir(dirPath);
   return dirPath;
 }
@@ -14991,9 +15614,9 @@ async function deleteSessionArtifacts({
   id,
   jsonlPath
 }) {
-  const shardDir = path17.dirname(jsonlPath);
-  const base = path17.basename(id);
-  const sessDir = path17.join(shardDir, base);
+  const shardDir = path20.dirname(jsonlPath);
+  const base = path20.basename(id);
+  const sessDir = path20.join(shardDir, base);
   const deletions = [
     fsp10.unlink(jsonlPath),
     fsp10.unlink(sessionPath(rootDir, id, ".summary.json")),
@@ -15052,7 +15675,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp11 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as path21 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -15074,12 +15697,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path18.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path21.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path21.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -15103,7 +15726,7 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path21.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
@@ -15145,7 +15768,7 @@ function emitSessionStoreError(events, sessionId, filePath, operation, error2, r
 }
 
 // src/storage/session-store/fork-session.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 
 // src/storage/session-store/replay.ts
 function isReplayableMessage(value) {
@@ -15217,7 +15840,7 @@ async function forkSession(host, id, opts = {}) {
   }
   const parentPrefix = parent.events.slice(0, boundary + 1);
   const workspaceCheckpoint = targetCheckpoint?.workspaceCheckpoint;
-  const checkpointHash = createHash4("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
+  const checkpointHash = createHash5("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
   const inherited = parentPrefix.filter(inheritsIntoFork);
   const writer = await host.create({
     id: "",
@@ -15560,6 +16183,16 @@ function replaySessionEvent(params) {
     } else {
       emitDamaged(params, "Ignored malformed messages_replaced event");
     }
+  } else if (ev.type === "messages_dropped" && ev.version === 1) {
+    if (exactJournalActive && Number.isInteger(ev.count) && ev.count > 0) {
+      messages.splice(0, Math.min(ev.count, messages.length));
+      openToolUses.clear();
+      for (const current of messages) trackMessageToolState(current, openToolUses);
+    } else if (!exactJournalActive) {
+      emitDamaged(params, "Ignored messages_dropped event outside the exact journal");
+    } else {
+      emitDamaged(params, `Ignored malformed messages_dropped event (count ${String(ev.count)})`);
+    }
   } else if (ev.type === "context_snapshot") {
     if (!applyContextSnapshot(messages, openToolUses, ev.messages)) {
       emitDamaged(params, "Ignored malformed context_snapshot event");
@@ -15614,7 +16247,7 @@ function emitDamaged(params, detail) {
 
 // src/storage/session-store/prune-helpers.ts
 import * as fsp13 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as path22 from "node:path";
 function isPrunableSessionJsonl(name) {
   return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
 }
@@ -15622,7 +16255,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   const cutoff = Date.now() - maxAgeDays * 864e5;
   let deleted = 0;
   const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path19.join(dir, name);
+    const jsonlPath = path22.join(dir, name);
     try {
       const stat15 = await fsp13.stat(jsonlPath);
       if (stat15.mtimeMs >= cutoff) return;
@@ -15641,7 +16274,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
       continue;
     }
     if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
+    const dateDir = path22.join(storeDir, entry.name);
     const files = await fsp13.readdir(dateDir, { withFileTypes: true }).catch(() => []);
     for (const file of files) {
       if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
@@ -15650,7 +16283,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
+    const dateDir = path22.join(storeDir, entry.name);
     try {
       const remaining = await fsp13.readdir(dateDir);
       if (remaining.length === 0) {
@@ -15983,6 +16616,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   logger;
   onAppend;
   onAppendBatch;
+  /** Present in built production output; source-only tests retain the local compatibility path. */
+  catalogClient;
+  maintenanceHolderId = randomUUID10();
   /**
    * In-memory cache for load() results, keyed by session ID. The cache is
    * invalidated when the file's mtimeMs or size changes (indicating the
@@ -16000,9 +16636,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
-    this.projectRoot = opts.projectRoot ? path20.resolve(opts.projectRoot) : void 0;
+    this.projectRoot = opts.projectRoot ? path23.resolve(opts.projectRoot) : void 0;
     this.checkpointCas = this.projectRoot ? new SessionCheckpointCas({
-      rootDir: path20.join(this.dir, "_cas"),
+      rootDir: path23.join(this.dir, "_cas"),
       projectRoot: this.projectRoot
     }) : void 0;
     this.events = opts.events;
@@ -16011,6 +16647,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this.logger = opts.logger;
     this.onAppend = opts.onAppend;
     this.onAppendBatch = opts.onAppendBatch;
+    const builtRuntime = import.meta.url.includes("/dist/");
+    this.catalogClient = this.projectRoot && (builtRuntime || process.env["WRONGSTACK_SESSION_CATALOG_FORCE"] === "1") && resolveSessionCatalogProjectServerUrl() ? new SessionCatalogProjectClient({
+      projectDir: path23.dirname(this.dir),
+      projectRoot: this.projectRoot
+    }) : void 0;
   }
   /**
    * Emit a structured warning. Uses the configured Logger when available;
@@ -16033,10 +16674,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   clearLoadCache(sessionId) {
     this.loadCache.clear(sessionId);
   }
+  async dispose() {
+    await this.catalogClient?.close();
+    this.clearLoadCache();
+  }
   // ── Storage event helpers ───────────────────────────────────────────────────
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path20.join(this.dir, "_index.jsonl");
+    return path23.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
@@ -16094,8 +16739,23 @@ var DefaultSessionStore = class _DefaultSessionStore {
           if (!current) return null;
           return current.name === void 0 ? {} : { name: sessionContentText(this.secretScrubber.scrub(current.name)) };
         },
-        onClose: (s) => this.appendToIndex(s)
+        onClose: (s) => this.persistCatalogSummary(s)
       });
+      if (this.catalogClient) {
+        await this.catalogClient.call("upsert_summary", {
+          summary: {
+            id,
+            title: meta.title ?? "",
+            startedAt,
+            model: meta.model ?? "",
+            provider: meta.provider ?? "",
+            tokenTotal: 0,
+            lastActivityAt: startedAt
+          },
+          transcriptRelativePath: `${id}.jsonl`,
+          summaryRelativePath: `${id}.summary.json`
+        });
+      }
       emitSessionStoreWrite(this.events, id, file, "create", "success", Date.now() - t0);
       return writer;
     } catch (err) {
@@ -16125,6 +16785,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return materializeCheckpoint(this.checkpointCas, checkpoint, targetRoot);
   }
   async resolveId(query) {
+    if (this.catalogClient) {
+      return this.catalogClient.call("resolve_id", { query });
+    }
     const normalized = query.trim();
     if (!normalized) throw new Error("Session not found: (empty query)");
     if (normalized) {
@@ -16231,7 +16894,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path20.dirname(file),
+          dir: path23.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
@@ -16242,7 +16905,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
             if (!current) return null;
             return current.name === void 0 ? {} : { name: sessionContentText(this.secretScrubber.scrub(current.name)) };
           },
-          onClose: (s) => this.appendToIndex(s)
+          onClose: (s) => this.persistCatalogSummary(s)
         }
       );
       emitSessionStoreWrite(this.events, canonicalId, file, "resume", "success", Date.now() - t0);
@@ -16355,6 +17018,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
   }
   async list(limit = 20) {
+    if (this.catalogClient) {
+      const records = await this.catalogClient.call("list_catalog", { limit });
+      return this.scrubSummaries(records);
+    }
     try {
       const indexed = await this.readIndex();
       if (indexed.length > 0) {
@@ -16377,6 +17044,13 @@ var DefaultSessionStore = class _DefaultSessionStore {
    */
   async listFiltered(criteria) {
     const limit = criteria.limit ?? 100;
+    if (this.catalogClient) {
+      const records = await this.catalogClient.call("list_catalog", {
+        limit: Math.min(1e3, Math.max(limit, 100)),
+        ...criteria.titleContains ? { search: criteria.titleContains } : {}
+      });
+      return this.scrubSummaries(records).filter((summary) => matchesSessionFilter(summary, criteria)).slice(0, limit);
+    }
     try {
       const indexed = await this.readIndex();
       if (indexed.length === 0) {
@@ -16426,6 +17100,18 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await this.appendToIndexStrict(summary).catch(() => {
     });
   }
+  /** Final summary boundary: daemon is authoritative when available. */
+  async persistCatalogSummary(summary) {
+    if (!this.catalogClient) {
+      await this.appendToIndex(summary);
+      return;
+    }
+    await this.catalogClient.call("upsert_summary", {
+      summary,
+      transcriptRelativePath: `${summary.id}.jsonl`,
+      summaryRelativePath: `${summary.id}.summary.json`
+    });
+  }
   /** Append a tombstone entry for a deleted session. */
   async writeTombstone(id) {
     try {
@@ -16535,6 +17221,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * fresh _index.jsonl. Useful after manual cleanup or index corruption.
    */
   async rebuildIndex() {
+    if (this.catalogClient) {
+      const result = await this.catalogClient.call("rebuild_catalog", {}, { timeoutMs: 12e4 });
+      return result.indexed;
+    }
     const ids = await this.collectSessionIds(this.dir);
     const summaries = await Promise.all(
       ids.map((id) => this.summaryFor(id).catch(() => null))
@@ -16604,7 +17294,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path20.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path23.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -16700,10 +17390,35 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await this.writeTombstone(id);
   }
   async delete(id) {
+    if (this.catalogClient) {
+      const canonical = await this.resolveId(id);
+      const lease = await this.catalogClient.call("acquire_maintenance", {
+        sessionId: canonical,
+        operation: "delete",
+        holderId: this.maintenanceHolderId
+      });
+      try {
+        await this.catalogClient.call("delete", { sessionId: canonical, lease });
+      } catch (error2) {
+        await this.catalogClient.call("release_maintenance", { lease }).catch(() => void 0);
+        throw error2;
+      }
+      this.clearLoadCache(canonical);
+      return;
+    }
     await assertSessionCanBeDeleted(id, this.isSessionInUse);
     await this.deleteSession(id);
   }
   async rename(id, name) {
+    if (this.catalogClient) {
+      const canonical = await this.resolveId(id);
+      const summary = await this.catalogClient.call("rename", {
+        sessionId: canonical,
+        name: sessionContentText(this.secretScrubber.scrub(name))
+      });
+      this.clearLoadCache(canonical);
+      return summary;
+    }
     const trimmed = sessionContentText(this.secretScrubber.scrub(name));
     const manifest = this.sessionPath(id, ".summary.json");
     const jsonlPath = this.sessionPath(id, ".jsonl");
@@ -16755,6 +17470,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return updated;
   }
   async prune(maxAgeDays = 30) {
+    if (this.catalogClient) {
+      return this.catalogClient.call("prune", {
+        maxAgeDays,
+        holderId: this.maintenanceHolderId
+      });
+    }
     const deleted = await pruneSessionFiles(this.dir, maxAgeDays, (id) => this.deleteSession(id));
     if (deleted > 0) {
       await this.compactIndex().catch(() => void 0);
@@ -16762,20 +17483,85 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return deleted;
   }
   async clearHistory(id) {
-    await this.ensureShardDir(id);
-    const file = this.sessionPath(id, ".jsonl");
-    const meta = this.sessionPath(id, ".summary.json");
+    const canonical = this.catalogClient ? await this.resolveId(id) : id;
+    const maintenance = this.catalogClient ? await this.catalogClient.call("acquire_maintenance", {
+      sessionId: canonical,
+      operation: "clear",
+      holderId: this.maintenanceHolderId,
+      // The catalog store runs inside the detached project daemon; without
+      // our pid it cannot tell "this TUI clearing its own session" from
+      // "another running wstack" and refuses every /clear as `is live`.
+      holderPid: process.pid
+    }) : void 0;
+    await this.ensureShardDir(canonical);
+    const file = this.sessionPath(canonical, ".jsonl");
+    const meta = this.sessionPath(canonical, ".summary.json");
+    const backupSuffix = maintenance ? `.${maintenance.leaseId}.clear-backup` : void 0;
+    const fileBackup = backupSuffix ? `${file}${backupSuffix}` : void 0;
+    const metaBackup = backupSuffix ? `${meta}${backupSuffix}` : void 0;
+    let fileStaged = false;
+    let metaStaged = false;
     const record = `${JSON.stringify({
       type: "session_start",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      id,
+      id: canonical,
       model: "unknown",
       provider: "unknown"
     })}
 `;
-    await atomicWrite(file, record);
-    await fsp17.unlink(meta).catch(() => void 0);
-    this.clearLoadCache(id);
+    try {
+      if (fileBackup) {
+        try {
+          await fsp17.rename(file, fileBackup);
+          fileStaged = true;
+        } catch (error2) {
+          if (error2.code !== "ENOENT") throw error2;
+        }
+      }
+      if (metaBackup) {
+        try {
+          await fsp17.rename(meta, metaBackup);
+          metaStaged = true;
+        } catch (error2) {
+          if (error2.code !== "ENOENT") throw error2;
+        }
+      }
+      await atomicWrite(file, record);
+      if (!metaBackup) await fsp17.unlink(meta).catch(() => void 0);
+      if (this.catalogClient) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        await this.catalogClient.call("upsert_summary", {
+          summary: {
+            id: canonical,
+            title: "",
+            startedAt: now,
+            model: "unknown",
+            provider: "unknown",
+            tokenTotal: 0,
+            lastActivityAt: now
+          },
+          transcriptRelativePath: `${canonical}.jsonl`,
+          summaryRelativePath: `${canonical}.summary.json`
+        });
+      }
+      if (fileStaged && fileBackup) await fsp17.unlink(fileBackup).catch(() => void 0);
+      if (metaStaged && metaBackup) await fsp17.unlink(metaBackup).catch(() => void 0);
+    } catch (error2) {
+      if (fileStaged && fileBackup) {
+        await fsp17.unlink(file).catch(() => void 0);
+        await fsp17.rename(fileBackup, file).catch(() => void 0);
+      }
+      if (metaStaged && metaBackup) {
+        await fsp17.unlink(meta).catch(() => void 0);
+        await fsp17.rename(metaBackup, meta).catch(() => void 0);
+      }
+      throw error2;
+    } finally {
+      if (maintenance && this.catalogClient) {
+        await this.catalogClient.call("release_maintenance", { lease: maintenance }).catch(() => void 0);
+      }
+    }
+    this.clearLoadCache(canonical);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({
@@ -16795,9 +17581,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path21.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path24.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path21.join(opts.sessionsRoot, runId);
+    dir = path24.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -16821,7 +17607,7 @@ function makeDirectorSessionFactory(opts) {
 }
 async function readDirectorSubagentSession(args) {
   if (!args.sessionsRoot) return null;
-  const filePath = path21.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
+  const filePath = path24.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
   let raw;
   try {
     raw = await fsp18.readFile(filePath, "utf8");
@@ -17393,7 +18179,7 @@ function formatRole(role) {
 }
 
 // src/coordination/fleet-spawn.ts
-async function spawn2(host, config, priceLookup) {
+async function spawn3(host, config, priceLookup) {
   if (host.workCompleteFlag) {
     throw new FleetSpawnBudgetError(
       "max_spawns",
@@ -17677,7 +18463,7 @@ function hashStr(s) {
 }
 
 // src/coordination/multi-agent-coordinator.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 
 // src/coordination/coordinator/error-classifier.ts
@@ -17816,12 +18602,12 @@ async function executeSubagentWithTimeout({
           }
           return new Promise((resolveDecision) => {
             let settled = false;
-            const resolve19 = (d) => {
+            const resolve21 = (d) => {
               if (settled) return;
               settled = true;
               resolveDecision(d);
             };
-            const fallback = setTimeout(() => resolve19("stop"), DECISION_TIMEOUT_MS);
+            const fallback = setTimeout(() => resolve21("stop"), DECISION_TIMEOUT_MS);
             const sessionId = currentSessionId();
             budget._events?.emit("budget.threshold_reached", {
               ...sessionId ? { sessionId } : {},
@@ -17831,11 +18617,11 @@ async function executeSubagentWithTimeout({
               timeoutMs: DECISION_TIMEOUT_MS,
               extend: (extra) => {
                 clearTimeout(fallback);
-                queueMicrotask(() => resolve19({ extend: extra }));
+                queueMicrotask(() => resolve21({ extend: extra }));
               },
               deny: () => {
                 clearTimeout(fallback);
-                resolve19("stop");
+                resolve21("stop");
               }
             });
           });
@@ -18047,7 +18833,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     return { ...subagent, name: display };
   }
   async spawn(subagent) {
-    const id = subagent.id || randomUUID10();
+    const id = subagent.id || randomUUID11();
     const cfg = this.withNickname(subagent, id);
     if (this.subagents.has(id)) {
       throw new Error(`Subagent id "${id}" already exists \u2014 refusing to overwrite`);
@@ -18222,7 +19008,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve19, reject) => {
+        return new Promise((resolve21, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -18231,7 +19017,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve19(result);
+              resolve21(result);
             }
           };
           this.on("task.completed", handler);
@@ -18256,13 +19042,13 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       const done = new Set(completed.map((r) => r.taskId));
       return { completed, pending: taskIds.filter((id) => !done.has(id)) };
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       let timer;
       const handler = ({ result }) => {
         if (!ids.has(result.taskId)) return;
         if (timer) clearTimeout(timer);
         this.off("task.completed", handler);
-        resolve19({
+        resolve21({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         });
@@ -18270,7 +19056,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       if (opts?.timeoutMs !== void 0) {
         timer = setTimeout(() => {
           this.off("task.completed", handler);
-          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve21({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.on("task.completed", handler);
@@ -18932,7 +19718,7 @@ var Director = class _Director {
   sessionProvider;
   sessionModel;
   constructor(opts) {
-    this.id = opts.config.coordinatorId || randomUUID11();
+    this.id = opts.config.coordinatorId || randomUUID12();
     this.manifestPath = opts.manifestPath;
     this.roster = opts.roster;
     this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
@@ -19194,7 +19980,7 @@ var Director = class _Director {
     }
     const config = { ...callerConfig };
     this.resolveSpawnModel(config);
-    const subagentId = await spawn2(this, config, priceLookup);
+    const subagentId = await spawn3(this, config, priceLookup);
     const perSubagentIdleMs = typeof config.idleTimeoutMs === "number" && Number.isFinite(config.idleTimeoutMs) && config.idleTimeoutMs >= 0 ? config.idleTimeoutMs : this.subagentIdleTimeoutMs;
     this.armSubagentIdleRetirement(subagentId, perSubagentIdleMs);
     return subagentId;
@@ -19215,7 +20001,7 @@ var Director = class _Director {
       );
     }
     const msg = {
-      id: randomUUID11(),
+      id: randomUUID12(),
       type: "task",
       from: this.id,
       to: subagentId,
@@ -21135,7 +21921,7 @@ function resolveContextWindowPolicy(config = {}, overrideMode) {
 
 // src/infrastructure/logger.ts
 import * as fsp20 from "node:fs/promises";
-import * as path22 from "node:path";
+import * as path25 from "node:path";
 var LEVEL_RANK2 = {
   error: 0,
   warn: 1,
@@ -21206,7 +21992,7 @@ var DefaultLogger = class _DefaultLogger {
     this.stderr = opts.stderr !== false;
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
-      const dir = path22.dirname(this.file);
+      const dir = path25.dirname(this.file);
       this._tail = this._tail.then(async () => {
         await fsp20.mkdir(dir, { recursive: true });
       }).catch(() => void 0);
@@ -21964,10 +22750,10 @@ var KNOWN_TOKEN_GROUPS = {
 var KNOWN_TOKEN_NAMES = Object.values(KNOWN_TOKEN_GROUPS).flat();
 
 // src/execution/design-kit-loader.ts
-import { existsSync as existsSync3 } from "node:fs";
-import * as fs3 from "node:fs/promises";
-import * as path23 from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { existsSync as existsSync4 } from "node:fs";
+import * as fs4 from "node:fs/promises";
+import * as path26 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
 var FOUNDATIONS_ID = "_foundations";
@@ -22066,15 +22852,15 @@ var DefaultDesignKitLoader = class {
     for (const { dir, source } of this.dirs) {
       let entries;
       try {
-        entries = await fs3.readdir(dir, { withFileTypes: true });
+        entries = await fs4.readdir(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const e of entries) {
         if (!e.isDirectory()) continue;
-        const kitFile = path23.join(dir, e.name, KIT_FILE);
+        const kitFile = path26.join(dir, e.name, KIT_FILE);
         try {
-          const raw = await fs3.readFile(kitFile, "utf8");
+          const raw = await fs4.readFile(kitFile, "utf8");
           const fm = parseKitFrontmatter(raw);
           const id = fm.id ?? e.name;
           if (!fm.name) continue;
@@ -22135,7 +22921,7 @@ var DefaultDesignKitLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(id);
     if (!m) throw new Error(`Design kit "${id}" not found`);
-    const raw = await fs3.readFile(m.path, "utf8");
+    const raw = await fs4.readFile(m.path, "utf8");
     const body = narrowStackSections(stripFrontmatter(raw), stack);
     this.bodyCache.set(key, body);
     return body;
@@ -22147,9 +22933,9 @@ var DefaultDesignKitLoader = class {
     const m = await this.find(id);
     let tokens;
     if (m) {
-      const tokensPath = path23.join(path23.dirname(m.path), TOKENS_FILE);
+      const tokensPath = path26.join(path26.dirname(m.path), TOKENS_FILE);
       try {
-        const raw = await fs3.readFile(tokensPath, "utf8");
+        const raw = await fs4.readFile(tokensPath, "utf8");
         tokens = JSON.parse(raw);
       } catch {
         tokens = void 0;
@@ -22209,15 +22995,15 @@ function mergeKitTokens(base, own) {
 }
 function resolveBundledDesignKitsDir() {
   try {
-    const here = path23.dirname(fileURLToPath3(import.meta.url));
+    const here = path26.dirname(fileURLToPath4(import.meta.url));
     const candidates = [
-      path23.join(here, "design-kits"),
-      path23.join(here, "..", "design-kits"),
-      path23.join(here, "..", "..", "design-kits"),
-      path23.join(here, "..", "..", "..", "design-kits")
+      path26.join(here, "design-kits"),
+      path26.join(here, "..", "design-kits"),
+      path26.join(here, "..", "..", "design-kits"),
+      path26.join(here, "..", "..", "..", "design-kits")
     ];
     for (const c of candidates) {
-      if (existsSync3(c)) return c;
+      if (existsSync4(c)) return c;
     }
   } catch {
   }
@@ -22251,12 +23037,12 @@ function _resetDesignKitLoaderMemo() {
 }
 
 // src/execution/design-project-store.ts
-import { existsSync as existsSync4 } from "node:fs";
-import * as fs4 from "node:fs/promises";
-import * as path24 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import * as fs5 from "node:fs/promises";
+import * as path27 from "node:path";
 var DESIGN_DIR = ".design";
 function designProjectDir(projectRoot) {
-  return path24.join(projectRoot, DESIGN_DIR);
+  return path27.join(projectRoot, DESIGN_DIR);
 }
 var RULE_FILES = ["rules.md", "RULES.md", "design.md"];
 var rulesCache = /* @__PURE__ */ new Map();
@@ -22271,7 +23057,7 @@ async function loadProjectDesignRules(projectRoot) {
   let rules;
   for (const name of RULE_FILES) {
     try {
-      const txt = await fs4.readFile(path24.join(designProjectDir(projectRoot), name), "utf8");
+      const txt = await fs5.readFile(path27.join(designProjectDir(projectRoot), name), "utf8");
       if (txt.trim()) {
         rules = txt.trim();
         break;
@@ -22297,7 +23083,7 @@ function parseOverrides(value) {
 }
 async function loadActiveKit(projectRoot) {
   try {
-    const raw = await fs4.readFile(path24.join(designProjectDir(projectRoot), "active.json"), "utf8");
+    const raw = await fs5.readFile(path27.join(designProjectDir(projectRoot), "active.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.kit === "string") {
       return {
@@ -22330,11 +23116,11 @@ function applyTokenOverrides(tokens, overrides) {
 }
 async function ensureDesignDir(projectRoot) {
   const dir = designProjectDir(projectRoot);
-  await fs4.mkdir(dir, { recursive: true });
-  const gi = path24.join(dir, ".gitignore");
-  if (!existsSync4(gi)) {
+  await fs5.mkdir(dir, { recursive: true });
+  const gi = path27.join(dir, ".gitignore");
+  if (!existsSync5(gi)) {
     try {
-      await fs4.writeFile(gi, "*\n");
+      await fs5.writeFile(gi, "*\n");
     } catch {
     }
   }
@@ -22345,11 +23131,11 @@ async function recordKitChoice(projectRoot, kit, stack, source, isoTime, overrid
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit, stack: stack ?? null };
     if (overrides && Object.keys(overrides).length > 0) record.overrides = overrides;
-    await fs4.writeFile(path24.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path27.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const line = `- ${isoTime} \xB7 kit=${kit}${stack ? ` stack=${stack}` : ""} \xB7 via=${source}
 `;
-    await fs4.appendFile(path24.join(dir, "decisions.md"), line);
+    await fs5.appendFile(path27.join(dir, "decisions.md"), line);
   } catch {
   }
 }
@@ -22365,11 +23151,11 @@ async function recordOverrides(projectRoot, patch, isoTime) {
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit: active.kit, stack: active.stack ?? null };
     if (Object.keys(merged).length > 0) record.overrides = merged;
-    await fs4.writeFile(path24.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path27.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const keys = Object.keys(patch).join(",");
-    await fs4.appendFile(
-      path24.join(dir, "decisions.md"),
+    await fs5.appendFile(
+      path27.join(dir, "decisions.md"),
       `- ${isoTime} \xB7 kit=${active.kit} \xB7 override=${keys} \xB7 via=set
 `
     );
@@ -22379,7 +23165,7 @@ async function recordOverrides(projectRoot, patch, isoTime) {
 }
 async function clearPersistedActiveKit(projectRoot) {
   try {
-    await fs4.rm(path24.join(designProjectDir(projectRoot), "active.json"), { force: true });
+    await fs5.rm(path27.join(designProjectDir(projectRoot), "active.json"), { force: true });
   } catch {
   }
 }
@@ -22519,12 +23305,12 @@ function verifyFiles(tokens, files) {
   const violations = [];
   let onPalette = 0;
   let offPalette = 0;
-  for (const { path: path42, text } of files) {
+  for (const { path: path45, text } of files) {
     const lines = text.split("\n");
     lines.forEach((lineText, i) => {
       const lineNo = i + 1;
       const flag = (snippet, reason, axis = "color") => {
-        violations.push({ file: path42, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
+        violations.push({ file: path45, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
       };
       for (const re of [HEX_RE, FUNC_COLOR_RE]) {
         re.lastIndex = 0;
@@ -22591,14 +23377,14 @@ var SKIP_DIR = /* @__PURE__ */ new Set([
   ".design"
 ]);
 async function walkUiFiles(root, max = 200) {
-  const { default: fs15 } = await import("node:fs/promises");
+  const { default: fs16 } = await import("node:fs/promises");
   const { default: nodePath } = await import("node:path");
   const found = [];
   async function rec(dir, depth) {
     if (found.length >= max || depth > 8) return;
     let entries;
     try {
-      entries = await fs15.readdir(dir, { withFileTypes: true });
+      entries = await fs16.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -22616,13 +23402,13 @@ async function walkUiFiles(root, max = 200) {
   return found;
 }
 async function runDesignVerify(projectRoot, tokens, explicitFiles) {
-  const { default: fs15 } = await import("node:fs/promises");
+  const { default: fs16 } = await import("node:fs/promises");
   const { default: nodePath } = await import("node:path");
   const abs = explicitFiles && explicitFiles.length > 0 ? explicitFiles.map((f) => nodePath.isAbsolute(f) ? f : nodePath.join(projectRoot, f)) : await walkUiFiles(projectRoot);
   const files = [];
   for (const a of abs) {
     try {
-      files.push({ path: nodePath.relative(projectRoot, a), text: await fs15.readFile(a, "utf8") });
+      files.push({ path: nodePath.relative(projectRoot, a), text: await fs16.readFile(a, "utf8") });
     } catch {
     }
   }
@@ -22753,10 +23539,10 @@ function makeDesignVerifyToolCallMiddleware() {
         const p = typeof input?.path === "string" ? input.path : "";
         if (!p || !detectFrontendFile(p)) return out;
         const ctx = out.ctx;
-        const { default: fs15 } = await import("node:fs/promises");
+        const { default: fs16 } = await import("node:fs/promises");
         const { default: nodePath } = await import("node:path");
         const abs = nodePath.isAbsolute(p) ? p : nodePath.join(ctx.projectRoot, p);
-        const text = await fs15.readFile(abs, "utf8").catch(() => "");
+        const text = await fs16.readFile(abs, "utf8").catch(() => "");
         if (!text) return out;
         const loader = getDesignKitLoader(ctx.projectRoot);
         const rawTokens = await loader.readTokens(state.activeKit);
@@ -23205,11 +23991,11 @@ function buildRecoveryStrategies(opts) {
       async attempt(err, ctx) {
         if (!(err instanceof ProviderError) || err.kind !== "rate_limit") return null;
         const delayMs = err.body?.retryAfterMs ?? 5e3;
-        const delay = Math.min(6e4, Math.max(1e3, delayMs));
+        const delay2 = Math.min(6e4, Math.max(1e3, delayMs));
         if (ctx?.signal) {
-          await new Promise((resolve19) => {
+          await new Promise((resolve21) => {
             if (ctx.signal.aborted) {
-              resolve19();
+              resolve21();
               return;
             }
             let settled = false;
@@ -23220,13 +24006,13 @@ function buildRecoveryStrategies(opts) {
               settled = true;
               if (timer !== void 0) clearTimeout(timer);
               ctx.signal.removeEventListener("abort", onAbort);
-              resolve19();
+              resolve21();
             };
-            timer = setTimeout(finish, delay);
+            timer = setTimeout(finish, delay2);
             ctx.signal.addEventListener("abort", onAbort, { once: true });
           });
         } else {
-          await new Promise((r) => setTimeout(r, delay));
+          await new Promise((r) => setTimeout(r, delay2));
         }
         return { action: "retry", reason: "rate_limit_backoff" };
       }
@@ -23856,10 +24642,10 @@ var EternalAutonomyEngine = class {
     if (status === "failure") {
       if (isTransientFailure) {
         this.consecutiveTransientRetries++;
-        const delay = this.computeTransientBackoffMs();
-        if (delay > 0) {
-          emit2({ phase: "sleep", ms: delay });
-          await this.sleepInterruptible(delay);
+        const delay2 = this.computeTransientBackoffMs();
+        if (delay2 > 0) {
+          emit2({ phase: "sleep", ms: delay2 });
+          await this.sleepInterruptible(delay2);
         }
         return false;
       }
@@ -24361,7 +25147,7 @@ function buildGoalPreamble(goal, deliverables) {
 }
 
 // src/execution/compaction-summary-cache.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // src/utils/lru-cache.ts
 var LruCache = class {
@@ -24499,7 +25285,7 @@ function semanticBlock(block) {
   }
 }
 function compactionSummaryKey(model, prompt, messages) {
-  const hash2 = createHash5("sha256");
+  const hash2 = createHash6("sha256");
   hash2.update("wrongstack-compaction-summary-v2\0").update(model).update("\0").update(prompt);
   for (const message of messages) {
     hash2.update("\0").update(message.role).update("\0");
@@ -24713,7 +25499,7 @@ ${summaryText}` : summaryText;
 };
 
 // src/execution/parallel-eternal-engine.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
   constructor(opts) {
@@ -24790,7 +25576,7 @@ var ParallelEternalEngine = class {
     this.state = "running";
     await this.persistState("running");
     const config = {
-      coordinatorId: `parallel-${randomUUID12().slice(0, 8)}`,
+      coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
       maxConcurrent: this.slots,
       doneCondition: { type: "all_tasks_done" }
     };
@@ -24844,7 +25630,7 @@ var ParallelEternalEngine = class {
     }
     if (!this.coordinator) {
       const config = {
-        coordinatorId: `parallel-${randomUUID12().slice(0, 8)}`,
+        coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
         maxConcurrent: this.slots,
         doneCondition: { type: "all_tasks_done" }
       };
@@ -24930,7 +25716,7 @@ ${recentJournal}` : "No prior iterations.",
       const task = expectDefined(tasks[i]);
       const route = routes[i] ?? null;
       const subagentId = `parallel-${this.iterations}-${i}`;
-      const taskId = randomUUID12();
+      const taskId = randomUUID13();
       const personaLine = route ? `Acting agent: ${route.definition.config.name} \u2014 ${route.definition.capability.summary}
 ` : "";
       const spec = {
@@ -25145,7 +25931,7 @@ ${lastFew}` : "No prior iterations.",
 };
 
 // src/core/streaming-response-builder.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -25205,7 +25991,7 @@ function handleContentBlockStart(state, ev) {
     state.textBuffers.push("");
     state.blockOrder.push({ kind: "text", idx: state.currentTextIndex });
   } else if (kind === "tool_use") {
-    const id = ev.id ?? randomUUID13();
+    const id = ev.id ?? randomUUID14();
     state.tools.set(id, { name: ev.name ?? "unknown", partial: "" });
     state.blockOrder.push({ kind: "tool", id });
     state.currentTextIndex = -1;
@@ -25414,8 +26200,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve19) => {
-            drainTimer = setTimeout(resolve19, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve21) => {
+            drainTimer = setTimeout(resolve21, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -25439,7 +26225,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
 }
 
 // src/chronicle/prompt-manifest.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function createChroniclePromptManifest(request) {
   const roleCounts = {}, blockCounts = {};
   const messages = request.messages.map((message, index) => messageSummary(message, index, roleCounts, blockCounts));
@@ -25526,11 +26312,11 @@ function countBlocks(blocks) {
   return counts;
 }
 function hash(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 function contentIdentity(content) {
   if (typeof content === "string") return { hash: hash(content), bytes: Buffer.byteLength(content) };
-  const digest = createHash6("sha256");
+  const digest = createHash7("sha256");
   let bytes = 0;
   const add = (value) => {
     if (!value) return;
@@ -25612,7 +26398,7 @@ function replaceAllCaseInsensitive(haystack, needle, replacement) {
 }
 
 // src/core/provider-runner.ts
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 function scrubProviderBody(body) {
   if (!body) return void 0;
   return {
@@ -25634,11 +26420,11 @@ function providerLogCtx(p, r) {
 }
 async function runProviderWithRetry(opts) {
   const { provider, request, signal, ctx, events, retry, logger, tracer } = opts;
-  const logicalRequestId = randomUUID14();
+  const logicalRequestId = randomUUID15();
   const promptManifest = createChroniclePromptManifest(request);
   let attempt = 0;
   for (; ; ) {
-    const attemptId = randomUUID14();
+    const attemptId = randomUUID15();
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startedNs = process.hrtime.bigint();
     const correlation = {
@@ -25711,7 +26497,7 @@ async function runProviderWithRetry(opts) {
       const description = scrubErrorText(
         isProviderErr ? err.describe() : errAsErr.message
       );
-      const delay = canRetry ? Math.round(retry.delayMs(attempt, isProviderErr ? err : errAsErr)) : void 0;
+      const delay2 = canRetry ? Math.round(retry.delayMs(attempt, isProviderErr ? err : errAsErr)) : void 0;
       events.emit("provider.attempt.failed", {
         ...correlation,
         startedAt,
@@ -25722,7 +26508,7 @@ async function runProviderWithRetry(opts) {
         description,
         retryable: canRetry,
         retryScheduled: canRetry,
-        ...delay !== void 0 ? { retryDelayMs: delay } : {},
+        ...delay2 !== void 0 ? { retryDelayMs: delay2 } : {},
         ...providerErrorBody?.requestId ? { providerRequestId: providerErrorBody.requestId } : {},
         ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
@@ -25748,11 +26534,11 @@ async function runProviderWithRetry(opts) {
       }
       const attemptNum = attempt + 1;
       const maxAttempts = retry.maxAttempts(isProviderErr ? err : errAsErr);
-      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay}ms \u2014 ${description}`, {
+      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay2}ms \u2014 ${description}`, {
         ...providerLogCtx(provider, request),
         attempt: attemptNum,
         maxAttempts,
-        delayMs: delay,
+        delayMs: delay2,
         errorDescription: description,
         status: isProviderErr ? err.status : void 0,
         errorBody: providerErrorBody
@@ -25761,12 +26547,12 @@ async function runProviderWithRetry(opts) {
         sessionId: resolveEventSessionId(ctx),
         providerId: isProviderErr ? err.providerId : provider.id,
         attempt: attemptNum,
-        delayMs: delay,
+        delayMs: delay2,
         status: isProviderErr ? err.status : 0,
         description,
         ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
-      await new Promise((resolve19, reject) => {
+      await new Promise((resolve21, reject) => {
         let settled = false;
         const cleanup = () => {
           clearTimeout(t);
@@ -25782,8 +26568,8 @@ async function runProviderWithRetry(opts) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve19();
-        }, delay);
+          resolve21();
+        }, delay2);
         if (signal.aborted) {
           onAbort();
           return;
@@ -26406,8 +27192,8 @@ Summarize the following message range:`;
 };
 
 // src/execution/skill-loader.ts
-import * as fs5 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as fs6 from "node:fs/promises";
+import * as path28 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -26471,7 +27257,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs5.stat(path25.join(dir, entry.name))).isDirectory();
+      return (await fs6.stat(path28.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -26495,7 +27281,7 @@ var DefaultSkillLoader = class {
       for (const tool of FOREIGN_SKILL_TOOLS) {
         if (!foreignIds.includes(tool.id)) continue;
         dirs.push({
-          dir: path25.join(root, "." + tool.id, tool.subdir),
+          dir: path28.join(root, "." + tool.id, tool.subdir),
           source: "foreign",
           originTool: tool.id
         });
@@ -26520,15 +27306,15 @@ var DefaultSkillLoader = class {
     this.shadowed = [];
     for (const { dir, source, originTool } of this.dirs) {
       try {
-        const entries = (await fs5.readdir(dir, { withFileTypes: true })).sort(
+        const entries = (await fs6.readdir(dir, { withFileTypes: true })).sort(
           (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
-          const skillFile = path25.join(dir, e.name, "SKILL.md");
+          const skillFile = path28.join(dir, e.name, "SKILL.md");
           let raw;
           try {
-            raw = await fs5.readFile(skillFile, "utf8");
+            raw = await fs6.readFile(skillFile, "utf8");
           } catch {
             continue;
           }
@@ -26647,7 +27433,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const body = await fs5.readFile(m.path, "utf8");
+    const body = await fs6.readFile(m.path, "utf8");
     this.bodyCache.set(key, body);
     return body;
   }
@@ -26657,12 +27443,12 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path25.join(path25.dirname(m.path), "SKILL.save.md");
+    const savePath = path28.join(path28.dirname(m.path), "SKILL.save.md");
     let result;
     try {
-      result = await fs5.readFile(savePath, "utf8");
+      result = await fs6.readFile(savePath, "utf8");
     } catch {
-      const full = await fs5.readFile(m.path, "utf8");
+      const full = await fs6.readFile(m.path, "utf8");
       const body = stripFrontmatter(full);
       const compact = compactSkillBody(body);
       if (compact) {
@@ -26690,12 +27476,12 @@ function parseDescriptionFromText(desc) {
 }
 
 // src/execution/prompt-loader.ts
-import * as fs7 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as fs8 from "node:fs/promises";
+import * as path30 from "node:path";
 
 // src/storage/prompt-store.ts
-import * as fs6 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as fs7 from "node:fs/promises";
+import * as path29 from "node:path";
 var SCHEMA_VERSION = 2;
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -26756,12 +27542,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fs6.readdir(this.dir);
+      const files = await fs7.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs6.readFile(path26.join(this.dir, file), "utf8")
+            await fs7.readFile(path29.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -26775,9 +27561,9 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path26.join(this.dir, `${id}.json`);
+    const file = path29.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fs6.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs7.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -26785,14 +27571,14 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path26.join(this.dir, `${entry.id}.json`);
+    const file = path29.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path26.join(this.dir, `${id}.json`);
+    const file = path29.join(this.dir, `${id}.json`);
     try {
-      await fs6.unlink(file);
+      await fs7.unlink(file);
       return true;
     } catch {
       return false;
@@ -26879,7 +27665,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path27.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path30.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -26992,7 +27778,7 @@ var DefaultPromptLoader = class {
     const files = await walkJson(dir);
     for (const file of files) {
       try {
-        const parsed = JSON.parse(await fs7.readFile(file, "utf8"));
+        const parsed = JSON.parse(await fs8.readFile(file, "utf8"));
         const migrated = migratePromptEntry(parsed);
         if (migrated) out.push({ ...migrated, source: "builtin" });
       } catch {
@@ -27006,12 +27792,12 @@ async function walkJson(dir) {
   const out = [];
   let entries;
   try {
-    entries = await fs7.readdir(dir, { withFileTypes: true });
+    entries = await fs8.readdir(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const e of entries) {
-    const full = path27.join(dir, e.name);
+    const full = path30.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -27198,9 +27984,9 @@ function readPolicy(ctx) {
 }
 
 // src/execution/tool-executor.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
-import * as fs9 from "node:fs/promises";
-import * as path30 from "node:path";
+import { randomUUID as randomUUID17 } from "node:crypto";
+import * as fs10 from "node:fs/promises";
+import * as path33 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // src/observability/process-telemetry.ts
@@ -27212,13 +27998,15 @@ function runWithProcessTelemetry(context, run) {
 
 // src/security/kanban-boundary.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path31 from "node:path";
 import {
+  evaluateContractGraphReadiness,
   evaluateKanbanBoundaryOpaque,
   evaluateKanbanBoundaryPath,
   readBoard,
   resolveKanbanBoundaryLayers
 } from "@wrongstack/kanban";
+var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo"]);
 var PATH_KEYS = /* @__PURE__ */ new Set([
   "path",
   "paths",
@@ -27243,12 +28031,60 @@ var TOOL_PATH_KEYS = {
   // filesystem target in language_info. Keep ambiguous names tool-specific.
   language_info: ["target"]
 };
-async function evaluateToolKanbanBoundary(tool, input, ctx) {
+async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
+  if (tool.name === "kanban") return { decision: "allow" };
   const identity = resolveKanbanIdentity(ctx);
-  if (!identity.boardId) return { decision: "allow" };
+  const governanceRequired = options.requireGovernance && isGovernedMutation(tool, input);
+  if (!identity.boardId) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
+    } : { decision: "allow" };
+  }
   const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
-  if (!board) return { decision: "allow" };
+  if (!board) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: `Active Kanban board not found: ${identity.boardId}. Recreate or select a valid managed card before mutation.`,
+      boardId: identity.boardId,
+      ...identity.taskId ? { taskId: identity.taskId } : {}
+    } : { decision: "allow" };
+  }
   const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  if (governanceRequired) {
+    if (!identity.taskId) {
+      return {
+        decision: "block",
+        reason: "Kanban governance requires an active task, not only a board. Complete the card details and call kanban start_task before mutation.",
+        boardId: board.id
+      };
+    }
+    if (!task) {
+      return {
+        decision: "block",
+        reason: `Active Kanban task not found: ${identity.taskId}. Call kanban start_task with a valid card.`,
+        boardId: board.id,
+        taskId: identity.taskId
+      };
+    }
+    const readiness = evaluateContractGraphReadiness(board, task.id);
+    if (!readiness.ready) {
+      return {
+        decision: "block",
+        reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+    if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
+      return {
+        decision: "block",
+        reason: "Active card must be in Running with a live assignment before product mutation. Call kanban start_task after completing the required card details.",
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+  }
   if (identity.leaseId && task?.assignment) {
     const caps2 = tool.capabilities ?? [];
     const isWrite = caps2.includes("fs.write") || caps2.includes("fs.write.outside-project") || caps2.some((c) => c.startsWith("shell."));
@@ -27284,6 +28120,19 @@ async function evaluateToolKanbanBoundary(tool, input, ctx) {
     ...task ? { taskId: task.id } : {}
   };
 }
+function isGovernedMutation(tool, input) {
+  if (!tool.mutating || GOVERNANCE_CONTROL_TOOLS.has(tool.name)) return false;
+  if (tool.capabilities?.includes("tool.meta")) return false;
+  if (tool.name === "git") {
+    const command = input["command"];
+    if (command === "status" || command === "log" || command === "diff") return false;
+    if (command === "worktree" && input["worktreeAction"] === "list") return false;
+  }
+  const capabilities = tool.capabilities ?? [];
+  return capabilities.some(
+    (capability) => capability === "fs.write" || capability === "fs.write.outside-project" || capability === "package.install" || capability === "tool.mutate.any" || capability.startsWith("shell.") || capability === "net.outbound"
+  );
+}
 function resolveKanbanIdentity(ctx) {
   const metaKanban = ctx.meta["kanban"];
   const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
@@ -27301,10 +28150,10 @@ function resolveKanbanIdentity(ctx) {
 async function extractCandidatePaths(toolName, input, ctx) {
   if (toolName === "patch" && typeof input["patch"] === "string") {
     const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
-    const directory = path28.isAbsolute(directoryInput) ? directoryInput : path28.resolve(ctx.workingDir, directoryInput);
+    const directory = path31.isAbsolute(directoryInput) ? directoryInput : path31.resolve(ctx.workingDir, directoryInput);
     const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
     const targets = extractPatchTargets(input["patch"], strip).map(
-      (target) => relativeToProject(path28.resolve(directory, target), ctx.projectRoot)
+      (target) => relativeToProject(path31.resolve(directory, target), ctx.projectRoot)
     );
     return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
   }
@@ -27314,7 +28163,7 @@ async function extractCandidatePaths(toolName, input, ctx) {
   collectPathValues(input, values, pathKeys);
   if (toolName === "scaffold" && typeof input["name"] === "string") {
     const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
-    values.push(path28.join(cwd, input["name"]));
+    values.push(path31.join(cwd, input["name"]));
   }
   const candidates = [
     ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
@@ -27322,21 +28171,21 @@ async function extractCandidatePaths(toolName, input, ctx) {
   return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
 }
 async function canonicalizeCandidatePath(candidate, ctx) {
-  if (path28.isAbsolute(candidate)) return candidate;
-  const absolute = path28.resolve(ctx.projectRoot, candidate);
+  if (path31.isAbsolute(candidate)) return candidate;
+  const absolute = path31.resolve(ctx.projectRoot, candidate);
   const canonicalRoot = await realpath3(ctx.projectRoot).catch(() => ctx.projectRoot);
   let probe = absolute;
   const missingSegments = [];
   while (true) {
     try {
-      const canonical = path28.join(await realpath3(probe), ...missingSegments);
+      const canonical = path31.join(await realpath3(probe), ...missingSegments);
       return relativeToProject(canonical, canonicalRoot);
     } catch (cause) {
       const code = cause.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
-      const parent = path28.dirname(probe);
+      const parent = path31.dirname(probe);
       if (parent === probe) return absolute;
-      missingSegments.unshift(path28.basename(probe));
+      missingSegments.unshift(path31.basename(probe));
       probe = parent;
     }
   }
@@ -27359,12 +28208,12 @@ function splitPathList(value) {
   return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function resolveInputPath(value, ctx) {
-  const absolute = path28.isAbsolute(value) ? value : path28.resolve(ctx.workingDir, value);
+  const absolute = path31.isAbsolute(value) ? value : path31.resolve(ctx.workingDir, value);
   return relativeToProject(absolute, ctx.projectRoot);
 }
 function relativeToProject(absolute, projectRoot) {
-  const relative8 = path28.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative8.startsWith("../") || path28.isAbsolute(relative8) ? absolute : relative8 || ".";
+  const relative8 = path31.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative8.startsWith("../") || path31.isAbsolute(relative8) ? absolute : relative8 || ".";
 }
 function extractPatchTargets(patchText, strip) {
   const targets = [];
@@ -27387,9 +28236,9 @@ function numericValue(value) {
 var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
 
 // src/execution/tool-executor-support.ts
-import { createHash as createHash7, randomUUID as randomUUID15 } from "node:crypto";
-import * as fs8 from "node:fs/promises";
-import * as path29 from "node:path";
+import { createHash as createHash8, randomUUID as randomUUID16 } from "node:crypto";
+import * as fs9 from "node:fs/promises";
+import * as path32 from "node:path";
 
 // src/types/tool-markers.ts
 var MALFORMED_ARG_MARKERS = ["__raw", "__raw_arguments", "_raw"];
@@ -27514,12 +28363,12 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     return content;
   }
   try {
-    const dir = path29.join(wstackGlobalRoot(), "tool-output");
-    await fs8.mkdir(dir, { recursive: true });
+    const dir = path32.join(wstackGlobalRoot(), "tool-output");
+    await fs9.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path29.join(dir, `${stamp}-${safeTool}-${randomUUID15()}.log`);
-    await fs8.writeFile(filePath, content, "utf8");
+    const filePath = path32.join(dir, `${stamp}-${safeTool}-${randomUUID16()}.log`);
+    await fs9.writeFile(filePath, content, "utf8");
     const marker = `[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
     const fixedBytes = Buffer.byteLength(marker + TOOL_OUTPUT_ARTIFACT_OMISSION, "utf8");
     const previewBytes = Math.min(
@@ -27544,7 +28393,7 @@ function hashPermissionInput(input, scrubber2) {
   } catch {
     serialized = String(input);
   }
-  return createHash7("sha256").update(scrubber2.scrub(serialized), "utf8").digest("hex");
+  return createHash8("sha256").update(scrubber2.scrub(serialized), "utf8").digest("hex");
 }
 function sliceUtf8Prefix(text, maxBytes) {
   if (maxBytes <= 0) return "";
@@ -27577,6 +28426,41 @@ function sliceUtf8Suffix(text, maxBytes) {
   return text.slice(start);
 }
 
+// src/execution/tool-error-taxonomy.ts
+function toolErrorResult(use, err, opts = {}) {
+  const { category, retryable, detail } = classifyToolError(err);
+  const rawMessage = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
+  const userMessage = opts.scrubber ? opts.scrubber(rawMessage) : rawMessage;
+  const info = {
+    category,
+    retryable,
+    userMessage,
+    ...detail !== void 0 ? { detail } : {}
+  };
+  const prefix = formatErrorPrefix(category, retryable);
+  const detailSuffix = detail ? ` [${detail}]` : "";
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `${prefix}: ${userMessage}${detailSuffix}`,
+    is_error: true,
+    // Attach structured info for programmatic consumers (retry logic,
+    // audit log, observability).
+    _toolErrorInfo: info
+  };
+}
+function formatErrorPrefix(category, retryable) {
+  const label = CATEGORY_LABELS[category] ?? "Error";
+  return retryable ? `${label} (retryable)` : label;
+}
+var CATEGORY_LABELS = {
+  ["transient" /* TRANSIENT */]: "Transient error",
+  ["not_found" /* NOT_FOUND */]: "Not found",
+  ["permission" /* PERMISSION */]: "Permission denied",
+  ["validation" /* VALIDATION */]: "Validation error",
+  ["fatal" /* FATAL */]: "Error"
+};
+
 // src/execution/tool-executor-logging.ts
 function toolLogBase(ctx, use, toolName, durationMs) {
   return {
@@ -27682,41 +28566,6 @@ function blockedByHookResult(use, reason) {
   };
 }
 
-// src/execution/tool-error-taxonomy.ts
-function toolErrorResult(use, err, opts = {}) {
-  const { category, retryable, detail } = classifyToolError(err);
-  const rawMessage = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
-  const userMessage = opts.scrubber ? opts.scrubber(rawMessage) : rawMessage;
-  const info = {
-    category,
-    retryable,
-    userMessage,
-    ...detail !== void 0 ? { detail } : {}
-  };
-  const prefix = formatErrorPrefix(category, retryable);
-  const detailSuffix = detail ? ` [${detail}]` : "";
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content: `${prefix}: ${userMessage}${detailSuffix}`,
-    is_error: true,
-    // Attach structured info for programmatic consumers (retry logic,
-    // audit log, observability).
-    _toolErrorInfo: info
-  };
-}
-function formatErrorPrefix(category, retryable) {
-  const label = CATEGORY_LABELS[category] ?? "Error";
-  return retryable ? `${label} (retryable)` : label;
-}
-var CATEGORY_LABELS = {
-  ["transient" /* TRANSIENT */]: "Transient error",
-  ["not_found" /* NOT_FOUND */]: "Not found",
-  ["permission" /* PERMISSION */]: "Permission denied",
-  ["validation" /* VALIDATION */]: "Validation error",
-  ["fatal" /* FATAL */]: "Error"
-};
-
 // src/execution/tool-executor-stream.ts
 async function executeStreamedTool({
   tool,
@@ -28005,7 +28854,9 @@ ${errorDetails}`,
           return { result, tool, durationMs: Date.now() - start };
         }
       }
-      const boundary = await evaluateToolKanbanBoundary(tool, use.input, ctx);
+      const boundary = await evaluateToolKanbanBoundary(tool, use.input, ctx, {
+        requireGovernance: this.opts.requireKanbanGovernance
+      });
       if (boundary.decision === "block") {
         const result = {
           type: "tool_result",
@@ -28059,18 +28910,18 @@ ${errorDetails}`,
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
-            (resolve19, reject) => {
+            (resolve21, reject) => {
               const signal = ctx.signal;
-              const onAbort = () => resolve19("abort");
+              const onAbort = () => resolve21("abort");
               if (signal.aborted) {
-                resolve19("abort");
+                resolve21("abort");
                 return;
               }
               signal.addEventListener("abort", onAbort, { once: true });
               awaiter(tool, use.input, use.id, suggestedPattern).then(
                 (c) => {
                   signal.removeEventListener("abort", onAbort);
-                  resolve19(c);
+                  resolve21(c);
                 },
                 (e) => {
                   signal.removeEventListener("abort", onAbort);
@@ -28116,10 +28967,10 @@ ${errorDetails}`,
         const inputPath = use.input && typeof use.input === "object" ? use.input.path : void 0;
         const caps = tool.capabilities ?? [];
         const hasFileCapability = caps.includes("fs.read") || caps.includes("fs.write");
-        const absPath = hasFileCapability && typeof inputPath === "string" ? path30.isAbsolute(inputPath) ? inputPath : path30.resolve(ctx.projectRoot, inputPath) : void 0;
+        const absPath = hasFileCapability && typeof inputPath === "string" ? path33.isAbsolute(inputPath) ? inputPath : path33.resolve(ctx.projectRoot, inputPath) : void 0;
         let writeTargetExisted;
         if (tool.name === "write" && caps.includes("fs.write") && absPath) {
-          writeTargetExisted = await fs9.stat(absPath).then(
+          writeTargetExisted = await fs10.stat(absPath).then(
             (stat15) => stat15.isFile(),
             (error2) => error2.code === "ENOENT" ? false : void 0
           );
@@ -28281,7 +29132,7 @@ ${post.additionalContext}`;
     const bridge = async (toolName, input) => {
       const nestedUse = {
         type: "tool_use",
-        id: `nested-${randomUUID16()}`,
+        id: `nested-${randomUUID17()}`,
         name: toolName,
         input
       };
@@ -28404,7 +29255,7 @@ ${preToolContext.text}` : preToolContext.text;
     ]);
     let output;
     const execute = () => typeof tool.executeStream === "function" ? this.runStreamedTool(tool, input, ctx, combined, toolUseId) : (async () => tool.execute(input, ctx, { signal: combined }))();
-    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID16()}`;
+    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID17()}`;
     const toolPromise = this.opts.events ? runWithNetworkTelemetry(
       {
         events: this.opts.events,
@@ -28430,7 +29281,7 @@ ${preToolContext.text}` : preToolContext.text;
     toolPromise.catch(() => {
     });
     try {
-      output = await new Promise((resolve19, reject) => {
+      output = await new Promise((resolve21, reject) => {
         const onAbort = () => {
           setTimeout(() => reject(abortReasonToError(combined.reason)), 0);
         };
@@ -28438,7 +29289,7 @@ ${preToolContext.text}` : preToolContext.text;
         toolPromise.then(
           (v) => {
             combined.removeEventListener("abort", onAbort);
-            resolve19(v);
+            resolve21(v);
           },
           (e) => {
             combined.removeEventListener("abort", onAbort);
@@ -28991,28 +29842,28 @@ function codexModelMeta(id) {
 }
 
 // src/models/mode-store.ts
-import * as fs10 from "node:fs/promises";
-import * as path32 from "node:path";
+import * as fs11 from "node:fs/promises";
+import * as path35 from "node:path";
 
 // src/types/mode-prompts.ts
-import { readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import * as path31 from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
+import * as path34 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync7(path31.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync9(path34.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function modePromptDirCandidates() {
-  const here = path31.dirname(fileURLToPath4(import.meta.url));
+  const here = path34.dirname(fileURLToPath5(import.meta.url));
   const candidates = [
-    path31.resolve(here, "../../instructions/modes"),
-    path31.resolve(here, "../instructions/modes"),
-    path31.resolve(here, "instructions/modes")
+    path34.resolve(here, "../../instructions/modes"),
+    path34.resolve(here, "../instructions/modes"),
+    path34.resolve(here, "instructions/modes")
   ];
   return candidates.sort((a, b) => Number(!isDirectory3(a)) - Number(!isDirectory3(b)));
 }
@@ -29244,8 +30095,8 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path32.join(this.configDir, "mode.json");
-      const content = await fs10.readFile(configPath, "utf8");
+      const configPath = path35.join(this.configDir, "mode.json");
+      const content = await fs11.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
     } catch {
@@ -29254,8 +30105,8 @@ var DefaultModeStore = class {
   }
   async saveActiveMode() {
     try {
-      await fs10.mkdir(this.configDir, { recursive: true });
-      const configPath = path32.join(this.configDir, "mode.json");
+      await fs11.mkdir(this.configDir, { recursive: true });
+      const configPath = path35.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -29267,14 +30118,14 @@ var DefaultModeStore = class {
 async function loadProjectModes(modesDir) {
   const modes = [];
   try {
-    const entries = await fs10.readdir(modesDir);
+    const entries = await fs11.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path32.join(modesDir, entry);
-      const stat15 = await fs10.stat(filePath);
+      const filePath = path35.join(modesDir, entry);
+      const stat15 = await fs11.stat(filePath);
       if (!stat15.isFile()) continue;
-      const content = await fs10.readFile(filePath, "utf8");
-      const id = path32.basename(entry, path32.extname(entry));
+      const content = await fs11.readFile(filePath, "utf8");
+      const id = path35.basename(entry, path35.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -29290,8 +30141,8 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path32.join(modesDir, "modes.json");
-    const content = await fs10.readFile(manifestPath, "utf8");
+    const manifestPath = path35.join(modesDir, "modes.json");
+    const content = await fs11.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
       modes.push(mode);
@@ -29302,8 +30153,8 @@ async function loadUserModes(modesDir) {
 }
 
 // src/models/models-registry.ts
-import * as fs11 from "node:fs/promises";
-import * as path33 from "node:path";
+import * as fs12 from "node:fs/promises";
+import * as path36 from "node:path";
 var DEFAULT_URL = "https://models.dev/api.json";
 var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
 var DEFAULT_TTL_SECONDS = 3 * 3600;
@@ -29380,7 +30231,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path33.join(path33.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path36.join(path36.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
     this.logger = opts.logger ?? noOpLogger;
   }
   async load(opts = {}) {
@@ -29568,7 +30419,7 @@ var DefaultModelsRegistry = class {
   async readOverlayFile() {
     if (!this.overlayFile) return void 0;
     try {
-      const raw = await fs11.readFile(this.overlayFile, "utf8");
+      const raw = await fs12.readFile(this.overlayFile, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -29647,7 +30498,7 @@ var DefaultModelsRegistry = class {
   }
   async readCacheAt(file) {
     try {
-      const raw = await fs11.readFile(file, "utf8");
+      const raw = await fs12.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -29655,7 +30506,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path33.resolve(this.cacheFile);
+    return path36.resolve(this.cacheFile);
   }
 };
 var REASONING_EFFORTS = /* @__PURE__ */ new Set([
@@ -30006,9 +30857,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve19) => {
+    const timeout = new Promise((resolve21) => {
       timer = setTimeout(
-        () => resolve19({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve21({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -30206,7 +31057,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path42 = opts.path ?? "/metrics";
+  const path45 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const token = opts.token;
@@ -30229,7 +31080,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path42) {
+    if (url === path45) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -30266,23 +31117,23 @@ async function startMetricsServer(opts) {
   let server;
   if (useHttps && tls) {
     const { createServer } = await import("node:https");
-    const { readFileSync: readFileSync9 } = await import("node:fs");
+    const { readFileSync: readFileSync11 } = await import("node:fs");
     server = createServer(
-      { cert: readFileSync9(tls.cert), key: readFileSync9(tls.key) },
+      { cert: readFileSync11(tls.cert), key: readFileSync11(tls.key) },
       listener
     );
   } else {
     const { createServer } = await import("node:http");
     server = createServer(listener);
   }
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve21, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve19();
+      resolve21();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -30293,9 +31144,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path42}`,
-    close: () => new Promise((resolve19, reject) => {
-      server.close((err) => err ? reject(err) : resolve19());
+    url: `${protocol}://${host}:${boundPort}${path45}`,
+    close: () => new Promise((resolve21, reject) => {
+      server.close((err) => err ? reject(err) : resolve21());
     })
   };
 }
@@ -30565,8 +31416,8 @@ function startOtlpTraceExporter(opts) {
 }
 
 // src/security/permission-policy.ts
-import * as fs12 from "node:fs/promises";
-import * as path36 from "node:path";
+import * as fs13 from "node:fs/promises";
+import * as path39 from "node:path";
 
 // src/security/permission-policy-schema.ts
 var TRUST_POLICY_LIMITS = Object.freeze({
@@ -30611,19 +31462,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path42, message) {
-  diagnostics.push({ severity: "error", code, path: path42, message });
+function error(diagnostics, code, path45, message) {
+  diagnostics.push({ severity: "error", code, path: path45, message });
 }
-function validatePatterns(value, path42, diagnostics) {
+function validatePatterns(value, path45, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path42, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path45, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path42,
+      path45,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -30631,7 +31482,7 @@ function validatePatterns(value, path42, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path42}[${index}]`;
+    const itemPath = `${path45}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -30735,7 +31586,7 @@ function validateTrustPolicy(value) {
 }
 
 // src/security/yolo-risk.ts
-import * as path34 from "node:path";
+import * as path37 from "node:path";
 var CATASTROPHIC_PATTERNS = [
   /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
   // make a filesystem — wipes a partition
@@ -30795,9 +31646,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path34.resolve(projectRoot, rawPath);
-  const relative8 = path34.relative(projectRoot, resolved);
-  return !!relative8 && !relative8.startsWith("..") && !path34.isAbsolute(relative8);
+  const resolved = path37.resolve(projectRoot, rawPath);
+  const relative8 = path37.relative(projectRoot, resolved);
+  return !!relative8 && !relative8.startsWith("..") && !path37.isAbsolute(relative8);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -31047,7 +31898,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 
 // src/security/permission-helpers.ts
 import { realpathSync } from "node:fs";
-import * as path35 from "node:path";
+import * as path38 from "node:path";
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -31131,24 +31982,24 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync(probe) : path35.join(realpathSync(probe), ...tail);
+      return tail.length === 0 ? realpathSync(probe) : path38.join(realpathSync(probe), ...tail);
     } catch {
-      const parent = path35.dirname(probe);
+      const parent = path38.dirname(probe);
       if (parent === probe) return p;
-      tail.unshift(path35.basename(probe));
+      tail.unshift(path38.basename(probe));
       probe = parent;
     }
   }
 }
 var agentStateRootRealCache = /* @__PURE__ */ new Map();
 function isInsideAgentStateRoot(absPath) {
-  const lexicalRoot = normalizeForCompare(path35.resolve(wstackGlobalRoot()));
+  const lexicalRoot = normalizeForCompare(path38.resolve(wstackGlobalRoot()));
   if (!lexicalRoot) return false;
   const target = normalizeForCompare(absPath);
   if (target === lexicalRoot || target.startsWith(`${lexicalRoot}/`)) return true;
   let realRoot = agentStateRootRealCache.get(lexicalRoot);
   if (realRoot === void 0) {
-    realRoot = normalizeForCompare(realpathOfNearestExisting(path35.resolve(wstackGlobalRoot())));
+    realRoot = normalizeForCompare(realpathOfNearestExisting(path38.resolve(wstackGlobalRoot())));
     agentStateRootRealCache.set(lexicalRoot, realRoot);
   }
   if (!realRoot || realRoot === lexicalRoot) return false;
@@ -31157,7 +32008,7 @@ function isInsideAgentStateRoot(absPath) {
 }
 function isProtectedAgentStatePath(absPath) {
   if (!isInsideAgentStateRoot(absPath)) return false;
-  return AGENT_STATE_SENSITIVE_BASENAMES.test(path35.basename(normalizeForCompare(absPath)));
+  return AGENT_STATE_SENSITIVE_BASENAMES.test(path38.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
   const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
@@ -31318,7 +32169,7 @@ var DefaultPermissionPolicy = class {
     if (!hasCapability(tool, ToolCapabilities.FS_WRITE)) return false;
     for (const targetPath of fsWriteTargetPaths(input)) {
       const base = ctx.workingDir ?? ctx.cwd;
-      const resolved = base ? path36.resolve(base, targetPath) : path36.resolve(targetPath);
+      const resolved = base ? path39.resolve(base, targetPath) : path39.resolve(targetPath);
       if (isInsideAgentStateRoot(resolved)) return true;
     }
     return false;
@@ -31363,7 +32214,7 @@ var DefaultPermissionPolicy = class {
     this.policyDiagnostics = [];
     this.policyInvalid = false;
     try {
-      const raw = await fs12.readFile(this.trustFile, "utf8");
+      const raw = await fs13.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok) {
         this.policy = {};
@@ -31985,9 +32836,9 @@ var DefaultPermissionPolicy = class {
 
 // src/security/secret-vault.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 import * as fsp22 from "node:fs/promises";
-import * as path37 from "node:path";
+import * as path40 from "node:path";
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
@@ -32127,7 +32978,7 @@ function checkKeyFilePermissions(keyFile, opts) {
   if (process.platform === "win32") return;
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   try {
-    const stat15 = fs13.statSync(keyFile);
+    const stat15 = fs14.statSync(keyFile);
     const actualMode = stat15.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
       void restrictFilePermissions(keyFile, {
@@ -32143,21 +32994,21 @@ function checkKeyFilePermissions(keyFile, opts) {
 }
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes3(4).toString("hex")}.tmp`;
-  const fd = fs13.openSync(tmp, "w", 384);
+  const fd = fs14.openSync(tmp, "w", 384);
   try {
-    fs13.writeFileSync(fd, content);
+    fs14.writeFileSync(fd, content);
     try {
-      fs13.fsyncSync(fd);
+      fs14.fsyncSync(fd);
     } catch {
     }
   } finally {
-    fs13.closeSync(fd);
+    fs14.closeSync(fd);
   }
   try {
-    fs13.renameSync(tmp, keyFile);
+    fs14.renameSync(tmp, keyFile);
   } catch (err) {
     try {
-      fs13.unlinkSync(tmp);
+      fs14.unlinkSync(tmp);
     } catch {
     }
     throw err;
@@ -32280,7 +33131,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path40.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -32320,7 +33171,7 @@ var DefaultSecretVault = class {
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
-      const buf = fs13.readFileSync(this.keyFile);
+      const buf = fs14.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
@@ -32367,17 +33218,17 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path40.dirname(this.keyFile), { recursive: true });
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
-      fs13.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      fs14.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
       this.scheduleKeyHardening();
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       this.scheduleKeyHardening();
-      const buf = fs13.readFileSync(this.keyFile);
+      const buf = fs14.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
@@ -32427,7 +33278,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp22.mkdir(path37.dirname(configPath), { recursive: true });
+  await fsp22.mkdir(path40.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions2(configPath);
   await vault.flushHardening?.();
@@ -32482,7 +33333,7 @@ function walkCount(node, vault, counter) {
 // src/storage/attachment-store.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
-import * as path38 from "node:path";
+import * as path41 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE2 = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -32503,7 +33354,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp23.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path38.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path41.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -32622,7 +33473,7 @@ function mergeAdjacentText(blocks) {
 }
 
 // src/storage/config-loader.ts
-import * as fs14 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 
 // src/storage/config-loader/bootstrap.ts
 var BOOTSTRAP_KEYS = /* @__PURE__ */ new Set(["version", "activeProfile"]);
@@ -33041,8 +33892,8 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "The other half of the filesystem confinement switch."
   }
 ];
-function deleteNestedPath(target, path42) {
-  const segments = path42.split(".");
+function deleteNestedPath(target, path45) {
+  const segments = path45.split(".");
   const last = segments[segments.length - 1];
   if (last === void 0) return false;
   let cursor = target;
@@ -33099,16 +33950,16 @@ function assertInProjectAllowListComplete() {
     );
   }
   const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path42 }) => !IN_PROJECT_ALLOWED_KEYS.has(path42.split(".")[0] ?? "")
-  ).map(({ path: path42 }) => path42);
+    ({ path: path45 }) => !IN_PROJECT_ALLOWED_KEYS.has(path45.split(".")[0] ?? "")
+  ).map(({ path: path45 }) => path45);
   if (orphanedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
     );
   }
   const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path42 }) => path42.split(".").length < 2 || path42.split(".").some((s) => s.length === 0)
-  ).map(({ path: path42 }) => path42);
+    ({ path: path45 }) => path45.split(".").length < 2 || path45.split(".").some((s) => s.length === 0)
+  ).map(({ path: path45 }) => path45);
   if (malformedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
@@ -33136,8 +33987,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  for (const { path: path42 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path42)) stripped.push(path42);
+  for (const { path: path45 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path45)) stripped.push(path45);
   }
   if (stripped.length > 0) {
     warn(
@@ -33326,10 +34177,10 @@ function removeLegacySageEngine(config) {
 }
 
 // src/storage/config-loader/path-identity.ts
-import * as path39 from "node:path";
+import * as path42 from "node:path";
 function samePath(a, b) {
-  let ra = path39.resolve(a);
-  let rb = path39.resolve(b);
+  let ra = path42.resolve(a);
+  let rb = path42.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -33489,7 +34340,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
         let parsed;
         let fileExisted = true;
         try {
-          const raw = await fs14.readFile(fp, "utf8");
+          const raw = await fs15.readFile(fp, "utf8");
           const result = safeParse(raw);
           if (!result.ok || !isPlainRecord(result.value)) {
             return;
@@ -33585,7 +34436,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     let parsed;
     let existed = true;
     try {
-      const raw = await fs14.readFile(profileFp, "utf8");
+      const raw = await fs15.readFile(profileFp, "utf8");
       const result = safeParse(raw);
       if (!result.ok || !isPlainRecord(result.value)) {
         this.logWarn("Profile config parse failed \u2014 falling back to defaults", {
@@ -33684,7 +34535,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fs14.readFile(fp, "utf8");
+      const raw = await fs15.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -33746,7 +34597,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat15 = await fs14.stat(file);
+      const stat15 = await fs15.stat(file);
       mtimeMs = stat15.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
@@ -33776,7 +34627,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     }
     let raw;
     try {
-      raw = await fs14.readFile(file, "utf8");
+      raw = await fs15.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -34011,8 +34862,8 @@ function deepFreeze(obj) {
 }
 
 // src/storage/plan-store.ts
+import { randomUUID as randomUUID18 } from "node:crypto";
 import * as fsp24 from "node:fs/promises";
-import { randomUUID as randomUUID17 } from "node:crypto";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
@@ -34110,7 +34961,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID17().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID18().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -34182,7 +35033,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID17().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID18().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id
@@ -34310,7 +35161,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 import * as fsp25 from "node:fs/promises";
-import * as path40 from "node:path";
+import * as path43 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -34343,7 +35194,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path40.join(opts.dir, "queue.json");
+    this.file = path43.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -34558,8 +35409,8 @@ function isPersistedQueueItem(v) {
 
 // src/storage/recovery-lock.ts
 import * as fsp26 from "node:fs/promises";
-import * as os2 from "node:os";
-import * as path41 from "node:path";
+import * as os3 from "node:os";
+import * as path44 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -34570,9 +35421,9 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path41.join(opts.dir, LOCK_FILE);
+    this.file = path44.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
-    this.hostname = opts.hostname ?? os2.hostname();
+    this.hostname = opts.hostname ?? os3.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
     this.sessionStore = opts.sessionStore;
     this.probe = opts.isPidAlive ?? defaultIsPidAlive;
@@ -34644,7 +35495,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path41.dirname(this.file));
+    await ensureDir(path44.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -34812,6 +35663,7 @@ var CORE_RECONSTRUCT_EVENTS = /* @__PURE__ */ new Set([
   "message_appended",
   "message_updated",
   "messages_replaced",
+  "messages_dropped",
   "context_snapshot",
   "checkpoint",
   "file_snapshot",