@wrongstack/webui-server 0.296.3 → 0.297.0

package/dist/index.js

@@ -134,85 +134,85 @@ var ENUM_PREF_KEYS = {
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
   fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"])
 };
-function validateModelRuntimeValue(modelRuntime, path34) {
+function validateModelRuntimeValue(modelRuntime, path35) {
   const reasoning = modelRuntime["reasoning"];
   if (reasoning !== void 0) {
-    if (!isRecord(reasoning)) return `${path34}.reasoning must be an object when provided`;
+    if (!isRecord(reasoning)) return `${path35}.reasoning must be an object when provided`;
     const mode = reasoning["mode"];
     const effort = reasoning["effort"];
     const preserve = reasoning["preserve"];
     if (mode !== void 0 && (typeof mode !== "string" || !REASONING_MODE_VALUES.has(mode))) {
-      return `${path34}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
+      return `${path35}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
     }
     if (effort !== void 0 && (typeof effort !== "string" || !REASONING_EFFORT_VALUES.has(effort))) {
-      return `${path34}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
+      return `${path35}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
     }
     if (preserve !== void 0 && typeof preserve !== "boolean") {
-      return `${path34}.reasoning.preserve must be a boolean when provided`;
+      return `${path35}.reasoning.preserve must be a boolean when provided`;
     }
   }
   const cache2 = modelRuntime["cache"];
   if (cache2 !== void 0) {
-    if (!isRecord(cache2)) return `${path34}.cache must be an object when provided`;
+    if (!isRecord(cache2)) return `${path35}.cache must be an object when provided`;
     const ttl = cache2["ttl"];
     if (ttl !== void 0 && (typeof ttl !== "string" || !CACHE_TTL_VALUES.has(ttl) || ttl === "default")) {
-      return `${path34}.cache.ttl must be one of: 5m, 1h`;
+      return `${path35}.cache.ttl must be one of: 5m, 1h`;
     }
   }
   const parameters = modelRuntime["parameters"];
   if (parameters !== void 0 && !isRecord(parameters)) {
-    return `${path34}.parameters must be an object when provided`;
+    return `${path35}.parameters must be an object when provided`;
   }
   return null;
 }
-function validateModelBlackoutRule(rule, path34) {
+function validateModelBlackoutRule(rule, path35) {
   const id = rule["id"];
   if (typeof id !== "string" || id.trim().length === 0) {
-    return `${path34}.id must be a non-empty string`;
+    return `${path35}.id must be a non-empty string`;
   }
   const start = rule["start"];
   if (typeof start !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(start)) {
-    return `${path34}.start must be a string in HH:mm (00:00-23:59) format`;
+    return `${path35}.start must be a string in HH:mm (00:00-23:59) format`;
   }
   const end = rule["end"];
   if (typeof end !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(end)) {
-    return `${path34}.end must be a string in HH:mm (00:00-23:59) format`;
+    return `${path35}.end must be a string in HH:mm (00:00-23:59) format`;
   }
   if (rule["enabled"] !== void 0 && typeof rule["enabled"] !== "boolean") {
-    return `${path34}.enabled must be a boolean when provided`;
+    return `${path35}.enabled must be a boolean when provided`;
   }
   if (rule["provider"] !== void 0 && typeof rule["provider"] !== "string") {
-    return `${path34}.provider must be a string when provided`;
+    return `${path35}.provider must be a string when provided`;
   }
   if (rule["model"] !== void 0 && typeof rule["model"] !== "string") {
-    return `${path34}.model must be a string when provided`;
+    return `${path35}.model must be a string when provided`;
   }
   if (rule["days"] !== void 0) {
-    if (!Array.isArray(rule["days"])) return `${path34}.days must be an array when provided`;
+    if (!Array.isArray(rule["days"])) return `${path35}.days must be an array when provided`;
     const seen = /* @__PURE__ */ new Set();
     for (const d of rule["days"]) {
       if (typeof d !== "number" || !Number.isInteger(d) || d < 0 || d > 6) {
-        return `${path34}.days elements must be integers 0-6 when provided`;
+        return `${path35}.days elements must be integers 0-6 when provided`;
       }
-      if (seen.has(d)) return `${path34}.days contains duplicate day: ${d}`;
+      if (seen.has(d)) return `${path35}.days contains duplicate day: ${d}`;
       seen.add(d);
     }
   }
   if (rule["timezone"] !== void 0) {
     if (typeof rule["timezone"] !== "string") {
-      return `${path34}.timezone must be a string when provided`;
+      return `${path35}.timezone must be a string when provided`;
     }
     try {
       Intl.DateTimeFormat(void 0, { timeZone: rule["timezone"] });
     } catch {
-      return `${path34}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
+      return `${path35}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
     }
   }
   if (rule["label"] !== void 0 && typeof rule["label"] !== "string") {
-    return `${path34}.label must be a string when provided`;
+    return `${path35}.label must be a string when provided`;
   }
   if (rule["mode"] !== void 0 && rule["mode"] !== "blackout" && rule["mode"] !== "allow_only") {
-    return `${path34}.mode must be 'blackout' or 'allow_only' when provided`;
+    return `${path35}.mode must be 'blackout' or 'allow_only' when provided`;
   }
   return null;
 }
@@ -385,6 +385,37 @@ function validateMailboxMessagesPayload(payload) {
     }
   };
 }
+var MAILBOX_ACTIONS = /* @__PURE__ */ new Set(["mark-read", "acknowledge", "reopen", "soft-delete"]);
+function validateMailboxActionPayload(payload) {
+  if (!isRecord2(payload)) {
+    return { ok: false, message: "mailbox.action payload must be an object" };
+  }
+  const requestId = payload["requestId"];
+  const mailId = payload["mailId"];
+  const action = payload["action"];
+  const readerId = payload["readerId"];
+  if (typeof requestId !== "string" || requestId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.requestId must be a non-empty string" };
+  }
+  if (typeof mailId !== "string" || mailId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.mailId must be a non-empty string" };
+  }
+  if (typeof action !== "string" || !MAILBOX_ACTIONS.has(action)) {
+    return { ok: false, message: "mailbox.action payload.action must be a supported action" };
+  }
+  if (typeof readerId !== "string" || readerId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.readerId must be a non-empty string" };
+  }
+  return {
+    ok: true,
+    value: {
+      requestId: requestId.trim(),
+      mailId: mailId.trim(),
+      action,
+      readerId: readerId.trim()
+    }
+  };
+}
 var MAILBOX_SEND_TYPES = /* @__PURE__ */ new Set([
   "note",
   "ask",
@@ -401,6 +432,7 @@ function validateMailboxSendPayload(payload) {
     return { ok: false, message: "mailbox.send payload must be an object" };
   }
   const requestId = payload["requestId"];
+  const rawFrom = payload["from"];
   const rawTo = payload["to"];
   const rawType = payload["type"];
   const rawAudience = payload["audience"];
@@ -411,6 +443,9 @@ function validateMailboxSendPayload(payload) {
   if (typeof requestId !== "string" || requestId.trim().length === 0) {
     return { ok: false, message: "mailbox.send payload.requestId must be a non-empty string" };
   }
+  if (rawFrom !== void 0 && (typeof rawFrom !== "string" || rawFrom.trim().length === 0)) {
+    return { ok: false, message: "mailbox.send payload.from must be a non-empty string when provided" };
+  }
   if (typeof rawTo !== "string" || rawTo.trim().length === 0) {
     return { ok: false, message: "mailbox.send payload.to must be a non-empty string" };
   }
@@ -447,6 +482,7 @@ function validateMailboxSendPayload(payload) {
     ok: true,
     value: {
       requestId: requestId.trim(),
+      ...rawFrom !== void 0 ? { from: rawFrom.trim() } : {},
       to,
       type,
       audience: rawAudience,
@@ -760,8 +796,8 @@ function validateShellOpenPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "shell.open payload must be an object with string path" };
   }
-  const path34 = payload["path"];
-  if (typeof path34 !== "string" || path34.trim().length === 0) {
+  const path35 = payload["path"];
+  if (typeof path35 !== "string" || path35.trim().length === 0) {
     return { ok: false, message: "shell.open payload.path must be a non-empty string" };
   }
   const target = payload["target"];
@@ -774,7 +810,7 @@ function validateShellOpenPayload(payload) {
   return {
     ok: true,
     value: {
-      path: path34,
+      path: path35,
       ...target !== void 0 ? { target } : {}
     }
   };
@@ -783,14 +819,14 @@ function validateGitDiffPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "git.diff payload must be an object" };
   }
-  const path34 = payload["path"];
-  if (path34 === void 0 || path34 === null) {
+  const path35 = payload["path"];
+  if (path35 === void 0 || path35 === null) {
     return { ok: true, value: { path: "" } };
   }
-  if (typeof path34 !== "string") {
+  if (typeof path35 !== "string") {
     return { ok: false, message: "git.diff payload.path must be a string when provided" };
   }
-  return { ok: true, value: { path: path34 } };
+  return { ok: true, value: { path: path35 } };
 }
 function validateProjectsAddPayload(payload) {
   if (!isRecord2(payload)) {
@@ -1575,6 +1611,7 @@ var CollaborationWebSocketHandler = class {
     for (const off of this.offs) off();
     this.offs.length = 0;
     this.stopBroadcast();
+    this.clients.clear();
   }
   // ── Inbound client messages ────────────────────────────────────────────
   /**
@@ -1634,9 +1671,7 @@ var CollaborationWebSocketHandler = class {
     if (activeSessionId !== void 0 && sessionId !== activeSessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `collab.join sessionId mismatch (active: ${activeSessionId})`
-        )
+        this.errorMessage(`collab.join sessionId mismatch (active: ${activeSessionId})`)
       );
       return;
     }
@@ -1647,26 +1682,19 @@ var CollaborationWebSocketHandler = class {
     if (role === "controller" && !this.bus) {
       this.send(
         ws,
-        this.errorMessage(
-          `role 'controller' is not available: server has no CollaborationBus`
-        )
+        this.errorMessage(`role 'controller' is not available: server has no CollaborationBus`)
       );
       return;
     }
     if (role === "annotator" && !this.annotations) {
       this.send(
         ws,
-        this.errorMessage(
-          `role 'annotator' is not available: server has no annotations store`
-        )
+        this.errorMessage(`role 'annotator' is not available: server has no annotations store`)
       );
       return;
     }
     if (role !== "observer" && this.options.authorizeRole?.({ ws, sessionId, requestedRole: role }) !== true) {
-      this.send(
-        ws,
-        this.errorMessage(`role '${role}' requires explicit server authorization`)
-      );
+      this.send(ws, this.errorMessage(`role '${role}' requires explicit server authorization`));
       return;
     }
     const participant = {
@@ -1695,14 +1723,10 @@ var CollaborationWebSocketHandler = class {
     this.broadcast(sessionId, this.stateMessage(sessionId));
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
-        this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`
-        );
+        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`);
       });
     }
-    this.logger.debug?.(
-      `collab: participant ${participant.participantId} joined ${sessionId}`
-    );
+    this.logger.debug?.(`collab: participant ${participant.participantId} joined ${sessionId}`);
   }
   leave(ws) {
     this.handleDisconnect(ws);
@@ -1773,18 +1797,13 @@ var CollaborationWebSocketHandler = class {
     }
     const payload = raw;
     if (!payload?.sessionId || typeof payload.atEventIndex !== "number" || typeof payload.text !== "string") {
-      this.send(
-        ws,
-        this.errorMessage("annotate requires { sessionId, atEventIndex, text }")
-      );
+      this.send(ws, this.errorMessage("annotate requires { sessionId, atEventIndex, text }"));
       return;
     }
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `annotate sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`annotate sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -1811,12 +1830,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(
-        ws,
-        this.errorMessage(
-          `annotation rejected: ${toErrorMessage(err)}`
-        )
-      );
+      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage(err)}`));
     }
   }
   async handleResolve(ws, raw) {
@@ -1832,26 +1846,19 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "annotator") {
       this.send(
         ws,
-        this.errorMessage(
-          `resolve requires the 'annotator' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`resolve requires the 'annotator' role (current: '${participant.role}')`)
       );
       return;
     }
     const payload = raw;
     if (!payload?.sessionId || !payload.annotationId) {
-      this.send(
-        ws,
-        this.errorMessage("resolve requires { sessionId, annotationId }")
-      );
+      this.send(ws, this.errorMessage("resolve requires { sessionId, annotationId }"));
       return;
     }
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `resolve sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`resolve sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -1862,10 +1869,7 @@ var CollaborationWebSocketHandler = class {
         resolvedBy: participant.participantId
       });
       if (!updated) {
-        this.send(
-          ws,
-          this.errorMessage(`annotation not found: ${payload.annotationId}`)
-        );
+        this.send(ws, this.errorMessage(`annotation not found: ${payload.annotationId}`));
         return;
       }
       this.broadcast(payload.sessionId, {
@@ -1878,12 +1882,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(
-        ws,
-        this.errorMessage(
-          `resolve failed: ${toErrorMessage(err)}`
-        )
-      );
+      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage(err)}`));
     }
   }
   // ── Event subscription (live mirror) ───────────────────────────────────
@@ -1954,9 +1953,7 @@ var CollaborationWebSocketHandler = class {
         seen++;
       }
     } catch (err) {
-      this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`
-      );
+      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`);
       return;
     }
     const tail2 = seen <= REPLAY_LIMIT ? ring.slice(0, seen) : (
@@ -2038,9 +2035,7 @@ var CollaborationWebSocketHandler = class {
       try {
         sendSerialized(p.ws, data);
       } catch (err) {
-        this.logger.debug?.(
-          `collab broadcast failed: ${toErrorMessage(err)}`
-        );
+        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage(err)}`);
       }
     }
   }
@@ -2067,9 +2062,7 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "controller") {
       this.send(
         ws,
-        this.errorMessage(
-          `pause requires the 'controller' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`pause requires the 'controller' role (current: '${participant.role}')`)
       );
       return;
     }
@@ -2114,9 +2107,7 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "controller") {
       this.send(
         ws,
-        this.errorMessage(
-          `resume requires the 'controller' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`resume requires the 'controller' role (current: '${participant.role}')`)
       );
       return;
     }
@@ -2214,9 +2205,7 @@ var CollaborationWebSocketHandler = class {
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `inject_tool sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`inject_tool sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -2230,9 +2219,7 @@ var CollaborationWebSocketHandler = class {
     if (!queued) {
       this.send(
         ws,
-        this.errorMessage(
-          `an injection for toolUseId ${payload.toolUseId} is already queued`
-        )
+        this.errorMessage(`an injection for toolUseId ${payload.toolUseId} is already queued`)
       );
       return;
     }
@@ -4376,8 +4363,8 @@ function jsonByteLength(value) {
     return MAX_PAYLOAD_BYTES + 1;
   }
 }
-function error(errors, path34, code, message) {
-  errors.push({ path: path34, code, message });
+function error(errors, path35, code, message) {
+  errors.push({ path: path35, code, message });
 }
 function isMessageRole(value) {
   return value === "user" || value === "assistant" || value === "system";
@@ -4385,25 +4372,25 @@ function isMessageRole(value) {
 function isPlainJsonObject(value) {
   return isRecord3(value);
 }
-function validateCacheControl(value, path34, errors) {
+function validateCacheControl(value, path35, errors) {
   if (value === void 0) return void 0;
   if (!isRecord3(value) || value["type"] !== "ephemeral") {
-    error(errors, path34, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
+    error(errors, path35, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
     return void 0;
   }
   return { type: "ephemeral" };
 }
-function validateProviderMeta(value, path34, errors) {
+function validateProviderMeta(value, path35, errors) {
   if (value === void 0) return void 0;
   if (!isPlainJsonObject(value)) {
-    error(errors, path34, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
+    error(errors, path35, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
     return void 0;
   }
   return value;
 }
-function validateBlock(value, path34, errors) {
+function validateBlock(value, path35, errors) {
   if (!isRecord3(value)) {
-    error(errors, path34, "INVALID_BLOCK", "Content block must be an object.");
+    error(errors, path35, "INVALID_BLOCK", "Content block must be an object.");
     return void 0;
   }
   const type = value["type"];
@@ -4411,14 +4398,14 @@ function validateBlock(value, path34, errors) {
     case "text": {
       const text2 = value["text"];
       if (typeof text2 !== "string") {
-        error(errors, `${path34}/text`, "INVALID_TEXT", "Text block text must be a string.");
+        error(errors, `${path35}/text`, "INVALID_TEXT", "Text block text must be a string.");
         return void 0;
       }
       if (text2.length > MAX_STRING_LENGTH) {
-        error(errors, `${path34}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
+        error(errors, `${path35}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
         return void 0;
       }
-      const cacheControl = validateCacheControl(value["cache_control"], `${path34}/cache_control`, errors);
+      const cacheControl = validateCacheControl(value["cache_control"], `${path35}/cache_control`, errors);
       return cacheControl ? { type: "text", text: text2, cache_control: cacheControl } : { type: "text", text: text2 };
     }
     case "tool_use": {
@@ -4426,15 +4413,15 @@ function validateBlock(value, path34, errors) {
       const name2 = value["name"];
       const input = value["input"];
       if (typeof id !== "string" || id.length === 0) {
-        error(errors, `${path34}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
+        error(errors, `${path35}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
       }
       if (typeof name2 !== "string" || name2.length === 0) {
-        error(errors, `${path34}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
+        error(errors, `${path35}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
       }
       if (!isPlainJsonObject(input)) {
-        error(errors, `${path34}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
+        error(errors, `${path35}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path34}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path35}/providerMeta`, errors);
       if (typeof id !== "string" || id.length === 0 || typeof name2 !== "string" || name2.length === 0 || !isPlainJsonObject(input)) {
         return void 0;
       }
@@ -4446,18 +4433,18 @@ function validateBlock(value, path34, errors) {
       const content = value["content"];
       const isError = value["is_error"];
       if (typeof toolUseId !== "string" || toolUseId.length === 0) {
-        error(errors, `${path34}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
+        error(errors, `${path35}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
       }
       if (name2 !== void 0 && typeof name2 !== "string") {
-        error(errors, `${path34}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
+        error(errors, `${path35}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
       }
       if (typeof content !== "string") {
-        error(errors, `${path34}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
+        error(errors, `${path35}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
       } else if (content.length > MAX_STRING_LENGTH) {
-        error(errors, `${path34}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
+        error(errors, `${path35}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
       }
       if (isError !== void 0 && typeof isError !== "boolean") {
-        error(errors, `${path34}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
+        error(errors, `${path35}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
       }
       if (typeof toolUseId !== "string" || toolUseId.length === 0 || typeof content !== "string") return void 0;
       return {
@@ -4471,25 +4458,25 @@ function validateBlock(value, path34, errors) {
     case "image": {
       const source = value["source"];
       if (!isRecord3(source)) {
-        error(errors, `${path34}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
+        error(errors, `${path35}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
         return void 0;
       }
       const sourceType = source["type"];
       if (sourceType !== "base64" && sourceType !== "url") {
-        error(errors, `${path34}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
+        error(errors, `${path35}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
         return void 0;
       }
       const mediaType = source["media_type"];
       const data = source["data"];
       const url = source["url"];
       if (mediaType !== void 0 && typeof mediaType !== "string") {
-        error(errors, `${path34}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
+        error(errors, `${path35}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
       }
       if (data !== void 0 && typeof data !== "string") {
-        error(errors, `${path34}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
+        error(errors, `${path35}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
       }
       if (url !== void 0 && typeof url !== "string") {
-        error(errors, `${path34}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
+        error(errors, `${path35}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
       }
       return {
         type: "image",
@@ -4505,13 +4492,13 @@ function validateBlock(value, path34, errors) {
       const thinking = value["thinking"];
       const signature = value["signature"];
       if (typeof thinking !== "string") {
-        error(errors, `${path34}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
+        error(errors, `${path35}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
         return void 0;
       }
       if (signature !== void 0 && typeof signature !== "string") {
-        error(errors, `${path34}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
+        error(errors, `${path35}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path34}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path35}/providerMeta`, errors);
       return {
         type: "thinking",
         thinking,
@@ -4520,7 +4507,7 @@ function validateBlock(value, path34, errors) {
       };
     }
     default:
-      error(errors, `${path34}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
+      error(errors, `${path35}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
       return void 0;
   }
 }
@@ -4538,39 +4525,39 @@ function validateContextEditorMessages(value, currentMessageCount = 0) {
     error(errors, "/messages", "PAYLOAD_TOO_LARGE", "Context editor payload is too large.");
   }
   value.forEach((item, index) => {
-    const path34 = `/messages/${index}`;
+    const path35 = `/messages/${index}`;
     if (!isRecord3(item)) {
-      error(errors, path34, "INVALID_MESSAGE", "Message must be an object.");
+      error(errors, path35, "INVALID_MESSAGE", "Message must be an object.");
       return;
     }
     const role = item["role"];
     if (!isMessageRole(role)) {
-      error(errors, `${path34}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
+      error(errors, `${path35}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
       return;
     }
     const rawContent = item["content"];
     let content;
     if (typeof rawContent === "string") {
       if (rawContent.length > MAX_STRING_LENGTH) {
-        error(errors, `${path34}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
+        error(errors, `${path35}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
         return;
       }
       content = rawContent;
     } else if (Array.isArray(rawContent)) {
       const blocks = [];
       rawContent.forEach((block, blockIndex) => {
-        const parsed = validateBlock(block, `${path34}/content/${blockIndex}`, errors);
+        const parsed = validateBlock(block, `${path35}/content/${blockIndex}`, errors);
         if (parsed) blocks.push(parsed);
       });
       content = blocks;
     } else {
-      error(errors, `${path34}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
+      error(errors, `${path35}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
       return;
     }
     const ts = item["ts"];
     if (ts !== void 0) {
       if (typeof ts !== "string" || Number.isNaN(Date.parse(ts))) {
-        error(errors, `${path34}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
+        error(errors, `${path35}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
         return;
       }
     }
@@ -4959,6 +4946,7 @@ import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wron
 import {
   checkCodebaseIndexServerHealth,
   getIndexState,
+  resolveProjectIndexDaemonAvailability,
   shutdownCodebaseIndexServer
 } from "@wrongstack/tools";
 async function handleConnectionsHealthRoute(context, ws, message) {
@@ -5051,6 +5039,19 @@ async function chronicleHealth(projectRoot) {
 }
 async function codebaseIndexHealth(projectRoot, indexDir) {
   const startedAt = Date.now();
+  const availability = resolveProjectIndexDaemonAvailability(projectRoot, indexDir);
+  if (availability.kind === "endpoint-invalid") {
+    return {
+      id: "codebase-index",
+      label: "Codebase index",
+      status: "unavailable",
+      required: false,
+      mode: "endpoint-invalid",
+      detail: `Socket path is ${availability.byteLength} bytes \u2014 over this platform's ${availability.maxBytes}-byte sun_path limit. Queries fall back to a process-local index. Set a shorter TMPDIR to restore the shared daemon.`,
+      endpoint: availability.endpoint,
+      latencyMs: Date.now() - startedAt
+    };
+  }
   try {
     const health = await checkCodebaseIndexServerHealth(projectRoot, indexDir, {
       timeoutMs: 2e3
@@ -5732,15 +5733,15 @@ async function handleGitChanges(ws, projectRoot) {
         if (!m) continue;
         const added = m[1] === "-" ? 0 : Number(m[1]);
         const deleted = m[2] === "-" ? 0 : Number(m[2]);
-        let path34 = m[3] ?? "";
-        if (path34 === "") {
+        let path35 = m[3] ?? "";
+        if (path35 === "") {
           i += 1;
-          path34 = parts[i + 1] ?? parts[i] ?? "";
+          path35 = parts[i + 1] ?? parts[i] ?? "";
           i += 1;
         }
-        if (!path34) continue;
-        const prev = counts.get(path34) ?? { added: 0, deleted: 0 };
-        counts.set(path34, { added: prev.added + added, deleted: prev.deleted + deleted });
+        if (!path35) continue;
+        const prev = counts.get(path35) ?? { added: 0, deleted: 0 };
+        counts.set(path35, { added: prev.added + added, deleted: prev.deleted + deleted });
       }
     };
     parseNumstat(unstagedNumstat);
@@ -5752,7 +5753,7 @@ async function handleGitChanges(ws, projectRoot) {
       if (!rec || rec.length < 3) continue;
       const x = rec[0] ?? " ";
       const y = rec[1] ?? " ";
-      const path34 = rec.slice(3);
+      const path35 = rec.slice(3);
       const isRename = x === "R" || x === "C" || y === "R" || y === "C";
       if (isRename) i += 1;
       let status;
@@ -5764,13 +5765,13 @@ async function handleGitChanges(ws, projectRoot) {
       else if (x === "D" || y === "D") status = "D";
       else status = "M";
       const staged = x !== " " && x !== "?";
-      let added = counts.get(path34)?.added ?? 0;
-      let deleted = counts.get(path34)?.deleted ?? 0;
+      let added = counts.get(path35)?.added ?? 0;
+      let deleted = counts.get(path35)?.deleted ?? 0;
       if (status === "?") {
         added = 0;
         deleted = 0;
       }
-      files.push({ path: path34, status, added, deleted, staged });
+      files.push({ path: path35, status, added, deleted, staged });
     }
     send(ws, { type: "git.changes", payload: { files } });
   } catch (err) {
@@ -5781,21 +5782,21 @@ async function handleGitChanges(ws, projectRoot) {
   }
 }
 var MAX_DIFF_BYTES = 2 * 1024 * 1024;
-async function handleGitDiff(ws, projectRoot, path34) {
+async function handleGitDiff(ws, projectRoot, path35) {
   const cwd = projectRoot || void 0;
-  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path34, ...extra } });
-  if (!path34 || path34.includes("\0") || path34.includes("..") || nodePath.isAbsolute(path34)) {
+  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path35, ...extra } });
+  if (!path35 || path35.includes("\0") || path35.includes("..") || nodePath.isAbsolute(path35)) {
     reply2({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
   try {
     const git = makeGit(cwd);
     const { readFile: readFile13 } = await import("node:fs/promises");
-    const { join: join18 } = await import("node:path");
-    const oldText = await git(["show", `HEAD:${path34}`]);
+    const { join: join19 } = await import("node:path");
+    const oldText = await git(["show", `HEAD:${path35}`]);
     let newText = "";
     try {
-      const abs = cwd ? join18(cwd, path34) : path34;
+      const abs = cwd ? join19(cwd, path35) : path35;
       const buf = await readFile13(abs);
       if (buf.includes(0)) {
         reply2({ oldText: "", newText: "", binary: true });
@@ -5857,10 +5858,7 @@ async function handleGoalSnapshotRoute(ws, msg, handlers) {
 }
 
 // src/server/goal-ws-handler.ts
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
-import {
-  assignNickname
-} from "@wrongstack/core/coordination";
+import { assignNickname } from "@wrongstack/core/coordination";
 import {
   GoalAssessor,
   GoalPlanner,
@@ -5868,6 +5866,7 @@ import {
   PhaseOrchestrator,
   PhaseStore
 } from "@wrongstack/core/goal";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 import { WorktreeManager } from "@wrongstack/core/worktree";
 
 // src/server/git-process.ts
@@ -5904,12 +5903,7 @@ function deriveTitle(goal) {
   return trimmed || "Goal";
 }
 async function commitsSince(cwd, baseSha, branch) {
-  const output = await gitStdout(cwd, [
-    "log",
-    "--reverse",
-    "--format=%H",
-    `${baseSha}..${branch}`
-  ]);
+  const output = await gitStdout(cwd, ["log", "--reverse", "--format=%H", `${baseSha}..${branch}`]);
   if (output === null) return [];
   return output.split("\n").map((s) => s.trim()).filter(Boolean);
 }
@@ -5960,6 +5954,17 @@ var GoalWebSocketHandler = class {
     ws.on("error", () => this.clients.delete(client));
     this.sendState(client);
   }
+  /** Release timers, in-flight work, and socket references owned by this host. */
+  dispose() {
+    this.stopping = true;
+    this.abort?.abort();
+    this.abort = null;
+    this.assessAbort?.abort();
+    this.assessAbort = null;
+    this.orchestrator?.stop();
+    this.stopBroadcast();
+    this.clients.clear();
+  }
   async handleMessage(ws, msg) {
     switch (msg.type) {
       case "goal.assess":
@@ -6007,7 +6012,8 @@ var GoalWebSocketHandler = class {
       }
       case "goal.assignTask": {
         const { taskId, agentId, agentName } = msg.payload;
-        if (this.orchestrator?.setTaskAssignee(taskId, agentId, agentName)) this.afterBoardMutation();
+        if (this.orchestrator?.setTaskAssignee(taskId, agentId, agentName))
+          this.afterBoardMutation();
         break;
       }
       case "goal.addTask": {
@@ -6052,7 +6058,10 @@ var GoalWebSocketHandler = class {
             this.graph = graph;
             this.broadcast({ type: "goal.state", payload: this.buildState() });
           } else {
-            this.broadcast({ type: "goal.error", payload: { message: `Graph not found: ${graphId}` } });
+            this.broadcast({
+              type: "goal.error",
+              payload: { message: `Graph not found: ${graphId}` }
+            });
           }
         }
         break;
@@ -6075,10 +6084,13 @@ var GoalWebSocketHandler = class {
     const mySeq = ++this.assessSeq;
     const sendResult7 = (result) => {
       if (mySeq !== this.assessSeq) return;
-      sendSerialized(ws, JSON.stringify({
-        type: "goal.assess.result",
-        payload: { ...result, reqSeq: seq }
-      }));
+      sendSerialized(
+        ws,
+        JSON.stringify({
+          type: "goal.assess.result",
+          payload: { ...result, reqSeq: seq }
+        })
+      );
     };
     if (!goal.trim()) {
       sendResult7({
@@ -6124,15 +6136,24 @@ var GoalWebSocketHandler = class {
     const multiBoard = payload?.multiBoard ?? false;
     const verifyTasks = payload?.verifyTasks ?? false;
     const chimeraReview = payload?.chimeraReview ?? false;
-    this.abort = new AbortController();
+    const runAbort = new AbortController();
+    this.abort = runAbort;
     this.stopping = false;
-    const phases = Array.isArray(payload?.phases) ? payload.phases : await this.planPhases(goal, this.abort.signal);
-    if (this.stopping || this.abort.signal.aborted) {
+    const phases = Array.isArray(payload?.phases) ? payload.phases : await this.planPhases(goal, runAbort.signal);
+    if (this.stopping || runAbort.signal.aborted) {
       this.broadcast({ type: "goal.stopped", payload: { title } });
       return;
     }
     this.logger.info(`[Goal] Starting: ${title}`);
-    const graph = await new PhaseGraphBuilder({ title, description: goal, phases, autonomous, multiBoard, verifyTasks, chimeraReview }).build();
+    const graph = await new PhaseGraphBuilder({
+      title,
+      description: goal,
+      phases,
+      autonomous,
+      multiBoard,
+      verifyTasks,
+      chimeraReview
+    }).build();
     this.graph = graph;
     await this.store.save(graph);
     const useWorktrees = payload?.worktrees ?? process.env["WRONGSTACK_GOAL_WORKTREES"] !== "0";
@@ -6151,9 +6172,10 @@ var GoalWebSocketHandler = class {
       maybeVerify.verifyPhase = (async (phase, env) => {
         const cwd = env?.cwd ?? this.projectRoot;
         try {
-          const { exec } = await import("node:child_process");
+          const { execFile: execFile2 } = await import("node:child_process");
           const result = await new Promise((resolve16) => {
-            exec("npx tsc --noEmit", { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
+            const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
+            execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
               if (err && err.code === "ENOENT") {
                 resolve16("[verify] tsc not found \u2014 skipping");
                 return;
@@ -6295,11 +6317,41 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
   /** Generic fallback phases when the LLM planner produces nothing usable. */
   defaultPhases() {
     return [
-      { name: "Discovery", description: "Requirements gathering", priority: "high", estimateHours: 2, parallelizable: false },
-      { name: "Design", description: "Architecture and design", priority: "critical", estimateHours: 4, parallelizable: false },
-      { name: "Implementation", description: "Core development", priority: "critical", estimateHours: 12, parallelizable: false },
-      { name: "Testing", description: "Unit and integration tests", priority: "high", estimateHours: 6, parallelizable: true },
-      { name: "Deployment", description: "Deploy to production", priority: "medium", estimateHours: 2, parallelizable: false }
+      {
+        name: "Discovery",
+        description: "Requirements gathering",
+        priority: "high",
+        estimateHours: 2,
+        parallelizable: false
+      },
+      {
+        name: "Design",
+        description: "Architecture and design",
+        priority: "critical",
+        estimateHours: 4,
+        parallelizable: false
+      },
+      {
+        name: "Implementation",
+        description: "Core development",
+        priority: "critical",
+        estimateHours: 12,
+        parallelizable: false
+      },
+      {
+        name: "Testing",
+        description: "Unit and integration tests",
+        priority: "high",
+        estimateHours: 6,
+        parallelizable: true
+      },
+      {
+        name: "Deployment",
+        description: "Deploy to production",
+        priority: "medium",
+        estimateHours: 2,
+        parallelizable: false
+      }
     ];
   }
   /** Plan phases+todos for the goal via the LLM; fall back to defaults on failure.
@@ -6380,8 +6432,10 @@ Type: ${task.type}`;
     try {
       const result_ = await this.agent.run(reviewPrompt);
       if (result_.status === "done" && result_.finalText) {
-        this.logger.info(`[Goal] Chimera review for "${task.title}":
-${result_.finalText.slice(0, 2e3)}`);
+        this.logger.info(
+          `[Goal] Chimera review for "${task.title}":
+${result_.finalText.slice(0, 2e3)}`
+        );
       }
     } catch (err) {
       this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage2(err)}`);
@@ -6434,7 +6488,16 @@ ${result_.finalText.slice(0, 2e3)}`);
   }
   buildState(activePhaseId) {
     if (!this.graph) {
-      return { phases: [], tasks: [], overallPercent: 0, autonomous: true, title: "", multiBoard: false, verifyTasks: false, chimeraReview: false };
+      return {
+        phases: [],
+        tasks: [],
+        overallPercent: 0,
+        autonomous: true,
+        title: "",
+        multiBoard: false,
+        verifyTasks: false,
+        chimeraReview: false
+      };
     }
     const phases = Array.from(this.graph.phases.values());
     const currentActiveId = activePhaseId || phases.find((p) => p.status === "running")?.id || phases[0]?.id || "";
@@ -6940,9 +7003,9 @@ function getAnalyticsBuffer() {
 }
 
 // src/server/http-server.ts
-import * as fs9 from "node:fs/promises";
+import * as fs10 from "node:fs/promises";
 import * as http from "node:http";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import * as v8 from "node:v8";
 import { getIndexState as getIndexState2 } from "@wrongstack/tools";
 
@@ -7626,18 +7689,153 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
 }
 
-// src/server/projects-manifest.ts
+// src/server/memory-diagnostics.ts
 import * as fs8 from "node:fs/promises";
 import * as path11 from "node:path";
+var DEFAULT_TAIL_BYTES = 1024 * 1024;
+var MAX_PROCESSES = 32;
+function finiteNumber(record2, key) {
+  const value = record2[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function stringValue(record2, key) {
+  const value = record2[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function toProcessDiagnostic(record2) {
+  const pid = finiteNumber(record2, "pid");
+  const ts = stringValue(record2, "ts");
+  if (pid === void 0 || ts === void 0) return null;
+  const queueEntries = finiteNumber(record2, "hqQueueEntries");
+  const queueBytes = finiteNumber(record2, "hqQueueBytes");
+  const queueMaxBytes = finiteNumber(record2, "hqQueueMaxBytes");
+  const snapshotInFlight = finiteNumber(record2, "hqSnapshotInFlight");
+  const snapshotPending = finiteNumber(record2, "hqSnapshotPending");
+  const snapshotTimerScheduled = finiteNumber(record2, "hqSnapshotTimerScheduled");
+  const eventInFlight = finiteNumber(record2, "hqEventInFlight");
+  const eventPending = finiteNumber(record2, "hqEventPending");
+  const eventCoalesced = finiteNumber(record2, "hqEventCoalesced");
+  const eventDropped = finiteNumber(record2, "hqEventDropped");
+  return {
+    pid,
+    surface: stringValue(record2, "surface") ?? "unknown",
+    ...stringValue(record2, "sessionId") !== void 0 ? { sessionId: stringValue(record2, "sessionId") } : {},
+    ts,
+    memory: {
+      rss: finiteNumber(record2, "rss") ?? 0,
+      heapUsed: finiteNumber(record2, "heapUsed") ?? 0,
+      heapTotal: finiteNumber(record2, "heapTotal") ?? 0,
+      retainedHeapUsed: finiteNumber(record2, "retainedHeapUsed"),
+      nativeResidual: finiteNumber(record2, "nativeResidual"),
+      external: finiteNumber(record2, "external"),
+      arrayBuffers: finiteNumber(record2, "arrayBuffers")
+    },
+    signal: stringValue(record2, "memorySignal"),
+    heapGrowthBytesPerHour: finiteNumber(record2, "heapGrowthBytesPerHour"),
+    rssGrowthBytesPerHour: finiteNumber(record2, "rssGrowthBytesPerHour"),
+    workload: {
+      messages: finiteNumber(record2, "messages"),
+      messageEstimatedTokens: finiteNumber(record2, "messageEstimatedTokens"),
+      historyEntries: finiteNumber(record2, "historyEntries"),
+      historyMountedEntries: finiteNumber(record2, "historyMountedEntries"),
+      historyCachedGroups: finiteNumber(record2, "historyCachedGroups"),
+      appRenders: finiteNumber(record2, "appRenders"),
+      metricsDroppedObservations: finiteNumber(record2, "metricsDroppedObservations"),
+      kanbanSyncActive: finiteNumber(record2, "kanbanSyncActive") === 1,
+      kanbanSyncPendingBoards: finiteNumber(record2, "kanbanSyncPendingBoards"),
+      kanbanSyncFullRescanPending: finiteNumber(record2, "kanbanSyncFullRescanPending") === 1,
+      kanbanSyncRemoteApplyQueued: finiteNumber(record2, "kanbanSyncRemoteApplyQueued") === 1,
+      kanbanSyncPendingRemoteBoards: finiteNumber(record2, "kanbanSyncPendingRemoteBoards"),
+      kanbanSyncPublishRuns: finiteNumber(record2, "kanbanSyncPublishRuns"),
+      kanbanSyncCoalescedRefreshes: finiteNumber(record2, "kanbanSyncCoalescedRefreshes"),
+      kanbanSupervisorSnapshots: finiteNumber(record2, "kanbanSupervisorSnapshots"),
+      kanbanSupervisorScheduledBoards: finiteNumber(record2, "kanbanSupervisorScheduledBoards"),
+      kanbanSupervisorAgentCooldowns: finiteNumber(record2, "kanbanSupervisorAgentCooldowns"),
+      kanbanSupervisorRunningAgents: finiteNumber(record2, "kanbanSupervisorRunningAgents")
+    },
+    resources: {
+      active: finiteNumber(record2, "activeResources"),
+      types: stringValue(record2, "activeResourceTypes")
+    },
+    ...queueEntries !== void 0 && queueBytes !== void 0 && queueMaxBytes !== void 0 ? {
+      hqQueue: {
+        entries: queueEntries,
+        bytes: queueBytes,
+        maxBytes: queueMaxBytes,
+        droppedFrames: finiteNumber(record2, "hqQueueDroppedFrames") ?? 0,
+        droppedBytes: finiteNumber(record2, "hqQueueDroppedBytes") ?? 0,
+        coalescedFrames: finiteNumber(record2, "hqQueueCoalescedFrames") ?? 0,
+        coalescedBytes: finiteNumber(record2, "hqQueueCoalescedBytes") ?? 0
+      }
+    } : {},
+    ...snapshotInFlight !== void 0 || snapshotPending !== void 0 || snapshotTimerScheduled !== void 0 ? {
+      hqSnapshot: {
+        inFlight: snapshotInFlight === 1,
+        pending: snapshotPending === 1,
+        timerScheduled: snapshotTimerScheduled === 1,
+        eventInFlight: eventInFlight === 1,
+        pendingEvents: eventPending ?? 0,
+        coalescedEvents: eventCoalesced ?? 0,
+        droppedEvents: eventDropped ?? 0
+      }
+    } : {},
+    profileTopStack: stringValue(record2, "memoryProfileTopStack"),
+    profileTopStackBytes: finiteNumber(record2, "memoryProfileTopStackBytes")
+  };
+}
+async function readRecentProcessMemoryDiagnostics(globalRoot, tailBytes = DEFAULT_TAIL_BYTES) {
+  if (!globalRoot) return [];
+  const heapLog = path11.join(globalRoot, "logs", "heap.jsonl");
+  let handle;
+  try {
+    handle = await fs8.open(heapLog, "r");
+    const stat3 = await handle.stat();
+    const length = Math.min(stat3.size, Math.max(1, tailBytes));
+    if (length === 0) return [];
+    const start = stat3.size - length;
+    const buffer = Buffer.allocUnsafe(length);
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    let text2 = buffer.subarray(0, bytesRead).toString("utf8");
+    if (start > 0) {
+      const firstNewline = text2.indexOf("\n");
+      if (firstNewline === -1) return [];
+      text2 = text2.slice(firstNewline + 1);
+    }
+    const newestByPid = /* @__PURE__ */ new Map();
+    const lines = text2.split(/\r?\n/u);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const line = lines[index]?.trim();
+      if (!line) continue;
+      try {
+        const parsed = JSON.parse(line);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) continue;
+        const diagnostic = toProcessDiagnostic(parsed);
+        if (!diagnostic || newestByPid.has(diagnostic.pid)) continue;
+        newestByPid.set(diagnostic.pid, diagnostic);
+        if (newestByPid.size >= MAX_PROCESSES) break;
+      } catch {
+      }
+    }
+    return [...newestByPid.values()].sort((a, b) => b.ts.localeCompare(a.ts));
+  } catch {
+    return [];
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+
+// src/server/projects-manifest.ts
+import * as fs9 from "node:fs/promises";
+import * as path12 from "node:path";
 import { ConfigError } from "@wrongstack/core/types";
 import { projectSlug, withFileLock } from "@wrongstack/core/utils";
 function projectsJsonPath(globalConfigPath) {
-  const base = path11.dirname(globalConfigPath);
-  return path11.join(base, "projects.json");
+  const base = path12.dirname(globalConfigPath);
+  return path12.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs8.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs9.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -7646,37 +7844,37 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs8.mkdir(path11.dirname(file), { recursive: true });
-  await fs8.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs9.mkdir(path12.dirname(file), { recursive: true });
+  await fs9.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path11.dirname(globalConfigPath);
-  const dir = path11.join(base, "projects", slug);
-  await fs8.mkdir(dir, { recursive: true });
+  const base = path12.dirname(globalConfigPath);
+  const dir = path12.join(base, "projects", slug);
+  await fs9.mkdir(dir, { recursive: true });
   return dir;
 }
 async function touchProjectInManifest(options, globalConfigPath) {
-  const root = path11.resolve(options.projectRoot);
+  const root = path12.resolve(options.projectRoot);
   const file = projectsJsonPath(globalConfigPath);
   let entry;
   await withFileLock(file, async () => {
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    entry = manifest.projects.find((candidate) => path11.resolve(candidate.root) === root);
+    entry = manifest.projects.find((candidate) => path12.resolve(candidate.root) === root);
     if (entry) {
       entry.lastSeen = now;
-      if (options.workingDir) entry.lastWorkingDir = path11.resolve(options.workingDir);
+      if (options.workingDir) entry.lastWorkingDir = path12.resolve(options.workingDir);
     } else {
       entry = {
-        name: options.name ?? path11.basename(root),
+        name: options.name ?? path12.basename(root),
         root,
         slug: generateProjectSlug(root),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: options.workingDir ? path11.resolve(options.workingDir) : void 0
+        lastWorkingDir: options.workingDir ? path12.resolve(options.workingDir) : void 0
       };
       manifest.projects.push(entry);
     }
@@ -8087,9 +8285,9 @@ function buildCspHeader(publicWsUrl, host, port) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path12.resolve(distDir);
-  const resolved = path12.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path12.sep);
+  const root = path13.resolve(distDir);
+  const resolved = path13.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path13.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -8109,7 +8307,7 @@ function strictDecodeParam(segment, res) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path12.resolve(opts.distDir);
+  const distDir = path13.resolve(opts.distDir);
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   let techStackRuntime = null;
   const getTechStackRuntime = async () => {
@@ -8437,11 +8635,7 @@ function createHttpServer(opts) {
           if (researchMatch && req.method === "POST") {
             const pkg = strictDecodeParam(researchMatch[1], res);
             if (pkg === null) return;
-            await handleTechStackDependencyResearch(
-              res,
-              deps2,
-              pkg
-            );
+            await handleTechStackDependencyResearch(res, deps2, pkg);
             return;
           }
         } catch (error2) {
@@ -8477,6 +8671,7 @@ function createHttpServer(opts) {
         return;
       }
       if (url.pathname === "/debug/system" && req.method === "GET") {
+        const processes = await readRecentProcessMemoryDiagnostics(opts.globalRoot);
         res.writeHead(200, {
           "Content-Type": "application/json",
           "Cache-Control": "no-store"
@@ -8489,6 +8684,7 @@ function createHttpServer(opts) {
             uptime: process.uptime(),
             cpuUsage: process.cpuUsage(),
             codebaseIndexServer: getIndexState2().server,
+            processes,
             timestamp: Date.now()
           })
         );
@@ -8496,24 +8692,24 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path12.join(distDir, "index.html");
+        filePath = path13.join(distDir, "index.html");
       } else {
-        filePath = path12.join(distDir, url.pathname);
+        filePath = path13.join(distDir, url.pathname);
       }
-      const resolvedPath = path12.resolve(filePath);
+      const resolvedPath = path13.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path12.extname(resolvedPath);
+      const ext = path13.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       setStaticSecurityHeaders(res);
       if (ext === ".html") {
         if (!shouldSetAuthCookie) res.setHeader("Cache-Control", "no-cache");
         res.setHeader("Content-Security-Policy", buildCspHeader(opts.publicWsUrl, opts.host, port));
-        const html = await fs9.readFile(resolvedPath, "utf8");
+        const html = await fs10.readFile(resolvedPath, "utf8");
         res.writeHead(200);
         res.end(injectWsConfig(html, { publicWsUrl: opts.publicWsUrl }));
         return;
@@ -8524,13 +8720,13 @@ function createHttpServer(opts) {
           url.pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "public, max-age=3600"
         );
       }
-      const fileContent = await fs9.readFile(resolvedPath);
+      const fileContent = await fs10.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs9.readFile(path12.join(distDir, "index.html"), "utf8");
+          const html = await fs10.readFile(path13.join(distDir, "index.html"), "utf8");
           setStaticSecurityHeaders(res);
           res.writeHead(200, {
             "Content-Type": "text/html",
@@ -8560,14 +8756,14 @@ function createHttpServer(opts) {
 
 // src/server/instance-registry.ts
 import * as os from "node:os";
-import * as path13 from "node:path";
-import * as fs10 from "node:fs/promises";
+import * as path14 from "node:path";
+import * as fs11 from "node:fs/promises";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
 function defaultBaseDir() {
-  return path13.join(os.homedir(), ".wrongstack");
+  return path14.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path13.join(baseDir, "webui-instances.json");
+  return path14.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -8580,7 +8776,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs10.readFile(file, "utf8");
+    const raw = await fs11.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -10437,14 +10633,14 @@ function registerShutdownHandlers(res) {
 }
 
 // src/server/config-doctor.ts
-import * as fs11 from "node:fs/promises";
+import * as fs12 from "node:fs/promises";
 import {
   repairConfigDefaults
 } from "@wrongstack/core/storage";
 import { atomicWrite as atomicWrite5 } from "@wrongstack/core/utils";
 import { decryptConfigSecrets } from "@wrongstack/core/security";
 async function readConfig(file, vault) {
-  const raw = await fs11.readFile(file, "utf8");
+  const raw = await fs12.readFile(file, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("Active profile config must contain a JSON object.");
@@ -10508,6 +10704,7 @@ async function handleConfigDoctor(ws, apply, deps2) {
 
 // src/server/mailbox-handlers.ts
 import {
+  actionToAckInput,
   getSharedProjectMailbox,
   isMailboxMessageVisibleTo,
   MAILBOX_TYPE_PROPERTIES,
@@ -10524,6 +10721,43 @@ function getMailboxForDeps(deps2) {
   const dir = resolveProjectDir(projectRoot, globalRoot);
   return getSharedProjectMailbox(dir, deps2.events);
 }
+async function handleMailboxAction(ws, deps2, payload) {
+  const mb = getMailboxForDeps(deps2);
+  if (!mb) {
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: false,
+        error: "No project root available"
+      }
+    });
+    return;
+  }
+  try {
+    const message = payload.action === "soft-delete" ? await mb.softDelete(payload.mailId, payload.readerId) : await mb.ack(actionToAckInput(payload.action, payload));
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: message !== null,
+        action: payload.action,
+        mailId: payload.mailId
+      }
+    });
+  } catch (err) {
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: false,
+        action: payload.action,
+        mailId: payload.mailId,
+        error: errMessage(err)
+      }
+    });
+  }
+}
 async function handleMailboxSend(ws, deps2, payload) {
   const mb = getMailboxForDeps(deps2);
   if (!mb) {
@@ -10539,7 +10773,7 @@ async function handleMailboxSend(ws, deps2, payload) {
   }
   try {
     const message = await mb.send({
-      from: "webui",
+      from: payload.from ?? "webui",
       to: payload.to,
       type: payload.type,
       audience: payload.audience,
@@ -10554,6 +10788,7 @@ async function handleMailboxSend(ws, deps2, payload) {
         requestId: payload.requestId,
         success: true,
         messageId: message.id,
+        from: message.from,
         to: message.to,
         audience: message.audience ?? "all"
       }
@@ -10598,6 +10833,7 @@ async function handleMailboxMessages(ws, deps2, payload) {
     send(ws, {
       type: "mailbox.messages",
       payload: {
+        ...payload?.unreadOnly === true ? { unreadOnly: true } : {},
         messages: visibleMessages.map((m) => {
           const readByMe = payload?.agentId !== void 0 ? payload.agentId in m.readBy : false;
           const completedByMe = payload?.agentId !== void 0 ? m.completedBy === payload.agentId : false;
@@ -10713,6 +10949,14 @@ function createMailboxRouteHandlers(ctx) {
     ...ctx.events ? { events: ctx.events } : {}
   };
   return {
+    action: (ws, msg) => {
+      const parsed = validateMailboxActionPayload(msg.payload);
+      if (!parsed.ok) {
+        sendResult2(ws, false, parsed.message);
+        return;
+      }
+      return handleMailboxAction(ws, deps2, parsed.value);
+    },
     send: (ws, msg) => {
       const parsed = validateMailboxSendPayload(msg.payload);
       if (!parsed.ok) {
@@ -10763,6 +11007,9 @@ function createMailboxRouteHandlers(ctx) {
 }
 async function handleMailboxRoute(ws, msg, handlers) {
   switch (msg.type) {
+    case "mailbox.action":
+      await handlers.action(ws, msg);
+      return true;
     case "mailbox.send":
       await handlers.send(ws, msg);
       return true;
@@ -12076,10 +12323,10 @@ async function findFreePort(host, startPort, opts = {}) {
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync } from "node:fs";
 import { findPackageJSON } from "node:module";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 function resolveDistDir(input) {
   const options = typeof input === "string" ? { explicitDistDir: input } : input ?? {};
-  if (options.explicitDistDir) return path14.resolve(options.explicitDistDir);
+  if (options.explicitDistDir) return path15.resolve(options.explicitDistDir);
   const exists = options.exists ?? existsSync;
   let packageTarget;
   try {
@@ -12091,15 +12338,15 @@ function resolveDistDir(input) {
     );
   }
   if (!packageTarget) return null;
-  const distDir = path14.basename(packageTarget) === "package.json" ? path14.join(path14.dirname(packageTarget), "dist") : path14.dirname(packageTarget);
+  const distDir = path15.basename(packageTarget) === "package.json" ? path15.join(path15.dirname(packageTarget), "dist") : path15.dirname(packageTarget);
   if (options.exists === void 0 && options.resolvePackageJson) return distDir;
-  return exists(path14.join(distDir, "index.html")) ? distDir : null;
+  return exists(path15.join(distDir, "index.html")) ? distDir : null;
 }
 async function ensureDistDir(explicitDistDir, deps2 = {}) {
   const exists = deps2.exists ?? existsSync;
   if (explicitDistDir) {
-    const resolved2 = path14.resolve(explicitDistDir);
-    return exists(path14.join(resolved2, "index.html")) ? resolved2 : null;
+    const resolved2 = path15.resolve(explicitDistDir);
+    return exists(path15.join(resolved2, "index.html")) ? resolved2 : null;
   }
   const resolveOptions = {
     resolvePackageJson: deps2.resolvePackageJson,
@@ -12111,7 +12358,7 @@ async function ensureDistDir(explicitDistDir, deps2 = {}) {
   try {
     const packageJson = deps2.resolvePackageJson ? deps2.resolvePackageJson("@wrongstack/webui/package.json") : findPackageJSON("@wrongstack/webui", import.meta.url);
     if (!packageJson) throw new Error("not found");
-    packageDir = path14.dirname(packageJson);
+    packageDir = path15.dirname(packageJson);
   } catch {
     throw new Error(
       "@wrongstack/webui package could not be resolved. Install workspace dependencies and rebuild the CLI."
@@ -12120,8 +12367,8 @@ async function ensureDistDir(explicitDistDir, deps2 = {}) {
   const findRoot = deps2.findWorkspaceRoot ?? ((pkgDir) => {
     let dir = pkgDir;
     for (let i = 0; i < 10; i++) {
-      if (existsSync(path14.join(dir, "pnpm-workspace.yaml"))) return dir;
-      const parent = path14.dirname(dir);
+      if (existsSync(path15.join(dir, "pnpm-workspace.yaml"))) return dir;
+      const parent = path15.dirname(dir);
       if (parent === dir) return null;
       dir = parent;
     }
@@ -12205,7 +12452,7 @@ function runPnpmBuild(cwd, workspace, timeoutMs) {
 }
 
 // src/server/embedded-lifecycle.ts
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 
 // src/server/network-info.ts
 import * as os2 from "node:os";
@@ -12271,7 +12518,7 @@ function registerWebuiInstance(p, deps2 = {}) {
       httpPort: p.httpPort,
       host: p.host,
       projectRoot: p.projectRoot,
-      projectName: path15.basename(p.projectRoot) || p.projectRoot,
+      projectName: path16.basename(p.projectRoot) || p.projectRoot,
       startedAt: p.startedAt,
       url: buildWebUIAccessUrl({
         host: p.host,
@@ -12322,6 +12569,7 @@ function createWebuiShutdown(res) {
     log("[WebUI] Shutting down...");
     res.abortInFlight();
     res.unsubscribeEvents();
+    res.disposeResources?.();
     res.closeClients();
     const unregistered = unregister(res.pid, res.registryBaseDir).catch(
       (err) => debug(`[webui-server] unregister failed: ${err}`)
@@ -12491,7 +12739,7 @@ ${text2}` : text2;
 
 // src/server/client-presence.ts
 import * as crypto2 from "node:crypto";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import {
   getSharedProjectMailbox as getSharedProjectMailbox2,
   resolveProjectDir as resolveProjectDir2
@@ -12509,7 +12757,7 @@ function createWebuiClientPresence(deps2) {
     if (!deps2.projectRoot) return null;
     try {
       const projectRoot = deps2.projectRoot;
-      const projectName = path16.basename(projectRoot);
+      const projectName = path17.basename(projectRoot);
       const nextMailbox = getSharedProjectMailbox2(
         resolveProjectDir2(projectRoot, wstackGlobalRoot()),
         deps2.events,
@@ -13128,6 +13376,26 @@ function createKanbanSupervisor(deps2) {
   const agentRunning = /* @__PURE__ */ new Set();
   let disposed = false;
   let nextTimer;
+  const forgetBoard = (boardId) => {
+    snapshots.delete(boardId);
+    nextDue.delete(boardId);
+    agentLastRun.delete(boardId);
+    agentRunning.delete(boardId);
+  };
+  const pruneAbsentBoards = (presentBoardIds) => {
+    for (const boardId of snapshots.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of nextDue.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of agentLastRun.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of agentRunning) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+  };
   const publish = (snapshot) => {
     snapshots.set(snapshot.boardId, snapshot);
     deps2.broadcast({
@@ -13227,6 +13495,7 @@ function createKanbanSupervisor(deps2) {
         onDone: async (result) => {
           clearTimeout(watchdog);
           agentRunning.delete(board.id);
+          if (await getBoard3(deps2.projectRoot, board.id) === null) return;
           const current3 = snapshots.get(board.id) ?? snapshot;
           publish({
             ...current3,
@@ -13248,13 +13517,20 @@ function createKanbanSupervisor(deps2) {
     }
   };
   const auditNow = async (boardId) => {
-    const boards = boardId ? [await getBoard3(deps2.projectRoot, boardId)].filter(
-      (board) => Boolean(board)
-    ) : await Promise.all(
-      (await listBoards4(deps2.projectRoot)).map(
-        (summary) => getBoard3(deps2.projectRoot, summary.id)
-      )
-    ).then((items) => items.filter((board) => Boolean(board)));
+    let boards;
+    if (boardId) {
+      const board = await getBoard3(deps2.projectRoot, boardId);
+      if (board === null) {
+        forgetBoard(boardId);
+        boards = [];
+      } else {
+        boards = [board];
+      }
+    } else {
+      const summaries = await listBoards4(deps2.projectRoot);
+      pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
+      boards = (await Promise.all(summaries.map((summary) => getBoard3(deps2.projectRoot, summary.id)))).filter((board) => Boolean(board));
+    }
     const results = [];
     for (const board of boards) results.push(await auditBoard(board));
     scheduleNext();
@@ -13289,6 +13565,7 @@ function createKanbanSupervisor(deps2) {
     try {
       const now = Date.now();
       const summaries = await listBoards4(deps2.projectRoot);
+      pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
       for (const summary of summaries) {
         if ((nextDue.get(summary.id) ?? 0) > now) continue;
         const board = await getBoard3(deps2.projectRoot, summary.id);
@@ -13304,12 +13581,22 @@ function createKanbanSupervisor(deps2) {
   return {
     getSnapshot: (boardId) => snapshots.get(boardId),
     auditNow,
+    getStats: () => ({
+      snapshots: snapshots.size,
+      scheduledBoards: nextDue.size,
+      agentCooldowns: agentLastRun.size,
+      runningAgents: agentRunning.size
+    }),
     dispose() {
       disposed = true;
       if (nextTimer !== void 0) {
         clearTimeout(nextTimer);
         nextTimer = void 0;
       }
+      snapshots.clear();
+      nextDue.clear();
+      agentLastRun.clear();
+      agentRunning.clear();
     }
   };
 }
@@ -13486,8 +13773,8 @@ function seedContextMeta(config, context) {
 }
 
 // src/server/pref-helpers.ts
-import * as fs12 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as fs13 from "node:fs/promises";
+import * as path18 from "node:path";
 import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite as atomicWrite6, backupConfigFile, FORBIDDEN_PROTO_KEYS as FORBIDDEN_PROTO_KEYS2 } from "@wrongstack/core/utils";
 var PREF_KEYS = [
@@ -13583,11 +13870,11 @@ function prefSnapshot(contextMeta) {
   return snapshot;
 }
 async function writeGlobalConfigFile(filePath, vault, mutate, logger, errorLabel) {
-  const globalRoot = path17.dirname(filePath);
+  const globalRoot = path18.dirname(filePath);
   await backupConfigFile(filePath, { globalRoot });
   let raw;
   try {
-    raw = await fs12.readFile(filePath, "utf8");
+    raw = await fs13.readFile(filePath, "utf8");
   } catch {
     raw = "{}";
   }
@@ -14062,16 +14349,16 @@ async function handleProcessRoute(ws, msg, handlers) {
 }
 
 // src/server/embedded-host-adapters.ts
-import * as fs15 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as fs16 from "node:fs/promises";
+import * as path20 from "node:path";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { DefaultSessionStore as DefaultSessionStore2 } from "@wrongstack/core/storage";
 import { toErrorMessage as toErrorMessage7, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/server/project-handlers.ts
-import * as fs13 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as fs14 from "node:fs/promises";
+import * as path19 from "node:path";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
 import { resolveWstackPaths as resolveWstackPaths4 } from "@wrongstack/core/utils";
 function createProjectHandlers(ctx) {
@@ -14123,10 +14410,10 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path18.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path18.basename(resolved);
+      const resolved = path19.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path19.basename(resolved);
       try {
-        const stat3 = await fs13.stat(resolved).catch(() => null);
+        const stat3 = await fs14.stat(resolved).catch(() => null);
         if (!stat3?.isDirectory()) {
           sendTo(ws, {
             type: "projects.added",
@@ -14135,7 +14422,7 @@ function createProjectHandlers(ctx) {
           return;
         }
         const before = await loadManifest(ctx.globalConfigPath);
-        const already = before.projects.some((project) => path18.resolve(project.root) === resolved);
+        const already = before.projects.some((project) => path19.resolve(project.root) === resolved);
         const entry = await touchProjectInManifest(
           { projectRoot: resolved, workingDir: resolved, name: name2 },
           ctx.globalConfigPath
@@ -14165,8 +14452,8 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path18.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path18.basename(resolved);
+      const resolved = path19.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path19.basename(resolved);
       if (!ctx.allowProjectMutations) {
         sendTo(ws, {
           type: "projects.selected",
@@ -14179,7 +14466,7 @@ function createProjectHandlers(ctx) {
         return;
       }
       try {
-        const stat3 = await fs13.stat(resolved).catch(() => null);
+        const stat3 = await fs14.stat(resolved).catch(() => null);
         if (!stat3?.isDirectory()) {
           sendTo(ws, {
             type: "projects.selected",
@@ -14209,7 +14496,7 @@ function createProjectHandlers(ctx) {
         const previousIdentityTarget = {
           projectSlug: previousPaths.projectSlug,
           projectRoot: previousProjectRoot,
-          projectName: path18.basename(previousProjectRoot),
+          projectName: path19.basename(previousProjectRoot),
           workingDir: ctx.context.workingDir
         };
         const previousUsage = ctx.tokenCounter.total();
@@ -14372,14 +14659,14 @@ async function searchCatalogModels(registry, rawQuery, limit = 8) {
 }
 
 // src/server/provider-config-io.ts
-import * as fs14 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 import { ConfigError as ConfigError2 } from "@wrongstack/core/types";
 import { atomicWrite as atomicWrite7 } from "@wrongstack/core/utils";
 import { decryptConfigSecrets as decryptConfigSecrets3, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs14.readFile(configPath, "utf8");
+    raw = await fs15.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -14397,7 +14684,7 @@ async function saveProviders(configPath, vault, providers, profileConfigPath) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs14.readFile(targetPath, "utf8");
+    raw = await fs15.readFile(targetPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new ConfigError2({
@@ -15163,6 +15450,7 @@ var CLIENT_COLLABORATION_MESSAGE_TYPES = [
   "collab.resume",
   "collab.grant_control",
   "collab.inject_tool",
+  "mailbox.action",
   "mailbox.agents",
   "mailbox.clear",
   "mailbox.compact",
@@ -15428,6 +15716,7 @@ var SERVER_COLLABORATION_MESSAGE_TYPES = [
   "collab.pause.granted",
   "collab.pause.released",
   "collab.state",
+  "mailbox.action_result",
   "mailbox.agent_registered",
   "mailbox.agents",
   "mailbox.cleared",
@@ -15651,13 +15940,13 @@ function isRegisteredMessageType(type, direction) {
 // src/protocol/decoder.ts
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var MAX_PAYLOAD_DEPTH = 32;
-function inspectValue(value, path34, depth) {
+function inspectValue(value, path35, depth) {
   if (depth > MAX_PAYLOAD_DEPTH) {
-    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path34 };
+    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path35 };
   }
   if (value === null || typeof value !== "object") return null;
   for (const key of Object.keys(value)) {
-    const childPath = `${path34}.${key}`;
+    const childPath = `${path35}.${key}`;
     if (FORBIDDEN_KEYS.has(key)) {
       return { code: "unsafe_key", message: `Unsafe protocol key: ${key}`, path: childPath };
     }
@@ -15754,7 +16043,11 @@ function projectChatMessage(message) {
       return value ? { kind: "text-delta", text: value, messageId: text(payload["messageId"]) } : null;
     }
     case "provider.response":
-      return { kind: "response", content: payload["content"] };
+      return {
+        kind: "response",
+        content: payload["content"],
+        stopReason: text(payload["stopReason"])
+      };
     case "run.result":
       return {
         kind: "run-result",
@@ -16591,7 +16884,7 @@ function createEmbeddedConversationRoutes(ctx) {
 }
 function sessionStoreFor(opts) {
   const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-  return opts.sessionStore ?? new DefaultSessionStore2({ dir: path19.join(projectRoot, ".wrongstack", "sessions"), projectRoot });
+  return opts.sessionStore ?? new DefaultSessionStore2({ dir: path20.join(projectRoot, ".wrongstack", "sessions"), projectRoot });
 }
 function createEmbeddedSessionRoutes(ctx) {
   const { opts } = ctx;
@@ -16610,7 +16903,7 @@ function createEmbeddedSessionRoutes(ctx) {
     getSession: () => actx.session ?? opts.session,
     getSessionStore: () => sessionStoreFor(opts),
     canSwapSessions: () => opts.sessionStore !== void 0,
-    getSessionsDir: () => opts.sessionsDir ?? path19.join(getProjectRoot(), ".wrongstack", "sessions"),
+    getSessionsDir: () => opts.sessionsDir ?? path20.join(getProjectRoot(), ".wrongstack", "sessions"),
     setSession: (next) => {
       actx.session = next;
     },
@@ -16627,7 +16920,7 @@ function createEmbeddedSessionRoutes(ctx) {
 async function broadcastEmbeddedGoalSnapshot(ctx) {
   const projectRoot = ctx.opts.projectRoot ?? ctx.opts.agent.ctx.projectRoot;
   try {
-    const raw = await fs15.readFile(path19.join(projectRoot, ".wrongstack", "goal.json"), "utf8");
+    const raw = await fs16.readFile(path20.join(projectRoot, ".wrongstack", "goal.json"), "utf8");
     ctx.broadcast({ type: "goal-state.updated", payload: JSON.parse(raw) });
   } catch {
     ctx.broadcast({ type: "goal-state.updated", payload: null });
@@ -16636,10 +16929,10 @@ async function broadcastEmbeddedGoalSnapshot(ctx) {
 function createEmbeddedProjectRoutes(ctx) {
   const { opts } = ctx;
   const actx = opts.agent.ctx;
-  const globalConfigPath = opts.globalConfigPath ?? path19.join(wstackGlobalRoot2(), "config.json");
+  const globalConfigPath = opts.globalConfigPath ?? path20.join(wstackGlobalRoot2(), "config.json");
   return createProjectHandlers({
     globalConfigPath,
-    wpaths: { globalRoot: path19.dirname(globalConfigPath) },
+    wpaths: { globalRoot: path20.dirname(globalConfigPath) },
     context: actx,
     tokenCounter: actx.tokenCounter,
     config: { model: actx.model, provider: actx.provider.id },
@@ -17687,8 +17980,8 @@ function createRouteFamilyDispatcher(options) {
 }
 
 // src/server/shell-open.ts
-import * as fs16 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as fs17 from "node:fs/promises";
+import * as path21 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function normalizeShellOpenTarget(target) {
   return target === "terminal" ? "terminal" : "file-manager";
@@ -17699,11 +17992,11 @@ function shellQuote(s) {
 }
 async function handleShellOpen(req, logger, options) {
   try {
-    const resolved = path20.resolve(req.path);
+    const resolved = path21.resolve(req.path);
     if (options?.projectRoot) {
-      const root = path20.resolve(options.projectRoot);
-      const relative5 = path20.relative(root, resolved);
-      const escapes = relative5.startsWith("..") || path20.isAbsolute(relative5);
+      const root = path21.resolve(options.projectRoot);
+      const relative5 = path21.relative(root, resolved);
+      const escapes = relative5.startsWith("..") || path21.isAbsolute(relative5);
       if (escapes) {
         return {
           success: false,
@@ -17711,7 +18004,7 @@ async function handleShellOpen(req, logger, options) {
         };
       }
     }
-    await fs16.access(resolved);
+    await fs17.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
@@ -18115,7 +18408,7 @@ function createEmbeddedMessageRouter(deps2) {
 }
 
 // src/server/provider-config-standalone.ts
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 import { DefaultSecretVault } from "@wrongstack/core/security";
 function createProviderConfigIO(configPath) {
   const keyFile = vaultKeyFileForConfigPath(configPath);
@@ -18126,15 +18419,15 @@ function createProviderConfigIO(configPath) {
   };
 }
 function vaultKeyFileForConfigPath(configPath) {
-  const configDir = path21.dirname(configPath);
-  const parentDir = path21.dirname(configDir);
-  const globalRoot = path21.basename(parentDir) === "profiles" ? path21.dirname(parentDir) : configDir;
-  return path21.join(globalRoot, ".key");
+  const configDir = path22.dirname(configPath);
+  const parentDir = path22.dirname(configDir);
+  const globalRoot = path22.basename(parentDir) === "profiles" ? path22.dirname(parentDir) : configDir;
+  return path22.join(globalRoot, ".key");
 }
 
 // src/server/provider-store.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
-import * as fs17 from "node:fs/promises";
+import * as fs18 from "node:fs/promises";
 import { decryptConfigSecrets as decryptConfigSecrets4, encryptConfigSecrets as encryptConfigSecrets3 } from "@wrongstack/core/security";
 import { atomicWrite as atomicWrite8 } from "@wrongstack/core/utils";
 function createConfigWriteLock() {
@@ -18158,7 +18451,7 @@ function createProviderStore(deps2) {
   const configWriteLock = createConfigWriteLock();
   async function loadSavedProviders2() {
     try {
-      const raw = await fs17.readFile(profileConfigPath, "utf8");
+      const raw = await fs18.readFile(profileConfigPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed.providers) return {};
       return decryptConfigSecrets4(parsed.providers, vault);
@@ -18172,7 +18465,7 @@ function createProviderStore(deps2) {
       await prev;
       let parsed;
       try {
-        const raw = await fs17.readFile(profileConfigPath, "utf8");
+        const raw = await fs18.readFile(profileConfigPath, "utf8");
         parsed = JSON.parse(raw);
       } catch {
         parsed = {};
@@ -18222,7 +18515,12 @@ function createProviderStore(deps2) {
 }
 
 // src/server/sdd-board-ws-handler.ts
-import { listBoards as listBoards5 } from "@wrongstack/kanban";
+import {
+  enqueueKanbanWorkflowCommand,
+  kanbanWorkflowId,
+  listBoards as listBoards5,
+  listKanbanWorkflowStates
+} from "@wrongstack/kanban";
 import {
   applySddLifecycle,
   extractVerificationCommand,
@@ -18249,7 +18547,7 @@ var SddBoardWebSocketHandler = class {
   clients = /* @__PURE__ */ new Set();
   lifecycle;
   security;
-  diskPollingEnabled;
+  standalonePollingEnabled;
   latest = null;
   poll = null;
   pollInFlight = false;
@@ -18258,7 +18556,7 @@ var SddBoardWebSocketHandler = class {
     this.store = new SddBoardStore({ baseDir: boardsDir });
     this.lifecycle = lifecycle;
     this.security = security;
-    this.diskPollingEnabled = events === void 0;
+    this.standalonePollingEnabled = events === void 0;
     if (events) {
       const handler = (e) => {
         this.latest = e.snapshot;
@@ -18293,7 +18591,7 @@ var SddBoardWebSocketHandler = class {
       return;
     }
     if (msg.type === "sdd.board.list") {
-      const boards = await this.store.list();
+      const boards = await this.listBoardEntries();
       this.broadcast({ type: "sdd.board.list", payload: { boards } });
       return;
     }
@@ -18306,7 +18604,8 @@ var SddBoardWebSocketHandler = class {
       const verificationCommands = [];
       if (action === "set_task_verification") {
         const command = msg.payload?.verificationCommand;
-        if (command !== void 0 && (typeof command !== "string" || command.length > 8192)) return;
+        if (command !== void 0 && (typeof command !== "string" || command.length > 8192))
+          return;
         if (typeof command === "string" && command.trim()) {
           verificationCommands.push({ command, operation: "sdd.set_task_verification" });
         }
@@ -18340,18 +18639,26 @@ var SddBoardWebSocketHandler = class {
         );
         if (!authorization.allowed) return;
       }
-      const runId = msg.payload?.runId ?? this.latest?.runId ?? (await this.store.list())[0]?.runId;
+      const runId = msg.payload?.runId ?? this.latest?.runId ?? (await this.listBoardEntries())[0]?.runId;
       if (runId) {
-        await this.store.appendControl(runId, {
-          ts: Date.now(),
-          type: action,
-          payload: msg.payload
-        });
+        if (this.lifecycle && this.lifecycle.controlTransport !== "legacy-file") {
+          await enqueueKanbanWorkflowCommand(
+            this.lifecycle.projectRoot,
+            kanbanWorkflowId("sdd", runId),
+            { type: action, payload: msg.payload }
+          );
+        } else {
+          await this.store.appendControl(runId, {
+            ts: Date.now(),
+            type: action,
+            payload: msg.payload
+          });
+        }
       }
     }
   }
   /**
-   * Apply a cleanup/rollback/destroy from disk and broadcast a structured
+   * Apply a cleanup/rollback/destroy from durable state and broadcast a structured
    * `sdd.board.lifecycle_result`. Refuses (no-op) while a run is still active —
    * the user must stop it first; the UI gates the buttons on `!active` and the
    * Destroy flow auto-stops then waits before sending `destroy`.
@@ -18360,7 +18667,11 @@ var SddBoardWebSocketHandler = class {
     if (!this.lifecycle) {
       this.broadcast({
         type: "sdd.board.lifecycle_result",
-        payload: { op, ok: false, reason: "Lifecycle operations are not available in this session." }
+        payload: {
+          op,
+          ok: false,
+          reason: "Lifecycle operations are not available in this session."
+        }
       });
       return;
     }
@@ -18376,6 +18687,7 @@ var SddBoardWebSocketHandler = class {
       projectRoot: this.lifecycle.projectRoot,
       paths: this.lifecycle.paths,
       runId,
+      stateTransport: this.lifecycle.stateTransport ?? "kanban",
       revertMerged: payload?.revertMerged === true
     });
     this.broadcast({ type: "sdd.board.lifecycle_result", payload: result });
@@ -18404,22 +18716,27 @@ var SddBoardWebSocketHandler = class {
     if (this.pollInFlight) return;
     this.pollInFlight = true;
     try {
-      const entry = await this.store.latest();
-      if (!entry) return;
-      if (this.latest && this.latest.updatedAt >= entry.updatedAt && this.latest.runId === entry.runId) {
+      const snap = await this.loadLatestSnapshot();
+      if (!snap) return;
+      if (this.latest && this.latest.updatedAt >= snap.updatedAt && this.latest.runId === snap.runId) {
         return;
       }
-      const snap = await this.store.load(entry.runId);
-      if (snap) {
-        this.latest = snap;
-        this.broadcast({ type: "sdd.board.snapshot", payload: snap });
-      }
+      this.latest = snap;
+      this.broadcast({ type: "sdd.board.snapshot", payload: snap });
+    } catch (err) {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "sdd_board.poll_failed",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
     } finally {
       this.pollInFlight = false;
     }
   }
   startPolling() {
-    if (!this.diskPollingEnabled || this.poll !== null || this.clients.size === 0) return;
+    if (!this.standalonePollingEnabled || this.poll !== null || this.clients.size === 0) return;
     this.poll = setInterval(() => void this.pollLatest(), 1e3);
     this.poll.unref?.();
   }
@@ -18429,17 +18746,44 @@ var SddBoardWebSocketHandler = class {
     this.poll = null;
   }
   async sendCurrent(client) {
-    const snap = this.latest ?? await this.loadLatestFromDisk();
+    const snap = this.latest ?? await this.loadLatestSnapshot();
     if (snap) this.send(client, { type: "sdd.board.snapshot", payload: snap });
   }
   async broadcastCurrent() {
-    const snap = this.latest ?? await this.loadLatestFromDisk();
+    const snap = this.latest ?? await this.loadLatestSnapshot();
     if (snap) this.broadcast({ type: "sdd.board.snapshot", payload: snap });
   }
-  async loadLatestFromDisk() {
+  async loadLatestSnapshot() {
+    if (this.usesKanbanState()) {
+      const states = await listKanbanWorkflowStates(this.lifecycle.projectRoot, "sdd:");
+      const snapshots = states.map((state) => state.value).filter(isSddBoardSnapshot).sort((a, b) => b.updatedAt - a.updatedAt);
+      return snapshots[0] ?? null;
+    }
     const entry = await this.store.latest();
     return entry ? this.store.load(entry.runId) : null;
   }
+  async listBoardEntries() {
+    if (!this.usesKanbanState()) return this.store.list();
+    const states = await listKanbanWorkflowStates(this.lifecycle.projectRoot, "sdd:");
+    return states.flatMap((state) => {
+      if (!isSddBoardSnapshot(state.value)) return [];
+      const snapshot = state.value;
+      return [
+        {
+          runId: snapshot.runId,
+          ...snapshot.specId ? { specId: snapshot.specId } : {},
+          title: snapshot.title,
+          status: snapshot.status,
+          total: snapshot.progress.total,
+          completed: snapshot.progress.completed,
+          updatedAt: snapshot.updatedAt
+        }
+      ];
+    });
+  }
+  usesKanbanState() {
+    return Boolean(this.lifecycle && this.lifecycle.stateTransport !== "legacy-file");
+  }
   broadcast(msg) {
     const data = JSON.stringify(msg);
     for (const client of this.clients) {
@@ -18450,17 +18794,20 @@ var SddBoardWebSocketHandler = class {
     sendSerialized(client.ws, JSON.stringify(msg));
   }
 };
+function isSddBoardSnapshot(value) {
+  if (!value || typeof value !== "object") return false;
+  const snapshot = value;
+  return typeof snapshot.runId === "string" && typeof snapshot.title === "string" && typeof snapshot.status === "string" && typeof snapshot.updatedAt === "number" && Array.isArray(snapshot.tasks) && Boolean(snapshot.progress && typeof snapshot.progress.total === "number");
+}
 
 // src/server/sdd-wizard-wiring.ts
-import * as path22 from "node:path";
-import {
-  DefaultTaskStore,
-  TaskTracker
-} from "@wrongstack/core/tasking";
+import * as path23 from "node:path";
+import { DefaultTaskStore, TaskTracker } from "@wrongstack/core/tasking";
 import { ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
 import { WorktreeManager as WorktreeManager2 } from "@wrongstack/core/worktree";
 import {
   cleanupStaleSddWorktrees,
+  createKanbanSddSessionPersistence,
   decomposeNonAtomicTasks,
   gatherProjectContext,
   makeAcceptanceCriteriaVerifier,
@@ -18478,7 +18825,7 @@ import {
 } from "@wrongstack/sdd";
 async function startSddRunFromGraph(graph, deps2, config = {}, tracker) {
   const runTracker = tracker ?? (() => {
-    const t = new TaskTracker({ store: new DefaultTaskStore() });
+    const t = new TaskTracker({ store: deps2.taskStore ?? new DefaultTaskStore() });
     t.setGraph(graph);
     return t;
   })();
@@ -18487,7 +18834,8 @@ async function startSddRunFromGraph(graph, deps2, config = {}, tracker) {
   if (worktreesEnabled && await isGitWorkTree(deps2.projectRoot)) {
     void cleanupStaleSddWorktrees({
       projectRoot: deps2.projectRoot,
-      boardsDir: deps2.projectSddBoards
+      boardsDir: deps2.projectSddBoards,
+      stateTransport: "kanban"
     }).catch(() => void 0);
     worktrees = new WorktreeManager2({
       projectRoot: deps2.projectRoot,
@@ -18566,7 +18914,8 @@ function buildSddWizardDeps(opts) {
   }).catch(() => {
     projectContext = "";
   });
-  const sessionPath = opts.paths.projectSddSession ?? path22.join(opts.paths.projectDir, "sdd-session.json");
+  const legacySessionPath = opts.paths.projectSddSession ?? path23.join(opts.paths.projectDir, "sdd-session.json");
+  const sessionPersistence = createKanbanSddSessionPersistence(opts.projectRoot, legacySessionPath);
   const specStore = new SpecStore({ baseDir: opts.paths.projectSpecs });
   const graphStore = new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs });
   const runIsolatedTurn = async (prompt, name2) => {
@@ -18587,7 +18936,7 @@ function buildSddWizardDeps(opts) {
   const makeDriver = () => new SddInterviewDriver({
     specStore,
     graphStore,
-    sessionPath,
+    sessionPersistence,
     projectContext
   });
   const launchFromGraph = async (graph, config, tracker) => {
@@ -18599,6 +18948,7 @@ function buildSddWizardDeps(opts) {
         projectRoot: opts.projectRoot,
         subagentFactory: opts.subagentFactory,
         projectSddBoards: opts.paths.projectSddBoards,
+        taskStore: graphStore,
         registry,
         runIsolatedTurn,
         ...opts.brain ? { brain: opts.brain } : {}
@@ -18668,8 +19018,18 @@ var SddWizardWebSocketHandler = class {
   lastAgentText = "";
   /** Guards against overlapping interview turns (one in flight at a time). */
   busy = false;
-  /** Resolves once project-context gather + disk resume finish. */
+  /** Set when authoritative session state could not be read during bootstrap. */
+  resumeError = null;
+  /** Resolves once project-context gather + durable resume finish. */
   ready;
+  /**
+   * Single-flight slot for the resume probe. `handleMessage` awaits this
+   * when `resumeError` is set, so concurrent frames cannot race the retry
+   * — one probe either clears the gate or re-latches it, then every
+   * queued frame re-checks and proceeds. `null` when no probe is in
+   * flight (or after the probe has settled).
+   */
+  resumeProbe = null;
   async bootstrap() {
     try {
       await this.deps.ensureReady?.();
@@ -18677,7 +19037,7 @@ var SddWizardWebSocketHandler = class {
     }
     await this.tryResume();
   }
-  /** Rehydrate a persisted interview if one exists on disk. */
+  /** Rehydrate a persisted interview if one exists. */
   async tryResume() {
     if (this.driver) return;
     try {
@@ -18686,9 +19046,11 @@ var SddWizardWebSocketHandler = class {
         this.driver = driver;
         this.lastAgentText = driver.getLastAgentText() ?? "";
       }
-    } catch {
+      this.resumeError = null;
+    } catch (error2) {
       this.driver = null;
       this.lastAgentText = "";
+      this.resumeError = error2 instanceof Error ? error2.message : String(error2);
     }
   }
   addClient(ws) {
@@ -18697,6 +19059,10 @@ var SddWizardWebSocketHandler = class {
     ws.on("close", () => this.clients.delete(client));
     ws.on("error", () => this.clients.delete(client));
     void this.ready.then(() => {
+      if (this.resumeError) {
+        this.send(client, { type: "sdd.spec.error", payload: { message: this.resumeError } });
+        return;
+      }
       if (this.driver) {
         this.send(client, this.snapshotMsg());
         if (this.lastAgentText) {
@@ -18708,6 +19074,22 @@ var SddWizardWebSocketHandler = class {
   async handleMessage(msg) {
     try {
       await this.ready;
+      if (this.resumeError) {
+        if (this.resumeProbe === null) {
+          const probe = Promise.resolve().then(() => this.tryResume());
+          this.resumeProbe = probe;
+          void probe.finally(() => {
+            setTimeout(() => {
+              if (this.resumeProbe === probe) this.resumeProbe = null;
+            }, 0);
+          });
+        }
+        await this.resumeProbe;
+        if (this.resumeError) {
+          this.broadcast({ type: "sdd.spec.error", payload: { message: this.resumeError } });
+          return;
+        }
+      }
       switch (msg.type) {
         case "sdd.spec.start":
           await this.onStart(String(msg.payload?.goal ?? "").trim(), {
@@ -18724,7 +19106,10 @@ var SddWizardWebSocketHandler = class {
           if (this.driver) {
             this.broadcast(this.snapshotMsg());
             if (this.lastAgentText) {
-              this.broadcast({ type: "sdd.spec.agent_text", payload: { text: this.lastAgentText } });
+              this.broadcast({
+                type: "sdd.spec.agent_text",
+                payload: { text: this.lastAgentText }
+              });
             }
           }
           break;
@@ -18938,10 +19323,10 @@ import { recordTaskFileActivity } from "@wrongstack/kanban";
 
 // src/server/setup-events-fleet-broadcaster.ts
 import { watch as fsWatch } from "node:fs";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
-  const globalRoot = globalConfigPath ? path23.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path24.dirname(globalConfigPath) : void 0;
   if (!globalRoot) return void 0;
   const disposers = [];
   const broadcastSessions = async () => {
@@ -18951,8 +19336,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
-      const myRoot = path23.resolve(context.projectRoot);
-      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path23.resolve(s.projectRoot) === myRoot).map((s) => ({
+      const myRoot = path24.resolve(context.projectRoot);
+      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path24.resolve(s.projectRoot) === myRoot).map((s) => ({
         sessionId: s.sessionId,
         projectName: s.projectName,
         projectSlug: s.projectSlug,
@@ -19142,14 +19527,14 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 
 // src/server/setup-events-status-watcher.ts
 import { watch as fsWatch2 } from "node:fs";
-import * as fs18 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as fs19 from "node:fs/promises";
+import * as path26 from "node:path";
 
 // src/server/setup-events-watcher.ts
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative5 = path24.isAbsolute(raw) ? path24.relative(projectsDir, raw) : raw;
+  const relative5 = path25.isAbsolute(raw) ? path25.relative(projectsDir, raw) : raw;
   const parts = relative5.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2 || parts.at(-1) !== "status.json") return null;
   return parts.at(-2) ?? null;
@@ -19184,7 +19569,7 @@ function logFileWatcherMetrics(metrics) {
 function registerSetupEventsStatusWatcher(deps2) {
   const { wpaths, watcherMetrics, clients, broadcast: broadcast2, on, isDisposed } = deps2;
   if (!wpaths?.projectStatus || !wpaths.globalRoot) return void 0;
-  const projectsDir = path25.join(wpaths.globalRoot, "projects");
+  const projectsDir = path26.join(wpaths.globalRoot, "projects");
   const knownProjectHashes = /* @__PURE__ */ new Set();
   const debounceTimers = /* @__PURE__ */ new Map();
   const DEBOUNCE_MS2 = 150;
@@ -19229,7 +19614,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   let watcher;
   const startWatcher = async () => {
     try {
-      await fs18.mkdir(projectsDir, { recursive: true });
+      await fs19.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
       watcher = fsWatch2(
         projectsDir,
@@ -19243,8 +19628,8 @@ function registerSetupEventsStatusWatcher(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path25.join(projectsDir, projectHash, "status.json");
-            const content = await fs18.readFile(targetFile, "utf-8");
+            const targetFile = path26.join(projectsDir, projectHash, "status.json");
+            const content = await fs19.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -19301,8 +19686,8 @@ function registerSetupEventsStatusWatcher(deps2) {
 }
 
 // src/server/setup-events-core-watchers.ts
-import * as fs19 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as fs20 from "node:fs/promises";
+import * as path27 from "node:path";
 function registerSetupEventsCoreWatchers(deps2) {
   const { broadcast: broadcast2, clients, context } = deps2;
   const disposers = [];
@@ -19338,9 +19723,9 @@ function registerSetupEventsClientStatusWriter(deps2) {
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path26.dirname(statusFile);
-        await fs19.mkdir(dir, { recursive: true });
-        await fs19.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+        const dir = path27.dirname(statusFile);
+        await fs20.mkdir(dir, { recursive: true });
+        await fs20.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
         console.error(
           JSON.stringify({
@@ -20365,7 +20750,7 @@ var SpecsWebSocketHandler = class {
 // src/server/start-webui.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import * as http2 from "node:http";
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 import { createDefaultPipelines } from "@wrongstack/core/agent";
 import { getSharedProjectMailbox as getSharedProjectMailbox5, resolveProjectDir as resolveProjectDir4 } from "@wrongstack/core/coordination";
 import { createCompatibilityTrustBoundary as createCompatibilityTrustBoundary3 } from "@wrongstack/core/security";
@@ -20379,7 +20764,7 @@ import { DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2 } fro
 import {
   expectDefined as expectDefined4,
   sessionScopedPath as sessionScopedPath3,
-  startHeapWatchdog,
+  startSharedHeapWatchdog,
   toErrorMessage as toErrorMessage14,
   wstackGlobalRoot as wstackGlobalRoot4
 } from "@wrongstack/core/utils";
@@ -20388,10 +20773,8 @@ import { toLanguagePackageInput } from "@wrongstack/techstack";
 import { ensureSessionShell } from "@wrongstack/tools";
 
 // src/server/backend-services.ts
-import { join as join15 } from "node:path";
-import {
-  Agent
-} from "@wrongstack/core/agent";
+import { join as join16 } from "node:path";
+import { Agent } from "@wrongstack/core/agent";
 import {
   BrainDecisionLedger,
   BrainMonitor,
@@ -20403,8 +20786,8 @@ import {
   mailboxSessionTag,
   ObservableBrainArbiter as ObservableBrainArbiterCtor
 } from "@wrongstack/core/coordination";
-import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import { DEFAULT_TOOLS_CONFIG } from "@wrongstack/core/defaults";
+import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import {
   AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
   createBrainRuntime,
@@ -20414,7 +20797,9 @@ import {
 } from "@wrongstack/core/execution";
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
-import { resolveContextWindowPolicy as resolveContextWindowPolicy2 } from "@wrongstack/core/types";
+import {
+  resolveContextWindowPolicy as resolveContextWindowPolicy2
+} from "@wrongstack/core/types";
 import {
   estimateRequestTokensCalibrated,
   toErrorMessage as toErrorMessage10
@@ -20431,7 +20816,7 @@ import {
 import { spawn as spawn4 } from "node:child_process";
 import { createRequire } from "node:module";
 import { existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname10, join as join13 } from "node:path";
+import { dirname as dirname10, join as join14 } from "node:path";
 import { resolveProjectDir as resolveProjectDir3 } from "@wrongstack/core/coordination";
 import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
 import { readLiveLock } from "@wrongstack/core/coordination";
@@ -20560,7 +20945,7 @@ function mailboxServeInvocation(projectRoot) {
 function findWorkspaceCliEntry(projectRoot) {
   let dir = projectRoot;
   for (let i = 0; i < 6; i++) {
-    const candidate = join13(dir, "packages", "cli", "dist", "index.js");
+    const candidate = join14(dir, "packages", "cli", "dist", "index.js");
     if (existsSync2(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
@@ -20805,10 +21190,10 @@ function clampDim(value, fallback) {
 }
 
 // src/server/worktree-ws-handler.ts
-import { join as join14, resolve as resolve13, sep as sep5 } from "node:path";
+import { join as join15, resolve as resolve13, sep as sep5 } from "node:path";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
-import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 var MAX_ACTIVITY = 6;
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["allocating", "active", "committing", "merging"]);
 var MANAGED_BRANCH_RE = /^wstack\/ap\/[A-Za-z0-9._/-]+$/;
@@ -20827,6 +21212,20 @@ var WorktreeWebSocketHandler = class {
   baseBranch = "";
   broadcastInterval = null;
   offs = [];
+  /**
+   * Single-flight guard for orphan scans. Two concurrent `scanAndBroadcast()`
+   * calls would race: the first call reads `wt.listManaged()`, then the
+   * second call's mutation completes (e.g. `removeOne`), then the first call
+   * broadcasts a stale orphan list — the user sees a row persist and clicks
+   * Remove a second time, hitting "remove failed (not a managed worktree?)".
+   *
+   * We coalesce concurrent triggers: while a scan is in flight, additional
+   * callers are remembered as "need a re-scan" and exactly one follow-up
+   * scan runs after the in-flight one finishes. The re-scan picks up any
+   * mutations that landed during the previous scan's `listManaged()` window.
+   */
+  scanInFlight = null;
+  scanRescanNeeded = false;
   addClient(ws) {
     this.clients.add(ws);
     ws.on("close", () => this.clients.delete(ws));
@@ -20845,7 +21244,10 @@ var WorktreeWebSocketHandler = class {
       return true;
     }
     if (msg.type === "worktree.remove") {
-      await this.removeOne(msg.payload?.["dir"], msg.payload?.["branch"]);
+      await this.removeOne(
+        msg.payload?.["dir"],
+        msg.payload?.["branch"]
+      );
       return true;
     }
     if (msg.type === "worktree.merge") {
@@ -20853,7 +21255,10 @@ var WorktreeWebSocketHandler = class {
       return true;
     }
     if (msg.type === "worktree.diff") {
-      await this.diffOne(msg.payload?.["dir"], msg.payload?.["baseBranch"]);
+      await this.diffOne(
+        msg.payload?.["dir"],
+        msg.payload?.["baseBranch"]
+      );
       return true;
     }
     return false;
@@ -20866,7 +21271,7 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve13(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve13(join15(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
@@ -20882,12 +21287,43 @@ var WorktreeWebSocketHandler = class {
     }
     return live;
   }
+  /**
+   * Coalesced orphan scan entry point. Multiple concurrent callers share one
+   * in-flight scan; if a caller arrives during a scan, a single follow-up
+   * scan is scheduled to pick up mutations that landed mid-scan. Returns the
+   * shared promise so `await this.scanAndBroadcast()` still works for callers
+   * that want to chain after the next broadcast.
+   */
+  scanAndBroadcast() {
+    if (this.scanInFlight) {
+      this.scanRescanNeeded = true;
+      return this.scanInFlight;
+    }
+    this.scanInFlight = this.runScanAndMaybeRescan();
+    return this.scanInFlight;
+  }
+  /**
+   * Run the actual scan, then drain a pending re-scan request if one came in
+   * during the scan. The re-scan is bounded (one follow-up) — additional
+   * requests that arrive during the follow-up coalesce into the next one.
+   */
+  async runScanAndMaybeRescan() {
+    try {
+      await this.runScanOnce();
+      while (this.scanRescanNeeded) {
+        this.scanRescanNeeded = false;
+        await this.runScanOnce();
+      }
+    } finally {
+      this.scanInFlight = null;
+    }
+  }
   /**
    * Scan the disk for managed worktrees/branches NOT owned by a live in-session
    * run and broadcast them as orphans, with whether it is safe to clean now.
    * No-op (empty inventory) when management deps were not wired.
    */
-  async scanAndBroadcast() {
+  async runScanOnce() {
     if (!this.management) {
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
       return;
@@ -20943,7 +21379,8 @@ var WorktreeWebSocketHandler = class {
     }
     const res = await cleanupStaleSddWorktrees2({
       projectRoot: this.management.projectRoot,
-      boardsDir: this.management.boardsDir
+      boardsDir: this.management.boardsDir,
+      stateTransport: "kanban"
     });
     if (res.skippedReason) {
       this.broadcast({
@@ -20956,26 +21393,45 @@ var WorktreeWebSocketHandler = class {
     for (const [id, h] of [...this.handles]) {
       if (!ACTIVE_STATUSES.has(h.status)) this.handles.delete(id);
     }
-    this.broadcast({ type: "worktree.cleanup_result", payload: { ok: true, removed: res.removed } });
+    this.broadcast({
+      type: "worktree.cleanup_result",
+      payload: { ok: true, removed: res.removed }
+    });
     this.broadcastState();
     await this.scanAndBroadcast();
   }
   /** Remove/discard ONE worktree + branch. Refused while a live run owns it. */
   async removeOne(dir, branch) {
     if (!this.management || !dir && !branch) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "nothing to remove" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "nothing to remove" }
+      });
       return;
     }
     if (branch && !MANAGED_BRANCH_RE.test(branch)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "not a managed worktree branch" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "not a managed worktree branch" }
+      });
       return;
     }
     if (dir && !this.underRoot(dir)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "path is outside the managed worktrees root" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "path is outside the managed worktrees root" }
+      });
       return;
     }
     if (branch && this.liveActiveBranches().has(branch)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "a run is live on this worktree \u2014 stop it first" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: {
+          ok: false,
+          removed: 0,
+          reason: "a run is live on this worktree \u2014 stop it first"
+        }
+      });
       return;
     }
     let removed = false;
@@ -20984,31 +21440,54 @@ var WorktreeWebSocketHandler = class {
       ({ removed } = await wt.removeOne(dir, branch));
     }
     for (const [id, h] of [...this.handles]) {
-      if (branch && h.branch === branch || dir && h.handleId && dir.endsWith(h.handleId)) this.handles.delete(id);
+      if (branch && h.branch === branch || dir && h.handleId && dir.endsWith(h.handleId))
+        this.handles.delete(id);
     }
-    this.broadcast({ type: "worktree.cleanup_result", payload: { ok: removed, removed: removed ? 1 : 0, reason: removed ? void 0 : "remove failed (not a managed worktree?)" } });
+    this.broadcast({
+      type: "worktree.cleanup_result",
+      payload: {
+        ok: removed,
+        removed: removed ? 1 : 0,
+        reason: removed ? void 0 : "remove failed (not a managed worktree?)"
+      }
+    });
     this.broadcastState();
     await this.scanAndBroadcast();
   }
   /** Squash-merge ONE branch into base. Refused while a live run owns it. */
   async mergeBranch(branch) {
     if (!this.management || !branch) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch: branch ?? "", reason: "no branch" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch: branch ?? "", reason: "no branch" }
+      });
       return;
     }
     if (!MANAGED_BRANCH_RE.test(branch)) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "not a managed worktree branch" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch, reason: "not a managed worktree branch" }
+      });
       return;
     }
     if (this.liveActiveBranches().has(branch)) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" }
+      });
       return;
     }
     const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
     const res = await wt.mergeBranch(branch);
     this.broadcast({
       type: "worktree.merge_result",
-      payload: { ok: res.ok, branch, conflict: res.conflict, conflictFiles: res.conflictFiles, reason: res.reason }
+      payload: {
+        ok: res.ok,
+        branch,
+        conflict: res.conflict,
+        conflictFiles: res.conflictFiles,
+        reason: res.reason
+      }
     });
     await this.scanAndBroadcast();
   }
@@ -21050,8 +21529,14 @@ var WorktreeWebSocketHandler = class {
       }),
       on("worktree.committed", (p) => {
         const e = p;
-        this.patch(e.handleId, { status: "committing", insertions: e.insertions, deletions: e.deletions, files: e.files });
-        if (e.committed) this.activity(e.handleId, "committed", `+${e.insertions}/-${e.deletions} (${e.files}f)`);
+        this.patch(e.handleId, {
+          status: "committing",
+          insertions: e.insertions,
+          deletions: e.deletions,
+          files: e.files
+        });
+        if (e.committed)
+          this.activity(e.handleId, "committed", `+${e.insertions}/-${e.deletions} (${e.files}f)`);
         this.broadcastState();
       }),
       on("worktree.merged", (p) => {
@@ -21092,10 +21577,15 @@ var WorktreeWebSocketHandler = class {
   activity(id, kind, text2) {
     const cur = this.handles.get(id);
     if (cur) {
-      const recentActivity = [...cur.recentActivity, { kind, text: text2, at: Date.now() }].slice(-MAX_ACTIVITY);
+      const recentActivity = [...cur.recentActivity, { kind, text: text2, at: Date.now() }].slice(
+        -MAX_ACTIVITY
+      );
       this.handles.set(id, { ...cur, recentActivity });
     }
-    this.broadcast({ type: "worktree.event", payload: { kind, handleId: id, text: text2, at: Date.now() } });
+    this.broadcast({
+      type: "worktree.event",
+      payload: { kind, handleId: id, text: text2, at: Date.now() }
+    });
   }
   stateMessage() {
     return {
@@ -21337,7 +21827,7 @@ async function createAgentServices(input) {
   const brainCfg = resolveBrainConfigDefaults(config.brain, {
     fallbackModels: config.fallbackModels
   });
-  const brainLedgerPath = join15(wpaths.projectDir, "brain-ledger.jsonl");
+  const brainLedgerPath = join16(wpaths.projectDir, "brain-ledger.jsonl");
   let brainLedgerEnabled = brainCfg.ledger?.enabled !== false;
   let brainLedger;
   const startBrainLedger = () => {
@@ -21402,33 +21892,35 @@ async function createAgentServices(input) {
     brainLog.push(entry);
     if (brainLog.length > 20) brainLog.shift();
   };
-  events.on(
-    "brain.decision_answered",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "answered",
-      question: e.request.question,
-      outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text : ""
-    })
-  );
-  events.on(
-    "brain.decision_ask_human",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "ask_human",
-      question: e.request.question,
-      outcome: "needs human judgement"
-    })
-  );
-  events.on(
-    "brain.decision_denied",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "denied",
-      question: e.request.question,
-      outcome: e.decision.type === "deny" ? e.decision.reason : ""
-    })
-  );
+  const brainLogOffs = [
+    events.on(
+      "brain.decision_answered",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "answered",
+        question: e.request.question,
+        outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text : ""
+      })
+    ),
+    events.on(
+      "brain.decision_ask_human",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "ask_human",
+        question: e.request.question,
+        outcome: "needs human judgement"
+      })
+    ),
+    events.on(
+      "brain.decision_denied",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "denied",
+        question: e.request.question,
+        outcome: e.decision.type === "deny" ? e.decision.reason : ""
+      })
+    )
+  ];
   const brainMailbox = getSharedProjectMailbox3(wpaths.projectDir, events);
   brainMonitor = new BrainMonitor({
     events,
@@ -21540,6 +22032,17 @@ async function createAgentServices(input) {
       getActiveSessionId: () => context.session.id
     }
   );
+  let realtimeHandlersDisposed = false;
+  const disposeRealtimeHandlers = () => {
+    if (realtimeHandlersDisposed) return;
+    realtimeHandlersDisposed = true;
+    for (const off of brainLogOffs) off();
+    goalHandler.dispose();
+    sddBoardHandler.dispose();
+    worktreeHandler.dispose();
+    terminalHandler.dispose();
+    collabHandler.dispose();
+  };
   return {
     collabBus,
     compactor,
@@ -21565,6 +22068,7 @@ async function createAgentServices(input) {
     worktreeHandler,
     terminalHandler,
     collabHandler,
+    disposeRealtimeHandlers,
     updateAutoCompactionMaxContext
   };
 }
@@ -21651,7 +22155,7 @@ function createConnectionHandler(options) {
 }
 
 // src/server/message-dispatcher.ts
-import path27 from "node:path";
+import path28 from "node:path";
 function createMessageDispatcher(opts) {
   const { state, deps: deps2, routes, promptsCtx, codebaseIndexing, runLock, pendingConfirms } = opts;
   function makeWorklistContext() {
@@ -21672,7 +22176,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path27.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path28.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -21924,7 +22428,7 @@ function createMessageDispatcher(opts) {
 
 // src/server/pre-context-services.ts
 import { createRequire as createRequire3 } from "node:module";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 import { Context, DefaultSystemPromptBuilder } from "@wrongstack/core/agent";
 import {
   getSharedProjectMailbox as getSharedProjectMailbox4,
@@ -21978,8 +22482,8 @@ import { configureDangerBypass, configureExecPolicy } from "@wrongstack/tools";
 import { attachSessionKanbanMirror, hydrateSessionKanban } from "@wrongstack/tools/session-kanban";
 
 // src/server/model-auto-discovery.ts
-import * as fs20 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as fs21 from "node:fs/promises";
+import * as path29 from "node:path";
 import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
@@ -22005,7 +22509,7 @@ function eligibleProviders(config) {
 }
 async function readCache(file) {
   try {
-    return JSON.parse(await fs20.readFile(file, "utf8"));
+    return JSON.parse(await fs21.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -22015,7 +22519,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path28.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path29.join(opts.cacheDir, "discovered-models-cache.json");
   const cache2 = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -22052,8 +22556,8 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs20.mkdir(path28.dirname(cacheFile), { recursive: true });
-      await fs20.writeFile(cacheFile, JSON.stringify(cache2), "utf8");
+      await fs21.mkdir(path29.dirname(cacheFile), { recursive: true });
+      await fs21.writeFile(cacheFile, JSON.stringify(cache2), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
     }
@@ -22149,7 +22653,7 @@ function resolveSetupProvider(opts) {
 }
 
 // src/server/standalone-session-identity.ts
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 import {
   AgentStatusTracker,
   FleetNotifier,
@@ -22168,7 +22672,7 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
   let activeTarget = {
     projectSlug: paths.projectSlug,
     projectRoot: paths.projectRoot,
-    projectName: path29.basename(paths.projectRoot),
+    projectName: path30.basename(paths.projectRoot),
     workingDir: opts.workingDir
   };
   let pendingClaim;
@@ -22399,7 +22903,7 @@ async function createPreContextServices(input) {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path30.dirname(wpaths.modelsCache),
+      cacheDir: path31.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
@@ -22451,7 +22955,7 @@ async function createPreContextServices(input) {
   configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpTokenStore = new MCPVaultTokenStore(
-    path30.join(wpaths.projectDir, "mcp-auth.json"),
+    path31.join(wpaths.projectDir, "mcp-auth.json"),
     vault
   );
   const mcpAuthorizationManager = new MCPAuthorizationManager({ store: mcpTokenStore });
@@ -22557,7 +23061,7 @@ async function createPreContextServices(input) {
   };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path30.join(wpaths.configDir, "installed-skills.json"),
+    manifestPath: path31.join(wpaths.configDir, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -22567,8 +23071,8 @@ async function createPreContextServices(input) {
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
       const req = createRequire3(import.meta.url);
-      return path30.join(
-        path30.dirname(req.resolve("@wrongstack/core/package.json")),
+      return path31.join(
+        path31.dirname(req.resolve("@wrongstack/core/package.json")),
         "data",
         "prompts"
       );
@@ -22672,7 +23176,7 @@ async function createPreContextServices(input) {
 }
 
 // src/server/routes.ts
-import path31 from "node:path";
+import path32 from "node:path";
 import { makeProviderFromConfig as makeProviderFromConfig4, withCatalogCapabilities } from "@wrongstack/providers";
 
 // src/server/mode-handlers.ts
@@ -22964,7 +23468,7 @@ function buildRoutes(state, deps2, cb) {
   };
   const mailboxRoutes = createMailboxRouteHandlers({
     getProjectRoot: state.getProjectRoot,
-    getGlobalRoot: () => path31.dirname(deps2.globalConfigPath),
+    getGlobalRoot: () => path32.dirname(deps2.globalConfigPath),
     events: deps2.events
   });
   const mcpRoutes = {
@@ -23037,7 +23541,7 @@ function buildRoutes(state, deps2, cb) {
 }
 
 // src/server/server-runtime.ts
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import { createRequire as createRequire4 } from "node:module";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
@@ -23098,7 +23602,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path32.basename(projectRoot) || projectRoot,
+      projectName: path33.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -23186,13 +23690,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, httpPort, setupInput, watch
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path32.resolve(explicitDistDir);
+  if (explicitDistDir) return path33.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire4(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui");
-    return path32.dirname(serverEntry);
+    return path33.dirname(serverEntry);
   } catch {
-    return path32.resolve(path32.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path33.resolve(path33.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -23406,6 +23910,7 @@ async function startWebUI(opts = {}) {
     worktreeHandler,
     terminalHandler,
     collabHandler,
+    disposeRealtimeHandlers,
     updateAutoCompactionMaxContext
   } = agentServices;
   if (typeof context.meta["yolo"] === "boolean") {
@@ -23584,21 +24089,21 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path33.resolve(root);
+    const resolved = path34.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path33.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path34.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path33.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path34.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path33.basename(resolved),
+        name: path34.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path33.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path34.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -23775,7 +24280,20 @@ async function startWebUI(opts = {}) {
     );
     credentialWatcherClose = credentialWatcher.close;
   }
-  const stopHeapWatchdog = startHeapWatchdog();
+  const stopHeapWatchdog = startSharedHeapWatchdog({
+    collectStats: () => ({
+      surface: opts.surface ?? "webui",
+      sessionId: context.session.id,
+      messages: context.state.messages.length,
+      messageEstimatedTokens: context.state.messages.reduce(
+        (sum, message) => sum + (message._estTokens ?? 0),
+        0
+      ),
+      webClients: clients.size,
+      pendingConfirms: pendingConfirms.size,
+      runActive: runLockControl.get() !== null
+    })
+  });
   const routes = buildRoutes(state, deps2, cb);
   const handleMessage = createMessageDispatcher({
     state,
@@ -23853,6 +24371,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       await todosCheckpoint.detach();
       await stopHeapWatchdog();
       credentialWatcherClose?.();
+      disposeRealtimeHandlers();
       brainMonitor.stop();
       await agentServices.brainLedger?.stop().catch(() => {
       });
@@ -23876,7 +24395,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       await memoryStore.dispose().catch(
         (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
       );
-      await unregisterInstance(process.pid, path33.dirname(globalConfigPath));
+      await unregisterInstance(process.pid, path34.dirname(globalConfigPath));
     }
   });
 }