@wrongstack/webui-server 0.296.3 → 0.297.0

package/dist/server/entry.js

@@ -135,85 +135,85 @@ var ENUM_PREF_KEYS = {
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
   fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"])
 };
-function validateModelRuntimeValue(modelRuntime, path29) {
+function validateModelRuntimeValue(modelRuntime, path30) {
   const reasoning = modelRuntime["reasoning"];
   if (reasoning !== void 0) {
-    if (!isRecord(reasoning)) return `${path29}.reasoning must be an object when provided`;
+    if (!isRecord(reasoning)) return `${path30}.reasoning must be an object when provided`;
     const mode = reasoning["mode"];
     const effort = reasoning["effort"];
     const preserve = reasoning["preserve"];
     if (mode !== void 0 && (typeof mode !== "string" || !REASONING_MODE_VALUES.has(mode))) {
-      return `${path29}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
+      return `${path30}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
     }
     if (effort !== void 0 && (typeof effort !== "string" || !REASONING_EFFORT_VALUES.has(effort))) {
-      return `${path29}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
+      return `${path30}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
     }
     if (preserve !== void 0 && typeof preserve !== "boolean") {
-      return `${path29}.reasoning.preserve must be a boolean when provided`;
+      return `${path30}.reasoning.preserve must be a boolean when provided`;
     }
   }
   const cache2 = modelRuntime["cache"];
   if (cache2 !== void 0) {
-    if (!isRecord(cache2)) return `${path29}.cache must be an object when provided`;
+    if (!isRecord(cache2)) return `${path30}.cache must be an object when provided`;
     const ttl = cache2["ttl"];
     if (ttl !== void 0 && (typeof ttl !== "string" || !CACHE_TTL_VALUES.has(ttl) || ttl === "default")) {
-      return `${path29}.cache.ttl must be one of: 5m, 1h`;
+      return `${path30}.cache.ttl must be one of: 5m, 1h`;
     }
   }
   const parameters = modelRuntime["parameters"];
   if (parameters !== void 0 && !isRecord(parameters)) {
-    return `${path29}.parameters must be an object when provided`;
+    return `${path30}.parameters must be an object when provided`;
   }
   return null;
 }
-function validateModelBlackoutRule(rule, path29) {
+function validateModelBlackoutRule(rule, path30) {
   const id = rule["id"];
   if (typeof id !== "string" || id.trim().length === 0) {
-    return `${path29}.id must be a non-empty string`;
+    return `${path30}.id must be a non-empty string`;
   }
   const start = rule["start"];
   if (typeof start !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(start)) {
-    return `${path29}.start must be a string in HH:mm (00:00-23:59) format`;
+    return `${path30}.start must be a string in HH:mm (00:00-23:59) format`;
   }
   const end = rule["end"];
   if (typeof end !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(end)) {
-    return `${path29}.end must be a string in HH:mm (00:00-23:59) format`;
+    return `${path30}.end must be a string in HH:mm (00:00-23:59) format`;
   }
   if (rule["enabled"] !== void 0 && typeof rule["enabled"] !== "boolean") {
-    return `${path29}.enabled must be a boolean when provided`;
+    return `${path30}.enabled must be a boolean when provided`;
   }
   if (rule["provider"] !== void 0 && typeof rule["provider"] !== "string") {
-    return `${path29}.provider must be a string when provided`;
+    return `${path30}.provider must be a string when provided`;
   }
   if (rule["model"] !== void 0 && typeof rule["model"] !== "string") {
-    return `${path29}.model must be a string when provided`;
+    return `${path30}.model must be a string when provided`;
   }
   if (rule["days"] !== void 0) {
-    if (!Array.isArray(rule["days"])) return `${path29}.days must be an array when provided`;
+    if (!Array.isArray(rule["days"])) return `${path30}.days must be an array when provided`;
     const seen = /* @__PURE__ */ new Set();
     for (const d of rule["days"]) {
       if (typeof d !== "number" || !Number.isInteger(d) || d < 0 || d > 6) {
-        return `${path29}.days elements must be integers 0-6 when provided`;
+        return `${path30}.days elements must be integers 0-6 when provided`;
       }
-      if (seen.has(d)) return `${path29}.days contains duplicate day: ${d}`;
+      if (seen.has(d)) return `${path30}.days contains duplicate day: ${d}`;
       seen.add(d);
     }
   }
   if (rule["timezone"] !== void 0) {
     if (typeof rule["timezone"] !== "string") {
-      return `${path29}.timezone must be a string when provided`;
+      return `${path30}.timezone must be a string when provided`;
     }
     try {
       Intl.DateTimeFormat(void 0, { timeZone: rule["timezone"] });
     } catch {
-      return `${path29}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
+      return `${path30}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
     }
   }
   if (rule["label"] !== void 0 && typeof rule["label"] !== "string") {
-    return `${path29}.label must be a string when provided`;
+    return `${path30}.label must be a string when provided`;
   }
   if (rule["mode"] !== void 0 && rule["mode"] !== "blackout" && rule["mode"] !== "allow_only") {
-    return `${path29}.mode must be 'blackout' or 'allow_only' when provided`;
+    return `${path30}.mode must be 'blackout' or 'allow_only' when provided`;
   }
   return null;
 }
@@ -386,6 +386,37 @@ function validateMailboxMessagesPayload(payload) {
     }
   };
 }
+var MAILBOX_ACTIONS = /* @__PURE__ */ new Set(["mark-read", "acknowledge", "reopen", "soft-delete"]);
+function validateMailboxActionPayload(payload) {
+  if (!isRecord2(payload)) {
+    return { ok: false, message: "mailbox.action payload must be an object" };
+  }
+  const requestId = payload["requestId"];
+  const mailId = payload["mailId"];
+  const action = payload["action"];
+  const readerId = payload["readerId"];
+  if (typeof requestId !== "string" || requestId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.requestId must be a non-empty string" };
+  }
+  if (typeof mailId !== "string" || mailId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.mailId must be a non-empty string" };
+  }
+  if (typeof action !== "string" || !MAILBOX_ACTIONS.has(action)) {
+    return { ok: false, message: "mailbox.action payload.action must be a supported action" };
+  }
+  if (typeof readerId !== "string" || readerId.trim().length === 0) {
+    return { ok: false, message: "mailbox.action payload.readerId must be a non-empty string" };
+  }
+  return {
+    ok: true,
+    value: {
+      requestId: requestId.trim(),
+      mailId: mailId.trim(),
+      action,
+      readerId: readerId.trim()
+    }
+  };
+}
 var MAILBOX_SEND_TYPES = /* @__PURE__ */ new Set([
   "note",
   "ask",
@@ -402,6 +433,7 @@ function validateMailboxSendPayload(payload) {
     return { ok: false, message: "mailbox.send payload must be an object" };
   }
   const requestId = payload["requestId"];
+  const rawFrom = payload["from"];
   const rawTo = payload["to"];
   const rawType = payload["type"];
   const rawAudience = payload["audience"];
@@ -412,6 +444,9 @@ function validateMailboxSendPayload(payload) {
   if (typeof requestId !== "string" || requestId.trim().length === 0) {
     return { ok: false, message: "mailbox.send payload.requestId must be a non-empty string" };
   }
+  if (rawFrom !== void 0 && (typeof rawFrom !== "string" || rawFrom.trim().length === 0)) {
+    return { ok: false, message: "mailbox.send payload.from must be a non-empty string when provided" };
+  }
   if (typeof rawTo !== "string" || rawTo.trim().length === 0) {
     return { ok: false, message: "mailbox.send payload.to must be a non-empty string" };
   }
@@ -448,6 +483,7 @@ function validateMailboxSendPayload(payload) {
     ok: true,
     value: {
       requestId: requestId.trim(),
+      ...rawFrom !== void 0 ? { from: rawFrom.trim() } : {},
       to,
       type,
       audience: rawAudience,
@@ -737,8 +773,8 @@ function validateShellOpenPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "shell.open payload must be an object with string path" };
   }
-  const path29 = payload["path"];
-  if (typeof path29 !== "string" || path29.trim().length === 0) {
+  const path30 = payload["path"];
+  if (typeof path30 !== "string" || path30.trim().length === 0) {
     return { ok: false, message: "shell.open payload.path must be a non-empty string" };
   }
   const target = payload["target"];
@@ -751,7 +787,7 @@ function validateShellOpenPayload(payload) {
   return {
     ok: true,
     value: {
-      path: path29,
+      path: path30,
       ...target !== void 0 ? { target } : {}
     }
   };
@@ -760,14 +796,14 @@ function validateGitDiffPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "git.diff payload must be an object" };
   }
-  const path29 = payload["path"];
-  if (path29 === void 0 || path29 === null) {
+  const path30 = payload["path"];
+  if (path30 === void 0 || path30 === null) {
     return { ok: true, value: { path: "" } };
   }
-  if (typeof path29 !== "string") {
+  if (typeof path30 !== "string") {
     return { ok: false, message: "git.diff payload.path must be a string when provided" };
   }
-  return { ok: true, value: { path: path29 } };
+  return { ok: true, value: { path: path30 } };
 }
 function validateProjectsAddPayload(payload) {
   if (!isRecord2(payload)) {
@@ -1529,6 +1565,7 @@ var CollaborationWebSocketHandler = class {
     for (const off of this.offs) off();
     this.offs.length = 0;
     this.stopBroadcast();
+    this.clients.clear();
   }
   // ── Inbound client messages ────────────────────────────────────────────
   /**
@@ -1588,9 +1625,7 @@ var CollaborationWebSocketHandler = class {
     if (activeSessionId !== void 0 && sessionId !== activeSessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `collab.join sessionId mismatch (active: ${activeSessionId})`
-        )
+        this.errorMessage(`collab.join sessionId mismatch (active: ${activeSessionId})`)
       );
       return;
     }
@@ -1601,26 +1636,19 @@ var CollaborationWebSocketHandler = class {
     if (role === "controller" && !this.bus) {
       this.send(
         ws,
-        this.errorMessage(
-          `role 'controller' is not available: server has no CollaborationBus`
-        )
+        this.errorMessage(`role 'controller' is not available: server has no CollaborationBus`)
       );
       return;
     }
     if (role === "annotator" && !this.annotations) {
       this.send(
         ws,
-        this.errorMessage(
-          `role 'annotator' is not available: server has no annotations store`
-        )
+        this.errorMessage(`role 'annotator' is not available: server has no annotations store`)
       );
       return;
     }
     if (role !== "observer" && this.options.authorizeRole?.({ ws, sessionId, requestedRole: role }) !== true) {
-      this.send(
-        ws,
-        this.errorMessage(`role '${role}' requires explicit server authorization`)
-      );
+      this.send(ws, this.errorMessage(`role '${role}' requires explicit server authorization`));
       return;
     }
     const participant = {
@@ -1649,14 +1677,10 @@ var CollaborationWebSocketHandler = class {
     this.broadcast(sessionId, this.stateMessage(sessionId));
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
-        this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`
-        );
+        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`);
       });
     }
-    this.logger.debug?.(
-      `collab: participant ${participant.participantId} joined ${sessionId}`
-    );
+    this.logger.debug?.(`collab: participant ${participant.participantId} joined ${sessionId}`);
   }
   leave(ws) {
     this.handleDisconnect(ws);
@@ -1727,18 +1751,13 @@ var CollaborationWebSocketHandler = class {
     }
     const payload = raw;
     if (!payload?.sessionId || typeof payload.atEventIndex !== "number" || typeof payload.text !== "string") {
-      this.send(
-        ws,
-        this.errorMessage("annotate requires { sessionId, atEventIndex, text }")
-      );
+      this.send(ws, this.errorMessage("annotate requires { sessionId, atEventIndex, text }"));
       return;
     }
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `annotate sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`annotate sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -1765,12 +1784,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(
-        ws,
-        this.errorMessage(
-          `annotation rejected: ${toErrorMessage(err)}`
-        )
-      );
+      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage(err)}`));
     }
   }
   async handleResolve(ws, raw) {
@@ -1786,26 +1800,19 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "annotator") {
       this.send(
         ws,
-        this.errorMessage(
-          `resolve requires the 'annotator' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`resolve requires the 'annotator' role (current: '${participant.role}')`)
       );
       return;
     }
     const payload = raw;
     if (!payload?.sessionId || !payload.annotationId) {
-      this.send(
-        ws,
-        this.errorMessage("resolve requires { sessionId, annotationId }")
-      );
+      this.send(ws, this.errorMessage("resolve requires { sessionId, annotationId }"));
       return;
     }
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `resolve sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`resolve sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -1816,10 +1823,7 @@ var CollaborationWebSocketHandler = class {
         resolvedBy: participant.participantId
       });
       if (!updated) {
-        this.send(
-          ws,
-          this.errorMessage(`annotation not found: ${payload.annotationId}`)
-        );
+        this.send(ws, this.errorMessage(`annotation not found: ${payload.annotationId}`));
         return;
       }
       this.broadcast(payload.sessionId, {
@@ -1832,12 +1836,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(
-        ws,
-        this.errorMessage(
-          `resolve failed: ${toErrorMessage(err)}`
-        )
-      );
+      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage(err)}`));
     }
   }
   // ── Event subscription (live mirror) ───────────────────────────────────
@@ -1908,9 +1907,7 @@ var CollaborationWebSocketHandler = class {
         seen++;
       }
     } catch (err) {
-      this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`
-      );
+      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`);
       return;
     }
     const tail2 = seen <= REPLAY_LIMIT ? ring.slice(0, seen) : (
@@ -1992,9 +1989,7 @@ var CollaborationWebSocketHandler = class {
       try {
         sendSerialized(p.ws, data);
       } catch (err) {
-        this.logger.debug?.(
-          `collab broadcast failed: ${toErrorMessage(err)}`
-        );
+        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage(err)}`);
       }
     }
   }
@@ -2021,9 +2016,7 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "controller") {
       this.send(
         ws,
-        this.errorMessage(
-          `pause requires the 'controller' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`pause requires the 'controller' role (current: '${participant.role}')`)
       );
       return;
     }
@@ -2068,9 +2061,7 @@ var CollaborationWebSocketHandler = class {
     if (participant.role !== "controller") {
       this.send(
         ws,
-        this.errorMessage(
-          `resume requires the 'controller' role (current: '${participant.role}')`
-        )
+        this.errorMessage(`resume requires the 'controller' role (current: '${participant.role}')`)
       );
       return;
     }
@@ -2168,9 +2159,7 @@ var CollaborationWebSocketHandler = class {
     if (payload.sessionId !== participant.sessionId) {
       this.send(
         ws,
-        this.errorMessage(
-          `inject_tool sessionId mismatch (joined: ${participant.sessionId})`
-        )
+        this.errorMessage(`inject_tool sessionId mismatch (joined: ${participant.sessionId})`)
       );
       return;
     }
@@ -2184,9 +2173,7 @@ var CollaborationWebSocketHandler = class {
     if (!queued) {
       this.send(
         ws,
-        this.errorMessage(
-          `an injection for toolUseId ${payload.toolUseId} is already queued`
-        )
+        this.errorMessage(`an injection for toolUseId ${payload.toolUseId} is already queued`)
       );
       return;
     }
@@ -4288,8 +4275,8 @@ function jsonByteLength(value) {
     return MAX_PAYLOAD_BYTES + 1;
   }
 }
-function error(errors, path29, code, message) {
-  errors.push({ path: path29, code, message });
+function error(errors, path30, code, message) {
+  errors.push({ path: path30, code, message });
 }
 function isMessageRole(value) {
   return value === "user" || value === "assistant" || value === "system";
@@ -4297,25 +4284,25 @@ function isMessageRole(value) {
 function isPlainJsonObject(value) {
   return isRecord3(value);
 }
-function validateCacheControl(value, path29, errors) {
+function validateCacheControl(value, path30, errors) {
   if (value === void 0) return void 0;
   if (!isRecord3(value) || value["type"] !== "ephemeral") {
-    error(errors, path29, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
+    error(errors, path30, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
     return void 0;
   }
   return { type: "ephemeral" };
 }
-function validateProviderMeta(value, path29, errors) {
+function validateProviderMeta(value, path30, errors) {
   if (value === void 0) return void 0;
   if (!isPlainJsonObject(value)) {
-    error(errors, path29, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
+    error(errors, path30, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
     return void 0;
   }
   return value;
 }
-function validateBlock(value, path29, errors) {
+function validateBlock(value, path30, errors) {
   if (!isRecord3(value)) {
-    error(errors, path29, "INVALID_BLOCK", "Content block must be an object.");
+    error(errors, path30, "INVALID_BLOCK", "Content block must be an object.");
     return void 0;
   }
   const type = value["type"];
@@ -4323,14 +4310,14 @@ function validateBlock(value, path29, errors) {
     case "text": {
       const text = value["text"];
       if (typeof text !== "string") {
-        error(errors, `${path29}/text`, "INVALID_TEXT", "Text block text must be a string.");
+        error(errors, `${path30}/text`, "INVALID_TEXT", "Text block text must be a string.");
         return void 0;
       }
       if (text.length > MAX_STRING_LENGTH) {
-        error(errors, `${path29}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
+        error(errors, `${path30}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
         return void 0;
       }
-      const cacheControl = validateCacheControl(value["cache_control"], `${path29}/cache_control`, errors);
+      const cacheControl = validateCacheControl(value["cache_control"], `${path30}/cache_control`, errors);
       return cacheControl ? { type: "text", text, cache_control: cacheControl } : { type: "text", text };
     }
     case "tool_use": {
@@ -4338,15 +4325,15 @@ function validateBlock(value, path29, errors) {
       const name2 = value["name"];
       const input = value["input"];
       if (typeof id !== "string" || id.length === 0) {
-        error(errors, `${path29}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
+        error(errors, `${path30}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
       }
       if (typeof name2 !== "string" || name2.length === 0) {
-        error(errors, `${path29}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
+        error(errors, `${path30}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
       }
       if (!isPlainJsonObject(input)) {
-        error(errors, `${path29}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
+        error(errors, `${path30}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path29}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path30}/providerMeta`, errors);
       if (typeof id !== "string" || id.length === 0 || typeof name2 !== "string" || name2.length === 0 || !isPlainJsonObject(input)) {
         return void 0;
       }
@@ -4358,18 +4345,18 @@ function validateBlock(value, path29, errors) {
       const content = value["content"];
       const isError = value["is_error"];
       if (typeof toolUseId !== "string" || toolUseId.length === 0) {
-        error(errors, `${path29}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
+        error(errors, `${path30}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
       }
       if (name2 !== void 0 && typeof name2 !== "string") {
-        error(errors, `${path29}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
+        error(errors, `${path30}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
       }
       if (typeof content !== "string") {
-        error(errors, `${path29}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
+        error(errors, `${path30}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
       } else if (content.length > MAX_STRING_LENGTH) {
-        error(errors, `${path29}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
+        error(errors, `${path30}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
       }
       if (isError !== void 0 && typeof isError !== "boolean") {
-        error(errors, `${path29}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
+        error(errors, `${path30}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
       }
       if (typeof toolUseId !== "string" || toolUseId.length === 0 || typeof content !== "string") return void 0;
       return {
@@ -4383,25 +4370,25 @@ function validateBlock(value, path29, errors) {
     case "image": {
       const source = value["source"];
       if (!isRecord3(source)) {
-        error(errors, `${path29}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
+        error(errors, `${path30}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
         return void 0;
       }
       const sourceType = source["type"];
       if (sourceType !== "base64" && sourceType !== "url") {
-        error(errors, `${path29}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
+        error(errors, `${path30}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
         return void 0;
       }
       const mediaType = source["media_type"];
       const data = source["data"];
       const url = source["url"];
       if (mediaType !== void 0 && typeof mediaType !== "string") {
-        error(errors, `${path29}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
+        error(errors, `${path30}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
       }
       if (data !== void 0 && typeof data !== "string") {
-        error(errors, `${path29}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
+        error(errors, `${path30}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
       }
       if (url !== void 0 && typeof url !== "string") {
-        error(errors, `${path29}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
+        error(errors, `${path30}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
       }
       return {
         type: "image",
@@ -4417,13 +4404,13 @@ function validateBlock(value, path29, errors) {
       const thinking = value["thinking"];
       const signature = value["signature"];
       if (typeof thinking !== "string") {
-        error(errors, `${path29}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
+        error(errors, `${path30}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
         return void 0;
       }
       if (signature !== void 0 && typeof signature !== "string") {
-        error(errors, `${path29}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
+        error(errors, `${path30}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path29}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path30}/providerMeta`, errors);
       return {
         type: "thinking",
         thinking,
@@ -4432,7 +4419,7 @@ function validateBlock(value, path29, errors) {
       };
     }
     default:
-      error(errors, `${path29}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
+      error(errors, `${path30}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
       return void 0;
   }
 }
@@ -4450,39 +4437,39 @@ function validateContextEditorMessages(value, currentMessageCount = 0) {
     error(errors, "/messages", "PAYLOAD_TOO_LARGE", "Context editor payload is too large.");
   }
   value.forEach((item, index) => {
-    const path29 = `/messages/${index}`;
+    const path30 = `/messages/${index}`;
     if (!isRecord3(item)) {
-      error(errors, path29, "INVALID_MESSAGE", "Message must be an object.");
+      error(errors, path30, "INVALID_MESSAGE", "Message must be an object.");
       return;
     }
     const role = item["role"];
     if (!isMessageRole(role)) {
-      error(errors, `${path29}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
+      error(errors, `${path30}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
       return;
     }
     const rawContent = item["content"];
     let content;
     if (typeof rawContent === "string") {
       if (rawContent.length > MAX_STRING_LENGTH) {
-        error(errors, `${path29}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
+        error(errors, `${path30}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
         return;
       }
       content = rawContent;
     } else if (Array.isArray(rawContent)) {
       const blocks = [];
       rawContent.forEach((block, blockIndex) => {
-        const parsed = validateBlock(block, `${path29}/content/${blockIndex}`, errors);
+        const parsed = validateBlock(block, `${path30}/content/${blockIndex}`, errors);
         if (parsed) blocks.push(parsed);
       });
       content = blocks;
     } else {
-      error(errors, `${path29}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
+      error(errors, `${path30}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
       return;
     }
     const ts = item["ts"];
     if (ts !== void 0) {
       if (typeof ts !== "string" || Number.isNaN(Date.parse(ts))) {
-        error(errors, `${path29}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
+        error(errors, `${path30}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
         return;
       }
     }
@@ -4871,6 +4858,7 @@ import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wron
 import {
   checkCodebaseIndexServerHealth,
   getIndexState,
+  resolveProjectIndexDaemonAvailability,
   shutdownCodebaseIndexServer
 } from "@wrongstack/tools";
 async function handleConnectionsHealthRoute(context, ws, message) {
@@ -4963,6 +4951,19 @@ async function chronicleHealth(projectRoot) {
 }
 async function codebaseIndexHealth(projectRoot, indexDir) {
   const startedAt = Date.now();
+  const availability = resolveProjectIndexDaemonAvailability(projectRoot, indexDir);
+  if (availability.kind === "endpoint-invalid") {
+    return {
+      id: "codebase-index",
+      label: "Codebase index",
+      status: "unavailable",
+      required: false,
+      mode: "endpoint-invalid",
+      detail: `Socket path is ${availability.byteLength} bytes \u2014 over this platform's ${availability.maxBytes}-byte sun_path limit. Queries fall back to a process-local index. Set a shorter TMPDIR to restore the shared daemon.`,
+      endpoint: availability.endpoint,
+      latencyMs: Date.now() - startedAt
+    };
+  }
   try {
     const health = await checkCodebaseIndexServerHealth(projectRoot, indexDir, {
       timeoutMs: 2e3
@@ -5406,15 +5407,15 @@ async function handleGitChanges(ws, projectRoot) {
         if (!m) continue;
         const added = m[1] === "-" ? 0 : Number(m[1]);
         const deleted = m[2] === "-" ? 0 : Number(m[2]);
-        let path29 = m[3] ?? "";
-        if (path29 === "") {
+        let path30 = m[3] ?? "";
+        if (path30 === "") {
           i += 1;
-          path29 = parts[i + 1] ?? parts[i] ?? "";
+          path30 = parts[i + 1] ?? parts[i] ?? "";
           i += 1;
         }
-        if (!path29) continue;
-        const prev = counts.get(path29) ?? { added: 0, deleted: 0 };
-        counts.set(path29, { added: prev.added + added, deleted: prev.deleted + deleted });
+        if (!path30) continue;
+        const prev = counts.get(path30) ?? { added: 0, deleted: 0 };
+        counts.set(path30, { added: prev.added + added, deleted: prev.deleted + deleted });
       }
     };
     parseNumstat(unstagedNumstat);
@@ -5426,7 +5427,7 @@ async function handleGitChanges(ws, projectRoot) {
       if (!rec || rec.length < 3) continue;
       const x = rec[0] ?? " ";
       const y = rec[1] ?? " ";
-      const path29 = rec.slice(3);
+      const path30 = rec.slice(3);
       const isRename = x === "R" || x === "C" || y === "R" || y === "C";
       if (isRename) i += 1;
       let status;
@@ -5438,13 +5439,13 @@ async function handleGitChanges(ws, projectRoot) {
       else if (x === "D" || y === "D") status = "D";
       else status = "M";
       const staged = x !== " " && x !== "?";
-      let added = counts.get(path29)?.added ?? 0;
-      let deleted = counts.get(path29)?.deleted ?? 0;
+      let added = counts.get(path30)?.added ?? 0;
+      let deleted = counts.get(path30)?.deleted ?? 0;
       if (status === "?") {
         added = 0;
         deleted = 0;
       }
-      files.push({ path: path29, status, added, deleted, staged });
+      files.push({ path: path30, status, added, deleted, staged });
     }
     send(ws, { type: "git.changes", payload: { files } });
   } catch (err) {
@@ -5455,21 +5456,21 @@ async function handleGitChanges(ws, projectRoot) {
   }
 }
 var MAX_DIFF_BYTES = 2 * 1024 * 1024;
-async function handleGitDiff(ws, projectRoot, path29) {
+async function handleGitDiff(ws, projectRoot, path30) {
   const cwd = projectRoot || void 0;
-  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path29, ...extra } });
-  if (!path29 || path29.includes("\0") || path29.includes("..") || nodePath.isAbsolute(path29)) {
+  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path30, ...extra } });
+  if (!path30 || path30.includes("\0") || path30.includes("..") || nodePath.isAbsolute(path30)) {
     reply2({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
   try {
     const git = makeGit(cwd);
     const { readFile: readFile11 } = await import("node:fs/promises");
-    const { join: join15 } = await import("node:path");
-    const oldText = await git(["show", `HEAD:${path29}`]);
+    const { join: join16 } = await import("node:path");
+    const oldText = await git(["show", `HEAD:${path30}`]);
     let newText = "";
     try {
-      const abs = cwd ? join15(cwd, path29) : path29;
+      const abs = cwd ? join16(cwd, path30) : path30;
       const buf = await readFile11(abs);
       if (buf.includes(0)) {
         reply2({ oldText: "", newText: "", binary: true });
@@ -5531,10 +5532,7 @@ async function handleGoalSnapshotRoute(ws, msg, handlers) {
 }
 
 // src/server/goal-ws-handler.ts
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
-import {
-  assignNickname
-} from "@wrongstack/core/coordination";
+import { assignNickname } from "@wrongstack/core/coordination";
 import {
   GoalAssessor,
   GoalPlanner,
@@ -5542,6 +5540,7 @@ import {
   PhaseOrchestrator,
   PhaseStore
 } from "@wrongstack/core/goal";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 import { WorktreeManager } from "@wrongstack/core/worktree";
 
 // src/server/git-process.ts
@@ -5578,12 +5577,7 @@ function deriveTitle(goal) {
   return trimmed || "Goal";
 }
 async function commitsSince(cwd, baseSha, branch) {
-  const output = await gitStdout(cwd, [
-    "log",
-    "--reverse",
-    "--format=%H",
-    `${baseSha}..${branch}`
-  ]);
+  const output = await gitStdout(cwd, ["log", "--reverse", "--format=%H", `${baseSha}..${branch}`]);
   if (output === null) return [];
   return output.split("\n").map((s) => s.trim()).filter(Boolean);
 }
@@ -5634,6 +5628,17 @@ var GoalWebSocketHandler = class {
     ws.on("error", () => this.clients.delete(client));
     this.sendState(client);
   }
+  /** Release timers, in-flight work, and socket references owned by this host. */
+  dispose() {
+    this.stopping = true;
+    this.abort?.abort();
+    this.abort = null;
+    this.assessAbort?.abort();
+    this.assessAbort = null;
+    this.orchestrator?.stop();
+    this.stopBroadcast();
+    this.clients.clear();
+  }
   async handleMessage(ws, msg) {
     switch (msg.type) {
       case "goal.assess":
@@ -5681,7 +5686,8 @@ var GoalWebSocketHandler = class {
       }
       case "goal.assignTask": {
         const { taskId, agentId, agentName } = msg.payload;
-        if (this.orchestrator?.setTaskAssignee(taskId, agentId, agentName)) this.afterBoardMutation();
+        if (this.orchestrator?.setTaskAssignee(taskId, agentId, agentName))
+          this.afterBoardMutation();
         break;
       }
       case "goal.addTask": {
@@ -5726,7 +5732,10 @@ var GoalWebSocketHandler = class {
             this.graph = graph;
             this.broadcast({ type: "goal.state", payload: this.buildState() });
           } else {
-            this.broadcast({ type: "goal.error", payload: { message: `Graph not found: ${graphId}` } });
+            this.broadcast({
+              type: "goal.error",
+              payload: { message: `Graph not found: ${graphId}` }
+            });
           }
         }
         break;
@@ -5749,10 +5758,13 @@ var GoalWebSocketHandler = class {
     const mySeq = ++this.assessSeq;
     const sendResult7 = (result) => {
       if (mySeq !== this.assessSeq) return;
-      sendSerialized(ws, JSON.stringify({
-        type: "goal.assess.result",
-        payload: { ...result, reqSeq: seq }
-      }));
+      sendSerialized(
+        ws,
+        JSON.stringify({
+          type: "goal.assess.result",
+          payload: { ...result, reqSeq: seq }
+        })
+      );
     };
     if (!goal.trim()) {
       sendResult7({
@@ -5798,15 +5810,24 @@ var GoalWebSocketHandler = class {
     const multiBoard = payload?.multiBoard ?? false;
     const verifyTasks = payload?.verifyTasks ?? false;
     const chimeraReview = payload?.chimeraReview ?? false;
-    this.abort = new AbortController();
+    const runAbort = new AbortController();
+    this.abort = runAbort;
     this.stopping = false;
-    const phases = Array.isArray(payload?.phases) ? payload.phases : await this.planPhases(goal, this.abort.signal);
-    if (this.stopping || this.abort.signal.aborted) {
+    const phases = Array.isArray(payload?.phases) ? payload.phases : await this.planPhases(goal, runAbort.signal);
+    if (this.stopping || runAbort.signal.aborted) {
       this.broadcast({ type: "goal.stopped", payload: { title } });
       return;
     }
     this.logger.info(`[Goal] Starting: ${title}`);
-    const graph = await new PhaseGraphBuilder({ title, description: goal, phases, autonomous, multiBoard, verifyTasks, chimeraReview }).build();
+    const graph = await new PhaseGraphBuilder({
+      title,
+      description: goal,
+      phases,
+      autonomous,
+      multiBoard,
+      verifyTasks,
+      chimeraReview
+    }).build();
     this.graph = graph;
     await this.store.save(graph);
     const useWorktrees = payload?.worktrees ?? process.env["WRONGSTACK_GOAL_WORKTREES"] !== "0";
@@ -5825,9 +5846,10 @@ var GoalWebSocketHandler = class {
       maybeVerify.verifyPhase = (async (phase, env) => {
         const cwd = env?.cwd ?? this.projectRoot;
         try {
-          const { exec } = await import("node:child_process");
+          const { execFile: execFile2 } = await import("node:child_process");
           const result = await new Promise((resolve15) => {
-            exec("npx tsc --noEmit", { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
+            const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
+            execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
               if (err && err.code === "ENOENT") {
                 resolve15("[verify] tsc not found \u2014 skipping");
                 return;
@@ -5969,11 +5991,41 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
   /** Generic fallback phases when the LLM planner produces nothing usable. */
   defaultPhases() {
     return [
-      { name: "Discovery", description: "Requirements gathering", priority: "high", estimateHours: 2, parallelizable: false },
-      { name: "Design", description: "Architecture and design", priority: "critical", estimateHours: 4, parallelizable: false },
-      { name: "Implementation", description: "Core development", priority: "critical", estimateHours: 12, parallelizable: false },
-      { name: "Testing", description: "Unit and integration tests", priority: "high", estimateHours: 6, parallelizable: true },
-      { name: "Deployment", description: "Deploy to production", priority: "medium", estimateHours: 2, parallelizable: false }
+      {
+        name: "Discovery",
+        description: "Requirements gathering",
+        priority: "high",
+        estimateHours: 2,
+        parallelizable: false
+      },
+      {
+        name: "Design",
+        description: "Architecture and design",
+        priority: "critical",
+        estimateHours: 4,
+        parallelizable: false
+      },
+      {
+        name: "Implementation",
+        description: "Core development",
+        priority: "critical",
+        estimateHours: 12,
+        parallelizable: false
+      },
+      {
+        name: "Testing",
+        description: "Unit and integration tests",
+        priority: "high",
+        estimateHours: 6,
+        parallelizable: true
+      },
+      {
+        name: "Deployment",
+        description: "Deploy to production",
+        priority: "medium",
+        estimateHours: 2,
+        parallelizable: false
+      }
     ];
   }
   /** Plan phases+todos for the goal via the LLM; fall back to defaults on failure.
@@ -6054,8 +6106,10 @@ Type: ${task.type}`;
     try {
       const result_ = await this.agent.run(reviewPrompt);
       if (result_.status === "done" && result_.finalText) {
-        this.logger.info(`[Goal] Chimera review for "${task.title}":
-${result_.finalText.slice(0, 2e3)}`);
+        this.logger.info(
+          `[Goal] Chimera review for "${task.title}":
+${result_.finalText.slice(0, 2e3)}`
+        );
       }
     } catch (err) {
       this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage2(err)}`);
@@ -6108,7 +6162,16 @@ ${result_.finalText.slice(0, 2e3)}`);
   }
   buildState(activePhaseId) {
     if (!this.graph) {
-      return { phases: [], tasks: [], overallPercent: 0, autonomous: true, title: "", multiBoard: false, verifyTasks: false, chimeraReview: false };
+      return {
+        phases: [],
+        tasks: [],
+        overallPercent: 0,
+        autonomous: true,
+        title: "",
+        multiBoard: false,
+        verifyTasks: false,
+        chimeraReview: false
+      };
     }
     const phases = Array.from(this.graph.phases.values());
     const currentActiveId = activePhaseId || phases.find((p) => p.status === "running")?.id || phases[0]?.id || "";
@@ -6606,9 +6669,9 @@ async function handleApiAnalyticsSummary(res) {
 }
 
 // src/server/http-server.ts
-import * as fs9 from "node:fs/promises";
+import * as fs10 from "node:fs/promises";
 import * as http from "node:http";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import * as v8 from "node:v8";
 import { getIndexState as getIndexState2 } from "@wrongstack/tools";
 
@@ -7292,18 +7355,153 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
 }
 
-// src/server/projects-manifest.ts
+// src/server/memory-diagnostics.ts
 import * as fs8 from "node:fs/promises";
 import * as path11 from "node:path";
+var DEFAULT_TAIL_BYTES = 1024 * 1024;
+var MAX_PROCESSES = 32;
+function finiteNumber(record, key) {
+  const value = record[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function stringValue(record, key) {
+  const value = record[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function toProcessDiagnostic(record) {
+  const pid = finiteNumber(record, "pid");
+  const ts = stringValue(record, "ts");
+  if (pid === void 0 || ts === void 0) return null;
+  const queueEntries = finiteNumber(record, "hqQueueEntries");
+  const queueBytes = finiteNumber(record, "hqQueueBytes");
+  const queueMaxBytes = finiteNumber(record, "hqQueueMaxBytes");
+  const snapshotInFlight = finiteNumber(record, "hqSnapshotInFlight");
+  const snapshotPending = finiteNumber(record, "hqSnapshotPending");
+  const snapshotTimerScheduled = finiteNumber(record, "hqSnapshotTimerScheduled");
+  const eventInFlight = finiteNumber(record, "hqEventInFlight");
+  const eventPending = finiteNumber(record, "hqEventPending");
+  const eventCoalesced = finiteNumber(record, "hqEventCoalesced");
+  const eventDropped = finiteNumber(record, "hqEventDropped");
+  return {
+    pid,
+    surface: stringValue(record, "surface") ?? "unknown",
+    ...stringValue(record, "sessionId") !== void 0 ? { sessionId: stringValue(record, "sessionId") } : {},
+    ts,
+    memory: {
+      rss: finiteNumber(record, "rss") ?? 0,
+      heapUsed: finiteNumber(record, "heapUsed") ?? 0,
+      heapTotal: finiteNumber(record, "heapTotal") ?? 0,
+      retainedHeapUsed: finiteNumber(record, "retainedHeapUsed"),
+      nativeResidual: finiteNumber(record, "nativeResidual"),
+      external: finiteNumber(record, "external"),
+      arrayBuffers: finiteNumber(record, "arrayBuffers")
+    },
+    signal: stringValue(record, "memorySignal"),
+    heapGrowthBytesPerHour: finiteNumber(record, "heapGrowthBytesPerHour"),
+    rssGrowthBytesPerHour: finiteNumber(record, "rssGrowthBytesPerHour"),
+    workload: {
+      messages: finiteNumber(record, "messages"),
+      messageEstimatedTokens: finiteNumber(record, "messageEstimatedTokens"),
+      historyEntries: finiteNumber(record, "historyEntries"),
+      historyMountedEntries: finiteNumber(record, "historyMountedEntries"),
+      historyCachedGroups: finiteNumber(record, "historyCachedGroups"),
+      appRenders: finiteNumber(record, "appRenders"),
+      metricsDroppedObservations: finiteNumber(record, "metricsDroppedObservations"),
+      kanbanSyncActive: finiteNumber(record, "kanbanSyncActive") === 1,
+      kanbanSyncPendingBoards: finiteNumber(record, "kanbanSyncPendingBoards"),
+      kanbanSyncFullRescanPending: finiteNumber(record, "kanbanSyncFullRescanPending") === 1,
+      kanbanSyncRemoteApplyQueued: finiteNumber(record, "kanbanSyncRemoteApplyQueued") === 1,
+      kanbanSyncPendingRemoteBoards: finiteNumber(record, "kanbanSyncPendingRemoteBoards"),
+      kanbanSyncPublishRuns: finiteNumber(record, "kanbanSyncPublishRuns"),
+      kanbanSyncCoalescedRefreshes: finiteNumber(record, "kanbanSyncCoalescedRefreshes"),
+      kanbanSupervisorSnapshots: finiteNumber(record, "kanbanSupervisorSnapshots"),
+      kanbanSupervisorScheduledBoards: finiteNumber(record, "kanbanSupervisorScheduledBoards"),
+      kanbanSupervisorAgentCooldowns: finiteNumber(record, "kanbanSupervisorAgentCooldowns"),
+      kanbanSupervisorRunningAgents: finiteNumber(record, "kanbanSupervisorRunningAgents")
+    },
+    resources: {
+      active: finiteNumber(record, "activeResources"),
+      types: stringValue(record, "activeResourceTypes")
+    },
+    ...queueEntries !== void 0 && queueBytes !== void 0 && queueMaxBytes !== void 0 ? {
+      hqQueue: {
+        entries: queueEntries,
+        bytes: queueBytes,
+        maxBytes: queueMaxBytes,
+        droppedFrames: finiteNumber(record, "hqQueueDroppedFrames") ?? 0,
+        droppedBytes: finiteNumber(record, "hqQueueDroppedBytes") ?? 0,
+        coalescedFrames: finiteNumber(record, "hqQueueCoalescedFrames") ?? 0,
+        coalescedBytes: finiteNumber(record, "hqQueueCoalescedBytes") ?? 0
+      }
+    } : {},
+    ...snapshotInFlight !== void 0 || snapshotPending !== void 0 || snapshotTimerScheduled !== void 0 ? {
+      hqSnapshot: {
+        inFlight: snapshotInFlight === 1,
+        pending: snapshotPending === 1,
+        timerScheduled: snapshotTimerScheduled === 1,
+        eventInFlight: eventInFlight === 1,
+        pendingEvents: eventPending ?? 0,
+        coalescedEvents: eventCoalesced ?? 0,
+        droppedEvents: eventDropped ?? 0
+      }
+    } : {},
+    profileTopStack: stringValue(record, "memoryProfileTopStack"),
+    profileTopStackBytes: finiteNumber(record, "memoryProfileTopStackBytes")
+  };
+}
+async function readRecentProcessMemoryDiagnostics(globalRoot, tailBytes = DEFAULT_TAIL_BYTES) {
+  if (!globalRoot) return [];
+  const heapLog = path11.join(globalRoot, "logs", "heap.jsonl");
+  let handle;
+  try {
+    handle = await fs8.open(heapLog, "r");
+    const stat3 = await handle.stat();
+    const length = Math.min(stat3.size, Math.max(1, tailBytes));
+    if (length === 0) return [];
+    const start = stat3.size - length;
+    const buffer = Buffer.allocUnsafe(length);
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    let text = buffer.subarray(0, bytesRead).toString("utf8");
+    if (start > 0) {
+      const firstNewline = text.indexOf("\n");
+      if (firstNewline === -1) return [];
+      text = text.slice(firstNewline + 1);
+    }
+    const newestByPid = /* @__PURE__ */ new Map();
+    const lines = text.split(/\r?\n/u);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const line = lines[index]?.trim();
+      if (!line) continue;
+      try {
+        const parsed = JSON.parse(line);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) continue;
+        const diagnostic = toProcessDiagnostic(parsed);
+        if (!diagnostic || newestByPid.has(diagnostic.pid)) continue;
+        newestByPid.set(diagnostic.pid, diagnostic);
+        if (newestByPid.size >= MAX_PROCESSES) break;
+      } catch {
+      }
+    }
+    return [...newestByPid.values()].sort((a, b) => b.ts.localeCompare(a.ts));
+  } catch {
+    return [];
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+
+// src/server/projects-manifest.ts
+import * as fs9 from "node:fs/promises";
+import * as path12 from "node:path";
 import { ConfigError } from "@wrongstack/core/types";
 import { projectSlug, withFileLock } from "@wrongstack/core/utils";
 function projectsJsonPath(globalConfigPath) {
-  const base = path11.dirname(globalConfigPath);
-  return path11.join(base, "projects.json");
+  const base = path12.dirname(globalConfigPath);
+  return path12.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs8.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs9.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -7312,37 +7510,37 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs8.mkdir(path11.dirname(file), { recursive: true });
-  await fs8.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs9.mkdir(path12.dirname(file), { recursive: true });
+  await fs9.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path11.dirname(globalConfigPath);
-  const dir = path11.join(base, "projects", slug);
-  await fs8.mkdir(dir, { recursive: true });
+  const base = path12.dirname(globalConfigPath);
+  const dir = path12.join(base, "projects", slug);
+  await fs9.mkdir(dir, { recursive: true });
   return dir;
 }
 async function touchProjectInManifest(options, globalConfigPath) {
-  const root = path11.resolve(options.projectRoot);
+  const root = path12.resolve(options.projectRoot);
   const file = projectsJsonPath(globalConfigPath);
   let entry;
   await withFileLock(file, async () => {
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    entry = manifest.projects.find((candidate) => path11.resolve(candidate.root) === root);
+    entry = manifest.projects.find((candidate) => path12.resolve(candidate.root) === root);
     if (entry) {
       entry.lastSeen = now;
-      if (options.workingDir) entry.lastWorkingDir = path11.resolve(options.workingDir);
+      if (options.workingDir) entry.lastWorkingDir = path12.resolve(options.workingDir);
     } else {
       entry = {
-        name: options.name ?? path11.basename(root),
+        name: options.name ?? path12.basename(root),
         root,
         slug: generateProjectSlug(root),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: options.workingDir ? path11.resolve(options.workingDir) : void 0
+        lastWorkingDir: options.workingDir ? path12.resolve(options.workingDir) : void 0
       };
       manifest.projects.push(entry);
     }
@@ -7753,9 +7951,9 @@ function buildCspHeader(publicWsUrl, host, port) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path12.resolve(distDir);
-  const resolved = path12.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path12.sep);
+  const root = path13.resolve(distDir);
+  const resolved = path13.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path13.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -7775,7 +7973,7 @@ function strictDecodeParam(segment, res) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path12.resolve(opts.distDir);
+  const distDir = path13.resolve(opts.distDir);
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   let techStackRuntime = null;
   const getTechStackRuntime = async () => {
@@ -8103,11 +8301,7 @@ function createHttpServer(opts) {
           if (researchMatch && req.method === "POST") {
             const pkg = strictDecodeParam(researchMatch[1], res);
             if (pkg === null) return;
-            await handleTechStackDependencyResearch(
-              res,
-              deps2,
-              pkg
-            );
+            await handleTechStackDependencyResearch(res, deps2, pkg);
             return;
           }
         } catch (error2) {
@@ -8143,6 +8337,7 @@ function createHttpServer(opts) {
         return;
       }
       if (url.pathname === "/debug/system" && req.method === "GET") {
+        const processes = await readRecentProcessMemoryDiagnostics(opts.globalRoot);
         res.writeHead(200, {
           "Content-Type": "application/json",
           "Cache-Control": "no-store"
@@ -8155,6 +8350,7 @@ function createHttpServer(opts) {
             uptime: process.uptime(),
             cpuUsage: process.cpuUsage(),
             codebaseIndexServer: getIndexState2().server,
+            processes,
             timestamp: Date.now()
           })
         );
@@ -8162,24 +8358,24 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path12.join(distDir, "index.html");
+        filePath = path13.join(distDir, "index.html");
       } else {
-        filePath = path12.join(distDir, url.pathname);
+        filePath = path13.join(distDir, url.pathname);
       }
-      const resolvedPath = path12.resolve(filePath);
+      const resolvedPath = path13.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path12.extname(resolvedPath);
+      const ext = path13.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       setStaticSecurityHeaders(res);
       if (ext === ".html") {
         if (!shouldSetAuthCookie) res.setHeader("Cache-Control", "no-cache");
         res.setHeader("Content-Security-Policy", buildCspHeader(opts.publicWsUrl, opts.host, port));
-        const html = await fs9.readFile(resolvedPath, "utf8");
+        const html = await fs10.readFile(resolvedPath, "utf8");
         res.writeHead(200);
         res.end(injectWsConfig(html, { publicWsUrl: opts.publicWsUrl }));
         return;
@@ -8190,13 +8386,13 @@ function createHttpServer(opts) {
           url.pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "public, max-age=3600"
         );
       }
-      const fileContent = await fs9.readFile(resolvedPath);
+      const fileContent = await fs10.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs9.readFile(path12.join(distDir, "index.html"), "utf8");
+          const html = await fs10.readFile(path13.join(distDir, "index.html"), "utf8");
           setStaticSecurityHeaders(res);
           res.writeHead(200, {
             "Content-Type": "text/html",
@@ -8226,14 +8422,14 @@ function createHttpServer(opts) {
 
 // src/server/instance-registry.ts
 import * as os from "node:os";
-import * as path13 from "node:path";
-import * as fs10 from "node:fs/promises";
+import * as path14 from "node:path";
+import * as fs11 from "node:fs/promises";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
 function defaultBaseDir() {
-  return path13.join(os.homedir(), ".wrongstack");
+  return path14.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path13.join(baseDir, "webui-instances.json");
+  return path14.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -8246,7 +8442,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs10.readFile(file, "utf8");
+    const raw = await fs11.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -10044,14 +10240,14 @@ function registerShutdownHandlers(res) {
 }
 
 // src/server/config-doctor.ts
-import * as fs11 from "node:fs/promises";
+import * as fs12 from "node:fs/promises";
 import {
   repairConfigDefaults
 } from "@wrongstack/core/storage";
 import { atomicWrite as atomicWrite5 } from "@wrongstack/core/utils";
 import { decryptConfigSecrets } from "@wrongstack/core/security";
 async function readConfig(file, vault) {
-  const raw = await fs11.readFile(file, "utf8");
+  const raw = await fs12.readFile(file, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("Active profile config must contain a JSON object.");
@@ -10115,6 +10311,7 @@ async function handleConfigDoctor(ws, apply, deps2) {
 
 // src/server/mailbox-handlers.ts
 import {
+  actionToAckInput,
   getSharedProjectMailbox,
   isMailboxMessageVisibleTo,
   MAILBOX_TYPE_PROPERTIES,
@@ -10131,6 +10328,43 @@ function getMailboxForDeps(deps2) {
   const dir = resolveProjectDir(projectRoot, globalRoot);
   return getSharedProjectMailbox(dir, deps2.events);
 }
+async function handleMailboxAction(ws, deps2, payload) {
+  const mb = getMailboxForDeps(deps2);
+  if (!mb) {
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: false,
+        error: "No project root available"
+      }
+    });
+    return;
+  }
+  try {
+    const message = payload.action === "soft-delete" ? await mb.softDelete(payload.mailId, payload.readerId) : await mb.ack(actionToAckInput(payload.action, payload));
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: message !== null,
+        action: payload.action,
+        mailId: payload.mailId
+      }
+    });
+  } catch (err) {
+    send(ws, {
+      type: "mailbox.action_result",
+      payload: {
+        requestId: payload.requestId,
+        success: false,
+        action: payload.action,
+        mailId: payload.mailId,
+        error: errMessage(err)
+      }
+    });
+  }
+}
 async function handleMailboxSend(ws, deps2, payload) {
   const mb = getMailboxForDeps(deps2);
   if (!mb) {
@@ -10146,7 +10380,7 @@ async function handleMailboxSend(ws, deps2, payload) {
   }
   try {
     const message = await mb.send({
-      from: "webui",
+      from: payload.from ?? "webui",
       to: payload.to,
       type: payload.type,
       audience: payload.audience,
@@ -10161,6 +10395,7 @@ async function handleMailboxSend(ws, deps2, payload) {
         requestId: payload.requestId,
         success: true,
         messageId: message.id,
+        from: message.from,
         to: message.to,
         audience: message.audience ?? "all"
       }
@@ -10205,6 +10440,7 @@ async function handleMailboxMessages(ws, deps2, payload) {
     send(ws, {
       type: "mailbox.messages",
       payload: {
+        ...payload?.unreadOnly === true ? { unreadOnly: true } : {},
         messages: visibleMessages.map((m) => {
           const readByMe = payload?.agentId !== void 0 ? payload.agentId in m.readBy : false;
           const completedByMe = payload?.agentId !== void 0 ? m.completedBy === payload.agentId : false;
@@ -10320,6 +10556,14 @@ function createMailboxRouteHandlers(ctx) {
     ...ctx.events ? { events: ctx.events } : {}
   };
   return {
+    action: (ws, msg) => {
+      const parsed = validateMailboxActionPayload(msg.payload);
+      if (!parsed.ok) {
+        sendResult2(ws, false, parsed.message);
+        return;
+      }
+      return handleMailboxAction(ws, deps2, parsed.value);
+    },
     send: (ws, msg) => {
       const parsed = validateMailboxSendPayload(msg.payload);
       if (!parsed.ok) {
@@ -10370,6 +10614,9 @@ function createMailboxRouteHandlers(ctx) {
 }
 async function handleMailboxRoute(ws, msg, handlers) {
   switch (msg.type) {
+    case "mailbox.action":
+      await handlers.action(ws, msg);
+      return true;
     case "mailbox.send":
       await handlers.send(ws, msg);
       return true;
@@ -11916,8 +12163,8 @@ function seedContextMeta(config, context) {
 }
 
 // src/server/pref-helpers.ts
-import * as fs12 from "node:fs/promises";
-import * as path14 from "node:path";
+import * as fs13 from "node:fs/promises";
+import * as path15 from "node:path";
 import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite as atomicWrite6, backupConfigFile, FORBIDDEN_PROTO_KEYS as FORBIDDEN_PROTO_KEYS2 } from "@wrongstack/core/utils";
 var PREF_KEYS = [
@@ -12013,11 +12260,11 @@ function prefSnapshot(contextMeta) {
   return snapshot;
 }
 async function writeGlobalConfigFile(filePath, vault, mutate, logger, errorLabel) {
-  const globalRoot = path14.dirname(filePath);
+  const globalRoot = path15.dirname(filePath);
   await backupConfigFile(filePath, { globalRoot });
   let raw;
   try {
-    raw = await fs12.readFile(filePath, "utf8");
+    raw = await fs13.readFile(filePath, "utf8");
   } catch {
     raw = "{}";
   }
@@ -12492,8 +12739,8 @@ async function handleProcessRoute(ws, msg, handlers) {
 }
 
 // src/server/project-handlers.ts
-import * as fs13 from "node:fs/promises";
-import * as path15 from "node:path";
+import * as fs14 from "node:fs/promises";
+import * as path16 from "node:path";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
 import { resolveWstackPaths as resolveWstackPaths4 } from "@wrongstack/core/utils";
 function createProjectHandlers(ctx) {
@@ -12545,10 +12792,10 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path15.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path15.basename(resolved);
+      const resolved = path16.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path16.basename(resolved);
       try {
-        const stat3 = await fs13.stat(resolved).catch(() => null);
+        const stat3 = await fs14.stat(resolved).catch(() => null);
         if (!stat3?.isDirectory()) {
           sendTo(ws, {
             type: "projects.added",
@@ -12557,7 +12804,7 @@ function createProjectHandlers(ctx) {
           return;
         }
         const before = await loadManifest(ctx.globalConfigPath);
-        const already = before.projects.some((project) => path15.resolve(project.root) === resolved);
+        const already = before.projects.some((project) => path16.resolve(project.root) === resolved);
         const entry = await touchProjectInManifest(
           { projectRoot: resolved, workingDir: resolved, name: name2 },
           ctx.globalConfigPath
@@ -12587,8 +12834,8 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path15.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path15.basename(resolved);
+      const resolved = path16.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path16.basename(resolved);
       if (!ctx.allowProjectMutations) {
         sendTo(ws, {
           type: "projects.selected",
@@ -12601,7 +12848,7 @@ function createProjectHandlers(ctx) {
         return;
       }
       try {
-        const stat3 = await fs13.stat(resolved).catch(() => null);
+        const stat3 = await fs14.stat(resolved).catch(() => null);
         if (!stat3?.isDirectory()) {
           sendTo(ws, {
             type: "projects.selected",
@@ -12631,7 +12878,7 @@ function createProjectHandlers(ctx) {
         const previousIdentityTarget = {
           projectSlug: previousPaths.projectSlug,
           projectRoot: previousProjectRoot,
-          projectName: path15.basename(previousProjectRoot),
+          projectName: path16.basename(previousProjectRoot),
           workingDir: ctx.context.workingDir
         };
         const previousUsage = ctx.tokenCounter.total();
@@ -12794,14 +13041,14 @@ async function searchCatalogModels(registry, rawQuery, limit = 8) {
 }
 
 // src/server/provider-config-io.ts
-import * as fs14 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 import { ConfigError as ConfigError2 } from "@wrongstack/core/types";
 import { atomicWrite as atomicWrite7 } from "@wrongstack/core/utils";
 import { decryptConfigSecrets as decryptConfigSecrets3, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs14.readFile(configPath, "utf8");
+    raw = await fs15.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -12819,7 +13066,7 @@ async function saveProviders(configPath, vault, providers, profileConfigPath) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs14.readFile(targetPath, "utf8");
+    raw = await fs15.readFile(targetPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new ConfigError2({
@@ -13522,6 +13769,7 @@ var CLIENT_COLLABORATION_MESSAGE_TYPES = [
   "collab.resume",
   "collab.grant_control",
   "collab.inject_tool",
+  "mailbox.action",
   "mailbox.agents",
   "mailbox.clear",
   "mailbox.compact",
@@ -13787,6 +14035,7 @@ var SERVER_COLLABORATION_MESSAGE_TYPES = [
   "collab.pause.granted",
   "collab.pause.released",
   "collab.state",
+  "mailbox.action_result",
   "mailbox.agent_registered",
   "mailbox.agents",
   "mailbox.cleared",
@@ -14010,13 +14259,13 @@ function isRegisteredMessageType(type, direction) {
 // src/protocol/decoder.ts
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var MAX_PAYLOAD_DEPTH = 32;
-function inspectValue(value, path29, depth) {
+function inspectValue(value, path30, depth) {
   if (depth > MAX_PAYLOAD_DEPTH) {
-    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path29 };
+    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path30 };
   }
   if (value === null || typeof value !== "object") return null;
   for (const key of Object.keys(value)) {
-    const childPath = `${path29}.${key}`;
+    const childPath = `${path30}.${key}`;
     if (FORBIDDEN_KEYS.has(key)) {
       return { code: "unsafe_key", message: `Unsafe protocol key: ${key}`, path: childPath };
     }
@@ -15712,8 +15961,8 @@ function createRouteFamilyDispatcher(options) {
 }
 
 // src/server/shell-open.ts
-import * as fs15 from "node:fs/promises";
-import * as path16 from "node:path";
+import * as fs16 from "node:fs/promises";
+import * as path17 from "node:path";
 import { spawn } from "node:child_process";
 function normalizeShellOpenTarget(target) {
   return target === "terminal" ? "terminal" : "file-manager";
@@ -15724,11 +15973,11 @@ function shellQuote(s) {
 }
 async function handleShellOpen(req, logger, options) {
   try {
-    const resolved = path16.resolve(req.path);
+    const resolved = path17.resolve(req.path);
     if (options?.projectRoot) {
-      const root = path16.resolve(options.projectRoot);
-      const relative5 = path16.relative(root, resolved);
-      const escapes = relative5.startsWith("..") || path16.isAbsolute(relative5);
+      const root = path17.resolve(options.projectRoot);
+      const relative5 = path17.relative(root, resolved);
+      const escapes = relative5.startsWith("..") || path17.isAbsolute(relative5);
       if (escapes) {
         return {
           success: false,
@@ -15736,7 +15985,7 @@ async function handleShellOpen(req, logger, options) {
         };
       }
     }
-    await fs15.access(resolved);
+    await fs16.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
@@ -15787,7 +16036,12 @@ async function handleShellOpen(req, logger, options) {
 }
 
 // src/server/sdd-board-ws-handler.ts
-import { listBoards as listBoards3 } from "@wrongstack/kanban";
+import {
+  enqueueKanbanWorkflowCommand,
+  kanbanWorkflowId,
+  listBoards as listBoards3,
+  listKanbanWorkflowStates
+} from "@wrongstack/kanban";
 import {
   applySddLifecycle,
   extractVerificationCommand,
@@ -15814,7 +16068,7 @@ var SddBoardWebSocketHandler = class {
   clients = /* @__PURE__ */ new Set();
   lifecycle;
   security;
-  diskPollingEnabled;
+  standalonePollingEnabled;
   latest = null;
   poll = null;
   pollInFlight = false;
@@ -15823,7 +16077,7 @@ var SddBoardWebSocketHandler = class {
     this.store = new SddBoardStore({ baseDir: boardsDir });
     this.lifecycle = lifecycle;
     this.security = security;
-    this.diskPollingEnabled = events === void 0;
+    this.standalonePollingEnabled = events === void 0;
     if (events) {
       const handler = (e) => {
         this.latest = e.snapshot;
@@ -15858,7 +16112,7 @@ var SddBoardWebSocketHandler = class {
       return;
     }
     if (msg.type === "sdd.board.list") {
-      const boards = await this.store.list();
+      const boards = await this.listBoardEntries();
       this.broadcast({ type: "sdd.board.list", payload: { boards } });
       return;
     }
@@ -15871,7 +16125,8 @@ var SddBoardWebSocketHandler = class {
       const verificationCommands = [];
       if (action === "set_task_verification") {
         const command = msg.payload?.verificationCommand;
-        if (command !== void 0 && (typeof command !== "string" || command.length > 8192)) return;
+        if (command !== void 0 && (typeof command !== "string" || command.length > 8192))
+          return;
         if (typeof command === "string" && command.trim()) {
           verificationCommands.push({ command, operation: "sdd.set_task_verification" });
         }
@@ -15905,18 +16160,26 @@ var SddBoardWebSocketHandler = class {
         );
         if (!authorization.allowed) return;
       }
-      const runId = msg.payload?.runId ?? this.latest?.runId ?? (await this.store.list())[0]?.runId;
+      const runId = msg.payload?.runId ?? this.latest?.runId ?? (await this.listBoardEntries())[0]?.runId;
       if (runId) {
-        await this.store.appendControl(runId, {
-          ts: Date.now(),
-          type: action,
-          payload: msg.payload
-        });
+        if (this.lifecycle && this.lifecycle.controlTransport !== "legacy-file") {
+          await enqueueKanbanWorkflowCommand(
+            this.lifecycle.projectRoot,
+            kanbanWorkflowId("sdd", runId),
+            { type: action, payload: msg.payload }
+          );
+        } else {
+          await this.store.appendControl(runId, {
+            ts: Date.now(),
+            type: action,
+            payload: msg.payload
+          });
+        }
       }
     }
   }
   /**
-   * Apply a cleanup/rollback/destroy from disk and broadcast a structured
+   * Apply a cleanup/rollback/destroy from durable state and broadcast a structured
    * `sdd.board.lifecycle_result`. Refuses (no-op) while a run is still active —
    * the user must stop it first; the UI gates the buttons on `!active` and the
    * Destroy flow auto-stops then waits before sending `destroy`.
@@ -15925,7 +16188,11 @@ var SddBoardWebSocketHandler = class {
     if (!this.lifecycle) {
       this.broadcast({
         type: "sdd.board.lifecycle_result",
-        payload: { op, ok: false, reason: "Lifecycle operations are not available in this session." }
+        payload: {
+          op,
+          ok: false,
+          reason: "Lifecycle operations are not available in this session."
+        }
       });
       return;
     }
@@ -15941,6 +16208,7 @@ var SddBoardWebSocketHandler = class {
       projectRoot: this.lifecycle.projectRoot,
       paths: this.lifecycle.paths,
       runId,
+      stateTransport: this.lifecycle.stateTransport ?? "kanban",
       revertMerged: payload?.revertMerged === true
     });
     this.broadcast({ type: "sdd.board.lifecycle_result", payload: result });
@@ -15969,22 +16237,27 @@ var SddBoardWebSocketHandler = class {
     if (this.pollInFlight) return;
     this.pollInFlight = true;
     try {
-      const entry = await this.store.latest();
-      if (!entry) return;
-      if (this.latest && this.latest.updatedAt >= entry.updatedAt && this.latest.runId === entry.runId) {
+      const snap = await this.loadLatestSnapshot();
+      if (!snap) return;
+      if (this.latest && this.latest.updatedAt >= snap.updatedAt && this.latest.runId === snap.runId) {
         return;
       }
-      const snap = await this.store.load(entry.runId);
-      if (snap) {
-        this.latest = snap;
-        this.broadcast({ type: "sdd.board.snapshot", payload: snap });
-      }
+      this.latest = snap;
+      this.broadcast({ type: "sdd.board.snapshot", payload: snap });
+    } catch (err) {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "sdd_board.poll_failed",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
     } finally {
       this.pollInFlight = false;
     }
   }
   startPolling() {
-    if (!this.diskPollingEnabled || this.poll !== null || this.clients.size === 0) return;
+    if (!this.standalonePollingEnabled || this.poll !== null || this.clients.size === 0) return;
     this.poll = setInterval(() => void this.pollLatest(), 1e3);
     this.poll.unref?.();
   }
@@ -15994,17 +16267,44 @@ var SddBoardWebSocketHandler = class {
     this.poll = null;
   }
   async sendCurrent(client) {
-    const snap = this.latest ?? await this.loadLatestFromDisk();
+    const snap = this.latest ?? await this.loadLatestSnapshot();
     if (snap) this.send(client, { type: "sdd.board.snapshot", payload: snap });
   }
   async broadcastCurrent() {
-    const snap = this.latest ?? await this.loadLatestFromDisk();
+    const snap = this.latest ?? await this.loadLatestSnapshot();
     if (snap) this.broadcast({ type: "sdd.board.snapshot", payload: snap });
   }
-  async loadLatestFromDisk() {
+  async loadLatestSnapshot() {
+    if (this.usesKanbanState()) {
+      const states = await listKanbanWorkflowStates(this.lifecycle.projectRoot, "sdd:");
+      const snapshots = states.map((state) => state.value).filter(isSddBoardSnapshot).sort((a, b) => b.updatedAt - a.updatedAt);
+      return snapshots[0] ?? null;
+    }
     const entry = await this.store.latest();
     return entry ? this.store.load(entry.runId) : null;
   }
+  async listBoardEntries() {
+    if (!this.usesKanbanState()) return this.store.list();
+    const states = await listKanbanWorkflowStates(this.lifecycle.projectRoot, "sdd:");
+    return states.flatMap((state) => {
+      if (!isSddBoardSnapshot(state.value)) return [];
+      const snapshot = state.value;
+      return [
+        {
+          runId: snapshot.runId,
+          ...snapshot.specId ? { specId: snapshot.specId } : {},
+          title: snapshot.title,
+          status: snapshot.status,
+          total: snapshot.progress.total,
+          completed: snapshot.progress.completed,
+          updatedAt: snapshot.updatedAt
+        }
+      ];
+    });
+  }
+  usesKanbanState() {
+    return Boolean(this.lifecycle && this.lifecycle.stateTransport !== "legacy-file");
+  }
   broadcast(msg) {
     const data = JSON.stringify(msg);
     for (const client of this.clients) {
@@ -16015,17 +16315,20 @@ var SddBoardWebSocketHandler = class {
     sendSerialized(client.ws, JSON.stringify(msg));
   }
 };
+function isSddBoardSnapshot(value) {
+  if (!value || typeof value !== "object") return false;
+  const snapshot = value;
+  return typeof snapshot.runId === "string" && typeof snapshot.title === "string" && typeof snapshot.status === "string" && typeof snapshot.updatedAt === "number" && Array.isArray(snapshot.tasks) && Boolean(snapshot.progress && typeof snapshot.progress.total === "number");
+}
 
 // src/server/sdd-wizard-wiring.ts
-import * as path17 from "node:path";
-import {
-  DefaultTaskStore,
-  TaskTracker
-} from "@wrongstack/core/tasking";
+import * as path18 from "node:path";
+import { DefaultTaskStore, TaskTracker } from "@wrongstack/core/tasking";
 import { ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
 import { WorktreeManager as WorktreeManager2 } from "@wrongstack/core/worktree";
 import {
   cleanupStaleSddWorktrees,
+  createKanbanSddSessionPersistence,
   decomposeNonAtomicTasks,
   gatherProjectContext,
   makeAcceptanceCriteriaVerifier,
@@ -16043,7 +16346,7 @@ import {
 } from "@wrongstack/sdd";
 async function startSddRunFromGraph(graph, deps2, config = {}, tracker) {
   const runTracker = tracker ?? (() => {
-    const t = new TaskTracker({ store: new DefaultTaskStore() });
+    const t = new TaskTracker({ store: deps2.taskStore ?? new DefaultTaskStore() });
     t.setGraph(graph);
     return t;
   })();
@@ -16052,7 +16355,8 @@ async function startSddRunFromGraph(graph, deps2, config = {}, tracker) {
   if (worktreesEnabled && await isGitWorkTree(deps2.projectRoot)) {
     void cleanupStaleSddWorktrees({
       projectRoot: deps2.projectRoot,
-      boardsDir: deps2.projectSddBoards
+      boardsDir: deps2.projectSddBoards,
+      stateTransport: "kanban"
     }).catch(() => void 0);
     worktrees = new WorktreeManager2({
       projectRoot: deps2.projectRoot,
@@ -16131,7 +16435,8 @@ function buildSddWizardDeps(opts) {
   }).catch(() => {
     projectContext = "";
   });
-  const sessionPath = opts.paths.projectSddSession ?? path17.join(opts.paths.projectDir, "sdd-session.json");
+  const legacySessionPath = opts.paths.projectSddSession ?? path18.join(opts.paths.projectDir, "sdd-session.json");
+  const sessionPersistence = createKanbanSddSessionPersistence(opts.projectRoot, legacySessionPath);
   const specStore = new SpecStore({ baseDir: opts.paths.projectSpecs });
   const graphStore = new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs });
   const runIsolatedTurn = async (prompt, name2) => {
@@ -16152,7 +16457,7 @@ function buildSddWizardDeps(opts) {
   const makeDriver = () => new SddInterviewDriver({
     specStore,
     graphStore,
-    sessionPath,
+    sessionPersistence,
     projectContext
   });
   const launchFromGraph = async (graph, config, tracker) => {
@@ -16164,6 +16469,7 @@ function buildSddWizardDeps(opts) {
         projectRoot: opts.projectRoot,
         subagentFactory: opts.subagentFactory,
         projectSddBoards: opts.paths.projectSddBoards,
+        taskStore: graphStore,
         registry,
         runIsolatedTurn,
         ...opts.brain ? { brain: opts.brain } : {}
@@ -16233,8 +16539,18 @@ var SddWizardWebSocketHandler = class {
   lastAgentText = "";
   /** Guards against overlapping interview turns (one in flight at a time). */
   busy = false;
-  /** Resolves once project-context gather + disk resume finish. */
+  /** Set when authoritative session state could not be read during bootstrap. */
+  resumeError = null;
+  /** Resolves once project-context gather + durable resume finish. */
   ready;
+  /**
+   * Single-flight slot for the resume probe. `handleMessage` awaits this
+   * when `resumeError` is set, so concurrent frames cannot race the retry
+   * — one probe either clears the gate or re-latches it, then every
+   * queued frame re-checks and proceeds. `null` when no probe is in
+   * flight (or after the probe has settled).
+   */
+  resumeProbe = null;
   async bootstrap() {
     try {
       await this.deps.ensureReady?.();
@@ -16242,7 +16558,7 @@ var SddWizardWebSocketHandler = class {
     }
     await this.tryResume();
   }
-  /** Rehydrate a persisted interview if one exists on disk. */
+  /** Rehydrate a persisted interview if one exists. */
   async tryResume() {
     if (this.driver) return;
     try {
@@ -16251,9 +16567,11 @@ var SddWizardWebSocketHandler = class {
         this.driver = driver;
         this.lastAgentText = driver.getLastAgentText() ?? "";
       }
-    } catch {
+      this.resumeError = null;
+    } catch (error2) {
       this.driver = null;
       this.lastAgentText = "";
+      this.resumeError = error2 instanceof Error ? error2.message : String(error2);
     }
   }
   addClient(ws) {
@@ -16262,6 +16580,10 @@ var SddWizardWebSocketHandler = class {
     ws.on("close", () => this.clients.delete(client));
     ws.on("error", () => this.clients.delete(client));
     void this.ready.then(() => {
+      if (this.resumeError) {
+        this.send(client, { type: "sdd.spec.error", payload: { message: this.resumeError } });
+        return;
+      }
       if (this.driver) {
         this.send(client, this.snapshotMsg());
         if (this.lastAgentText) {
@@ -16273,6 +16595,22 @@ var SddWizardWebSocketHandler = class {
   async handleMessage(msg) {
     try {
       await this.ready;
+      if (this.resumeError) {
+        if (this.resumeProbe === null) {
+          const probe = Promise.resolve().then(() => this.tryResume());
+          this.resumeProbe = probe;
+          void probe.finally(() => {
+            setTimeout(() => {
+              if (this.resumeProbe === probe) this.resumeProbe = null;
+            }, 0);
+          });
+        }
+        await this.resumeProbe;
+        if (this.resumeError) {
+          this.broadcast({ type: "sdd.spec.error", payload: { message: this.resumeError } });
+          return;
+        }
+      }
       switch (msg.type) {
         case "sdd.spec.start":
           await this.onStart(String(msg.payload?.goal ?? "").trim(), {
@@ -16289,7 +16627,10 @@ var SddWizardWebSocketHandler = class {
           if (this.driver) {
             this.broadcast(this.snapshotMsg());
             if (this.lastAgentText) {
-              this.broadcast({ type: "sdd.spec.agent_text", payload: { text: this.lastAgentText } });
+              this.broadcast({
+                type: "sdd.spec.agent_text",
+                payload: { text: this.lastAgentText }
+              });
             }
           }
           break;
@@ -16503,10 +16844,10 @@ import { recordTaskFileActivity } from "@wrongstack/kanban";
 
 // src/server/setup-events-fleet-broadcaster.ts
 import { watch as fsWatch } from "node:fs";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
-  const globalRoot = globalConfigPath ? path18.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path19.dirname(globalConfigPath) : void 0;
   if (!globalRoot) return void 0;
   const disposers = [];
   const broadcastSessions = async () => {
@@ -16516,8 +16857,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
-      const myRoot = path18.resolve(context.projectRoot);
-      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path18.resolve(s.projectRoot) === myRoot).map((s) => ({
+      const myRoot = path19.resolve(context.projectRoot);
+      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path19.resolve(s.projectRoot) === myRoot).map((s) => ({
         sessionId: s.sessionId,
         projectName: s.projectName,
         projectSlug: s.projectSlug,
@@ -16707,14 +17048,14 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 
 // src/server/setup-events-status-watcher.ts
 import { watch as fsWatch2 } from "node:fs";
-import * as fs16 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as fs17 from "node:fs/promises";
+import * as path21 from "node:path";
 
 // src/server/setup-events-watcher.ts
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative5 = path19.isAbsolute(raw) ? path19.relative(projectsDir, raw) : raw;
+  const relative5 = path20.isAbsolute(raw) ? path20.relative(projectsDir, raw) : raw;
   const parts = relative5.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2 || parts.at(-1) !== "status.json") return null;
   return parts.at(-2) ?? null;
@@ -16749,7 +17090,7 @@ function logFileWatcherMetrics(metrics) {
 function registerSetupEventsStatusWatcher(deps2) {
   const { wpaths, watcherMetrics, clients, broadcast: broadcast2, on, isDisposed } = deps2;
   if (!wpaths?.projectStatus || !wpaths.globalRoot) return void 0;
-  const projectsDir = path20.join(wpaths.globalRoot, "projects");
+  const projectsDir = path21.join(wpaths.globalRoot, "projects");
   const knownProjectHashes = /* @__PURE__ */ new Set();
   const debounceTimers = /* @__PURE__ */ new Map();
   const DEBOUNCE_MS = 150;
@@ -16794,7 +17135,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   let watcher;
   const startWatcher = async () => {
     try {
-      await fs16.mkdir(projectsDir, { recursive: true });
+      await fs17.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
       watcher = fsWatch2(
         projectsDir,
@@ -16808,8 +17149,8 @@ function registerSetupEventsStatusWatcher(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path20.join(projectsDir, projectHash, "status.json");
-            const content = await fs16.readFile(targetFile, "utf-8");
+            const targetFile = path21.join(projectsDir, projectHash, "status.json");
+            const content = await fs17.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -16866,8 +17207,8 @@ function registerSetupEventsStatusWatcher(deps2) {
 }
 
 // src/server/setup-events-core-watchers.ts
-import * as fs17 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as fs18 from "node:fs/promises";
+import * as path22 from "node:path";
 function registerSetupEventsCoreWatchers(deps2) {
   const { broadcast: broadcast2, clients, context } = deps2;
   const disposers = [];
@@ -16903,9 +17244,9 @@ function registerSetupEventsClientStatusWriter(deps2) {
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path21.dirname(statusFile);
-        await fs17.mkdir(dir, { recursive: true });
-        await fs17.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+        const dir = path22.dirname(statusFile);
+        await fs18.mkdir(dir, { recursive: true });
+        await fs18.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
         console.error(
           JSON.stringify({
@@ -17930,7 +18271,7 @@ var SpecsWebSocketHandler = class {
 // src/server/start-webui.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import * as http2 from "node:http";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import { createDefaultPipelines } from "@wrongstack/core/agent";
 import { getSharedProjectMailbox as getSharedProjectMailbox4, resolveProjectDir as resolveProjectDir3 } from "@wrongstack/core/coordination";
 import { createCompatibilityTrustBoundary as createCompatibilityTrustBoundary3 } from "@wrongstack/core/security";
@@ -17944,7 +18285,7 @@ import { DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2 } fro
 import {
   expectDefined as expectDefined3,
   sessionScopedPath as sessionScopedPath3,
-  startHeapWatchdog,
+  startSharedHeapWatchdog,
   toErrorMessage as toErrorMessage13,
   wstackGlobalRoot as wstackGlobalRoot2
 } from "@wrongstack/core/utils";
@@ -17953,10 +18294,8 @@ import { toLanguagePackageInput } from "@wrongstack/techstack";
 import { ensureSessionShell } from "@wrongstack/tools";
 
 // src/server/backend-services.ts
-import { join as join12 } from "node:path";
-import {
-  Agent
-} from "@wrongstack/core/agent";
+import { join as join13 } from "node:path";
+import { Agent } from "@wrongstack/core/agent";
 import {
   BrainDecisionLedger,
   BrainMonitor,
@@ -17968,8 +18307,8 @@ import {
   mailboxSessionTag,
   ObservableBrainArbiter as ObservableBrainArbiterCtor
 } from "@wrongstack/core/coordination";
-import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import { DEFAULT_TOOLS_CONFIG } from "@wrongstack/core/defaults";
+import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import {
   AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
   createBrainRuntime,
@@ -17979,7 +18318,9 @@ import {
 } from "@wrongstack/core/execution";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
-import { resolveContextWindowPolicy as resolveContextWindowPolicy2 } from "@wrongstack/core/types";
+import {
+  resolveContextWindowPolicy as resolveContextWindowPolicy2
+} from "@wrongstack/core/types";
 import {
   estimateRequestTokensCalibrated,
   toErrorMessage as toErrorMessage9
@@ -17996,7 +18337,7 @@ import {
 import { spawn as spawn2 } from "node:child_process";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { dirname as dirname7, join as join11 } from "node:path";
 import { resolveProjectDir as resolveProjectDir2 } from "@wrongstack/core/coordination";
 import { wstackGlobalRoot } from "@wrongstack/core/utils";
 import { readLiveLock } from "@wrongstack/core/coordination";
@@ -18125,7 +18466,7 @@ function mailboxServeInvocation(projectRoot) {
 function findWorkspaceCliEntry(projectRoot) {
   let dir = projectRoot;
   for (let i = 0; i < 6; i++) {
-    const candidate = join10(dir, "packages", "cli", "dist", "index.js");
+    const candidate = join11(dir, "packages", "cli", "dist", "index.js");
     if (existsSync(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
@@ -18370,10 +18711,10 @@ function clampDim(value, fallback) {
 }
 
 // src/server/worktree-ws-handler.ts
-import { join as join11, resolve as resolve12, sep as sep5 } from "node:path";
+import { join as join12, resolve as resolve12, sep as sep5 } from "node:path";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
-import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 var MAX_ACTIVITY = 6;
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["allocating", "active", "committing", "merging"]);
 var MANAGED_BRANCH_RE = /^wstack\/ap\/[A-Za-z0-9._/-]+$/;
@@ -18392,6 +18733,20 @@ var WorktreeWebSocketHandler = class {
   baseBranch = "";
   broadcastInterval = null;
   offs = [];
+  /**
+   * Single-flight guard for orphan scans. Two concurrent `scanAndBroadcast()`
+   * calls would race: the first call reads `wt.listManaged()`, then the
+   * second call's mutation completes (e.g. `removeOne`), then the first call
+   * broadcasts a stale orphan list — the user sees a row persist and clicks
+   * Remove a second time, hitting "remove failed (not a managed worktree?)".
+   *
+   * We coalesce concurrent triggers: while a scan is in flight, additional
+   * callers are remembered as "need a re-scan" and exactly one follow-up
+   * scan runs after the in-flight one finishes. The re-scan picks up any
+   * mutations that landed during the previous scan's `listManaged()` window.
+   */
+  scanInFlight = null;
+  scanRescanNeeded = false;
   addClient(ws) {
     this.clients.add(ws);
     ws.on("close", () => this.clients.delete(ws));
@@ -18410,7 +18765,10 @@ var WorktreeWebSocketHandler = class {
       return true;
     }
     if (msg.type === "worktree.remove") {
-      await this.removeOne(msg.payload?.["dir"], msg.payload?.["branch"]);
+      await this.removeOne(
+        msg.payload?.["dir"],
+        msg.payload?.["branch"]
+      );
       return true;
     }
     if (msg.type === "worktree.merge") {
@@ -18418,7 +18776,10 @@ var WorktreeWebSocketHandler = class {
       return true;
     }
     if (msg.type === "worktree.diff") {
-      await this.diffOne(msg.payload?.["dir"], msg.payload?.["baseBranch"]);
+      await this.diffOne(
+        msg.payload?.["dir"],
+        msg.payload?.["baseBranch"]
+      );
       return true;
     }
     return false;
@@ -18431,7 +18792,7 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve12(join11(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve12(join12(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
@@ -18447,12 +18808,43 @@ var WorktreeWebSocketHandler = class {
     }
     return live;
   }
+  /**
+   * Coalesced orphan scan entry point. Multiple concurrent callers share one
+   * in-flight scan; if a caller arrives during a scan, a single follow-up
+   * scan is scheduled to pick up mutations that landed mid-scan. Returns the
+   * shared promise so `await this.scanAndBroadcast()` still works for callers
+   * that want to chain after the next broadcast.
+   */
+  scanAndBroadcast() {
+    if (this.scanInFlight) {
+      this.scanRescanNeeded = true;
+      return this.scanInFlight;
+    }
+    this.scanInFlight = this.runScanAndMaybeRescan();
+    return this.scanInFlight;
+  }
+  /**
+   * Run the actual scan, then drain a pending re-scan request if one came in
+   * during the scan. The re-scan is bounded (one follow-up) — additional
+   * requests that arrive during the follow-up coalesce into the next one.
+   */
+  async runScanAndMaybeRescan() {
+    try {
+      await this.runScanOnce();
+      while (this.scanRescanNeeded) {
+        this.scanRescanNeeded = false;
+        await this.runScanOnce();
+      }
+    } finally {
+      this.scanInFlight = null;
+    }
+  }
   /**
    * Scan the disk for managed worktrees/branches NOT owned by a live in-session
    * run and broadcast them as orphans, with whether it is safe to clean now.
    * No-op (empty inventory) when management deps were not wired.
    */
-  async scanAndBroadcast() {
+  async runScanOnce() {
     if (!this.management) {
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
       return;
@@ -18508,7 +18900,8 @@ var WorktreeWebSocketHandler = class {
     }
     const res = await cleanupStaleSddWorktrees2({
       projectRoot: this.management.projectRoot,
-      boardsDir: this.management.boardsDir
+      boardsDir: this.management.boardsDir,
+      stateTransport: "kanban"
     });
     if (res.skippedReason) {
       this.broadcast({
@@ -18521,26 +18914,45 @@ var WorktreeWebSocketHandler = class {
     for (const [id, h] of [...this.handles]) {
       if (!ACTIVE_STATUSES.has(h.status)) this.handles.delete(id);
     }
-    this.broadcast({ type: "worktree.cleanup_result", payload: { ok: true, removed: res.removed } });
+    this.broadcast({
+      type: "worktree.cleanup_result",
+      payload: { ok: true, removed: res.removed }
+    });
     this.broadcastState();
     await this.scanAndBroadcast();
   }
   /** Remove/discard ONE worktree + branch. Refused while a live run owns it. */
   async removeOne(dir, branch) {
     if (!this.management || !dir && !branch) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "nothing to remove" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "nothing to remove" }
+      });
       return;
     }
     if (branch && !MANAGED_BRANCH_RE.test(branch)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "not a managed worktree branch" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "not a managed worktree branch" }
+      });
       return;
     }
     if (dir && !this.underRoot(dir)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "path is outside the managed worktrees root" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: { ok: false, removed: 0, reason: "path is outside the managed worktrees root" }
+      });
       return;
     }
     if (branch && this.liveActiveBranches().has(branch)) {
-      this.broadcast({ type: "worktree.cleanup_result", payload: { ok: false, removed: 0, reason: "a run is live on this worktree \u2014 stop it first" } });
+      this.broadcast({
+        type: "worktree.cleanup_result",
+        payload: {
+          ok: false,
+          removed: 0,
+          reason: "a run is live on this worktree \u2014 stop it first"
+        }
+      });
       return;
     }
     let removed = false;
@@ -18549,31 +18961,54 @@ var WorktreeWebSocketHandler = class {
       ({ removed } = await wt.removeOne(dir, branch));
     }
     for (const [id, h] of [...this.handles]) {
-      if (branch && h.branch === branch || dir && h.handleId && dir.endsWith(h.handleId)) this.handles.delete(id);
+      if (branch && h.branch === branch || dir && h.handleId && dir.endsWith(h.handleId))
+        this.handles.delete(id);
     }
-    this.broadcast({ type: "worktree.cleanup_result", payload: { ok: removed, removed: removed ? 1 : 0, reason: removed ? void 0 : "remove failed (not a managed worktree?)" } });
+    this.broadcast({
+      type: "worktree.cleanup_result",
+      payload: {
+        ok: removed,
+        removed: removed ? 1 : 0,
+        reason: removed ? void 0 : "remove failed (not a managed worktree?)"
+      }
+    });
     this.broadcastState();
     await this.scanAndBroadcast();
   }
   /** Squash-merge ONE branch into base. Refused while a live run owns it. */
   async mergeBranch(branch) {
     if (!this.management || !branch) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch: branch ?? "", reason: "no branch" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch: branch ?? "", reason: "no branch" }
+      });
       return;
     }
     if (!MANAGED_BRANCH_RE.test(branch)) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "not a managed worktree branch" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch, reason: "not a managed worktree branch" }
+      });
       return;
     }
     if (this.liveActiveBranches().has(branch)) {
-      this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" } });
+      this.broadcast({
+        type: "worktree.merge_result",
+        payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" }
+      });
       return;
     }
     const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
     const res = await wt.mergeBranch(branch);
     this.broadcast({
       type: "worktree.merge_result",
-      payload: { ok: res.ok, branch, conflict: res.conflict, conflictFiles: res.conflictFiles, reason: res.reason }
+      payload: {
+        ok: res.ok,
+        branch,
+        conflict: res.conflict,
+        conflictFiles: res.conflictFiles,
+        reason: res.reason
+      }
     });
     await this.scanAndBroadcast();
   }
@@ -18615,8 +19050,14 @@ var WorktreeWebSocketHandler = class {
       }),
       on("worktree.committed", (p) => {
         const e = p;
-        this.patch(e.handleId, { status: "committing", insertions: e.insertions, deletions: e.deletions, files: e.files });
-        if (e.committed) this.activity(e.handleId, "committed", `+${e.insertions}/-${e.deletions} (${e.files}f)`);
+        this.patch(e.handleId, {
+          status: "committing",
+          insertions: e.insertions,
+          deletions: e.deletions,
+          files: e.files
+        });
+        if (e.committed)
+          this.activity(e.handleId, "committed", `+${e.insertions}/-${e.deletions} (${e.files}f)`);
         this.broadcastState();
       }),
       on("worktree.merged", (p) => {
@@ -18657,10 +19098,15 @@ var WorktreeWebSocketHandler = class {
   activity(id, kind, text) {
     const cur = this.handles.get(id);
     if (cur) {
-      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-MAX_ACTIVITY);
+      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(
+        -MAX_ACTIVITY
+      );
       this.handles.set(id, { ...cur, recentActivity });
     }
-    this.broadcast({ type: "worktree.event", payload: { kind, handleId: id, text, at: Date.now() } });
+    this.broadcast({
+      type: "worktree.event",
+      payload: { kind, handleId: id, text, at: Date.now() }
+    });
   }
   stateMessage() {
     return {
@@ -18902,7 +19348,7 @@ async function createAgentServices(input) {
   const brainCfg = resolveBrainConfigDefaults(config.brain, {
     fallbackModels: config.fallbackModels
   });
-  const brainLedgerPath = join12(wpaths.projectDir, "brain-ledger.jsonl");
+  const brainLedgerPath = join13(wpaths.projectDir, "brain-ledger.jsonl");
   let brainLedgerEnabled = brainCfg.ledger?.enabled !== false;
   let brainLedger;
   const startBrainLedger = () => {
@@ -18967,33 +19413,35 @@ async function createAgentServices(input) {
     brainLog.push(entry);
     if (brainLog.length > 20) brainLog.shift();
   };
-  events.on(
-    "brain.decision_answered",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "answered",
-      question: e.request.question,
-      outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text : ""
-    })
-  );
-  events.on(
-    "brain.decision_ask_human",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "ask_human",
-      question: e.request.question,
-      outcome: "needs human judgement"
-    })
-  );
-  events.on(
-    "brain.decision_denied",
-    (e) => pushBrainLog({
-      at: e.at,
-      kind: "denied",
-      question: e.request.question,
-      outcome: e.decision.type === "deny" ? e.decision.reason : ""
-    })
-  );
+  const brainLogOffs = [
+    events.on(
+      "brain.decision_answered",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "answered",
+        question: e.request.question,
+        outcome: e.decision.type === "answer" ? e.decision.optionId ?? e.decision.text : ""
+      })
+    ),
+    events.on(
+      "brain.decision_ask_human",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "ask_human",
+        question: e.request.question,
+        outcome: "needs human judgement"
+      })
+    ),
+    events.on(
+      "brain.decision_denied",
+      (e) => pushBrainLog({
+        at: e.at,
+        kind: "denied",
+        question: e.request.question,
+        outcome: e.decision.type === "deny" ? e.decision.reason : ""
+      })
+    )
+  ];
   const brainMailbox = getSharedProjectMailbox2(wpaths.projectDir, events);
   brainMonitor = new BrainMonitor({
     events,
@@ -19105,6 +19553,17 @@ async function createAgentServices(input) {
       getActiveSessionId: () => context.session.id
     }
   );
+  let realtimeHandlersDisposed = false;
+  const disposeRealtimeHandlers = () => {
+    if (realtimeHandlersDisposed) return;
+    realtimeHandlersDisposed = true;
+    for (const off of brainLogOffs) off();
+    goalHandler.dispose();
+    sddBoardHandler.dispose();
+    worktreeHandler.dispose();
+    terminalHandler.dispose();
+    collabHandler.dispose();
+  };
   return {
     collabBus,
     compactor,
@@ -19130,6 +19589,7 @@ async function createAgentServices(input) {
     worktreeHandler,
     terminalHandler,
     collabHandler,
+    disposeRealtimeHandlers,
     updateAutoCompactionMaxContext
   };
 }
@@ -19216,7 +19676,7 @@ function createConnectionHandler(options) {
 }
 
 // src/server/message-dispatcher.ts
-import path22 from "node:path";
+import path23 from "node:path";
 function createMessageDispatcher(opts) {
   const { state, deps: deps2, routes, promptsCtx, codebaseIndexing, runLock, pendingConfirms } = opts;
   function makeWorklistContext() {
@@ -19237,7 +19697,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path22.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path23.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -19489,7 +19949,7 @@ function createMessageDispatcher(opts) {
 
 // src/server/pre-context-services.ts
 import { createRequire as createRequire3 } from "node:module";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 import { Context, DefaultSystemPromptBuilder } from "@wrongstack/core/agent";
 import {
   getSharedProjectMailbox as getSharedProjectMailbox3,
@@ -19543,8 +20003,8 @@ import { configureDangerBypass, configureExecPolicy } from "@wrongstack/tools";
 import { attachSessionKanbanMirror, hydrateSessionKanban } from "@wrongstack/tools/session-kanban";
 
 // src/server/model-auto-discovery.ts
-import * as fs18 from "node:fs/promises";
-import * as path23 from "node:path";
+import * as fs19 from "node:fs/promises";
+import * as path24 from "node:path";
 import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
@@ -19570,7 +20030,7 @@ function eligibleProviders(config) {
 }
 async function readCache(file) {
   try {
-    return JSON.parse(await fs18.readFile(file, "utf8"));
+    return JSON.parse(await fs19.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -19580,7 +20040,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path23.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path24.join(opts.cacheDir, "discovered-models-cache.json");
   const cache2 = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -19617,8 +20077,8 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs18.mkdir(path23.dirname(cacheFile), { recursive: true });
-      await fs18.writeFile(cacheFile, JSON.stringify(cache2), "utf8");
+      await fs19.mkdir(path24.dirname(cacheFile), { recursive: true });
+      await fs19.writeFile(cacheFile, JSON.stringify(cache2), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
     }
@@ -19714,7 +20174,7 @@ function resolveSetupProvider(opts) {
 }
 
 // src/server/standalone-session-identity.ts
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 import {
   AgentStatusTracker,
   FleetNotifier,
@@ -19733,7 +20193,7 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
   let activeTarget = {
     projectSlug: paths.projectSlug,
     projectRoot: paths.projectRoot,
-    projectName: path24.basename(paths.projectRoot),
+    projectName: path25.basename(paths.projectRoot),
     workingDir: opts.workingDir
   };
   let pendingClaim;
@@ -19964,7 +20424,7 @@ async function createPreContextServices(input) {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path25.dirname(wpaths.modelsCache),
+      cacheDir: path26.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
@@ -20016,7 +20476,7 @@ async function createPreContextServices(input) {
   configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpTokenStore = new MCPVaultTokenStore(
-    path25.join(wpaths.projectDir, "mcp-auth.json"),
+    path26.join(wpaths.projectDir, "mcp-auth.json"),
     vault
   );
   const mcpAuthorizationManager = new MCPAuthorizationManager({ store: mcpTokenStore });
@@ -20122,7 +20582,7 @@ async function createPreContextServices(input) {
   };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path25.join(wpaths.configDir, "installed-skills.json"),
+    manifestPath: path26.join(wpaths.configDir, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -20132,8 +20592,8 @@ async function createPreContextServices(input) {
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
       const req = createRequire3(import.meta.url);
-      return path25.join(
-        path25.dirname(req.resolve("@wrongstack/core/package.json")),
+      return path26.join(
+        path26.dirname(req.resolve("@wrongstack/core/package.json")),
         "data",
         "prompts"
       );
@@ -20237,7 +20697,7 @@ async function createPreContextServices(input) {
 }
 
 // src/server/routes.ts
-import path26 from "node:path";
+import path27 from "node:path";
 import { makeProviderFromConfig as makeProviderFromConfig2, withCatalogCapabilities } from "@wrongstack/providers";
 
 // src/server/mode-handlers.ts
@@ -20529,7 +20989,7 @@ function buildRoutes(state, deps2, cb) {
   };
   const mailboxRoutes = createMailboxRouteHandlers({
     getProjectRoot: state.getProjectRoot,
-    getGlobalRoot: () => path26.dirname(deps2.globalConfigPath),
+    getGlobalRoot: () => path27.dirname(deps2.globalConfigPath),
     events: deps2.events
   });
   const mcpRoutes = {
@@ -20602,7 +21062,7 @@ function buildRoutes(state, deps2, cb) {
 }
 
 // src/server/server-runtime.ts
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 import { createRequire as createRequire4 } from "node:module";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
@@ -20663,7 +21123,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path27.basename(projectRoot) || projectRoot,
+      projectName: path28.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -20751,13 +21211,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, httpPort, setupInput, watch
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path27.resolve(explicitDistDir);
+  if (explicitDistDir) return path28.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire4(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui");
-    return path27.dirname(serverEntry);
+    return path28.dirname(serverEntry);
   } catch {
-    return path27.resolve(path27.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path28.resolve(path28.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -20971,6 +21431,7 @@ async function startWebUI(opts = {}) {
     worktreeHandler,
     terminalHandler,
     collabHandler,
+    disposeRealtimeHandlers,
     updateAutoCompactionMaxContext
   } = agentServices;
   if (typeof context.meta["yolo"] === "boolean") {
@@ -21149,21 +21610,21 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path28.resolve(root);
+    const resolved = path29.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path28.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path29.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path28.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path29.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path28.basename(resolved),
+        name: path29.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path28.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path29.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -21340,7 +21801,20 @@ async function startWebUI(opts = {}) {
     );
     credentialWatcherClose = credentialWatcher.close;
   }
-  const stopHeapWatchdog = startHeapWatchdog();
+  const stopHeapWatchdog = startSharedHeapWatchdog({
+    collectStats: () => ({
+      surface: opts.surface ?? "webui",
+      sessionId: context.session.id,
+      messages: context.state.messages.length,
+      messageEstimatedTokens: context.state.messages.reduce(
+        (sum, message) => sum + (message._estTokens ?? 0),
+        0
+      ),
+      webClients: clients.size,
+      pendingConfirms: pendingConfirms.size,
+      runActive: runLockControl.get() !== null
+    })
+  });
   const routes = buildRoutes(state, deps2, cb);
   const handleMessage = createMessageDispatcher({
     state,
@@ -21418,6 +21892,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       await todosCheckpoint.detach();
       await stopHeapWatchdog();
       credentialWatcherClose?.();
+      disposeRealtimeHandlers();
       brainMonitor.stop();
       await agentServices.brainLedger?.stop().catch(() => {
       });
@@ -21441,7 +21916,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       await memoryStore.dispose().catch(
         (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage13(err)}`)
       );
-      await unregisterInstance(process.pid, path28.dirname(globalConfigPath));
+      await unregisterInstance(process.pid, path29.dirname(globalConfigPath));
     }
   });
 }
@@ -21534,7 +22009,7 @@ if (argv.includes("--help") || argv.includes("-h")) {
     console.error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  const open = argv.includes("--open") || argv.includes("-o") || process.env["WEBUI_OPEN"] === "1";
+  const open2 = argv.includes("--open") || argv.includes("-o") || process.env["WEBUI_OPEN"] === "1";
   const requireToken = argv.includes("--require-token") || envFlag2("WEBUI_REQUIRE_TOKEN");
   console.log(`[WebUI] Starting standalone server on ${wsHost} (http:${httpPort})...`);
   startWebUI({
@@ -21544,7 +22019,7 @@ if (argv.includes("--help") || argv.includes("-h")) {
     publicUrl,
     publicWsUrl,
     requireToken,
-    open,
+    open: open2,
     distDir
   }).catch((err) => {
     console.error(JSON.stringify({