@wrongstack/webui-server 0.302.0 → 0.303.0

package/dist/server/entry.js

@@ -1421,7 +1421,13 @@ function indexDbVersion(projectRoot, indexDir) {
   try {
     const dir = resolveIndexDir(projectRoot, indexDir);
     const st = fs.statSync(path.join(dir, DB_FILE));
-    return `${st.mtimeMs}:${st.size}`;
+    let wal = "";
+    try {
+      const walSt = fs.statSync(path.join(dir, `${DB_FILE}-wal`));
+      wal = `:${walSt.mtimeMs}:${walSt.size}`;
+    } catch {
+    }
+    return `${st.mtimeMs}:${st.size}${wal}`;
   } catch {
     return "missing";
   }
@@ -4323,7 +4329,8 @@ function createConversationOperations(ctx) {
     userMessage: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "user_message")) return;
       const payload = msg.payload ?? {};
-      const controller = ctx.runControl.begin(ws);
+      const originSessionId = ctx.getSessionId();
+      const controller = ctx.runControl.begin(ws, originSessionId);
       if (!controller) {
         ctx.send(ws, {
           type: "error",
@@ -4334,7 +4341,6 @@ function createConversationOperations(ctx) {
         });
         return;
       }
-      const originSessionId = ctx.getSessionId();
       try {
         const agent = ctx.getAgent();
         if (payload.freshContext === true) await startFreshTopicContext(agent.ctx);
@@ -4393,12 +4399,13 @@ function createConversationOperations(ctx) {
           });
         }
       } finally {
-        ctx.runControl.end(ws, controller);
+        ctx.runControl.end(ws, originSessionId, controller);
       }
     },
     abort: (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "abort")) return;
-      ctx.runControl.abort(ws);
+      const sessionId = requestedSessionId(msg) ?? ctx.getSessionId();
+      ctx.runControl.abort(ws, sessionId);
       ctx.notifyAbort(ws, {
         type: "error",
         payload: sessionPayload2({ phase: "abort", message: "User aborted" })
@@ -5450,6 +5457,7 @@ function createConnectionLifecycle(options) {
 }
 
 // src/server/connections-health-route.ts
+import * as net from "node:net";
 import {
   ChronicleProjectServerClient,
   createChronicleProjectAccess as createChronicleProjectAccess2,
@@ -5459,13 +5467,22 @@ import {
   isMailboxProjectServerAvailable,
   MailboxProjectServerConnection
 } from "@wrongstack/core/coordination";
+import { SessionCatalogProjectClient } from "@wrongstack/core/session-catalog";
 import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
 import {
   closeKanbanServerConnections,
   getKanbanServerConnection,
   isKanbanServerAvailable
 } from "@wrongstack/kanban";
-import * as net from "node:net";
+import { readGovernanceDaemonOperatorStatus } from "@wrongstack/runtime/governance-bootstrap";
+import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
+import {
+  checkCodebaseIndexServerHealth,
+  ensureCodebaseIndexServer as ensureCodebaseIndexServer2,
+  getIndexState,
+  resolveProjectIndexDaemonAvailability,
+  shutdownCodebaseIndexServer
+} from "@wrongstack/tools";
 
 // src/server/privileged-actions.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -5499,15 +5516,6 @@ async function authorizeWebUIAction(boundary, action, logger) {
 }
 
 // src/server/connections-health-route.ts
-import { readGovernanceDaemonOperatorStatus } from "@wrongstack/runtime/governance-bootstrap";
-import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
-import {
-  checkCodebaseIndexServerHealth,
-  ensureCodebaseIndexServer as ensureCodebaseIndexServer2,
-  getIndexState,
-  resolveProjectIndexDaemonAvailability,
-  shutdownCodebaseIndexServer
-} from "@wrongstack/tools";
 async function handleConnectionsHealthRoute(context, ws, message) {
   if (message.type !== "connections.health") return false;
   try {
@@ -5528,6 +5536,7 @@ async function handleConnectionsHealthRoute(context, ws, message) {
 async function collectConnectionsHealth(options) {
   const services = await Promise.all([
     Promise.resolve(webuiHealth(options.backend)),
+    sessionCatalogHealth(options.projectRoot),
     chronicleHealth(options.projectRoot),
     codebaseIndexHealth(options.projectRoot, options.indexDir),
     sageHealth(options.projectRoot),
@@ -5545,6 +5554,50 @@ async function collectConnectionsHealth(options) {
     services
   };
 }
+async function sessionCatalogHealth(projectRoot) {
+  const startedAt = Date.now();
+  try {
+    const paths = resolveWstackPaths2({ projectRoot });
+    const client = new SessionCatalogProjectClient({
+      projectDir: paths.projectDir,
+      projectRoot
+    });
+    try {
+      const health = await client.ping();
+      return {
+        id: "session-catalog",
+        label: "Session Catalog",
+        status: health.damagedRows > 0 ? "degraded" : "healthy",
+        required: true,
+        mode: "project-daemon",
+        detail: health.damagedRows > 0 ? `${health.damagedRows} damaged catalog row(s); rebuild is required.` : `${health.catalogRows} catalog session(s), ${health.liveLeases} live lease(s), ${health.reservations} reservation(s).`,
+        ownerPid: health.pid,
+        endpoint: health.endpoint,
+        storage: health.databasePath,
+        uptimeMs: health.uptimeMs,
+        latencyMs: Date.now() - startedAt,
+        clients: health.clients,
+        activeRequests: health.activeRequests,
+        queuedWork: health.reservations + health.maintenanceLeases,
+        control: "none"
+      };
+    } finally {
+      await client.close().catch(() => void 0);
+    }
+  } catch (error2) {
+    return {
+      id: "session-catalog",
+      label: "Session Catalog",
+      status: "error",
+      required: true,
+      mode: "project-daemon",
+      detail: "Project-scoped session ownership and catalog are unavailable.",
+      latencyMs: Date.now() - startedAt,
+      lastError: error2 instanceof Error ? error2.message : String(error2),
+      control: "none"
+    };
+  }
+}
 function webuiHealth(backend) {
   return {
     id: "webui",
@@ -6143,7 +6196,11 @@ async function restartSageServer(projectRoot) {
   });
   const verifyConn = new SageProjectServerConnection(projectRoot);
   try {
-    await verifyConn.call("ping", {}, { timeoutMs: 1e4, meta: { clientId: `sage-restart-${process.pid}` } });
+    await verifyConn.call(
+      "ping",
+      {},
+      { timeoutMs: 1e4, meta: { clientId: `sage-restart-${process.pid}` } }
+    );
     return {
       serviceId: "sage",
       action: "restart",
@@ -7552,12 +7609,34 @@ function handleTodosGet(ctx, ws) {
     payload: sessionPayload(ctx, { todos: [...ctx.context.todos] })
   });
 }
-function handleTodosClear(ctx, ws) {
-  ctx.replaceTodos?.([]);
-  sendResult3(ctx, ws, true, "Todos cleared");
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: [] }) });
+async function commitTodos(ctx, todos) {
+  if (ctx.mutateTodos) {
+    const result = await ctx.mutateTodos(todos);
+    return { todos: result.todos, warnings: result.warnings ?? [] };
+  }
+  ctx.replaceTodos?.(todos);
+  return { todos: [...todos], warnings: [] };
+}
+function managedProjectionMessage() {
+  return "Kanban-bound todos are task projections. Change or remove the task from Kanban.";
 }
-function handleTodosRemove(ctx, ws, payload) {
+async function handleTodosClear(ctx, ws) {
+  if (ctx.context.todos.some((todo) => todo.kanbanBoardId && todo.kanbanTaskId)) {
+    sendResult3(ctx, ws, false, managedProjectionMessage());
+    return;
+  }
+  try {
+    const result = await commitTodos(ctx, []);
+    sendResult3(ctx, ws, true, "Todos cleared");
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
+}
+async function handleTodosRemove(ctx, ws, payload) {
   if (!payload) {
     sendResult3(ctx, ws, false, "Missing id or index");
     return;
@@ -7574,12 +7653,27 @@ function handleTodosRemove(ctx, ws, payload) {
     sendResult3(ctx, ws, false, "Todo not found");
     return;
   }
+  if (removed.kanbanBoardId && removed.kanbanTaskId) {
+    sendResult3(ctx, ws, false, managedProjectionMessage());
+    return;
+  }
   const next = [...todos.slice(0, targetIndex), ...todos.slice(targetIndex + 1)];
-  ctx.replaceTodos?.(next);
-  sendResult3(ctx, ws, true, `Removed: ${removed.content}`);
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: next }) });
+  try {
+    const result = await commitTodos(ctx, next);
+    sendResult3(ctx, ws, true, `Removed: ${removed.content}`);
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
 }
-function handleTodoUpdate(ctx, ws, payload) {
+async function handleTodoUpdate(ctx, ws, payload) {
+  if (!payload || typeof payload.id !== "string" || payload.status !== void 0 && payload.status !== "pending" && payload.status !== "in_progress" && payload.status !== "completed" || payload.activeForm !== void 0 && typeof payload.activeForm !== "string") {
+    sendResult3(ctx, ws, false, "Invalid todo update payload");
+    return;
+  }
   const index = ctx.context.todos.findIndex((todo) => todo.id === payload.id);
   const existing = ctx.context.todos[index];
   if (index === -1 || !existing) {
@@ -7592,9 +7686,25 @@ function handleTodoUpdate(ctx, ws, payload) {
     status: payload.status ?? existing.status,
     activeForm: payload.activeForm !== void 0 ? payload.activeForm : existing.activeForm
   };
-  ctx.replaceTodos?.(next);
-  sendResult3(ctx, ws, true, `Todo "${existing.content}" updated`);
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: next }) });
+  try {
+    const result = await commitTodos(ctx, next);
+    const projected = result.todos.find((todo) => todo.id === existing.id);
+    const requestedStatus = payload.status ?? existing.status;
+    const projectionRejected = Boolean(existing.kanbanBoardId && existing.kanbanTaskId) && projected?.status !== requestedStatus;
+    const warning = result.warnings[0];
+    sendResult3(
+      ctx,
+      ws,
+      !projectionRejected,
+      projectionRejected ? warning ?? `Kanban kept "${existing.content}" at ${projected?.status ?? "its current state"}.` : warning ? `Todo "${existing.content}" updated. ${warning}` : `Todo "${existing.content}" updated`
+    );
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
 }
 async function handleTasksGet(ctx, ws) {
   const taskPath = taskPathOf(ctx);
@@ -7622,14 +7732,32 @@ async function handleTaskUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const file = await mutateTasks(taskPath, currentSessionId(ctx), async (tasks) => {
-      const task = tasks.tasks.find((candidate) => candidate.id === payload.id);
-      if (!task) return tasks;
-      task.status = payload.status;
-      task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      return tasks;
-    });
-    sendResult3(ctx, ws, true, `Task status updated to "${payload.status}".`);
+    let file;
+    if (ctx.mutateTaskStatus) {
+      const result = await ctx.mutateTaskStatus(payload.id, payload.status);
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      file = await loadTasks(taskPath);
+      if (!file) throw new Error("Task mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+    } else {
+      let matched = false;
+      file = await mutateTasks(taskPath, currentSessionId(ctx), async (tasks) => {
+        const task = tasks.tasks.find((candidate) => candidate.id === payload.id);
+        if (!task) return tasks;
+        matched = true;
+        task.status = payload.status;
+        task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        return tasks;
+      });
+      if (!matched) {
+        sendResult3(ctx, ws, false, `Task "${payload.id}" not found.`);
+        return;
+      }
+      sendResult3(ctx, ws, true, `Task status updated to "${payload.status}".`);
+    }
     ctx.broadcast({
       type: "tasks.updated",
       payload: sessionPayload(ctx, { tasks: file.tasks })
@@ -7676,6 +7804,18 @@ async function handlePlanTemplateUse(ctx, ws, template) {
     return;
   }
   try {
+    if (ctx.mutatePlan) {
+      const result = await ctx.mutatePlan({ action: "template_use", template });
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      const plan2 = await loadPlan(planPath);
+      if (!plan2) throw new Error("Plan mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+      ctx.broadcast({ type: "plan.updated", payload: sessionPayload(ctx, { plan: plan2 }) });
+      return;
+    }
     const templateDefinition = getPlanTemplate(template);
     if (!templateDefinition) {
       sendResult3(ctx, ws, false, `Unknown template "${template}".`);
@@ -7704,6 +7844,22 @@ async function handlePlanItemUpdate(ctx, ws, payload) {
     return;
   }
   try {
+    if (ctx.mutatePlan) {
+      const result = await ctx.mutatePlan({
+        action: "status",
+        target: payload.target,
+        status: payload.status
+      });
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      const plan2 = await loadPlan(planPath);
+      if (!plan2) throw new Error("Plan mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+      ctx.broadcast({ type: "plan.updated", payload: sessionPayload(ctx, { plan: plan2 }) });
+      return;
+    }
     let changed = false;
     const plan = await mutatePlan(planPath, currentSessionId(ctx), async (currentPlan) => {
       const before = currentPlan.updatedAt;
@@ -7727,13 +7883,17 @@ async function handleWorklistMessage(ctx, ws, message) {
       handleTodosGet(ctx, ws);
       return;
     case "todos.clear":
-      handleTodosClear(ctx, ws);
+      await handleTodosClear(ctx, ws);
       return;
     case "todos.remove":
-      handleTodosRemove(ctx, ws, message.payload);
+      await handleTodosRemove(
+        ctx,
+        ws,
+        message.payload
+      );
       return;
     case "todo.update":
-      handleTodoUpdate(
+      await handleTodoUpdate(
         ctx,
         ws,
         message.payload
@@ -8154,8 +8314,8 @@ async function handleApiSessions(res, globalRoot) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
-    const registry = new SessionRegistry(globalRoot);
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+    const registry = getSessionRegistry3(globalRoot);
     const sessions = await registry.list();
     const result = sessions.map((s) => ({
       sessionId: s.sessionId,
@@ -8192,8 +8352,8 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
-    const registry = new SessionRegistry(globalRoot);
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8201,20 +8361,22 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
       return;
     }
     res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({
-      sessionId: entry.sessionId,
-      projectName: entry.projectName,
-      status: entry.status,
-      agents: entry.agents.map((a) => ({
-        id: a.id,
-        name: a.name,
-        status: a.status,
-        currentTool: a.currentTool,
-        iterations: a.iterations,
-        toolCalls: a.toolCalls,
-        lastActivityAt: a.lastActivityAt
-      }))
-    }));
+    res.end(
+      JSON.stringify({
+        sessionId: entry.sessionId,
+        projectName: entry.projectName,
+        status: entry.status,
+        agents: entry.agents.map((a) => ({
+          id: a.id,
+          name: a.name,
+          status: a.status,
+          currentTool: a.currentTool,
+          iterations: a.iterations,
+          toolCalls: a.toolCalls,
+          lastActivityAt: a.lastActivityAt
+        }))
+      })
+    );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: sanitizeApiError(err) }));
@@ -8332,9 +8494,9 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, DefaultSessionStore: DefaultSessionStore3, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3, DefaultSessionStore: DefaultSessionStore3, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core/storage");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8342,7 +8504,10 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
       return;
     }
     const paths = resolveWstackPaths7({ projectRoot: entry.projectRoot, globalRoot });
-    const store = new DefaultSessionStore3({ dir: paths.projectSessions });
+    const store = new DefaultSessionStore3({
+      dir: paths.projectSessions,
+      projectRoot: entry.projectRoot
+    });
     const reader = new DefaultSessionReader2({ store });
     const RING = Math.max(limit * 4, 2e3);
     const ring = [];
@@ -8434,10 +8599,10 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
   const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox5, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8462,10 +8627,10 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox5, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8522,10 +8687,10 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox5, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8571,10 +8736,10 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox5, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const all = await registry.list();
     const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
     const targets = all.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true);
@@ -10434,11 +10599,11 @@ function kanbanListMessage(boards) {
 function kanbanDeletedMessage(boardId) {
   return { type: "kanban.delete", payload: { success: true, data: { removed: true, boardId } } };
 }
-async function publishKanbanBoard(broadcast2, board, listBoards4) {
+async function publishKanbanBoard(broadcast2, board, listBoards5) {
   broadcast2(kanbanBoardMessage(board));
-  if (!listBoards4) return;
+  if (!listBoards5) return;
   try {
-    broadcast2(kanbanListMessage(await listBoards4()));
+    broadcast2(kanbanListMessage(await listBoards5()));
   } catch {
   }
 }
@@ -10689,9 +10854,9 @@ import {
   claimReadyTask,
   copyTaskToBoard,
   createBoard,
+  createBoardFromText,
   duplicateBoard,
   exportBoardToTaskGraph,
-  createBoardFromText,
   getBoard,
   getKanbanOrchestrationSnapshot,
   getKanbanQueueHealth,
@@ -10879,8 +11044,35 @@ async function handleTaskVerification(ws, type, payload, ctx) {
   }
 }
 
+// src/server/kanban-route-pagination.ts
+function paginateKanbanBoards(boards, input) {
+  const pageSize = Math.min(100, Math.max(1, Math.floor(input.pageSize)));
+  const activeSessionIds = new Set(input.activeSessionIds ?? []);
+  const isActive = (board) => board.presence?.some((entry) => entry.active) === true || board.tags?.some((tag) => tag.startsWith("session:") && activeSessionIds.has(tag.slice(8))) === true;
+  const sorted = [...boards].sort((left, right) => {
+    const activityOrder = Number(isActive(right)) - Number(isActive(left));
+    return activityOrder || right.updatedAt.localeCompare(left.updatedAt);
+  });
+  const activeTotal = sorted.filter(isActive).length;
+  const total = sorted.length;
+  const totalPages = Math.max(1, Math.ceil(total / pageSize));
+  const requestedPage = Number.isFinite(input.page) ? Math.floor(input.page) : 1;
+  const page = Math.min(totalPages, Math.max(1, requestedPage));
+  const start = (page - 1) * pageSize;
+  return {
+    items: sorted.slice(start, start + pageSize),
+    total,
+    page,
+    pageSize,
+    totalPages,
+    activeTotal,
+    orphanedTotal: total - activeTotal
+  };
+}
+
 // src/server/kanban-task-routes.ts
 import {
+  getKanbanWorkbench,
   getTask,
   listTaskActivity,
   recordTaskActivity,
@@ -10888,6 +11080,16 @@ import {
 } from "@wrongstack/kanban";
 async function handleKanbanTaskRoute(ws, type, payload, ctx) {
   switch (type) {
+    case "kanban.workbench":
+      ok(
+        ws,
+        type,
+        await getKanbanWorkbench(ctx.projectRoot, {
+          ...typeof payload?.limitPerLane === "number" ? { limitPerLane: payload.limitPerLane } : {},
+          ...typeof payload?.alertLimit === "number" ? { alertLimit: payload.alertLimit } : {}
+        })
+      );
+      return true;
     case "kanban.task.remove":
       await handleTaskRemove(ws, type, payload, ctx);
       return true;
@@ -10980,40 +11182,11 @@ async function handleTaskActivityAdd(ws, type, payload, ctx) {
       outcome,
       ...typeof payload?.details === "string" && payload.details.trim() ? { details: payload.details.trim() } : {}
     },
-    activityContext(
-      ctx,
-      payload?.actor ?? ctx.context?.agentId ?? "webui"
-    )
+    activityContext(ctx, payload?.actor ?? ctx.context?.agentId ?? "webui")
   );
   board ? ok(ws, type, board) : fail(ws, type, "Board or task not found");
 }
 
-// src/server/kanban-route-pagination.ts
-function paginateKanbanBoards(boards, input) {
-  const pageSize = Math.min(100, Math.max(1, Math.floor(input.pageSize)));
-  const activeSessionIds = new Set(input.activeSessionIds ?? []);
-  const isActive = (board) => board.presence?.some((entry) => entry.active) === true || board.tags?.some((tag) => tag.startsWith("session:") && activeSessionIds.has(tag.slice(8))) === true;
-  const sorted = [...boards].sort((left, right) => {
-    const activityOrder = Number(isActive(right)) - Number(isActive(left));
-    return activityOrder || right.updatedAt.localeCompare(left.updatedAt);
-  });
-  const activeTotal = sorted.filter(isActive).length;
-  const total = sorted.length;
-  const totalPages = Math.max(1, Math.ceil(total / pageSize));
-  const requestedPage = Number.isFinite(input.page) ? Math.floor(input.page) : 1;
-  const page = Math.min(totalPages, Math.max(1, requestedPage));
-  const start = (page - 1) * pageSize;
-  return {
-    items: sorted.slice(start, start + pageSize),
-    total,
-    page,
-    pageSize,
-    totalPages,
-    activeTotal,
-    orphanedTotal: total - activeTotal
-  };
-}
-
 // src/server/kanban-routes.ts
 async function handleKanbanRoute(ws, msg, ctx) {
   if (!msg.type.startsWith("kanban.")) return false;
@@ -11074,6 +11247,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           fail(ws, type, `Board not found: ${boardId}`);
           return true;
         }
+        if (ctx.supervisor) {
+          const snapshots = await ctx.supervisor.auditNow(boardId);
+          const snapshot = snapshots[0];
+          if (snapshot) {
+            ok(ws, type, snapshot);
+            return true;
+          }
+        }
         const reconciled = await reconcileKanbanBoard(ctx.projectRoot, boardId);
         let health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
         const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments(ctx.projectRoot, boardId, {
@@ -11784,7 +11965,9 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
     projectRoot,
     async (event) => {
       const family = event.event?.split(".")[0];
-      if (family !== "board" && family !== "task" && family !== "column") return;
+      if (family !== "board" && family !== "task" && family !== "column" && family !== "contract") {
+        return;
+      }
       const evData = event.data;
       const boardId = evData?.boardId;
       if (!boardId) return;
@@ -11833,6 +12016,15 @@ function createShutdown(res) {
       } catch {
       }
     }
+    if (res.onPreShutdown) {
+      try {
+        await res.onPreShutdown();
+      } catch (e) {
+        log(
+          `[WebUI] Error during pre-shutdown cleanup: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
     for (const server of res.servers) server?.close();
     if (res.onShutdown) {
       try {
@@ -13087,14 +13279,17 @@ async function handleSageForFile(ws, msg, memoryStore) {
     send(ws, { type: "memory.sage.forFile", payload: { error: "filePath is required" } });
     return;
   }
+  const includeSuperseded = typeof payload["showSuperseded"] === "boolean" ? payload["showSuperseded"] : typeof payload["includeSuperseded"] === "boolean" ? payload["includeSuperseded"] : void 0;
+  const includeDeleted = payload["showDeleted"] === true || payload["includeDeleted"] === true;
   try {
     const response = await Sage.findMemoriesForFile(filePath, {
       ...typeof payload["lineStart"] === "number" ? { lineStart: payload["lineStart"] } : {},
       ...typeof payload["lineEnd"] === "number" ? { lineEnd: payload["lineEnd"] } : {},
       ...typeof payload["limit"] === "number" ? { limit: payload["limit"] } : {},
-      ...payload["includeDeleted"] === true ? { includeDeleted: true } : {}
+      ...includeSuperseded !== void 0 ? { includeSuperseded } : {},
+      ...includeDeleted ? { includeDeleted: true } : {}
     });
-    send(ws, { type: "memory.sage.forFile", payload: response });
+    send(ws, { type: "memory.sage.forFile", payload: { response } });
   } catch (err) {
     send(ws, { type: "memory.sage.forFile", payload: { error: errMessage(err) } });
   }
@@ -13747,6 +13942,324 @@ async function handleBrainAsk(ctx, ws, question) {
   }
 }
 
+// src/server/kanban-supervisor.ts
+import {
+  finalizeTaskCompletion,
+  getBoard as getBoard2,
+  getKanbanQueueHealth as getKanbanQueueHealth2,
+  listBoards as listBoards3,
+  reconcileKanbanBoard as reconcileKanbanBoard2,
+  recoverStaleTaskAssignments as recoverStaleTaskAssignments2,
+  resolveGateEnforcement
+} from "@wrongstack/kanban";
+function resolveProjectRoot(deps2) {
+  const root = deps2.projectRoot;
+  return typeof root === "function" ? root() : root;
+}
+var DEFAULT_INTERVAL_MS = 1e4;
+var MIN_INTERVAL_MS = 2e3;
+var DEFAULT_AGENT_COOLDOWN_MS = 5 * 6e4;
+var DEFAULT_CONFIG = {
+  enabled: true,
+  mode: "deterministic",
+  intervalMs: DEFAULT_INTERVAL_MS,
+  recoveryMode: "auto"
+};
+function createKanbanSupervisor(deps2) {
+  const snapshots = /* @__PURE__ */ new Map();
+  const nextDue = /* @__PURE__ */ new Map();
+  const agentLastRun = /* @__PURE__ */ new Map();
+  const agentRunning = /* @__PURE__ */ new Set();
+  let disposed = false;
+  let nextTimer;
+  const forgetBoard = (boardId) => {
+    snapshots.delete(boardId);
+    nextDue.delete(boardId);
+    agentLastRun.delete(boardId);
+    agentRunning.delete(boardId);
+  };
+  const pruneAbsentBoards = (presentBoardIds) => {
+    for (const boardId of snapshots.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of nextDue.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of agentLastRun.keys()) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+    for (const boardId of agentRunning) {
+      if (!presentBoardIds.has(boardId)) forgetBoard(boardId);
+    }
+  };
+  const publish = (snapshot) => {
+    snapshots.set(snapshot.boardId, snapshot);
+    deps2.broadcast({
+      type: "kanban.supervisor.status",
+      payload: { success: true, data: snapshot }
+    });
+  };
+  const auditBoard = async (board) => {
+    const config = effectiveConfig(board);
+    const auditedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const intervalMs = Math.max(MIN_INTERVAL_MS, config.intervalMs ?? DEFAULT_INTERVAL_MS);
+    const nextAuditAt = new Date(Date.now() + intervalMs).toISOString();
+    nextDue.set(board.id, Date.now() + intervalMs);
+    if (!config.enabled) {
+      const snapshot2 = {
+        boardId: board.id,
+        status: "disabled",
+        mode: config.mode,
+        lastAuditAt: auditedAt,
+        nextAuditAt,
+        reconciledTaskIds: [],
+        staleRecoveredTaskIds: [],
+        anomalyCount: 0,
+        summary: "Supervision is disabled for this board."
+      };
+      publish(snapshot2);
+      return snapshot2;
+    }
+    const reconciled = await reconcileKanbanBoard2(resolveProjectRoot(deps2), board.id);
+    const gateSwept = await sweepGateParkedTasks(deps2, reconciled?.board ?? board);
+    let health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
+    const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments2(resolveProjectRoot(deps2), board.id, {
+      mode: config.recoveryMode ?? "auto",
+      reason: "Kanban supervisor found an expired worker lease."
+    }) : null;
+    if (recovered)
+      health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
+    const anomalyCount = countAnomalies(health);
+    const snapshot = {
+      boardId: board.id,
+      status: anomalyCount > 0 ? "attention" : "healthy",
+      mode: config.mode,
+      lastAuditAt: auditedAt,
+      nextAuditAt,
+      reconciledTaskIds: reconciled?.tasks.map((task) => task.id) ?? [],
+      staleRecoveredTaskIds: recovered?.tasks.map((task) => task.id) ?? [],
+      anomalyCount,
+      summary: healthSummary(health)
+    };
+    publish(snapshot);
+    const changedBoard = recovered?.board ?? gateSwept ?? reconciled?.board;
+    if (changedBoard) {
+      await publishKanbanBoard(
+        deps2.broadcast,
+        changedBoard,
+        () => listBoards3(resolveProjectRoot(deps2))
+      );
+    }
+    if (config.mode === "agentic" && anomalyCount > 0) {
+      await maybeRunAgent(board, config, health, snapshot);
+    }
+    return snapshots.get(board.id) ?? snapshot;
+  };
+  const maybeRunAgent = async (board, config, health, snapshot) => {
+    if (!deps2.dispatchTask || agentRunning.has(board.id)) return;
+    const cooldownMs = Math.max(
+      MIN_INTERVAL_MS,
+      config.agentCooldownMs ?? DEFAULT_AGENT_COOLDOWN_MS
+    );
+    if (Date.now() - (agentLastRun.get(board.id) ?? 0) < cooldownMs) return;
+    agentRunning.add(board.id);
+    agentLastRun.set(board.id, Date.now());
+    const watchdog = setTimeout(
+      () => agentRunning.delete(board.id),
+      Math.max(cooldownMs * 2, DEFAULT_AGENT_COOLDOWN_MS * 2)
+    );
+    watchdog.unref?.();
+    publish({
+      ...snapshot,
+      status: "running",
+      lastAgentRunAt: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: `Agentic anomaly review started. ${snapshot.summary ?? ""}`.trim()
+    });
+    const routing = config.routing ?? { mode: "session" };
+    try {
+      const spawnSummary = await deps2.dispatchTask(buildAuditPrompt(board, health), {
+        ...dispatchRoute(routing),
+        ...config.skills?.length ? { skills: config.skills } : {},
+        name: `kanban-supervisor-${board.id.slice(0, 6)}`,
+        // Carry the board identity into the spawned TaskSpec.context so the
+        // tool-runtime boundary gate (`evaluateToolKanbanBoundary`) can resolve
+        // the live board policy instead of failing open. Whole-board agentic
+        // runs have no taskId, so only boardId is propagated.
+        context: { kanban: { boardId: board.id, projectRoot: resolveProjectRoot(deps2) } },
+        onDone: async (result) => {
+          clearTimeout(watchdog);
+          agentRunning.delete(board.id);
+          if (await getBoard2(resolveProjectRoot(deps2), board.id) === null) return;
+          const current3 = snapshots.get(board.id) ?? snapshot;
+          publish({
+            ...current3,
+            status: result.status === "failed" ? "error" : current3.anomalyCount ? "attention" : "healthy",
+            lastAgentRunAt: (/* @__PURE__ */ new Date()).toISOString(),
+            summary: result.result ?? current3.summary,
+            ...result.error ? { error: result.error } : {}
+          });
+        }
+      });
+      const current2 = snapshots.get(board.id) ?? snapshot;
+      publish({ ...current2, status: "running", summary: spawnSummary });
+    } catch (error2) {
+      clearTimeout(watchdog);
+      agentRunning.delete(board.id);
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      deps2.log?.(`[KanbanSupervisor] ${board.id}: ${message}`);
+      publish({ ...snapshot, status: "error", error: message });
+    }
+  };
+  const auditNow = async (boardId) => {
+    let boards;
+    if (boardId) {
+      const board = await getBoard2(resolveProjectRoot(deps2), boardId);
+      if (board === null) {
+        forgetBoard(boardId);
+        boards = [];
+      } else {
+        boards = [board];
+      }
+    } else {
+      const summaries = await listBoards3(resolveProjectRoot(deps2));
+      pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
+      boards = (await Promise.all(
+        summaries.map((summary) => getBoard2(resolveProjectRoot(deps2), summary.id))
+      )).filter((board) => Boolean(board));
+    }
+    const results = [];
+    for (const board of boards) results.push(await auditBoard(board));
+    scheduleNext();
+    return results;
+  };
+  const scheduleNext = () => {
+    if (disposed) return;
+    if (nextTimer !== void 0) {
+      clearTimeout(nextTimer);
+      nextTimer = void 0;
+    }
+    const now = Date.now();
+    let minDue = Infinity;
+    for (const due of nextDue.values()) {
+      if (due < minDue) minDue = due;
+    }
+    if (!Number.isFinite(minDue) || minDue <= now) {
+      nextTimer = setTimeout(() => void tick(), MIN_INTERVAL_MS);
+      nextTimer.unref?.();
+      return;
+    }
+    const delay = Math.min(minDue - now, DEFAULT_INTERVAL_MS);
+    if (delay <= 0) {
+      nextTimer = setTimeout(() => void tick(), MIN_INTERVAL_MS);
+    } else {
+      nextTimer = setTimeout(() => void tick(), delay);
+    }
+    nextTimer.unref?.();
+  };
+  const tick = async () => {
+    if (disposed) return;
+    try {
+      const now = Date.now();
+      const summaries = await listBoards3(resolveProjectRoot(deps2));
+      pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
+      for (const summary of summaries) {
+        if ((nextDue.get(summary.id) ?? 0) > now) continue;
+        const board = await getBoard2(resolveProjectRoot(deps2), summary.id);
+        if (board) await auditBoard(board);
+      }
+    } catch (error2) {
+      deps2.log?.(`[KanbanSupervisor] ${error2 instanceof Error ? error2.message : String(error2)}`);
+    } finally {
+      scheduleNext();
+    }
+  };
+  void scheduleNext();
+  return {
+    getSnapshot: (boardId) => snapshots.get(boardId),
+    auditNow,
+    getStats: () => ({
+      snapshots: snapshots.size,
+      scheduledBoards: nextDue.size,
+      agentCooldowns: agentLastRun.size,
+      runningAgents: agentRunning.size
+    }),
+    dispose() {
+      disposed = true;
+      if (nextTimer !== void 0) {
+        clearTimeout(nextTimer);
+        nextTimer = void 0;
+      }
+      snapshots.clear();
+      nextDue.clear();
+      agentLastRun.clear();
+      agentRunning.clear();
+    }
+  };
+}
+function effectiveConfig(board) {
+  return { ...DEFAULT_CONFIG, ...board.supervisor ?? {} };
+}
+async function sweepGateParkedTasks(deps2, board) {
+  if (resolveGateEnforcement(board) === "off") return void 0;
+  const parked = board.tasks.filter(
+    (task) => task.status === "review" && task.assignment?.status === "completed" && !task.verificationReport
+  );
+  let lastBoard;
+  for (const task of parked) {
+    try {
+      const finalized = await finalizeTaskCompletion(resolveProjectRoot(deps2), board.id, task.id, {
+        eventContext: { actor: "kanban-supervisor" }
+      });
+      if (finalized) lastBoard = finalized.board;
+    } catch (error2) {
+      deps2.log?.(
+        `[KanbanSupervisor] completion gate sweep failed for ${task.id}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+  return lastBoard;
+}
+function dispatchRoute(routing) {
+  if (routing.mode === "session") return {};
+  return {
+    ...routing.provider ? { provider: routing.provider } : {},
+    ...routing.model ? { model: routing.model } : {},
+    ...routing.fallbackProfile ? { fallbackProfile: routing.fallbackProfile } : {},
+    ...routing.fallbackModels?.length ? { fallbackModels: routing.fallbackModels } : {}
+  };
+}
+function countAnomalies(health) {
+  return health.staleAssignments.count + health.heartbeatDue.count + health.counts.failed + health.counts.blocked;
+}
+function healthSummary(health) {
+  return [
+    `${health.counts.running} running`,
+    `${health.counts.ready} ready`,
+    `${health.counts.review} review`,
+    `${health.counts.blocked} blocked`,
+    `${health.counts.failed} failed`,
+    `${health.staleAssignments.count} stale`,
+    `${health.dependencyBlocked.count} dependency-blocked`
+  ].join(" \xB7 ");
+}
+function buildAuditPrompt(board, health) {
+  const taskLines = board.tasks.map(
+    (task) => `- ${task.id}: ${task.title} [task=${task.status}; assignment=${task.assignment?.status ?? "none"}; column=${task.columnId}]`
+  );
+  return [
+    "You are the explicitly configured WrongStack Kanban supervisor.",
+    "Audit only this board. Do not implement product tasks.",
+    `Board: ${board.title} (${board.id})`,
+    `Health: ${healthSummary(health)}`,
+    "",
+    "Tasks:",
+    ...taskLines,
+    "",
+    "Use the kanban tool for corrections. Preserve manual blockers and dependencies.",
+    "Fix only demonstrable status/assignment/column drift, then report every action and remaining anomaly."
+  ].join("\n");
+}
+
 // src/server/context-meta.ts
 import { FallbackProfileManager } from "@wrongstack/core/agent";
 import { resolvePluginEnablement } from "@wrongstack/core/plugin";
@@ -16222,6 +16735,8 @@ function labelForEvent(e) {
       const count = e.messagesOmitted ?? e.messages.length;
       return `Messages replaced (${e.messagesOmitted ? "~" : ""}${count} msgs)`;
     }
+    case "messages_dropped":
+      return `Oldest ${e.count} message${e.count === 1 ? "" : "s"} evicted`;
     case "message_truncated":
       return `Message truncated: ${e.before} \u2192 ${e.after}`;
     case "file_event":
@@ -16309,6 +16824,8 @@ function detailForEvent(e) {
       return `at index ${e.index}`;
     case "messages_replaced":
       return `${e.messagesOmitted ?? e.messages.length} total`;
+    case "messages_dropped":
+      return `dropped ${e.count} from the front`;
     case "message_truncated":
       return `truncated to ${e.after} tokens`;
     case "mode_changed":
@@ -16526,7 +17043,7 @@ function createSessionHandlers(ctx) {
     const current2 = ctx.getSession();
     if (current2 !== next) {
       try {
-        ctx.abortActiveRun?.();
+        ctx.abortActiveRun?.(current2.id);
       } catch {
       }
       await finalizeSession(current2);
@@ -17059,85 +17576,51 @@ function createSessionHandlers(ctx) {
 // src/server/agent-roster-handlers.ts
 import {
   applyProjectAgentConfig,
-  buildConsolidationInstruction,
   captureLearnedFromAgentOutputDetailed,
   clearProjectAgentConsolidated,
+  clearProjectSkillAugmentation,
   createProjectAgent,
   detectLearnedConflicts,
+  evaluateAutoOptimize,
   FLEET_ROSTER,
   getProjectAgentLearnStats,
   isConsolidated,
   listProjectAgentLearnedEntries,
   listProjectAgentRoles,
+  listProjectSkillAugmentations,
   loadConsolidationMetadata,
   loadProjectAgentConfig,
   loadProjectAgentConsolidated,
   loadProjectAgentIdentity,
   loadProjectAgentLearned,
   loadProjectAgentProfile,
+  loadProjectSkillAugmentation,
+  loadSkillAffinity,
+  optimizeProjectAgentLearning,
+  readRawLearnedEntries,
   resetProjectAgentIdentity,
+  resolveAutoOptimizePolicy,
+  resolveRoleSkillCandidates,
   saveProjectAgentConsolidated,
+  saveProjectSkillAugmentation,
+  setSkillPinned,
   slugifyProjectAgentRole,
   updateProjectAgentConfig,
   updateProjectAgentIdentity,
   updateProjectAgentLearned,
   updateProjectAgentLearningPolicy
 } from "@wrongstack/core/coordination";
-import { isTextBlock } from "@wrongstack/core/types";
-var CONSOLIDATION_MAX_TOKENS = 8e3;
-var CONSOLIDATION_TIMEOUT_MS = 12e4;
 var AgentRosterWSHandler = class {
   getProjectRoot;
   getLlm;
   broadcast;
+  getAutoOptimizeSettings;
   constructor(opts) {
     this.getProjectRoot = typeof opts.projectRoot === "function" ? opts.projectRoot : () => opts.projectRoot;
     this.getLlm = opts.getLlm ?? (() => void 0);
     this.broadcast = opts.broadcast ?? (() => {
     });
-  }
-  /**
-   * Run the consolidation LLM synthesis headlessly and return the cleaned
-   * document text. Returns undefined when no LLM is available so the caller
-   * can fall back to the instruction-only path.
-   */
-  async synthesizeConsolidation(instruction) {
-    const llm = this.getLlm();
-    if (!llm) return void 0;
-    const req = {
-      model: llm.model,
-      system: [
-        {
-          type: "text",
-          text: "You are a precise technical editor. You consolidate an AI agent role's captured learning entries into a single, durable, role-scoped instruction document. Output ONLY the consolidated markdown document \u2014 no preamble, no code fences, no commentary about the consolidation process."
-        }
-      ],
-      messages: [{ role: "user", content: instruction }],
-      maxTokens: CONSOLIDATION_MAX_TOKENS
-    };
-    const timer = new AbortController();
-    let timedOut = false;
-    const to = setTimeout(() => {
-      timedOut = true;
-      timer.abort(new Error("consolidation timeout"));
-    }, CONSOLIDATION_TIMEOUT_MS);
-    to.unref();
-    try {
-      const res = await llm.provider.complete(req, { signal: timer.signal });
-      const text = res.content.filter(isTextBlock).map((block) => block.text).join("\n").trim();
-      const wholeDocFence = /^```(?:markdown|md)?[^\n]*\n([\s\S]*?)\n?```\s*$/i;
-      const wrapped = wholeDocFence.exec(text);
-      const inner = wrapped?.[1];
-      const unfenced = inner !== void 0 ? inner.trim() : text;
-      return { content: unfenced, model: llm.model };
-    } catch (err) {
-      if (timedOut) {
-        throw new Error(`consolidation timed out after ${CONSOLIDATION_TIMEOUT_MS}ms`);
-      }
-      throw err;
-    } finally {
-      clearTimeout(to);
-    }
+    this.getAutoOptimizeSettings = opts.getAutoOptimizeSettings;
   }
   /** Handle an incoming client message. Returns a response payload. */
   async handleMessage(_ws, type, payload) {
@@ -17342,70 +17825,47 @@ ${String(p.content ?? "")}`;
         const conflicts = detectLearnedConflicts(projectRoot);
         return { type, payload: { conflicts } };
       }
-      // ── Consolidate learned entries (headless LLM synthesis) ──────────
-      // Runs the whole optimization on the server: read raw entries →
-      // synthesize with the active model → write consolidated.md +
-      // consolidation.json. No chat round-trip. When no LLM is available the
-      // handler degrades to returning the instruction so a caller (e.g. the
-      // chat agent) can still perform the consolidation manually.
-      case "agent-roster.consolidate": {
+      // ── Optimize: distil captures into skill addenda + a consolidated doc,
+      // then archive and reset the raw buffer. Shared implementation with the
+      // CLI (`optimizeProjectAgentLearning`) so both surfaces persist the same
+      // artifacts instead of the CLI producing markdown nobody saved.
+      case "agent-roster.consolidate":
+      case "agent-roster.optimize": {
         if (!role) return { type, payload: { error: "role required" } };
-        const { instruction, rawEntries, hasExistingConsolidation } = buildConsolidationInstruction(role, projectRoot);
-        if (rawEntries.length === 0) {
+        const hasExistingConsolidation = isConsolidated(role, projectRoot);
+        const pending = readRawLearnedEntries(role, projectRoot);
+        if (pending.length === 0) {
           return {
             type: "agent-roster.consolidate",
             payload: {
               role,
               consolidated: false,
               rawEntryCount: 0,
+              skills: [],
               hasExistingConsolidation,
               currentStats: getProjectAgentLearnStats(role, projectRoot)
             }
           };
         }
-        let synth;
-        try {
-          synth = await this.synthesizeConsolidation(instruction);
-        } catch (err) {
-          return {
-            type: "agent-roster.consolidate",
-            payload: {
-              role,
-              consolidated: false,
-              rawEntryCount: rawEntries.length,
-              hasExistingConsolidation,
-              currentStats: getProjectAgentLearnStats(role, projectRoot),
-              error: err instanceof Error ? err.message : "consolidation failed"
-            }
-          };
-        }
-        if (synth && synth.content.length > 0) {
-          let stats;
-          let metadata;
-          try {
-            saveProjectAgentConsolidated(role, synth.content, projectRoot, {
-              trigger: "manual",
-              model: synth.model
-            });
-            stats = getProjectAgentLearnStats(role, projectRoot);
-            metadata = loadConsolidationMetadata(role, projectRoot);
-          } catch (err) {
-            return {
-              type: "agent-roster.consolidate",
-              payload: {
-                role,
-                consolidated: false,
-                rawEntryCount: rawEntries.length,
-                hasExistingConsolidation,
-                currentStats: getProjectAgentLearnStats(role, projectRoot),
-                error: err instanceof Error ? err.message : "failed to persist consolidation"
-              }
-            };
-          }
+        const llm = this.getLlm();
+        const result = await optimizeProjectAgentLearning(role, projectRoot, {
+          ...llm ? { llm } : {},
+          trigger: "manual"
+        });
+        const currentStats = getProjectAgentLearnStats(role, projectRoot);
+        const metadata = loadConsolidationMetadata(role, projectRoot);
+        const basePayload = {
+          role,
+          rawEntryCount: result.rawEntryCount,
+          skills: result.skills,
+          hasExistingConsolidation,
+          currentStats
+        };
+        if (result.status === "optimized") {
           try {
             this.broadcast({
               type: "agent-roster.updated",
-              payload: { role, reason: "consolidated", currentStats: stats, metadata }
+              payload: { role, reason: "consolidated", currentStats, metadata }
             });
           } catch (e) {
             console.warn(
@@ -17421,44 +17881,101 @@ ${String(p.content ?? "")}`;
           return {
             type: "agent-roster.consolidate",
             payload: {
-              role,
+              ...basePayload,
               consolidated: true,
-              rawEntryCount: rawEntries.length,
-              content: synth.content,
-              model: synth.model,
-              currentStats: stats,
+              content: result.content,
+              model: result.model,
+              pruned: result.pruned,
               metadata
             }
           };
         }
-        if (synth) {
-          return {
-            type: "agent-roster.consolidate",
-            payload: {
-              role,
-              consolidated: false,
-              emptySynthesis: true,
-              model: synth.model,
-              rawEntryCount: rawEntries.length,
-              hasExistingConsolidation,
-              currentStats: getProjectAgentLearnStats(role, projectRoot)
-            }
-          };
-        }
         return {
           type: "agent-roster.consolidate",
           payload: {
-            role,
+            ...basePayload,
             consolidated: false,
-            instruction,
-            rawEntryCount: rawEntries.length,
-            hasExistingConsolidation,
-            currentStats: getProjectAgentLearnStats(role, projectRoot),
-            // Instruction for the leader agent to execute the consolidation
-            leaderInstruction: `Optimize what the "${role}" agent has learned. Read its raw learned entries, synthesize them into a single narrowly-scoped document preserving every fact, and save the result. The instruction text contains the full details and raw entries.`
+            ...result.status === "empty-synthesis" ? { emptySynthesis: true, model: result.model } : {},
+            ...result.status === "failed" ? { error: result.error } : {},
+            ...result.status === "no-llm" ? {
+              instruction: result.instruction,
+              leaderInstruction: `Optimize what the "${role}" agent has learned. Read its raw learned entries, synthesize them into a single narrowly-scoped document preserving every fact, and save the result. The instruction text contains the full details and raw entries.`
+            } : {}
+          }
+        };
+      }
+      // ── Automatic-optimization status ─────────────────────────────────
+      // Read-only: says whether the background scheduler considers each role
+      // eligible right now, and why not when it does not. Surfacing the reason
+      // is what keeps "nothing happened" from looking like a broken feature.
+      case "agent-roster.auto-optimize-status": {
+        const policy = resolveAutoOptimizePolicy(
+          this.getAutoOptimizeSettings?.() ?? void 0
+        );
+        const roles = role ? [role] : listProjectAgentRoles(projectRoot);
+        return {
+          type,
+          payload: {
+            policy,
+            roles: roles.map((current2) => {
+              try {
+                const decision = evaluateAutoOptimize(current2, projectRoot, policy);
+                return { role: current2, ...decision };
+              } catch {
+                return { role: current2, eligible: false, reason: "disabled" };
+              }
+            })
           }
         };
       }
+      // ── Skill layer: what this project has developed for each role skill ──
+      case "agent-roster.skills": {
+        if (!role) return { type, payload: { error: "role required" } };
+        const candidates = resolveRoleSkillCandidates(role, projectRoot);
+        const developed = listProjectSkillAugmentations(role, projectRoot);
+        const affinity = loadSkillAffinity(role, projectRoot);
+        return {
+          type,
+          payload: {
+            role,
+            skills: candidates.map((skill) => ({
+              skill,
+              developed: developed.includes(skill),
+              affinity: affinity.entries[skill] ?? null
+            }))
+          }
+        };
+      }
+      case "agent-roster.read-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill) return { type, payload: { error: "role and skill required" } };
+        return {
+          type,
+          payload: { role, skill, content: loadProjectSkillAugmentation(role, skill, projectRoot) }
+        };
+      }
+      case "agent-roster.save-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill || typeof p.content !== "string") {
+          return { type, payload: { error: "role, skill and content required" } };
+        }
+        const savedPath = saveProjectSkillAugmentation(role, skill, p.content, projectRoot);
+        return { type, payload: { role, skill, path: savedPath, success: true } };
+      }
+      case "agent-roster.clear-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role) return { type, payload: { error: "role required" } };
+        clearProjectSkillAugmentation(role, skill || void 0, projectRoot);
+        return { type, payload: { role, skill: skill || null, success: true } };
+      }
+      case "agent-roster.pin-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill || typeof p.pinned !== "boolean") {
+          return { type, payload: { error: "role, skill and boolean pinned required" } };
+        }
+        const affinity = setSkillPinned(role, skill, p.pinned, projectRoot);
+        return { type, payload: { role, skill, pinned: p.pinned, affinity, success: true } };
+      }
       // ── Save consolidated document ────────────────────────────────────
       case "agent-roster.save-consolidated": {
         if (!role || typeof p.content !== "string") {
@@ -18211,7 +18728,7 @@ async function handleShellOpen(req, logger, options) {
 import {
   enqueueKanbanWorkflowCommand,
   kanbanWorkflowId,
-  listBoards as listBoards3,
+  listBoards as listBoards4,
   listKanbanWorkflowStates
 } from "@wrongstack/kanban";
 import {
@@ -18391,7 +18908,7 @@ var SddBoardWebSocketHandler = class {
       this.broadcast({ type: "sdd.board.snapshot", payload: null });
       if (this.lifecycle) {
         try {
-          const boards = await listBoards3(this.lifecycle.projectRoot);
+          const boards = await listBoards4(this.lifecycle.projectRoot);
           this.broadcast({
             type: "kanban.list",
             payload: { success: true, data: boards }
@@ -19093,7 +19610,6 @@ function registerSetupEventsClientStatusWriter(deps2) {
 }
 
 // src/server/setup-events-fleet-broadcaster.ts
-import { watch as fsWatch } from "node:fs";
 import * as path20 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
@@ -19102,8 +19618,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
   const disposers = [];
   const broadcastSessions = async () => {
     try {
-      const { SessionRegistry } = await import("@wrongstack/core/storage");
-      const registry = new SessionRegistry(globalRoot);
+      const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+      const registry = getSessionRegistry3(globalRoot);
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
@@ -19150,7 +19666,7 @@ function registerSetupEventsFleetBroadcaster(deps2) {
     }
   };
   onFleetBroadcaster?.(broadcastSessions);
-  let regWatchLive = false;
+  let subscriptionLive = false;
   let statusTimer;
   const scheduleStatusPoll = () => {
     if (isDisposed()) return;
@@ -19159,35 +19675,31 @@ function registerSetupEventsFleetBroadcaster(deps2) {
         void broadcastSessions();
         scheduleStatusPoll();
       },
-      regWatchLive ? 3e4 : 5e3
+      subscriptionLive ? 3e4 : 5e3
     );
     if (statusTimer.unref) statusTimer.unref();
   };
   disposers.push(() => {
     if (statusTimer) clearTimeout(statusTimer);
   });
-  let regDebounce;
-  try {
-    const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
-      const name2 = filename ? String(filename) : "";
-      if (!name2.startsWith("session-registry.json") || name2.endsWith(".lock")) return;
-      if (regDebounce) clearTimeout(regDebounce);
-      regDebounce = setTimeout(() => void broadcastSessions(), 150);
-    });
-    regWatcher.on("error", () => {
-      regWatchLive = false;
-      try {
-        regWatcher.close();
-      } catch {
-      }
-    });
-    regWatchLive = true;
-    disposers.push(() => {
-      if (regDebounce) clearTimeout(regDebounce);
-      regWatcher.close();
-    });
-  } catch {
-  }
+  let eventDebounce;
+  let unsubscribe;
+  void import("@wrongstack/core/storage").then(async ({ getSessionRegistry: getSessionRegistry3 }) => {
+    const registry = getSessionRegistry3(globalRoot);
+    const projectSlug2 = wpaths?.projectSlug;
+    if (!projectSlug2 || isDisposed()) return;
+    unsubscribe = await registry.subscribeProject(projectSlug2, context.projectRoot, () => {
+      if (eventDebounce) clearTimeout(eventDebounce);
+      eventDebounce = setTimeout(() => void broadcastSessions(), 25);
+    });
+    subscriptionLive = true;
+  }).catch(() => {
+    subscriptionLive = false;
+  });
+  disposers.push(() => {
+    if (eventDebounce) clearTimeout(eventDebounce);
+    void unsubscribe?.();
+  });
   scheduleStatusPoll();
   void broadcastSessions();
   return () => {
@@ -19300,7 +19812,7 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 }
 
 // src/server/setup-events-status-watcher.ts
-import { watch as fsWatch2 } from "node:fs";
+import { watch as fsWatch } from "node:fs";
 import * as fs18 from "node:fs/promises";
 import * as path22 from "node:path";
 
@@ -19390,7 +19902,7 @@ function registerSetupEventsStatusWatcher(deps2) {
     try {
       await fs18.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
-      watcher = fsWatch2(
+      watcher = fsWatch(
         projectsDir,
         { persistent: true, recursive: true },
         async (eventType, filename) => {
@@ -20552,7 +21064,6 @@ import {
   mailboxSessionTag,
   ObservableBrainArbiter as ObservableBrainArbiterCtor
 } from "@wrongstack/core/coordination";
-import { DEFAULT_TOOLS_CONFIG } from "@wrongstack/core/types";
 import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import {
   AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
@@ -20564,6 +21075,7 @@ import {
 import { TOKENS } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
 import {
+  DEFAULT_TOOLS_CONFIG,
   resolveContextWindowPolicy as resolveContextWindowPolicy2
 } from "@wrongstack/core/types";
 import {
@@ -21445,6 +21957,11 @@ async function createAgentServices(input) {
           taskAware: config.Sage?.inject?.taskAware,
           minScore: config.Sage?.inject?.minScore,
           minImportance: config.Sage?.inject?.minImportance,
+          // Forward the explicit relation floor so an operator-configured
+          // `Sage.inject.relationFloor` is honored in WebUI sessions. Without
+          // this we silently fall back to MIN_RELATION_STRENGTH (0.85), which
+          // is the CLI default but masks operator overrides.
+          relationFloor: config.Sage?.inject?.relationFloor,
           repeatCooldownMs: config.Sage?.inject?.repeatCooldownMs,
           verifyOnMutation: config.Sage?.hygiene?.autoOnFileChange,
           triggers: config.Sage?.inject?.triggers,
@@ -21466,6 +21983,10 @@ async function createAgentServices(input) {
           maxMemories: config.Sage?.inject?.maxTurnMemories,
           maxChars: config.Sage?.inject?.maxCharsPerTurn,
           minScore: config.Sage?.inject?.minScore,
+          // CLI parity: honor `Sage.retrieval.metadataWeight` so the same config
+          // value drives both runtimes instead of silently falling back to the
+          // 0.3 default. The undefined case keeps the middleware's own default.
+          metadataWeight: config.Sage?.retrieval?.metadataWeight,
           getSessionId: getSageSessionId,
           tracker: sageInjectionTracker
         })
@@ -21490,25 +22011,29 @@ async function createAgentServices(input) {
     strategy: config.context?.strategy,
     preserveK: config.context?.preserveK ?? 10,
     eliseThreshold: config.context?.eliseThreshold ?? 2e3,
+    // Match the CLI/TUI runtime: keep corrections, errors and decisions
+    // verbatim while collapsing routine assistant chatter/tool protocol.
+    // Without this WebUI's hybrid strategy builds an ever-growing lossless
+    // digest and eventually relies on blunt emergency head/tail trimming.
+    smart: true,
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
   const initialContextPolicy = resolveContextWindowPolicy2(config.context);
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
-    let effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
-    if (!effectiveMaxContext) {
-      try {
-        const m = await resolveProviderModelMetadata(
-          modelsRegistry,
-          config.provider,
-          context.model,
-          config.providers?.[config.provider]
-        );
-        effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
-      } catch {
-      }
+    let effectiveMaxContext = 0;
+    try {
+      const m = await resolveProviderModelMetadata(
+        modelsRegistry,
+        config.provider,
+        context.model,
+        config.providers?.[config.provider]
+      );
+      effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
+    } catch {
     }
+    if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
     if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
     autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
@@ -22029,6 +22554,7 @@ async function setupWebUiGovernance(input, dependencies = DEFAULT_DEPENDENCIES)
 
 // src/server/message-dispatcher.ts
 import path23 from "node:path";
+import { planTool, taskTool, todoTool } from "@wrongstack/tools";
 function createMessageDispatcher(opts) {
   const { state, deps: deps2, routes, promptsCtx, codebaseIndexing, runLock, pendingConfirms } = opts;
   function makeWorklistContext() {
@@ -22040,7 +22566,20 @@ function createMessageDispatcher(opts) {
       },
       send: (w, m) => send(w, m),
       broadcast: (m) => broadcast(state.getClients(), m),
-      replaceTodos: (todos) => deps2.context.state.replaceTodos(todos)
+      replaceTodos: (todos) => deps2.context.state.replaceTodos(todos),
+      mutateTodos: async (todos) => {
+        const result = await todoTool.execute({ todos }, deps2.context, {
+          signal: AbortSignal.timeout(3e4)
+        });
+        return {
+          todos: [...deps2.context.todos],
+          ...result.kanban_warnings ? { warnings: result.kanban_warnings } : {}
+        };
+      },
+      mutateTaskStatus: async (id, status) => taskTool.execute({ action: "status", id, status }, deps2.context, {
+        signal: AbortSignal.timeout(3e4)
+      }),
+      mutatePlan: async (operation) => planTool.execute(operation, deps2.context, { signal: AbortSignal.timeout(3e4) })
     };
   }
   function makeSkillsContext() {
@@ -22130,16 +22669,24 @@ function createMessageDispatcher(opts) {
     getAgent: () => deps2.agent,
     getSessionId: () => state.getSession().id,
     runControl: {
-      begin: () => {
+      begin: (_ws, sessionId) => {
         if (runLock.get()) return void 0;
         const controller = new AbortController();
         runLock.set(controller);
+        runLock.setSession(sessionId);
         return controller;
       },
-      end: (_ws, controller) => {
-        if (runLock.get() === controller) runLock.set(null);
+      end: (_ws, _sessionId, controller) => {
+        if (runLock.get() === controller) {
+          runLock.set(null);
+          runLock.setSession(null);
+        }
       },
-      abort: () => runLock.get()?.abort()
+      abort: (_ws, sessionId) => {
+        if (runLock.getSession() === sessionId || !runLock.getSession()) {
+          runLock.get()?.abort();
+        }
+      }
     },
     pendingConfirms,
     send,
@@ -22161,10 +22708,20 @@ function createMessageDispatcher(opts) {
   const goalSnapshotRoutes = {
     getSnapshot: () => handleGoalGet(state.getProjectRoot(), (message) => broadcast(state.getClients(), message))
   };
+  const kanbanSupervisor = createKanbanSupervisor({
+    projectRoot: () => state.getProjectRoot(),
+    broadcast: (message) => broadcast(state.getClients(), message),
+    log: (message) => deps2.logger.warn?.(`[KanbanSupervisor] ${message}`)
+  });
+  if (opts.onDispose) {
+    const dispose = () => kanbanSupervisor.dispose();
+    opts.onDispose(dispose);
+  }
   const kanbanContext = () => ({
     projectRoot: state.getProjectRoot(),
     context: deps2.context,
-    broadcast: (message) => broadcast(state.getClients(), message)
+    broadcast: (message) => broadcast(state.getClients(), message),
+    supervisor: kanbanSupervisor
   });
   const kanbanHostRoutes = {
     meta: async (ws) => {
@@ -22234,6 +22791,7 @@ function createMessageDispatcher(opts) {
       agentRoster: {
         rosterHandler: new AgentRosterWSHandler({
           projectRoot: state.getProjectRoot,
+          getAutoOptimizeSettings: () => state.getConfig().fleet?.learning?.autoOptimize,
           getLlm: () => {
             const ctx = deps2.agent.ctx;
             return ctx.provider && ctx.model ? { provider: ctx.provider, model: ctx.model } : void 0;
@@ -22680,6 +23238,14 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
     transition = transition.then(async () => {
       if (stopped) return;
       if (pendingClaim?.sessionId === sessionId) {
+        await pendingClaim.claim.activate({
+          sessionId,
+          ...target,
+          clientType: "webui",
+          pid: process.pid,
+          startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          agents: statusTracker.getAgents()
+        });
         pendingClaim = void 0;
       } else {
         await register(sessionId, true, target);
@@ -22703,14 +23269,35 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
     }
     if (sessionId === activeSessionId) return async () => {
     };
-    const previousSessionId = activeSessionId;
-    const previousTarget = activeTarget;
     const token = Symbol(sessionId);
-    await register(sessionId, true, target);
-    pendingClaim = { sessionId, previousSessionId, token };
+    if ("reserveResume" in registry && typeof registry.reserveResume === "function") {
+      const reservation = await registry.reserveResume({
+        sessionId,
+        projectSlug: target.projectSlug,
+        projectRoot: target.projectRoot
+      });
+      pendingClaim = { sessionId, token, claim: reservation, target };
+    } else {
+      await register(sessionId, true, target);
+      pendingClaim = {
+        sessionId,
+        token,
+        target,
+        claim: {
+          reservation: {
+            reservationId: "legacy",
+            targetSessionId: sessionId,
+            requesterInstanceId: "legacy",
+            expiresAt: Number.MAX_SAFE_INTEGER
+          },
+          activate: async () => void 0,
+          cancel: async () => register(activeSessionId, true, activeTarget)
+        }
+      };
+    }
     return async () => {
       if (pendingClaim?.token !== token) return;
-      await register(previousSessionId, true, previousTarget);
+      await pendingClaim.claim.cancel();
       pendingClaim = void 0;
     };
   };
@@ -23415,11 +24002,11 @@ function buildRoutes(state, deps2, cb) {
 }
 
 // src/server/server-runtime.ts
-import * as path28 from "node:path";
 import { createRequire as createRequire4 } from "node:module";
+import * as path28 from "node:path";
 import { fileURLToPath } from "node:url";
-import { WebSocketServer } from "ws";
 import { toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils";
+import { WebSocketServer } from "ws";
 async function resolvePorts(opts) {
   const surface = opts.surface ?? "webui";
   const surfaceDefaults = surface === "simpleui" ? { http: 3466 } : { http: 3456 };
@@ -23637,10 +24224,11 @@ function startHttpServer(opts) {
   return httpServer;
 }
 function registerShutdown(deps2) {
-  registerShutdownHandlers({
+  return registerShutdownHandlers({
     flushSession: deps2.flushSession,
     clients: deps2.clients,
     servers: deps2.servers,
+    onPreShutdown: deps2.onPreShutdown,
     onShutdown: deps2.onShutdown
   });
 }
@@ -23955,10 +24543,15 @@ async function startWebUI(opts = {}) {
     );
   }
   let _runLock = null;
+  let _runLockSession = null;
   const runLockControl = {
     get: () => _runLock,
     set: (ctrl) => {
       _runLock = ctrl;
+    },
+    getSession: () => _runLockSession,
+    setSession: (id) => {
+      _runLockSession = id;
     }
   };
   const pendingConfirms = /* @__PURE__ */ new Map();
@@ -24083,6 +24676,7 @@ async function startWebUI(opts = {}) {
       if (ctrl) {
         ctrl.abort();
         runLockControl.set(null);
+        runLockControl.setSession(null);
       }
     },
     isRunActive: () => runLockControl.get() !== null,
@@ -24232,6 +24826,7 @@ async function startWebUI(opts = {}) {
     })
   });
   const routes = buildRoutes(state, deps2, cb);
+  let kanbanSupervisorDispose = null;
   const handleMessage = createMessageDispatcher({
     state,
     deps: deps2,
@@ -24239,7 +24834,10 @@ async function startWebUI(opts = {}) {
     promptsCtx,
     codebaseIndexing,
     runLock: runLockControl,
-    pendingConfirms
+    pendingConfirms,
+    onDispose: (dispose) => {
+      kanbanSupervisorDispose = dispose;
+    }
   });
   const mailbox = getSharedProjectMailbox4(
     resolveProjectDir3(context.projectRoot, wstackGlobalRoot2()),
@@ -24273,7 +24871,14 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         priority: "high",
         senderSessionId: session.id
       }).catch((err) => {
-        console.warn(`[WebUI] security-rejection mailbox note failed: ${String(err)}`);
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "webui.security_rejection_mailbox_note_failed",
+            message: String(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
       });
     },
     goalHandler,
@@ -24287,7 +24892,9 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
   });
   wssPrimary.on("connection", handleConnection);
   if (wssSecondary) wssSecondary.on("connection", handleConnection);
-  registerShutdown({
+  let unregisterShutdown = () => {
+  };
+  unregisterShutdown = registerShutdown({
     flushSession: async () => {
       await session.append({
         type: "session_end",
@@ -24303,7 +24910,12 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       wssPrimary,
       ...wssSecondary ? [wssSecondary] : []
     ],
+    onPreShutdown: () => {
+      kanbanSupervisorDispose?.();
+      kanbanSupervisorDispose = null;
+    },
     onShutdown: async () => {
+      unregisterShutdown();
       await todosCheckpoint.detach();
       await stopHeapWatchdog();
       credentialWatcherClose?.();