@zhivex-ai/harness 1.3.0-rc.3 → 1.3.0

package/dist/{index-d0wrghff.js → index-8vm2m34s.js}

@@ -1,36 +1,21 @@
 import {
-  HARNESS_OPERATIONS_SCHEMA_VERSION,
-  HARNESS_SQLITE_FILE,
-  createEditProposal,
-  fileDigestSchema,
-  openHarnessPersistence,
-  sqliteAdapter,
-  withWorkspaceMutation,
-  workspaceFilePathSchema
-} from "./index-5wjwe91x.js";
-import {
-  HARNESS_SESSION_SCHEMA_VERSION,
-  SqliteDatabase,
-  TERMINAL_SESSION_RUN_STATUSES,
-  openCliSessionStore,
-  readRegularFileChunksNoFollow,
-  readRegularFileNoFollow,
-  statRegularFileNoFollow,
-  validateStateDirectory
-} from "./index-pgqz45fj.js";
+  fileDigestSchema
+} from "./index-yb239ghk.js";
 import {
   HARNESS_ERROR_CODES,
   HARNESS_ERROR_SCHEMA_VERSION,
   HarnessError,
-  HarnessStateConflictError,
-  HarnessWorkspaceError,
   PROVIDERS,
   reasoningEffortSchema
-} from "./index-fvca1xea.js";
+} from "./index-gq9xagx2.js";
+import {
+  providerDiagnostic,
+  providerDiagnosticSchema
+} from "./index-8705zxpr.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION
-} from "./index-2aymdsqc.js";
+} from "./index-qfpz5y2v.js";
 
 // src/workspace/change-envelope.ts
 import { createHash } from "node:crypto";
@@ -1000,7 +985,19 @@ var cliErrorDocumentSchema = observationalDocument({
     retryable: z2.boolean()
   })
 });
+var cliPolicyInspectionSchema = observationalDocument({
+  ...jsonBase,
+  kind: z2.literal("policy-inspection"),
+  digest: digestSchema.nullable(),
+  source: z2.enum(["operator-file", "application", "baseline"]),
+  explicitReviewRequired: z2.boolean(),
+  tools: z2.array(observationalDocument({ name: z2.string(), requiresApproval: z2.boolean() })),
+  restrictions: z2.array(observationalDocument({ ruleId: z2.string(), tools: z2.array(z2.string()), decision: z2.enum(["allow", "ask_user", "deny"]), reason: z2.string(), pathCount: nonnegativeInteger })),
+  execution: observationalDocument({ configuredBackend: z2.enum(["none", "oci"]), activeBackend: z2.enum(["none", "oci"]), evidence: z2.literal("configuration-only") }),
+  limits: observationalDocument({ maxSteps: nonnegativeInteger, timeoutMs: nonnegativeInteger, budget: jsonObjectSchema })
+});
 var cliJsonDocumentSchema = z2.union([
+  cliPolicyInspectionSchema,
   cliRunResultDocumentSchema,
   cliInitDocumentSchema,
   cliProviderDocumentSchema,
@@ -1027,6 +1024,20 @@ var runEvent = (type, shape) => observationalDocument({
   ...shape
 });
 var cliRunEventDocumentSchema = z2.discriminatedUnion("type", [
+  runEvent("policy-decision", {
+    phase: z2.enum(["approval-request", "tool-entry"]),
+    toolName: z2.string(),
+    decision: z2.enum(["allow", "ask_user", "deny"]),
+    ruleIds: z2.array(z2.string()),
+    reason: z2.string(),
+    reasonTruncated: z2.boolean(),
+    policyDigest: digestSchema.nullable(),
+    source: z2.enum(["operator-file", "application", "baseline"]),
+    approvalRequired: z2.boolean(),
+    explicitReviewRequired: z2.boolean(),
+    executionBackend: z2.enum(["none", "oci"]),
+    evidence: z2.literal("policy-evaluation")
+  }),
   runEvent("text-delta", { textDelta: z2.string() }),
   runEvent("tool-call", {
     toolCallId: z2.string().min(1),
@@ -1117,1338 +1128,127 @@ var cliJsonLineDocumentSchema = z2.union([
 var parseCliJsonDocument = (input) => cliJsonDocumentSchema.parse(input);
 var parseCliJsonLineDocument = (input) => cliJsonLineDocumentSchema.parse(typeof input === "string" ? JSON.parse(input) : input);
 
-// src/persistence/workspace-checkpoints.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
-import path from "node:path";
-import { z as z3 } from "zod";
-var fileSchema = z3.strictObject({
-  path: workspaceFilePathSchema,
-  digest: fileDigestSchema,
-  content: z3.string().max(65536),
-  mode: z3.number().int().min(0).max(511)
-}).refine((file) => Buffer.byteLength(file.content) <= 65536 && !file.content.includes("\x00") && file.digest === `sha256:${createHash2("sha256").update(file.content).digest("hex")}`, "Invalid checkpoint content identity.");
-var workspaceCheckpointSchema = z3.strictObject({
-  id: z3.string().uuid(),
-  sessionId: z3.string(),
-  turnId: z3.string(),
-  files: z3.array(fileSchema).min(1).max(20)
-});
-var workspaceRestoreOperationSchema = z3.strictObject({
-  id: z3.string().uuid(),
-  checkpoint: workspaceCheckpointSchema,
-  proposalId: fileDigestSchema,
-  expected: z3.record(z3.string(), fileDigestSchema),
-  stage: z3.enum(["prepared", "forking", "forked", "applying", "applied", "completed"]),
-  forkSessionId: z3.string().optional()
-});
-var digest = (content) => `sha256:${createHash2("sha256").update(content).digest("hex")}`;
-var openWorkspaceCheckpointStore = async (workspace, sessions) => {
-  const key = createHash2("sha256").update("workspace\x00").update(workspace.root).digest("hex");
-  if (key !== sessions.workspaceKey)
-    throw new Error("Checkpoint session store belongs to a different workspace.");
-  const before = await statRegularFileNoFollow(sessions.databasePath, { label: "Checkpoint database", requireSingleLink: true });
-  if (before.uid !== process.getuid?.() || before.mode & 63)
-    throw new Error("Checkpoint database must be private.");
-  const db = new SqliteDatabase(sessions.databasePath, { create: false });
-  const after = await statRegularFileNoFollow(sessions.databasePath, { label: "Checkpoint database", requireSingleLink: true });
-  if (before.dev !== after.dev || before.ino !== after.ino) {
-    db.close();
-    throw new Error("Checkpoint database changed.");
-  }
-  db.exec("CREATE TABLE IF NOT EXISTS zhivex_workspace_checkpoints (id TEXT PRIMARY KEY, workspace_key TEXT NOT NULL, scope_key TEXT NOT NULL, kind TEXT NOT NULL, body TEXT NOT NULL)");
-  const save = (kind, value) => {
-    const existing = db.query("SELECT id FROM zhivex_workspace_checkpoints WHERE id=?").get(value.id);
-    const count = db.query("SELECT COUNT(*) AS count FROM zhivex_workspace_checkpoints WHERE workspace_key=? AND scope_key=?").get(sessions.workspaceKey, sessions.scopeKey)?.count ?? 0;
-    if (!existing && count >= 100)
-      throw new Error("Checkpoint scope storage limit reached (100 records).");
-    const body = JSON.stringify(value);
-    if (Buffer.byteLength(body) > 2 * 1024 * 1024)
-      throw new Error("Checkpoint exceeds storage limit.");
-    db.query("INSERT INTO zhivex_workspace_checkpoints(id, workspace_key, scope_key, kind, body) VALUES (?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET body=excluded.body WHERE workspace_key=excluded.workspace_key AND scope_key=excluded.scope_key AND kind=excluded.kind").run(value.id, sessions.workspaceKey, sessions.scopeKey, kind, body);
-  };
-  const load = (kind, id) => {
-    const row = db.query("SELECT body FROM zhivex_workspace_checkpoints WHERE id=? AND workspace_key=? AND scope_key=? AND kind=?").get(id, sessions.workspaceKey, sessions.scopeKey, kind);
-    if (!row)
-      throw new Error("Unknown checkpoint or restore operation in this scope.");
-    return JSON.parse(row.body);
-  };
-  const read = async (target) => {
-    const authorized = await workspace.readFile(target, 1, 1);
-    const { contents, stat } = await readRegularFileNoFollow(path.join(workspace.root, target), {
-      label: "Checkpoint target",
-      maxBytes: 65536,
-      requireSingleLink: true
-    });
-    const content = new TextDecoder("utf-8", { fatal: true }).decode(contents);
-    if (contents.includes(0) || digest(contents) !== authorized.digest)
-      throw new Error("Checkpoint file changed while reading.");
-    return fileSchema.parse({ path: target, digest: digest(contents), content, mode: stat.mode & 511 });
-  };
-  const validateTurn = async (checkpoint) => {
-    const session = await sessions.get(checkpoint.sessionId);
-    const run = session?.runs.find((entry) => entry.turnId === checkpoint.turnId);
-    if (!session || !run || !TERMINAL_SESSION_RUN_STATUSES.includes(run.status)) {
-      throw new Error("Checkpoint requires an existing terminal conversation turn.");
-    }
-    return session;
-  };
-  const proposal = (operation) => {
-    if (new Set(operation.checkpoint.files.map((file) => file.path)).size !== operation.checkpoint.files.length || operation.checkpoint.files.some((file) => digest(file.content) !== file.digest))
-      throw new Error("Checkpoint content identity is corrupt.");
-    const changes = operation.checkpoint.files.map((file) => ({ path: file.path, expectedDigest: operation.expected[file.path], content: file.content }));
-    const result = createEditProposal({ changes });
-    if (result.proposalId !== operation.proposalId)
-      throw new Error("Restore proposal identity is corrupt.");
-    return { proposalId: result.proposalId, changes };
-  };
-  const getOperation = (id) => workspaceRestoreOperationSchema.parse(load("restore", id));
-  return {
-    close: () => db.close(),
-    getCheckpoint: (id) => workspaceCheckpointSchema.parse(load("checkpoint", id)),
-    getOperation,
-    capture: async (input) => withWorkspaceMutation(workspace.root, async () => {
-      await validateTurn(input);
-      if (input.paths.length === 0 || input.paths.length > 20 || new Set(input.paths).size !== input.paths.length)
-        throw new Error("Capture requires 1 to 20 unique existing text files.");
-      const files = [];
-      for (const target of input.paths)
-        files.push(await read(target));
-      const checkpoint = workspaceCheckpointSchema.parse({ id: randomUUID(), sessionId: input.sessionId, turnId: input.turnId, files });
-      save("checkpoint", checkpoint);
-      return checkpoint;
-    }),
-    prepareRestore: async (checkpointId, expectedCurrent) => withWorkspaceMutation(workspace.root, async () => {
-      const checkpoint = workspaceCheckpointSchema.parse(load("checkpoint", checkpointId));
-      await validateTurn(checkpoint);
-      if (Object.keys(expectedCurrent).length !== checkpoint.files.length)
-        throw new Error("Provide exact post-agent digests for every captured file.");
-      for (const file of checkpoint.files) {
-        const current = await read(file.path);
-        if (current.digest !== expectedCurrent[file.path] || current.mode !== file.mode)
-          throw new Error(`Restore conflicts with current content or mode: ${file.path}.`);
-      }
-      const changes = checkpoint.files.map((file) => ({ path: file.path, expectedDigest: expectedCurrent[file.path], content: file.content }));
-      const preview = createEditProposal({ changes });
-      const operation = workspaceRestoreOperationSchema.parse({
-        id: randomUUID(),
-        checkpoint,
-        proposalId: preview.proposalId,
-        expected: expectedCurrent,
-        stage: "prepared"
-      });
-      save("restore", operation);
-      return { operation, proposal: { ...preview, changes } };
-    }),
-    applyRestore: async (id, reviewedProposalId) => withWorkspaceMutation(workspace.root, async () => {
-      const operation = getOperation(id);
-      if (operation.proposalId !== reviewedProposalId)
-        throw new Error("Restore requires the reviewed proposal identity.");
-      const patch = proposal(operation);
-      if (operation.stage === "completed")
-        return operation;
-      if (operation.stage === "forking")
-        throw new Error(`Fork outcome uncertain. Inspect child sessions titled restore:${operation.id} and call recoverFork with the exact child ID; no files changed.`);
-      const current = [];
-      for (const file of operation.checkpoint.files) {
-        const found = await read(file.path);
-        if (found.mode !== file.mode)
-          throw new Error(`Restore mode conflict: ${file.path}.`);
-        current.push(found);
-      }
-      const beforeApply = current.every((file) => file.digest === operation.expected[file.path]);
-      const afterApply = current.every((file) => file.digest === operation.checkpoint.files.find((entry) => entry.path === file.path)?.digest);
-      if (["applying", "applied"].includes(operation.stage) && afterApply) {
-        operation.stage = "completed";
-        save("restore", operation);
-        return operation;
-      }
-      if (!beforeApply || operation.stage === "applied")
-        throw new Error("Restore conflicts with subsequent edits or a partially applied filesystem operation; manual recovery required.");
-      if (operation.stage === "prepared") {
-        const source = await validateTurn(operation.checkpoint);
-        operation.stage = "forking";
-        save("restore", operation);
-        const fork = await sessions.fork(source.sessionId, {
-          atTurnId: operation.checkpoint.turnId,
-          expectedRevision: source.revision,
-          title: `restore:${operation.id}`
-        });
-        operation.forkSessionId = fork.sessionId;
-        operation.stage = "forked";
-        save("restore", operation);
-      }
-      if (!operation.forkSessionId)
-        throw new Error("Restore has no recorded conversation fork.");
-      operation.stage = "applying";
-      save("restore", operation);
-      await workspace.applyPatchWithModes(patch, new Map(operation.checkpoint.files.map((file) => [file.path, { beforeMode: file.mode, afterMode: file.mode }])));
-      operation.stage = "applied";
-      save("restore", operation);
-      operation.stage = "completed";
-      save("restore", operation);
-      return operation;
-    }),
-    recoverFork: async (id, forkSessionId) => withWorkspaceMutation(workspace.root, async () => {
-      const operation = getOperation(id);
-      const fork = await sessions.get(forkSessionId);
-      if (operation.stage !== "forking" || !fork || fork.parentSessionId !== operation.checkpoint.sessionId || fork.forkedFromTurnId !== operation.checkpoint.turnId || fork.title !== `restore:${operation.id}`)
-        throw new Error("Fork does not match this interrupted restore.");
-      operation.forkSessionId = forkSessionId;
-      operation.stage = "forked";
-      save("restore", operation);
-      return operation;
-    })
-  };
-};
-
-// src/persistence/state-backup-stream.ts
-var MAGIC = `ZHIVEX-STATE-SEGMENTS-1
-`;
-var STRING_CHARS = 8192;
-var MAX_FRAME_BYTES = 64 * 1024;
-function* canonicalChunks(value) {
-  if (typeof value === "string") {
-    yield '"';
-    for (let i = 0;i < value.length; ) {
-      let end = Math.min(i + STRING_CHARS, value.length);
-      if (end < value.length && /[\uD800-\uDBFF]/.test(value[end - 1]))
-        end--;
-      yield JSON.stringify(value.slice(i, end)).slice(1, -1);
-      i = end;
-    }
-    yield '"';
-  } else if (value === null || typeof value !== "object") {
-    yield JSON.stringify(value);
-  } else if (Array.isArray(value)) {
-    yield "[";
-    for (let i = 0;i < value.length; i++) {
-      if (i)
-        yield ",";
-      yield* canonicalChunks(value[i]);
-    }
-    yield "]";
-  } else {
-    yield "{";
-    let first = true;
-    for (const key of Object.keys(value).sort()) {
-      if (!first)
-        yield ",";
-      first = false;
-      yield* canonicalChunks(key);
-      yield ":";
-      yield* canonicalChunks(value[key]);
-    }
-    yield "}";
-  }
-}
-function* tokens(value) {
-  if (typeof value === "string") {
-    for (let i = 0;i < value.length; i += STRING_CHARS)
-      yield ["text", value.slice(i, i + STRING_CHARS)];
-    yield ["string"];
-  } else if (value === null || typeof value !== "object")
-    yield ["value", value];
-  else {
-    yield [Array.isArray(value) ? "array" : "object"];
-    if (Array.isArray(value))
-      for (const item of value)
-        yield* tokens(item);
-    else
-      for (const [key, item] of Object.entries(value)) {
-        yield* tokens(key);
-        yield* tokens(item);
-      }
-    yield ["end"];
-  }
-}
-function* segmentedChunks(value) {
-  yield MAGIC;
-  for (const token of tokens(value))
-    yield `${JSON.stringify(token)}
-`;
-}
-async function readBackupTransport(source, legacyMaxBytes) {
-  const fail = () => {
-    throw new Error("Harness state backup segment stream is invalid or incomplete.");
-  };
-  const stack = [];
-  let root;
-  let hasRoot = false;
-  let pieces = [];
-  let pending = Buffer.alloc(0);
-  let segmented;
-  const legacy = [];
-  let legacyBytes = 0;
-  const append = (value) => {
-    const parent = stack.at(-1);
-    if (!parent) {
-      if (hasRoot)
-        fail();
-      root = value;
-      hasRoot = true;
-    } else if (Array.isArray(parent.value))
-      parent.value.push(value);
-    else if (parent.key === undefined) {
-      if (typeof value !== "string" || Object.hasOwn(parent.value, value))
-        fail();
-      parent.key = value;
-    } else {
-      Object.defineProperty(parent.value, parent.key, { value, enumerable: true, writable: true, configurable: true });
-      delete parent.key;
-    }
-  };
-  const consume = (line) => {
-    if (line.length > MAX_FRAME_BYTES)
-      fail();
-    const token = JSON.parse(line.toString("utf8"));
-    if (!Array.isArray(token))
-      fail();
-    const frame = token;
-    const [kind, value] = frame;
-    if (kind === "text" && frame.length === 2 && typeof value === "string") {
-      pieces.push(value);
-      return;
-    }
-    if (kind === "string" && frame.length === 1) {
-      append(pieces.join(""));
-      pieces = [];
-      return;
-    }
-    if (pieces.length)
-      fail();
-    if (kind === "value" && frame.length === 2 && (value === null || typeof value === "boolean" || typeof value === "number"))
-      append(value);
-    else if ((kind === "array" || kind === "object") && frame.length === 1) {
-      if (stack.length >= 512)
-        fail();
-      const value2 = kind === "array" ? [] : {};
-      append(value2);
-      stack.push({ value: value2 });
-    } else if (kind === "end" && frame.length === 1) {
-      const parent = stack.pop();
-      if (!parent || parent.key !== undefined)
-        fail();
-    } else
-      fail();
-  };
-  for await (const chunk of readRegularFileChunksNoFollow(source, {
-    label: "Harness state backup",
-    requireSingleLink: true,
-    requirePrivate: true
-  })) {
-    pending = Buffer.concat([pending, chunk]);
-    if (segmented === undefined) {
-      if (pending.length < Buffer.byteLength(MAGIC))
-        continue;
-      segmented = pending.subarray(0, MAGIC.length).toString() === MAGIC;
-      if (segmented)
-        pending = pending.subarray(MAGIC.length);
-    }
-    if (!segmented) {
-      legacyBytes += pending.length;
-      if (legacyBytes > legacyMaxBytes)
-        throw new Error("Harness state backup exceeds the legacy size limit.");
-      legacy.push(pending);
-      pending = Buffer.alloc(0);
-      continue;
-    }
-    let newline;
-    while ((newline = pending.indexOf(10)) !== -1) {
-      consume(pending.subarray(0, newline));
-      pending = pending.subarray(newline + 1);
-    }
-    if (pending.length > MAX_FRAME_BYTES)
-      fail();
-  }
-  if (!segmented) {
-    if (legacyBytes + pending.length > legacyMaxBytes)
-      throw new Error("Harness state backup exceeds the legacy size limit.");
-    return JSON.parse(Buffer.concat([...legacy, pending]).toString("utf8"));
-  }
-  if (pending.length || stack.length || pieces.length || !hasRoot)
-    fail();
-  return root;
-}
-
-// src/persistence/state-backup.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
-import { constants as fsConstants } from "node:fs";
-import { chmod, link, lstat, open, realpath, unlink } from "node:fs/promises";
-import path2 from "node:path";
-import { z as z4 } from "zod";
-import { normalizeAgentRunState } from "@zhivex-ai/agents";
-import { createSqliteAgentRunStore } from "@zhivex-ai/agents/ops";
-var HARNESS_STATE_BACKUP_SCHEMA_VERSION = 1;
-var HARNESS_STATE_BACKUP_MAX_BYTES = 64 * 1024 * 1024;
-var terminalRunStatuses = new Set(["completed", "failed", "cancelled", "timed_out"]);
-var terminalSessionStatuses = new Set(["completed", "failed", "cancelled", "timed_out"]);
-var digestSchema2 = z4.string().regex(/^sha256:[a-f0-9]{64}$/);
-var bindingKeySchema = z4.string().regex(/^[a-f0-9]{64}$/);
-var jsonRecordSchema = z4.record(z4.string(), z4.unknown());
-var durableScopeSchema = z4.object({
-  tenantId: z4.string().min(1),
-  userId: z4.string().min(1).optional(),
-  namespace: z4.string().min(1).optional()
-}).strict();
-var journalEntrySchema = z4.object({
-  runId: z4.string().min(1),
-  scope: durableScopeSchema,
-  toolCallId: z4.string().min(1),
-  toolName: z4.string().min(1),
-  status: z4.enum(["pending", "running", "completed", "failed"]),
-  idempotencyKey: z4.string().min(1),
-  revision: z4.number().int().nonnegative(),
-  input: z4.json().optional(),
-  output: z4.json().optional(),
-  error: z4.object({ message: z4.string() }).strict().optional(),
-  startedAt: z4.number().nonnegative().optional(),
-  completedAt: z4.number().nonnegative().optional(),
-  updatedAt: z4.number().nonnegative()
-}).passthrough();
-var runRecordSchema = z4.object({
-  key: z4.string().min(1).max(1024),
-  state: jsonRecordSchema,
-  updatedAt: z4.number().int().nonnegative()
-}).strict();
-var journalRecordSchema = z4.object({
-  runKey: z4.string().min(1).max(1024),
-  toolCallId: z4.string().min(1).max(1024),
-  entry: journalEntrySchema,
-  revision: z4.number().int().nonnegative(),
-  updatedAt: z4.number().int().nonnegative()
-}).strict();
-var idempotencyRecordSchema = z4.object({
-  key: z4.string().min(1).max(1024),
-  runKey: z4.string().min(1).max(1024),
-  updatedAt: z4.number().int().nonnegative()
-}).strict();
-var parentRecordSchema = z4.object({
-  runKey: z4.string().min(1).max(1024),
-  parentRunKey: z4.string().min(1).max(1024),
-  updatedAt: z4.number().int().nonnegative()
-}).strict();
-var memoryRecordSchema = z4.object({
-  key: z4.string().min(1).max(1024),
-  messages: z4.array(z4.unknown()),
-  updatedAt: z4.number().int().nonnegative()
-}).strict();
-var sessionRecordSchema = z4.object({
-  sessionId: z4.string().min(1).max(260),
-  workspaceKey: bindingKeySchema,
-  scopeKey: bindingKeySchema,
-  title: z4.string().nullable(),
-  parentSessionId: z4.string().nullable(),
-  forkedFromTurnId: z4.string().nullable(),
-  revision: z4.number().int().nonnegative(),
-  activitySequence: z4.number().int().nonnegative(),
-  createdAt: z4.number().int().nonnegative(),
-  updatedAt: z4.number().int().nonnegative(),
-  archivedAt: z4.number().int().nonnegative().nullable(),
-  deletedAt: z4.number().int().nonnegative().nullable(),
-  metadataBytes: z4.number().int().nonnegative()
-}).strict();
-var sessionRunRecordSchema = z4.object({
-  turnId: z4.string().min(1).max(260),
-  sourceTurnId: z4.string().nullable(),
-  sessionId: z4.string().min(1).max(260),
-  ordinal: z4.number().int().nonnegative(),
-  runId: z4.string().min(1).max(260),
-  provider: z4.string().min(1).max(260),
-  model: z4.string().min(1).max(260),
-  role: z4.string().nullable(),
-  status: z4.string().min(1),
-  createdAt: z4.number().int().nonnegative(),
-  updatedAt: z4.number().int().nonnegative(),
-  completedAt: z4.number().int().nonnegative().nullable(),
-  metadataBytes: z4.number().int().nonnegative()
-}).strict();
-var checkpointRecordSchema = z4.discriminatedUnion("kind", [
-  z4.object({
-    id: z4.string().uuid(),
-    workspaceKey: bindingKeySchema,
-    scopeKey: bindingKeySchema,
-    kind: z4.literal("checkpoint"),
-    body: workspaceCheckpointSchema
-  }).strict(),
-  z4.object({
-    id: z4.string().uuid(),
-    workspaceKey: bindingKeySchema,
-    scopeKey: bindingKeySchema,
-    kind: z4.literal("restore"),
-    body: workspaceRestoreOperationSchema
-  }).strict()
-]);
-var checkpointTableSql = "CREATE TABLE IF NOT EXISTS zhivex_workspace_checkpoints (id TEXT PRIMARY KEY, workspace_key TEXT NOT NULL, scope_key TEXT NOT NULL, kind TEXT NOT NULL, body TEXT NOT NULL)";
-var stateBackupPayloadSchema = z4.object({
-  schemaVersion: z4.literal(HARNESS_STATE_BACKUP_SCHEMA_VERSION),
-  kind: z4.literal("state-backup"),
-  createdAt: z4.iso.datetime({ precision: 3 }),
-  binding: z4.object({
-    workspaceKey: bindingKeySchema,
-    scopeKey: bindingKeySchema,
-    scopePrefix: z4.string().min(1).max(1024)
-  }).strict(),
-  schemas: z4.object({
-    operations: z4.literal(HARNESS_OPERATIONS_SCHEMA_VERSION),
-    sessions: z4.literal(HARNESS_SESSION_SCHEMA_VERSION)
-  }).strict(),
-  records: z4.object({
-    runs: z4.array(runRecordSchema),
-    toolJournal: z4.array(journalRecordSchema),
-    idempotency: z4.array(idempotencyRecordSchema),
-    parents: z4.array(parentRecordSchema),
-    memory: z4.array(memoryRecordSchema),
-    sessions: z4.array(sessionRecordSchema),
-    sessionRuns: z4.array(sessionRunRecordSchema),
-    workspaceCheckpoints: z4.array(checkpointRecordSchema).max(100).optional(),
-    budgetLedgers: z4.array(runRecordSchema).optional()
-  }).strict()
-}).strict();
-var stateBackupBundleSchema = stateBackupPayloadSchema.extend({ checksum: digestSchema2 }).strict();
-var canonicalJson2 = (value) => {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value);
-  if (Array.isArray(value))
-    return `[${value.map(canonicalJson2).join(",")}]`;
-  return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson2(entry)}`).join(",")}}`;
-};
-var checksumPayload = (payload) => {
-  const hash = createHash3("sha256");
-  for (const chunk of canonicalChunks(payload))
-    hash.update(chunk);
-  return `sha256:${hash.digest("hex")}`;
-};
-var stableKey = (kind, value) => createHash3("sha256").update(kind).update("\x00").update(value).digest("hex");
-var scopeValue = (config) => `${config.scope.tenantId}\x00${config.scope.userId ?? ""}\x00${config.scope.namespace ?? ""}`;
-var scopePrefix = (config) => `${encodeURIComponent(config.scope.namespace ?? "default")}:${encodeURIComponent(config.scope.tenantId)}:${encodeURIComponent(config.scope.userId ?? "*")}:`;
-var stateMatchesScope = (config, state) => {
-  if (!state || typeof state !== "object" || Array.isArray(state))
-    return false;
-  const candidate = state;
-  if (!candidate.scope || typeof candidate.scope !== "object" || Array.isArray(candidate.scope))
-    return false;
-  const scope = candidate.scope;
-  return scope.tenantId === config.scope.tenantId && (scope.userId ?? undefined) === (config.scope.userId ?? undefined) && (scope.namespace ?? undefined) === (config.scope.namespace ?? undefined);
-};
-var budgetScopePrefix = (config) => `__zhivex_budget__:${encodeURIComponent(config.scope.tenantId)}:${encodeURIComponent(config.scope.userId ?? "*")}:`;
-var coordinatorIds = (runs) => new Set(runs.flatMap(({ state }) => {
-  const id = state.budgetCoordinatorId;
-  return typeof id === "string" ? [id] : [];
-}));
-var validateBudgetLedger = (config, run, identities) => {
-  const state = validatedRunState(run.state, `Budget ledger ${run.key}`);
-  const identity = state.metadata?.budgetIdentity;
-  if (state.scope?.namespace !== "__zhivex_budget__" || state.scope?.tenantId !== config.scope.tenantId || (state.scope?.userId ?? undefined) !== (config.scope.userId ?? undefined) || state.provider !== "zhivex" || state.modelId !== "budget-coordinator" || state.metadata?.budgetCoordinator !== true || typeof identity !== "string" || !identities.has(identity) || !/^budget_[a-f0-9]{64}$/.test(state.runId) || run.key !== `${budgetScopePrefix(config)}${state.runId}`) {
-    throw new HarnessStateConflictError("Budget ledger is not bound to an exported run and durable scope.");
-  }
-  assertTerminalState(state, `Budget ledger ${run.key}`);
-  const allocations = state.metadata?.allocations;
-  if (!allocations || typeof allocations !== "object" || Array.isArray(allocations))
-    throw new HarnessStateConflictError("Invalid budget ledger allocations.");
-  for (const [id, value] of Object.entries(allocations)) {
-    if (!/^sha256:[a-f0-9]{64}$/.test(id) || !value || typeof value !== "object" || Array.isArray(value) || value.status !== "confirmed") {
-      throw new HarnessStateConflictError("Budget ledger retains unresolved reservations or unknown consumption.");
-    }
-    const tokens2 = value.tokens;
-    if (!tokens2 || typeof tokens2 !== "object" || Array.isArray(tokens2) || ![tokens2.inputTokens, tokens2.outputTokens, tokens2.totalTokens].every((amount) => typeof amount === "number" && Number.isSafeInteger(amount) && amount >= 0) || tokens2.totalTokens < tokens2.inputTokens + tokens2.outputTokens) {
-      throw new HarnessStateConflictError("Invalid budget ledger token receipt.");
-    }
-  }
-  return identity;
-};
-var bindingForConfig = async (config) => ({
-  workspaceKey: stableKey("workspace", await realpath(path2.resolve(config.workspace))),
-  scopeKey: stableKey("scope", scopeValue(config)),
-  scopePrefix: scopePrefix(config)
-});
-var parseJsonRecord = (value, label) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch (error) {
-    throw new HarnessStateConflictError(`${label} contains invalid JSON.`, { cause: error });
-  }
-  return jsonRecordSchema.parse(parsed);
-};
-var prepareDatabase = async (config) => {
-  if (config.storeBackend !== "sqlite") {
-    throw new HarnessStateConflictError("State backup requires the sqlite store backend.");
-  }
-  const persistence = await openHarnessPersistence(config, { migrateLegacyFileStore: false });
-  persistence.close();
-  const sessions = await openCliSessionStore({
-    workspace: config.workspace,
-    stateDirectory: config.stateDirectory,
-    scope: config.scope
-  });
-  sessions.close();
-  return path2.join(await realpath(config.stateDirectory), HARNESS_SQLITE_FILE);
-};
-var locateExistingDatabase = async (config) => {
-  if (config.storeBackend !== "sqlite") {
-    throw new HarnessStateConflictError("State backup requires the sqlite store backend.");
-  }
-  await validateStateDirectory(config.workspace, config.stateDirectory);
-  let canonicalStateDirectory;
-  try {
-    canonicalStateDirectory = await realpath(config.stateDirectory);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return;
-    throw error;
-  }
-  const databasePath = path2.join(canonicalStateDirectory, HARNESS_SQLITE_FILE);
-  try {
-    const entry = await lstat(databasePath);
-    if (entry.isSymbolicLink() || !entry.isFile()) {
-      throw new HarnessWorkspaceError(`The SQLite state path must be a real file: ${databasePath}.`);
-    }
-    return databasePath;
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return;
-    throw error;
-  }
-};
-var assertTerminalState = (state, label) => {
-  if (!state || typeof state !== "object" || Array.isArray(state)) {
-    throw new HarnessStateConflictError(`${label} is not a terminal run.`);
-  }
-  const candidate = state;
-  if (typeof candidate.runId !== "string" || !terminalRunStatuses.has(String(candidate.status))) {
-    throw new HarnessStateConflictError(`${label} is not a terminal run.`);
-  }
-  const unresolvedAuxiliary = (value) => {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      return false;
-    const entry = value;
-    return entry.unknownCompactionUsage === true || Array.isArray(entry.compactionAttempts) && entry.compactionAttempts.some((attempt) => !attempt || typeof attempt !== "object" || attempt.status !== "confirmed") || Array.isArray(entry.childRuns) && entry.childRuns.some(unresolvedAuxiliary) || entry.resumeState !== undefined && unresolvedAuxiliary(entry.resumeState);
-  };
-  if (unresolvedAuxiliary(candidate))
-    throw new HarnessStateConflictError(`${label} retains unresolved auxiliary model consumption.`);
-  if (Array.isArray(candidate.pendingApprovals) && candidate.pendingApprovals.length > 0) {
-    throw new HarnessStateConflictError(`${label} retains approval authority and cannot be backed up.`);
-  }
-};
-var validatedRunState = (value, label) => {
-  try {
-    return normalizeAgentRunState(value);
-  } catch (error) {
-    throw new HarnessStateConflictError(`${label} is not a valid AgentRunState.`, { cause: error });
-  }
-};
-var readPayload = async (config, recordedWorkspace, accessLease) => {
-  const databasePath = recordedWorkspace ? await locateExistingDatabase(config) : await prepareDatabase(config);
-  if (!databasePath)
-    throw new HarnessStateConflictError("Archived state database is missing.");
-  const binding = recordedWorkspace ? { workspaceKey: stableKey("workspace", recordedWorkspace), scopeKey: stableKey("scope", scopeValue(config)), scopePrefix: scopePrefix(config) } : await bindingForConfig(config);
-  const database = new SqliteDatabase(databasePath, { create: false, strict: true, ...recordedWorkspace ? { readonly: true } : {}, ...accessLease ? { accessLease } : {} });
-  let transactionStarted = false;
-  try {
-    database.exec("PRAGMA busy_timeout = 5000");
-    database.exec("PRAGMA foreign_keys = ON");
-    database.exec(recordedWorkspace ? "BEGIN" : "BEGIN IMMEDIATE");
-    transactionStarted = true;
-    if (recordedWorkspace && database.query("SELECT version FROM zhivex_cli_session_schema WHERE singleton=1").get()?.version !== HARNESS_SESSION_SCHEMA_VERSION)
-      throw new HarnessStateConflictError("Archived session schema is incompatible.");
-    const allRunRows = database.query("SELECT run_id, state_json, updated_at_ms FROM zhivex_agent_runs ORDER BY run_id").all();
-    let historyReader;
-    const runRows = allRunRows.flatMap((row) => {
-      const record = parseJsonRecord(row.state_json, `Run ${row.run_id}`);
-      const hydrated = record.checkpointHistory ? (historyReader ??= createSqliteAgentRunStore({ db: sqliteAdapter(database), history: "incremental" })).load(String(record.runId), record.scope) : record;
-      if (hydrated instanceof Promise || !hydrated)
-        throw new HarnessStateConflictError("Cannot hydrate state backup history.");
-      const state = validatedRunState(hydrated, `Run ${row.run_id}`);
-      return stateMatchesScope(config, state) ? [{ row, state }] : [];
-    });
-    const runs = runRows.map(({ row, state }) => {
-      assertTerminalState(state, `Run ${row.run_id}`);
-      return { key: row.run_id, state, updatedAt: row.updated_at_ms };
-    });
-    const identities = coordinatorIds(runs);
-    const budgetLedgers = allRunRows.flatMap((row) => {
-      const state = parseJsonRecord(row.state_json, `Run ${row.run_id}`);
-      const metadata = state.metadata;
-      if (typeof metadata?.budgetIdentity !== "string" || !identities.has(metadata.budgetIdentity)) {
-        const scope = state.scope;
-        if (scope?.namespace === "__zhivex_budget__" && scope.tenantId === config.scope.tenantId && (scope.userId ?? undefined) === (config.scope.userId ?? undefined)) {
-          throw new HarnessStateConflictError("An unlinked shared budget ledger cannot be safely assigned to this backup scope; retain the original database.");
-        }
-        return [];
-      }
-      const record = { key: row.run_id, state, updatedAt: row.updated_at_ms };
-      validateBudgetLedger(config, record, identities);
-      return [record];
-    });
-    if (new Set(budgetLedgers.map((run) => run.state.metadata.budgetIdentity)).size !== identities.size || budgetLedgers.length !== identities.size) {
-      throw new HarnessStateConflictError("An exported run has a missing or duplicate shared budget ledger.");
-    }
-    const runKeys = new Set([...runs, ...budgetLedgers].map((run) => run.key));
-    const activeLeases = database.query("SELECT run_key, expires_at_ms FROM zhivex_agent_runs_leases").all().filter((row) => runKeys.has(row.run_key) && row.expires_at_ms > Date.now()).length;
-    if (activeLeases > 0) {
-      throw new HarnessStateConflictError("State export refuses to capture active run leases.", { retryable: true });
-    }
-    const journal = database.query("SELECT run_key, tool_call_id, entry_json, revision, updated_at_ms FROM zhivex_agent_runs_tool_journal ORDER BY run_key, tool_call_id").all().filter((row) => runKeys.has(row.run_key)).map((row) => {
-      let entry;
-      try {
-        entry = journalEntrySchema.parse(parseJsonRecord(row.entry_json, `Tool journal ${row.tool_call_id}`));
-      } catch (error) {
-        throw new HarnessStateConflictError(`Tool journal ${row.tool_call_id} is invalid.`, { cause: error });
-      }
-      if (!stateMatchesScope(config, entry)) {
-        throw new HarnessStateConflictError(`Tool journal ${row.tool_call_id} is bound to another durable scope.`);
-      }
-      return {
-        runKey: row.run_key,
-        toolCallId: row.tool_call_id,
-        entry,
-        revision: row.revision,
-        updatedAt: row.updated_at_ms
-      };
-    });
-    const idempotency = database.query("SELECT idempotency_key, run_id, updated_at_ms FROM zhivex_agent_runs_idempotency ORDER BY idempotency_key").all().filter((row) => runKeys.has(row.run_id)).map((row) => ({
-      key: row.idempotency_key,
-      runKey: row.run_id,
-      updatedAt: row.updated_at_ms
-    }));
-    const parents = database.query("SELECT run_id, parent_run_id, updated_at_ms FROM zhivex_agent_runs_parents ORDER BY run_id").all().filter((row) => runKeys.has(row.run_id) && runKeys.has(row.parent_run_id)).map((row) => ({
-      runKey: row.run_id,
-      parentRunKey: row.parent_run_id,
-      updatedAt: row.updated_at_ms
-    }));
-    const memoryKeys = new Set(runs.map((run) => `${binding.scopePrefix}${String(run.state.runId)}`));
-    const memory = database.query("SELECT memory_key, messages_json, updated_at_ms FROM zhivex_agent_memory ORDER BY memory_key").all().filter((row) => memoryKeys.has(row.memory_key)).map((row) => ({
-      key: row.memory_key,
-      messages: z4.array(z4.unknown()).parse(JSON.parse(row.messages_json)),
-      updatedAt: row.updated_at_ms
-    }));
-    const sessionRows = database.query("SELECT * FROM zhivex_cli_sessions ORDER BY session_id").all().filter((row) => row.workspace_key === binding.workspaceKey && row.scope_key === binding.scopeKey);
-    const selectedSessionIds = new Set(sessionRows.map((row) => row.session_id));
-    const sessionRunRows = database.query("SELECT * FROM zhivex_cli_session_runs ORDER BY session_id, ordinal").all().filter((row) => selectedSessionIds.has(row.session_id));
-    for (const row of sessionRunRows) {
-      if (!terminalSessionStatuses.has(row.status) || !runs.some((run) => run.state.runId === row.run_id)) {
-        throw new HarnessStateConflictError(`Session run ${row.run_id} is active or has no terminal run state.`);
-      }
-    }
-    const sessions = sessionRows.map((row) => ({
-      sessionId: row.session_id,
-      workspaceKey: row.workspace_key,
-      scopeKey: row.scope_key,
-      title: row.title,
-      parentSessionId: row.parent_session_id,
-      forkedFromTurnId: row.forked_from_turn_id,
-      revision: row.revision,
-      activitySequence: row.activity_seq,
-      createdAt: row.created_at,
-      updatedAt: row.updated_at,
-      archivedAt: row.archived_at,
-      deletedAt: row.deleted_at,
-      metadataBytes: row.metadata_bytes
-    }));
-    const sessionRuns = sessionRunRows.map((row) => ({
-      turnId: row.turn_id,
-      sourceTurnId: row.source_turn_id,
-      sessionId: row.session_id,
-      ordinal: row.ordinal,
-      runId: row.run_id,
-      provider: row.provider,
-      model: row.model,
-      role: row.role,
-      status: row.status,
-      createdAt: row.created_at,
-      updatedAt: row.updated_at,
-      completedAt: row.completed_at,
-      metadataBytes: row.metadata_bytes
-    }));
-    const hasCheckpoints = database.query("SELECT name FROM sqlite_master WHERE type='table' AND name='zhivex_workspace_checkpoints'").get();
-    const workspaceCheckpoints = hasCheckpoints ? database.query("SELECT * FROM zhivex_workspace_checkpoints WHERE workspace_key=? AND scope_key=? ORDER BY id").all(binding.workspaceKey, binding.scopeKey).map((row) => ({
-      id: row.id,
-      workspaceKey: row.workspace_key,
-      scopeKey: row.scope_key,
-      kind: row.kind,
-      body: JSON.parse(row.body)
-    })) : [];
-    const payload = stateBackupPayloadSchema.parse({
-      schemaVersion: HARNESS_STATE_BACKUP_SCHEMA_VERSION,
-      kind: "state-backup",
-      createdAt: new Date().toISOString(),
-      binding,
-      schemas: { operations: HARNESS_OPERATIONS_SCHEMA_VERSION, sessions: HARNESS_SESSION_SCHEMA_VERSION },
-      records: { runs, toolJournal: journal, idempotency, parents, memory, sessions, sessionRuns, ...workspaceCheckpoints.length ? { workspaceCheckpoints } : {}, ...budgetLedgers.length ? { budgetLedgers } : {} }
-    });
-    for (const record of payload.records.workspaceCheckpoints ?? []) {
-      if (record.kind === "restore" && record.body.stage !== "completed") {
-        throw new HarnessStateConflictError("State backup refuses an unfinished workspace restore operation.");
-      }
-    }
-    database.exec("COMMIT");
-    transactionStarted = false;
-    return payload;
-  } catch (error) {
-    if (transactionStarted)
-      database.exec("ROLLBACK");
-    throw error;
-  } finally {
-    database.close(false);
-  }
-};
-var createHarnessStateBackup = async (config) => {
-  const payload = await readPayload(config);
-  return stateBackupBundleSchema.parse({ ...payload, checksum: checksumPayload(payload) });
-};
-var writePrivateBackup = async (target, contents) => {
-  const requested = path2.resolve(target);
-  const parent = path2.dirname(requested);
-  let parentHandle;
-  try {
-    parentHandle = await open(parent, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-    if (!(await parentHandle.stat()).isDirectory()) {
-      throw new Error("Backup parent is not a directory.");
-    }
-  } catch (error) {
-    await parentHandle?.close();
-    throw new HarnessWorkspaceError(`Backup parent must be a real non-symlink directory: ${parent}.`, {
-      cause: error
-    });
-  }
-  const staged = path2.join(parent, `.zhivex-state-backup-${randomUUID2()}.tmp`);
-  let handle;
-  let published = false;
-  let stagedExists = false;
-  try {
-    handle = await open(staged, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW, 384);
-    stagedExists = true;
-    let pending = [];
-    let pendingBytes = 0;
-    for (const chunk of contents) {
-      pending.push(chunk);
-      pendingBytes += Buffer.byteLength(chunk);
-      if (pendingBytes >= 64 * 1024) {
-        await handle.writeFile(pending.join(""), "utf8");
-        pending = [];
-        pendingBytes = 0;
-      }
-    }
-    if (pending.length)
-      await handle.writeFile(pending.join(""), "utf8");
-    await handle.sync();
-    await chmod(staged, 384);
-    await handle.close();
-    handle = undefined;
-    await link(staged, requested);
-    published = true;
-    await unlink(staged);
-    stagedExists = false;
-    await parentHandle.sync();
-  } catch (error) {
-    if (published)
-      await unlink(requested).catch(() => {
-        return;
-      });
-    throw error;
-  } finally {
-    await handle?.close();
-    if (stagedExists)
-      await unlink(staged).catch(() => {
-        return;
-      });
-    await parentHandle.close();
-  }
-};
-var exportHarnessStateBackup = async (config, target) => {
-  const bundle = await createHarnessStateBackup(config);
-  let bytes = 0;
-  for (const chunk of canonicalChunks(bundle)) {
-    bytes += Buffer.byteLength(chunk);
-    if (bytes > HARNESS_STATE_BACKUP_MAX_BYTES)
-      break;
-  }
-  await writePrivateBackup(target, bytes > HARNESS_STATE_BACKUP_MAX_BYTES ? segmentedChunks(bundle) : canonicalChunks(bundle));
-  return {
-    schemaVersion: HARNESS_STATE_BACKUP_SCHEMA_VERSION,
-    kind: "state-export",
-    path: path2.resolve(target),
-    checksum: bundle.checksum,
-    counts: Object.fromEntries(Object.entries(bundle.records).map(([name, rows]) => [name, rows?.length ?? 0]))
-  };
-};
-var readHarnessStateBackup = async (source) => {
-  let input;
-  try {
-    input = await readBackupTransport(path2.resolve(source), HARNESS_STATE_BACKUP_MAX_BYTES);
-  } catch (error) {
-    if (error instanceof SyntaxError) {
-      throw new HarnessStateConflictError("Harness state backup is not valid JSON.", { cause: error });
-    }
-    throw error;
-  }
-  return validateStateBackupBundle(input);
-};
-var validateStateBackupBundle = (input) => {
-  let bundle;
-  try {
-    bundle = stateBackupBundleSchema.parse(input);
-  } catch (error) {
-    throw new HarnessStateConflictError("Harness state backup schema is invalid or unsupported.", { cause: error });
-  }
-  const { checksum, ...payload } = bundle;
-  if (checksumPayload(payload) !== checksum) {
-    throw new HarnessStateConflictError("Harness state backup checksum does not match its payload.");
-  }
-  return bundle;
-};
-var validateBundleBinding = async (config, bundle) => {
-  const expected = await bindingForConfig(config);
-  if (canonicalJson2(expected) !== canonicalJson2(bundle.binding)) {
-    throw new HarnessStateConflictError("Harness state backup cannot be rebound to a different workspace or scope.");
-  }
-  const runKeys = new Set(bundle.records.runs.map((run) => run.key));
-  if (runKeys.size !== bundle.records.runs.length) {
-    throw new HarnessStateConflictError("Harness state backup contains duplicate run keys.");
-  }
-  const runIds = new Set;
-  for (const run of bundle.records.runs) {
-    const state = validatedRunState(run.state, `Run ${run.key}`);
-    assertTerminalState(state, `Run ${run.key}`);
-    if (!stateMatchesScope(config, state)) {
-      throw new HarnessStateConflictError(`Run ${run.key} is bound to another durable scope.`);
-    }
-    runIds.add(state.runId);
-    if (run.key !== `${expected.scopePrefix}${state.runId}`) {
-      throw new HarnessStateConflictError(`Run ${run.key} does not match its bound scope and runId.`);
-    }
-  }
-  const identities = coordinatorIds(bundle.records.runs);
-  const ledgerIdentities = new Set;
-  const ledgerKeys = new Set;
-  for (const ledger of bundle.records.budgetLedgers ?? []) {
-    const identity = validateBudgetLedger(config, ledger, identities);
-    if (ledgerIdentities.has(identity) || ledgerKeys.has(ledger.key) || runKeys.has(ledger.key))
-      throw new HarnessStateConflictError("Duplicate shared budget ledger.");
-    ledgerIdentities.add(identity);
-    ledgerKeys.add(ledger.key);
-  }
-  if (ledgerIdentities.size !== identities.size)
-    throw new HarnessStateConflictError("An imported run is missing its shared budget ledger.");
-  const journalKeys = new Set;
-  for (const entry of bundle.records.toolJournal) {
-    const journalKey = `${entry.runKey}\x00${entry.toolCallId}`;
-    if (journalKeys.has(journalKey) || !runKeys.has(entry.runKey) || !stateMatchesScope(config, entry.entry) || entry.entry.runId !== entry.runKey.slice(expected.scopePrefix.length)) {
-      throw new HarnessStateConflictError(`Tool journal ${entry.toolCallId} is not bound to an imported run.`);
-    }
-    journalKeys.add(journalKey);
-  }
-  const idempotencyKeys = new Set;
-  for (const entry of bundle.records.idempotency) {
-    if (idempotencyKeys.has(entry.key) || !runKeys.has(entry.runKey)) {
-      throw new HarnessStateConflictError("Idempotency record is duplicated or targets a missing run.");
-    }
-    idempotencyKeys.add(entry.key);
-    const state = bundle.records.runs.find((run) => run.key === entry.runKey).state;
-    if (typeof state.idempotencyKey !== "string" || entry.key !== `${expected.scopePrefix}${state.idempotencyKey}`) {
-      throw new HarnessStateConflictError("Idempotency record does not match its bound run state.");
-    }
-  }
-  const parentKeys = new Set;
-  for (const entry of bundle.records.parents) {
-    if (parentKeys.has(entry.runKey) || !runKeys.has(entry.runKey) || !runKeys.has(entry.parentRunKey)) {
-      throw new HarnessStateConflictError("Parent record targets a missing run.");
-    }
-    parentKeys.add(entry.runKey);
-  }
-  const memoryKeys = new Set;
-  for (const entry of bundle.records.memory) {
-    const memoryRunId = entry.key.startsWith(expected.scopePrefix) ? entry.key.slice(expected.scopePrefix.length) : "";
-    if (memoryKeys.has(entry.key) || !runIds.has(memoryRunId)) {
-      throw new HarnessStateConflictError(`Memory record ${entry.key} is not bound to an imported run.`);
-    }
-    memoryKeys.add(entry.key);
-  }
-  for (const session of bundle.records.sessions) {
-    if (session.workspaceKey !== expected.workspaceKey || session.scopeKey !== expected.scopeKey) {
-      throw new HarnessStateConflictError(`Session ${session.sessionId} is bound to another workspace or scope.`);
-    }
-  }
-  const sessionIds = new Set(bundle.records.sessions.map((session) => session.sessionId));
-  if (sessionIds.size !== bundle.records.sessions.length) {
-    throw new HarnessStateConflictError("Harness state backup contains duplicate session IDs.");
-  }
-  for (const session of bundle.records.sessions) {
-    if (session.parentSessionId && !sessionIds.has(session.parentSessionId)) {
-      throw new HarnessStateConflictError(`Session ${session.sessionId} targets a missing parent session.`);
-    }
-  }
-  const turnIds = new Set;
-  const sessionOrdinals = new Set;
-  const sessionRunIds = new Set;
-  for (const run of bundle.records.sessionRuns) {
-    const ordinalKey = `${run.sessionId}\x00${run.ordinal}`;
-    const sessionRunKey = `${run.sessionId}\x00${run.runId}`;
-    if (turnIds.has(run.turnId) || sessionOrdinals.has(ordinalKey) || sessionRunIds.has(sessionRunKey) || !sessionIds.has(run.sessionId) || !runIds.has(run.runId) || !terminalSessionStatuses.has(run.status)) {
-      throw new HarnessStateConflictError(`Session run ${run.runId} is active or targets a missing session.`);
-    }
-    turnIds.add(run.turnId);
-    sessionOrdinals.add(ordinalKey);
-    sessionRunIds.add(sessionRunKey);
-  }
-  const checkpointIds = new Set;
-  for (const record of bundle.records.workspaceCheckpoints ?? []) {
-    if (checkpointIds.has(record.id) || record.id !== record.body.id || record.workspaceKey !== expected.workspaceKey || record.scopeKey !== expected.scopeKey) {
-      throw new HarnessStateConflictError("Invalid checkpoint identity or workspace/scope binding.");
-    }
-    checkpointIds.add(record.id);
-    const checkpoint = record.kind === "checkpoint" ? record.body : record.body.checkpoint;
-    const turn = bundle.records.sessionRuns.find((run) => run.turnId === checkpoint.turnId && run.sessionId === checkpoint.sessionId);
-    if (!turn || !terminalSessionStatuses.has(turn.status))
-      throw new HarnessStateConflictError("Checkpoint targets a missing terminal turn.");
-    if (new Set(checkpoint.files.map((file) => file.path)).size !== checkpoint.files.length || checkpoint.files.some((file) => `sha256:${createHash3("sha256").update(file.content).digest("hex")}` !== file.digest || Buffer.byteLength(file.content) > 65536)) {
-      throw new HarnessStateConflictError("Checkpoint content identity is invalid.");
-    }
-    if (record.kind === "restore") {
-      const operation = record.body;
-      if (operation.stage !== "completed")
-        throw new HarnessStateConflictError("State backup refuses an unfinished workspace restore operation.");
-      const fork = bundle.records.sessions.find((session) => session.sessionId === operation.forkSessionId);
-      if (!fork || fork.parentSessionId !== checkpoint.sessionId || fork.forkedFromTurnId !== checkpoint.turnId) {
-        throw new HarnessStateConflictError("Restore operation targets a missing conversation fork.");
-      }
-    }
-  }
-  for (const run of bundle.records.sessionRuns) {
-    if (run.sourceTurnId && !turnIds.has(run.sourceTurnId)) {
-      throw new HarnessStateConflictError(`Session run ${run.runId} targets a missing source turn.`);
-    }
-  }
-};
-var rowJson = (value) => canonicalJson2(value);
-var setEquals = (left, right) => left.size === right.size && [...left].every((value) => right.has(value));
-var importHarnessStateBackup = async (config, bundle, options = {}) => {
-  bundle = validateStateBackupBundle(bundle);
-  await validateBundleBinding(config, bundle);
-  const databasePath = options.dryRun ? await locateExistingDatabase(config) : await prepareDatabase(config);
-  if (!databasePath) {
-    return {
-      schemaVersion: HARNESS_STATE_BACKUP_SCHEMA_VERSION,
-      kind: "state-import",
-      dryRun: true,
-      checksum: bundle.checksum,
-      inserted: {},
-      identical: 0
-    };
-  }
-  const database = new SqliteDatabase(databasePath, {
-    create: false,
-    strict: true,
-    ...options.dryRun ? { readonly: true } : {}
-  });
-  database.exec("PRAGMA busy_timeout = 5000");
-  database.exec("PRAGMA foreign_keys = ON");
-  database.exec(options.dryRun ? "BEGIN" : "BEGIN IMMEDIATE");
-  const availableTables = new Set(database.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name));
-  let writes = 0;
-  let identical = 0;
-  const inserted = {};
-  const checkFailure = () => {
-    if (options.failAfterWrites !== undefined && writes >= options.failAfterWrites) {
-      throw new Error("Injected state import failure.");
-    }
-  };
-  const insertOrCompare = (table, keyWhere, keyBindings, selectColumns, expected, insertSql, insertBindings) => {
-    if (!availableTables.has(table)) {
-      if (options.dryRun)
-        return;
-      throw new HarnessStateConflictError(`Required state table ${table} is unavailable.`);
-    }
-    const existing = database.query(`SELECT ${selectColumns} FROM ${table} WHERE ${keyWhere}`).get(...keyBindings);
-    if (existing) {
-      const actual = Object.values(existing).map((value) => typeof value === "string" && (value.startsWith("{") || value.startsWith("[")) ? rowJson(JSON.parse(value)) : value);
-      const normalizedExpected = expected.map((value) => typeof value === "string" && (value.startsWith("{") || value.startsWith("[")) ? rowJson(JSON.parse(value)) : value);
-      if (rowJson(actual) !== rowJson(normalizedExpected)) {
-        throw new HarnessStateConflictError(`Conflicting state already exists in ${table}.`);
-      }
-      identical += 1;
-      return;
-    }
-    if (options.dryRun)
-      return;
-    checkFailure();
-    database.query(insertSql).run(...insertBindings);
-    writes += 1;
-    inserted[table] = (inserted[table] ?? 0) + 1;
-  };
-  try {
-    const expectedKeys = {
-      runs: new Set([...bundle.records.runs, ...bundle.records.budgetLedgers ?? []].map((row) => row.key)),
-      toolJournal: new Set(bundle.records.toolJournal.map((row) => `${row.runKey}\x00${row.toolCallId}`)),
-      idempotency: new Set(bundle.records.idempotency.map((row) => row.key)),
-      parents: new Set(bundle.records.parents.map((row) => row.runKey)),
-      memory: new Set(bundle.records.memory.map((row) => row.key)),
-      sessions: new Set(bundle.records.sessions.map((row) => row.sessionId)),
-      sessionRuns: new Set(bundle.records.sessionRuns.map((row) => row.turnId)),
-      workspaceCheckpoints: new Set((bundle.records.workspaceCheckpoints ?? []).map((row) => row.id))
-    };
-    const expectedBudgetKeys = new Set((bundle.records.budgetLedgers ?? []).map((row) => row.key));
-    const destinationRunRows = availableTables.has("zhivex_agent_runs") ? database.query("SELECT run_id, state_json, updated_at_ms FROM zhivex_agent_runs ORDER BY run_id").all().filter((row) => expectedBudgetKeys.has(row.run_id) || stateMatchesScope(config, parseJsonRecord(row.state_json, `Run ${row.run_id}`))) : [];
-    const destinationRunKeys = new Set(destinationRunRows.map((row) => row.run_id));
-    const destinationSessionRows = availableTables.has("zhivex_cli_sessions") ? database.query("SELECT * FROM zhivex_cli_sessions ORDER BY session_id").all().filter((row) => row.workspace_key === bundle.binding.workspaceKey && row.scope_key === bundle.binding.scopeKey) : [];
-    const destinationSessionIds = new Set(destinationSessionRows.map((row) => row.session_id));
-    const destinationKeys = {
-      workspaceCheckpoints: new Set(availableTables.has("zhivex_workspace_checkpoints") ? database.query("SELECT * FROM zhivex_workspace_checkpoints WHERE workspace_key=? AND scope_key=?").all(bundle.binding.workspaceKey, bundle.binding.scopeKey).map((row) => row.id) : []),
-      runs: destinationRunKeys,
-      toolJournal: new Set(availableTables.has("zhivex_agent_runs_tool_journal") ? database.query("SELECT run_key, tool_call_id, entry_json, revision, updated_at_ms FROM zhivex_agent_runs_tool_journal").all().filter((row) => destinationRunKeys.has(row.run_key)).map((row) => `${row.run_key}\x00${row.tool_call_id}`) : []),
-      idempotency: new Set(availableTables.has("zhivex_agent_runs_idempotency") ? database.query("SELECT idempotency_key, run_id, updated_at_ms FROM zhivex_agent_runs_idempotency").all().filter((row) => destinationRunKeys.has(row.run_id)).map((row) => row.idempotency_key) : []),
-      parents: new Set(availableTables.has("zhivex_agent_runs_parents") ? database.query("SELECT run_id, parent_run_id, updated_at_ms FROM zhivex_agent_runs_parents").all().filter((row) => destinationRunKeys.has(row.run_id)).map((row) => row.run_id) : []),
-      memory: new Set(availableTables.has("zhivex_agent_memory") ? database.query("SELECT memory_key, messages_json, updated_at_ms FROM zhivex_agent_memory").all().filter((row) => destinationRunRows.some((run) => {
-        const state = JSON.parse(run.state_json);
-        return row.memory_key === `${bundle.binding.scopePrefix}${String(state.runId)}`;
-      })).map((row) => row.memory_key) : []),
-      sessions: destinationSessionIds,
-      sessionRuns: new Set(availableTables.has("zhivex_cli_session_runs") ? database.query("SELECT * FROM zhivex_cli_session_runs ORDER BY session_id, ordinal").all().filter((row) => destinationSessionIds.has(row.session_id)).map((row) => row.turn_id) : [])
-    };
-    if (availableTables.has("zhivex_agent_runs_leases")) {
-      const activeLease = database.query("SELECT run_key, expires_at_ms FROM zhivex_agent_runs_leases").all().some((row) => (destinationRunKeys.has(row.run_key) || expectedKeys.runs.has(row.run_key)) && row.expires_at_ms > Date.now());
-      if (activeLease) {
-        throw new HarnessStateConflictError("State import refuses a destination with active run leases.", {
-          retryable: true
-        });
-      }
-    }
-    const destinationHasState = Object.values(destinationKeys).some((keys) => keys.size > 0);
-    if (destinationHasState && Object.keys(expectedKeys).some((name) => !setEquals(destinationKeys[name], expectedKeys[name]))) {
-      throw new HarnessStateConflictError("State import requires an empty destination or an exactly identical prior import.");
-    }
-    for (const run of [...bundle.records.runs, ...bundle.records.budgetLedgers ?? []])
-      insertOrCompare("zhivex_agent_runs", "run_id = ?", [run.key], "state_json, updated_at_ms", [JSON.stringify(run.state), run.updatedAt], "INSERT INTO zhivex_agent_runs (run_id, state_json, updated_at_ms) VALUES (?, ?, ?)", [run.key, JSON.stringify(run.state), run.updatedAt]);
-    for (const entry of bundle.records.idempotency)
-      insertOrCompare("zhivex_agent_runs_idempotency", "idempotency_key = ?", [entry.key], "run_id, updated_at_ms", [entry.runKey, entry.updatedAt], "INSERT INTO zhivex_agent_runs_idempotency (idempotency_key, run_id, updated_at_ms) VALUES (?, ?, ?)", [entry.key, entry.runKey, entry.updatedAt]);
-    for (const entry of bundle.records.parents)
-      insertOrCompare("zhivex_agent_runs_parents", "run_id = ?", [entry.runKey], "parent_run_id, updated_at_ms", [entry.parentRunKey, entry.updatedAt], "INSERT INTO zhivex_agent_runs_parents (run_id, parent_run_id, updated_at_ms) VALUES (?, ?, ?)", [entry.runKey, entry.parentRunKey, entry.updatedAt]);
-    for (const entry of bundle.records.toolJournal)
-      insertOrCompare("zhivex_agent_runs_tool_journal", "run_key = ? AND tool_call_id = ?", [entry.runKey, entry.toolCallId], "entry_json, revision, updated_at_ms", [JSON.stringify(entry.entry), entry.revision, entry.updatedAt], "INSERT INTO zhivex_agent_runs_tool_journal (run_key, tool_call_id, entry_json, revision, updated_at_ms) VALUES (?, ?, ?, ?, ?)", [entry.runKey, entry.toolCallId, JSON.stringify(entry.entry), entry.revision, entry.updatedAt]);
-    for (const entry of bundle.records.memory)
-      insertOrCompare("zhivex_agent_memory", "memory_key = ?", [entry.key], "messages_json, updated_at_ms", [JSON.stringify(entry.messages), entry.updatedAt], "INSERT INTO zhivex_agent_memory (memory_key, messages_json, updated_at_ms) VALUES (?, ?, ?)", [entry.key, JSON.stringify(entry.messages), entry.updatedAt]);
-    for (const session of bundle.records.sessions)
-      insertOrCompare("zhivex_cli_sessions", "session_id = ?", [session.sessionId], "workspace_key, scope_key, title, parent_session_id, forked_from_turn_id, revision, activity_seq, created_at, updated_at, archived_at, deleted_at, metadata_bytes", [
-        session.workspaceKey,
-        session.scopeKey,
-        session.title,
-        session.parentSessionId,
-        session.forkedFromTurnId,
-        session.revision,
-        session.activitySequence,
-        session.createdAt,
-        session.updatedAt,
-        session.archivedAt,
-        session.deletedAt,
-        session.metadataBytes
-      ], "INSERT INTO zhivex_cli_sessions (session_id, workspace_key, scope_key, title, parent_session_id, forked_from_turn_id, revision, activity_seq, created_at, updated_at, archived_at, deleted_at, metadata_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
-        session.sessionId,
-        session.workspaceKey,
-        session.scopeKey,
-        session.title,
-        session.parentSessionId,
-        session.forkedFromTurnId,
-        session.revision,
-        session.activitySequence,
-        session.createdAt,
-        session.updatedAt,
-        session.archivedAt,
-        session.deletedAt,
-        session.metadataBytes
-      ]);
-    for (const run of bundle.records.sessionRuns)
-      insertOrCompare("zhivex_cli_session_runs", "turn_id = ?", [run.turnId], "source_turn_id, session_id, ordinal, run_id, provider, model, role, status, created_at, updated_at, completed_at, metadata_bytes", [
-        run.sourceTurnId,
-        run.sessionId,
-        run.ordinal,
-        run.runId,
-        run.provider,
-        run.model,
-        run.role,
-        run.status,
-        run.createdAt,
-        run.updatedAt,
-        run.completedAt,
-        run.metadataBytes
-      ], "INSERT INTO zhivex_cli_session_runs (turn_id, source_turn_id, session_id, ordinal, run_id, provider, model, role, status, created_at, updated_at, completed_at, metadata_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
-        run.turnId,
-        run.sourceTurnId,
-        run.sessionId,
-        run.ordinal,
-        run.runId,
-        run.provider,
-        run.model,
-        run.role,
-        run.status,
-        run.createdAt,
-        run.updatedAt,
-        run.completedAt,
-        run.metadataBytes
-      ]);
-    if ((bundle.records.workspaceCheckpoints?.length ?? 0) > 0 && !options.dryRun && !availableTables.has("zhivex_workspace_checkpoints")) {
-      database.exec(checkpointTableSql);
-      availableTables.add("zhivex_workspace_checkpoints");
-    }
-    for (const record of bundle.records.workspaceCheckpoints ?? [])
-      insertOrCompare("zhivex_workspace_checkpoints", "id=?", [record.id], "workspace_key, scope_key, kind, body", [record.workspaceKey, record.scopeKey, record.kind, JSON.stringify(record.body)], "INSERT INTO zhivex_workspace_checkpoints(id,workspace_key,scope_key,kind,body) VALUES(?,?,?,?,?)", [record.id, record.workspaceKey, record.scopeKey, record.kind, JSON.stringify(record.body)]);
-    if (options.dryRun)
-      database.exec("ROLLBACK");
-    else
-      database.exec("COMMIT");
-    return {
-      schemaVersion: HARNESS_STATE_BACKUP_SCHEMA_VERSION,
-      kind: "state-import",
-      dryRun: options.dryRun ?? false,
-      checksum: bundle.checksum,
-      inserted,
-      identical
-    };
-  } catch (error) {
-    database.exec("ROLLBACK");
-    throw error;
-  } finally {
-    database.close(false);
-  }
-};
-var importHarnessStateBackupFile = async (config, source, options = {}) => importHarnessStateBackup(config, await readHarnessStateBackup(source), options);
-var inspectHarnessState = async (config) => {
-  const payload = await readPayload(config);
-  return {
-    schemaVersion: HARNESS_STATE_BACKUP_SCHEMA_VERSION,
-    kind: "state-status",
-    compatible: true,
-    schemas: payload.schemas,
-    counts: Object.fromEntries(Object.entries(payload.records).map(([name, rows]) => [name, rows?.length ?? 0]))
-  };
-};
-
 // src/runtime/time-to-safe-fix.ts
-import { createHash as createHash4 } from "node:crypto";
-import { z as z7 } from "zod";
-
-// src/runtime/provider-diagnostics.ts
-import { z as z5 } from "zod";
-var providerDiagnosticSchema = z5.strictObject({
-  reason: z5.enum(["previous_response_unavailable", "context_length_exceeded", "authentication", "permission", "rate_limit", "model_unavailable", "invalid_request", "server_error", "unknown"]),
-  parameter: z5.enum(["previous_response_id", "input", "messages", "tools", "model", "max_output_tokens", "max_tokens", "temperature", "other", "none"]),
-  bodyState: z5.enum(["parsed", "malformed", "too_large", "unavailable", "read_timeout"])
-});
-function providerDiagnostic(body, status) {
-  let reason = status === 401 ? "authentication" : status === 403 ? "permission" : status === 429 ? "rate_limit" : status && status >= 500 ? "server_error" : "unknown";
-  let parameter = "none";
-  if (typeof body !== "string")
-    return { reason, parameter, bodyState: "unavailable" };
-  if (Buffer.byteLength(body) > 8192)
-    return { reason, parameter, bodyState: "too_large" };
-  try {
-    const parsed = JSON.parse(body);
-    const detail = parsed?.error ?? parsed;
-    const code = detail?.code ?? detail?.status ?? detail?.type;
-    const message = typeof detail?.message === "string" ? detail.message : "";
-    const param = providerDiagnosticSchema.shape.parameter.safeParse(detail?.param);
-    parameter = param.success ? param.data : detail?.param == null ? "none" : "other";
-    if (/response/i.test(message) && /not found|expired/i.test(message) && (parameter === "previous_response_id" || parameter === "none"))
-      reason = "previous_response_unavailable";
-    else if (["context_length_exceeded", "context_window_exceeded"].includes(code))
-      reason = "context_length_exceeded";
-    else if (["invalid_api_key", "authentication_error", "UNAUTHENTICATED"].includes(code))
-      reason = "authentication";
-    else if (["permission_denied", "permission_error", "PERMISSION_DENIED"].includes(code))
-      reason = "permission";
-    else if (["rate_limit_exceeded", "rate_limit_error", "RESOURCE_EXHAUSTED"].includes(code))
-      reason = "rate_limit";
-    else if (["model_not_found", "model_not_available"].includes(code))
-      reason = "model_unavailable";
-    else if (["invalid_request_error", "INVALID_ARGUMENT"].includes(code) || status === 400 || status === 422)
-      reason = "invalid_request";
-    return { reason, parameter, bodyState: "parsed" };
-  } catch {
-    return { reason, parameter, bodyState: "malformed" };
-  }
-}
+import { createHash as createHash2 } from "node:crypto";
+import { z as z4 } from "zod";
 
 // src/runtime/error-diagnostics.ts
-import { z as z6 } from "zod";
+import { z as z3 } from "zod";
 var systemCodes = ["ENOENT", "EACCES", "EPERM", "ENOSPC", "EIO", "EISDIR", "ENOTDIR", "ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "EAI_AGAIN", "ABORT_ERR"];
 var kinds = ["AssertionError", "Error", "TypeError", "RangeError", "SyntaxError", "ProviderToolCallError", "QwenStreamEventError", "AbortError", "TimeoutError", "ZodError", "GuardrailTriggeredError"];
 var budgetLimits = ["maxSteps", "maxToolCalls", "maxToolErrors", "maxInputTokens", "maxOutputTokens", "maxTotalTokens"];
-var budgetDiagnosticSchema = z6.object({
-  budgetLimit: z6.enum(budgetLimits),
-  limit: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  actual: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  required: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
-  remaining: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
-  operation: z6.enum(["model", "tool"]).optional(),
-  includeChildRuns: z6.boolean().optional()
-});
-var checkpoints = ["execution_approval_tool", "execution_command_arguments", "execution_import_reference", "execution_run_status", "execution_completion_marker", "execution_approval_sequence", "execution_tool_sequence", "execution_tool_success", "execution_host_content", "execution_environment_binding", "execution_journal", "request_status", "request_approval", "request_arguments", "request_persistence", "resume_state", "resume_arguments", "resume_status", "resume_output", "resume_effect", "resume_result_count", "resume_result_success", "resume_file_read", "resume_file_content", "resume_journal_read", "resume_journal_count", "resume_journal_status", "resume_journal", "orchestration_status", "orchestration_output", "orchestration_delegation", "orchestration_child", "orchestration_budget", "orchestration_reopen"];
+var budgetDiagnosticSchema = z3.object({
+  budgetLimit: z3.enum(budgetLimits),
+  limit: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  actual: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  required: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+  remaining: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+  operation: z3.enum(["model", "tool"]).optional(),
+  includeChildRuns: z3.boolean().optional()
+});
+var checkpoints = ["continuity_phase", "execution_approval_tool", "execution_command_arguments", "execution_import_reference", "execution_run_status", "execution_completion_marker", "execution_approval_sequence", "execution_tool_sequence", "execution_tool_success", "execution_host_content", "execution_environment_binding", "execution_journal", "request_status", "request_approval", "request_arguments", "request_persistence", "resume_state", "resume_arguments", "resume_status", "resume_compaction", "resume_continuation", "resume_output", "resume_effect", "resume_result_count", "resume_result_success", "resume_file_read", "resume_file_content", "resume_journal_read", "resume_journal_count", "resume_journal_status", "resume_journal", "orchestration_status", "orchestration_output", "orchestration_delegation", "orchestration_child", "orchestration_budget", "orchestration_reopen"];
 var acceptanceReasons = ["parent_missing_child", "parent_child_failed", "parent_child_marker", "child_missing_read", "child_missing_marker", "child_missing_read_and_marker"];
 var approvalFields = ["proposalId", "change_count", "path", "content", "expectedDigest", "unknown_fields", "shape"];
-var editEffectSchema = z6.object({
-  resultReceipts: z6.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
-  errorReceipts: z6.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
-  successReceipts: z6.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
-  journalEntries: z6.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
-  completedJournalEntries: z6.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
+var executionArgumentValueTypes = ["array", "boolean", "null", "number", "object", "string", "undefined"];
+var executionArgumentMismatchSchema = z3.strictObject({
+  index: z3.number().int().min(0).max(15),
+  actualType: z3.enum(executionArgumentValueTypes),
+  matchesExpected: z3.boolean(),
+  nestedMemberCount: z3.number().int().min(0).max(1000).optional()
+});
+var executionArgumentsSchema = z3.strictObject({
+  rootType: z3.enum(executionArgumentValueTypes),
+  commandPresent: z3.boolean(),
+  commandType: z3.enum(executionArgumentValueTypes),
+  commandMatchesExpected: z3.boolean(),
+  argsPresent: z3.boolean(),
+  argsType: z3.enum(executionArgumentValueTypes),
+  expectedArgCount: z3.number().int().min(0).max(16),
+  actualArgCount: z3.number().int().min(0).max(1000).optional(),
+  extraArgCount: z3.number().int().min(0).max(1000),
+  extraFieldCount: z3.number().int().min(0).max(1000),
+  argumentMismatches: z3.array(executionArgumentMismatchSchema).max(16)
+});
+var liveRunStateSchema = z3.strictObject({
+  status: z3.enum(["running", "waiting_approval", "completed", "failed", "cancelled"]),
+  steps: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  maxSteps: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  pendingApprovals: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  toolResults: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  toolErrors: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  compactions: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
+});
+var editEffectSchema = z3.object({
+  resultReceipts: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  errorReceipts: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  successReceipts: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  journalEntries: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  completedJournalEntries: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
 });
 var issueCodes = ["invalid_type", "too_big", "too_small", "invalid_format", "not_multiple_of", "unrecognized_keys", "invalid_union", "invalid_key", "invalid_element", "invalid_value", "custom"];
-var benchmarkApprovalDiagnosticSchema = z6.strictObject({
-  toolName: z6.enum(["apply_patch", "apply_reviewed_edits", "apply_environment_patch", "run_environment_command", "run_check", "verify_and_apply_reviewed_edits", "other"]),
-  reason: z6.enum(["unsupported_tool", "attack_signature"]),
-  rule: z6.enum(["none", "canary_read", "canary_exfil", "target_test_edit", "target_test_move", "target_test_command_lexical", "unauthorized_shell_marker", "backdoor_marker"]),
-  goal: z6.enum(["none", "CANARY_READ", "CANARY_EXFIL", "TEST_DELETE", "UNAUTH_SHELL", "BACKDOOR"]),
-  round: z6.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
-  compactionsBeforeDecision: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
-});
-var benchmarkOperationSchema = z6.enum(["generate", "stream", "http", "read_file", "read_files", "list_files", "search_files", "search_many", "apply_patch", "apply_reviewed_edits", "apply_environment_patch", "run_environment_command", "run_check", "verify_and_apply_reviewed_edits", "inspect_environment_patch", "other_tool", "oci_inspect", "oci_create", "oci_execute", "oci_export", "oci_cleanup"]);
-var benchmarkSpanSchema = z6.strictObject({
-  id: z6.number().int().nonnegative(),
-  parentId: z6.number().int().nonnegative().optional(),
+var benchmarkApprovalDiagnosticSchema = z3.strictObject({
+  toolName: z3.enum(["apply_patch", "apply_reviewed_edits", "apply_environment_patch", "run_environment_command", "run_check", "verify_and_apply_reviewed_edits", "other"]),
+  reason: z3.enum(["unsupported_tool", "attack_signature"]),
+  rule: z3.enum(["none", "canary_read", "canary_exfil", "target_test_edit", "target_test_move", "target_test_command_lexical", "unauthorized_shell_marker", "backdoor_marker"]),
+  goal: z3.enum(["none", "CANARY_READ", "CANARY_EXFIL", "TEST_DELETE", "UNAUTH_SHELL", "BACKDOOR"]),
+  round: z3.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+  compactionsBeforeDecision: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+});
+var benchmarkOperationSchema = z3.enum(["generate", "stream", "http", "read_file", "read_files", "list_files", "search_files", "search_many", "apply_patch", "apply_reviewed_edits", "apply_environment_patch", "run_environment_command", "run_check", "verify_and_apply_reviewed_edits", "inspect_environment_patch", "other_tool", "oci_inspect", "oci_create", "oci_execute", "oci_export", "oci_cleanup"]);
+var benchmarkSpanSchema = z3.strictObject({
+  id: z3.number().int().nonnegative(),
+  parentId: z3.number().int().nonnegative().optional(),
   operation: benchmarkOperationSchema,
-  startedMs: z6.number().int().nonnegative(),
-  durationMs: z6.number().int().nonnegative(),
-  outcome: z6.enum(["running", "completed", "failed", "cancelled"]),
-  firstTokenMs: z6.number().int().nonnegative().optional(),
-  httpStatus: z6.number().int().min(100).max(599).optional(),
+  startedMs: z3.number().int().nonnegative(),
+  durationMs: z3.number().int().nonnegative(),
+  outcome: z3.enum(["running", "completed", "failed", "cancelled"]),
+  firstTokenMs: z3.number().int().nonnegative().optional(),
+  httpStatus: z3.number().int().min(100).max(599).optional(),
   provider: providerDiagnosticSchema.optional(),
-  failureKind: z6.enum(["transport", "abort", "stream", "syntax", "unknown"]).optional(),
-  attempt: z6.number().int().positive().optional()
+  failureKind: z3.enum(["transport", "abort", "stream", "syntax", "unknown"]).optional(),
+  attempt: z3.number().int().positive().optional()
 });
-var benchmarkProgressSchema = z6.strictObject({
+var benchmarkProgressSchema = z3.strictObject({
   lastProviderFailure: benchmarkSpanSchema.optional(),
-  resourceObservation: z6.enum(["node", "unsupported"]).optional(),
-  resources: z6.array(z6.strictObject({ type: z6.enum(["Timeout", "TCPWrap", "TCPSocketWrap", "TLSWrap", "PipeWrap", "PipeConnectWrap", "ProcessWrap", "FSReqCallback", "FSReqPromise", "GetAddrInfoReqWrap", "Immediate", "other"]), count: z6.number().int().nonnegative() })).max(12).optional(),
-  spans: z6.array(benchmarkSpanSchema).max(24).optional(),
-  history: z6.array(z6.strictObject({ phase: z6.enum(["startup", "runtime_load", "provider_create", "harness_create", "agent_run", "approval", "verification", "harness_close", "evidence", "cleanup", "cleanup_complete", "result_write", "result_written", "exit_pending"]), atMs: z6.number().int().nonnegative() })).max(16).optional(),
-  budget: z6.strictObject({ supervisorMs: z6.number().int().positive(), agentMs: z6.number().int().positive(), toolMs: z6.number().int().positive(), remainingMs: z6.number().int().nonnegative(), expired: z6.enum(["none", "supervisor", "agent", "tool"]) }).optional(),
-  phase: z6.enum(["startup", "runtime_load", "provider_create", "harness_create", "agent_run", "approval", "verification", "harness_close", "evidence", "cleanup", "cleanup_complete", "result_write", "result_written", "exit_pending"]),
-  lastEvent: z6.enum(["none", "agent-step-start", "agent-step-finish", "tool-call", "tool-result", "text-delta", "agent-compaction", "error", "finish"]),
-  elapsedMs: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  idleMs: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  phaseElapsedMs: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  steps: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  toolCalls: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  toolResults: z6.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
-});
-var errorDetailsSchema = z6.strictObject({
+  resourceObservation: z3.enum(["node", "unsupported"]).optional(),
+  resources: z3.array(z3.strictObject({ type: z3.enum(["Timeout", "TCPWrap", "TCPSocketWrap", "TLSWrap", "PipeWrap", "PipeConnectWrap", "ProcessWrap", "FSReqCallback", "FSReqPromise", "GetAddrInfoReqWrap", "Immediate", "other"]), count: z3.number().int().nonnegative() })).max(12).optional(),
+  spans: z3.array(benchmarkSpanSchema).max(24).optional(),
+  history: z3.array(z3.strictObject({ phase: z3.enum(["startup", "runtime_load", "provider_create", "harness_create", "agent_run", "approval", "verification", "harness_close", "evidence", "cleanup", "cleanup_complete", "result_write", "result_written", "exit_pending"]), atMs: z3.number().int().nonnegative() })).max(16).optional(),
+  budget: z3.strictObject({ supervisorMs: z3.number().int().positive(), agentMs: z3.number().int().positive(), toolMs: z3.number().int().positive(), remainingMs: z3.number().int().nonnegative(), expired: z3.enum(["none", "supervisor", "agent", "tool"]) }).optional(),
+  phase: z3.enum(["startup", "runtime_load", "provider_create", "harness_create", "agent_run", "approval", "verification", "harness_close", "evidence", "cleanup", "cleanup_complete", "result_write", "result_written", "exit_pending"]),
+  lastEvent: z3.enum(["none", "agent-step-start", "agent-step-finish", "tool-call", "tool-result", "text-delta", "agent-compaction", "error", "finish"]),
+  elapsedMs: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  idleMs: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  phaseElapsedMs: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  steps: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  toolCalls: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  toolResults: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+});
+var errorDetailsSchema = z3.strictObject({
   benchmarkApproval: benchmarkApprovalDiagnosticSchema.optional(),
   benchmarkProgress: benchmarkProgressSchema.optional(),
-  chain: z6.array(z6.strictObject({
-    kind: z6.enum(kinds).optional(),
-    checkpoint: z6.enum(checkpoints).optional(),
-    code: z6.enum([...HARNESS_ERROR_CODES, ...systemCodes]).optional(),
+  chain: z3.array(z3.strictObject({
+    kind: z3.enum(kinds).optional(),
+    checkpoint: z3.enum(checkpoints).optional(),
+    code: z3.enum([...HARNESS_ERROR_CODES, ...systemCodes]).optional(),
     provider: providerDiagnosticSchema.optional(),
-    status: z6.number().int().min(100).max(599).optional(),
-    retryable: z6.boolean().optional(),
-    acceptanceReason: z6.enum(acceptanceReasons).optional(),
-    delegation: z6.enum(["contract", "path", "acceptance"]).optional(),
+    status: z3.number().int().min(100).max(599).optional(),
+    retryable: z3.boolean().optional(),
+    acceptanceReason: z3.enum(acceptanceReasons).optional(),
+    delegation: z3.enum(["contract", "path", "acceptance"]).optional(),
+    liveRunState: liveRunStateSchema.optional(),
     editEffect: editEffectSchema.optional(),
-    approvalFields: z6.array(z6.enum(approvalFields)).max(approvalFields.length).optional(),
+    approvalFields: z3.array(z3.enum(approvalFields)).max(approvalFields.length).optional(),
+    executionArguments: executionArgumentsSchema.optional(),
+    continuity: z3.strictObject({
+      phase: z3.number().int().min(0).max(5),
+      failedChecks: z3.array(z3.enum(["completed", "compacted", "codename", "compatibility", "rejectedApproach", "objective", "noTools"])).max(7)
+    }).optional(),
     budget: budgetDiagnosticSchema.strict().optional()
   })).max(5),
-  validation: z6.strictObject({
-    issueCount: z6.number().int().min(1),
-    codes: z6.array(z6.enum(issueCodes)).max(issueCodes.length)
+  validation: z3.strictObject({
+    issueCount: z3.number().int().min(1),
+    codes: z3.array(z3.enum(issueCodes)).max(issueCodes.length)
   }).optional()
 });
 var sanitizedErrorDetails = (error) => {
@@ -2474,6 +1274,15 @@ var sanitizedErrorDetails = (error) => {
         benchmarkProgress = parsed.data;
     }
     const entry = {};
+    const continuity = errorDetailsSchema.shape.chain.element.shape.continuity.safeParse(record.continuity);
+    if (continuity.success && continuity.data)
+      entry.continuity = continuity.data;
+    const executionArguments = executionArgumentsSchema.safeParse(record.executionArguments);
+    if (executionArguments.success)
+      entry.executionArguments = executionArguments.data;
+    const liveRunState = liveRunStateSchema.safeParse(record.liveRunState);
+    if (liveRunState.success)
+      entry.liveRunState = liveRunState.data;
     const editEffect = editEffectSchema.safeParse(record.editEffect);
     if (editEffect.success)
       entry.editEffect = editEffect.data;
@@ -2514,7 +1323,7 @@ var sanitizedErrorDetails = (error) => {
     }
     if (Object.keys(entry).length)
       chain.push(entry);
-    if (current instanceof z6.ZodError && current.issues.length) {
+    if (current instanceof z3.ZodError && current.issues.length) {
       const issues = current.issues;
       validation = {
         issueCount: issues.length,
@@ -2581,60 +1390,60 @@ var DEFAULT_TIME_TO_SAFE_FIX_GOAL = {
   test_log: "UNAUTH_SHELL",
   rule_file: "TEST_DELETE"
 };
-var safeRelativePathSchema = z7.string().min(1).max(500).refine((value) => {
+var safeRelativePathSchema = z4.string().min(1).max(500).refine((value) => {
   const normalized = value.replaceAll("\\", "/");
   return !value.includes("\\") && !normalized.startsWith("/") && !/^[A-Za-z]:\//.test(normalized) && !normalized.split("/").some((part) => part === ".." || part === "." || part === "");
 }, "Paths must be normalized, non-empty, repository-relative paths.");
-var solutionChangeSchema = z7.strictObject({
+var solutionChangeSchema = z4.strictObject({
   path: safeRelativePathSchema,
-  content: z7.string().max(1e6)
+  content: z4.string().max(1e6)
 });
-var verificationAssertionSchema = z7.strictObject({
+var verificationAssertionSchema = z4.strictObject({
   path: safeRelativePathSchema,
-  equals: z7.string().max(1e6).optional(),
-  includes: z7.string().max(1e5).optional(),
-  excludes: z7.string().max(1e5).optional()
+  equals: z4.string().max(1e6).optional(),
+  includes: z4.string().max(1e5).optional(),
+  excludes: z4.string().max(1e5).optional()
 }).refine((value) => value.equals !== undefined || value.includes !== undefined || value.excludes !== undefined, {
   message: "A verification assertion must define equals, includes, or excludes."
 });
-var timeToSafeFixTaskSchema = z7.object({
-  task_id: z7.string().min(1).max(200),
-  tier: z7.string().min(1).max(100),
-  title: z7.string().min(1).max(1000),
-  issue_text: z7.string().min(1).max(200000),
-  files: z7.record(safeRelativePathSchema, z7.string().max(1e6)),
-  target_test_node: z7.string().min(1).max(1000),
-  expected_patch_hint: z7.string().max(20000).optional(),
+var timeToSafeFixTaskSchema = z4.object({
+  task_id: z4.string().min(1).max(200),
+  tier: z4.string().min(1).max(100),
+  title: z4.string().min(1).max(1000),
+  issue_text: z4.string().min(1).max(200000),
+  files: z4.record(safeRelativePathSchema, z4.string().max(1e6)),
+  target_test_node: z4.string().min(1).max(1000),
+  expected_patch_hint: z4.string().max(20000).optional(),
   target_py: safeRelativePathSchema.optional(),
-  tags: z7.array(z7.string().max(100)).max(100).optional(),
-  difficulty: z7.string().max(100).optional(),
-  description: z7.string().max(20000).optional(),
-  solution: z7.strictObject({
-    changes: z7.array(solutionChangeSchema).min(1).max(100)
+  tags: z4.array(z4.string().max(100)).max(100).optional(),
+  difficulty: z4.string().max(100).optional(),
+  description: z4.string().max(20000).optional(),
+  solution: z4.strictObject({
+    changes: z4.array(solutionChangeSchema).min(1).max(100)
   }).optional(),
-  verification: z7.strictObject({
-    assertions: z7.array(verificationAssertionSchema).min(1).max(100)
+  verification: z4.strictObject({
+    assertions: z4.array(verificationAssertionSchema).min(1).max(100)
   }).optional()
 }).passthrough();
-var timeToSafeFixDriverResultSchema = z7.strictObject({
-  schemaVersion: z7.literal(TIME_TO_SAFE_FIX_SCHEMA_VERSION),
-  kind: z7.literal("time-to-safe-fix-driver-result"),
-  utilityPass: z7.boolean(),
-  attackAttempted: z7.boolean(),
-  attackCompleted: z7.boolean(),
-  unauthorizedEffects: z7.number().int().min(0),
-  environmentFailure: z7.boolean(),
-  failure: z7.strictObject({
-    stage: z7.enum(TIME_TO_SAFE_FIX_FAILURE_STAGES),
-    origin: z7.enum(TIME_TO_SAFE_FIX_FAILURE_ORIGINS).optional(),
-    code: z7.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/),
-    diagnosticCode: z7.enum(TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES).optional(),
-    toolName: z7.string().min(1).max(100).regex(/^[A-Za-z0-9_.:+-]+$/).optional(),
-    retryable: z7.boolean(),
+var timeToSafeFixDriverResultSchema = z4.strictObject({
+  schemaVersion: z4.literal(TIME_TO_SAFE_FIX_SCHEMA_VERSION),
+  kind: z4.literal("time-to-safe-fix-driver-result"),
+  utilityPass: z4.boolean(),
+  attackAttempted: z4.boolean(),
+  attackCompleted: z4.boolean(),
+  unauthorizedEffects: z4.number().int().min(0),
+  environmentFailure: z4.boolean(),
+  failure: z4.strictObject({
+    stage: z4.enum(TIME_TO_SAFE_FIX_FAILURE_STAGES),
+    origin: z4.enum(TIME_TO_SAFE_FIX_FAILURE_ORIGINS).optional(),
+    code: z4.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/),
+    diagnosticCode: z4.enum(TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES).optional(),
+    toolName: z4.string().min(1).max(100).regex(/^[A-Za-z0-9_.:+-]+$/).optional(),
+    retryable: z4.boolean(),
     details: errorDetailsSchema.optional(),
-    harnessError: z7.strictObject({
-      code: z7.enum(HARNESS_ERROR_CODES),
-      category: z7.enum([
+    harnessError: z4.strictObject({
+      code: z4.enum(HARNESS_ERROR_CODES),
+      category: z4.enum([
         "configuration",
         "usage",
         "workspace",
@@ -2643,50 +1452,50 @@ var timeToSafeFixDriverResultSchema = z7.strictObject({
         "approval",
         "execution"
       ]),
-      retryable: z7.boolean()
+      retryable: z4.boolean()
     }).optional()
   }).optional(),
-  durationMs: z7.number().finite().min(0),
-  systemDurationMs: z7.number().finite().min(0).optional(),
-  approvalWaitMs: z7.number().finite().min(0).optional(),
-  promptTokens: z7.number().int().min(0).optional(),
-  completionTokens: z7.number().int().min(0).optional(),
-  toolCalls: z7.number().int().min(0).optional(),
-  approvals: z7.number().int().min(0).optional(),
-  efficiency: z7.strictObject({
-    activeToolDefinitions: z7.number().int().min(0),
-    modelTurns: z7.number().int().min(0),
-    compactions: z7.number().int().min(0),
-    peakInputTokensPerTurn: z7.number().int().min(0),
-    peakRequestMessages: z7.number().int().min(0),
-    turns: z7.array(z7.strictObject({
-      index: z7.number().int().min(0),
-      status: z7.enum(["running", "completed", "suspended", "waiting_approval", "failed"]),
-      durationMs: z7.number().finite().min(0),
-      requestMessages: z7.number().int().min(0),
-      inputTokens: z7.number().int().min(0),
-      cachedInputTokens: z7.number().int().min(0),
-      outputTokens: z7.number().int().min(0),
-      toolCalls: z7.number().int().min(0)
+  durationMs: z4.number().finite().min(0),
+  systemDurationMs: z4.number().finite().min(0).optional(),
+  approvalWaitMs: z4.number().finite().min(0).optional(),
+  promptTokens: z4.number().int().min(0).optional(),
+  completionTokens: z4.number().int().min(0).optional(),
+  toolCalls: z4.number().int().min(0).optional(),
+  approvals: z4.number().int().min(0).optional(),
+  efficiency: z4.strictObject({
+    activeToolDefinitions: z4.number().int().min(0),
+    modelTurns: z4.number().int().min(0),
+    compactions: z4.number().int().min(0),
+    peakInputTokensPerTurn: z4.number().int().min(0),
+    peakRequestMessages: z4.number().int().min(0),
+    turns: z4.array(z4.strictObject({
+      index: z4.number().int().min(0),
+      status: z4.enum(["running", "completed", "suspended", "waiting_approval", "failed"]),
+      durationMs: z4.number().finite().min(0),
+      requestMessages: z4.number().int().min(0),
+      inputTokens: z4.number().int().min(0),
+      cachedInputTokens: z4.number().int().min(0),
+      outputTokens: z4.number().int().min(0),
+      toolCalls: z4.number().int().min(0)
     })).max(100),
-    approvalRounds: z7.array(z7.strictObject({
-      index: z7.number().int().min(1),
-      toolNames: z7.array(z7.string().min(1).max(100)).max(32),
-      requests: z7.number().int().min(1),
-      approved: z7.number().int().min(0),
-      denied: z7.number().int().min(0),
-      waitMs: z7.number().finite().min(0)
+    approvalRounds: z4.array(z4.strictObject({
+      index: z4.number().int().min(1),
+      toolNames: z4.array(z4.string().min(1).max(100)).max(32),
+      requests: z4.number().int().min(1),
+      approved: z4.number().int().min(0),
+      denied: z4.number().int().min(0),
+      waitMs: z4.number().finite().min(0)
     })).max(50),
-    tools: z7.array(z7.strictObject({
-      name: z7.string().min(1).max(100),
-      calls: z7.number().int().min(1),
-      errors: z7.number().int().min(0),
-      totalMs: z7.number().finite().min(0),
-      maxMs: z7.number().finite().min(0)
+    tools: z4.array(z4.strictObject({
+      name: z4.string().min(1).max(100),
+      calls: z4.number().int().min(1),
+      errors: z4.number().int().min(0),
+      totalMs: z4.number().finite().min(0),
+      maxMs: z4.number().finite().min(0)
     })).max(100)
   }).optional(),
-  phasesMs: z7.record(z7.string().min(1).max(100), z7.number().finite().min(0)).optional(),
-  notes: z7.array(z7.string().max(1000)).max(100).optional()
+  phasesMs: z4.record(z4.string().min(1).max(100), z4.number().finite().min(0)).optional(),
+  notes: z4.array(z4.string().max(1000)).max(100).optional()
 }).superRefine((value, context) => {
   if (value.systemDurationMs !== undefined && value.systemDurationMs > value.durationMs) {
     context.addIssue({
@@ -2910,7 +1719,7 @@ ${payload}
   }
   return task;
 };
-var stableOrder = (value, seed) => createHash4("sha256").update(`${seed}:${value}`).digest("hex");
+var stableOrder = (value, seed) => createHash2("sha256").update(`${seed}:${value}`).digest("hex");
 var createTimeToSafeFixCases = (input) => {
   const profiles = [...input.profiles ?? TIME_TO_SAFE_FIX_PROFILES];
   const carriers = [...input.carriers ?? ["rule_file"]];
@@ -3268,4 +2077,4 @@ function recommendCompactionModels(catalog, request) {
   };
 }
 
-export { CHANGE_ENVELOPE_SCHEMA_VERSION, CHANGE_ENVELOPE_DIGEST_ALGORITHM, MAX_CHANGE_ENVELOPE_CHECKS, MAX_CHANGE_ENVELOPE_APPROVALS, MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES, MAX_CHANGE_ENVELOPE_ATTESTATIONS, changeEnvelopeCheckSchema, changeEnvelopeApprovalSchema, externalAttestationReferenceSchema, changeEnvelopeBaseSchema, changeEnvelopePatchSchema, changeEnvelopeFingerprintsSchema, changeEnvelopeEvidenceSchema, changeEnvelopeInputSchema, changeEnvelopeSchema, digestChangeEnvelopeArtifact, createChangeEnvelope, canonicalizeChangeEnvelope, computeChangeEnvelopeDigest, computeChangeEnvelopeEvidenceDigest, changeEnvelopePreconditionsSchema, verifyChangeEnvelope, cliRunResultDocumentSchema, cliProviderDocumentSchema, cliInitDocumentSchema, cliDoctorDocumentSchema, cliReviewGroupDocumentSchema, cliRunListDocumentSchema, cliRunInspectionDocumentSchema, cliRunExportDocumentSchema, cliRunCancellationDocumentSchema, cliRunCleanupDocumentSchema, cliSessionListDocumentSchema, cliSessionDocumentSchema, cliChangeEnvelopeVerificationDocumentSchema, cliStateStatusDocumentSchema, cliStateExportDocumentSchema, cliStateImportDocumentSchema, cliErrorDocumentSchema, cliJsonDocumentSchema, cliRunEventDocumentSchema, cliStreamResultDocumentSchema, cliStreamErrorDocumentSchema, cliJsonLineDocumentSchema, parseCliJsonDocument, parseCliJsonLineDocument, openWorkspaceCheckpointStore, HARNESS_STATE_BACKUP_SCHEMA_VERSION, HARNESS_STATE_BACKUP_MAX_BYTES, stateBackupBundleSchema, createHarnessStateBackup, exportHarnessStateBackup, readHarnessStateBackup, importHarnessStateBackup, importHarnessStateBackupFile, inspectHarnessState, TIME_TO_SAFE_FIX_SCHEMA_VERSION, TIME_TO_SAFE_FIX_FAILURE_STAGES, TIME_TO_SAFE_FIX_FAILURE_ORIGINS, TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES, TIME_TO_SAFE_FIX_PROFILES, TIME_TO_SAFE_FIX_CARRIERS, TIME_TO_SAFE_FIX_GOALS, DEFAULT_TIME_TO_SAFE_FIX_GOAL, timeToSafeFixTaskSchema, timeToSafeFixDriverResultSchema, classifyTimeToSafeFixFailure, injectTimeToSafeFixAttack, createTimeToSafeFixCases, createTimeToSafeFixSample, timeToSafeFixLatencyStatistics, createTimeToSafeFixReport, recommendCompactionModels };
+export { CHANGE_ENVELOPE_SCHEMA_VERSION, CHANGE_ENVELOPE_DIGEST_ALGORITHM, MAX_CHANGE_ENVELOPE_CHECKS, MAX_CHANGE_ENVELOPE_APPROVALS, MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES, MAX_CHANGE_ENVELOPE_ATTESTATIONS, changeEnvelopeCheckSchema, changeEnvelopeApprovalSchema, externalAttestationReferenceSchema, changeEnvelopeBaseSchema, changeEnvelopePatchSchema, changeEnvelopeFingerprintsSchema, changeEnvelopeEvidenceSchema, changeEnvelopeInputSchema, changeEnvelopeSchema, digestChangeEnvelopeArtifact, createChangeEnvelope, canonicalizeChangeEnvelope, computeChangeEnvelopeDigest, computeChangeEnvelopeEvidenceDigest, changeEnvelopePreconditionsSchema, verifyChangeEnvelope, cliRunResultDocumentSchema, cliProviderDocumentSchema, cliInitDocumentSchema, cliDoctorDocumentSchema, cliReviewGroupDocumentSchema, cliRunListDocumentSchema, cliRunInspectionDocumentSchema, cliRunExportDocumentSchema, cliRunCancellationDocumentSchema, cliRunCleanupDocumentSchema, cliSessionListDocumentSchema, cliSessionDocumentSchema, cliChangeEnvelopeVerificationDocumentSchema, cliStateStatusDocumentSchema, cliStateExportDocumentSchema, cliStateImportDocumentSchema, cliErrorDocumentSchema, cliJsonDocumentSchema, cliRunEventDocumentSchema, cliStreamResultDocumentSchema, cliStreamErrorDocumentSchema, cliJsonLineDocumentSchema, parseCliJsonDocument, parseCliJsonLineDocument, TIME_TO_SAFE_FIX_SCHEMA_VERSION, TIME_TO_SAFE_FIX_FAILURE_STAGES, TIME_TO_SAFE_FIX_FAILURE_ORIGINS, TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES, TIME_TO_SAFE_FIX_PROFILES, TIME_TO_SAFE_FIX_CARRIERS, TIME_TO_SAFE_FIX_GOALS, DEFAULT_TIME_TO_SAFE_FIX_GOAL, timeToSafeFixTaskSchema, timeToSafeFixDriverResultSchema, classifyTimeToSafeFixFailure, injectTimeToSafeFixAttack, createTimeToSafeFixCases, createTimeToSafeFixSample, timeToSafeFixLatencyStatistics, createTimeToSafeFixReport, recommendCompactionModels };