blun-king-cli 9.1.616 → 9.1.618

package/worker-host.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// BLUN_BUILD_INPUT_SHA256:8034cba54fd011bf9ce255483d60f6d12f8cdb9862b405ccf424ae40ac14b7c5
+// BLUN_BUILD_INPUT_SHA256:136619430389be9d0388c81121dbf3721ce107f6a770cab9494fa3ffee3aade3
 import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';
 import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
@@ -12,6 +12,7 @@ import * as path$11 from "node:path";
 import path, { basename, dirname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path";
 import { Blob as Blob$1, File as File$1 } from "node:buffer";
 import fs, { access, appendFile, chmod, copyFile, cp, link, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as nodeOs from "node:os";
 import os, { arch, homedir, hostname, release, tmpdir, type, userInfo } from "node:os";
 import { execFile, execFileSync, spawn } from "node:child_process";
@@ -30,7 +31,6 @@ import en from "zlib";
 import { Buffer as Buffer$1 } from "buffer";
 import { ReadableStream as ReadableStream$1 } from "node:stream/web";
 import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
-import { AsyncLocalStorage } from "node:async_hooks";
 import * as posixPath from "node:path/posix";
 import * as win32Path from "node:path/win32";
 import { createServer } from "node:http";
@@ -10151,16 +10151,272 @@ function isPlainObject$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-//#region ../../packages/agent-core/src/session/writer-lease.ts
+//#region ../../packages/agent-core/src/config/resolve.ts
+const TRUE_BOOLEAN_ENV_VALUES = new Set([
+	"1",
+	"true",
+	"yes",
+	"on"
+]);
+const FALSE_BOOLEAN_ENV_VALUES = new Set([
+	"0",
+	"false",
+	"no",
+	"off"
+]);
+function resolveConfigValue(input) {
+	return input.parseEnv(input.env?.[input.envKey]) ?? input.configValue ?? input.defaultValue;
+}
+function parseBooleanEnv(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (normalized === void 0 || normalized.length === 0) return void 0;
+	if (TRUE_BOOLEAN_ENV_VALUES.has(normalized)) return true;
+	if (FALSE_BOOLEAN_ENV_VALUES.has(normalized)) return false;
+}
+/**
+* Parse a floating-point environment value (e.g. `BLUN_MODEL_TEMPERATURE`).
+* Returns `undefined` when unset/blank; throws `BlunError(CONFIG_INVALID)` on a
+* non-numeric value so a typo fails fast like the other `BLUN_MODEL_*` vars.
+* No range validation — callers pass values the upstream API accepts.
+*/
+function parseFloatEnv(value, varName) {
+	const trimmed = value?.trim();
+	if (trimmed === void 0 || trimmed.length === 0) return void 0;
+	const parsed = Number(trimmed);
+	if (!Number.isFinite(parsed)) throw new BlunError(ErrorCodes.CONFIG_INVALID, `${varName} must be a number, got "${value}".`);
+	return parsed;
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/env-model.ts
+/** Reserved keys for the env-driven synthetic provider / model alias. */
+const ENV_MODEL_PROVIDER_KEY = "__blun_env__";
+const ENV_MODEL_ALIAS_KEY = "__blun_env_model__";
+const DEFAULT_BASE_URL = "https://api.blun.ai/v1";
+/** Default context window (256K) used when BLUN_MODEL_MAX_CONTEXT_SIZE is unset. */
+const DEFAULT_MAX_CONTEXT_SIZE = 262144;
+/** Default capabilities when BLUN_MODEL_CAPABILITIES is unset (blun models support both). */
+const DEFAULT_CAPABILITIES = ["image_in", "thinking"];
+function trimmed(value) {
+	const t = value?.trim();
+	return t === void 0 || t.length === 0 ? void 0 : t;
+}
+function fail(message) {
+	throw new BlunError(ErrorCodes.CONFIG_INVALID, message);
+}
+function parsePositiveInt$1(raw, varName) {
+	if (!/^\d+$/.test(raw) || Number(raw) <= 0) fail(`${varName} must be a positive integer, got "${raw}".`);
+	return Number(raw);
+}
+function parseProviderType(raw) {
+	if (raw === void 0) return "blun";
+	if (raw.toLowerCase() !== "blun") fail(`BLUN_MODEL_PROVIDER_TYPE must be "blun", got "${raw}".`);
+	return "blun";
+}
+function parseCapabilities(raw) {
+	if (raw === void 0) return void 0;
+	const caps = raw.split(",").map((c) => c.trim().toLowerCase()).filter((c) => c.length > 0);
+	return caps.length === 0 ? void 0 : caps;
+}
+function parseBooleanVar(raw, varName) {
+	const value = trimmed(raw);
+	if (value === void 0) return void 0;
+	const parsed = parseBooleanEnv(value);
+	if (parsed === void 0) fail(`${varName} must be a boolean (true/false/1/0/yes/no/on/off), got "${raw}".`);
+	return parsed;
+}
+/**
+* When `BLUN_MODEL_NAME` is set, synthesize one provider + one model alias from
+* the `BLUN_MODEL_*` environment variables and make it the default model.
+* Returns the config unchanged when the trigger variable is absent.
+*
+* IMPORTANT: the synthesized provider/model/default_model exist ONLY in the
+* in-memory runtime config and must never be serialized back to config.toml.
+* Two layers enforce this: write paths read the raw config via `readConfigFile`,
+* and `writeConfigFile` strips the reserved entries via `stripEnvModelConfig` as
+* a final guard against patch round-trips (getConfig -> setConfig).
+*/
+function applyEnvModelConfig(config, env = process.env) {
+	const envRaw = (suffix) => env[`BLUN_MODEL_${suffix}`];
+	const model = trimmed(envRaw("NAME"));
+	if (model === void 0) return config;
+	const apiKey = trimmed(envRaw("API_KEY"));
+	if (apiKey === void 0) fail("BLUN_MODEL_NAME is set but BLUN_MODEL_API_KEY is missing.");
+	const maxContextRaw = trimmed(envRaw("MAX_CONTEXT_SIZE"));
+	const maxContextSize = maxContextRaw === void 0 ? DEFAULT_MAX_CONTEXT_SIZE : parsePositiveInt$1(maxContextRaw, "BLUN_MODEL_MAX_CONTEXT_SIZE");
+	const type = parseProviderType(trimmed(envRaw("PROVIDER_TYPE")));
+	const baseUrl = trimmed(envRaw("BASE_URL")) ?? DEFAULT_BASE_URL;
+	const provider = {
+		type,
+		apiKey,
+		...baseUrl !== void 0 ? { baseUrl } : {}
+	};
+	const maxOutputRaw = trimmed(envRaw("MAX_OUTPUT_SIZE"));
+	const maxOutputSize = maxOutputRaw !== void 0 ? parsePositiveInt$1(maxOutputRaw, "BLUN_MODEL_MAX_OUTPUT_SIZE") : void 0;
+	const capabilities = parseCapabilities(envRaw("CAPABILITIES")) ?? DEFAULT_CAPABILITIES;
+	const displayName = trimmed(envRaw("DISPLAY_NAME"));
+	const reasoningKey = trimmed(envRaw("REASONING_KEY"));
+	const adaptiveThinking = parseBooleanVar(envRaw("ADAPTIVE_THINKING"), "BLUN_MODEL_ADAPTIVE_THINKING");
+	const alias = {
+		provider: ENV_MODEL_PROVIDER_KEY,
+		model,
+		maxContextSize,
+		capabilities,
+		...displayName !== void 0 ? { displayName } : {},
+		...maxOutputSize !== void 0 ? { maxOutputSize } : {},
+		...reasoningKey !== void 0 ? { reasoningKey } : {},
+		...adaptiveThinking !== void 0 ? { adaptiveThinking } : {}
+	};
+	const thinkingEffort = trimmed(env["BLUN_MODEL_THINKING_EFFORT"]);
+	const thinking = thinkingEffort !== void 0 ? {
+		...config.thinking,
+		effort: thinkingEffort
+	} : config.thinking;
+	return validateConfig({
+		...config,
+		providers: {
+			...config.providers,
+			[ENV_MODEL_PROVIDER_KEY]: provider
+		},
+		models: {
+			...config.models,
+			[ENV_MODEL_ALIAS_KEY]: alias
+		},
+		defaultModel: ENV_MODEL_ALIAS_KEY,
+		...thinking !== void 0 ? { thinking } : {}
+	});
+}
+/**
+* Remove the env-synthesized provider/model before a config is persisted to
+* disk. Mirror of {@link applyEnvModelConfig}: that injects the reserved entries
+* into the in-memory runtime config; this guarantees they never reach
+* config.toml — including via a `getConfig` -> `setConfig` patch round-trip,
+* where the runtime config (carrying the env provider and its shell API key)
+* would otherwise be merged back and written out. Every env-injected top-level
+* field (default_model, thinking) is restored to its on-disk
+* value from `config.raw` rather than erased, so real values already in
+* config.toml survive the round-trip.
+*/
+function stripEnvModelConfig(config) {
+	const hasProvider = ENV_MODEL_PROVIDER_KEY in config.providers;
+	const hasModel = config.models !== void 0 && "__blun_env_model__" in config.models;
+	const defaultIsEnv = config.defaultModel === ENV_MODEL_ALIAS_KEY;
+	if (!hasProvider && !hasModel && !defaultIsEnv) return config;
+	const providers = { ...config.providers };
+	delete providers[ENV_MODEL_PROVIDER_KEY];
+	let models = config.models;
+	if (models !== void 0 && "__blun_env_model__" in models) {
+		models = { ...models };
+		delete models[ENV_MODEL_ALIAS_KEY];
+	}
+	return {
+		...config,
+		providers,
+		...models !== void 0 ? { models } : {},
+		...defaultIsEnv ? { defaultModel: rawDefaultModel(config) } : {},
+		thinking: rawThinking(config)
+	};
+}
+function rawDefaultModel(config) {
+	const raw = config.raw?.["default_model"];
+	return typeof raw === "string" ? raw : void 0;
+}
+function rawThinking(config) {
+	const raw = config.raw?.["thinking"];
+	return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : void 0;
+}
+//#endregion
+//#region ../../packages/oauth/src/errors.ts
+/**
+* OAuth error classes.
+*
+* All errors derive from {@link OAuthError}. Distinguishing subclasses let
+* callers react appropriately:
+*  - `OAuthUnauthorizedError`: 401/403 from token endpoint → refresh_token
+*    or credentials are bad; drive user through `/login` again.
+*  - `OAuthConnectionError`: transport-level OAuth request failure; callers
+*    may retry the operation.
+*  - `DeviceCodeExpiredError`: device_code TTL ran out before user approved;
+*    restart the device flow.
+*  - `DeviceCodeTimeoutError`: local 15 min wall-clock budget exhausted
+*    before the user completed approval.
+*  - `RetryableRefreshError`: 429 / 5xx from token endpoint; the refresh
+*    helper retries with exponential backoff before surfacing this.
+*/
+var OAuthError$1 = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OAuthError";
+	}
+};
+var OAuthUnauthorizedError = class extends OAuthError$1 {
+	constructor(message) {
+		super(message);
+		this.name = "OAuthUnauthorizedError";
+	}
+};
+var OAuthConnectionError = class extends OAuthError$1 {
+	constructor(message) {
+		super(message);
+		this.name = "OAuthConnectionError";
+	}
+};
+var DeviceCodeTimeoutError = class extends OAuthError$1 {
+	constructor(message = "Device authorization timed out locally.") {
+		super(message);
+		this.name = "DeviceCodeTimeoutError";
+	}
+};
+var RetryableRefreshError = class extends OAuthError$1 {
+	constructor(message) {
+		super(message);
+		this.name = "RetryableRefreshError";
+	}
+};
+//#endregion
+//#region ../../packages/oauth/src/types.ts
+function tokenToWire(token) {
+	return {
+		access_token: token.accessToken,
+		refresh_token: token.refreshToken,
+		expires_at: token.expiresAt,
+		scope: token.scope,
+		token_type: token.tokenType,
+		expires_in: token.expiresIn,
+		...token.memoryWorkspaceId === void 0 ? {} : { memory_workspace_id: token.memoryWorkspaceId }
+	};
+}
+function tokenFromWire(wire) {
+	return {
+		accessToken: wire.access_token ?? "",
+		refreshToken: wire.refresh_token ?? "",
+		expiresAt: typeof wire.expires_at === "number" ? wire.expires_at : 0,
+		scope: wire.scope ?? "",
+		tokenType: wire.token_type ?? "",
+		expiresIn: typeof wire.expires_in === "number" ? wire.expires_in : 0,
+		...typeof wire.memory_workspace_id === "string" && wire.memory_workspace_id.length > 0 ? { memoryWorkspaceId: wire.memory_workspace_id } : {}
+	};
+}
+//#endregion
+//#region ../../packages/oauth/src/private-path-writer.ts
+var PrivatePathWriterError = class extends Error {
+	failure;
+	code;
+	constructor(failure, cause) {
+		super(`Private path writer ownership ${failure}`, { cause });
+		this.failure = failure;
+		this.name = "PrivatePathWriterError";
+		this.code = `private.writer_${failure}`;
+	}
+};
 const markerPattern = /^owner-([0-9a-f-]{36})\.json$/;
 function codeOf(error) {
 	return error?.code;
 }
 function unavailable(cause) {
-	return new BlunError(ErrorCodes.SESSION_WRITER_UNAVAILABLE, "Session writer ownership could not be verified", { cause });
+	return new PrivatePathWriterError("unavailable", cause);
 }
 /** Resolve aliases without opening a replaceable file before its writer is owned. */
-async function canonicalWriterPath(target) {
+async function canonicalPrivateWriterPath(target) {
 	let path = resolve(target);
 	for (let depth = 0; depth < 40; depth += 1) {
 		await mkdir(dirname(path), {
@@ -10258,7 +10514,7 @@ async function reclaimDeadOwner(lockDirectory) {
 				await removeEmptyDirectory(lockDirectory);
 				return;
 			}
-			throw new BlunError(ErrorCodes.SESSION_WRITER_BUSY, "This session is already open for writing");
+			throw new PrivatePathWriterError("busy");
 		}
 		await removeEmptyDirectory(lockDirectory);
 	} catch (error) {
@@ -10266,14 +10522,14 @@ async function reclaimDeadOwner(lockDirectory) {
 	}
 }
 /** A local-host writer claim. It never expires based on age or missed heartbeats. */
-async function acquireSessionWriter(sessionDirectory, options = {}) {
+async function acquirePrivatePathWriter(targetPath, options = {}) {
 	const waitForBusyMs = options.waitForBusyMs ?? 0;
 	if (!Number.isFinite(waitForBusyMs) || waitForBusyMs < 0 || waitForBusyMs > 5e3) throw new RangeError("Writer contention budget must be between 0 and 5000 milliseconds");
 	const deadline = performance.now() + waitForBusyMs;
 	let staged;
 	let name;
 	try {
-		const canonical = await canonicalWriterPath(sessionDirectory);
+		const canonical = await canonicalPrivateWriterPath(targetPath);
 		const lockDirectory = join(dirname(canonical), `@writer-${basename(canonical)}`);
 		const ownerId = randomUUID();
 		name = `owner-${ownerId}.json`;
@@ -10302,7 +10558,7 @@ async function acquireSessionWriter(sessionDirectory, options = {}) {
 				try {
 					await reclaimDeadOwner(lockDirectory);
 				} catch (ownershipError) {
-					if (!(ownershipError instanceof BlunError) || ownershipError.code !== ErrorCodes.SESSION_WRITER_BUSY) throw ownershipError;
+					if (!(ownershipError instanceof PrivatePathWriterError) || ownershipError.failure !== "busy") throw ownershipError;
 					const remaining = deadline - performance.now();
 					if (waitForBusyMs === 0 || remaining <= 0) throw ownershipError;
 					await new Promise((resolve) => {
@@ -10318,10 +10574,11 @@ async function acquireSessionWriter(sessionDirectory, options = {}) {
 			let releasing;
 			const assertOwned = async () => {
 				const current = await readOwner(lockDirectory).catch(() => void 0);
-				if (released || current?.record.ownerId !== ownerId || current.record.pid !== process.pid) throw new BlunError(ErrorCodes.SESSION_WRITER_LOST, "Session writer ownership was lost");
+				if (released || current?.record.ownerId !== ownerId || current.record.pid !== process.pid) throw new PrivatePathWriterError("lost");
 			};
 			return {
 				lockDirectory,
+				canonicalPath: canonical,
 				assertOwned,
 				release() {
 					releasing ??= (async () => {
@@ -10335,7 +10592,7 @@ async function acquireSessionWriter(sessionDirectory, options = {}) {
 			};
 		}
 	} catch (error) {
-		if (error instanceof BlunError) throw error;
+		if (error instanceof PrivatePathWriterError) throw error;
 		throw unavailable(error);
 	} finally {
 		if (staged !== void 0 && name !== void 0) {
@@ -10347,78 +10604,6 @@ async function acquireSessionWriter(sessionDirectory, options = {}) {
 	}
 }
 //#endregion
-//#region ../../packages/oauth/src/errors.ts
-/**
-* OAuth error classes.
-*
-* All errors derive from {@link OAuthError}. Distinguishing subclasses let
-* callers react appropriately:
-*  - `OAuthUnauthorizedError`: 401/403 from token endpoint → refresh_token
-*    or credentials are bad; drive user through `/login` again.
-*  - `OAuthConnectionError`: transport-level OAuth request failure; callers
-*    may retry the operation.
-*  - `DeviceCodeExpiredError`: device_code TTL ran out before user approved;
-*    restart the device flow.
-*  - `DeviceCodeTimeoutError`: local 15 min wall-clock budget exhausted
-*    before the user completed approval.
-*  - `RetryableRefreshError`: 429 / 5xx from token endpoint; the refresh
-*    helper retries with exponential backoff before surfacing this.
-*/
-var OAuthError$1 = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "OAuthError";
-	}
-};
-var OAuthUnauthorizedError = class extends OAuthError$1 {
-	constructor(message) {
-		super(message);
-		this.name = "OAuthUnauthorizedError";
-	}
-};
-var OAuthConnectionError = class extends OAuthError$1 {
-	constructor(message) {
-		super(message);
-		this.name = "OAuthConnectionError";
-	}
-};
-var DeviceCodeTimeoutError = class extends OAuthError$1 {
-	constructor(message = "Device authorization timed out locally.") {
-		super(message);
-		this.name = "DeviceCodeTimeoutError";
-	}
-};
-var RetryableRefreshError = class extends OAuthError$1 {
-	constructor(message) {
-		super(message);
-		this.name = "RetryableRefreshError";
-	}
-};
-//#endregion
-//#region ../../packages/oauth/src/types.ts
-function tokenToWire(token) {
-	return {
-		access_token: token.accessToken,
-		refresh_token: token.refreshToken,
-		expires_at: token.expiresAt,
-		scope: token.scope,
-		token_type: token.tokenType,
-		expires_in: token.expiresIn,
-		...token.memoryWorkspaceId === void 0 ? {} : { memory_workspace_id: token.memoryWorkspaceId }
-	};
-}
-function tokenFromWire(wire) {
-	return {
-		accessToken: wire.access_token ?? "",
-		refreshToken: wire.refresh_token ?? "",
-		expiresAt: typeof wire.expires_at === "number" ? wire.expires_at : 0,
-		scope: wire.scope ?? "",
-		tokenType: wire.token_type ?? "",
-		expiresIn: typeof wire.expires_in === "number" ? wire.expires_in : 0,
-		...typeof wire.memory_workspace_id === "string" && wire.memory_workspace_id.length > 0 ? { memoryWorkspaceId: wire.memory_workspace_id } : {}
-	};
-}
-//#endregion
 //#region ../../packages/oauth/src/utils.ts
 function isRecord$9(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -10943,24 +11128,35 @@ var FileTokenStorage = class {
 			systemDirectory: options.windowsSystemDirectory
 		}) : void 0;
 	}
-	ensureDir() {
-		mkdirSync(this.dir, {
+	async withWriter(operation) {
+		const writer = await acquirePrivatePathWriter(this.dir, { waitForBusyMs: 5e3 });
+		try {
+			await writer.assertOwned();
+			if (await canonicalPrivateWriterPath(this.dir) !== writer.canonicalPath) throw new PrivatePathWriterError("lost");
+			await writer.assertOwned();
+			return await operation(writer.canonicalPath);
+		} finally {
+			await writer.release();
+		}
+	}
+	ensureDir(directory) {
+		mkdirSync(directory, {
 			recursive: true,
 			mode: 448
 		});
 		if (this.platform === "win32") {
-			this.windowsAcl.hardenAndVerify(this.dir, "directory");
+			this.windowsAcl.hardenAndVerify(directory, "directory");
 			return;
 		}
-		chmodSync(this.dir, 448);
+		chmodSync(directory, 448);
 	}
-	pathFor(name) {
+	pathFor(name, directory = this.dir) {
 		const safe = basename(name);
 		const invalidWindowsName = this.platform === "win32" && (safe.includes(":") || safe.endsWith(".") || safe.endsWith(" "));
 		if (safe.length === 0 || safe !== name || safe.startsWith(".") || invalidWindowsName) throw new Error(`Invalid token name: "${name}"`);
-		return join(this.dir, `${safe}.json`);
+		return join(directory, `${safe}.json`);
 	}
-	hardenExistingFileForLoad(file) {
+	hardenExistingFileForLoad(file, directory) {
 		try {
 			statSync(file);
 		} catch (error) {
@@ -10968,17 +11164,21 @@ var FileTokenStorage = class {
 			throw error;
 		}
 		if (this.platform === "win32") {
-			this.windowsAcl.hardenAndVerify(this.dir, "directory");
+			this.windowsAcl.hardenAndVerify(directory, "directory");
 			this.windowsAcl.hardenAndVerify(file, "file");
 		} else {
-			chmodSync(this.dir, 448);
+			chmodSync(directory, 448);
 			chmodSync(file, 384);
 		}
 		return true;
 	}
 	async load(name) {
-		const file = this.pathFor(name);
-		if (!this.hardenExistingFileForLoad(file)) return void 0;
+		this.pathFor(name);
+		return this.withWriter((directory) => this.loadOwned(name, directory));
+	}
+	loadOwned(name, directory) {
+		const file = this.pathFor(name, directory);
+		if (!this.hardenExistingFileForLoad(file, directory)) return void 0;
 		let raw;
 		try {
 			raw = readFileSync(file, "utf-8");
@@ -10996,8 +11196,12 @@ var FileTokenStorage = class {
 		return tokenFromWire(parsed);
 	}
 	async save(name, token) {
-		const target = this.pathFor(name);
-		this.ensureDir();
+		this.pathFor(name);
+		return this.withWriter((directory) => this.saveOwned(name, token, directory));
+	}
+	saveOwned(name, token, directory) {
+		const target = this.pathFor(name, directory);
+		this.ensureDir(directory);
 		const tmp = `${target}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
 		const rollback = `${target}.rollback.${process.pid}.${randomBytes(4).toString("hex")}`;
 		const data = Buffer.from(`${JSON.stringify(tokenToWire(token), null, 2)}\n`, "utf-8");
@@ -11059,16 +11263,23 @@ var FileTokenStorage = class {
 		}
 	}
 	async remove(name) {
+		this.pathFor(name);
+		return this.withWriter((directory) => this.removeOwned(name, directory));
+	}
+	removeOwned(name, directory) {
 		try {
-			unlinkSync(this.pathFor(name));
+			unlinkSync(this.pathFor(name, directory));
 		} catch (error) {
 			if (error.code !== "ENOENT") throw error;
 		}
 	}
 	async list() {
+		return this.withWriter((directory) => this.listOwned(directory));
+	}
+	listOwned(directory) {
 		let entries;
 		try {
-			entries = readdirSync(this.dir);
+			entries = readdirSync(directory);
 		} catch {
 			return [];
 		}
@@ -12932,7 +13143,9 @@ var OAuthManager = class {
 	async login(options = {}) {
 		const deadlineAt = this.now() + Math.ceil(this.deviceCodeTimeoutMs / 1e3);
 		while (true) {
+			this.throwIfAborted(options.signal);
 			const auth = await this.requestImpl(this.config);
+			this.throwIfAborted(options.signal);
 			await options.onDeviceCode?.(auth);
 			let currentInterval = Math.max(auth.interval, 1);
 			let deviceExpired = false;
@@ -12940,9 +13153,11 @@ var OAuthManager = class {
 				this.throwIfAborted(options.signal);
 				if (this.now() >= deadlineAt) throw new DeviceCodeTimeoutError(`Device authorization timed out after ${Math.ceil(this.deviceCodeTimeoutMs / 1e3)}s`);
 				const result = await this.pollImpl(this.config, auth.deviceCode);
+				this.throwIfAborted(options.signal);
 				if (result.kind === "success") {
 					const release = await this.acquireRefreshLock();
 					try {
+						this.throwIfAborted(options.signal);
 						await this.storage.save(this.config.name, result.token);
 					} finally {
 						await release();
@@ -14783,6 +14998,43 @@ async function refreshProviderModels(host, options = {}) {
 	};
 }
 //#endregion
+//#region ../../packages/agent-core/src/session/writer-lease.ts
+const canonicalWriterPath = canonicalPrivateWriterPath;
+function sessionError(error) {
+	if (!(error instanceof PrivatePathWriterError)) return error;
+	const [code, message] = {
+		busy: [ErrorCodes.SESSION_WRITER_BUSY, "This session is already open for writing"],
+		lost: [ErrorCodes.SESSION_WRITER_LOST, "Session writer ownership was lost"],
+		unavailable: [ErrorCodes.SESSION_WRITER_UNAVAILABLE, "Session writer ownership could not be verified"]
+	}[error.failure];
+	return new BlunError(code, message, { cause: error.cause });
+}
+/** Keep the Core API and diagnostics while sharing the native writer protocol. */
+async function acquireSessionWriter(sessionDirectory, options = {}) {
+	try {
+		const lease = await acquirePrivatePathWriter(sessionDirectory, options);
+		let releasing;
+		return {
+			lockDirectory: lease.lockDirectory,
+			async assertOwned() {
+				try {
+					await lease.assertOwned();
+				} catch (error) {
+					throw sessionError(error);
+				}
+			},
+			release() {
+				releasing ??= lease.release().catch((error) => {
+					throw sessionError(error);
+				});
+				return releasing;
+			}
+		};
+	} catch (error) {
+		throw sessionError(error);
+	}
+}
+//#endregion
 //#region ../../packages/agent-core/src/utils/fs.ts
 /**
 * Low-level POSIX durability primitives.
@@ -14945,178 +15197,110 @@ async function atomicWriteWithMode(filePath, content, syncOverride, renameOverri
 	}
 }
 //#endregion
-//#region ../../packages/agent-core/src/config/resolve.ts
-const TRUE_BOOLEAN_ENV_VALUES = new Set([
-	"1",
-	"true",
-	"yes",
-	"on"
-]);
-const FALSE_BOOLEAN_ENV_VALUES = new Set([
-	"0",
-	"false",
-	"no",
-	"off"
-]);
-function resolveConfigValue(input) {
-	return input.parseEnv(input.env?.[input.envKey]) ?? input.configValue ?? input.defaultValue;
-}
-function parseBooleanEnv(value) {
-	const normalized = value?.trim().toLowerCase();
-	if (normalized === void 0 || normalized.length === 0) return void 0;
-	if (TRUE_BOOLEAN_ENV_VALUES.has(normalized)) return true;
-	if (FALSE_BOOLEAN_ENV_VALUES.has(normalized)) return false;
-}
-/**
-* Parse a floating-point environment value (e.g. `BLUN_MODEL_TEMPERATURE`).
-* Returns `undefined` when unset/blank; throws `BlunError(CONFIG_INVALID)` on a
-* non-numeric value so a typo fails fast like the other `BLUN_MODEL_*` vars.
-* No range validation — callers pass values the upstream API accepts.
-*/
-function parseFloatEnv(value, varName) {
-	const trimmed = value?.trim();
-	if (trimmed === void 0 || trimmed.length === 0) return void 0;
-	const parsed = Number(trimmed);
-	if (!Number.isFinite(parsed)) throw new BlunError(ErrorCodes.CONFIG_INVALID, `${varName} must be a number, got "${value}".`);
-	return parsed;
-}
-//#endregion
-//#region ../../packages/agent-core/src/config/env-model.ts
-/** Reserved keys for the env-driven synthetic provider / model alias. */
-const ENV_MODEL_PROVIDER_KEY = "__blun_env__";
-const ENV_MODEL_ALIAS_KEY = "__blun_env_model__";
-const DEFAULT_BASE_URL = "https://api.blun.ai/v1";
-/** Default context window (256K) used when BLUN_MODEL_MAX_CONTEXT_SIZE is unset. */
-const DEFAULT_MAX_CONTEXT_SIZE = 262144;
-/** Default capabilities when BLUN_MODEL_CAPABILITIES is unset (blun models support both). */
-const DEFAULT_CAPABILITIES = ["image_in", "thinking"];
-function trimmed(value) {
-	const t = value?.trim();
-	return t === void 0 || t.length === 0 ? void 0 : t;
-}
-function fail(message) {
-	throw new BlunError(ErrorCodes.CONFIG_INVALID, message);
-}
-function parsePositiveInt$1(raw, varName) {
-	if (!/^\d+$/.test(raw) || Number(raw) <= 0) fail(`${varName} must be a positive integer, got "${raw}".`);
-	return Number(raw);
+//#region ../../packages/agent-core/src/config/write-ownership.ts
+const writeScope = new AsyncLocalStorage();
+async function canonicalConfigPath(filePath, options) {
+	const absolute = resolve(filePath);
+	if (await mkdir(dirname(absolute), {
+		recursive: true,
+		mode: 448
+	}) !== void 0) await hardenPrivatePath(options === void 0 ? dirname(absolute) : dirname$3(filePath), "directory", options);
+	return canonicalWriterPath(absolute);
 }
-function parseProviderType(raw) {
-	if (raw === void 0) return "blun";
-	if (raw.toLowerCase() !== "blun") fail(`BLUN_MODEL_PROVIDER_TYPE must be "blun", got "${raw}".`);
-	return "blun";
+function samePath(a, b) {
+	return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
-function parseCapabilities(raw) {
-	if (raw === void 0) return void 0;
-	const caps = raw.split(",").map((c) => c.trim().toLowerCase()).filter((c) => c.length > 0);
-	return caps.length === 0 ? void 0 : caps;
+function configWriterError(error) {
+	if (error instanceof BlunError && error.code.startsWith("session.writer_")) return new BlunError(ErrorCodes.CONFIG_WRITE_UNAVAILABLE, "Configuration writer ownership could not be verified", { cause: error });
+	return error;
 }
-function parseBooleanVar(raw, varName) {
-	const value = trimmed(raw);
-	if (value === void 0) return void 0;
-	const parsed = parseBooleanEnv(value);
-	if (parsed === void 0) fail(`${varName} must be a boolean (true/false/1/0/yes/no/on/off), got "${raw}".`);
-	return parsed;
+async function acquireConfigWriter(filePath) {
+	try {
+		return await acquireSessionWriter(filePath, { waitForBusyMs: 5e3 });
+	} catch (error) {
+		if (!(error instanceof BlunError) || error.code !== ErrorCodes.SESSION_WRITER_BUSY) throw error;
+		throw new BlunError(ErrorCodes.CONFIG_WRITE_BUSY, "Another configuration change is still being saved", { cause: error });
+	}
 }
-/**
-* When `BLUN_MODEL_NAME` is set, synthesize one provider + one model alias from
-* the `BLUN_MODEL_*` environment variables and make it the default model.
-* Returns the config unchanged when the trigger variable is absent.
-*
-* IMPORTANT: the synthesized provider/model/default_model exist ONLY in the
-* in-memory runtime config and must never be serialized back to config.toml.
-* Two layers enforce this: write paths read the raw config via `readConfigFile`,
-* and `writeConfigFile` strips the reserved entries via `stripEnvModelConfig` as
-* a final guard against patch round-trips (getConfig -> setConfig).
-*/
-function applyEnvModelConfig(config, env = process.env) {
-	const envRaw = (suffix) => env[`BLUN_MODEL_${suffix}`];
-	const model = trimmed(envRaw("NAME"));
-	if (model === void 0) return config;
-	const apiKey = trimmed(envRaw("API_KEY"));
-	if (apiKey === void 0) fail("BLUN_MODEL_NAME is set but BLUN_MODEL_API_KEY is missing.");
-	const maxContextRaw = trimmed(envRaw("MAX_CONTEXT_SIZE"));
-	const maxContextSize = maxContextRaw === void 0 ? DEFAULT_MAX_CONTEXT_SIZE : parsePositiveInt$1(maxContextRaw, "BLUN_MODEL_MAX_CONTEXT_SIZE");
-	const type = parseProviderType(trimmed(envRaw("PROVIDER_TYPE")));
-	const baseUrl = trimmed(envRaw("BASE_URL")) ?? DEFAULT_BASE_URL;
-	const provider = {
-		type,
-		apiKey,
-		...baseUrl !== void 0 ? { baseUrl } : {}
-	};
-	const maxOutputRaw = trimmed(envRaw("MAX_OUTPUT_SIZE"));
-	const maxOutputSize = maxOutputRaw !== void 0 ? parsePositiveInt$1(maxOutputRaw, "BLUN_MODEL_MAX_OUTPUT_SIZE") : void 0;
-	const capabilities = parseCapabilities(envRaw("CAPABILITIES")) ?? DEFAULT_CAPABILITIES;
-	const displayName = trimmed(envRaw("DISPLAY_NAME"));
-	const reasoningKey = trimmed(envRaw("REASONING_KEY"));
-	const adaptiveThinking = parseBooleanVar(envRaw("ADAPTIVE_THINKING"), "BLUN_MODEL_ADAPTIVE_THINKING");
-	const alias = {
-		provider: ENV_MODEL_PROVIDER_KEY,
-		model,
-		maxContextSize,
-		capabilities,
-		...displayName !== void 0 ? { displayName } : {},
-		...maxOutputSize !== void 0 ? { maxOutputSize } : {},
-		...reasoningKey !== void 0 ? { reasoningKey } : {},
-		...adaptiveThinking !== void 0 ? { adaptiveThinking } : {}
-	};
-	const thinkingEffort = trimmed(env["BLUN_MODEL_THINKING_EFFORT"]);
-	const thinking = thinkingEffort !== void 0 ? {
-		...config.thinking,
-		effort: thinkingEffort
-	} : config.thinking;
-	return validateConfig({
-		...config,
-		providers: {
-			...config.providers,
-			[ENV_MODEL_PROVIDER_KEY]: provider
-		},
-		models: {
-			...config.models,
-			[ENV_MODEL_ALIAS_KEY]: alias
-		},
-		defaultModel: ENV_MODEL_ALIAS_KEY,
-		...thinking !== void 0 ? { thinking } : {}
-	});
+/** The public atomic writer inherits only its enclosing mutation's native claim. */
+async function withConfigAtomicWrite(filePath, operation, options) {
+	const inherited = writeScope.getStore();
+	if (inherited?.active) {
+		const canonical = await canonicalConfigPath(filePath, options);
+		if (samePath(canonical, inherited.path)) {
+			await inherited.writer.assertOwned();
+			if (inherited.active) return operation(canonical);
+		}
+	}
+	return withConfigWriter(filePath, (canonical) => operation(canonical), options);
 }
-/**
-* Remove the env-synthesized provider/model before a config is persisted to
-* disk. Mirror of {@link applyEnvModelConfig}: that injects the reserved entries
-* into the in-memory runtime config; this guarantees they never reach
-* config.toml — including via a `getConfig` -> `setConfig` patch round-trip,
-* where the runtime config (carrying the env provider and its shell API key)
-* would otherwise be merged back and written out. Every env-injected top-level
-* field (default_model, thinking) is restored to its on-disk
-* value from `config.raw` rather than erased, so real values already in
-* config.toml survive the round-trip.
-*/
-function stripEnvModelConfig(config) {
-	const hasProvider = ENV_MODEL_PROVIDER_KEY in config.providers;
-	const hasModel = config.models !== void 0 && "__blun_env_model__" in config.models;
-	const defaultIsEnv = config.defaultModel === ENV_MODEL_ALIAS_KEY;
-	if (!hasProvider && !hasModel && !defaultIsEnv) return config;
-	const providers = { ...config.providers };
-	delete providers[ENV_MODEL_PROVIDER_KEY];
-	let models = config.models;
-	if (models !== void 0 && "__blun_env_model__" in models) {
-		models = { ...models };
-		delete models[ENV_MODEL_ALIAS_KEY];
+async function withConfigWriter(filePath, operation, options) {
+	const canonical = await canonicalConfigPath(filePath, options);
+	try {
+		const writer = await acquireConfigWriter(canonical);
+		const scope = {
+			path: canonical,
+			writer,
+			active: true
+		};
+		try {
+			return await writeScope.run(scope, () => operation(canonical, writer));
+		} finally {
+			scope.active = false;
+			await writer.release();
+		}
+	} catch (error) {
+		throw configWriterError(error);
 	}
-	return {
-		...config,
-		providers,
-		...models !== void 0 ? { models } : {},
-		...defaultIsEnv ? { defaultModel: rawDefaultModel(config) } : {},
-		thinking: rawThinking(config)
-	};
 }
-function rawDefaultModel(config) {
-	const raw = config.raw?.["default_model"];
-	return typeof raw === "string" ? raw : void 0;
+async function configBytes(file) {
+	try {
+		return await readFile(file);
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
 }
-function rawThinking(config) {
-	const raw = config.raw?.["thinking"];
-	return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : void 0;
+/** Claim the existing writer immediately; busy/unknown ownership is not idle. */
+async function tryReserveConfigIdleAdmission(filePath) {
+	let writer;
+	let retained = false;
+	try {
+		const canonical = await canonicalConfigPath(filePath);
+		writer = await acquireSessionWriter(canonical);
+		const owned = writer;
+		await owned.assertOwned();
+		const snapshot = await configBytes(canonical);
+		let live = true;
+		let releasing;
+		const isValid = async () => {
+			if (!live) return false;
+			try {
+				await owned.assertOwned();
+				const current = await configBytes(canonical);
+				const alias = await canonicalConfigPath(filePath);
+				await owned.assertOwned();
+				live = live && samePath(alias, canonical) && (snapshot === void 0 ? current === void 0 : current !== void 0 && snapshot.equals(current));
+			} catch {
+				live = false;
+			}
+			return live;
+		};
+		if (!await isValid()) return void 0;
+		retained = true;
+		return {
+			isValid,
+			release: () => {
+				live = false;
+				releasing ??= owned.release();
+				return releasing;
+			}
+		};
+	} catch {
+		return;
+	} finally {
+		if (!retained && writer) await writer.release();
+	}
 }
 //#endregion
 //#region ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
@@ -16027,32 +16211,35 @@ const DEFAULT_CONFIG_FILE_TEXT = `# BLUN runtime config (config.toml)
 # Login will populate managed BLUN provider and model entries.
 `;
 async function ensureConfigFile(filePath, privatePathOptions = {}) {
-	const configDirectory = dirname$3(filePath);
-	if (await mkdir(configDirectory, {
-		recursive: true,
-		mode: 448
-	}) !== void 0) await hardenPrivatePath(configDirectory, "directory", privatePathOptions);
-	let handle;
-	let created = false;
-	try {
-		handle = await open(filePath, "wx", 384);
-		created = true;
-		await hardenPrivatePath(filePath, "file", privatePathOptions);
-		await handle.writeFile(DEFAULT_CONFIG_FILE_TEXT, "utf-8");
-	} catch (error) {
-		if (isFileExistsError(error)) {
-			await hardenPrivatePath(filePath, "file", privatePathOptions);
-			return;
-		}
-		if (created) {
-			await handle?.close().catch(() => {});
-			handle = void 0;
-			await unlink(filePath).catch(() => {});
+	return withConfigAtomicWrite(filePath, async (canonical) => {
+		const target = normalize$3(resolve$2(filePath)) === normalize$3(canonical) ? filePath : canonical;
+		const configDirectory = dirname$3(target);
+		if (await mkdir(configDirectory, {
+			recursive: true,
+			mode: 448
+		}) !== void 0) await hardenPrivatePath(configDirectory, "directory", privatePathOptions);
+		let handle;
+		let created = false;
+		try {
+			handle = await open(target, "wx", 384);
+			created = true;
+			await hardenPrivatePath(target, "file", privatePathOptions);
+			await handle.writeFile(DEFAULT_CONFIG_FILE_TEXT, "utf-8");
+		} catch (error) {
+			if (isFileExistsError(error)) {
+				await hardenPrivatePath(target, "file", privatePathOptions);
+				return;
+			}
+			if (created) {
+				await handle?.close().catch(() => {});
+				handle = void 0;
+				await unlink(target).catch(() => {});
+			}
+			throw error;
+		} finally {
+			await handle?.close();
 		}
-		throw error;
-	} finally {
-		await handle?.close();
-	}
+	}, privatePathOptions);
 }
 function readConfigFile(filePath) {
 	if (!existsSync(filePath)) return getDefaultConfig();
@@ -16285,13 +16472,15 @@ function transformLoopControlData(data) {
 	return out;
 }
 async function writeConfigFile(filePath, config) {
-	const validated = validateConfig(stripEnvModelConfig(config));
-	const configDirectory = dirname$3(filePath);
-	if (await mkdir(configDirectory, {
-		recursive: true,
-		mode: 448
-	}) !== void 0) await hardenPrivatePath(configDirectory, "directory");
-	await atomicWritePrivate(filePath, `${stringify$1(configToTomlData(validated))}\n`);
+	return withConfigAtomicWrite(filePath, async (canonical) => {
+		const validated = validateConfig(stripEnvModelConfig(config));
+		const configDirectory = dirname$3(canonical);
+		if (await mkdir(configDirectory, {
+			recursive: true,
+			mode: 448
+		}) !== void 0) await hardenPrivatePath(configDirectory, "directory");
+		await atomicWritePrivate(canonical, `${stringify$1(configToTomlData(validated))}\n`);
+	});
 }
 function configToTomlData(config) {
 	const out = cloneRecord$1(config.raw);
@@ -16485,54 +16674,26 @@ function isFileExistsError(error) {
 }
 //#endregion
 //#region ../../packages/agent-core/src/config/mutate.ts
-async function canonicalConfigPath(filePath) {
-	const absolute = resolve(filePath);
-	if (await mkdir(dirname(absolute), {
-		recursive: true,
-		mode: 448
-	}) !== void 0) await hardenPrivatePath(dirname(absolute), "directory");
-	return canonicalWriterPath(absolute);
-}
-function configWriterError(error) {
-	if (error instanceof BlunError && error.code.startsWith("session.writer_")) return new BlunError(ErrorCodes.CONFIG_WRITE_UNAVAILABLE, "Configuration writer ownership could not be verified", { cause: error });
-	return error;
-}
-async function acquireConfigWriter(filePath) {
-	try {
-		return await acquireSessionWriter(filePath, { waitForBusyMs: 5e3 });
-	} catch (error) {
-		if (!(error instanceof BlunError) || error.code !== ErrorCodes.SESSION_WRITER_BUSY) throw error;
-		throw new BlunError(ErrorCodes.CONFIG_WRITE_BUSY, "Another configuration change is still being saved", { cause: error });
-	}
-}
 /** Keep transforms synchronous; credential validation and discovery belong before this boundary. */
 async function mutateConfigFile(filePath, transform) {
-	const canonical = await canonicalConfigPath(filePath);
-	try {
-		const writer = await acquireConfigWriter(canonical);
-		try {
+	return withConfigWriter(filePath, async (canonical, writer) => {
+		await writer.assertOwned();
+		const { config, result } = transform(readConfigFileForUpdate(canonical));
+		for (let attempt = 0;; attempt += 1) {
 			await writer.assertOwned();
-			const { config, result } = transform(readConfigFileForUpdate(canonical));
-			for (let attempt = 0;; attempt += 1) {
-				await writer.assertOwned();
-				try {
-					await writeConfigFile(canonical, config);
-					break;
-				} catch (error) {
-					const failure = error;
-					if (process.platform !== "win32" || attempt >= 9 || failure?.code !== "EPERM" || failure.syscall !== "rename" || typeof failure.dest !== "string" || resolve(failure.dest) !== canonical) throw error;
-					await new Promise((resolve) => {
-						setTimeout(resolve, 25);
-					});
-				}
+			try {
+				await writeConfigFile(canonical, config);
+				break;
+			} catch (error) {
+				const failure = error;
+				if (process.platform !== "win32" || attempt >= 9 || failure?.code !== "EPERM" || failure.syscall !== "rename" || typeof failure.dest !== "string" || resolve(failure.dest) !== canonical) throw error;
+				await new Promise((resolve) => {
+					setTimeout(resolve, 25);
+				});
 			}
-			return result;
-		} finally {
-			await writer.release();
 		}
-	} catch (error) {
-		throw configWriterError(error);
-	}
+		return result;
+	});
 }
 //#endregion
 //#region ../../packages/agent-core/src/config/model.ts
@@ -29294,6 +29455,156 @@ function resettableTimeoutOutcome(initialMs, outcome) {
 	});
 }
 //#endregion
+//#region ../../packages/agent-core/src/utils/quiescence.ts
+/** A reservation can release only itself; permanent shutdown always wins. */
+var AdmissionGate = class {
+	state = null;
+	get closed() {
+		return this.state !== null;
+	}
+	get reserved() {
+		return this.state !== null && this.state !== "closed";
+	}
+	close() {
+		this.state = "closed";
+	}
+	tryReserve() {
+		if (this.closed) return void 0;
+		const reservation = {};
+		this.state = reservation;
+		const release = () => {
+			if (this.state === reservation) this.state = null;
+		};
+		return Object.assign(release, {
+			isValid: () => this.state === reservation,
+			commit: () => {
+				if (this.state !== reservation) return false;
+				this.state = "closed";
+				return true;
+			}
+		});
+	}
+};
+/** Validate the whole native owner tree before closing any of its held gates. */
+var IdleAdmissionReservation = class {
+	#live = true;
+	#released = false;
+	#groups;
+	#barriers;
+	#validate;
+	#current;
+	constructor(releases, validate, current, children = []) {
+		this.#validate = validate;
+		this.#current = current;
+		this.#groups = [this, ...children.flatMap((child) => child.#groups)];
+		this.#barriers = [...releases.map((release) => ({
+			release,
+			isValid: release.isValid,
+			commit: release.commit
+		})), ...children.flatMap((child) => child.#barriers)];
+	}
+	isValid = () => this.#check();
+	#check() {
+		if (!this.#live) return false;
+		try {
+			this.#live = this.#groups.every((group) => group.#live && group.#validate()) && this.#groups.every((group) => group.#current()) && this.#barriers.every((barrier) => barrier.isValid());
+		} catch {
+			this.#live = false;
+		}
+		return this.#live;
+	}
+	commit = () => {
+		if (!this.#check()) return false;
+		for (const barrier of this.#barriers) barrier.commit();
+		for (const group of this.#groups) group.#live = false;
+		return true;
+	};
+	release = () => {
+		if (this.#released) return;
+		for (const group of this.#groups) {
+			group.#live = false;
+			group.#released = true;
+		}
+		for (const barrier of [...this.#barriers].reverse()) barrier.release();
+	};
+};
+var QuiescenceDeadline = class {
+	deadlineAt;
+	monotonicEnd;
+	constructor(deadlineAt) {
+		this.deadlineAt = deadlineAt;
+		const budget = deadlineAt - Date.now();
+		if (!Number.isSafeInteger(deadlineAt) || deadlineAt < 0 || budget > 2147483647) throw new Error("Quiescence deadline must be a safe timestamp within the timer range");
+		this.monotonicEnd = performance.now() + Math.max(0, budget);
+	}
+	get remainingMs() {
+		return Math.max(0, Math.min(this.deadlineAt - Date.now(), this.monotonicEnd - performance.now()));
+	}
+	get expired() {
+		return this.remainingMs <= 0;
+	}
+	async wait(completion) {
+		let settled = false;
+		const done = completion.then(() => {
+			settled = true;
+		}, () => {
+			settled = true;
+		});
+		while (!settled && !this.expired) {
+			let timer;
+			try {
+				await Promise.race([done, new Promise((resolve) => {
+					timer = setTimeout(resolve, Math.ceil(this.remainingMs));
+				})]);
+			} finally {
+				if (timer !== void 0) clearTimeout(timer);
+			}
+		}
+	}
+};
+/** Keeps settlement identity separate from presentation/cancellation state. */
+var ExecutionLedger = class {
+	entries = /* @__PURE__ */ new Map();
+	revision = 0;
+	get version() {
+		return this.revision;
+	}
+	/** Register before invoking callbacks that can reenter the owner. */
+	run(detail, operation) {
+		this.revision++;
+		const key = {};
+		let resolve;
+		const settled = new Promise((yes) => {
+			resolve = yes;
+		});
+		this.entries.set(key, {
+			detail,
+			settled
+		});
+		const finish = () => {
+			this.entries.delete(key);
+			resolve();
+		};
+		try {
+			const completion = operation();
+			completion.then(finish, finish);
+			return completion;
+		} catch (error) {
+			finish();
+			throw error;
+		}
+	}
+	track(detail, completion) {
+		this.run(detail, () => completion);
+	}
+	get pending() {
+		return Array.from(this.entries.values(), (entry) => entry.detail);
+	}
+	async drain() {
+		while (this.entries.size > 0) await Promise.all(Array.from(this.entries.values(), (entry) => entry.settled));
+	}
+};
+//#endregion
 //#region ../../packages/agent-core/src/agent/context/notification-xml.ts
 /**
 * Notification XML rendering — produces the chat-history injection text
@@ -30012,6 +30323,9 @@ var FileSystemAgentRecordPersistence = class {
 		this.filePath = filePath;
 		this.options = options;
 	}
+	get hasPendingWork() {
+		return this.error !== void 0 || this.flushPromise !== void 0 || this.shouldClear || this.pendingRecords.length > 0;
+	}
 	async *read() {
 		yield* this.readFrom(0, 0);
 	}
@@ -182196,11 +182510,24 @@ function invalidateMessageTokenEstimate(message) {
 * and supersedes this value. Used to keep `tokenCountWithPending`
 * monotonic between LLM round-trips without paying for a tokenizer.
 */
-function estimateTokens(text) {
+/** With stopAfter, an overflowing result is only a lower bound for comparison. */
+function estimateTokens(text, stopAfter = Infinity) {
 	let asciiCount = 0;
 	let nonAsciiCount = 0;
-	for (const char of text) if (char.codePointAt(0) <= 127) asciiCount++;
-	else nonAsciiCount++;
+	let asciiBudget = Math.floor(stopAfter) * 4;
+	for (let index = 0; index < text.length; index++) {
+		const code = text.charCodeAt(index);
+		if (code <= 127) asciiCount++;
+		else {
+			nonAsciiCount++;
+			asciiBudget -= 4;
+			if (code >= 55296 && code <= 56319) {
+				const next = text.charCodeAt(index + 1);
+				if (next >= 56320 && next <= 57343) index++;
+			}
+		}
+		if (asciiCount > asciiBudget) return Math.ceil(asciiCount / 4) + nonAsciiCount;
+	}
 	return Math.ceil(asciiCount / 4) + nonAsciiCount;
 }
 function estimateTokensForMessages(messages) {
@@ -182212,9 +182539,9 @@ function estimateTokensForMessages(messages) {
 function estimateTokensForTools(tools, stopAfter = Infinity) {
 	let total = 0;
 	for (const tool of tools) {
-		total += estimateTokens(tool.name);
-		total += estimateTokens(tool.description);
-		total += estimateTokens(JSON.stringify(tool.parameters));
+		total += estimateTokens(tool.name, stopAfter - total);
+		total += estimateTokens(tool.description, stopAfter - total);
+		total += estimateTokens(JSON.stringify(tool.parameters), stopAfter - total);
 		if (total > stopAfter) return total;
 	}
 	return total;
@@ -183217,6 +183544,8 @@ function restoreAgentRecord(agent, input) {
 var AgentRecords = class {
 	agent;
 	persistence;
+	operations = new ExecutionLedger();
+	revision = 0;
 	_restoring = null;
 	metadataInitialized = false;
 	persistedProtocolVersion;
@@ -183247,6 +183576,14 @@ var AgentRecords = class {
 			protocolVersion: this.persistedProtocolVersion
 		};
 	}
+	get version() {
+		return this.revision;
+	}
+	get hasPendingWork() {
+		if (this._restoring !== null || this.operations.pending.length > 0 || this.checkpointWrite !== void 0) return true;
+		if (this.persistence === void 0 || this.persistence instanceof InMemoryAgentRecordPersistence) return false;
+		return !(this.persistence instanceof FileSystemAgentRecordPersistence) || this.persistence.hasPendingWork;
+	}
 	get replaySource() {
 		if (this.persistence === void 0) return void 0;
 		const source = this.persistence instanceof FileSystemAgentRecordPersistence ? new FileSystemAgentRecordPersistence(this.persistence.filePath) : this.persistence;
@@ -183254,6 +183591,7 @@ var AgentRecords = class {
 	}
 	logRecord(record) {
 		if (this._restoring !== null) return;
+		this.revision++;
 		const stamped = record.time !== void 0 ? record : {
 			...record,
 			time: Date.now()
@@ -183276,6 +183614,7 @@ var AgentRecords = class {
 		this.persistence?.append(stamped);
 	}
 	restore(record) {
+		this.revision++;
 		this.captureStateRecord(record);
 		this._restoring = { time: record.time ?? Date.now() };
 		try {
@@ -183285,7 +183624,11 @@ var AgentRecords = class {
 			this._restoring = null;
 		}
 	}
-	async replay(options = {}) {
+	replay(options = {}) {
+		this.revision++;
+		return this.operations.run("replay", () => this.replayInner(options));
+	}
+	async replayInner(options) {
 		if (!this.persistence) throw new Error("No persistence provided for AgentRecords");
 		this.persistedProtocolVersion = void 0;
 		this.resumeCheckpointRestored = false;
@@ -183335,10 +183678,14 @@ var AgentRecords = class {
 		if (completed && this.agent.blobStore !== void 0) for (const msg of this.agent.context.history) await this.agent.blobStore.rehydrateParts(msg.content);
 		return { warning };
 	}
-	async flush() {
-		await this.persistence?.flush();
+	flush() {
+		return this.operations.run("flush", () => this.persistence?.flush() ?? Promise.resolve());
 	}
-	async writeResumeCheckpoint() {
+	writeResumeCheckpoint() {
+		this.revision++;
+		return this.operations.run("checkpoint", () => this.writeResumeCheckpointInner());
+	}
+	async writeResumeCheckpointInner() {
 		await this.checkpointWrite;
 		const write = this.persistResumeCheckpoint();
 		this.checkpointWrite = write;
@@ -183857,63 +184204,6 @@ var SubagentResumeReference = class SubagentResumeReference {
 	}
 };
 //#endregion
-//#region ../../packages/agent-core/src/utils/quiescence.ts
-var QuiescenceDeadline = class {
-	deadlineAt;
-	monotonicEnd;
-	constructor(deadlineAt) {
-		this.deadlineAt = deadlineAt;
-		const budget = deadlineAt - Date.now();
-		if (!Number.isSafeInteger(deadlineAt) || deadlineAt < 0 || budget > 2147483647) throw new Error("Quiescence deadline must be a safe timestamp within the timer range");
-		this.monotonicEnd = performance.now() + Math.max(0, budget);
-	}
-	get remainingMs() {
-		return Math.max(0, Math.min(this.deadlineAt - Date.now(), this.monotonicEnd - performance.now()));
-	}
-	get expired() {
-		return this.remainingMs <= 0;
-	}
-	async wait(completion) {
-		let settled = false;
-		const done = completion.then(() => {
-			settled = true;
-		}, () => {
-			settled = true;
-		});
-		while (!settled && !this.expired) {
-			let timer;
-			try {
-				await Promise.race([done, new Promise((resolve) => {
-					timer = setTimeout(resolve, Math.ceil(this.remainingMs));
-				})]);
-			} finally {
-				if (timer !== void 0) clearTimeout(timer);
-			}
-		}
-	}
-};
-/** Keeps settlement identity separate from presentation/cancellation state. */
-var ExecutionLedger = class {
-	entries = /* @__PURE__ */ new Map();
-	track(detail, completion) {
-		const key = {};
-		const finish = () => {
-			this.entries.delete(key);
-		};
-		const settled = completion.then(finish, finish);
-		this.entries.set(key, {
-			detail,
-			settled
-		});
-	}
-	get pending() {
-		return Array.from(this.entries.values(), (entry) => entry.detail);
-	}
-	async drain() {
-		while (this.entries.size > 0) await Promise.all(Array.from(this.entries.values(), (entry) => entry.settled));
-	}
-};
-//#endregion
 //#region ../../packages/agent-core/src/session/subagent-batch.ts
 const INITIAL_LAUNCH_LIMIT = 5;
 const INITIAL_LAUNCH_INTERVAL_MS = 700;
@@ -184356,14 +184646,20 @@ IMPORTANT:
 - If you do not know the answer, say so directly.
 `;
 const nativeExecutionCompletions = /* @__PURE__ */ new WeakMap();
+const preparedExecutionCompletions = /* @__PURE__ */ new WeakMap();
 /** Only handles produced by this native host can attest their actual execution end. */
 function getSubagentExecutionCompletion(handle) {
 	return nativeExecutionCompletions.get(handle);
 }
+/** Preparation identity, not a caller's display promise, owns the execution receipt. */
+function getPreparedSubagentExecutionCompletion(prepared, owner, handle) {
+	const native = preparedExecutionCompletions.get(prepared);
+	return native?.owner === owner && native.agentId === handle.agentId && native.profileName === handle.profileName && handle.resumed ? native.completion : void 0;
+}
 var SessionSubagentHost = class {
 	session;
 	ownerAgentId;
-	admissionClosed = false;
+	admission = new AdmissionGate();
 	operations = new ExecutionLedger();
 	childExecutions = new ExecutionLedger();
 	preparedDisposers = /* @__PURE__ */ new Set();
@@ -184374,7 +184670,17 @@ var SessionSubagentHost = class {
 		this.ownerAgentId = ownerAgentId;
 	}
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
+	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0 || this.childExecutions.pending.length > 0 || this.preparedDisposers.size > 0 || this.resumeReservations.size > 0 || this.activeChildren.size > 0;
+	}
+	belongsTo(session, agentId) {
+		return this.session === session && this.ownerAgentId === agentId;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
 	}
 	async quiesce(options) {
 		const deadline = new QuiescenceDeadline(options.deadlineAt);
@@ -184396,13 +184702,11 @@ var SessionSubagentHost = class {
 		await this.childExecutions.drain();
 	}
 	assertAdmissionOpen() {
-		if (this.admissionClosed) throw new Error("Subagent admission is closed for quiescence");
+		if (this.admission.closed) throw new Error("Subagent admission is closed for quiescence");
 	}
 	runOperation(id, operation) {
 		this.assertAdmissionOpen();
-		const completion = operation();
-		this.operations.track(id, completion);
-		return completion;
+		return this.operations.run(id, operation);
 	}
 	nativeHandle(handle) {
 		const child = this.session.getReadyAgent(handle.agentId);
@@ -184531,6 +184835,10 @@ var SessionSubagentHost = class {
 		const token = {};
 		this.resumeReservations.set(agentId, token);
 		let retainedWire;
+		const execution = createControlledPromise();
+		execution.catch(() => {});
+		let startedExecution;
+		let consumed = false;
 		const releaseReservation = () => {
 			if (this.resumeReservations.get(agentId) === token) this.resumeReservations.delete(agentId);
 		};
@@ -184545,6 +184853,8 @@ var SessionSubagentHost = class {
 			}).then(() => {
 				if (retainedWire === closing) retainedWire = void 0;
 				if (retainedWire === void 0) this.preparedDisposers.delete(dispose);
+				if (!consumed) execution.resolve();
+				else if (startedExecution !== void 0) execution.resolve(startedExecution);
 			});
 			disposal = completion;
 			completion.then(() => {
@@ -184573,18 +184883,16 @@ var SessionSubagentHost = class {
 			if (source === void 0 || resolve(source.path) !== wire || source.protocolVersion !== "1.4" || child.context.history.length === 0 || child.config.systemPrompt.length === 0) throw new Error("Preserved subagent context could not be verified.");
 			await sourceReference.refreshAfterReplay();
 			this.assertAdmissionOpen();
-			const reference = createHash("sha256").update(JSON.stringify([
-				sessionRoot,
-				this.ownerAgentId,
-				agentId,
-				home,
-				sourceReference.digest
-			])).digest("hex");
-			let consumed = false;
-			return {
+			const prepared = {
 				agentId,
 				profileName,
-				reference,
+				reference: createHash("sha256").update(JSON.stringify([
+					sessionRoot,
+					this.ownerAgentId,
+					agentId,
+					home,
+					sourceReference.digest
+				])).digest("hex"),
 				dispose,
 				start: async (options) => this.runOperation("prepared-start", async () => {
 					await sourceReference.assertUnchanged();
@@ -184611,15 +184919,24 @@ var SessionSubagentHost = class {
 							throw error;
 						}
 					});
-					return this.nativeHandle({
+					const handle = this.nativeHandle({
 						agentId,
 						profileName,
 						resumed: true,
 						completion,
 						update: (message) => this.updateActiveRun(agentId, completion, message)
 					});
+					startedExecution = getSubagentExecutionCompletion(handle);
+					return handle;
 				})
 			};
+			preparedExecutionCompletions.set(prepared, {
+				owner: this,
+				agentId,
+				profileName,
+				completion: execution
+			});
+			return prepared;
 		} catch (error) {
 			await dispose();
 			throw error;
@@ -184692,7 +185009,7 @@ var SessionSubagentHost = class {
 	async getProfileName(agentId) {
 		const metadata = this.session.metadata.agents[agentId];
 		if (metadata?.type !== "sub" || metadata.parentAgentId !== this.ownerAgentId) return;
-		return (await this.session.ensureAgentResumed(agentId)).config.profileName;
+		return this.runOperation("profile-query", async () => (await this.session.ensureAgentResumed(agentId)).config.profileName);
 	}
 	getSwarmItem(agentId) {
 		const metadata = this.session.metadata.agents[agentId];
@@ -184910,6 +185227,7 @@ var AgentBackgroundTask = class {
 		return this.handle.update(message);
 	}
 	get executionCompletion() {
+		if (this.options.preparedExecution !== void 0) return getPreparedSubagentExecutionCompletion(this.options.preparedExecution, this.subagentHost, this.handle);
 		return getSubagentExecutionCompletion(this.handle);
 	}
 	async start(sink) {
@@ -185172,6 +185490,7 @@ var TaskResumeRuntime = class {
 					return active.update(message);
 				}
 			}, input.description, host, controller, {
+				preparedExecution: prepared,
 				resumed: true,
 				replacesTaskId: source.taskId,
 				resumeRootTaskId: intent.resumeRootTaskId,
@@ -185344,7 +185663,8 @@ var BackgroundManager = class {
 	agent;
 	persistence;
 	tasks = /* @__PURE__ */ new Map();
-	admissionClosed = false;
+	admission = new AdmissionGate();
+	executions = new ExecutionLedger();
 	unregisteredProcesses = /* @__PURE__ */ new Map();
 	reservedTaskIds = /* @__PURE__ */ new Set();
 	taskResume = new TaskResumeRuntime(this);
@@ -185363,7 +185683,7 @@ var BackgroundManager = class {
 	fireTerminalEffects(entry) {
 		if (!this.isDetached(entry)) return;
 		const info = this.toInfo(entry);
-		this.notifyBackgroundTask(info).catch(() => {});
+		this.executions.run(`notification:${entry.taskId}`, () => this.notifyBackgroundTask(info)).catch(() => {});
 		this.emitTaskTerminated(info);
 	}
 	emitTaskStarted(info) {
@@ -185393,7 +185713,10 @@ var BackgroundManager = class {
 		throw new Error("Too many background tasks are already running.");
 	}
 	assertAdmissionOpen() {
-		if (this.admissionClosed) throw new Error("Background manager is quiescing; task admission is closed.");
+		if (this.admission.closed) throw new Error("Background manager is quiescing; task admission is closed.");
+	}
+	assertMutationAdmissionOpen() {
+		if (this.admission.reserved) throw new Error("Background task admission is reserved.");
 	}
 	activeBackgroundAdmissionCount() {
 		let count = 0;
@@ -185445,7 +185768,8 @@ var BackgroundManager = class {
 			outputPersistStarted: detached
 		};
 		this.tasks.set(taskId, entry);
-		this.runTaskLifecycle(entry);
+		if (task instanceof AgentBackgroundTask && task.executionCompletion !== void 0) this.executions.track(`child:${taskId}`, task.executionCompletion);
+		this.executions.run(`lifecycle:${taskId}`, () => this.runTaskLifecycle(entry));
 		if (this.isDetached(entry)) {
 			this.persistLive(entry);
 			this.emitTaskStarted(this.toInfo(entry));
@@ -185475,7 +185799,7 @@ var BackgroundManager = class {
 	}
 	resumeAgentTask(input, host) {
 		this.assertAdmissionOpen();
-		return this.taskResume.resume(input, host);
+		return this.executions.run(`resume:${input.taskId}`, () => this.taskResume.resume(input, host));
 	}
 	async awaitTaskPersisted(taskId) {
 		const entry = this.tasks.get(taskId);
@@ -185491,6 +185815,7 @@ var BackgroundManager = class {
 		return this.ghosts.get(taskId);
 	}
 	updateAgentTask(taskId, message) {
+		this.assertMutationAdmissionOpen();
 		const text = message.trim();
 		if (!text) throw new Error("Update message must not be empty.");
 		const entry = this.tasks.get(taskId);
@@ -185577,12 +185902,16 @@ var BackgroundManager = class {
 		return output;
 	}
 	async suppressTerminalNotification(taskId) {
-		const entry = this.tasks.get(taskId);
-		if (entry === void 0 || entry.terminalNotificationSuppressed === true) return;
-		entry.terminalNotificationSuppressed = true;
-		await this.persistLive(entry);
+		this.assertMutationAdmissionOpen();
+		return this.executions.run(`suppression:${taskId}`, async () => {
+			const entry = this.tasks.get(taskId);
+			if (entry === void 0 || entry.terminalNotificationSuppressed === true) return;
+			entry.terminalNotificationSuppressed = true;
+			await this.persistLive(entry);
+		});
 	}
 	detach(taskId) {
+		this.assertMutationAdmissionOpen();
 		const entry = this.tasks.get(taskId);
 		if (entry === void 0) return this.ghosts.get(taskId);
 		if (TERMINAL_STATUSES.has(entry.status)) return this.toInfo(entry);
@@ -185600,12 +185929,14 @@ var BackgroundManager = class {
 		return this.toInfo(entry);
 	}
 	persistOutput(taskId) {
+		this.assertMutationAdmissionOpen();
 		const entry = this.tasks.get(taskId);
 		if (entry === void 0) return;
 		this.startOutputPersist(entry);
 	}
 	/** Stop a running task. SIGTERM → 5s grace → SIGKILL. */
 	async stop(taskId, reason) {
+		this.assertMutationAdmissionOpen();
 		const entry = this.tasks.get(taskId);
 		if (!entry) return void 0;
 		const trimmedReason = reason?.trim();
@@ -185621,12 +185952,27 @@ var BackgroundManager = class {
 		return this.toInfo(entry);
 	}
 	async stopAll(reason) {
+		this.assertMutationAdmissionOpen();
 		const taskIds = Array.from(this.tasks.keys());
 		return (await Promise.all(taskIds.map((taskId) => this.stop(taskId, reason)))).filter((info) => info !== void 0);
 	}
 	/** Explicit manager-only shutdown. Does not change ordinary stop/close policy. */
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
+	}
+	get hasPendingWork() {
+		if (this.reservedTaskIds.size > 0 || this.executions.pending.length > 0 || this.pendingRegisteredTaskExecutions.length > 0 || this.pendingUnregisteredProcessExecutions.length > 0) return true;
+		for (const entry of this.tasks.values()) {
+			if (!TERMINAL_STATUSES.has(entry.status)) return true;
+			if (entry.task.kind === "process" && (!(entry.task instanceof ProcessBackgroundTask) || entry.task.proc.exitCode === null)) return true;
+			if (entry.task.kind === "agent" && (!(entry.task instanceof AgentBackgroundTask) || entry.task.executionCompletion === void 0)) return true;
+		}
+		for (const ghost of this.ghosts.values()) if (!TERMINAL_STATUSES.has(ghost.status)) return true;
+		return false;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
 	}
 	/** Observe an existing process after task admission failed; this admits no new work. */
 	trackUnregisteredProcess(proc) {
@@ -185700,7 +186046,7 @@ var BackgroundManager = class {
 				await Promise.all([entry.persistWriteQueue, entry.outputWriteQueue]);
 				observed.add(entry.taskId);
 			} catch {}
-		})).then(() => unregistered).then(() => false);
+		})).then(() => unregistered).then(() => this.executions.drain()).then(() => false);
 		const remainingBudget = Math.min(deadlineAt - Date.now(), monotonicDeadline - performance.now());
 		let timedOut = remainingBudget <= 0;
 		if (!timedOut) {
@@ -185786,14 +186132,17 @@ var BackgroundManager = class {
 	* calls overwrite the ghost map.
 	*/
 	async loadFromDisk() {
-		const persistence = this.persistence;
-		if (persistence === void 0) return;
-		this.ghosts.clear();
-		const persisted = await persistence.listTasks();
-		for (const t of persisted) {
-			if (this.tasks.has(t.taskId)) continue;
-			this.ghosts.set(t.taskId, t);
-		}
+		this.assertAdmissionOpen();
+		return this.executions.run("load", async () => {
+			const persistence = this.persistence;
+			if (persistence === void 0) return;
+			this.ghosts.clear();
+			const persisted = await persistence.listTasks();
+			for (const t of persisted) {
+				if (this.tasks.has(t.taskId)) continue;
+				this.ghosts.set(t.taskId, t);
+			}
+		});
 	}
 	/**
 	* Reconcile loaded ghost tasks. Any ghost with status `running` is
@@ -185818,9 +186167,12 @@ var BackgroundManager = class {
 		return lostInfo;
 	}
 	async reconcile() {
-		const lostInfo = await this.markLoadedTasksLost();
-		for (const info of lostInfo) this.emitTaskTerminated(info);
-		await this.restoreBackgroundTaskNotifications();
+		this.assertAdmissionOpen();
+		return this.executions.run("reconcile", async () => {
+			const lostInfo = await this.markLoadedTasksLost();
+			for (const info of lostInfo) this.emitTaskTerminated(info);
+			await this.restoreBackgroundTaskNotifications();
+		});
 	}
 	/**
 	* Persist the current state of a live ManagedTask. Called from
@@ -185831,6 +186183,7 @@ var BackgroundManager = class {
 		if (persistence === void 0) return Promise.resolve();
 		const info = this.toInfo(entry);
 		entry.persistWriteQueue = entry.persistWriteQueue.then(() => persistence.writeTask(info, true)).catch(() => {});
+		this.executions.track(`record:${entry.taskId}`, entry.persistWriteQueue);
 		return entry.persistWriteQueue;
 	}
 	appendOutput(entry, chunk) {
@@ -185861,6 +186214,7 @@ var BackgroundManager = class {
 		const persistence = this.persistence;
 		if (persistence === void 0) return;
 		entry.outputWriteQueue = entry.outputWriteQueue.then(() => persistence.appendTaskOutput(entry.taskId, chunk)).catch(() => {});
+		this.executions.track(`output:${entry.taskId}`, entry.outputWriteQueue);
 	}
 	/**
 	* Begin persisting `output.log` for a task that buffered while foreground.
@@ -185945,6 +186299,7 @@ var BackgroundManager = class {
 		});
 	}
 	markDeliveredNotification(origin) {
+		this.assertMutationAdmissionOpen();
 		this.deliveredNotificationKeys.add(notificationKey(origin));
 	}
 	isTerminalNotificationSuppressed(taskId) {
@@ -230534,7 +230889,7 @@ function selectCompactionHistory(history) {
 }
 var FullCompaction = class {
 	agent;
-	admissionClosed = false;
+	admission = new AdmissionGate();
 	nextExecutionId = 0;
 	executions = new ExecutionLedger();
 	executingControllers = /* @__PURE__ */ new Set();
@@ -230566,7 +230921,14 @@ var FullCompaction = class {
 	}
 	/** Explicit host shutdown only; normal cancellation remains restartable. */
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
+	}
+	get hasPendingWork() {
+		return this.compacting !== null || this.executions.pending.length > 0 || Boolean(this.agent.records.restoring);
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
 	}
 	get pendingExecutions() {
 		return this.executions.pending.map((entry) => ({ ...entry }));
@@ -230591,7 +230953,7 @@ var FullCompaction = class {
 		return this.executions.drain();
 	}
 	assertAdmissionOpen() {
-		if (this.admissionClosed) throw new Error("Compaction admission is closed for quiescence");
+		if (this.admission.closed) throw new Error("Compaction admission is closed for quiescence");
 	}
 	get isSessionCompactionStopped() {
 		return this.sessionCompactionFailures >= MAX_SESSION_COMPACTION_FAILURES;
@@ -230608,11 +230970,14 @@ var FullCompaction = class {
 		return budget !== void 0 && Number.isFinite(budget) && budget > 0 ? Math.floor(budget) : void 0;
 	}
 	proactiveCompactionStatus(context = {}) {
-		const usedTokens = this.estimateCurrentRequestTokens(context);
+		const messages = context.messages ?? this.agent.context.messages;
+		const usedTokens = this.estimateCurrentRequestTokens({
+			...context,
+			messages
+		});
 		const budget = this.getCompactionBudgetTokens();
 		const thresholdTokens = budget === void 0 ? void 0 : Math.max(1, Math.floor(budget * .9));
 		let reason = "eligible";
-		const messages = context.messages ?? this.agent.context.messages;
 		const projected = context.additionalMessages === void 0 ? messages : [...messages, ...context.additionalMessages];
 		const historyBudget = this.requestHistoryByteBudget(projected);
 		const historyThresholdReached = historyBudget !== void 0 && historyBudget.usedHistoryBytes >= historyBudget.thresholdHistoryBytes;
@@ -230719,41 +231084,43 @@ var FullCompaction = class {
 		}
 		if (this.agent.context.history.length === 0) throw new BlunError(ErrorCodes.COMPACTION_UNABLE, "No messages to compact in current history.");
 		if (data.source === "manual" && this.agent.turn.hasActiveTurn) throw new BlunError(ErrorCodes.COMPACTION_UNABLE, "Cannot compact while a turn is active. Wait for it to finish, then retry.");
-		this.agent.records.logRecord({
-			type: "full_compaction.begin",
-			...data
-		});
-		this.agent.emitEvent({
-			type: "compaction.started",
-			trigger: data.source,
-			instruction: data.instruction
-		});
-		this.assertAdmissionOpen();
-		const abortController = new AbortController();
 		const executionId = ++this.nextExecutionId;
-		let resolve;
-		let reject;
-		const promise = new Promise((yes, no) => {
-			resolve = yes;
-			reject = no;
-		});
-		this.executions.track({
+		this.executions.run({
 			kind: "worker",
 			id: executionId,
 			source: data.source
-		}, promise);
-		this.executingControllers.add(abortController);
-		this.compacting = {
-			abortController,
-			promise,
-			blockedByTurn: false
-		};
-		this.compactionWorker(abortController.signal, data, executionId).then(() => {
-			this.executingControllers.delete(abortController);
-			resolve();
-		}, (error) => {
-			this.executingControllers.delete(abortController);
-			reject(error);
+		}, () => {
+			this.agent.records.logRecord({
+				type: "full_compaction.begin",
+				...data
+			});
+			this.agent.emitEvent({
+				type: "compaction.started",
+				trigger: data.source,
+				instruction: data.instruction
+			});
+			this.assertAdmissionOpen();
+			const abortController = new AbortController();
+			let resolve;
+			let reject;
+			const promise = new Promise((yes, no) => {
+				resolve = yes;
+				reject = no;
+			});
+			this.executingControllers.add(abortController);
+			this.compacting = {
+				abortController,
+				promise,
+				blockedByTurn: false
+			};
+			this.compactionWorker(abortController.signal, data, executionId).then(() => {
+				this.executingControllers.delete(abortController);
+				resolve();
+			}, (error) => {
+				this.executingControllers.delete(abortController);
+				reject(error);
+			});
+			return promise;
 		});
 	}
 	cancel() {
@@ -230791,6 +231158,7 @@ var FullCompaction = class {
 		this.consecutiveOverflowCompactions += 1;
 		const maxAttempts = this.strategy.maxOverflowCompactionAttempts;
 		if (this.consecutiveOverflowCompactions > maxAttempts) throw new BlunError(ErrorCodes.CONTEXT_OVERFLOW, `Compaction failed to bring the context under the model window after ${String(maxAttempts)} attempts.`, { cause: error instanceof Error ? error : void 0 });
+		this.diagnoseAutomaticCompaction("provider-overflow", this.tokenCountWithPending);
 		if (!this.beginAutoCompaction() && !this.compacting) throw error;
 		await this.block(signal);
 	}
@@ -230805,7 +231173,7 @@ var FullCompaction = class {
 		const historyThresholdReached = historyBudget !== void 0 && historyBudget.usedHistoryBytes >= historyBudget.thresholdHistoryBytes;
 		const requestBudget = this.requestBodyByteBudget(projectedMessages, requestContext);
 		const proactive = (requestBudget !== void 0 && requestBudget.usedRequestBytesEstimate >= requestBudget.thresholdRequestBytes || historyThresholdReached || !this.isCompacting && budget !== void 0 && Number.isFinite(requestTokens) && requestTokens >= Math.max(1, Math.floor(budget * .9))) && this.hasShrinkableHistory(projectedMessages);
-		if (this.checkAutoCompaction(true, requestTokens, projectedMessages, proactive) && (proactive || this.strategy.shouldBlock(requestTokens))) await this.block(signal);
+		if (this.checkAutoCompaction(true, requestTokens, projectedMessages, proactive, "request-preflight", requestContext) && (proactive || this.strategy.shouldBlock(requestTokens))) await this.block(signal);
 		signal.throwIfAborted();
 		const compacted = this.agent.context.history !== historyBefore;
 		let rebuiltMessages = compacted ? await requestContext.rebuildMessages?.() : void 0;
@@ -230835,20 +231203,47 @@ var FullCompaction = class {
 			this.proactiveCompactionRequested = false;
 			signal.throwIfAborted();
 			const status = this.proactiveCompactionStatus();
-			if (this.isCompacting || status.eligible && this.checkAutoCompaction(true, status.usedTokens, this.agent.context.history, true)) await this.block(signal);
+			if (this.isCompacting || status.eligible && this.checkAutoCompaction(true, status.usedTokens, this.agent.context.history, true, "tool-request")) await this.block(signal);
 			return;
 		}
 		if (this.strategy.checkAfterStep) this.checkAutoCompaction(false);
 	}
-	checkAutoCompaction(throwOnLimit = true, usedSize = this.tokenCountWithPending, messages = this.agent.context.history, proactive = false) {
+	checkAutoCompaction(throwOnLimit = true, usedSize = this.tokenCountWithPending, messages = this.agent.context.history, proactive = false, entryPoint = "background", requestContext = {}) {
 		if (this.compacting) return true;
 		const modelAlias = this.agent.activeResponderModel ?? this.agent.config.modelAlias;
 		const maxContextTokens = this.getEffectiveMaxContextTokens();
 		if (this.lastCompactedState !== null && this.tokenCountWithPending <= this.lastCompactedState.tokenCount && modelAlias === this.lastCompactedState.modelAlias && maxContextTokens === this.lastCompactedState.maxContextTokens) return false;
 		if (!proactive && !this.strategy.shouldCompact(usedSize)) return false;
 		if (this.requiresShrinkableHistory && !this.hasShrinkableHistory(messages)) return false;
+		this.diagnoseAutomaticCompaction(entryPoint, usedSize, requestContext, proactive);
 		return this.beginAutoCompaction(throwOnLimit);
 	}
+	diagnoseAutomaticCompaction(entryPoint, usedTokens, context = {}, proactive = false) {
+		if (this.agent.type !== "main" || process.env["BLUN_DIAG_PRE_REQUEST_PHASES"] !== "1") return;
+		try {
+			const messages = context.messages ?? this.agent.context.messages;
+			const projected = context.additionalMessages === void 0 ? messages : [...messages, ...context.additionalMessages];
+			const budget = this.getCompactionBudgetTokens();
+			const thresholdTokens = budget === void 0 ? void 0 : proactive ? Math.max(1, Math.floor(budget * .9)) : budget;
+			const historyBudget = this.requestHistoryByteBudget(projected);
+			const requestBudget = this.requestBodyByteBudget(projected, context);
+			this.agent.log.info("compaction automatic decision", {
+				entryPoint,
+				turnId: this.agent.turn.currentId,
+				usedTokens,
+				storedTokens: this.tokenCountWithPending,
+				projectedTokens: this.estimateProjectedRequestTokens(context),
+				thresholdTokens,
+				...historyBudget,
+				...requestBudget,
+				tokenThresholdReached: thresholdTokens !== void 0 && Number.isFinite(usedTokens) && usedTokens >= thresholdTokens,
+				historyByteThresholdReached: historyBudget !== void 0 && historyBudget.usedHistoryBytes >= historyBudget.thresholdHistoryBytes,
+				requestByteThresholdReached: requestBudget !== void 0 && requestBudget.usedRequestBytesEstimate >= requestBudget.thresholdRequestBytes,
+				proactive,
+				alreadyCompacting: this.isCompacting
+			});
+		} catch {}
+	}
 	hasShrinkableHistory(messages) {
 		if (messages.some((message) => message.role === "assistant" || message.role === "tool")) return true;
 		return estimateTokensForMessages(messages.filter(isRealUserInput)) > COMPACT_USER_MESSAGE_MAX_TOKENS;
@@ -232329,6 +232724,10 @@ const ID_REGEX = /^[0-9a-f]{8}$/;
 */
 const MAX_ID_ATTEMPTS = 8;
 var SessionCronStore = class {
+	assertMutationOpen;
+	constructor(assertMutationOpen = () => {}) {
+		this.assertMutationOpen = assertMutationOpen;
+	}
 	/**
 	* Backing map. `Map` preserves insertion order in JS, which we rely on
 	* for {@link list}.
@@ -232343,6 +232742,7 @@ var SessionCronStore = class {
 	* practice; surfacing it as a throw beats silently retrying forever.
 	*/
 	add(init, nowMs) {
+		this.assertMutationOpen();
 		const id = this.generateUniqueId();
 		const task = {
 			...init,
@@ -232365,6 +232765,7 @@ var SessionCronStore = class {
 	* semantics should clear the store first.
 	*/
 	adopt(task) {
+		this.assertMutationOpen();
 		this.tasks.set(task.id, task);
 	}
 	/**
@@ -232377,6 +232778,7 @@ var SessionCronStore = class {
 	* scheduler's fire and the cursor callback.
 	*/
 	markFired(id, lastFiredAt) {
+		this.assertMutationOpen();
 		const existing = this.tasks.get(id);
 		if (existing === void 0) return void 0;
 		const updated = {
@@ -232387,6 +232789,7 @@ var SessionCronStore = class {
 		return updated;
 	}
 	update(id, patch) {
+		this.assertMutationOpen();
 		const existing = this.tasks.get(id);
 		if (existing === void 0) return void 0;
 		const updated = {
@@ -232415,12 +232818,14 @@ var SessionCronStore = class {
 	* order.
 	*/
 	remove(ids) {
+		this.assertMutationOpen();
 		const removed = [];
 		for (const id of ids) if (this.tasks.delete(id)) removed.push(id);
 		return removed;
 	}
 	/** Empty the store. Convenience for tests / shutdown. */
 	clear() {
+		this.assertMutationOpen();
 		this.tasks.clear();
 	}
 	generateUniqueId() {
@@ -233038,7 +233443,8 @@ var CronManager = class {
 	* across repeated start() calls.
 	*/
 	started = false;
-	admissionClosed = false;
+	admission = new AdmissionGate();
+	operations = new ExecutionLedger();
 	lastUnavailableWarning = null;
 	/**
 	* Reference to the bound SIGUSR1 listener while the manager is
@@ -233068,7 +233474,7 @@ var CronManager = class {
 	activeRuns = /* @__PURE__ */ new Map();
 	constructor(agent, opts = {}) {
 		this.agent = agent;
-		this.store = new SessionCronStore();
+		this.store = new SessionCronStore(() => this.assertAdmissionOpen());
 		this.clocks = opts.clocks ?? resolveClockSources(process.env["BLUN_CRON_CLOCK"]) ?? SYSTEM_CLOCKS;
 		this.persistStore = agent.homedir === void 0 ? void 0 : createCronPersistStore(agent.homedir);
 		this.runStore = new CronRunStore(agent.homedir, () => {
@@ -233077,10 +233483,10 @@ var CronManager = class {
 		this.scheduler = createCronScheduler({
 			clocks: this.clocks,
 			source: () => this.store.list(),
-			isIdle: () => !agent.turn.hasActiveTurn,
+			isIdle: () => !this.admission.closed && !agent.turn.hasActiveTurn,
 			isKilled: () => process.env["BLUN_DISABLE_CRON"] === "1",
 			onFire: (task, ctx) => {
-				this.handleFire(task, ctx);
+				this.runSynchronous("fire", () => this.handleFire(task, ctx));
 			},
 			removeOneShot: (id) => {
 				this.removeTasks([id]);
@@ -233107,16 +233513,20 @@ var CronManager = class {
 	* the agent loop.
 	*/
 	addTask(init) {
-		const task = this.store.add(init, this.clocks.wallNow());
-		this.persistEnqueue(task.id, () => this.persistStore.write(task.id, task));
-		return task;
+		return this.runSynchronous("add", () => {
+			const task = this.store.add(init, this.clocks.wallNow());
+			this.persistEnqueue(task.id, () => this.persistStore.write(task.id, task));
+			return task;
+		});
 	}
 	/** Schedule one recurring loop per session; one-shot reminders remain independent. */
 	scheduleTask(init) {
-		const replaced = init.recurring === false ? [] : this.store.list().filter((task) => task.recurring !== false).map((task) => task.id);
-		const task = this.addTask(init);
-		for (const id of this.removeTasks(replaced)) this.emitDeleted(id);
-		return task;
+		return this.runSynchronous("schedule", () => {
+			const replaced = init.recurring === false ? [] : this.store.list().filter((task) => task.recurring !== false).map((task) => task.id);
+			const task = this.addTask(init);
+			for (const id of this.removeTasks(replaced)) this.emitDeleted(id);
+			return task;
+		});
 	}
 	/**
 	* Remove a batch of tasks from the in-memory store and mirror each
@@ -233131,21 +233541,25 @@ var CronManager = class {
 	* `list()` shape-guard pass.
 	*/
 	removeTasks(ids) {
-		const removed = this.store.remove(ids);
-		for (const id of removed) {
-			this.persistEnqueue(id, () => this.persistStore.remove(id));
-			for (const run of this.runStore.list()) if (run.receipt.jobId === id) this.runStore.put({
-				...run.receipt,
-				jobDeleted: true
-			}, run.finalMessage);
-		}
-		return removed;
+		return this.runSynchronous("remove", () => {
+			const removed = this.store.remove(ids);
+			for (const id of removed) {
+				this.persistEnqueue(id, () => this.persistStore.remove(id));
+				for (const run of this.runStore.list()) if (run.receipt.jobId === id) this.runStore.put({
+					...run.receipt,
+					jobDeleted: true
+				}, run.finalMessage);
+			}
+			return removed;
+		});
 	}
 	updateTask(id, patch) {
-		const updated = this.store.update(id, patch);
-		if (updated === void 0 || this.persistStore === void 0) return updated;
-		this.persistEnqueue(id, () => this.persistStore.write(id, updated));
-		return updated;
+		return this.runSynchronous("update", () => {
+			const updated = this.store.update(id, patch);
+			if (updated === void 0 || this.persistStore === void 0) return updated;
+			this.persistEnqueue(id, () => this.persistStore.write(id, updated));
+			return updated;
+		});
 	}
 	/**
 	* Persist the scheduler's `lastFiredAt` cursor for a recurring task
@@ -233178,12 +233592,15 @@ var CronManager = class {
 	* input, so a regenerated value would corrupt both.
 	*/
 	async loadFromDisk() {
-		if (this.persistStore === void 0) return;
-		const tasks = await this.persistStore.list();
-		this.store.clear();
-		for (const task of tasks) this.store.adopt(task);
-		this.activeRuns.clear();
-		this.runStore.load(this.clocks.wallNow());
+		this.assertAdmissionOpen();
+		return this.operations.run("load", async () => {
+			if (this.persistStore === void 0) return;
+			const tasks = await this.persistStore.list();
+			this.store.clear();
+			for (const task of tasks) this.store.adopt(task);
+			this.activeRuns.clear();
+			this.runStore.load(this.clocks.wallNow());
+		});
 	}
 	listRuns(options = {}) {
 		const limit = Math.min(100, Math.max(1, Math.trunc(options.limit ?? 20)));
@@ -233271,7 +233688,7 @@ var CronManager = class {
 		}));
 	}
 	publishRun(run) {
-		this.agent.emitEvent({
+		this.emitOwnedEvent({
 			type: "cron.run.updated",
 			runId: run.receipt.runId,
 			jobId: run.receipt.jobId,
@@ -233279,6 +233696,30 @@ var CronManager = class {
 			durable: run.durable
 		});
 	}
+	emitOwnedEvent(event) {
+		this.operations.run("event", () => Promise.resolve(this.agent.emitEvent(event))).catch((error) => {
+			this.agent.log?.warn?.("cron event publication failed", error);
+		});
+	}
+	assertAdmissionOpen() {
+		if (this.admission.closed) throw new Error("Cron admission is closed for quiescence");
+	}
+	runSynchronous(id, operation) {
+		this.assertAdmissionOpen();
+		let result;
+		this.operations.run(id, () => {
+			result = operation();
+			return Promise.resolve();
+		});
+		return result;
+	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0 || this.persistQueues.size > 0 || this.activeRuns.size > 0 || this.store.list().some((task) => task.paused !== true) || this.runStore.list().some((run) => run.receipt.status === "buffered" || run.receipt.status === "running");
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
+	}
 	/**
 	* Serialize per-id persistence writes. Concurrent mutations on the
 	* same id (uncommon but reachable via `add` immediately followed by
@@ -233315,7 +233756,7 @@ var CronManager = class {
 	* sequence and tests can opt into "ensure started" without bookkeeping.
 	*/
 	start() {
-		if (this.admissionClosed) throw new Error("Cron admission is closed for quiescence");
+		this.assertAdmissionOpen();
 		if (this.started) return;
 		this.started = true;
 		this.scheduler.start();
@@ -233334,19 +233775,21 @@ var CronManager = class {
 	* would be missing from the resume's `loadFromDisk()`.
 	*/
 	async stop() {
-		this.unbindSigusr1();
-		await this.scheduler.stop();
-		await this.flushPersist();
-		this.started = false;
+		if (this.admission.reserved) throw new Error("Cron admission is closed for quiescence");
+		return this.operations.run("stop", async () => {
+			this.unbindSigusr1();
+			await this.scheduler.stop();
+			await this.flushPersist();
+			this.started = false;
+		});
 	}
 	/** Host shutdown only; retain all scheduled jobs and their cursor state. */
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
 	}
 	/** Drive one scheduler tick synchronously. Used by tests + P1.8 SIGUSR1. */
 	tick() {
-		if (this.admissionClosed) throw new Error("Cron admission is closed for quiescence");
-		this.scheduler.tick();
+		this.runSynchronous("tick", () => this.scheduler.tick());
 	}
 	/**
 	* Earliest theoretical (post-jitter) next-fire across all tasks, or
@@ -233438,7 +233881,7 @@ var CronManager = class {
 			finalMessageRef: null,
 			unavailableReason
 		}));
-		if (ctx.coalescedCount > CRON_COALESCE_WARNING_THRESHOLD) this.agent.emitEvent({
+		if (ctx.coalescedCount > CRON_COALESCE_WARNING_THRESHOLD) this.emitOwnedEvent({
 			type: "warning",
 			code: "cron.coalesced",
 			message: `Cron warning: ${String(ctx.coalescedCount)} scheduled runs were coalesced. Check the session before continuing.`
@@ -233447,7 +233890,7 @@ var CronManager = class {
 			const warningKey = unavailableReason === "session_stopped" ? unavailableReason : `${unavailableReason}:${String(maxContextTokens)}`;
 			if (this.lastUnavailableWarning !== warningKey) {
 				this.lastUnavailableWarning = warningKey;
-				this.agent.emitEvent({
+				this.emitOwnedEvent({
 					type: "warning",
 					code: `cron.${unavailableReason}`,
 					message: unavailableReason === "session_stopped" ? "Cron stopped because compaction failed twice in this session. Start a fresh session after saving pending work." : `Cron stopped because pending history reached the ${String(maxContextTokens)} token context limit. Start a fresh session after saving pending work.`
@@ -233477,7 +233920,7 @@ var CronManager = class {
 			type: "text",
 			text: renderCronFireXml(origin, task.prompt)
 		}];
-		this.agent.emitEvent({
+		this.emitOwnedEvent({
 			type: "cron.fired",
 			origin,
 			prompt: task.prompt
@@ -233523,14 +233966,16 @@ var CronManager = class {
 	* contract simple ("safe to call with anything, no-op when empty").
 	*/
 	handleMissed(tasks, renderMissedNotification) {
-		if (tasks.length === 0) return;
-		const content = renderMissedNotification(tasks);
-		const origin = {
-			kind: "cron_missed",
-			count: tasks.length
-		};
-		this.agent.turn.steer(content, origin);
-		this.agent.telemetry.track(CRON_MISSED, { count: tasks.length });
+		this.runSynchronous("missed", () => {
+			if (tasks.length === 0) return;
+			const content = renderMissedNotification(tasks);
+			const origin = {
+				kind: "cron_missed",
+				count: tasks.length
+			};
+			this.agent.turn.steer(content, origin);
+			this.agent.telemetry.track(CRON_MISSED, { count: tasks.length });
+		});
 	}
 	/**
 	* Emit `cron_scheduled` for a freshly-added task. Called by
@@ -235583,6 +236028,11 @@ function formatUndoUnavailableMessage(requestedCount, undoableCount, stoppedAtCo
 }
 //#endregion
 //#region ../../packages/agent-core/src/agent/injection/injector.ts
+function latestMatchingSystemReminderIndex(history, variant, injection) {
+	const latestIndex = history.findLastIndex((message) => message.origin?.kind === "injection" && message.origin.variant === variant);
+	const latest = history[latestIndex];
+	return latest?.role === "user" && latest.toolCalls.length === 0 && latest.content.length === 1 && latest.content[0]?.type === "text" && latest.content[0].text === `<system-reminder>\n${injection.trim()}\n</system-reminder>` ? latestIndex : void 0;
+}
 var DynamicInjector;
 var init_injector = __esmMin((() => {
 	DynamicInjector = class {
@@ -235611,9 +236061,8 @@ var init_injector = __esmMin((() => {
 			const injection = await this.getInjection();
 			if (injection) {
 				if (this.dedupeIdenticalWhilePresent) {
-					const latestIndex = this.agent.context.history.findLastIndex((message) => message.origin?.kind === "injection" && message.origin.variant === this.injectionVariant);
-					const latest = this.agent.context.history[latestIndex];
-					if (latest?.role === "user" && latest.toolCalls.length === 0 && latest.content.length === 1 && latest.content[0]?.type === "text" && latest.content[0].text === `<system-reminder>\n${injection.trim()}\n</system-reminder>`) {
+					const latestIndex = latestMatchingSystemReminderIndex(this.agent.context.history, this.injectionVariant, injection);
+					if (latestIndex !== void 0) {
 						this.injectedAt = latestIndex;
 						return;
 					}
@@ -236069,7 +236518,7 @@ var HookEngine = class {
 	options;
 	byEvent = /* @__PURE__ */ new Map();
 	pendingTriggers = /* @__PURE__ */ new Set();
-	admissionClosed = false;
+	admission = new AdmissionGate();
 	executionCounter = 0;
 	executionAbort = new AbortController();
 	executions = new ExecutionLedger();
@@ -236090,7 +236539,14 @@ var HookEngine = class {
 		return this.matchingHooks(event, matcherValue).length > 0;
 	}
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
+	}
+	get hasPendingWork() {
+		return this.executions.pending.length > 0 || this.pendingTriggers.size > 0;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
 	}
 	get pendingExecutions() {
 		return this.executions.pending.map((entry) => ({ ...entry }));
@@ -236111,15 +236567,13 @@ var HookEngine = class {
 		};
 	}
 	trigger(event, args = {}) {
-		if (this.admissionClosed) return Promise.resolve([]);
+		if (this.admission.closed) return Promise.resolve([]);
 		try {
 			const id = `${event}:${++this.executionCounter}`;
-			const completion = this.triggerInner(event, args, id).catch(() => []);
-			this.executions.track({
+			return this.executions.run({
 				kind: "trigger",
 				id
-			}, completion);
-			return completion;
+			}, () => this.triggerInner(event, args, id).catch(() => []));
 		} catch {
 			return Promise.resolve([]);
 		}
@@ -236169,7 +236623,7 @@ var HookEngine = class {
 		this.emitTriggered(event, matcherValue, matched.length);
 		const startedAt = Date.now();
 		const results = (await Promise.all(matched.map(async (hook, index) => {
-			if (this.admissionClosed) return void 0;
+			if (this.admission.closed) return void 0;
 			let runtimeEnv;
 			try {
 				runtimeEnv = this.options.runtimeEnv?.(hook);
@@ -236179,7 +236633,7 @@ var HookEngine = class {
 					stderr: "Hook runtime environment is unavailable."
 				};
 			}
-			if (this.admissionClosed) return void 0;
+			if (this.admission.closed) return void 0;
 			let hookInput;
 			try {
 				hookInput = this.options.runtimeInput?.(hook, inputData) ?? inputData;
@@ -239241,6 +239695,7 @@ var init_mission_contract_bridge = __esmMin((() => {
 	normalize = normalize$1;
 	MissionContractInjector = class extends DynamicInjector {
 		injectionVariant = "mission_contract";
+		dedupeIdenticalWhilePresent = true;
 		config;
 		evidenceState = null;
 		contractValue = null;
@@ -241798,6 +242253,8 @@ function isWithin$1(child, parent) {
 const LISTING_DESC_MAX = 250;
 const MODEL_SKILL_LISTING_MAX_CHARS = 8e3;
 var SessionSkillRegistry = class {
+	admission = new AdmissionGate();
+	operations = new ExecutionLedger();
 	byName = /* @__PURE__ */ new Map();
 	byPluginAndName = /* @__PURE__ */ new Map();
 	roots = [];
@@ -241811,27 +242268,54 @@ var SessionSkillRegistry = class {
 		this.sessionId = options.sessionId;
 	}
 	async loadRoots(roots) {
-		for (const root of roots) if (!this.roots.includes(root.path)) this.roots.push(root.path);
-		const skills = await this.discoverImpl({
-			roots,
-			onWarning: this.onWarning,
-			onSkippedByPolicy: (skill) => this.skipped.push(skill),
-			onDiscoveredSkill: (skill) => {
-				this.indexPluginSkill(skill);
-			}
+		this.assertAdmissionOpen();
+		return this.operations.run("load", async () => {
+			for (const root of roots) if (!this.roots.includes(root.path)) this.roots.push(root.path);
+			const skills = await this.discoverImpl({
+				roots,
+				onWarning: this.onWarning,
+				onSkippedByPolicy: (skill) => this.skipped.push(skill),
+				onDiscoveredSkill: (skill) => {
+					this.indexPluginSkill(skill);
+				}
+			});
+			for (const skill of skills) this.byName.set(normalizeSkillName(skill.name), skill);
 		});
-		for (const skill of skills) this.byName.set(normalizeSkillName(skill.name), skill);
 	}
 	registerBuiltinSkill(skill) {
-		this.register(skill.source === "builtin" ? skill : {
-			...skill,
-			source: "builtin"
+		this.mutate("builtin", () => {
+			this.register(skill.source === "builtin" ? skill : {
+				...skill,
+				source: "builtin"
+			});
 		});
 	}
 	register(skill, options = {}) {
-		const key = normalizeSkillName(skill.name);
-		if (options.replace === true || !this.byName.has(key)) this.byName.set(key, skill);
-		this.indexPluginSkill(skill, options);
+		this.mutate("register", () => {
+			const key = normalizeSkillName(skill.name);
+			if (options.replace === true || !this.byName.has(key)) this.byName.set(key, skill);
+			this.indexPluginSkill(skill, options);
+		});
+	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
+	}
+	closeAdmission() {
+		this.admission.close();
+	}
+	assertAdmissionOpen() {
+		if (this.admission.closed) throw new Error("Skill work admission is closed");
+	}
+	mutate(detail, operation) {
+		this.assertAdmissionOpen();
+		this.operations.run(detail, () => {
+			operation();
+			return Promise.resolve();
+		});
 	}
 	getSkill(name) {
 		return this.byName.get(normalizeSkillName(name));
@@ -265778,7 +266262,11 @@ function toolResultMaxChars(maxContextTokens) {
 async function budgetToolResultForModel(options) {
 	const text = persistableToolResultText(options.result.output);
 	const maxChars = toolResultMaxChars(options.maxContextTokens);
-	if (text === void 0 || text.length <= maxChars) return options.result;
+	if (text === void 0) return options.result;
+	const tokenWindow = options.maxContextTokens;
+	const exceedsChars = text.length > maxChars;
+	const exceedsTokenWindow = !exceedsChars && tokenWindow !== void 0 && Number.isFinite(tokenWindow) && tokenWindow > 0 && text.length > tokenWindow && estimateTokens(text) > tokenWindow;
+	if (!exceedsChars && !exceedsTokenWindow) return options.result;
 	if (options.result.truncated === true) return options.result;
 	if (options.homedir === void 0) return options.result;
 	if (text.includes("\0") || Buffer.from(text, "utf8").toString("utf8") !== text || text.split("\n").some((line) => line.length > 2e3)) return options.result;
@@ -265789,7 +266277,8 @@ async function budgetToolResultForModel(options) {
 		toolCallId: options.toolCallId
 	}, text);
 	if (outputPath === void 0) return options.result;
-	const output = renderPersistedToolResult(options.toolName, options.toolCallId, text, outputPath, maxChars);
+	const output = renderPersistedToolResult(options.toolName, options.toolCallId, text, outputPath, maxChars, exceedsTokenWindow, tokenWindow);
+	if (exceedsTokenWindow && tokenWindow !== void 0 && estimateTokens(output) > tokenWindow) return options.result;
 	return options.result.isError === true ? {
 		...options.result,
 		output,
@@ -265821,9 +266310,9 @@ async function saveToolResult(options, text) {
 		return;
 	}
 }
-function renderPersistedToolResult(toolName, toolCallId, text, outputPath, maxChars) {
+function renderPersistedToolResult(toolName, toolCallId, text, outputPath, maxChars, exceedsTokenWindow, tokenWindow) {
 	const lines = [
-		`Tool output exceeded ${String(maxChars)} characters; showing a preview only.`,
+		exceedsTokenWindow ? `Tool output estimate exceeded the ${String(tokenWindow)}-token model context window; showing a preview only.` : `Tool output exceeded ${String(maxChars)} characters; showing a preview only.`,
 		`tool_name: ${toolName}`,
 		`tool_call_id: ${toolCallId}`,
 		`output_size_chars: ${String(text.length)}`,
@@ -265832,6 +266321,19 @@ function renderPersistedToolResult(toolName, toolCallId, text, outputPath, maxCh
 		"next_step: Use Read with output_path to page through the full output."
 	];
 	let preview = text.slice(0, TOOL_RESULT_PREVIEW_CHARS);
+	if (tokenWindow !== void 0 && Number.isFinite(tokenWindow) && tokenWindow > 0) {
+		const remaining = Math.max(0, Math.floor(tokenWindow) - estimateTokens(lines.join("\n") + "\n\n[preview]\n"));
+		if (estimateTokens(preview) > remaining) {
+			let low = 0;
+			let high = preview.length;
+			while (low < high) {
+				const middle = Math.ceil((low + high) / 2);
+				if (estimateTokens(preview.slice(0, middle)) <= remaining) low = middle;
+				else high = middle - 1;
+			}
+			preview = preview.slice(0, low);
+		}
+	}
 	if (/[\uD800-\uDBFF]$/.test(preview)) preview = preview.slice(0, -1);
 	lines.push("", "[preview]", preview);
 	return lines.join("\n");
@@ -267849,7 +268351,7 @@ function blunToolsForOrigin(tools, origin) {
 * already eligible for this turn enter the loader; execution still follows
 * the ordinary permission pipeline.
 */
-function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PURE__ */ new Set(), requiredToolNames = /* @__PURE__ */ new Set(), selected = []) {
+function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PURE__ */ new Set(), requiredToolNames = /* @__PURE__ */ new Set(), selected = [], rankedToolNames = /* @__PURE__ */ new Set()) {
 	const schemaBudget = (0, import_turn_tool_performance_policy.toolSchemaBudgetTokens)(maxContextTokens);
 	const estimates = /* @__PURE__ */ new Map();
 	const estimateSummary = (tool) => {
@@ -267864,7 +268366,7 @@ function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PU
 		let total = 0;
 		for (const candidate of candidates) {
 			const estimate = estimateSummary(candidate);
-			if (estimate.complete === void 0) estimate.complete = estimate.summary + estimateTokens(JSON.stringify(candidate.parameters));
+			if (estimate.complete === void 0) estimate.complete = estimate.summary + estimateTokens(JSON.stringify(candidate.parameters), schemaBudget - estimate.summary);
 			total += estimate.complete;
 			if (total > schemaBudget) break;
 		}
@@ -267895,6 +268397,10 @@ function blunSelectTurnTools(tools, maxContextTokens, loadedToolNames = /* @__PU
 		if (!remembered.delete(name)) continue;
 		choose();
 	}
+	for (const name of rankedToolNames) {
+		const tool = tools.find((candidate) => candidate.name === name);
+		if (tool !== void 0 && !selected.some((candidate) => candidate.name === name) && estimateSelection([...selected, tool]) <= schemaBudget) selected.push(tool);
+	}
 	return selected;
 }
 const LLM_NOT_SET_MESSAGE = "LLM not set, send \"/login\" to login";
@@ -267952,7 +268458,7 @@ const GOAL_CONTINUATION_PROMPT = [
 ].join(" ");
 var TurnFlow = class {
 	agent;
-	admissionClosed = false;
+	admission = new AdmissionGate();
 	loadedToolNames = /* @__PURE__ */ new Set();
 	refreshSelectedTools;
 	executions = new ExecutionLedger();
@@ -267977,7 +268483,15 @@ var TurnFlow = class {
 	}
 	/** Explicit host shutdown only; ordinary cancellation remains resumable. */
 	closeAdmission() {
-		this.admissionClosed = true;
+		this.admission.close();
+	}
+	/** Turn-local reservation only; other native owners must be reserved separately. */
+	get hasPendingWork() {
+		return this.activeTurn !== null || this.steerBuffer.length > 0 || this.executions.pending.length > 0 || Boolean(this.agent.records.restoring) || this.agent.fullCompaction.isCompacting;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
 	}
 	async quiesce(options) {
 		const deadline = new QuiescenceDeadline(options.deadlineAt);
@@ -268004,7 +268518,7 @@ var TurnFlow = class {
 		return this.executions.pending;
 	}
 	assertAdmissionOpen() {
-		if (this.admissionClosed) throw new Error("Turn admission is closed for quiescence");
+		if (this.admission.closed) throw new Error("Turn admission is closed for quiescence");
 	}
 	/** Best-effort agent id (main / generated id) derived from the agent homedir. */
 	get agentId() {
@@ -268044,7 +268558,7 @@ var TurnFlow = class {
 	}
 	/** Buffer only into the currently active turn; never launch from an idle state. */
 	steerActive(input, expectedTurnId, origin = USER_PROMPT_ORIGIN) {
-		if (this.admissionClosed) return null;
+		if (this.admission.closed) return null;
 		const active = this.activeTurn;
 		if (active === null || active === "resuming" || !active.acceptingSteers || expectedTurnId !== void 0 && expectedTurnId !== this.currentId) return null;
 		this.agent.records.logRecord({
@@ -268062,7 +268576,7 @@ var TurnFlow = class {
 		});
 	}
 	launch(input, origin) {
-		if (this.admissionClosed) return null;
+		if (this.admission.closed) return null;
 		if (this.activeTurn) {
 			this.agent.emitEvent({
 				type: "error",
@@ -268077,11 +268591,10 @@ var TurnFlow = class {
 		const turnId = this.allocateTurnId();
 		const controller = new AbortController();
 		this.executingControllers.add(controller);
-		const promise = this.turnWorker(turnId, input, origin, controller.signal);
-		this.executions.track({
+		const promise = this.executions.run({
 			kind: "turn",
 			id: String(turnId)
-		}, promise);
+		}, () => this.turnWorker(turnId, input, origin, controller.signal));
 		promise.then(() => {
 			this.executingControllers.delete(controller);
 		}, () => {
@@ -268246,7 +268759,7 @@ var TurnFlow = class {
 	* draining into it via `flushSteerBuffer`.
 	*/
 	onCompactionFinished() {
-		if (this.admissionClosed) return;
+		if (this.admission.closed) return;
 		if (this.steerBuffer.length === 0) return;
 		if (this.activeTurn !== null) return;
 		const next = this.steerBuffer.shift();
@@ -268659,12 +269172,9 @@ var TurnFlow = class {
 					const required = (0, import_turn_tool_performance_policy.mediaToolNamesForTurnText)(blunExtractText(toolInput));
 					if (taskToolsNeeded) {
 						const maxContextTokens = this.agent.fullCompaction.getEffectiveMaxContextTokens();
-						blunSelectTurnTools(eligibleTools, maxContextTokens, this.loadedToolNames, required, selectedTools);
 						const trustedToolNames = new Set(eligibleTools.filter((tool) => this.agent.tools.isUserTool(tool)).map((tool) => tool.name));
-						for (const name of (0, import_turn_tool_performance_policy.rankedToolNamesForTurnText)(eligibleTools, blunExtractText(intent), { trustedToolNames })) {
-							const tool = eligibleTools.find((candidate) => candidate.name === name);
-							if (tool !== void 0 && !selectedTools.some((candidate) => candidate.name === name) && estimateTokensForTools([...selectedTools, tool]) <= (0, import_turn_tool_performance_policy.toolSchemaBudgetTokens)(maxContextTokens)) selectedTools.push(tool);
-						}
+						const ranked = (0, import_turn_tool_performance_policy.rankedToolNamesForTurnText)(eligibleTools, blunExtractText(intent), { trustedToolNames });
+						blunSelectTurnTools(eligibleTools, maxContextTokens, this.loadedToolNames, required, selectedTools, ranked);
 					} else selectedTools.splice(0, selectedTools.length, ...eligibleTools.filter((tool) => BLUN_LANGUAGE_REVIEW_TOOL_NAMES.has(tool.name) || BLUN_TELEGRAM_OUTBOUND_TOOL_RE.test(tool.name)));
 					recordPreRequestPhase("tool-selection", selectionStartedAt);
 					return selectedTools;
@@ -303285,6 +303795,9 @@ var StdioMcpClient = class {
 	started = false;
 	closed = false;
 	ready = false;
+	processSpawned = false;
+	processClosed;
+	resolveProcessClosed;
 	hooksInstalled = false;
 	unexpectedCloseListener;
 	lastTransportError;
@@ -303293,6 +303806,9 @@ var StdioMcpClient = class {
 	static stderrBufferCapacity = STDERR_BUFFER_CAPACITY;
 	constructor(config, options = {}) {
 		if (config.executor !== void 0 && config.executor !== "local") throw new BlunError(ErrorCodes.NOT_IMPLEMENTED, `MCP stdio executor '${config.executor}' is not yet implemented`);
+		this.processClosed = new Promise((resolve) => {
+			this.resolveProcessClosed = resolve;
+		});
 		this.transport = new StdioClientTransport({
 			command: config.command,
 			args: config.args,
@@ -303300,6 +303816,12 @@ var StdioMcpClient = class {
 			cwd: resolveStdioCwd(config.cwd, options.defaultCwd),
 			stderr: "pipe"
 		});
+		const start = this.transport.start.bind(this.transport);
+		this.transport.start = () => {
+			const completion = start();
+			this.processSpawned = this.transport.pid !== null;
+			return completion;
+		};
 		this.transport.stderr?.on("data", (chunk) => {
 			this.stderrBuffer.push(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
 		});
@@ -303331,6 +303853,10 @@ var StdioMcpClient = class {
 		this.closed = true;
 		await this.closeStartedClient();
 	}
+	/** SDK close can settle before the spawned process emits its actual close. */
+	getProcessCloseCompletion() {
+		return this.processSpawned ? this.processClosed : void 0;
+	}
 	/**
 	* Register a listener that fires when the underlying transport closes on
 	* its own — i.e. the caller has not yet invoked {@link close}. At most one
@@ -303377,6 +303903,9 @@ var StdioMcpClient = class {
 	installTransportHooks() {
 		if (this.hooksInstalled) return;
 		this.hooksInstalled = true;
+		this.transport.onclose = () => {
+			this.resolveProcessClosed();
+		};
 		this.client.onclose = () => {
 			if (this.closed) return;
 			if (!this.ready) return;
@@ -303488,6 +304017,11 @@ const DEFAULT_STARTUP_TIMEOUT_MS$1 = 3e4;
 */
 var McpConnectionManager = class {
 	options;
+	admission = new AdmissionGate();
+	operations = new ExecutionLedger();
+	ownedClients = /* @__PURE__ */ new WeakMap();
+	closingClients = /* @__PURE__ */ new WeakMap();
+	unconfirmedCloses = /* @__PURE__ */ new Set();
 	entries = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
 	initialLoad = Promise.resolve();
@@ -303548,22 +304082,27 @@ var McpConnectionManager = class {
 		const entry = this.entries.get(name);
 		if (entry?.status !== "connected" || entry.tools === void 0 || entry.client === void 0) return;
 		return {
-			client: entry.client,
+			client: this.ownedClient(entry.client),
 			tools: entry.tools,
 			enabledNames: entry.enabledNames ?? new Set(entry.tools.map((t) => t.name))
 		};
 	}
 	connectAll(configs) {
-		const attemptId = ++this.initialLoadAttemptId;
-		this.initialLoadStartedAt = Date.now();
-		this.initialLoadFinishedAt = void 0;
-		const initialLoad = this.connectAllNow(configs).finally(() => {
-			if (this.initialLoadAttemptId === attemptId) this.initialLoadFinishedAt = Date.now();
+		return this.runOperation("connect-all", () => {
+			const attemptId = ++this.initialLoadAttemptId;
+			this.initialLoadStartedAt = Date.now();
+			this.initialLoadFinishedAt = void 0;
+			const initialLoad = this.connectAllNow(configs).finally(() => {
+				if (this.initialLoadAttemptId === attemptId) this.initialLoadFinishedAt = Date.now();
+			});
+			this.initialLoad = initialLoad;
+			return initialLoad;
 		});
-		this.initialLoad = initialLoad;
-		return initialLoad;
 	}
 	async connect(name, config) {
+		return this.runOperation("connect", () => this.connectNow(name, config));
+	}
+	async connectNow(name, config) {
 		const previous = this.entries.get(name);
 		if (previous !== void 0) await this.closeClient(previous);
 		const disabled = config.enabled === false;
@@ -303578,6 +304117,9 @@ var McpConnectionManager = class {
 		if (!disabled) await this.connectOne(entry, this.beginConnectAttempt(entry));
 	}
 	async remove(name) {
+		return this.runOperation("remove", () => this.removeNow(name));
+	}
+	async removeNow(name) {
 		const entry = this.entries.get(name);
 		if (entry === void 0) return false;
 		await this.closeClient(entry);
@@ -303616,6 +304158,9 @@ var McpConnectionManager = class {
 		await Promise.allSettled(tasks);
 	}
 	async reconnect(name) {
+		return this.runOperation("reconnect", () => this.reconnectNow(name));
+	}
+	async reconnectNow(name) {
 		const entry = this.entries.get(name);
 		if (entry === void 0) throw new BlunError(ErrorCodes.MCP_SERVER_NOT_FOUND, `Unknown MCP server: ${name}`);
 		if (entry.config.enabled === false) throw new BlunError(ErrorCodes.MCP_SERVER_DISABLED, `MCP server is disabled: ${name}`);
@@ -303636,11 +304181,45 @@ var McpConnectionManager = class {
 		}
 	}
 	async shutdown() {
+		if (this.admission.reserved) throw new Error("MCP work admission is closed");
+		return this.operations.run("shutdown", () => this.shutdownNow());
+	}
+	async shutdownNow() {
 		const entries = Array.from(this.entries.values());
 		this.entries.clear();
 		const tasks = entries.map((entry) => this.closeClient(entry));
 		await Promise.allSettled(tasks);
 	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0 || this.unconfirmedCloses.size > 0;
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
+	}
+	closeAdmission() {
+		this.admission.close();
+	}
+	waitForOperations() {
+		return this.operations.drain();
+	}
+	runOperation(detail, operation) {
+		if (this.admission.closed) throw new Error("MCP work admission is closed");
+		return this.operations.run(detail, operation);
+	}
+	ownedClient(client) {
+		let owned = this.ownedClients.get(client);
+		if (owned === void 0) {
+			const native = client;
+			owned = {
+				getInstructions: () => native.getInstructions?.(),
+				listTools: async () => this.runOperation("list-tools", () => client.listTools()),
+				callTool: async (name, args, signal) => this.runOperation("call-tool", () => client.callTool(name, args, signal))
+			};
+			this.ownedClients.set(client, owned);
+		}
+		return owned;
+	}
 	async connectOne(entry, attemptId) {
 		const timeoutMs = entry.config.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS$1;
 		let client;
@@ -303648,7 +304227,7 @@ var McpConnectionManager = class {
 			const startupClient = this.createClient(entry.config, entry.name);
 			client = startupClient;
 			entry.client = startupClient;
-			const tools = await withTimeout(this.connectAndDiscoverTools(startupClient), timeoutMs, () => {
+			const tools = await withTimeout(this.operations.run("startup", () => this.connectAndDiscoverTools(startupClient)), timeoutMs, () => {
 				this.closeRuntimeClient(startupClient);
 			});
 			if (!this.isCurrent(entry, attemptId)) {
@@ -303682,13 +304261,16 @@ var McpConnectionManager = class {
 		client.onUnexpectedClose((reason) => {
 			if (!this.isCurrent(entry, attemptId)) return;
 			if (entry.client !== client) return;
-			entry.status = "failed";
-			entry.error = formatUnexpectedCloseError(entry.name, reason);
-			entry.tools = void 0;
-			entry.enabledNames = void 0;
-			entry.client = void 0;
-			this.closeRuntimeClient(client);
-			this.emit(entry);
+			this.operations.run("transport-close", () => {
+				entry.status = "failed";
+				entry.error = formatUnexpectedCloseError(entry.name, reason);
+				entry.tools = void 0;
+				entry.enabledNames = void 0;
+				entry.client = void 0;
+				const completion = this.closeRuntimeClient(client);
+				this.emit(entry);
+				return completion;
+			});
 		});
 	}
 	beginConnectAttempt(entry) {
@@ -303751,9 +304333,24 @@ var McpConnectionManager = class {
 		await this.closeRuntimeClient(client);
 	}
 	async closeRuntimeClient(client) {
-		try {
-			await client.close();
-		} catch {}
+		const existing = this.closingClients.get(client);
+		if (existing !== void 0) return existing;
+		const processClosed = client instanceof StdioMcpClient ? client.getProcessCloseCompletion() : void 0;
+		let processConfirmed = false;
+		if (processClosed !== void 0) this.operations.run("process-close", async () => {
+			await processClosed;
+			processConfirmed = true;
+			this.unconfirmedCloses.delete(client);
+		});
+		const completion = this.operations.run("close", async () => {
+			try {
+				await client.close();
+			} catch {
+				if (!processConfirmed) this.unconfirmedCloses.add(client);
+			}
+		});
+		this.closingClients.set(client, completion);
+		return completion;
 	}
 	isCurrent(entry, attemptId) {
 		return this.entries.get(entry.name) === entry && entry.attemptId === attemptId;
@@ -304109,6 +304706,168 @@ function hasLegacyLocalMemorySystemBlock(systemPrompt) {
 	return candidate.includes(LEGACY_LOCAL_MEMORY_LOCATION) && candidate.includes(LEGACY_LOCAL_MEMORY_SAVE) && candidate.includes("MEMORY.md");
 }
 //#endregion
+//#region ../../packages/agent-core/src/utils/host-work.ts
+function bindHostEffectMethod(methods, owner, name, asynchronous, kind, detail) {
+	const method = Reflect.get(methods, name);
+	Object.defineProperty(methods, name, {
+		configurable: true,
+		writable: true,
+		value: (...args) => {
+			try {
+				return owner.runHostEffect(detail, () => Reflect.apply(method, methods, args), kind);
+			} catch (error) {
+				if (asynchronous) return Promise.reject(error);
+				throw error;
+			}
+		}
+	});
+}
+//#endregion
+//#region ../../packages/agent-core/src/session/host-work.ts
+const DIRECT_WORK = {
+	setToolKaos: false,
+	setAdditionalDirs: true,
+	setAllowedTools: true,
+	addAdditionalDir: true,
+	createMain: true,
+	resume: true,
+	setAccountMemoryContext: false,
+	setRuntimeModelContext: false,
+	generateAgentsMd: true,
+	appendPluginSessionStartReminder: true,
+	applyMcpServerConfig: true,
+	getSessionWarnings: true,
+	waitForBackgroundTasksOnPrint: true,
+	close: true,
+	closeForReload: true
+};
+function bindDirectSessionWork(session) {
+	for (const [name, asynchronous] of Object.entries(DIRECT_WORK)) bindHostEffectMethod(session, session, name, asynchronous, [
+		"close",
+		"closeForReload",
+		"getSessionWarnings",
+		"waitForBackgroundTasksOnPrint"
+	].includes(name) ? "teardown" : "work", `session:${name}`);
+}
+//#endregion
+//#region ../../packages/agent-core/src/session/idle-admission.ts
+function nativeOwners(session, id, agent) {
+	if (!(agent.turn instanceof TurnFlow) || !(agent.fullCompaction instanceof FullCompaction) || !(agent.background instanceof BackgroundManager) || !(agent.records instanceof AgentRecords) || !(agent.goal instanceof GoalMode) || !(agent.subagentHost instanceof SessionSubagentHost) || !agent.subagentHost.belongsTo(session, id) || agent.cron !== null && !(agent.cron instanceof CronManager) || agent.hooks !== void 0 && !(agent.hooks instanceof HookEngine)) return void 0;
+	return [
+		agent.turn,
+		agent.fullCompaction,
+		agent.background,
+		agent.subagentHost,
+		...agent.cron === null ? [] : [agent.cron],
+		...agent.hooks === void 0 ? [] : [agent.hooks]
+	];
+}
+/** Identity receipts only; the Session maps remain the sole enumerable agent catalog. */
+var SessionIdleAdmission = class {
+	session;
+	admission;
+	sessionPending;
+	sessionVersion;
+	identities = /* @__PURE__ */ new WeakMap();
+	shared;
+	constructor(session, admission, sessionPending, sessionVersion) {
+		this.session = session;
+		this.admission = admission;
+		this.sessionPending = sessionPending;
+		this.sessionVersion = sessionVersion;
+		this.shared = [
+			session.skills,
+			session.mcp,
+			session.hookEngine,
+			...session.lsp === void 0 ? [] : [session.lsp]
+		];
+	}
+	register(id, agent) {
+		const owners = nativeOwners(this.session, id, agent);
+		if (owners) this.identities.set(agent, {
+			id,
+			owners,
+			records: agent.records,
+			goal: agent.goal
+		});
+	}
+	snapshot() {
+		if (this.sessionPending()) return void 0;
+		const shared = [
+			this.session.skills,
+			this.session.mcp,
+			this.session.hookEngine,
+			...this.session.lsp === void 0 ? [] : [this.session.lsp]
+		];
+		if (shared.length !== this.shared.length || shared.some((owner, index) => owner !== this.shared[index])) return void 0;
+		const agents = [...this.session.agents];
+		if (!this.session.agents.has("main")) return void 0;
+		const identities = [];
+		const versions = [];
+		for (const [id, agent] of agents) {
+			if (!(agent instanceof Agent$1)) return void 0;
+			const identity = this.identities.get(agent);
+			const owners = nativeOwners(this.session, id, agent);
+			if (!identity || identity.id !== id || !owners || owners.length !== identity.owners.length || owners.some((owner, index) => owner !== identity.owners[index]) || agent.records !== identity.records || agent.goal !== identity.goal || agent.records.hasPendingWork || agent.goal.getActiveGoal() !== null) return void 0;
+			identities.push(identity);
+			versions.push(agent.records.version);
+		}
+		if (Object.keys(this.session.metadata.agents).some((id) => !this.session.agents.has(id))) return void 0;
+		return {
+			agents,
+			identities,
+			versions,
+			metadata: this.session.metadata,
+			scope: JSON.stringify({
+				id: this.session.options.id,
+				homedir: this.session.options.homedir,
+				blunHomeDir: this.session.options.blunHomeDir,
+				additionalDirs: this.session.getAdditionalDirs(),
+				mcp: this.session.mcpConfigSnapshot()
+			}),
+			text: JSON.stringify(this.session.metadata),
+			version: this.sessionVersion()
+		};
+	}
+	tryReserve() {
+		const ownRelease = this.admission.tryReserve();
+		if (!ownRelease) return void 0;
+		const releases = [ownRelease];
+		let retained = false;
+		try {
+			const snapshot = this.snapshot();
+			if (!snapshot) return void 0;
+			const owners = [...new Set([...this.shared, ...snapshot.identities.flatMap((identity) => identity.owners)])];
+			for (const owner of owners) {
+				if (owner.hasPendingWork) return void 0;
+				const release = owner.tryReserveIdleAdmission();
+				if (!release) return void 0;
+				releases.push(release);
+			}
+			const lease = new IdleAdmissionReservation(releases, () => {
+				const fresh = this.snapshot();
+				return owners.every((owner) => !owner.hasPendingWork) && fresh !== void 0 && fresh.version === snapshot.version && fresh.metadata === snapshot.metadata && fresh.text === snapshot.text && fresh.scope === snapshot.scope && fresh.agents.length === snapshot.agents.length && fresh.agents.every(([id, agent], index) => id === snapshot.agents[index][0] && agent === snapshot.agents[index][1]) && fresh.versions.every((version, index) => version === snapshot.versions[index]);
+			}, () => !this.sessionPending() && this.sessionVersion() === snapshot.version && this.session.metadata === snapshot.metadata && this.session.agents.size === snapshot.agents.length && snapshot.agents.every(([id, agent]) => this.session.agents.get(id) === agent) && snapshot.identities.every((identity, index) => !identity.records.hasPendingWork && identity.records.version === snapshot.versions[index]) && owners.every((owner) => !owner.hasPendingWork));
+			if (!lease.isValid()) return void 0;
+			retained = true;
+			return lease;
+		} catch {
+			return;
+		} finally {
+			if (!retained) for (const release of releases.reverse()) release();
+		}
+	}
+};
+//#endregion
+//#region ../../packages/agent-core/src/session/host-events.ts
+/** Publication settlement belongs to the session, even during native teardown. */
+function withOwnedSessionEvents(rpc, operations) {
+	const emitEvent = (...args) => operations.run("rpc-event", () => rpc.emitEvent(...args));
+	return new Proxy(rpc, { get(target, property) {
+		return property === "emitEvent" ? emitEvent : Reflect.get(target, property, target);
+	} });
+}
+//#endregion
 //#region ../../packages/agent-core/src/lsp/client.ts
 const DEFAULT_STARTUP_TIMEOUT_MS = 1e4;
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 2e3;
@@ -304117,6 +304876,10 @@ var StdioLspClient = class {
 	name;
 	config;
 	cwd;
+	operations = new ExecutionLedger();
+	children = /* @__PURE__ */ new Set();
+	processEnds = /* @__PURE__ */ new WeakMap();
+	closingProcesses = /* @__PURE__ */ new WeakSet();
 	process;
 	startPromise;
 	stdout = Buffer.alloc(0);
@@ -304137,10 +304900,16 @@ var StdioLspClient = class {
 	get generation() {
 		return this._generation;
 	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0;
+	}
+	waitForOperations() {
+		return this.operations.drain();
+	}
 	async start() {
-		if (this.running) return;
 		if (this.startPromise !== void 0) return this.startPromise;
-		this.startPromise = this.startInternal().catch((error) => {
+		if (this.running) return;
+		this.startPromise = this.operations.run("startup", () => this.startInternal()).catch((error) => {
 			this.startPromise = void 0;
 			throw error;
 		});
@@ -304165,6 +304934,9 @@ var StdioLspClient = class {
 		this.diagnosticsByUri.delete(uri);
 	}
 	async waitForDiagnostics(uri, timeoutMs = 300) {
+		return this.operations.run("diagnostics", () => this.waitForDiagnosticsNow(uri, timeoutMs));
+	}
+	async waitForDiagnosticsNow(uri, timeoutMs) {
 		const current = this.diagnosticsByUri.get(uri);
 		if (current !== void 0) return current;
 		let notify;
@@ -304184,8 +304956,15 @@ var StdioLspClient = class {
 		return this.diagnosticsByUri.get(uri) ?? [];
 	}
 	async shutdown() {
+		return this.operations.run("shutdown", () => this.shutdownNow());
+	}
+	async shutdownNow() {
 		this.stopped = true;
 		const child = this.process;
+		for (const owned of this.children) {
+			this.retainProcessEnd(owned);
+			if (owned !== child && owned.exitCode === null) owned.kill();
+		}
 		if (child === void 0 || child.exitCode !== null) return;
 		try {
 			await this.sendRequest("shutdown", null, this.config.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS);
@@ -304216,11 +304995,38 @@ var StdioLspClient = class {
 			windowsHide: true
 		});
 		this.process = child;
-		child.stdout.on("data", (chunk) => this.onStdout(chunk));
+		this.stdout = Buffer.alloc(0);
+		this.children.add(child);
+		this.processEnds.set(child, new Promise((resolve) => {
+			child.once("close", () => {
+				this.operations.run("process-close", () => {
+					this.children.delete(child);
+					for (const [id, pending] of this.pending) {
+						if (pending.child !== child) continue;
+						clearTimeout(pending.timer);
+						this.pending.delete(id);
+						pending.reject(/* @__PURE__ */ new Error(`LSP server "${this.name}" closed before its response`));
+						pending.finish();
+					}
+					if (this.process === child) this.process = void 0;
+					resolve();
+					return Promise.resolve();
+				});
+			});
+		}));
+		child.stdout.on("data", (chunk) => {
+			if (this.process !== child) return;
+			this.operations.run("message", () => {
+				this.onStdout(chunk);
+				return Promise.resolve();
+			});
+		});
 		child.stderr.on("data", () => {});
-		child.once("error", (error) => this.failProcess(error));
+		child.once("error", (error) => {
+			if (this.process === child) this.failProcess(error);
+		});
 		child.once("exit", (code, signal) => {
-			if (!this.stopped) this.failProcess(/* @__PURE__ */ new Error(`LSP server "${this.name}" exited unexpectedly (${code === null ? signal : String(code)})`));
+			if (!this.stopped && this.process === child) this.failProcess(/* @__PURE__ */ new Error(`LSP server "${this.name}" exited unexpectedly (${code === null ? signal : String(code)})`));
 		});
 		const rootPath = this.config.workspaceFolder ?? this.cwd;
 		const rootUri = pathToFileURL(rootPath).href;
@@ -304252,6 +305058,7 @@ var StdioLspClient = class {
 			this._generation++;
 			if (this.config.settings !== void 0) this.notify("workspace/didChangeConfiguration", { settings: this.config.settings });
 		} catch (error) {
+			this.retainProcessEnd(child);
 			if (child.exitCode === null) child.kill();
 			const message = error instanceof Error ? error.message : String(error);
 			throw new Error(`Failed to start LSP server "${this.name}" (${this.config.command}): ${message}`, { cause: error });
@@ -304259,13 +305066,20 @@ var StdioLspClient = class {
 	}
 	sendRequest(method, params, timeoutMs) {
 		const id = this.nextId++;
+		const child = this.process;
+		if (child === void 0) return Promise.reject(/* @__PURE__ */ new Error(`LSP server "${this.name}" is not available`));
+		let finish;
+		this.operations.run("request-end", () => new Promise((resolve) => {
+			finish = resolve;
+		}));
 		return new Promise((resolve, reject) => {
 			const timer = setTimeout(() => {
-				this.pending.delete(id);
 				reject(/* @__PURE__ */ new Error(`LSP request "${method}" timed out after ${String(timeoutMs)} ms`));
 			}, timeoutMs);
 			timer.unref?.();
 			this.pending.set(id, {
+				child,
+				finish,
 				resolve,
 				reject,
 				timer
@@ -304280,6 +305094,7 @@ var StdioLspClient = class {
 			} catch (error) {
 				clearTimeout(timer);
 				this.pending.delete(id);
+				finish();
 				reject(error instanceof Error ? error : new Error(String(error)));
 			}
 		});
@@ -304288,8 +305103,21 @@ var StdioLspClient = class {
 		const stdin = this.process?.stdin;
 		if (stdin === void 0 || stdin.destroyed) throw new Error(`LSP server "${this.name}" is not available`);
 		const body = Buffer.from(JSON.stringify(message), "utf8");
-		stdin.write(`Content-Length: ${String(body.length)}\r\n\r\n`);
-		stdin.write(body);
+		for (const chunk of [`Content-Length: ${String(body.length)}\r\n\r\n`, body]) {
+			let finish;
+			const completion = new Promise((resolve) => {
+				finish = resolve;
+			});
+			this.operations.run("write", () => {
+				try {
+					stdin.write(chunk, () => finish());
+				} catch (error) {
+					finish();
+					throw error;
+				}
+				return completion;
+			});
+		}
 	}
 	onStdout(chunk) {
 		this.stdout = Buffer.concat([this.stdout, chunk]);
@@ -304325,6 +305153,7 @@ var StdioLspClient = class {
 			if (pending === void 0) return;
 			clearTimeout(pending.timer);
 			this.pending.delete(message.id);
+			pending.finish();
 			if (message.error !== void 0) pending.reject(/* @__PURE__ */ new Error(`LSP request failed${message.error.code === void 0 ? "" : ` (${String(message.error.code)})`}: ${message.error.message ?? "unknown error"}`));
 			else pending.resolve(message.result);
 			return;
@@ -304378,15 +305207,25 @@ var StdioLspClient = class {
 		});
 	}
 	failProcess(error) {
+		const child = this.process;
+		if (child === void 0) return;
+		this.retainProcessEnd(child);
 		const wrapped = new Error(`LSP server "${this.name}" (${this.config.command}) failed: ${error.message}`, { cause: error });
 		for (const pending of this.pending.values()) {
+			if (pending.child !== child) continue;
 			clearTimeout(pending.timer);
 			pending.reject(wrapped);
 		}
-		this.pending.clear();
 		this.process = void 0;
 		if (this.config.restartOnCrash !== false && !this.stopped) this.startPromise = void 0;
 	}
+	retainProcessEnd(child) {
+		if (this.closingProcesses.has(child)) return;
+		const completion = this.processEnds.get(child);
+		if (completion === void 0) return;
+		this.closingProcesses.add(child);
+		this.operations.run("process-end", () => completion);
+	}
 };
 async function waitForExit(child, timeoutMs) {
 	if (child.exitCode !== null) return;
@@ -304403,6 +305242,8 @@ function delay(timeoutMs) {
 //#region ../../packages/agent-core/src/lsp/manager.ts
 var LspManager = class {
 	options;
+	admission = new AdmissionGate();
+	operations = new ExecutionLedger();
 	clients = /* @__PURE__ */ new Map();
 	openedDocuments = /* @__PURE__ */ new Map();
 	constructor(options) {
@@ -304415,15 +305256,20 @@ var LspManager = class {
 		return [...this.clients.entries()].filter(([, client]) => client.running).map(([name]) => name).toSorted();
 	}
 	async diagnosticsAfterChange(filePath) {
-		const resolvedPath = path.resolve(this.options.cwd, filePath);
-		if (!this.supportsPath(resolvedPath)) return void 0;
-		const diagnostics = await this.request({
-			operation: "diagnostics",
-			path: resolvedPath
+		return this.runOperation("diagnostics", async () => {
+			const resolvedPath = path.resolve(this.options.cwd, filePath);
+			if (!this.supportsPath(resolvedPath)) return void 0;
+			const diagnostics = await this.requestNow({
+				operation: "diagnostics",
+				path: resolvedPath
+			});
+			return Array.isArray(diagnostics) ? diagnostics : [];
 		});
-		return Array.isArray(diagnostics) ? diagnostics : [];
 	}
 	async request(input) {
+		return this.runOperation("request", () => this.requestNow(input));
+	}
+	async requestNow(input) {
 		if (input.operation === "workspace_symbols") {
 			if (input.query === void 0) throw new Error("workspace_symbols requires query");
 			const results = await Promise.allSettled(this.serverNames().map(async (name) => {
@@ -304451,10 +305297,38 @@ var LspManager = class {
 		return client.request(method, params);
 	}
 	async shutdown() {
-		await Promise.allSettled([...this.clients.values()].map((client) => client.shutdown()));
+		if (this.admission.reserved) throw new Error("LSP work admission is closed");
+		return this.operations.run("shutdown", () => this.shutdownNow());
+	}
+	async shutdownNow() {
+		await Promise.allSettled([...this.clients.values()].map((client) => {
+			const completion = client.shutdown();
+			this.operations.run("client-end", () => client.waitForOperations());
+			return completion;
+		}));
 		this.clients.clear();
 		this.openedDocuments.clear();
 	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0 || [...this.clients.values()].some((client) => client.hasPendingWork);
+	}
+	tryReserveIdleAdmission() {
+		if (this.hasPendingWork) return void 0;
+		return this.admission.tryReserve();
+	}
+	closeAdmission() {
+		this.admission.close();
+	}
+	async waitForOperations() {
+		do {
+			await this.operations.drain();
+			await Promise.all([...this.clients.values()].map((client) => client.waitForOperations()));
+		} while (this.hasPendingWork);
+	}
+	runOperation(detail, operation) {
+		if (this.admission.closed) throw new Error("LSP work admission is closed");
+		return this.operations.run(detail, operation);
+	}
 	clientForPath(filePath) {
 		const extension = path.extname(filePath).toLowerCase();
 		for (const [name, config] of Object.entries(this.options.servers)) {
@@ -304538,6 +305412,7 @@ function positionFrom(input) {
 }
 //#endregion
 //#region ../../packages/agent-core/src/session/index.ts
+init_injector();
 const BACKGROUND_KEEP_ALIVE_ON_EXIT_ENV = "BLUN_BACKGROUND_KEEP_ALIVE_ON_EXIT";
 const ACTIVE_TURN_CLOSE_TIMEOUT_MS = 8e3;
 const BASELINE_SKILL_NAME = "blun-design-dna";
@@ -304587,19 +305462,21 @@ var Session$1 = class {
 	accountMemoryContext = prepareRuntimeSystemPromptAppend(void 0);
 	agentSpineRuntime;
 	mcpLoadStarted = false;
-	workAdmissionClosed = false;
+	admission = new AdmissionGate();
+	idleAdmission;
 	agentOperations = new ExecutionLedger();
 	hostOperations = new ExecutionLedger();
 	quiescenceRecordFlushes = /* @__PURE__ */ new Map();
 	constructingAgents = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.options = options;
+		bindDirectSessionWork(this);
 		this.logHandle = options.id === void 0 ? void 0 : getRootLogger().attachSession({
 			sessionId: options.id,
 			sessionDir: options.homedir
 		});
 		this.log = this.logHandle?.logger ?? (options.id === void 0 ? log : log.createChild({ sessionId: options.id }));
-		this.rpc = options.rpc;
+		this.rpc = withOwnedSessionEvents(options.rpc, this.hostOperations);
 		this.experimentalFlags = options.experimentalFlags ?? new FlagResolver();
 		this.agentSpineRuntime = this.experimentalFlags.enabled("agent_spine_timeline") ? new AgentSpineSessionRuntime(options.agentSpineRuntime) : void 0;
 		this.visionReader = (this.experimentalFlags.enabled("vision_reader") ? createVisionReader(options.config?.services?.visionReader) : void 0) ?? createManagedMediaVisionReader(options.toolServices?.media);
@@ -304641,14 +305518,15 @@ var Session$1 = class {
 			cwd: options.kaos.getcwd(),
 			servers: options.lspServers
 		});
+		this.idleAdmission = new SessionIdleAdmission(this, this.admission, () => this.constructingAgents.size > 0 || this.agentOperations.pending.length > 0 || this.hostOperations.pending.length > 0, () => `${this.agentOperations.version}:${this.hostOperations.version}`);
 		this.mcp.onStatusChange((entry) => {
 			this.onMcpServerStatusChange(entry);
 		});
-		this.skillsReady = this.loadSkills().catch((error) => {
+		this.skillsReady = this.hostOperations.run("initial-skills", () => this.loadSkills().catch((error) => {
 			this.log.error("skills load failed", error);
 		}).then(() => {
 			this.refreshAgentBuiltinTools();
-		});
+		}));
 		if (!this.agentSpineRuntime?.hasRecipients) this.startMcpServers();
 	}
 	setToolKaos(kaos) {
@@ -304733,6 +305611,7 @@ var Session$1 = class {
 		return { warning };
 	}
 	async close() {
+		this.admission.close();
 		try {
 			await Promise.allSettled(Array.from(this.readyAgents(), async (agent) => agent.cron?.stop()));
 			await this.cancelActiveTurnsOnClose();
@@ -304748,6 +305627,7 @@ var Session$1 = class {
 		}
 	}
 	async closeForReload() {
+		this.admission.close();
 		try {
 			await Promise.allSettled(Array.from(this.readyAgents(), async (agent) => agent.cron?.stop()));
 			await this.flushMetadata();
@@ -304865,9 +305745,7 @@ var Session$1 = class {
 	}
 	async createAgent(config, options = {}) {
 		this.assertWorkAdmissionOpen();
-		const completion = this.createAgentInner(config, options);
-		this.agentOperations.track("create", completion);
-		return completion;
+		return this.agentOperations.run("create", () => this.createAgentInner(config, options));
 	}
 	async createAgentInner(config, options) {
 		await this.skillsReady;
@@ -304901,13 +305779,44 @@ var Session$1 = class {
 		}
 	}
 	assertWorkAdmissionOpen() {
-		if (this.workAdmissionClosed) throw new Error("Session work admission is closed for quiescence");
+		if (this.admission.closed) throw new Error("Session work admission is closed for quiescence");
+	}
+	assertNoIdleReservation() {
+		if (this.admission.reserved) throw new Error("Session work admission is reserved");
+	}
+	tryReserveIdleAdmission() {
+		return this.idleAdmission.tryReserve();
 	}
 	async runHostOperation(id, operation) {
 		this.assertWorkAdmissionOpen();
-		const completion = operation();
-		this.hostOperations.track(id, completion);
-		return completion;
+		return this.hostOperations.run(id, operation);
+	}
+	runHostEffect(id, operation, kind = "work") {
+		this.assertNoIdleReservation();
+		if (kind === "work") this.assertWorkAdmissionOpen();
+		let result;
+		this.hostOperations.run(id, () => {
+			result = operation();
+			return Promise.resolve(result);
+		});
+		return result;
+	}
+	get pendingHostOperations() {
+		return this.hostOperations.pending;
+	}
+	get pendingAgentOperations() {
+		return this.agentOperations.pending;
+	}
+	pendingSessionOperations() {
+		return [...this.agentOperations.pending.map((id) => ({
+			kind: "agent-setup",
+			id,
+			reason: "execution-pending"
+		})), ...this.hostOperations.pending.map((id) => ({
+			kind: "host-operation",
+			id,
+			reason: "execution-pending"
+		}))];
 	}
 	ownedAgents() {
 		const result = new Map(this.constructingAgents);
@@ -304955,7 +305864,7 @@ var Session$1 = class {
 	/** Explicit bounded host shutdown, independent of close/stop and keepAlive policy. */
 	async quiesce(options) {
 		const deadline = new QuiescenceDeadline(options.deadlineAt);
-		this.workAdmissionClosed = true;
+		this.admission.close();
 		const agents = this.ownedAgents();
 		const hooks = new Map([[this.hookEngine, void 0]]);
 		for (const [agentId, agent] of agents) if (agent.hooks !== void 0 && !hooks.has(agent.hooks)) hooks.set(agent.hooks, agentId);
@@ -305026,6 +305935,7 @@ var Session$1 = class {
 			this.agentOperations.drain(),
 			this.hostOperations.drain()
 		]));
+		await deadline.wait(this.hostOperations.drain());
 		const pending = [...Array.from(remaining.values()).flat(), ...hookFailures];
 		for (const [engine, agentId] of hooks) for (const item of engine.pendingExecutions) pending.push({
 			agentId,
@@ -305064,17 +305974,11 @@ var Session$1 = class {
 				reason: "execution-pending"
 			});
 		}
-		for (const id of this.agentOperations.pending) pending.push({
-			kind: "agent-setup",
-			id,
-			reason: "execution-pending"
-		});
-		for (const id of this.hostOperations.pending) pending.push({
-			kind: "host-operation",
-			id,
-			reason: "execution-pending"
-		});
-		if (!deadline.expired && pending.length === 0) pending.push(...await this.flushQuiescentRecords(agents, deadline));
+		pending.push(...this.pendingSessionOperations());
+		if (!deadline.expired && pending.length === 0) {
+			pending.push(...await this.flushQuiescentRecords(agents, deadline));
+			pending.push(...this.pendingSessionOperations());
+		}
 		const checkedAt = Date.now();
 		if (!deadline.expired && pending.length === 0) return {
 			sessionId: this.options.id,
@@ -305164,12 +306068,12 @@ var Session$1 = class {
 		}
 	}
 	/**
-	* Appends a fresh `<plugin_session_start>` system reminder to the main agent
+	* Appends changed `<plugin_session_start>` guidance to the main agent
 	* using the currently enabled plugins, then flushes records so the reminder is
 	* persisted and visible on the wire. Used by the explicit `/reload` flow after
 	* the session has been re-resumed with reloaded plugin state.
 	*
-	* When no plugin session start is currently resolvable but an earlier
+	* Identical latest guidance is reused without growing the replayed context.
 	* When no plugin session start is currently resolvable but the context may still
 	* carry stale plugin guidance — either an earlier `<plugin_session_start>`
 	* reminder, or a compaction summary that may have folded one in — appends a
@@ -305184,15 +306088,12 @@ var Session$1 = class {
 			registry: mainAgent.skills?.registry,
 			log: mainAgent.log
 		});
-		if (reminder !== void 0) mainAgent.context.appendSystemReminder(`${reminder}\n\nThis supersedes any earlier plugin_session_start reminder in this session.`, {
-			kind: "injection",
-			variant: "plugin_session_start"
-		});
-		else if (this.shouldNeutralizePluginSessionStart(mainAgent)) mainAgent.context.appendSystemReminder("There are currently no active plugin session starts. This supersedes any earlier plugin_session_start reminder in this session.", {
+		const content = reminder !== void 0 ? `${reminder}\n\nThis supersedes any earlier plugin_session_start reminder in this session.` : this.shouldNeutralizePluginSessionStart(mainAgent) ? "There are currently no active plugin session starts. This supersedes any earlier plugin_session_start reminder in this session." : void 0;
+		if (content === void 0) return;
+		if (latestMatchingSystemReminderIndex(mainAgent.context.history, "plugin_session_start", content) === void 0) mainAgent.context.appendSystemReminder(content, {
 			kind: "injection",
 			variant: "plugin_session_start"
 		});
-		else return;
 		await mainAgent.records.flush();
 	}
 	shouldNeutralizePluginSessionStart(mainAgent) {
@@ -305210,26 +306111,35 @@ var Session$1 = class {
 		return join$1(this.options.homedir, "state.json");
 	}
 	writeMetadata() {
-		const text = JSON.stringify(this.metadata, null, 2);
-		const write = async () => {
-			await this.persistenceKaos.mkdir(this.options.homedir, {
-				parents: true,
-				existOk: true
-			});
-			await this.persistenceKaos.writeText(this.metadataPath, text);
-		};
-		this.writeMetadataPromise = this.writeMetadataPromise.then(write, write);
-		return this.writeMetadataPromise;
+		this.assertNoIdleReservation();
+		return this.hostOperations.run("metadata-write", () => {
+			const text = JSON.stringify(this.metadata, null, 2);
+			const write = async () => {
+				await this.persistenceKaos.mkdir(this.options.homedir, {
+					parents: true,
+					existOk: true
+				});
+				await this.persistenceKaos.writeText(this.metadataPath, text);
+			};
+			this.writeMetadataPromise = this.writeMetadataPromise.then(write, write);
+			return this.writeMetadataPromise;
+		});
 	}
 	async readMetadata() {
-		const text = await this.persistenceKaos.readText(this.metadataPath);
-		this.metadata = JSON.parse(text);
-		return this.metadata;
+		this.assertNoIdleReservation();
+		return this.hostOperations.run("metadata-read", async () => {
+			const text = await this.persistenceKaos.readText(this.metadataPath);
+			this.metadata = JSON.parse(text);
+			return this.metadata;
+		});
 	}
 	async flushMetadata() {
-		await this.skillsReady;
-		await this.writeMetadataPromise;
-		await Promise.all(Array.from(this.readyAgents()).map((agent) => agent.records.flush()));
+		this.assertNoIdleReservation();
+		return this.hostOperations.run("metadata-flush", async () => {
+			await this.skillsReady;
+			await this.writeMetadataPromise;
+			await Promise.all(Array.from(this.readyAgents()).map((agent) => agent.records.flush()));
+		});
 	}
 	async listSkills() {
 		await this.skillsReady;
@@ -305312,9 +306222,9 @@ var Session$1 = class {
 	startMcpServers() {
 		if (this.mcpLoadStarted) return;
 		this.mcpLoadStarted = true;
-		this.loadMcpServers().catch((error) => {
+		this.hostOperations.run("initial-mcp", () => this.loadMcpServers().catch((error) => {
 			this.emitInitialMcpLoadError(error);
-		});
+		}));
 	}
 	emitInitialMcpLoadError(error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -305385,6 +306295,7 @@ var Session$1 = class {
 			additionalDirs: parentAgent?.getAdditionalDirs() ?? this.additionalDirs,
 			systemPromptContextProvider: () => prepareSystemPromptContext(this.systemContextKaos(agent.kaos.getcwd()), this.options.blunHomeDir, { additionalDirs: agent.getAdditionalDirs() })
 		});
+		this.idleAdmission.register(id, agent);
 		agent.setRuntimeSystemPromptAppend(this.accountMemoryContext.text, this.accountMemoryContext.source);
 		return agent;
 	}
@@ -305423,8 +306334,7 @@ var Session$1 = class {
 		const entry = this.agents.get(id);
 		if (entry !== void 0) return this.resolveAgentEntry(entry);
 		this.assertWorkAdmissionOpen();
-		const promise = this.resumePersistedAgent(id, stack);
-		this.agentOperations.track(id, promise);
+		const promise = this.agentOperations.run(id, () => this.resumePersistedAgent(id, stack));
 		this.agents.set(id, promise);
 		return promise;
 	}
@@ -306463,13 +307373,30 @@ function decodeRefSegments(segments) {
 	}).join("/");
 }
 //#endregion
+//#region ../../packages/agent-core/src/plugin/work.ts
+const EFFECTS = [
+	"load",
+	"install",
+	"setEnabled",
+	"setMcpServerEnabled",
+	"remove",
+	"reload",
+	"enabledCommands"
+];
+function bindPluginWork(manager) {
+	for (const name of EFFECTS) bindHostEffectMethod(manager, manager, name, true, "work", `plugin:${name}`);
+}
+//#endregion
 //#region ../../packages/agent-core/src/plugin/manager.ts
 const BLUN_NODE_FALLBACK_SUBCOMMAND = "__plugin_run_node";
 var PluginManager = class {
 	blunHomeDir;
 	disabledPluginIds;
 	records = /* @__PURE__ */ new Map();
+	admission = new AdmissionGate();
+	operations = new ExecutionLedger();
 	constructor(options) {
+		bindPluginWork(this);
 		this.blunHomeDir = options.blunHomeDir;
 		this.disabledPluginIds = new Set((options.disabledPluginIds ?? disabledPluginIdsFromEnv()).map(normalizePluginId));
 	}
@@ -306479,6 +307406,24 @@ var PluginManager = class {
 		for (const entry of file.plugins) next.set(entry.id, await this.materialize(entry));
 		this.records = next;
 	}
+	get hasPendingWork() {
+		return this.operations.pending.length > 0;
+	}
+	get version() {
+		return this.operations.version;
+	}
+	tryReserveIdleAdmission() {
+		return this.hasPendingWork ? void 0 : this.admission.tryReserve();
+	}
+	runHostEffect(id, operation) {
+		if (this.admission.closed) throw new Error("Plugin work admission is closed");
+		let result;
+		this.operations.run(id, () => {
+			result = operation();
+			return Promise.resolve(result);
+		});
+		return result;
+	}
 	list() {
 		return [...this.records.values()].toSorted((a, b) => a.id.localeCompare(b.id));
 	}
@@ -337368,6 +338313,88 @@ function managedApiKeyFingerprint(apiKey) {
 	return createHash("sha256").update(`${MANAGED_PROVIDER_NAME$1}\0${apiKey.trim()}`).digest("hex");
 }
 //#endregion
+//#region ../../packages/agent-core/src/session/rpc-work.ts
+const SESSION_RPC_WORK = {
+	prompt: "work",
+	promptAccepted: "work",
+	runShellCommand: "work",
+	cancelShellCommand: "teardown",
+	steer: "work",
+	cancel: "teardown",
+	undoHistory: "work",
+	setThinking: "work",
+	setActionStyle: "work",
+	setPermission: "work",
+	setModel: "work",
+	getModel: "read",
+	enterPlan: "work",
+	cancelPlan: "work",
+	clearPlan: "work",
+	getPlanMode: "read",
+	enterSwarm: "work",
+	exitSwarm: "work",
+	getSwarmMode: "read",
+	getSwarmModeTrigger: "read",
+	beginCompaction: "work",
+	cancelCompaction: "teardown",
+	registerTool: "work",
+	unregisterTool: "work",
+	setActiveTools: "work",
+	setAllowedTools: "work",
+	stopBackground: "teardown",
+	detachBackground: "work",
+	clearContext: "work",
+	activateSkill: "work",
+	activatePluginCommand: "work",
+	startBtw: "work",
+	createGoal: "work",
+	editGoal: "work",
+	blockGoal: "work",
+	completeGoal: "work",
+	getGoal: "read",
+	pauseGoal: "work",
+	resumeGoal: "work",
+	cancelGoal: "work",
+	getBackgroundOutput: "read",
+	getContext: "read",
+	getConfig: "read",
+	getPermission: "read",
+	getPlan: "read",
+	getUsage: "read",
+	getTools: "read",
+	getBackground: "read",
+	complete: "work",
+	quiesceSession: "quiesce",
+	setAccountMemoryContext: "sync-work",
+	setRuntimeModelContext: "sync-work",
+	setPersonalMemoryHostCapability: "work",
+	renameSession: "work",
+	updateSessionMetadata: "work",
+	getSessionMetadata: "read",
+	listSkills: "read",
+	listPluginCommands: "read",
+	listMcpServers: "read",
+	getMcpStartupMetrics: "read",
+	reconnectMcpServer: "work",
+	generateAgentsMd: "work",
+	getSessionWarnings: "read",
+	waitForBackgroundTasksOnPrint: "teardown",
+	addAdditionalDir: "work",
+	createLoop: "work",
+	getLoop: "read",
+	pauseLoop: "teardown",
+	resumeLoop: "work",
+	stopLoop: "teardown"
+};
+function bindSessionRpcWork(methods, session) {
+	for (const [name, kind] of Object.entries(SESSION_RPC_WORK)) {
+		if (kind === "read" || kind === "quiesce") continue;
+		const asynchronous = kind !== "sync-work";
+		const detail = name === "runShellCommand" ? "shell-command" : `rpc:${name}`;
+		bindHostEffectMethod(methods, session, name, asynchronous, kind === "teardown" ? "teardown" : "work", detail);
+	}
+}
+//#endregion
 //#region ../../packages/agent-core/src/session/prompt-metadata.ts
 const MAX_TITLE_LENGTH = 200;
 const MAX_LAST_PROMPT_LENGTH = 4e3;
@@ -337414,6 +338441,7 @@ var SessionAPIImpl = class {
 	session;
 	constructor(session) {
 		this.session = session;
+		bindSessionRpcWork(this, session);
 	}
 	quiesceSession(payload) {
 		return this.session.quiesce(payload);
@@ -337496,7 +338524,7 @@ var SessionAPIImpl = class {
 		return (await this.getAgent(agentId)).steer(payload);
 	}
 	async runShellCommand({ agentId, ...payload }) {
-		return this.session.runHostOperation("shell-command", async () => (await this.getAgent(agentId)).runShellCommand(payload));
+		return (await this.getAgent(agentId)).runShellCommand(payload);
 	}
 	async cancelShellCommand({ agentId, ...payload }) {
 		return (await this.getAgent(agentId, true)).cancelShellCommand(payload);
@@ -338183,6 +339211,169 @@ function compareSessionSummary(a, b) {
 	return 0;
 }
 //#endregion
+//#region ../../packages/agent-core/src/rpc/core-work.ts
+const CORE_RPC_WORK = {
+	...SESSION_RPC_WORK,
+	getSessionWarnings: "work",
+	getCoreInfo: "read",
+	getExperimentalFeatures: "read",
+	getConfigDiagnostics: "read",
+	setMcpServerEnabled: "work",
+	removeMcpServer: "work",
+	getBlunConfig: "work",
+	setBlunConfig: "work",
+	removeBlunProvider: "work",
+	createSession: "work",
+	closeSession: "teardown",
+	archiveSession: "work",
+	resumeSession: "work",
+	getReplayPage: "work",
+	reloadSession: "work",
+	forkSession: "work",
+	listSessions: "work",
+	exportSession: "work",
+	listPlugins: "work",
+	installPlugin: "work",
+	setPluginEnabled: "work",
+	setPluginMcpServerEnabled: "work",
+	removePlugin: "work",
+	reloadPlugins: "work",
+	getPluginInfo: "work"
+};
+function bindCoreWork(core) {
+	for (const [name, kind] of Object.entries(CORE_RPC_WORK)) {
+		if (kind === "read" || kind === "quiesce") continue;
+		bindHostEffectMethod(core, core, name, kind !== "sync-work", kind === "teardown" ? "teardown" : "work", `core:${name}`);
+	}
+	for (const name of ["createSessionWithOverrides", "resumeSessionWithOverrides"]) bindHostEffectMethod(core, core, name, true, "work", `core:${name}`);
+}
+//#endregion
+//#region ../../packages/agent-core/src/rpc/idle-admission.ts
+/** The Core session map stays authoritative; receipts identify native construction only. */
+var CoreIdleAdmission = class {
+	core;
+	admission;
+	pending;
+	state;
+	revision;
+	identities = /* @__PURE__ */ new WeakSet();
+	plugins;
+	constructor(core, admission, pending, state, revision) {
+		this.core = core;
+		this.admission = admission;
+		this.pending = pending;
+		this.state = state;
+		this.revision = revision;
+		this.plugins = core.plugins;
+	}
+	register(session) {
+		this.identities.add(session);
+	}
+	snapshot() {
+		if (this.pending() || this.core.plugins !== this.plugins || !(this.plugins instanceof PluginManager) || this.plugins.hasPendingWork) return void 0;
+		const sessions = [...this.core.sessions];
+		if (sessions.some(([id, session]) => !(session instanceof Session$1) || !this.identities.has(session) || session.options.id !== id || session.options.blunHomeDir !== this.core.homeDir)) return void 0;
+		return {
+			sessions,
+			state: this.state(),
+			pluginVersion: this.plugins.version,
+			plugins: JSON.stringify(this.plugins.list()),
+			homeDir: this.core.homeDir,
+			configPath: this.core.configPath
+		};
+	}
+	tryReserve() {
+		const ownRelease = this.admission.tryReserve();
+		if (!ownRelease) return void 0;
+		const releases = [ownRelease];
+		const sessions = [];
+		let retained = false;
+		const releaseAll = () => {
+			for (const session of [...sessions].reverse()) session.release();
+			for (const release of [...releases].reverse()) release();
+		};
+		try {
+			const snapshot = this.snapshot();
+			if (!snapshot) return void 0;
+			const pluginRelease = this.plugins.tryReserveIdleAdmission();
+			if (!pluginRelease) return void 0;
+			releases.push(pluginRelease);
+			for (const [, session] of snapshot.sessions) {
+				const lease = session.tryReserveIdleAdmission();
+				if (!lease) return void 0;
+				sessions.push(lease);
+			}
+			const lease = new IdleAdmissionReservation(releases, () => {
+				const fresh = this.snapshot();
+				return fresh !== void 0 && fresh.homeDir === snapshot.homeDir && fresh.configPath === snapshot.configPath && fresh.state.version === snapshot.state.version && fresh.state.text === snapshot.state.text && fresh.state.owners.length === snapshot.state.owners.length && fresh.state.owners.every((owner, index) => owner === snapshot.state.owners[index]) && fresh.pluginVersion === snapshot.pluginVersion && fresh.plugins === snapshot.plugins && fresh.sessions.length === snapshot.sessions.length && fresh.sessions.every(([id, session], index) => id === snapshot.sessions[index][0] && session === snapshot.sessions[index][1]);
+			}, () => !this.pending() && this.revision() === snapshot.state.version && this.core.homeDir === snapshot.homeDir && this.core.configPath === snapshot.configPath && this.core.plugins === this.plugins && this.plugins.version === snapshot.pluginVersion && this.core.sessions.size === snapshot.sessions.length && snapshot.sessions.every(([id, session]) => this.core.sessions.get(id) === session), sessions);
+			if (!lease.isValid()) return void 0;
+			retained = true;
+			return lease;
+		} catch {
+			return;
+		} finally {
+			if (!retained) releaseAll();
+		}
+	}
+};
+//#endregion
+//#region ../../packages/agent-core/src/rpc/config-idle-admission.ts
+/** Extend the actual Core reservation with the same native claim used by config writes. */
+async function reserveCoreConfiguration(core, configState) {
+	const local = core.tryReserveIdleAdmission();
+	if (!local) return void 0;
+	let file;
+	let retained = false;
+	const releaseAll = async () => {
+		await file?.release();
+		local.release();
+	};
+	try {
+		file = await tryReserveConfigIdleAdmission(core.configPath);
+		if (!file) return void 0;
+		const owned = file;
+		let live = true;
+		let releasing;
+		const isValid = async () => {
+			if (!live) return false;
+			try {
+				const loaded = loadRuntimeConfigSafe(core.configPath);
+				live = loaded.fileError === void 0 && configState() === JSON.stringify({
+					config: loaded.config,
+					warnings: [...loaded.fileWarnings, ...loaded.envWarnings]
+				}) && local.isValid() && await owned.isValid() && live && local.isValid();
+			} catch {
+				live = false;
+			}
+			return live;
+		};
+		if (!await isValid()) return void 0;
+		retained = true;
+		return {
+			isValid,
+			commit: async (validateLocalInput = () => true) => {
+				if (!await isValid() || !live) return false;
+				try {
+					if (validateLocalInput() !== true) return false;
+				} catch {
+					return false;
+				}
+				if (!live || !local.commit()) return false;
+				live = false;
+				return true;
+			},
+			release: () => {
+				live = false;
+				releasing ??= releaseAll();
+				return releasing;
+			}
+		};
+	} finally {
+		if (!retained) await releaseAll();
+	}
+}
+//#endregion
 //#region ../../packages/agent-core/src/rpc/core-impl.ts
 const BLUN_PROVIDER_NAME = "managed:blun";
 const BLUN_BASE_URL_ENV = "BLUN_BASE_URL";
@@ -338208,6 +339399,9 @@ var BlunCore = class {
 	sessionStore;
 	sessionWriters = /* @__PURE__ */ new Map();
 	sessionMutations = /* @__PURE__ */ new Map();
+	admission = new AdmissionGate();
+	hostOperations = new ExecutionLedger();
+	idleAdmission;
 	plugins;
 	pluginsReady;
 	pluginsLoadError;
@@ -338215,6 +339409,7 @@ var BlunCore = class {
 	experimentalFlags;
 	constructor(rpcClient, options = {}) {
 		this.rpcClient = rpcClient;
+		bindCoreWork(this);
 		this.homeDir = resolveBlunHome$1(options.homeDir);
 		this.userHomeDir = homedir();
 		this.configPath = resolveConfigPath({
@@ -338238,6 +339433,19 @@ var BlunCore = class {
 		this.experimentalFlags = new FlagResolver(process.env, FLAG_DEFINITIONS, this.config.experimental);
 		this.sessionStore = new SessionStore(this.homeDir);
 		this.plugins = new PluginManager({ blunHomeDir: this.homeDir });
+		this.idleAdmission = new CoreIdleAdmission(this, this.admission, () => this.hostOperations.pending.length > 0 || this.sessionMutations.size > 0 || this.pluginsLoadError !== void 0, () => ({
+			version: this.hostOperations.version,
+			text: JSON.stringify({
+				config: this.config,
+				warnings: this.configWarnings
+			}),
+			owners: [
+				this.config,
+				this.runtime,
+				this.kaos,
+				this.pluginsReady
+			]
+		}), () => this.hostOperations.version);
 		this.pluginsReady = this.plugins.load().catch((error) => {
 			this.pluginsLoadError = error instanceof Error ? error : new Error(String(error));
 		});
@@ -338247,6 +339455,30 @@ var BlunCore = class {
 	async createSession(input) {
 		return this.createSessionWithOverrides(input, {});
 	}
+	tryReserveIdleAdmission() {
+		return this.idleAdmission.tryReserve();
+	}
+	tryReserveConfigurationIdleAdmission() {
+		return reserveCoreConfiguration(this, () => JSON.stringify({
+			config: this.config,
+			warnings: this.configWarnings
+		}));
+	}
+	get pendingHostOperations() {
+		return this.hostOperations.pending;
+	}
+	runHostEffect(id, operation, kind = "work") {
+		if (this.admission.reserved || kind === "work" && this.admission.closed) throw new Error("Core work admission is closed");
+		return this.runHostCallback(id, operation);
+	}
+	runHostCallback(id, operation) {
+		let result;
+		this.hostOperations.run(id, () => {
+			result = operation();
+			return Promise.resolve(result);
+		});
+		return result;
+	}
 	async createSessionWithOverrides(input, overrides) {
 		const id = input.id ?? createSessionId();
 		const workDir = requiredWorkDir("createSession", input.workDir);
@@ -338318,6 +339550,7 @@ var BlunCore = class {
 			additionalDirs,
 			missionContract: options.metadata?.["__missionContract"]
 		});
+		this.idleAdmission.register(session);
 		try {
 			session.metadata = {
 				...session.metadata,
@@ -338468,6 +339701,7 @@ var BlunCore = class {
 			appVersion: this.appVersion,
 			additionalDirs
 		});
+		this.idleAdmission.register(session);
 		let warning;
 		try {
 			warning = (await session.resume()).warning;
@@ -347794,6 +349028,212 @@ function defaultShell() {
 }
 registerSingleton(ITerminalService, new SyncDescriptor(TerminalService, [{}], false));
 //#endregion
+//#region ../../packages/node-sdk/src/rpc-work.ts
+const SDK_RPC_WORK = {
+	withInteractiveAgent: "callback",
+	ensureConfigFile: "work",
+	close: "teardown",
+	quiesceSession: "quiesce",
+	createSession: "work",
+	createSessionWithKaos: "work",
+	resumeSession: "work",
+	resumeSessionWithKaos: "work",
+	reloadSession: "work",
+	forkSession: "work",
+	closeSession: "teardown",
+	getReplayPage: "work",
+	listSessions: "work",
+	renameSession: "work",
+	exportSession: "work",
+	getConfig: "work",
+	getConfigDiagnostics: "read",
+	getExperimentalFeatures: "read",
+	setConfig: "work",
+	removeProvider: "work",
+	prompt: "work",
+	promptAccepted: "work",
+	runShellCommand: "work",
+	cancelShellCommand: "teardown",
+	steer: "work",
+	steerActive: "work",
+	generateAgentsMd: "work",
+	getSessionWarnings: "work",
+	getSessionMetadata: "read",
+	updateSessionMetadata: "work",
+	addAdditionalDir: "work",
+	startBtw: "work",
+	cancel: "teardown",
+	registerTool: "work",
+	unregisterTool: "work",
+	setModel: "work",
+	setRuntimeModelContext: "work",
+	setAccountMemoryContext: "work",
+	setPersonalMemoryHostCapability: "work",
+	setThinking: "work",
+	setActionStyle: "work",
+	setPermission: "work",
+	setAllowedTools: "work",
+	setPlanMode: "work",
+	setSwarmMode: "work",
+	getSwarmModeTrigger: "read",
+	swarm: "work",
+	swarmAccepted: "work",
+	getPlan: "read",
+	clearPlan: "work",
+	compact: "work",
+	cancelCompaction: "teardown",
+	undoHistory: "work",
+	getContext: "read",
+	getUsage: "read",
+	getStatus: "read",
+	listTools: "read",
+	listSkills: "read",
+	listPluginCommands: "read",
+	listBackgroundTasks: "read",
+	getBackgroundTaskOutput: "read",
+	complete: "work",
+	stopBackgroundTask: "teardown",
+	detachBackgroundTask: "work",
+	waitForBackgroundTasksOnPrint: "teardown",
+	createGoal: "work",
+	editGoal: "work",
+	blockGoal: "work",
+	completeGoal: "work",
+	getGoal: "read",
+	pauseGoal: "work",
+	resumeGoal: "work",
+	cancelGoal: "work",
+	createLoop: "work",
+	getLoop: "read",
+	pauseLoop: "teardown",
+	resumeLoop: "work",
+	stopLoop: "teardown",
+	listMcpServers: "read",
+	getMcpStartupMetrics: "read",
+	reconnectMcpServer: "work",
+	setMcpServerEnabled: "work",
+	removeMcpServer: "work",
+	listPlugins: "work",
+	installPlugin: "work",
+	setPluginEnabled: "work",
+	setPluginMcpServerEnabled: "work",
+	removePlugin: "work",
+	reloadPlugins: "work",
+	getPluginInfo: "work",
+	activateSkill: "work",
+	activatePluginCommand: "work",
+	receiveEvent: "callback",
+	requestApproval: "callback",
+	requestQuestion: "callback",
+	toolCall: "callback"
+};
+const HARNESS_WORK = {
+	tryReserveConfigurationIdleAdmission: "quiesce",
+	withInteractiveAgent: "callback",
+	createSession: "work",
+	resumeSession: "work",
+	reloadSession: "work",
+	forkSession: "work",
+	closeSession: "teardown",
+	renameSession: "work",
+	exportSession: "work",
+	listSessions: "work",
+	getConfig: "work",
+	getConfigDiagnostics: "read",
+	complete: "work",
+	getExperimentalFeatures: "read",
+	ensureConfigFile: "work",
+	setConfig: "work",
+	removeProvider: "work",
+	close: "teardown"
+};
+const SDK_SESSION_WORK = {
+	quiesce: "quiesce",
+	reloadSession: "work",
+	refreshResumeState: "work",
+	registerToolAndWait: "work",
+	unregisterToolAndWait: "work",
+	setPersonalMemoryHostCapability: "work",
+	registerTool: "sync-work",
+	unregisterTool: "sync-work",
+	prompt: "work",
+	promptAccepted: "work",
+	runShellCommand: "work",
+	cancelShellCommand: "teardown",
+	steer: "work",
+	steerActive: "work",
+	swarm: "work",
+	init: "work",
+	getSessionWarnings: "work",
+	getSessionMetadata: "read",
+	updateSessionMetadata: "work",
+	addAdditionalDir: "work",
+	startBtw: "work",
+	cancel: "teardown",
+	setModel: "work",
+	setRuntimeModelContext: "work",
+	setAccountMemoryContext: "work",
+	setThinking: "work",
+	setActionStyle: "work",
+	setPermission: "work",
+	setAllowedTools: "work",
+	setPlanMode: "work",
+	setSwarmMode: "work",
+	getSwarmModeTrigger: "read",
+	getPlan: "read",
+	clearPlan: "work",
+	compact: "work",
+	cancelCompaction: "teardown",
+	undoHistory: "work",
+	getContext: "read",
+	getReplayPage: "work",
+	getUsage: "read",
+	getStatus: "read",
+	listTools: "read",
+	listSkills: "read",
+	listPluginCommands: "read",
+	listBackgroundTasks: "read",
+	getBackgroundTaskOutput: "read",
+	complete: "work",
+	stopBackgroundTask: "teardown",
+	detachBackgroundTask: "work",
+	waitForBackgroundTasksOnPrint: "teardown",
+	createGoal: "work",
+	getGoal: "read",
+	editGoal: "work",
+	blockGoal: "work",
+	completeGoal: "work",
+	pauseGoal: "work",
+	resumeGoal: "work",
+	cancelGoal: "work",
+	createLoop: "work",
+	getLoop: "read",
+	pauseLoop: "teardown",
+	resumeLoop: "work",
+	stopLoop: "teardown",
+	listMcpServers: "read",
+	getMcpStartupMetrics: "read",
+	reconnectMcpServer: "work",
+	setMcpServerEnabled: "work",
+	removeMcpServer: "work",
+	listPlugins: "work",
+	installPlugin: "work",
+	setPluginEnabled: "work",
+	setPluginMcpServerEnabled: "work",
+	removePlugin: "work",
+	reloadPlugins: "work",
+	getPluginInfo: "work",
+	activateSkill: "work",
+	activatePluginCommand: "work",
+	close: "teardown"
+};
+function bindSdkWork(methods, owner, classification, scope) {
+	for (const [name, kind] of Object.entries(classification)) {
+		if (kind !== "work" && kind !== "teardown" && kind !== "sync-work") continue;
+		bindHostEffectMethod(methods, owner, name, kind !== "sync-work", kind === "teardown" ? "teardown" : "work", `${scope}:${name}`);
+	}
+}
+//#endregion
 //#region ../../packages/node-sdk/src/session.ts
 const MAIN_AGENT_ID$1 = "main";
 var Session = class {
@@ -347802,6 +349242,7 @@ var Session = class {
 	summary;
 	resumeState;
 	rpc;
+	workOwner;
 	onClose;
 	userInputAcceptedHandler;
 	pendingUserInputAcceptanceRequests = /* @__PURE__ */ new Set();
@@ -347814,6 +349255,8 @@ var Session = class {
 		this.resumeState = options.resumeState ?? resumeStateFromSummary(options.summary);
 		this.rpc = options.rpc;
 		this.onClose = options.onClose;
+		this.workOwner = options.rpc.workOwner;
+		if (this.workOwner !== void 0) bindSdkWork(this, this.workOwner, SDK_SESSION_WORK, "sdk-session");
 	}
 	getResumeState() {
 		this.ensureOpen();
@@ -348018,9 +349461,10 @@ var Session = class {
 		if (handler === void 0) return;
 		try {
 			let pending;
-			pending = Promise.resolve(handler(input)).catch(() => {}).finally(() => {
+			const notify = () => Promise.resolve(handler(input)).catch(() => {}).finally(() => {
 				this.pendingUserInputAcceptedHandlers.delete(pending);
 			});
+			pending = this.workOwner === void 0 ? notify() : this.workOwner.runHostEffect("sdk-session:input-accepted", notify);
 			this.pendingUserInputAcceptedHandlers.add(pending);
 		} catch {}
 	}
@@ -348525,6 +349969,7 @@ var BlunHarness = class {
 	homeDir;
 	configPath;
 	auth;
+	profileScope;
 	identity;
 	uiMode;
 	telemetry;
@@ -348532,6 +349977,7 @@ var BlunHarness = class {
 	ensureConfigFileImpl;
 	closeImpl;
 	sessionStartedProperties;
+	idleCore;
 	constructor(rpc, options) {
 		this.rpc = rpc;
 		this.identity = options.identity;
@@ -348540,13 +349986,23 @@ var BlunHarness = class {
 		this.configPath = options.configPath;
 		this.telemetry = options.telemetry;
 		this.auth = options.auth;
+		this.profileScope = Object.freeze({
+			profile: options.profileScope?.profile,
+			sharedHome: options.profileScope?.sharedHome
+		});
 		this.ensureConfigFileImpl = options.ensureConfigFile;
 		this.closeImpl = options.onClose;
 		this.sessionStartedProperties = options.sessionStartedProperties ?? {};
+		const owner = options.workOwner;
+		this.idleCore = owner instanceof BlunCore && owner === rpc.workOwner && owner.homeDir === options.homeDir && owner.configPath === options.configPath ? owner : void 0;
+		if (options.workOwner !== void 0) bindSdkWork(this, options.workOwner, HARNESS_WORK, "harness");
 	}
 	get sessions() {
 		return this.activeSessions;
 	}
+	async tryReserveConfigurationIdleAdmission() {
+		return this.idleCore?.tryReserveConfigurationIdleAdmission();
+	}
 	get interactiveAgentId() {
 		return this.rpc.interactiveAgentId;
 	}
@@ -348777,6 +350233,28 @@ function mapOAuthTokenError(error, providerName) {
 	if (error instanceof OAuthConnectionError || error instanceof RetryableRefreshError) return new BlunError(ErrorCodes.PROVIDER_CONNECTION_ERROR, `OAuth provider "${providerName}" failed to fetch an access token: ${error.message}`, { cause: error });
 }
 //#endregion
+//#region ../../packages/node-sdk/src/auth-work.ts
+const AUTH_WORK_METHODS = [
+	"restoreMissingProfileModel",
+	"status",
+	"getCachedMemoryWorkspaceId",
+	"cacheMemoryWorkspaceId",
+	"login",
+	"loginWithApiKey",
+	"logout",
+	"getManagedUsage",
+	"getManagedQuota",
+	"submitFeedback",
+	"createFeedbackUploadUrl",
+	"completeFeedbackUpload",
+	"getCachedAccessToken",
+	"resolveOAuthTokenProvider"
+];
+/** Auth uses the existing Core admission and ledger, not a separate work queue. */
+function bindAuthWork(auth, owner) {
+	for (const method of AUTH_WORK_METHODS) bindHostEffectMethod(auth, owner, method, method !== "resolveOAuthTokenProvider", "work", `auth.${method}`);
+}
+//#endregion
 //#region ../../packages/node-sdk/src/auth.ts
 var BlunAuthTransitionError = class extends Error {
 	warnings;
@@ -348791,8 +350269,10 @@ var BlunAuthFacade = class {
 	options;
 	toolkit;
 	managedApiKeyRevocations;
+	workOwner;
 	constructor(options) {
 		this.options = options;
+		this.workOwner = options.workOwner;
 		this.managedApiKeyRevocations = new FileManagedApiKeyRevocationStore(options.homeDir);
 		this.toolkit = new BlunOAuthToolkit({
 			homeDir: options.homeDir,
@@ -348812,6 +350292,7 @@ var BlunAuthFacade = class {
 				remove: applyManagedBlunCodeLogoutConfig
 			}
 		});
+		if (this.workOwner !== void 0) bindAuthWork(this, this.workOwner);
 	}
 	async restoreMissingProfileModel() {
 		const needsRepair = (config) => config.defaultModel === LEGACY_PROFILE_MODEL && config.models?.[LEGACY_PROFILE_MODEL] === void 0 && config.providers["managed:blun"] === void 0;
@@ -349165,11 +350646,14 @@ var BlunAuthFacade = class {
 	resolveOAuthTokenProvider = (providerName, oauthRef) => {
 		const provider = this.toolkit.tokenProvider(providerName, this.runtimeOAuthRef(providerName, oauthRef));
 		return { getAccessToken: async (options) => {
-			try {
-				return await provider.getAccessToken(options);
-			} catch (error) {
-				throw mapOAuthTokenError(error, providerName) ?? error;
-			}
+			const access = async () => {
+				try {
+					return await provider.getAccessToken(options);
+				} catch (error) {
+					throw mapOAuthTokenError(error, providerName) ?? error;
+				}
+			};
+			return this.workOwner === void 0 ? access() : this.workOwner.runHostEffect("auth.getAccessToken", access);
 		} };
 	};
 	resolveManagedAuth(providerName) {
@@ -349247,12 +350731,16 @@ var SDKRpcClientBase = class {
 	approvalHandlers = /* @__PURE__ */ new Map();
 	questionHandlers = /* @__PURE__ */ new Map();
 	toolCallHandlers = /* @__PURE__ */ new Map();
+	get workOwner() {}
 	get interactiveAgentId() {
 		return this.interactiveAgentScope.getStore() ?? MAIN_AGENT_ID;
 	}
 	withInteractiveAgent(agentId, fn) {
 		return this.interactiveAgentScope.run(agentId, fn);
 	}
+	runCallback(_id, operation) {
+		return operation();
+	}
 	async quiesceSession(input) {
 		return (await this.getRpc()).quiesceSession(input);
 	}
@@ -349835,7 +351323,7 @@ var SDKRpcClientBase = class {
 		};
 	}
 	async receiveEvent(event) {
-		await Promise.all([...this.eventListeners].map((listener) => Promise.resolve(listener(event))));
+		await Promise.all([...this.eventListeners].map((listener) => this.runCallback("sdk-callback:event-listener", () => Promise.resolve(listener(event)))));
 	}
 	setApprovalHandler(sessionId, handler) {
 		if (handler === void 0) {
@@ -349952,9 +351440,9 @@ function errorMessage(error) {
 }
 //#endregion
 //#region ../../packages/node-sdk/src/sdk-rpc-client.ts
-function authHomeForProfile(homeDir) {
-	const sharedHome = process.env["BLUN_SHARED_HOME"]?.trim();
-	const profile = process.env["BLUN_PROFILE"]?.trim();
+function authHomeForProfile(homeDir, scope) {
+	const sharedHome = scope.sharedHome?.trim();
+	const profile = scope.profile?.trim();
 	if (!sharedHome || !profile || !/^[a-z0-9][a-z0-9_-]{0,31}$/u.test(profile)) return homeDir;
 	const expected = resolve(join(sharedHome, "profile", profile));
 	const actual = resolve(homeDir);
@@ -349967,10 +351455,14 @@ var SDKRpcClient = class extends SDKRpcClientBase {
 	identity;
 	telemetry;
 	auth;
+	profileScope;
 	core;
 	ready;
 	usesDefaultConfigPath;
 	restoreProfileModel;
+	get workOwner() {
+		return this.core;
+	}
 	constructor(options = {}) {
 		super();
 		this.identity = options.identity === void 0 ? void 0 : assertBlunHostIdentity(options.identity);
@@ -349980,14 +351472,19 @@ var SDKRpcClient = class extends SDKRpcClientBase {
 			configPath: options.configPath
 		});
 		this.usesDefaultConfigPath = options.configPath === void 0;
-		const authHomeDir = authHomeForProfile(this.homeDir);
+		this.profileScope = Object.freeze({
+			profile: process.env["BLUN_PROFILE"],
+			sharedHome: process.env["BLUN_SHARED_HOME"]
+		});
+		const authHomeDir = authHomeForProfile(this.homeDir, this.profileScope);
 		this.restoreProfileModel = this.usesDefaultConfigPath && authHomeDir !== this.homeDir;
 		this.telemetry = options.telemetry ?? noopTelemetryClient;
 		this.auth = new BlunAuthFacade({
 			homeDir: authHomeDir,
 			configPath: this.configPath,
 			identity: this.identity,
-			onRefresh: options.onOAuthRefresh
+			onRefresh: options.onOAuthRefresh,
+			workOwner: { runHostEffect: (id, operation) => this.core.runHostEffect(id, operation) }
 		});
 		getRootLogger().configure(resolveLoggingConfig({ homeDir: this.homeDir }));
 		const [coreRpc, sdkRpc] = createRPC();
@@ -350001,6 +351498,12 @@ var SDKRpcClient = class extends SDKRpcClientBase {
 			appVersion: this.identity?.version
 		});
 		this.ready = sdkRpc(new ClientAPI(this));
+		bindSdkWork(this, this.core, SDK_RPC_WORK, "sdk");
+		const callbackOwner = { runHostEffect: (id, operation) => this.runCallback(id, operation) };
+		for (const [name, kind] of Object.entries(SDK_RPC_WORK)) if (kind === "callback" && name !== "withInteractiveAgent") bindHostEffectMethod(this, callbackOwner, name, true, "work", `sdk-callback:${name}`);
+	}
+	runCallback(id, operation) {
+		return this.core.runHostCallback(id, operation);
 	}
 	async ensureConfigFile() {
 		await ensureConfigFile(this.configPath);
@@ -350046,10 +351549,12 @@ function createBlunHarness(options) {
 		homeDir: rpc.homeDir,
 		configPath: rpc.configPath,
 		auth: rpc.auth,
+		profileScope: rpc.profileScope,
 		telemetry: rpc.telemetry,
 		ensureConfigFile: () => rpc.ensureConfigFile(),
 		onClose: () => rpc.close(),
-		sessionStartedProperties: options.sessionStartedProperties
+		sessionStartedProperties: options.sessionStartedProperties,
+		workOwner: rpc.core
 	});
 }
 //#endregion