negotium 0.2.27 → 0.2.28

package/dist/main.js

@@ -1868,7 +1868,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.2.27";
+var NEGOTIUM_VERSION = "0.2.28";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn } from "child_process";
@@ -7506,8 +7506,11 @@ var init_constants = __esm(() => {
 var exports_api_topics = {};
 __export(exports_api_topics, {
   upsertTopic: () => upsertTopic,
+  stampUnscopedOtiumTopics: () => stampUnscopedOtiumTopics,
   setTopicSurfaces: () => setTopicSurfaces,
   setTopicSessionId: () => setTopicSessionId,
+  setSurfaceScopeRequired: () => setSurfaceScopeRequired,
+  setDefaultSurfaceScope: () => setDefaultSurfaceScope,
   setApiTopicAgent: () => setApiTopicAgent,
   revokeSubagentTellTarget: () => revokeSubagentTellTarget,
   reparentTopicChildren: () => reparentTopicChildren,
@@ -7516,10 +7519,12 @@ __export(exports_api_topics, {
   normalizeTopicSurface: () => normalizeTopicSurface,
   normalizeTopicState: () => normalizeTopicState,
   normalizeTopicKind: () => normalizeTopicKind,
+  normalizeSurfaceScope: () => normalizeSurfaceScope,
   normalizeAiMode: () => normalizeAiMode,
   listTopics: () => listTopics,
   listSubagentTellTargetIds: () => listSubagentTellTargetIds,
   isTopicVisible: () => isTopicVisible,
+  isSurfaceScopeRequired: () => isSurfaceScopeRequired,
   inferTopicKind: () => inferTopicKind,
   inferAiMode: () => inferAiMode,
   grantSubagentTellTarget: () => grantSubagentTellTarget,
@@ -7533,6 +7538,7 @@ __export(exports_api_topics, {
   findTopicTitleConflict: () => findTopicTitleConflict,
   deleteTopic: () => deleteTopic,
   defaultTopicSurface: () => defaultTopicSurface,
+  defaultSurfaceScope: () => defaultSurfaceScope,
   clearTopicSessionId: () => clearTopicSessionId,
   aiMentionFromMode: () => aiMentionFromMode,
   addParticipantToDB: () => addParticipantToDB
@@ -7543,6 +7549,26 @@ function defaultTopicSurface() {
 function normalizeTopicSurface(value) {
   return value === "telegram" || value === "otium" || value === "terminal" ? value : "terminal";
 }
+function normalizeSurfaceScope(value) {
+  if (typeof value !== "string")
+    return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function defaultSurfaceScope() {
+  return activeSurfaceScope ?? normalizeSurfaceScope(process.env.NEGOTIUM_SURFACE_SCOPE);
+}
+function setDefaultSurfaceScope(scope) {
+  const previous = activeSurfaceScope;
+  activeSurfaceScope = normalizeSurfaceScope(scope);
+  return previous;
+}
+function setSurfaceScopeRequired(required) {
+  surfaceScopeRequired = required;
+}
+function isSurfaceScopeRequired() {
+  return surfaceScopeRequired;
+}
 function tableColumns2(table) {
   const rows = db.query(`PRAGMA table_info(${table})`).all();
   return new Set(rows.map((row) => row.name));
@@ -7674,6 +7700,7 @@ function initializeApiTopicsSchema() {
       is_subagent INTEGER NOT NULL DEFAULT 0 CHECK (is_subagent IN (0,1)),
       visibility TEXT NOT NULL DEFAULT 'visible' CHECK (visibility IN ('visible','hidden')),
       surface TEXT NOT NULL DEFAULT 'terminal' CHECK (surface IN ('terminal','telegram','otium')),
+      surface_scope TEXT,
       browser_profile TEXT NOT NULL DEFAULT 'default',
       browser_profile_owner TEXT,
       session_id TEXT,
@@ -7719,8 +7746,8 @@ function initializeApiTopicsSchema() {
           const legacyBaseEffort = row.base_effort ?? row.default_effort;
           db.query(`INSERT INTO api_topics_next
              (id,title,kind,description,agent,base_model,base_effort,response_policy,
-              created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,session_id)
-           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(String(row.id), String(row.title), normalized.kind, typeof row.description === "string" ? row.description : null, normalized.agent ?? null, typeof legacyBaseModel === "string" ? legacyBaseModel : null, typeof legacyBaseEffort === "string" ? legacyBaseEffort : null, normalized.aiMode, String(row.created_at), typeof row.last_message_at === "string" ? row.last_message_at : null, typeof row.parent_topic_id === "string" ? row.parent_topic_id : null, typeof row.memory_topic_id === "string" ? row.memory_topic_id : null, typeof row.memory_key === "string" ? row.memory_key : null, Number(row.is_fork ?? 0) !== 0 ? 1 : 0, Number(row.is_subagent ?? 0) !== 0 ? 1 : 0, row.visibility === "hidden" ? "hidden" : "visible", row.surface === undefined ? defaultTopicSurface() : normalizeTopicSurface(row.surface), typeof row.session_id === "string" ? row.session_id : null);
+              created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,surface_scope,session_id)
+           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(String(row.id), String(row.title), normalized.kind, typeof row.description === "string" ? row.description : null, normalized.agent ?? null, typeof legacyBaseModel === "string" ? legacyBaseModel : null, typeof legacyBaseEffort === "string" ? legacyBaseEffort : null, normalized.aiMode, String(row.created_at), typeof row.last_message_at === "string" ? row.last_message_at : null, typeof row.parent_topic_id === "string" ? row.parent_topic_id : null, typeof row.memory_topic_id === "string" ? row.memory_topic_id : null, typeof row.memory_key === "string" ? row.memory_key : null, Number(row.is_fork ?? 0) !== 0 ? 1 : 0, Number(row.is_subagent ?? 0) !== 0 ? 1 : 0, row.visibility === "hidden" ? "hidden" : "visible", row.surface === undefined ? defaultTopicSurface() : normalizeTopicSurface(row.surface), normalizeSurfaceScope(row.surface_scope), typeof row.session_id === "string" ? row.session_id : null);
         }
         db.exec("DROP TABLE IF EXISTS topic_members");
         db.exec("DROP TABLE api_topics");
@@ -7777,6 +7804,9 @@ function initializeApiTopicsSchema() {
   if (!tableColumns2("api_topics").has("surface")) {
     db.exec("ALTER TABLE api_topics ADD COLUMN surface TEXT NOT NULL DEFAULT 'terminal'");
   }
+  if (!tableColumns2("api_topics").has("surface_scope")) {
+    db.exec("ALTER TABLE api_topics ADD COLUMN surface_scope TEXT");
+  }
   if (tableColumns2("api_topics").has("access_mode")) {
     try {
       db.exec("ALTER TABLE api_topics DROP COLUMN access_mode");
@@ -7812,6 +7842,30 @@ function initializeApiTopicsSchema() {
   backfillTopicSurfaces();
   db.exec("CREATE INDEX IF NOT EXISTS idx_api_topics_last_message ON api_topics(last_message_at DESC)");
   db.exec("CREATE INDEX IF NOT EXISTS idx_api_topics_surface ON api_topics(surface)");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_api_topics_surface_scope ON api_topics(surface, surface_scope)");
+}
+function stampUnscopedOtiumTopics(scope) {
+  const normalized = normalizeSurfaceScope(scope);
+  if (!normalized)
+    return 0;
+  db.exec(`
+  CREATE TABLE IF NOT EXISTS api_schema_migrations (
+    key TEXT PRIMARY KEY,
+    applied_at TEXT NOT NULL
+  )
+`);
+  const applied = db.query("SELECT key FROM api_schema_migrations WHERE key = ?").get(SURFACE_SCOPE_STAMP_MIGRATION);
+  if (applied)
+    return 0;
+  let stamped = 0;
+  db.transaction(() => {
+    stamped = Number(db.query("UPDATE api_topics SET surface_scope = ? WHERE surface = 'otium' AND surface_scope IS NULL").run(normalized).changes ?? 0);
+    db.query("INSERT INTO api_schema_migrations (key, applied_at) VALUES (?, ?)").run(SURFACE_SCOPE_STAMP_MIGRATION, new Date().toISOString());
+  })();
+  if (stamped > 0) {
+    logger.info({ scope: normalized, stamped }, "api_topics: surface scope stamped");
+  }
+  return stamped;
 }
 function backfillTopicSurfaces() {
   db.exec(`
@@ -7833,21 +7887,23 @@ function backfillTopicSurfaces() {
 }
 function renameSurfaceTitleCollisions() {
   const rows = db.query("SELECT id, title, kind, surface FROM api_topics WHERE kind != 'manager' ORDER BY created_at ASC, rowid ASC").all();
-  const taken = new Set;
+  const keyOf = (surface, kind, title) => [surface, kind, normalizedTitle(title)].join("\x00");
+  const reserved = new Set(rows.map((row) => keyOf(row.surface, row.kind, row.title)));
+  const used = new Set;
   const update = db.query("UPDATE api_topics SET title = ? WHERE id = ?");
   for (const row of rows) {
-    const key = (title) => [row.surface, row.kind, normalizedTitle(title)].join("\x00");
-    if (!taken.has(key(row.title))) {
-      taken.add(key(row.title));
+    const key = (title) => keyOf(row.surface, row.kind, title);
+    if (!used.has(key(row.title))) {
+      used.add(key(row.title));
       continue;
     }
     let suffix = 2;
     let candidate = `${row.title} (${suffix})`;
-    while (taken.has(key(candidate))) {
+    while (reserved.has(key(candidate)) || used.has(key(candidate))) {
       suffix += 1;
       candidate = `${row.title} (${suffix})`;
     }
-    taken.add(key(candidate));
+    used.add(key(candidate));
     update.run(candidate, row.id);
     logger.warn({ topicId: row.id, surface: row.surface, from: row.title, to: candidate }, "api_topics: renamed a duplicate title for surface-scoped uniqueness");
   }
@@ -7910,7 +7966,8 @@ function rowToDto2(r, participants = getTopicParticipants(r.id), tellTargets) {
       subagentReportMode: r.subagent_report_mode === "tell" || r.subagent_report_mode === "status-only" ? r.subagent_report_mode : "auto"
     } : {},
     visibility: normalizeTopicVisibility(r.visibility),
-    surface: normalizeTopicSurface(r.surface)
+    surface: normalizeTopicSurface(r.surface),
+    surfaceScope: normalizeSurfaceScope(r.surface_scope)
   };
 }
 function normalizeTopicVisibility(value) {
@@ -7978,6 +8035,13 @@ function normalizeTopicState(input) {
 function normalizedTitle(title) {
   return title.trim().toLowerCase();
 }
+function surfaceScopeForWrite(t) {
+  if (normalizeTopicSurface(t.surface ?? defaultTopicSurface()) !== "otium")
+    return null;
+  if (t.surfaceScope !== undefined)
+    return normalizeSurfaceScope(t.surfaceScope);
+  return defaultSurfaceScope();
+}
 function upsertTopic(t) {
   const normalized = normalizeTopicState({
     id: t.id,
@@ -7990,8 +8054,8 @@ function upsertTopic(t) {
     db.query(`INSERT INTO api_topics
        (id,title,kind,description,agent,base_model,base_effort,response_policy,
         created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,
-        subagent_report_mode)
-     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+        surface_scope,subagent_report_mode)
+     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
      ON CONFLICT(id) DO UPDATE SET
        title = excluded.title,
        kind = excluded.kind,
@@ -8009,7 +8073,11 @@ function upsertTopic(t) {
        is_subagent = excluded.is_subagent,
        visibility = excluded.visibility,
        surface = excluded.surface,
-       subagent_report_mode = excluded.subagent_report_mode`).run(t.id, t.title, normalized.kind, t.description ?? null, normalized.agent ?? null, t.defaultModel ?? null, t.defaultEffort ?? null, normalized.aiMode, t.createdAt, t.lastMessageAt ?? null, t.parentTopicId ?? null, t.memoryTopicId ?? null, t.memoryKey ?? null, t.isFork ? 1 : 0, t.isSubagent ? 1 : 0, normalizeTopicVisibility(t.visibility), normalizeTopicSurface(t.surface ?? defaultTopicSurface()), t.subagentReportMode ?? "auto");
+       -- A room's workspace is fixed at creation (M-1). COALESCE, not
+       -- assignment: an update may fill in a scope that was unknown when the
+       -- room was created, but may never move a room to another workspace.
+       surface_scope = COALESCE(api_topics.surface_scope, excluded.surface_scope),
+       subagent_report_mode = excluded.subagent_report_mode`).run(t.id, t.title, normalized.kind, t.description ?? null, normalized.agent ?? null, t.defaultModel ?? null, t.defaultEffort ?? null, normalized.aiMode, t.createdAt, t.lastMessageAt ?? null, t.parentTopicId ?? null, t.memoryTopicId ?? null, t.memoryKey ?? null, t.isFork ? 1 : 0, t.isSubagent ? 1 : 0, normalizeTopicVisibility(t.visibility), normalizeTopicSurface(t.surface ?? defaultTopicSurface()), surfaceScopeForWrite(t), t.subagentReportMode ?? "auto");
     db.query("DELETE FROM topic_members WHERE topic_id = ?").run(t.id);
     for (const participant of t.participants) {
       db.query("INSERT INTO topic_members (topic_id,user_id,role) VALUES (?,?,?)").run(t.id, participant.userId, participant.role);
@@ -8023,7 +8091,8 @@ function upsertTopic(t) {
   })();
 }
 function listTopics(opts = {}) {
-  const rows = opts.surface ? db.query("SELECT * FROM api_topics WHERE surface = ? ORDER BY last_message_at DESC").all(normalizeTopicSurface(opts.surface)) : db.query("SELECT * FROM api_topics ORDER BY last_message_at DESC").all();
+  const scoped = Object.hasOwn(opts, "surfaceScope");
+  const rows = opts.surface ? db.query(`SELECT * FROM api_topics WHERE surface = ?${scoped ? " AND surface_scope IS ?" : ""} ORDER BY last_message_at DESC`).all(...scoped ? [normalizeTopicSurface(opts.surface), normalizeSurfaceScope(opts.surfaceScope)] : [normalizeTopicSurface(opts.surface)]) : db.query("SELECT * FROM api_topics ORDER BY last_message_at DESC").all();
   const participants = getAllTopicParticipants();
   const tellTargets = rows.some((row) => row.is_subagent !== 0) ? getAllSubagentTellTargets() : undefined;
   return rows.map((row) => rowToDto2(row, participants.get(row.id) ?? [], tellTargets));
@@ -8032,15 +8101,24 @@ function getTopic(id) {
   const r = db.query("SELECT * FROM api_topics WHERE id = ?").get(id);
   return r ? rowToDto2(r) : null;
 }
-function getManagerTopicForUser(userId) {
-  const row = db.query(`SELECT t.* FROM api_topics t
+function getManagerTopicForUser(userId, surface, opts = {}) {
+  const scoped = Object.hasOwn(opts, "surfaceScope");
+  const sql = `SELECT t.* FROM api_topics t
        JOIN topic_members m ON m.topic_id = t.id
        WHERE t.kind = 'manager'
          AND t.id != ?
          AND m.user_id = ?
          AND m.role = 'owner'
+         ${surface ? "AND t.surface = ?" : ""}
+         ${scoped ? "AND t.surface_scope IS ?" : ""}
        ORDER BY t.created_at ASC
-       LIMIT 1`).get(GENERAL_TOPIC_ID, userId);
+       LIMIT 1`;
+  const params = [GENERAL_TOPIC_ID, userId];
+  if (surface)
+    params.push(surface);
+  if (scoped)
+    params.push(normalizeSurfaceScope(opts.surfaceScope));
+  const row = db.query(sql).get(...params);
   return row ? rowToDto2(row) : null;
 }
 function getTopicMemoryOrigin(id) {
@@ -8075,6 +8153,7 @@ function getTopicByNameAndKind(title, kind) {
 function findTopicTitleConflict(title, kind, opts = {}) {
   const wanted = normalizedTitle(title);
   const surface = normalizeTopicSurface(opts.surface ?? defaultTopicSurface());
+  const surfaceScope = Object.hasOwn(opts, "surfaceScope") ? normalizeSurfaceScope(opts.surfaceScope) : surface === "otium" ? defaultSurfaceScope() : null;
   const generalTitleRequested = wanted === normalizedTitle(GENERAL_TOPIC_ID);
   if (generalTitleRequested && opts.excludeTopicId !== GENERAL_TOPIC_ID) {
     const general = db.query("SELECT * FROM api_topics WHERE id = ?").get(GENERAL_TOPIC_ID);
@@ -8083,8 +8162,8 @@ function findTopicTitleConflict(title, kind, opts = {}) {
   }
   if (kind === "manager")
     return null;
-  const params = [wanted, surface, kind, GENERAL_TOPIC_ID];
-  let sql = "SELECT * FROM api_topics WHERE LOWER(TRIM(title)) = ? AND surface = ? AND (kind = ? OR id = ?)";
+  const params = [wanted, surface, surfaceScope, kind, GENERAL_TOPIC_ID];
+  let sql = "SELECT * FROM api_topics WHERE LOWER(TRIM(title)) = ? AND surface = ? AND surface_scope IS ? AND (kind = ? OR id = ?)";
   if (opts.excludeTopicId) {
     sql += " AND id != ?";
     params.push(opts.excludeTopicId);
@@ -8111,14 +8190,16 @@ function getTopicByNameForUser(title, userId, opts = {}) {
   const qualified = /^(agent|channel|manager):(.+)$/i.exec(trimmed);
   const requestedKind = qualified ? normalizeTopicKind(qualified[1]?.toLowerCase()) : null;
   const requestedTitle = qualified ? qualified[2].trim() : trimmed;
+  const scoped = Object.hasOwn(opts, "surfaceScope");
   const rows = db.query(`SELECT t.* FROM api_topics t
        WHERE LOWER(t.title) = LOWER(?)
          AND t.id != ?
          AND t.visibility != 'hidden'
          AND (? IS NULL OR t.surface = ?)
+         ${scoped ? "AND t.surface_scope IS ?" : ""}
          AND EXISTS (
            SELECT 1 FROM topic_members m WHERE m.topic_id = t.id AND m.user_id = ?
-         )`).all(requestedTitle, GENERAL_TOPIC_ID, opts.surface ?? null, opts.surface ?? null, userId);
+         )`).all(requestedTitle, GENERAL_TOPIC_ID, opts.surface ?? null, opts.surface ?? null, ...scoped ? [normalizeSurfaceScope(opts.surfaceScope)] : [], userId);
   const matches = requestedKind ? rows.filter((row) => row.kind === requestedKind) : rows;
   return matches.length === 1 ? rowToDto2(matches[0]) : null;
 }
@@ -8206,7 +8287,7 @@ function removeParticipantFromDB(topicId, userId) {
   db.query("DELETE FROM topic_members WHERE topic_id = ? AND user_id = ?").run(topicId, userId);
   return true;
 }
-var DEFAULT_AGENT_ROOM_AGENT = "maestro", SURFACE_BACKFILL_MIGRATION = "api_topics_surface_backfill_20260808";
+var DEFAULT_AGENT_ROOM_AGENT = "maestro", activeSurfaceScope = null, surfaceScopeRequired = false, SURFACE_SCOPE_STAMP_MIGRATION = "api_topics_surface_scope_stamp_20260809", SURFACE_BACKFILL_MIGRATION = "api_topics_surface_backfill_20260808";
 var init_api_topics = __esm(async () => {
   init_constants();
   init_logger();
@@ -11426,8 +11507,10 @@ var init_active_rooms = __esm(async () => {
 
 // ../../packages/core/src/topics/personal-general.ts
 import { randomUUID as randomUUID9 } from "crypto";
-function ensurePersonalGeneral(userId) {
-  const existing = getManagerTopicForUser(userId);
+function ensurePersonalGeneral(userId, surface, opts = {}) {
+  const scope = normalizeTopicSurface(surface ?? defaultTopicSurface());
+  const surfaceScope = opts.surfaceScope !== undefined ? normalizeSurfaceScope(opts.surfaceScope) : scope === "otium" ? defaultSurfaceScope() : null;
+  const existing = getManagerTopicForUser(userId, scope, { surfaceScope });
   if (existing) {
     if (existing.description === LEGACY_PERSONAL_GENERAL_DESCRIPTION) {
       existing.description = PERSONAL_GENERAL_DESCRIPTION;
@@ -11451,6 +11534,8 @@ function ensurePersonalGeneral(userId) {
     aiMode: "always",
     aiMention: false,
     participants: [{ userId, role: "owner" }],
+    surface: scope,
+    surfaceScope,
     createdAt: now,
     lastMessageAt: now
   };
@@ -13438,7 +13523,8 @@ function mergeRuntimeUserTurnRequest(input) {
   const now = Date.now();
   return db.transaction(() => {
     const rows = db.query("SELECT * FROM runtime_user_turn_requests WHERE topic_id = ? ORDER BY created_at ASC, rowid ASC").all(input.topicId);
-    const previous = rows.map(rowToRequest);
+    const thread = input.execution.threadRootId;
+    const previous = rows.map(rowToRequest).filter((request) => request.execution?.threadRootId === thread);
     const omittedRequestIds = new Set([
       ...input.omitRequestIds ?? [],
       ...previous.filter((request) => Boolean(request.execution?.providerSessionId)).map((request) => request.requestId)
@@ -13474,7 +13560,11 @@ function mergeRuntimeUserTurnRequest(input) {
       execution.sessionIdSpecified = true;
     }
     const attachments = flattenUserTurnAttachments(userMessages);
-    db.query("DELETE FROM runtime_user_turn_requests WHERE topic_id = ?").run(input.topicId);
+    const absorbed = previous.map((request) => request.requestId);
+    if (absorbed.length > 0) {
+      db.query(`DELETE FROM runtime_user_turn_requests
+           WHERE topic_id = ? AND request_id IN (${absorbed.map(() => "?").join(",")})`).run(input.topicId, ...absorbed);
+    }
     db.query(`INSERT INTO runtime_user_turn_requests
          (request_id, topic_id, user_id, prompt, user_messages_json, attachments_json,
           allow_auto_continue, execution_json, topic_epoch, created_at,
@@ -14321,8 +14411,8 @@ function updateTopic(topicId, patch) {
 function isParticipant(topic, userId) {
   return topic.participants.some((p) => p.userId === userId);
 }
-function nextDerivedTopicTitle(sourceTitle, kind, suffix, surface) {
-  const visibleTitles = new Set(listTopics(surface ? { surface } : {}).filter((topic) => topic.kind === kind).map((topic) => topic.title.toLowerCase()));
+function nextDerivedTopicTitle(sourceTitle, kind, suffix, surface, surfaceScope) {
+  const visibleTitles = new Set(listTopics(surface ? { surface, surfaceScope: surfaceScope ?? null } : {}).filter((topic) => topic.kind === kind).map((topic) => topic.title.toLowerCase()));
   let n = 1;
   let title = `${sourceTitle}-${suffix}-${n}`;
   while (visibleTitles.has(title.toLowerCase())) {
@@ -14387,8 +14477,9 @@ async function createDerivedTopicImpl(topic, sourceTopicId, userId, copyHistory,
   ] : [{ userId, role: "owner" }];
   const kind = topic.kind ?? inferTopicKind(topic);
   const surface = topic.surface ?? defaultTopicSurface();
-  const title = opts?.name?.trim() || nextDerivedTopicTitle(topic.title, kind, suffix, surface);
-  const conflict = findTopicTitleConflict(title, kind, { surface });
+  const surfaceScope = topic.surfaceScope ?? null;
+  const title = opts?.name?.trim() || nextDerivedTopicTitle(topic.title, kind, suffix, surface, surfaceScope);
+  const conflict = findTopicTitleConflict(title, kind, { surface, surfaceScope });
   if (conflict) {
     logger.info({ sourceTopicId, title, kind, conflictTopicId: conflict.id }, "createDerivedTopic: title conflict");
     throw new TopicTitleConflictError(title);
@@ -14411,7 +14502,8 @@ async function createDerivedTopicImpl(topic, sourceTopicId, userId, copyHistory,
     isFork: copyHistory,
     ...subagent ? { isSubagent: true } : {},
     visibility: topic.visibility,
-    surface
+    surface,
+    surfaceScope
   };
   let sessionId;
   let rollbackHandle;
@@ -14519,7 +14611,10 @@ async function createDerivedTopicImpl(topic, sourceTopicId, userId, copyHistory,
       if (!currentSource || currentSource.kind === "manager" || !isParticipant(currentSource, userId) || subagent && isRuntimeTopicMaintenance(sourceTopicId)) {
         throw new TopicDeriveBusyError("Source topic changed while deriving; try again");
       }
-      const transactionalConflict = findTopicTitleConflict(title, kind, { surface });
+      const transactionalConflict = findTopicTitleConflict(title, kind, {
+        surface,
+        surfaceScope
+      });
       if (transactionalConflict)
         throw new TopicTitleConflictError(title);
       upsertTopic(derived);
@@ -15389,13 +15484,14 @@ async function forwardToPeer(args) {
     error: forwarded.configured ? "remote session bridge is configured but unavailable" : "remote nodes are not connected on this negotium node (standalone mode)"
   };
 }
-async function peerSessionsForUser(userId, sourceQueryId) {
+async function peerSessionsForUser(userId, sourceQueryId, fromTopicId) {
   if (activeBridge)
-    return activeBridge.sessions(userId, sourceQueryId);
+    return activeBridge.sessions(userId, sourceQueryId, fromTopicId);
   const sessions = await callLoopbackBridge({
     action: "sessions",
     userId,
-    sourceQueryId
+    sourceQueryId,
+    fromTopicId
   });
   if (sessions.result)
     return sessions.result;
@@ -16151,6 +16247,226 @@ body{font-family:system-ui,-apple-system,"Segoe UI",sans-serif;background:var(--
 </style>`;
 });
 
+// ../../packages/core/src/storage/token-stats.ts
+var exports_token_stats = {};
+__export(exports_token_stats, {
+  tokenStatsFileId: () => tokenStatsFileId,
+  recordUsage: () => recordUsage,
+  getTopicStats: () => getTopicStats,
+  getStats: () => getStats,
+  deleteTopicStats: () => deleteTopicStats,
+  calcCost: () => calcCost
+});
+import { createHash as createHash7 } from "crypto";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync14 } from "fs";
+import { join as join25 } from "path";
+function emptyBucket() {
+  return {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheCreationInputTokens: 0,
+    cacheReadInputTokens: 0,
+    queries: 0,
+    estimatedCostUsd: 0
+  };
+}
+function tokenStatsFileId(userId) {
+  const rawUserId = String(userId);
+  return /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,255}$/.test(rawUserId) && !rawUserId.includes("..") ? rawUserId : `sha256-${createHash7("sha256").update(rawUserId).digest("hex")}`;
+}
+function queriesPath(userId) {
+  const fileId = tokenStatsFileId(userId);
+  const logDir = resolveStorageLogDir();
+  mkdirSync16(logDir, { recursive: true });
+  return join25(logDir, `token-queries-${fileId}.jsonl`);
+}
+function loadRecords(userId) {
+  try {
+    return readJsonlLines(queriesPath(userId)).flatMap((line) => {
+      try {
+        return [JSON.parse(line)];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  }
+}
+function calcCost(b) {
+  return b.estimatedCostUsd;
+}
+function estimateUsageCost(agent, model, usage) {
+  const prices = TOKEN_PRICES[`${agent}:${model}`];
+  if (!prices)
+    return 0;
+  return (usage.inputTokens * prices.input + usage.outputTokens * prices.output + (agent === "claude" ? usage.cacheCreationInputTokens * (prices.cacheWrite ?? prices.input) : 0) + usage.cacheReadInputTokens * prices.cacheRead) / 1e6;
+}
+function isQueryRecord(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const record = value;
+  return record.schemaVersion === 2 && typeof record.timestamp === "string" && typeof record.session === "string" && typeof record.topicId === "string" && typeof record.agent === "string" && typeof record.model === "string" && typeof record.inputTokens === "number" && typeof record.outputTokens === "number" && typeof record.cacheCreationInputTokens === "number" && typeof record.cacheReadInputTokens === "number" && typeof record.estimatedCostUsd === "number";
+}
+function recordUsage(userId, session, usage, context) {
+  const cacheReadInputTokens = usage.cacheReadInputTokens ?? 0;
+  const inputTokens = context.agent === "claude" ? usage.inputTokens : Math.max(0, usage.inputTokens - cacheReadInputTokens);
+  const normalized = {
+    inputTokens,
+    outputTokens: usage.outputTokens,
+    cacheCreationInputTokens: usage.cacheCreationInputTokens ?? 0,
+    cacheReadInputTokens
+  };
+  const record = {
+    schemaVersion: 2,
+    timestamp: new Date().toISOString(),
+    session,
+    topicId: context.topicId,
+    ...context.providerSessionId ? { providerSessionId: context.providerSessionId } : {},
+    agent: context.agent,
+    model: context.model,
+    ...normalized,
+    ...usage.contextTokens !== undefined ? { contextTokens: usage.contextTokens } : {},
+    ...usage.contextWindow !== undefined ? { contextWindow: usage.contextWindow } : {},
+    estimatedCostUsd: usage.costUsd ?? estimateUsageCost(context.agent, context.model, normalized)
+  };
+  try {
+    appendJsonlEntry(queriesPath(userId), record);
+  } catch (e) {
+    logger.warn({ err: e, userId }, "token-stats: Failed to record");
+  }
+}
+function deleteTopicStats(userId, topicId) {
+  const path = queriesPath(userId);
+  try {
+    const kept = readJsonlLines(path).filter((line) => {
+      try {
+        const record = JSON.parse(line);
+        return record.topicId !== topicId;
+      } catch {
+        return true;
+      }
+    });
+    writeFileSync14(path, kept.length > 0 ? `${kept.join(`
+`)}
+` : "", "utf-8");
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return;
+    logger.warn({ err: e, userId, topicId }, "token-stats: Failed to delete topic stats");
+  }
+}
+function getStats(userId, from, to) {
+  const records = loadRecords(userId);
+  const fromTs = from ? new Date(from).getTime() : 0;
+  const toTs = to ? new Date(to).getTime() : Infinity;
+  if (from && Number.isNaN(fromTs) || to && Number.isNaN(toTs)) {
+    logger.warn({ from, to }, "token-stats: Invalid date range, returning empty");
+    return {
+      total: emptyBucket(),
+      byHour: {},
+      bySession: {},
+      currentSessions: [],
+      ignoredLegacyRecords: 0,
+      estimatedCostUsd: 0
+    };
+  }
+  const total = emptyBucket();
+  const byHour = {};
+  const bySession = {};
+  const currentSessions = new Map;
+  let ignoredLegacyRecords = 0;
+  for (const raw of records) {
+    if (!isQueryRecord(raw)) {
+      ignoredLegacyRecords += 1;
+      continue;
+    }
+    const r = raw;
+    const ts = new Date(r.timestamp).getTime();
+    if (ts < fromTs || ts > toTs)
+      continue;
+    const hourKey = r.timestamp.slice(0, 13);
+    if (!byHour[hourKey])
+      byHour[hourKey] = emptyBucket();
+    if (!bySession[r.session])
+      bySession[r.session] = emptyBucket();
+    for (const bucket of [total, byHour[hourKey], bySession[r.session]]) {
+      bucket.inputTokens += r.inputTokens;
+      bucket.outputTokens += r.outputTokens;
+      bucket.cacheCreationInputTokens += r.cacheCreationInputTokens;
+      bucket.cacheReadInputTokens += r.cacheReadInputTokens;
+      bucket.queries += 1;
+      bucket.estimatedCostUsd += r.estimatedCostUsd;
+    }
+    if (r.contextTokens !== undefined && r.contextWindow !== undefined && r.contextWindow > 0) {
+      currentSessions.set(r.topicId, {
+        timestamp: r.timestamp,
+        topicId: r.topicId,
+        topicTitle: r.session,
+        ...r.providerSessionId ? { providerSessionId: r.providerSessionId } : {},
+        agent: r.agent,
+        model: r.model,
+        contextTokens: r.contextTokens,
+        contextWindow: r.contextWindow
+      });
+    }
+  }
+  return {
+    total,
+    byHour,
+    bySession,
+    currentSessions: [...currentSessions.values()].sort((a, b) => b.timestamp.localeCompare(a.timestamp)),
+    ignoredLegacyRecords,
+    estimatedCostUsd: calcCost(total)
+  };
+}
+function getTopicStats(userId, topicId, activeProviderSessionId = getTopicSessionId(topicId) ?? undefined) {
+  const total = emptyBucket();
+  let currentSession;
+  for (const raw of loadRecords(userId)) {
+    if (!isQueryRecord(raw) || raw.topicId !== topicId)
+      continue;
+    total.inputTokens += raw.inputTokens;
+    total.outputTokens += raw.outputTokens;
+    total.cacheCreationInputTokens += raw.cacheCreationInputTokens;
+    total.cacheReadInputTokens += raw.cacheReadInputTokens;
+    total.queries += 1;
+    total.estimatedCostUsd += raw.estimatedCostUsd;
+    if (raw.contextTokens !== undefined && raw.contextWindow !== undefined && raw.contextWindow > 0 && activeProviderSessionId !== undefined && raw.providerSessionId === activeProviderSessionId && (!currentSession || raw.timestamp > currentSession.timestamp)) {
+      currentSession = {
+        timestamp: raw.timestamp,
+        topicId: raw.topicId,
+        topicTitle: raw.session,
+        ...raw.providerSessionId ? { providerSessionId: raw.providerSessionId } : {},
+        agent: raw.agent,
+        model: raw.model,
+        contextTokens: raw.contextTokens,
+        contextWindow: raw.contextWindow
+      };
+    }
+  }
+  return { topicId, ...total, ...currentSession ? { currentSession } : {} };
+}
+var TOKEN_PRICES;
+var init_token_stats = __esm(async () => {
+  init_jsonl();
+  init_logger();
+  await init_api_topics();
+  await init_storage_host();
+  TOKEN_PRICES = {
+    "codex:gpt-5.6-sol": { input: 5, cacheRead: 0.5, output: 30 },
+    "codex:gpt-5.6-terra": { input: 2.5, cacheRead: 0.25, output: 15 },
+    "codex:gpt-5.6-luna": { input: 1, cacheRead: 0.1, output: 6 },
+    "claude:fable": { input: 10, cacheWrite: 12.5, cacheRead: 1, output: 50 },
+    "claude:opus": { input: 5, cacheWrite: 6.25, cacheRead: 0.5, output: 25 },
+    "claude:sonnet": { input: 2, cacheWrite: 2.5, cacheRead: 0.2, output: 10 },
+    "maestro:kimi-k3": { input: 3, cacheRead: 0.3, output: 15 },
+    "maestro:kimi-k2.7-code": { input: 0.95, cacheRead: 0.19, output: 4 },
+    "maestro:deepseek-pro": { input: 0.435, cacheRead: 0.003625, output: 0.87 },
+    "maestro:deepseek-flash": { input: 0.14, cacheRead: 0.0028, output: 0.28 }
+  };
+});
+
 // ../../packages/core/src/topics/lifecycle.ts
 var exports_lifecycle = {};
 __export(exports_lifecycle, {
@@ -16200,6 +16516,7 @@ async function cleanupParticipantResources(topic, userIds, sessionId, cwd, purge
     cleanupSessionInboxFiles(participantUserId, topic.id, topic.title);
     clearQueryState(participantUserId, topic.id, topic.title);
     clearQueryUsageAlert(participantUserId, topic.id);
+    deleteTopicStats(participantUserId, topic.id);
     deletePendingAsksForTopic({ userId: participantUserId, topicName: topic.title });
   }
   return true;
@@ -16354,6 +16671,7 @@ var init_lifecycle = __esm(async () => {
   await init_runtime_turn_requests();
   await init_self_schedules();
   await init_session_asks();
+  await init_token_stats();
   await init_topic_archive();
   await init_topic_archive_state();
   TopicArchiveRequiredError = class TopicArchiveRequiredError extends Error {
@@ -16388,8 +16706,8 @@ var init_lifecycle = __esm(async () => {
 
 // ../../packages/core/src/runtime/attachments.ts
 import { randomUUID as randomUUID14 } from "crypto";
-import { copyFileSync as copyFileSync2, mkdirSync as mkdirSync16, writeFileSync as writeFileSync14 } from "fs";
-import { basename as basename5, join as join25 } from "path";
+import { copyFileSync as copyFileSync2, mkdirSync as mkdirSync17, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename5, join as join26 } from "path";
 function workspaceCwdFor(topicId) {
   return resolveTopicWorkspaceDir(topicId);
 }
@@ -16402,7 +16720,7 @@ function materializePromptAttachments(topicId, queryId, attachmentIds) {
   if (!attachmentIds?.length)
     return [];
   const out = [];
-  const destDir = join25(workspaceCwdFor(topicId), "attachments", queryId);
+  const destDir = join26(workspaceCwdFor(topicId), "attachments", queryId);
   for (const rawId of attachmentIds) {
     if (typeof rawId !== "string")
       continue;
@@ -16416,10 +16734,10 @@ function materializePromptAttachments(topicId, queryId, attachmentIds) {
       continue;
     }
     try {
-      mkdirSync16(destDir, { recursive: true });
+      mkdirSync17(destDir, { recursive: true });
       const index = String(out.length + 1).padStart(2, "0");
       const safeName = safeAttachmentFilename(attachment.filename, fileId);
-      const destPath = join25(destDir, `${index}-${fileId.slice(0, 8)}-${safeName}`);
+      const destPath = join26(destDir, `${index}-${fileId.slice(0, 8)}-${safeName}`);
       copyFileSync2(sourcePath, destPath);
       out.push({
         id: attachment.id,
@@ -16449,14 +16767,14 @@ function promptWithAttachments(prompt, attachments) {
   return composeAttachmentPrompt(prompt, attachments.map(({ filename, path }) => attachmentPromptLine(filename, path)));
 }
 function ingestAttachment(args) {
-  const destDir = join25(UPLOADS_DIR, args.topicId);
-  mkdirSync16(destDir, { recursive: true });
+  const destDir = join26(UPLOADS_DIR, args.topicId);
+  mkdirSync17(destDir, { recursive: true });
   const safeName = safeAttachmentFilename(args.filename, "upload");
-  const destPath = join25(destDir, `${Date.now()}-${randomUUID14().slice(0, 8)}-${safeName}`);
+  const destPath = join26(destDir, `${Date.now()}-${randomUUID14().slice(0, 8)}-${safeName}`);
   if (args.sourcePath !== undefined) {
     copyFileSync2(args.sourcePath, destPath);
   } else if (args.bytes !== undefined) {
-    writeFileSync14(destPath, args.bytes);
+    writeFileSync15(destPath, args.bytes);
   } else {
     throw new Error("ingestAttachment: provide sourcePath or bytes");
   }
@@ -17052,204 +17370,6 @@ var init_visuals = __esm(async () => {
   init_visual_html();
 });
 
-// ../../packages/core/src/storage/token-stats.ts
-var exports_token_stats = {};
-__export(exports_token_stats, {
-  tokenStatsFileId: () => tokenStatsFileId,
-  recordUsage: () => recordUsage,
-  getTopicStats: () => getTopicStats,
-  getStats: () => getStats,
-  calcCost: () => calcCost
-});
-import { createHash as createHash7 } from "crypto";
-import { mkdirSync as mkdirSync17 } from "fs";
-import { join as join26 } from "path";
-function emptyBucket() {
-  return {
-    inputTokens: 0,
-    outputTokens: 0,
-    cacheCreationInputTokens: 0,
-    cacheReadInputTokens: 0,
-    queries: 0,
-    estimatedCostUsd: 0
-  };
-}
-function tokenStatsFileId(userId) {
-  const rawUserId = String(userId);
-  return /^[A-Za-z0-9][A-Za-z0-9_.@-]{0,255}$/.test(rawUserId) && !rawUserId.includes("..") ? rawUserId : `sha256-${createHash7("sha256").update(rawUserId).digest("hex")}`;
-}
-function queriesPath(userId) {
-  const fileId = tokenStatsFileId(userId);
-  const logDir = resolveStorageLogDir();
-  mkdirSync17(logDir, { recursive: true });
-  return join26(logDir, `token-queries-${fileId}.jsonl`);
-}
-function loadRecords(userId) {
-  try {
-    return readJsonlLines(queriesPath(userId)).flatMap((line) => {
-      try {
-        return [JSON.parse(line)];
-      } catch {
-        return [];
-      }
-    });
-  } catch {
-    return [];
-  }
-}
-function calcCost(b) {
-  return b.estimatedCostUsd;
-}
-function estimateUsageCost(agent, model, usage) {
-  const prices = TOKEN_PRICES[`${agent}:${model}`];
-  if (!prices)
-    return 0;
-  return (usage.inputTokens * prices.input + usage.outputTokens * prices.output + (agent === "claude" ? usage.cacheCreationInputTokens * (prices.cacheWrite ?? prices.input) : 0) + usage.cacheReadInputTokens * prices.cacheRead) / 1e6;
-}
-function isQueryRecord(value) {
-  if (!value || typeof value !== "object")
-    return false;
-  const record = value;
-  return record.schemaVersion === 2 && typeof record.timestamp === "string" && typeof record.session === "string" && typeof record.topicId === "string" && typeof record.agent === "string" && typeof record.model === "string" && typeof record.inputTokens === "number" && typeof record.outputTokens === "number" && typeof record.cacheCreationInputTokens === "number" && typeof record.cacheReadInputTokens === "number" && typeof record.estimatedCostUsd === "number";
-}
-function recordUsage(userId, session, usage, context) {
-  const cacheReadInputTokens = usage.cacheReadInputTokens ?? 0;
-  const inputTokens = context.agent === "claude" ? usage.inputTokens : Math.max(0, usage.inputTokens - cacheReadInputTokens);
-  const normalized = {
-    inputTokens,
-    outputTokens: usage.outputTokens,
-    cacheCreationInputTokens: usage.cacheCreationInputTokens ?? 0,
-    cacheReadInputTokens
-  };
-  const record = {
-    schemaVersion: 2,
-    timestamp: new Date().toISOString(),
-    session,
-    topicId: context.topicId,
-    ...context.providerSessionId ? { providerSessionId: context.providerSessionId } : {},
-    agent: context.agent,
-    model: context.model,
-    ...normalized,
-    ...usage.contextTokens !== undefined ? { contextTokens: usage.contextTokens } : {},
-    ...usage.contextWindow !== undefined ? { contextWindow: usage.contextWindow } : {},
-    estimatedCostUsd: usage.costUsd ?? estimateUsageCost(context.agent, context.model, normalized)
-  };
-  try {
-    appendJsonlEntry(queriesPath(userId), record);
-  } catch (e) {
-    logger.warn({ err: e, userId }, "token-stats: Failed to record");
-  }
-}
-function getStats(userId, from, to) {
-  const records = loadRecords(userId);
-  const fromTs = from ? new Date(from).getTime() : 0;
-  const toTs = to ? new Date(to).getTime() : Infinity;
-  if (from && Number.isNaN(fromTs) || to && Number.isNaN(toTs)) {
-    logger.warn({ from, to }, "token-stats: Invalid date range, returning empty");
-    return {
-      total: emptyBucket(),
-      byHour: {},
-      bySession: {},
-      currentSessions: [],
-      ignoredLegacyRecords: 0,
-      estimatedCostUsd: 0
-    };
-  }
-  const total = emptyBucket();
-  const byHour = {};
-  const bySession = {};
-  const currentSessions = new Map;
-  let ignoredLegacyRecords = 0;
-  for (const raw of records) {
-    if (!isQueryRecord(raw)) {
-      ignoredLegacyRecords += 1;
-      continue;
-    }
-    const r = raw;
-    const ts = new Date(r.timestamp).getTime();
-    if (ts < fromTs || ts > toTs)
-      continue;
-    const hourKey = r.timestamp.slice(0, 13);
-    if (!byHour[hourKey])
-      byHour[hourKey] = emptyBucket();
-    if (!bySession[r.session])
-      bySession[r.session] = emptyBucket();
-    for (const bucket of [total, byHour[hourKey], bySession[r.session]]) {
-      bucket.inputTokens += r.inputTokens;
-      bucket.outputTokens += r.outputTokens;
-      bucket.cacheCreationInputTokens += r.cacheCreationInputTokens;
-      bucket.cacheReadInputTokens += r.cacheReadInputTokens;
-      bucket.queries += 1;
-      bucket.estimatedCostUsd += r.estimatedCostUsd;
-    }
-    if (r.contextTokens !== undefined && r.contextWindow !== undefined && r.contextWindow > 0) {
-      currentSessions.set(r.topicId, {
-        timestamp: r.timestamp,
-        topicId: r.topicId,
-        topicTitle: r.session,
-        ...r.providerSessionId ? { providerSessionId: r.providerSessionId } : {},
-        agent: r.agent,
-        model: r.model,
-        contextTokens: r.contextTokens,
-        contextWindow: r.contextWindow
-      });
-    }
-  }
-  return {
-    total,
-    byHour,
-    bySession,
-    currentSessions: [...currentSessions.values()].sort((a, b) => b.timestamp.localeCompare(a.timestamp)),
-    ignoredLegacyRecords,
-    estimatedCostUsd: calcCost(total)
-  };
-}
-function getTopicStats(userId, topicId) {
-  const total = emptyBucket();
-  let currentSession;
-  for (const raw of loadRecords(userId)) {
-    if (!isQueryRecord(raw) || raw.topicId !== topicId)
-      continue;
-    total.inputTokens += raw.inputTokens;
-    total.outputTokens += raw.outputTokens;
-    total.cacheCreationInputTokens += raw.cacheCreationInputTokens;
-    total.cacheReadInputTokens += raw.cacheReadInputTokens;
-    total.queries += 1;
-    total.estimatedCostUsd += raw.estimatedCostUsd;
-    if (raw.contextTokens !== undefined && raw.contextWindow !== undefined && raw.contextWindow > 0 && (!currentSession || raw.timestamp > currentSession.timestamp)) {
-      currentSession = {
-        timestamp: raw.timestamp,
-        topicId: raw.topicId,
-        topicTitle: raw.session,
-        ...raw.providerSessionId ? { providerSessionId: raw.providerSessionId } : {},
-        agent: raw.agent,
-        model: raw.model,
-        contextTokens: raw.contextTokens,
-        contextWindow: raw.contextWindow
-      };
-    }
-  }
-  return { topicId, ...total, ...currentSession ? { currentSession } : {} };
-}
-var TOKEN_PRICES;
-var init_token_stats = __esm(async () => {
-  init_jsonl();
-  init_logger();
-  await init_storage_host();
-  TOKEN_PRICES = {
-    "codex:gpt-5.6-sol": { input: 5, cacheRead: 0.5, output: 30 },
-    "codex:gpt-5.6-terra": { input: 2.5, cacheRead: 0.25, output: 15 },
-    "codex:gpt-5.6-luna": { input: 1, cacheRead: 0.1, output: 6 },
-    "claude:fable": { input: 10, cacheWrite: 12.5, cacheRead: 1, output: 50 },
-    "claude:opus": { input: 5, cacheWrite: 6.25, cacheRead: 0.5, output: 25 },
-    "claude:sonnet": { input: 2, cacheWrite: 2.5, cacheRead: 0.2, output: 10 },
-    "maestro:kimi-k3": { input: 3, cacheRead: 0.3, output: 15 },
-    "maestro:kimi-k2.7-code": { input: 0.95, cacheRead: 0.19, output: 4 },
-    "maestro:deepseek-pro": { input: 0.435, cacheRead: 0.003625, output: 0.87 },
-    "maestro:deepseek-flash": { input: 0.14, cacheRead: 0.0028, output: 0.28 }
-  };
-});
-
 // ../../packages/core/src/runtime/turn-event-stream.ts
 import { randomUUID as randomUUID15 } from "crypto";
 import { realpathSync as realpathSync5, statSync as statSync9 } from "fs";
@@ -17365,10 +17485,11 @@ async function runTurnEventStream(topicId, topicTitle, queryId, events, control,
       agentType,
       model,
       sourceNode: execution?.sourceNode,
+      ...execution?.threadRootId ? { threadRootId: execution.threadRootId } : {},
       usage,
       createdAt: new Date().toISOString()
     };
-    appendApiMessage(message);
+    appendApiMessage(message, execution?.threadRootId ? { updateTopicLastMessageAt: false } : undefined);
     hub.broadcastMessage(topicId, message);
     lastVisibleMessageId = message.id;
     visibleMessageIds.push(message.id);
@@ -17890,7 +18011,7 @@ __export(exports_app_settings, {
   getGlobalAiName: () => getGlobalAiName,
   DEFAULT_AI_NAME: () => DEFAULT_AI_NAME
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync18, readFileSync as readFileSync16, writeFileSync as writeFileSync16 } from "fs";
 import { dirname as dirname14, join as join27 } from "path";
 function settingsFile() {
   return join27(resolveStorageDataDir(), "otium-settings.json");
@@ -17920,7 +18041,7 @@ function setGlobalAiName(name) {
   aiName = name.trim() || DEFAULT_AI_NAME;
   try {
     mkdirSync18(dirname14(path), { recursive: true });
-    writeFileSync15(path, JSON.stringify({ aiName }, null, 2));
+    writeFileSync16(path, JSON.stringify({ aiName }, null, 2));
   } catch {}
   return aiName;
 }
@@ -18417,6 +18538,7 @@ async function drainOneDurableUserTurn() {
       bridgeSessionFromHistory: execution?.bridgeSessionFromHistory,
       peerBridge: execution?.peerBridge,
       from: execution?.from,
+      threadRootId: execution?.threadRootId,
       _queryId: request.requestId,
       _runtimeEpoch: execution?.runtimeEpoch ?? request.topicEpoch,
       onSettled: () => {
@@ -18489,6 +18611,7 @@ function startAiTurn(params) {
   let sessionId = sessionResolution.sessionId;
   const deferredSessionId = params.sessionId === undefined && !sessionResolution.isolated ? undefined : sessionId;
   const sourceNode = params.sourceNode;
+  const threadRootId = params.threadRootId;
   const topicId = topic.id;
   const requestId = params.requestId;
   const depth = params.depth;
@@ -19017,7 +19140,7 @@ function startAiTurn(params) {
     WsHub.get().broadcastTyping(topicId, "ai");
     WsHub.get().broadcastAiActive(topicId, queryId);
   }
-  streamAgentEvents(topicId, topic.title, queryId, events, control, agentKind, resolvedModel, resolvedEffort, userId, !sessionRetried, onSessionId, { silent, peerBridge, sourceNode }).then(async (streamOutcome) => {
+  streamAgentEvents(topicId, topic.title, queryId, events, control, agentKind, resolvedModel, resolvedEffort, userId, !sessionRetried, onSessionId, { silent, peerBridge, sourceNode, ...threadRootId ? { threadRootId } : {} }).then(async (streamOutcome) => {
     let outcome = streamOutcome;
     if (outcome.kind === "session-expired") {
       const retry = resolveSessionRetry({
@@ -20277,7 +20400,8 @@ function gatewayPayloadHash(params, requestId, actorUserId) {
     params.text,
     params.clientMessageId,
     requestId,
-    params.allowAutoContinue ?? true
+    params.allowAutoContinue ?? true,
+    params.threadRootId ?? null
   ])).digest("hex");
 }
 function submitRuntimeGatewayTurn(params) {
@@ -20297,6 +20421,7 @@ function submitRuntimeGatewayTurn(params) {
     sourceAdapter: "runtime-gateway",
     sourceMessageId: params.clientMessageId,
     text: params.text,
+    ...params.threadRootId ? { threadRootId: params.threadRootId } : {},
     createdAt
   };
   const submission = {
@@ -20331,7 +20456,8 @@ function submitRuntimeGatewayTurn(params) {
           sessionIdSpecified: true,
           conversationPrompts: [params.text],
           loggedUserMessageCount: 0,
-          vaultUserId: params.vaultUserId
+          vaultUserId: params.vaultUserId,
+          ...params.threadRootId ? { threadRootId: params.threadRootId } : {}
         }
       });
       const acceptedEvent = appendRuntimeEvent("runtime-gateway-ingress", {
@@ -20524,7 +20650,11 @@ function registerTopic(opts) {
     throw new TopicValidationError("Manager rooms are system-managed");
   }
   const surface = normalizeTopicSurface(opts.surface ?? defaultTopicSurface());
-  const conflict = findTopicTitleConflict(title, requestedKind, { surface });
+  const surfaceScope = opts.surfaceScope !== undefined ? normalizeSurfaceScope(opts.surfaceScope) : surface === "otium" ? defaultSurfaceScope() : null;
+  if (surface === "otium" && !surfaceScope && isSurfaceScopeRequired()) {
+    throw new TopicValidationError("this node serves several Otium workspaces; a room must name one to be created");
+  }
+  const conflict = findTopicTitleConflict(title, requestedKind, { surface, surfaceScope });
   if (conflict) {
     throw new TopicValidationError(`A topic named "${title}" already exists on ${surface}`);
   }
@@ -20561,6 +20691,7 @@ function registerTopic(opts) {
     aiMode,
     participants: [{ userId: opts.userId, role: "owner" }],
     surface,
+    surfaceScope,
     createdAt: now,
     lastMessageAt: now
   };
@@ -21714,7 +21845,7 @@ var init_file_ops = __esm(() => {
 
 // ../../packages/core/src/runtime/inbox.ts
 import { createHash as createHash9, randomUUID as randomUUID20 } from "crypto";
-import { readdirSync as readdirSync8, statSync as statSync13, writeFileSync as writeFileSync16 } from "fs";
+import { readdirSync as readdirSync8, statSync as statSync13, writeFileSync as writeFileSync17 } from "fs";
 import { join as join32 } from "path";
 async function createAskForkPlan(options) {
   const snapshot = structuredClone(options.entries);
@@ -22004,7 +22135,7 @@ function sweepScheduledSessionInbox(nowMs = Date.now()) {
           total: due.length + pending.length
         }, "self-schedule: promotion interrupted; retaining only the unpromoted entries");
         try {
-          writeFileSync16(drained.processingPath, `${unfinished.map((entry) => JSON.stringify(entry)).join(`
+          writeFileSync17(drained.processingPath, `${unfinished.map((entry) => JSON.stringify(entry)).join(`
 `)}
 `);
         } catch (rewriteErr) {
@@ -22411,13 +22542,16 @@ __export(exports_src, {
   startBashrsCompletionsWorker: () => startBashrsCompletionsWorker,
   startAskUserQuestionGateOwner: () => startAskUserQuestionGateOwner,
   startAiTurn: () => startAiTurn,
+  stampUnscopedOtiumTopics: () => stampUnscopedOtiumTopics,
   setTopicSurfaces: () => setTopicSurfaces,
   setTopicSessionId: () => setTopicSessionId,
+  setSurfaceScopeRequired: () => setSurfaceScopeRequired,
   setRuntimeMcpPort: () => setRuntimeMcpPort,
   setRuntimeBus: () => setRuntimeBus,
   setPlaywrightUnavailableNotifier: () => setPlaywrightUnavailableNotifier,
   setNodeMcpServers: () => setNodeMcpServers,
   setFileHooks: () => setFileHooks,
+  setDefaultSurfaceScope: () => setDefaultSurfaceScope,
   setBashrsCompletionSink: () => setBashrsCompletionSink,
   setApiTopicConfig: () => setApiTopicConfig,
   sessionInboxPath: () => sessionInboxPath,
@@ -22459,6 +22593,7 @@ __export(exports_src, {
   onShutdown: () => onShutdown,
   normalizeVaultKey: () => normalizeVaultKey,
   normalizeTopicSurface: () => normalizeTopicSurface,
+  normalizeSurfaceScope: () => normalizeSurfaceScope,
   nodeRequestHandlerNames: () => nodeRequestHandlerNames,
   modelOwner: () => modelOwner,
   markPlaywrightUnavailable: () => markPlaywrightUnavailable,
@@ -22486,6 +22621,7 @@ __export(exports_src, {
   isTranscriptionConfigured: () => isTranscriptionConfigured,
   isTopicVisible: () => isTopicVisible,
   isTopicRunning: () => isTopicRunning,
+  isSurfaceScopeRequired: () => isSurfaceScopeRequired,
   isSensitivePath: () => isSensitivePath,
   isParticipant: () => isParticipant,
   isHostedMcpSurface: () => isHostedMcpSurface,
@@ -22535,6 +22671,7 @@ __export(exports_src, {
   deleteVaultEntry: () => deleteVaultEntry,
   deleteTopicCascade: () => deleteTopicCascade,
   defaultTopicSurface: () => defaultTopicSurface,
+  defaultSurfaceScope: () => defaultSurfaceScope,
   db: () => db,
   createSubagentManagementToolDefinitions: () => createSubagentManagementToolDefinitions,
   createSpawnSubagentToolDefinition: () => createSpawnSubagentToolDefinition,
@@ -22832,6 +22969,7 @@ __export(exports_node_host, {
   getVisibleTopics: () => getVisibleTopics,
   getTopicStats: () => getTopicStats,
   getTopic: () => getTopic,
+  getApiMessage: () => getApiMessage,
   flushBashrsCompletions: () => flushBashrsCompletions,
   executeVaultCommand: () => executeVaultCommand,
   ensurePersonalGeneral: () => ensurePersonalGeneral,
@@ -23166,6 +23304,7 @@ __export(exports_mcp_runtime_host, {
   dispatchPeerRuntimeFile: () => dispatchPeerRuntimeFile,
   dispatchPeerRuntimeAskUser: () => dispatchPeerRuntimeAskUser,
   deleteTopicCascade: () => deleteTopicCascade,
+  defaultTopicSurface: () => defaultTopicSurface,
   createSubagentManagementToolDefinitions: () => createSubagentManagementToolDefinitions,
   createSpawnSubagentToolDefinition: () => createSpawnSubagentToolDefinition,
   createSelfConfigToolDefinitions: () => createSelfConfigToolDefinitions,
@@ -23222,6 +23361,9 @@ var init_mcp_runtime_host = __esm(async () => {
 
 // ../../packages/mcp/src/node-tools.ts
 import { z as z6 } from "zod";
+function callerSurface(ctx) {
+  return getTopic(ctx.topicId)?.surface ?? defaultTopicSurface();
+}
 function resolveTopicForUser(ctx, ref) {
   const trimmed = ref.trim();
   if (!trimmed)
@@ -23233,7 +23375,7 @@ function resolveTopicForUser(ctx, ref) {
       return { error: notFound };
     return { topic: byId };
   }
-  const byTitle = getTopicByNameForUser(trimmed, ctx.userId);
+  const byTitle = getTopicByNameForUser(trimmed, ctx.userId, { surface: callerSurface(ctx) });
   if (byTitle)
     return { topic: byTitle };
   return { error: notFound };
@@ -23255,6 +23397,7 @@ function registerNodeTools(server, ctx) {
       const topic = registerTopic({
         title,
         userId: ctx.userId,
+        surface: callerSurface(ctx),
         agent,
         model,
         effort,
@@ -23276,7 +23419,7 @@ function registerNodeTools(server, ctx) {
     }
   });
   server.tool("list_topics", "List the calling user's topics on this negotium node: title, id, kind, agent, and whether a turn is currently running.", {}, async () => {
-    const topics = getTopics().filter((topic) => isParticipant(topic, ctx.userId));
+    const topics = getTopics({ surface: callerSurface(ctx) }).filter((topic) => isParticipant(topic, ctx.userId));
     if (topics.length === 0) {
       return textResult("No topics found. Use register_topic to create one.");
     }
@@ -24253,13 +24396,15 @@ function currentTopic(context) {
   return topic;
 }
 function targetCatalog(context) {
-  const surface = (context.currentTopicId ? getTopic(context.currentTopicId)?.surface : undefined) ?? defaultTopicSurface();
+  const current3 = context.currentTopicId ? getTopic(context.currentTopicId) : null;
+  const surface = current3?.surface ?? defaultTopicSurface();
+  const surfaceScope = current3 ? current3.surfaceScope ?? null : surface === "otium" ? defaultSurfaceScope() : null;
   return createSessionTargetCatalog({
     currentTopicId: context.currentTopicId,
     currentTopicName: context.currentTopic,
     currentSurface: surface,
     isAgent: isAgentKind,
-    listRows: () => listTopics().filter((topic) => topic.participants.some((p) => p.userId === context.userId)).map((topic) => ({
+    listRows: () => listTopics({ surface, surfaceScope }).filter((topic) => topic.participants.some((p) => p.userId === context.userId)).map((topic) => ({
       id: topic.id,
       title: topic.title,
       kind: topic.kind ?? null,
@@ -24311,7 +24456,7 @@ function createDefaultSessionCommMcpHost() {
       const entries = targetCatalog(context).listTargets().filter(({ topic }) => !identity.restricted || Boolean(topic.topicId && canSubagentTellTarget(identity, topic.topicId))).filter(({ topic }) => Boolean(topic.agent)).map(({ key, topic }) => `- ${key}: ${topic.sessionId ? "active" : "fresh-start ready"}${topic.description ? `
     description: ${topic.description.slice(0, 80)}` : ""}`);
       if (!identity.restricted) {
-        const peers = await peerSessionsForUser(context.userId, context.peerHostQueryId);
+        const peers = await peerSessionsForUser(context.userId, context.peerHostQueryId, context.currentTopicId);
         for (const node of peers.nodes ?? []) {
           for (const session of node.sessions ?? []) {
             if (session.agent)
@@ -25156,7 +25301,7 @@ import {
   renameSync as renameSync11,
   statSync as statSync15,
   unlinkSync as unlinkSync19,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "fs";
 import { basename as basename7, dirname as dirname16, join as join36, relative as relative2, resolve as resolve17 } from "path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -25194,7 +25339,7 @@ function acquireRecoveryGuard(lockPath) {
     try {
       const fd = openSync4(guardPath, "wx");
       try {
-        writeFileSync17(fd, ownerToken, "utf-8");
+        writeFileSync18(fd, ownerToken, "utf-8");
       } catch (error2) {
         closeSync4(fd);
         try {
@@ -25227,7 +25372,7 @@ function acquireFileLock(path) {
     try {
       const fd = openSync4(lockPath, "wx");
       try {
-        writeFileSync17(fd, ownerToken, "utf-8");
+        writeFileSync18(fd, ownerToken, "utf-8");
       } catch (error2) {
         closeSync4(fd);
         try {
@@ -25271,7 +25416,7 @@ function acquireFileLock(path) {
 }
 function atomicWriteFile(path, content) {
   const temporaryPath = `${path}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync17(temporaryPath, content, "utf-8");
+  writeFileSync18(temporaryPath, content, "utf-8");
   try {
     renameSync11(temporaryPath, path);
   } catch (error2) {
@@ -26151,7 +26296,7 @@ ${fresh.join(`
     const existing = readFileSync23(skillPath, "utf-8");
     finalContent = mergeGotchas(content, extractGotchas(existing));
   } catch {}
-  writeFileSync17(skillPath, finalContent, "utf-8");
+  writeFileSync18(skillPath, finalContent, "utf-8");
   return {
     content: [
       {
@@ -26170,7 +26315,7 @@ function writeSummaryDocument(rawTopic, content, dateStr) {
   let counter = 1;
   while (true) {
     try {
-      writeFileSync17(resolve17(runtime().summariesDir, summaryName), content, {
+      writeFileSync18(resolve17(runtime().summariesDir, summaryName), content, {
         encoding: "utf-8",
         flag: "wx"
       });
@@ -26210,7 +26355,7 @@ function writeTopicDocument(rawTopic, content) {
   const briefPath = resolve17(runtime().topicsDir, `${fileSlug}.md`);
   ensureDir(dirname16(briefPath));
   const existed = existsSync27(briefPath);
-  writeFileSync17(briefPath, content, "utf-8");
+  writeFileSync18(briefPath, content, "utf-8");
   const setTopicBrief2 = runtime().host.setTopicBrief;
   let sqliteUpdated = false;
   if (topicId && setTopicBrief2) {
@@ -26877,7 +27022,7 @@ import {
   renameSync as renameSync12,
   statSync as statSync16,
   unlinkSync as unlinkSync20,
-  writeFileSync as writeFileSync18
+  writeFileSync as writeFileSync19
 } from "fs";
 import { basename as basename8, join as join37 } from "path";
 function startLogRotation() {
@@ -26977,7 +27122,7 @@ function removeSentFilesForTopic(userId, topicName) {
       }
     });
     if (remaining.length > 0) {
-      writeFileSync18(file, `${remaining.join(`
+      writeFileSync19(file, `${remaining.join(`
 `)}
 `);
     } else {
@@ -27499,6 +27644,7 @@ __export(exports_storage_public, {
   tasks: () => exports_tasks,
   taskScopeKey: () => taskScopeKey,
   taskFileMtimeNs: () => taskFileMtimeNs,
+  stampUnscopedOtiumTopics: () => stampUnscopedOtiumTopics,
   softDeleteApiMessagesByIdPrefix: () => softDeleteApiMessagesByIdPrefix,
   softDeleteApiMessage: () => softDeleteApiMessage,
   settleTopicArchiveJob: () => settleTopicArchiveJob,
@@ -27513,10 +27659,12 @@ __export(exports_storage_public, {
   setTopicAgentAndSession: () => setTopicAgentAndSession,
   setTopicAgentAndClearSession: () => setTopicAgentAndClearSession,
   setTopicAgent: () => setTopicAgent,
+  setSurfaceScopeRequired: () => setSurfaceScopeRequired,
   setSessionForTopic: () => setSessionForTopic,
   setLastShownConfig: () => setLastShownConfig,
   setGlobalAiName: () => setGlobalAiName,
   setDmSessionId: () => setDmSessionId,
+  setDefaultSurfaceScope: () => setDefaultSurfaceScope,
   setApiTopicConfig: () => setApiTopicConfig,
   setApiTopicAgent: () => setApiTopicAgent,
   setApiMessageReactions: () => setApiMessageReactions,
@@ -27549,6 +27697,7 @@ __export(exports_storage_public, {
   normalizeTopicSurface: () => normalizeTopicSurface,
   normalizeTopicState: () => normalizeTopicState,
   normalizeTopicKind: () => normalizeTopicKind,
+  normalizeSurfaceScope: () => normalizeSurfaceScope,
   normalizeAiMode: () => normalizeAiMode,
   markPendingAskState: () => markPendingAskState,
   markPendingAskSources: () => markPendingAskSources,
@@ -27564,6 +27713,7 @@ __export(exports_storage_public, {
   isTopicVisible: () => isTopicVisible,
   isTopicSummaryFile: () => isTopicSummaryFile,
   isTopicBriefFile: () => isTopicBriefFile,
+  isSurfaceScopeRequired: () => isSurfaceScopeRequired,
   isRuntimeProcessLeaseAlive: () => isRuntimeProcessLeaseAlive,
   inferTopicKind: () => inferTopicKind,
   inferAiMode: () => inferAiMode,
@@ -27616,6 +27766,7 @@ __export(exports_storage_public, {
   findRecentUserMessage: () => findRecentUserMessage,
   findLastSessionIdForAgent: () => findLastSessionIdForAgent,
   describePendingAskState: () => describePendingAskState,
+  deleteTopicStats: () => deleteTopicStats,
   deleteTopicBrief: () => deleteTopicBrief,
   deleteTopicArchiveState: () => deleteTopicArchiveState,
   deleteTopic: () => deleteTopic,
@@ -27624,6 +27775,7 @@ __export(exports_storage_public, {
   deleteMessagesForTopic: () => deleteMessagesForTopic,
   deleteApiTopicConfig: () => deleteApiTopicConfig,
   defaultTopicSurface: () => defaultTopicSurface,
+  defaultSurfaceScope: () => defaultSurfaceScope,
   db: () => db2,
   createTasks: () => createTasks,
   createPendingAsk: () => createPendingAsk,
@@ -28483,7 +28635,7 @@ var init_spec = __esm(() => {
 });
 
 // ../../packages/mcp-host/src/manifest.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync26, readFileSync as readFileSync24, renameSync as renameSync13, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync26, readFileSync as readFileSync24, renameSync as renameSync13, writeFileSync as writeFileSync20 } from "fs";
 import { dirname as dirname17 } from "path";
 import { z as z14 } from "zod";
 
@@ -28550,7 +28702,7 @@ class McpManifest {
       servers: [...this.entries.values()]
     };
     const tmp = `${this.file}.tmp-${process.pid}`;
-    writeFileSync19(tmp, `${JSON.stringify(payload, null, 2)}
+    writeFileSync20(tmp, `${JSON.stringify(payload, null, 2)}
 `);
     renameSync13(tmp, this.file);
   }
@@ -28585,7 +28737,7 @@ import {
   readFileSync as readFileSync25,
   renameSync as renameSync14,
   unlinkSync as unlinkSync21,
-  writeFileSync as writeFileSync20
+  writeFileSync as writeFileSync21
 } from "fs";
 import { connect, createServer as createServer3 } from "net";
 import { join as join38 } from "path";
@@ -28902,7 +29054,7 @@ class McpHost {
       mkdirSync27(this.portsDir, { recursive: true });
       const file = join38(this.portsDir, fileName);
       const tmp = `${file}.tmp-${process.pid}`;
-      writeFileSync20(tmp, String(port));
+      writeFileSync21(tmp, String(port));
       renameSync14(tmp, file);
     } catch (e) {
       this.log("warn", "Failed to write MCP port file", { fileName, port, err: String(e) });
@@ -29020,7 +29172,7 @@ import {
   readFileSync as readFileSync26,
   rmSync as rmSync9,
   statSync as statSync18,
-  writeFileSync as writeFileSync21
+  writeFileSync as writeFileSync22
 } from "fs";
 import { basename as basename10, extname as extname4, join as join39 } from "path";
 function safeExtension(filename) {
@@ -29110,7 +29262,7 @@ class NodeFileStore {
         ...access.visibility ? { visibility: access.visibility } : {}
       };
       copyFileSync4(absPath, savedPath);
-      writeFileSync21(this.#metadataPath(fileId), JSON.stringify(metadata), { mode: 384 });
+      writeFileSync22(this.#metadataPath(fileId), JSON.stringify(metadata), { mode: 384 });
       return this.#attachment(fileId, metadata);
     } catch (error2) {
       rmSync9(savedPath, { force: true });
@@ -29303,12 +29455,38 @@ import {
   readFileSync as readFileSync27,
   renameSync as renameSync15,
   unlinkSync as unlinkSync22,
-  writeFileSync as writeFileSync22
+  writeFileSync as writeFileSync23
 } from "fs";
 import { dirname as dirname18, resolve as resolve21 } from "path";
 function jsonError(status, error2) {
   return Response.json({ ok: false, error: error2 }, { status });
 }
+function requestSurfaceScope(req) {
+  const header = req.headers.get(NODE_RUNTIME_SURFACE_SCOPE_HEADER);
+  if (header === null)
+    return {};
+  const scope = header.trim();
+  return { surfaceScope: scope ? scope : null };
+}
+function topicInRequestScope(req, topic) {
+  const scope = requestSurfaceScope(req);
+  if (!("surfaceScope" in scope))
+    return true;
+  const roomScope = topic.surfaceScope ?? null;
+  if (roomScope === null)
+    return req.headers.get(NODE_RUNTIME_SURFACE_SCOPE_STRICT_HEADER) !== "1";
+  return roomScope === (scope.surfaceScope ?? null);
+}
+function gatewayVisibleTopics(req) {
+  const scope = requestSurfaceScope(req);
+  if (!("surfaceScope" in scope))
+    return getVisibleTopics({ surface: "otium" });
+  const own = getVisibleTopics({ surface: "otium", surfaceScope: scope.surfaceScope ?? null });
+  const strict = req.headers.get(NODE_RUNTIME_SURFACE_SCOPE_STRICT_HEADER) === "1";
+  if (strict || scope.surfaceScope === null)
+    return own;
+  return own.concat(getVisibleTopics({ surface: "otium", surfaceScope: null }));
+}
 function topicServiceError(error2) {
   const status = error2.code === "TOPIC_NOT_FOUND" ? 404 : error2.code === "TOPIC_FORBIDDEN" ? 403 : 400;
   return jsonError(status, error2.message);
@@ -29363,7 +29541,21 @@ function runtimeEvent(event) {
     createdAt: event.createdAt
   };
 }
-function createRuntimeContractEventStream(req, after, topicId) {
+function createRuntimeContractEventStream(req, after, topicId, scope = {}) {
+  const scoped = "surfaceScope" in scope;
+  const wanted = scope.surfaceScope ?? null;
+  const visible = new Map;
+  const eventInScope = (eventTopicId) => {
+    if (!scoped)
+      return true;
+    const cached = visible.get(eventTopicId);
+    if (cached !== undefined)
+      return cached;
+    const roomScope = getTopic(eventTopicId)?.surfaceScope ?? null;
+    const allowed = roomScope === null || roomScope === wanted;
+    visible.set(eventTopicId, allowed);
+    return allowed;
+  };
   let cursor = Math.max(0, after);
   return createPollingSseStream(req, {
     ready: { v: NODE_RUNTIME_CONTRACT_VERSION, cursor },
@@ -29374,7 +29566,7 @@ function createRuntimeContractEventStream(req, after, topicId) {
           break;
         for (const event of events) {
           cursor = event.seq;
-          if (!topicId || event.topicId === topicId) {
+          if ((!topicId || event.topicId === topicId) && eventInScope(event.topicId)) {
             send("runtime", runtimeEvent(event), event.seq);
           }
         }
@@ -29385,8 +29577,8 @@ function createRuntimeContractEventStream(req, after, topicId) {
     }
   });
 }
-function createEventStream(req, userId, after) {
-  const allowedTopics = new Set(topicsForUser(userId).map((topic) => topic.id));
+function createEventStream(req, userId, after, surface) {
+  const allowedTopics = new Set(topicsForUser(userId, surface).map((topic) => topic.id));
   let cursor = Math.max(0, after);
   return createPollingSseStream(req, {
     ready: { protocolVersion: NODE_CONTROL_PROTOCOL_VERSION, cursor },
@@ -29399,7 +29591,8 @@ function createEventStream(req, userId, after) {
           cursor = event.seq;
           if (event.type === "topic-created" || event.type === "topic-updated") {
             const topic = getTopic(event.topicId);
-            if (topic && isParticipant(topic, userId))
+            const admissible = topic && isParticipant(topic, userId) && (!surface || topic.surface === surface);
+            if (admissible)
               allowedTopics.add(event.topicId);
             else
               allowedTopics.delete(event.topicId);
@@ -29451,6 +29644,10 @@ function createNodeControlHandler(options) {
           if (body.v !== NODE_RUNTIME_CONTRACT_VERSION)
             return jsonError(400, "Unsupported v");
           const topicId = requiredText(body.topicId, "topicId");
+          const turnTopic = getTopic(topicId);
+          if (turnTopic && !topicInRequestScope(req, turnTopic)) {
+            return jsonError(404, "Topic not found");
+          }
           const userId = requiredText(body.userId, "userId");
           const actorUserId = body.actorUserId === undefined ? undefined : requiredText(body.actorUserId, "actorUserId");
           const actorLabel = body.actorLabel === undefined ? undefined : requiredText(body.actorLabel, "actorLabel");
@@ -29458,12 +29655,19 @@ function createNodeControlHandler(options) {
           const text2 = requiredText(body.text, "text");
           const clientMessageId = requiredText(body.clientMessageId, "clientMessageId");
           const requestId = body.requestId === undefined ? undefined : requiredText(body.requestId, "requestId");
+          const threadRootId = body.threadRootId === undefined ? undefined : requiredText(body.threadRootId, "threadRootId");
           const topic = getTopic(topicId);
           if (!topic)
             return jsonError(404, "Topic not found");
           if (!topic.participants.some((participant) => participant.userId === userId)) {
             return jsonError(404, "Topic not found");
           }
+          if (threadRootId) {
+            const root = getApiMessage(topicId, threadRootId);
+            if (!root || root.deleted || root.threadRootId) {
+              return jsonError(400, "threadRootId does not identify a thread root in this topic");
+            }
+          }
           const submission = submitRuntimeGatewayTurn({
             topic,
             userId,
@@ -29473,7 +29677,8 @@ function createNodeControlHandler(options) {
             text: text2,
             clientMessageId,
             requestId,
-            allowAutoContinue: body.allowAutoContinue !== false
+            allowAutoContinue: body.allowAutoContinue !== false,
+            ...threadRootId ? { threadRootId } : {}
           });
           return Response.json({
             ok: true,
@@ -29490,13 +29695,15 @@ function createNodeControlHandler(options) {
         if (req.method === "GET" && runtimePath === "/events") {
           const parsed = Number.parseInt(url.searchParams.get("after") ?? "0", 10);
           const topicId = url.searchParams.get("topicId")?.trim() || undefined;
-          return createRuntimeContractEventStream(req, Number.isFinite(parsed) ? parsed : 0, topicId);
+          return createRuntimeContractEventStream(req, Number.isFinite(parsed) ? parsed : 0, topicId, requestSurfaceScope(req));
         }
         const runtimeMessagesMatch = runtimePath.match(/^\/topics\/([^/]+)\/messages$/);
         if (runtimeMessagesMatch && req.method === "GET") {
           const topicId = decodeURIComponent(runtimeMessagesMatch[1]);
-          if (!getTopic(topicId))
+          const messagesTopic = getTopic(topicId);
+          if (!messagesTopic || !topicInRequestScope(req, messagesTopic)) {
             return jsonError(404, "Topic not found");
+          }
           const cursor = url.searchParams.get("cursor");
           const parsedLimit = Number.parseInt(url.searchParams.get("limit") ?? "50", 10);
           const result = listApiMessages(topicId, {
@@ -29506,7 +29713,7 @@ function createNodeControlHandler(options) {
           return Response.json({ ok: true, v: NODE_RUNTIME_CONTRACT_VERSION, ...result });
         }
         if (req.method === "GET" && runtimePath === "/topics") {
-          const topics = getVisibleTopics({ surface: "otium" });
+          const topics = gatewayVisibleTopics(req);
           return Response.json({
             ok: true,
             v: NODE_RUNTIME_CONTRACT_VERSION,
@@ -29529,6 +29736,7 @@ function createNodeControlHandler(options) {
             userId,
             kind: "agent",
             surface: "otium",
+            ...requestSurfaceScope(req),
             ...agent ? { agent } : {}
           });
           return Response.json({ ok: true, v: NODE_RUNTIME_CONTRACT_VERSION, topic }, { status: 201 });
@@ -29540,7 +29748,7 @@ function createNodeControlHandler(options) {
             return jsonError(400, "Unsupported v");
           const topicId = decodeURIComponent(importMatch[1]);
           const topic = getTopic(topicId);
-          if (!topic)
+          if (!topic || !topicInRequestScope(req, topic))
             return jsonError(404, "Topic not found");
           if (!Array.isArray(body.messages)) {
             return jsonError(400, "messages must be an array");
@@ -29585,6 +29793,8 @@ function createNodeControlHandler(options) {
         const runtimeTopicMatch = runtimePath.match(/^\/topics\/([^/]+)$/);
         if (runtimeTopicMatch && req.method === "GET") {
           const topic = getTopic(decodeURIComponent(runtimeTopicMatch[1]));
+          if (topic && !topicInRequestScope(req, topic))
+            return jsonError(404, "Topic not found");
           if (!topic)
             return jsonError(404, "Topic not found");
           return Response.json({ ok: true, v: NODE_RUNTIME_CONTRACT_VERSION, topic });
@@ -29608,7 +29818,7 @@ function createNodeControlHandler(options) {
       }
       if (req.method === "GET" && path === "/session") {
         const userId = requiredText(url.searchParams.get("user"), "user");
-        ensurePersonalGeneral(userId);
+        ensurePersonalGeneral(userId, requestedSurface(url));
         return Response.json({
           ok: true,
           protocolVersion: NODE_CONTROL_PROTOCOL_VERSION,
@@ -29679,7 +29889,7 @@ function createNodeControlHandler(options) {
       if (req.method === "GET" && path === "/events") {
         const userId = requiredText(url.searchParams.get("user"), "user");
         const parsed = Number.parseInt(url.searchParams.get("after") ?? "0", 10);
-        return createEventStream(req, userId, Number.isFinite(parsed) ? parsed : 0);
+        return createEventStream(req, userId, Number.isFinite(parsed) ? parsed : 0, requestedSurface(url));
       }
       const messagesMatch = path.match(/^\/topics\/([^/]+)\/messages$/);
       if (messagesMatch && req.method === "GET") {
@@ -29876,7 +30086,7 @@ function writeNodeDaemonInfo(port, startedAt) {
   };
   mkdirSync29(dirname18(NODE_DAEMON_INFO_PATH), { recursive: true });
   const temporary = `${NODE_DAEMON_INFO_PATH}.${process.pid}.${randomUUID25()}.tmp`;
-  writeFileSync22(temporary, `${JSON.stringify(info, null, 2)}
+  writeFileSync23(temporary, `${JSON.stringify(info, null, 2)}
 `, { mode: 384 });
   chmodSync6(temporary, 384);
   renameSync15(temporary, NODE_DAEMON_INFO_PATH);
@@ -29964,7 +30174,7 @@ async function stopNodeDaemon(timeoutMs = 3000) {
     throw new Error(`node shutdown returned HTTP ${response.status}`);
   return true;
 }
-var NODE_CONTROL_PROTOCOL_VERSION = 1, NODE_CONTROL_BASE_PATH = "/api/v1/control", NODE_RUNTIME_CONTRACT_VERSION = 1, NODE_RUNTIME_CONTRACT_BASE_PATH, NODE_DAEMON_ROLE = "node-daemon", NODE_DAEMON_INFO_PATH, NODE_VERSION, ControlRequestError;
+var NODE_CONTROL_PROTOCOL_VERSION = 1, NODE_CONTROL_BASE_PATH = "/api/v1/control", NODE_RUNTIME_CONTRACT_VERSION = 1, NODE_RUNTIME_SURFACE_SCOPE_HEADER = "x-negotium-surface-scope", NODE_RUNTIME_SURFACE_SCOPE_STRICT_HEADER = "x-negotium-surface-scope-strict", NODE_RUNTIME_CONTRACT_BASE_PATH, NODE_DAEMON_ROLE = "node-daemon", NODE_DAEMON_INFO_PATH, NODE_VERSION, ControlRequestError;
 var init_control = __esm(async () => {
   await init_node_host();
   await init_files();
@@ -32893,8 +33103,10 @@ function activeContextBreakdown(state) {
   if (!topic)
     return;
   const messages = activeMessages(state);
-  const latest = latestUsageMessage(messages);
-  const stored = state.topicUsage[topic.id]?.currentSession;
+  const topicUsage = state.topicUsage[topic.id];
+  const stored = topicUsage?.currentSession;
+  const contextWasReset = Boolean(topicUsage) && !stored;
+  const latest = contextWasReset ? undefined : latestUsageMessage(messages);
   const confirmed = latest?.usage.context ?? stored?.contextTokens;
   const contextWindow = latest?.usage.contextWindow ?? stored?.contextWindow;
   if (confirmed === undefined || !contextWindow)
@@ -34182,10 +34394,10 @@ function topicPickerHints(topicPickerRoot) {
     `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 ${exit}`,
     `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 ${shortExit}`,
     `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N new \xB7 Ctrl-D delete \xB7 ${exit}`,
-    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N/D/P \xB7 ${shortExit}`,
-    "\u2191\u2193 \xB7 Enter \xB7 type to filter \xB7 Ctrl-N/D/P",
-    "type to filter \xB7 Ctrl-N/D/P",
-    "Ctrl-N/D/P"
+    `\u2191\u2193 select \xB7 Enter open \xB7 type to filter \xB7 Ctrl-N/D \xB7 ${shortExit}`,
+    "\u2191\u2193 \xB7 Enter \xB7 type to filter \xB7 Ctrl-N/D",
+    "type to filter \xB7 Ctrl-N/D",
+    "Ctrl-N/D"
   ];
   return [...new Set(candidates)].sort((a, b) => displayWidth(b) - displayWidth(a));
 }
@@ -35392,7 +35604,7 @@ class EmbeddedNegotiumClient {
     try {
       if (this.#startNode)
         this.#node = await startDefaultNode({ port: this.#port });
-      ensurePersonalGeneral(this.#userId);
+      ensurePersonalGeneral(this.#userId, "terminal");
     } catch (error2) {
       this.#unsubscribe?.();
       this.#unsubscribe = null;
@@ -35776,7 +35988,7 @@ class RemoteNegotiumClient {
     }
   }
   async#openEventStream(after, signal) {
-    const response = await fetch(`${this.#baseUrl}${NODE_CONTROL_BASE_PATH}/events?user=${encodeURIComponent(this.#userId)}&after=${after}`, {
+    const response = await fetch(`${this.#baseUrl}${NODE_CONTROL_BASE_PATH}/events?user=${encodeURIComponent(this.#userId)}&after=${after}&surface=terminal`, {
       signal,
       headers: {
         accept: "text/event-stream",
@@ -39862,7 +40074,7 @@ function startTelegramAdapter(opts) {
   if (initialForumChatId !== undefined && !forumMode) {
     logger.warn({ forumChatId: initialForumChatId }, "telegram adapter: forumChatId set but client lacks createForumTopic \u2014 forum mode disabled");
   }
-  const personalGeneral = ensurePersonalGeneral(userId);
+  const personalGeneral = ensurePersonalGeneral(userId, "telegram");
   const byKey = new Map;
   const byTopic = new Map;
   const targetByQueryId = new Map;
@@ -40109,7 +40321,9 @@ function startTelegramAdapter(opts) {
     return true;
   }
   if (!store.isFlagSet(SURFACE_BACKFILL_FLAG)) {
-    const mappedIds = [...new Set(store.load().map((mapping) => mapping.topicId))];
+    const mappedIds = [
+      ...new Set(store.load().map((mapping) => mapping.topicId).filter((topicId) => getTopic(topicId)?.kind !== "manager"))
+    ];
     const moved = setTopicSurfaces(mappedIds, "telegram");
     store.setFlag(SURFACE_BACKFILL_FLAG);
     if (moved > 0) {
@@ -41358,45 +41572,101 @@ var init_join_status = __esm(() => {
 });
 
 // ../../adapters/otium/src/control-protocol.ts
-var OTIUM_ADAPTER_CONTROL_PREFIX = "/api/v1/adapter/otium", OTIUM_ADAPTER_CONTROL_HEADER = "x-negotium-adapter-token";
+var OTIUM_ADAPTER_CONTROL_PREFIX = "/api/v1/adapter/otium", OTIUM_ADAPTER_CONTROL_HEADER = "x-negotium-adapter-token", OTIUM_WORKSPACES_CONTROL_PATH = "/_workspaces", OTIUM_RELAYED_HEADER = "x-negotium-otium-relayed";
 
 // ../../adapters/otium/src/central.ts
+function cellState(cellId) {
+  return cells.get(cellId) ?? null;
+}
+function firstCell() {
+  for (const cell of cells.values())
+    return cell;
+  return null;
+}
+function attachOtiumCentralCell(join42) {
+  cells.set(join42.cellId, {
+    join: join42,
+    nodesCache: null,
+    verifyCache: new Map,
+    tokenCache: new Map
+  });
+}
+function detachOtiumCentralCell(cellId) {
+  return cells.delete(cellId);
+}
+function attachedOtiumCells() {
+  return [...cells.values()].map((cell) => cell.join);
+}
 function configureOtiumCentral(join42) {
-  joinConfig = join42;
-  resetPeerCentralCaches();
+  cells.clear();
+  if (join42)
+    attachOtiumCentralCell(join42);
 }
-function otiumCentralConfig() {
-  return joinConfig;
+function isOtiumCentralConfigured() {
+  return cells.size > 0;
 }
-function centralFetch(path, init) {
-  if (!joinConfig)
-    throw new Error("otium: join credentials missing");
-  return fetch(`${joinConfig.central}${path}`, {
+function centralFetch(cell, path, init) {
+  return fetch(`${cell.join.central}${path}`, {
     ...init,
     headers: {
-      authorization: `Bearer ${joinConfig.secret}`,
+      authorization: `Bearer ${cell.join.secret}`,
       "content-type": "application/json",
       ...init.headers ?? {}
     },
     signal: AbortSignal.timeout(5000)
   });
 }
-async function listPeerNodes(opts = {}) {
-  if (!opts.fresh && nodesCache && Date.now() - nodesCache.at < NODES_CACHE_MS) {
-    return nodesCache.nodes;
+async function discover(cell, fresh) {
+  if (!fresh && cell.nodesCache && Date.now() - cell.nodesCache.at < NODES_CACHE_MS) {
+    return cell.nodesCache.nodes;
   }
-  const response = await centralFetch("/peer/nodes", { method: "GET" });
+  const response = await centralFetch(cell, "/peer/nodes", { method: "GET" });
   const body = await response.json();
   if (!response.ok || !body.ok || !Array.isArray(body.nodes)) {
     throw new Error(`otium: node discovery failed: ${body.error ?? response.status}`);
   }
-  nodesCache = { nodes: body.nodes, workspaceId: body.workspaceId ?? "", at: Date.now() };
-  return body.nodes;
+  const nodes = body.nodes.map((node) => ({ ...node, viaCellId: cell.join.cellId }));
+  cell.nodesCache = { nodes, workspaceId: body.workspaceId ?? "", at: Date.now() };
+  return nodes;
 }
-async function selfPeerNode() {
-  const nodes = await listPeerNodes();
+async function listPeerNodesForCell(cellId, opts = {}) {
+  const cell = cellState(cellId);
+  if (!cell)
+    throw new Error(`otium: not attached to cell ${cellId}`);
+  return discover(cell, opts.fresh === true);
+}
+async function listPeerNodes(opts = {}) {
+  if (cells.size === 0)
+    throw new Error("otium: join credentials missing");
+  const results = await Promise.allSettled([...cells.values()].map((cell) => discover(cell, opts.fresh === true)));
+  const nodes = results.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+  const failures = results.filter((result) => result.status === "rejected");
+  if (failures.length === results.length) {
+    throw failures[0].reason;
+  }
+  for (const failure of failures) {
+    logger.warn({ err: failure.reason }, "otium: discovery failed");
+  }
+  return nodes;
+}
+async function selfPeerNodeForCell(cellId) {
+  const nodes = await listPeerNodesForCell(cellId);
   return nodes.find((node) => node.self) ?? null;
 }
+async function selfPeerNode() {
+  const cell = firstCell();
+  if (!cell)
+    throw new Error("otium: join credentials missing");
+  return selfPeerNodeForCell(cell.join.cellId);
+}
+async function peerWorkspaceIdForCell(cellId) {
+  const cell = cellState(cellId);
+  if (!cell)
+    return null;
+  if (!cell.nodesCache?.workspaceId)
+    await discover(cell, true);
+  return cell.nodesCache?.workspaceId || null;
+}
 async function resolvePeerNodeByCellId(cellId) {
   const find = (nodes) => nodes.find((node) => node.cellId === cellId) ?? null;
   const cached = find(await listPeerNodes());
@@ -41404,36 +41674,39 @@ async function resolvePeerNodeByCellId(cellId) {
     return cached;
   return find(await listPeerNodes({ fresh: true }));
 }
-async function mintPeerToken(toCellId) {
-  const cached = tokenCache.get(toCellId);
+async function mintPeerToken(target) {
+  const cell = cellState(target.viaCellId);
+  if (!cell)
+    throw new Error("otium: join credentials missing");
+  const cached = cell.tokenCache.get(target.cellId);
   if (cached && cached.expiresAtMs - Date.now() > 30000)
     return cached.token;
-  const response = await centralFetch("/peer/token", {
+  const response = await centralFetch(cell, "/peer/token", {
     method: "POST",
-    body: JSON.stringify({ toCellId })
+    body: JSON.stringify({ toCellId: target.cellId })
   });
   const body = await response.json();
   if (!response.ok || !body.ok || !body.token) {
     throw new Error(`otium: peer token mint failed: ${body.error ?? response.status}`);
   }
-  tokenCache.set(toCellId, {
+  cell.tokenCache.set(target.cellId, {
     token: body.token,
     expiresAtMs: Date.parse(body.expiresAt ?? "") || Date.now() + 60000
   });
   return body.token;
 }
-async function verifyPeerToken(token) {
-  const cached = verifyCache.get(token);
+async function verifyAgainstCell(cell, token) {
+  const cached = cell.verifyCache.get(token);
   if (cached && Date.now() - cached.at < VERIFY_CACHE_MS)
     return cached.verified;
   let response;
   try {
-    response = await centralFetch("/peer/verify", {
+    response = await centralFetch(cell, "/peer/verify", {
       method: "POST",
       body: JSON.stringify({ token })
     });
   } catch (err2) {
-    logger.warn({ err: err2 }, "otium: central verify unreachable");
+    logger.warn({ err: err2, cellId: cell.join.cellId }, "otium: central verify unreachable");
     return null;
   }
   const body = await response.json().catch(() => null);
@@ -41444,25 +41717,39 @@ async function verifyPeerToken(token) {
     fromCellId: body.fromCellId,
     fromNodeName: body.fromNodeName,
     fromIsPrimary: body.fromIsPrimary,
-    expiresAt: body.expiresAt
+    expiresAt: body.expiresAt,
+    viaCellId: cell.join.cellId
   };
-  verifyCache.set(token, { verified, at: Date.now() });
-  for (const [key, entry] of verifyCache) {
+  cell.verifyCache.set(token, { verified, at: Date.now() });
+  for (const [key, entry] of cell.verifyCache) {
     if (Date.now() - entry.at > VERIFY_CACHE_MS)
-      verifyCache.delete(key);
+      cell.verifyCache.delete(key);
   }
   return verified;
 }
-function resetPeerCentralCaches() {
-  nodesCache = null;
-  verifyCache.clear();
-  tokenCache.clear();
+async function verifyPeerToken(token) {
+  const rejectedAt = rejectCache.get(token);
+  if (rejectedAt !== undefined && Date.now() - rejectedAt < REJECT_CACHE_MS)
+    return null;
+  for (const cell of cells.values()) {
+    const verified = await verifyAgainstCell(cell, token);
+    if (verified) {
+      rejectCache.delete(token);
+      return verified;
+    }
+  }
+  rejectCache.set(token, Date.now());
+  for (const [key, at] of rejectCache) {
+    if (Date.now() - at > REJECT_CACHE_MS)
+      rejectCache.delete(key);
+  }
+  return null;
 }
-var NODES_CACHE_MS = 30000, VERIFY_CACHE_MS = 30000, joinConfig = null, nodesCache = null, verifyCache, tokenCache;
+var NODES_CACHE_MS = 30000, VERIFY_CACHE_MS = 30000, cells, REJECT_CACHE_MS = 2000, rejectCache;
 var init_central = __esm(async () => {
   await init_src();
-  verifyCache = new Map;
-  tokenCache = new Map;
+  cells = new Map;
+  rejectCache = new Map;
 });
 
 // ../../adapters/otium/src/protocol.ts
@@ -41537,7 +41824,7 @@ async function forwardCanonicalTool(capability, request) {
   if (!hub?.isPrimary || hub.self)
     return { error: "canonical hub is unavailable", status: 503 };
   try {
-    const peerToken = await mintPeerToken(hub.cellId);
+    const peerToken = await mintPeerToken(hub);
     const response = await fetch(`${hub.baseUrl.replace(/\/+$/, "")}/api/v1/peer/bridge/canonical-mcp`, {
       method: "POST",
       headers: { authorization: `Bearer ${peerToken}`, "content-type": "application/json" },
@@ -41710,6 +41997,7 @@ __export(exports_join, {
   saveJoin: () => saveJoin,
   removeJoin: () => removeJoin,
   parseInviteCode: () => parseInviteCode,
+  loadJoins: () => loadJoins,
   loadJoin: () => loadJoin,
   joinFilePath: () => joinFilePath,
   joinCredentialDigest: () => joinCredentialDigest,
@@ -41730,7 +42018,7 @@ import {
   rmSync as rmSync10,
   statSync as statSync20,
   unlinkSync as unlinkSync23,
-  writeFileSync as writeFileSync23
+  writeFileSync as writeFileSync24
 } from "fs";
 import { dirname as dirname21, resolve as resolve24 } from "path";
 function joinFilePath() {
@@ -41811,7 +42099,7 @@ function withJoinCredentialLock(operation) {
     try {
       mkdirSync32(lockPath, { mode: 448 });
       created = true;
-      writeFileSync23(ownerPath, `${JSON.stringify(owner)}
+      writeFileSync24(ownerPath, `${JSON.stringify(owner)}
 `, { mode: 384 });
       const ownerFd = openSync5(ownerPath, "r");
       try {
@@ -41881,82 +42169,60 @@ function normalizedJoin(join42) {
 function joinCredentialDigest(join42) {
   return createHash11("sha256").update(JSON.stringify(normalizedJoin(join42))).digest("base64url");
 }
-function readPersistedJoin(path = joinFilePath()) {
+function readPersistedJoins(path = joinFilePath()) {
   if (!existsSync37(path))
-    return null;
+    return [];
   const parsed = JSON.parse(readFileSync28(path, "utf-8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("persisted join credentials are not a JSON object");
   }
-  return normalizeJoin(parsed);
+  const record = parsed;
+  if (!Array.isArray(record.joins))
+    return [normalizeJoin(record)];
+  return record.joins.map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error("persisted join credentials contain a non-object entry");
+    }
+    return normalizeJoin(entry);
+  });
 }
 function isJoinPersisted(join42) {
   try {
-    const persisted = readPersistedJoin();
-    return persisted !== null && joinsEqual(persisted, normalizedJoin(join42));
+    const normalized = normalizedJoin(join42);
+    return readPersistedJoins().some((persisted) => joinsEqual(persisted, normalized));
   } catch {
     return false;
   }
 }
-function saveJoinWhileLocked(join42, options = {}) {
+function fsyncPath(target) {
+  const fd = openSync5(target, "r");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync5(fd);
+  }
+}
+function writeJoins(joins, allowOverwrite) {
   const path = joinFilePath();
   const directory = dirname21(path);
-  const normalized = normalizedJoin(join42);
-  mkdirSync32(directory, { recursive: true });
-  if (existsSync37(path)) {
-    if (lstatSync(path).isSymbolicLink()) {
-      throw new Error(`refusing to replace symlinked Otium join file at ${path}`);
-    }
-    let existing = null;
-    try {
-      existing = readPersistedJoin(path);
-    } catch (error2) {
-      if (!options.replaceExisting) {
-        throw new Error(`existing Otium join file at ${path} is invalid; pass --replace to replace it`, { cause: error2 });
-      }
-    }
-    if (existing && joinsEqual(existing, normalized)) {
-      chmodSync7(path, 384);
-      const fileFd = openSync5(path, "r");
-      try {
-        fsyncSync2(fileFd);
-      } finally {
-        closeSync5(fileFd);
-      }
-      const directoryFd = openSync5(directory, "r");
-      try {
-        fsyncSync2(directoryFd);
-      } finally {
-        closeSync5(directoryFd);
-      }
-      return path;
-    }
-    if (!options.replaceExisting) {
-      throw new Error(`this node is already joined${existing ? ` as ${existing.cellId}` : " with an invalid join file"}; pass --replace to replace its credentials`);
-    }
-  }
   const temporaryPath = resolve24(directory, `.otium-join.json.${process.pid}.${randomUUID28()}.tmp`);
+  const payload = { v: JOIN_FILE_VERSION, joins };
   let fd;
   try {
     fd = openSync5(temporaryPath, "wx", 384);
-    writeFileSync23(fd, `${JSON.stringify(normalized, null, 2)}
+    writeFileSync24(fd, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
     fsyncSync2(fd);
     closeSync5(fd);
     fd = undefined;
-    if (options.replaceExisting) {
+    if (allowOverwrite) {
       renameSync16(temporaryPath, path);
     } else {
       linkSync(temporaryPath, path);
       unlinkSync23(temporaryPath);
     }
     chmodSync7(path, 384);
-    const directoryFd = openSync5(directory, "r");
-    try {
-      fsyncSync2(directoryFd);
-    } finally {
-      closeSync5(directoryFd);
-    }
+    fsyncPath(directory);
   } catch (error2) {
     if (fd !== undefined)
       closeSync5(fd);
@@ -41966,10 +42232,43 @@ function saveJoinWhileLocked(join42, options = {}) {
   }
   return path;
 }
+function saveJoinWhileLocked(join42, options = {}) {
+  const path = joinFilePath();
+  const directory = dirname21(path);
+  const normalized = normalizedJoin(join42);
+  mkdirSync32(directory, { recursive: true });
+  if (!existsSync37(path))
+    return writeJoins([normalized], false);
+  if (lstatSync(path).isSymbolicLink()) {
+    throw new Error(`refusing to replace symlinked Otium join file at ${path}`);
+  }
+  let existing = null;
+  try {
+    existing = readPersistedJoins(path);
+  } catch (error2) {
+    if (!options.replaceExisting) {
+      throw new Error(`existing Otium join file at ${path} is invalid; pass --replace to replace it`, { cause: error2 });
+    }
+  }
+  if (existing?.some((persisted) => joinsEqual(persisted, normalized))) {
+    chmodSync7(path, 384);
+    fsyncPath(path);
+    fsyncPath(directory);
+    return path;
+  }
+  if (!existing)
+    return writeJoins([normalized], true);
+  const conflict = existing.find((persisted) => persisted.cellId === normalized.cellId);
+  if (conflict && !options.replaceExisting) {
+    throw new Error(`this node is already joined as ${conflict.cellId}; pass --replace to replace its credentials`);
+  }
+  const next = conflict ? existing.map((persisted) => persisted.cellId === normalized.cellId ? normalized : persisted) : [...existing, normalized];
+  return writeJoins(next, true);
+}
 function saveJoin(join42, options = {}) {
   return withJoinCredentialLock(() => saveJoinWhileLocked(join42, options));
 }
-function removeJoin() {
+function removeJoin(cellId) {
   return withJoinCredentialLock(() => {
     const path = joinFilePath();
     if (!existsSync37(path))
@@ -41977,27 +42276,36 @@ function removeJoin() {
     if (lstatSync(path).isSymbolicLink()) {
       throw new Error(`refusing to remove symlinked Otium join file at ${path}`);
     }
-    unlinkSync23(path);
-    const directoryFd = openSync5(dirname21(path), "r");
-    try {
-      fsyncSync2(directoryFd);
-    } finally {
-      closeSync5(directoryFd);
+    if (cellId) {
+      let remaining;
+      try {
+        remaining = readPersistedJoins(path).filter((join42) => join42.cellId !== cellId);
+      } catch {
+        return false;
+      }
+      if (remaining.length === readPersistedJoins(path).length)
+        return false;
+      if (remaining.length > 0) {
+        writeJoins(remaining, true);
+        return true;
+      }
     }
+    unlinkSync23(path);
+    fsyncPath(dirname21(path));
     return true;
   });
 }
-function loadJoin() {
+function loadJoins() {
   const central = process.env.OTIUM_CENTRAL_URL?.trim();
   const cellId = process.env.OTIUM_CELL_ID?.trim();
   const secret = process.env.OTIUM_CELL_SECRET?.trim();
   const relay = process.env.OTIUM_RELAY_URL?.trim();
   if (central && cellId && secret) {
     try {
-      return normalizeJoin({ central, relay, cellId, secret });
+      return [normalizeJoin({ central, relay, cellId, secret })];
     } catch (err2) {
       logger.warn({ err: err2 }, "otium: invalid OTIUM_CENTRAL_URL/OTIUM_CELL_ID/OTIUM_CELL_SECRET env");
-      return null;
+      return [];
     }
   }
   if (central || cellId || secret) {
@@ -42005,18 +42313,18 @@ function loadJoin() {
   }
   const path = joinFilePath();
   if (!existsSync37(path))
-    return null;
+    return [];
   try {
-    const parsed = JSON.parse(readFileSync28(path, "utf-8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return null;
-    return normalizeJoin(parsed);
+    return readPersistedJoins(path);
   } catch (err2) {
     logger.warn({ err: err2, path }, "otium: failed to read join file");
-    return null;
+    return [];
   }
 }
-var JOIN_LOCK_STALE_MS = 30000;
+function loadJoin() {
+  return loadJoins()[0] ?? null;
+}
+var JOIN_LOCK_STALE_MS = 30000, JOIN_FILE_VERSION = 2;
 var init_join = __esm(async () => {
   await init_src();
 });
@@ -42170,7 +42478,7 @@ var init_runtime_bridge = __esm(async () => {
         return errorResult("Error: Hub node is no longer attached.");
       let token;
       try {
-        token = await mintPeerToken(hubNode.cellId);
+        token = await mintPeerToken(hubNode);
       } catch (err2) {
         return errorResult(`Error: Failed to spawn on hub: ${err2.message}`);
       }
@@ -42210,7 +42518,7 @@ var init_runtime_bridge = __esm(async () => {
         return errorResult("Error: Hub node is no longer attached.");
       let token;
       try {
-        token = await mintPeerToken(hubNode.cellId);
+        token = await mintPeerToken(hubNode);
       } catch (error2) {
         return errorResult(`Error: Failed to open hub question: ${error2.message}`);
       }
@@ -42266,7 +42574,7 @@ var init_runtime_bridge = __esm(async () => {
       if (!hubNode)
         return errorResult("Error: Hub node is no longer attached.");
       try {
-        const token = await mintPeerToken(hubNode.cellId);
+        const token = await mintPeerToken(hubNode);
         const response = await fetch(`${hubNode.baseUrl.replace(/\/+$/, "")}/api/v1/peer/bridge/self-config`, {
           method: "POST",
           headers: {
@@ -42297,7 +42605,7 @@ var init_runtime_bridge = __esm(async () => {
         return { ok: false, error: "hub node is no longer attached" };
       let token;
       try {
-        token = await mintPeerToken(hubNode.cellId);
+        token = await mintPeerToken(hubNode);
       } catch (error2) {
         return { ok: false, error: `peer token mint failed: ${error2.message}` };
       }
@@ -42359,7 +42667,7 @@ var init_runtime_bridge = __esm(async () => {
       if (!hubNode)
         return { ok: false, error: "hub node is no longer attached" };
       try {
-        const token = await mintPeerToken(hubNode.cellId);
+        const token = await mintPeerToken(hubNode);
         const form = new FormData;
         form.set("hostQueryId", request.bridge.hostQueryId);
         form.set("userId", request.userId);
@@ -42526,13 +42834,81 @@ var init_store2 = __esm(async () => {
 `);
 });
 
+// ../../adapters/otium/src/workspace-scope.ts
+import { createHash as createHash13 } from "crypto";
+import { mkdirSync as mkdirSync34, readFileSync as readFileSync29, writeFileSync as writeFileSync25 } from "fs";
+import { dirname as dirname22, resolve as resolve25 } from "path";
+function surfaceScopeFor(central, workspaceId) {
+  const digest = createHash13("sha256").update(`${central.trim().replace(/\/+$/, "")}
+${workspaceId.trim()}`).digest("hex");
+  return `ws_${digest.slice(0, 24)}`;
+}
+function scopeCachePath() {
+  return resolve25(DATA_DIR, "otium-workspace.json");
+}
+function readCache() {
+  try {
+    const parsed = JSON.parse(readFileSync29(scopeCachePath(), "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function cachedSurfaceScope(join43) {
+  const record = readCache()[join43.cellId];
+  if (!record || record.central !== join43.central || !record.workspaceId)
+    return null;
+  return surfaceScopeFor(record.central, record.workspaceId);
+}
+function cacheSurfaceScope(join43, workspaceId) {
+  const scope = surfaceScopeFor(join43.central, workspaceId);
+  const path = scopeCachePath();
+  try {
+    mkdirSync34(dirname22(path), { recursive: true });
+    const cache = readCache();
+    cache[join43.cellId] = { central: join43.central, workspaceId, scope };
+    writeFileSync25(path, `${JSON.stringify(cache, null, 2)}
+`, { mode: 384 });
+  } catch (err2) {
+    logger.warn({ err: err2, path }, "otium: could not cache the workspace scope");
+  }
+  return scope;
+}
+async function resolveSurfaceScope(join43) {
+  const cached = cachedSurfaceScope(join43);
+  if (cached)
+    return cached;
+  try {
+    const workspaceId = await peerWorkspaceIdForCell(join43.cellId);
+    if (!workspaceId)
+      return null;
+    return cacheSurfaceScope(join43, workspaceId);
+  } catch (err2) {
+    logger.warn({ err: err2 }, "otium: workspace scope unresolved (will retry on the next contact)");
+    return null;
+  }
+}
+function surfaceScopeForCell(cellId) {
+  const join43 = attachedOtiumCells().find((candidate) => candidate.cellId === cellId);
+  return join43 ? cachedSurfaceScope(join43) : null;
+}
+function unscopedRoomsAddressable() {
+  return attachedOtiumCells().length < 2;
+}
+var init_workspace_scope = __esm(async () => {
+  await init_src();
+  await init_central();
+});
+
 // ../../adapters/otium/src/session-bridge.ts
 function prunePendingRemoteAsks(now = Date.now()) {
   pruneRemoteAsks(now - PENDING_ASK_TTL_MS2);
 }
 async function postPeer(node, path, body) {
   try {
-    const token = await mintPeerToken(node.cellId);
+    const token = await mintPeerToken(node);
     const response = await fetch(`${node.baseUrl.replace(/\/+$/, "")}${path}`, {
       method: "POST",
       headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -42569,7 +42945,7 @@ async function postPeerIdempotent(node, path, body) {
 }
 async function peerSupportsRemoteAsk(node) {
   try {
-    const token = await mintPeerToken(node.cellId);
+    const token = await mintPeerToken(node);
     const response = await fetch(`${node.baseUrl.replace(/\/+$/, "")}/api/v1/peer/capabilities`, {
       headers: { authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(PEER_TIMEOUT_MS)
@@ -42580,26 +42956,50 @@ async function peerSupportsRemoteAsk(node) {
     return false;
   }
 }
-async function findNode(nodeName) {
-  const find = (nodes) => nodes.find((node) => node.nodeName === nodeName) ?? null;
-  return find(await listPeerNodes()) ?? find(await listPeerNodes({ fresh: true }));
+async function findNode(nodeName, fromTopicId) {
+  const callerScope = fromTopicId ? getTopic(fromTopicId)?.surfaceScope ?? null : null;
+  const select = (nodes) => {
+    let candidates = nodes.filter((node) => node.nodeName === nodeName);
+    if (callerScope) {
+      candidates = candidates.filter((node) => surfaceScopeForCell(node.viaCellId) === callerScope);
+    }
+    if (candidates.length === 0)
+      return null;
+    if (candidates.length > 1) {
+      return {
+        ok: false,
+        error: `node "${nodeName}" is ambiguous across attached workspaces`
+      };
+    }
+    return { ok: true, node: candidates[0] };
+  };
+  const cached = select(await listPeerNodes());
+  if (cached)
+    return cached;
+  return select(await listPeerNodes({ fresh: true })) ?? {
+    ok: false,
+    error: `unknown remote node "${nodeName}"`
+  };
 }
-async function originLabel(args) {
-  const self = await selfPeerNode();
+async function originLabel(args, peer) {
+  const self = await selfPeerNodeForCell(peer.viaCellId).catch(() => null);
   const local = args.fromTitle?.trim() || args.fromKey?.trim() || "peer";
   return self?.nodeName ? `${self.nodeName}/${local}` : local;
 }
 async function forward(args) {
-  const node = await findNode(args.toNode).catch(() => null);
-  if (!node || node.self)
+  const lookup = await findNode(args.toNode, args.fromTopicId).catch(() => ({ ok: false, error: `unknown remote node "${args.toNode}"` }));
+  if (!lookup.ok)
+    return lookup;
+  const node = lookup.node;
+  if (node.self)
     return { ok: false, error: `unknown remote node "${args.toNode}"` };
-  const self = await selfPeerNode().catch(() => null);
+  const self = await selfPeerNodeForCell(node.viaCellId).catch(() => null);
   if (!self)
     return { ok: false, error: "local peer node is not attached" };
   if (!self.isPrimary && !node.isPrimary) {
     return { ok: false, error: "worker peer calls must target the primary hub" };
   }
-  const fromLabel = await originLabel(args);
+  const fromLabel = await originLabel(args, node);
   const requestId = args.requestId;
   if (args.action === "ask") {
     if (!requestId || !args.fromTopicId || !args.fromKey || !args.message) {
@@ -42669,14 +43069,20 @@ async function forward(args) {
     ...args.sourceQueryId ? { sourceQueryId: args.sourceQueryId } : {}
   });
 }
-async function sessions(userId, sourceQueryId) {
+async function sessions(userId, sourceQueryId, fromTopicId) {
   const nodes = await listPeerNodes().catch(() => []);
-  const self = nodes.find((node) => node.self);
-  if (!self)
+  const selves = new Map(nodes.filter((node) => node.self).map((node) => [node.viaCellId, node]));
+  if (selves.size === 0)
     return { ok: false, nodes: [] };
+  const callerScope = fromTopicId ? getTopic(fromTopicId)?.surfaceScope ?? null : null;
   return {
     ok: true,
-    nodes: await Promise.all(nodes.filter((node) => !node.self && node.nodeName && (self.isPrimary || node.isPrimary)).map(async (node) => {
+    nodes: await Promise.all(nodes.filter((node) => {
+      const self = selves.get(node.viaCellId);
+      if (callerScope && surfaceScopeForCell(node.viaCellId) !== callerScope)
+        return false;
+      return !node.self && node.nodeName && self && (self.isPrimary || node.isPrimary);
+    }).map(async (node) => {
       const result = await postPeer(node, "/api/v1/peer/sessions", {
         v: PEER_PROTOCOL_VERSION,
         userId,
@@ -42714,7 +43120,7 @@ function flushPeerReplyOutbox() {
         toTopic: "",
         userId: pending2.user_id,
         fromTitle: pending2.source_title
-      });
+      }, node);
       const result = await postPeer(node, "/api/v1/peer/reply", {
         v: PEER_PROTOCOL_VERSION,
         requestId: pending2.request_id,
@@ -42797,6 +43203,7 @@ var init_session_bridge = __esm(async () => {
   await init_central();
   init_protocol();
   await init_store2();
+  await init_workspace_scope();
   PENDING_ASK_TTL_MS2 = 15 * 60 * 1000;
   otiumPeerSessionBridge = { forward, sessions, reply };
 });
@@ -42884,7 +43291,7 @@ function startPeerSessionBridgeIpc(bridge) {
           return Response.json(await bridge.forward(payload.args));
         }
         if (payload.action === "sessions") {
-          return Response.json(await bridge.sessions(payload.userId, payload.sourceQueryId));
+          return Response.json(await bridge.sessions(payload.userId, payload.sourceQueryId, payload.fromTopicId));
         }
         if (payload.action === "reply") {
           return Response.json(await bridge.reply(payload.route, payload.sourceTitle, payload.replyText, payload.kind));
@@ -43501,14 +43908,14 @@ import {
   existsSync as existsSync38,
   fsyncSync as fsyncSync3,
   linkSync as linkSync2,
-  mkdirSync as mkdirSync34,
+  mkdirSync as mkdirSync35,
   openSync as openSync6,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   renameSync as renameSync17,
   unlinkSync as unlinkSync24,
-  writeFileSync as writeFileSync24
+  writeFileSync as writeFileSync26
 } from "fs";
-import { dirname as dirname22, resolve as resolve25 } from "path";
+import { dirname as dirname23, resolve as resolve26 } from "path";
 function parseEnrollmentInvite(code) {
   let parsed;
   try {
@@ -43529,14 +43936,14 @@ function parseEnrollmentInvite(code) {
   return { v: 2, central, token };
 }
 function pendingEnrollmentPath() {
-  return resolve25(DATA_DIR, "otium-enrollment-pending.json");
+  return resolve26(DATA_DIR, "otium-enrollment-pending.json");
 }
 function isEnrollmentPending(invite) {
   const path = pendingEnrollmentPath();
   if (!existsSync38(path))
     return false;
   try {
-    const saved = JSON.parse(readFileSync29(path, "utf8"));
+    const saved = JSON.parse(readFileSync30(path, "utf8"));
     return saved.central === invite.central && saved.token === invite.token;
   } catch {
     return false;
@@ -43545,7 +43952,7 @@ function isEnrollmentPending(invite) {
 function loadOrCreatePending(invite, nodeName) {
   const path = pendingEnrollmentPath();
   if (existsSync38(path)) {
-    const saved = JSON.parse(readFileSync29(path, "utf8"));
+    const saved = JSON.parse(readFileSync30(path, "utf8"));
     if (saved.central === invite.central && saved.token === invite.token)
       return saved;
     throw new Error(`another Otium enrollment is pending at ${path}`);
@@ -43558,12 +43965,12 @@ function loadOrCreatePending(invite, nodeName) {
     publicKey: pair.publicKey.export({ format: "der", type: "spki" }).toString("base64url"),
     ...nodeName ? { nodeName } : {}
   };
-  mkdirSync34(dirname22(path), { recursive: true });
-  const temporaryPath = resolve25(dirname22(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
+  mkdirSync35(dirname23(path), { recursive: true });
+  const temporaryPath = resolve26(dirname23(path), `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync24(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync26(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -43571,7 +43978,7 @@ function loadOrCreatePending(invite, nodeName) {
     linkSync2(temporaryPath, path);
     unlinkSync24(temporaryPath);
     chmodSync8(path, 384);
-    const directoryFd = openSync6(dirname22(path), "r");
+    const directoryFd = openSync6(dirname23(path), "r");
     try {
       fsyncSync3(directoryFd);
     } finally {
@@ -43583,7 +43990,7 @@ function loadOrCreatePending(invite, nodeName) {
     if (existsSync38(temporaryPath))
       unlinkSync24(temporaryPath);
     if (error2.code === "EEXIST" && existsSync38(path)) {
-      const saved = JSON.parse(readFileSync29(path, "utf8"));
+      const saved = JSON.parse(readFileSync30(path, "utf8"));
       if (saved.central === invite.central && saved.token === invite.token)
         return saved;
     }
@@ -43593,12 +44000,12 @@ function loadOrCreatePending(invite, nodeName) {
 }
 function replacePendingEnrollment(pending2) {
   const path = pendingEnrollmentPath();
-  const directory = dirname22(path);
-  const temporaryPath = resolve25(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
+  const directory = dirname23(path);
+  const temporaryPath = resolve26(directory, `.otium-enrollment-pending.json.${process.pid}.${randomUUID31()}.tmp`);
   let fd;
   try {
     fd = openSync6(temporaryPath, "wx", 384);
-    writeFileSync24(fd, `${JSON.stringify(pending2, null, 2)}
+    writeFileSync26(fd, `${JSON.stringify(pending2, null, 2)}
 `, "utf8");
     fsyncSync3(fd);
     closeSync6(fd);
@@ -43620,7 +44027,7 @@ function replacePendingEnrollment(pending2) {
 }
 function recordClaimedCredential(pending2, join43) {
   withJoinCredentialLock(() => {
-    const current3 = JSON.parse(readFileSync29(pendingEnrollmentPath(), "utf8"));
+    const current3 = JSON.parse(readFileSync30(pendingEnrollmentPath(), "utf8"));
     if (current3.central !== pending2.central || current3.token !== pending2.token || current3.idempotencyKey !== pending2.idempotencyKey || current3.publicKey !== pending2.publicKey) {
       throw new Error("pending Otium enrollment changed while its claim was in flight");
     }
@@ -43699,7 +44106,7 @@ async function claimEnrollment(invite, nodeName) {
 function commitEnrollment(join43, options = {}) {
   return withJoinCredentialLock(() => {
     const pendingPath = pendingEnrollmentPath();
-    const pending2 = existsSync38(pendingPath) ? JSON.parse(readFileSync29(pendingPath, "utf8")) : null;
+    const pending2 = existsSync38(pendingPath) ? JSON.parse(readFileSync30(pendingPath, "utf8")) : null;
     const digest = joinCredentialDigest(join43);
     if (pending2 && (!pending2.claimed || pending2.claimed.digest !== digest || pending2.claimed.cellId !== join43.cellId)) {
       throw new Error(`pending Otium enrollment at ${pendingPath} does not match these credentials`);
@@ -43711,7 +44118,7 @@ function commitEnrollment(join43, options = {}) {
     if (!pending2)
       return path;
     unlinkSync24(pendingPath);
-    const directoryFd = openSync6(dirname22(pendingPath), "r");
+    const directoryFd = openSync6(dirname23(pendingPath), "r");
     try {
       fsyncSync3(directoryFd);
     } finally {
@@ -43750,6 +44157,8 @@ async function forwardGatewayRequest(req, options) {
   target.search = url.search;
   const headers = new Headers(req.headers);
   headers.set("authorization", `Bearer ${NODE_CONTROL_TOKEN}`);
+  headers.set(SURFACE_SCOPE_HEADER, options.surfaceScope ?? "");
+  headers.set(SURFACE_SCOPE_STRICT_HEADER, options.strictScope ? "1" : "0");
   headers.delete("transfer-encoding");
   headers.delete("content-length");
   headers.delete("host");
@@ -43764,7 +44173,7 @@ async function forwardGatewayRequest(req, options) {
     signal: req.signal
   }));
 }
-var RUNTIME_CONTRACT_PATH = "/api/v1/control/runtime/v1", OTIUM_GATEWAY_FORWARD_PREFIX = "/api/v1/peer/runtime";
+var RUNTIME_CONTRACT_PATH = "/api/v1/control/runtime/v1", SURFACE_SCOPE_HEADER = "x-negotium-surface-scope", SURFACE_SCOPE_STRICT_HEADER = "x-negotium-surface-scope-strict", OTIUM_GATEWAY_FORWARD_PREFIX = "/api/v1/peer/runtime";
 var init_gateway_forward = __esm(async () => {
   await init_src();
 });
@@ -43797,7 +44206,7 @@ function checkProtocol(body) {
   return null;
 }
 async function requirePeer(req) {
-  if (!otiumCentralConfig()) {
+  if (!isOtiumCentralConfigured()) {
     return { ok: false, response: jsonError2("multi-node is disabled", 403) };
   }
   const token = bearer(req);
@@ -43811,8 +44220,22 @@ async function requirePeer(req) {
 function requirePrimaryOrigin(peer) {
   return peer.verified.fromIsPrimary ? null : jsonError2("only the workspace hub may call this endpoint", 403);
 }
-function peerAddressable(topic) {
-  return topic.surface === "otium";
+function peerTopicByName(toTopic, userId, peer) {
+  const surfaceScope = surfaceScopeForCell(peer.verified.viaCellId);
+  const scoped = getTopicByNameForUser(toTopic, userId, { surface: "otium", surfaceScope });
+  if (scoped)
+    return scoped;
+  if (!unscopedRoomsAddressable())
+    return null;
+  return getTopicByNameForUser(toTopic, userId, { surface: "otium", surfaceScope: null });
+}
+function peerAddressable(topic, peer) {
+  if (topic.surface !== "otium")
+    return false;
+  const roomScope = topic.surfaceScope ?? null;
+  if (!roomScope)
+    return unscopedRoomsAddressable();
+  return roomScope === surfaceScopeForCell(peer.verified.viaCellId);
 }
 function localCapabilities() {
   const agents = SUPPORTED_AGENTS.map((kind) => {
@@ -43882,8 +44305,8 @@ async function handleAbort(req) {
   const toTopic = str(body, "toTopic");
   if (!userId || !toTopic)
     return jsonError2("userId and toTopic are required", 400);
-  const topic = getTopicByNameForUser(toTopic, userId);
-  if (!topic || !peerAddressable(topic)) {
+  const topic = peerTopicByName(toTopic, userId, peer);
+  if (!topic || !peerAddressable(topic, peer)) {
     return jsonError2(`shared topic "${toTopic}" not found on this node`, 404);
   }
   appendJsonlEntry(sessionInboxPath(userId, topic.id), {
@@ -43924,8 +44347,8 @@ async function handleTell(req) {
   if (depth > MAX_TELL_DEPTH) {
     return jsonError2(`tell depth limit exceeded (max ${MAX_TELL_DEPTH})`, 400);
   }
-  const topic = getTopicByNameForUser(toTopic, userId);
-  if (!topic || !peerAddressable(topic)) {
+  const topic = peerTopicByName(toTopic, userId, peer);
+  if (!topic || !peerAddressable(topic, peer)) {
     return jsonError2(`shared topic "${toTopic}" not found on this node`, 404);
   }
   const claim = claimInboundPeerMessage({
@@ -43982,7 +44405,7 @@ async function handleSessions(req) {
   const userId = str(body, "userId");
   if (!userId)
     return jsonError2("userId is required", 400);
-  const topics = listTopics({ surface: "otium" }).filter((topic) => topic.kind !== "manager" && !topic.isSubagent && peerAddressable(topic) && topic.participants.some((p) => p.userId === userId));
+  const topics = listTopics({ surface: "otium" }).filter((topic) => topic.kind !== "manager" && !topic.isSubagent && peerAddressable(topic, peer) && topic.participants.some((p) => p.userId === userId));
   const titleCounts = new Map;
   for (const topic of topics) {
     const normalized = topic.title.toLowerCase();
@@ -44030,8 +44453,8 @@ async function handleAsk(req) {
   if (!Number.isInteger(fromDepth) || fromDepth < 0) {
     return jsonError2("fromDepth must be a non-negative integer", 400);
   }
-  const topic = getTopicByNameForUser(toTopic, userId);
-  if (!topic || !peerAddressable(topic)) {
+  const topic = peerTopicByName(toTopic, userId, peer);
+  if (!topic || !peerAddressable(topic, peer)) {
     return jsonError2(`shared topic "${toTopic}" not found on this node`, 404);
   }
   if (!topic.agent)
@@ -44151,7 +44574,7 @@ async function handleOtiumPeerRequest(req) {
   const url = new URL(req.url);
   const path = url.pathname;
   if (path === "/ready" && req.method === "GET") {
-    if (!otiumCentralConfig())
+    if (!isOtiumCentralConfigured())
       return null;
     return Response.json({ ok: true });
   }
@@ -44170,7 +44593,9 @@ async function handleOtiumPeerRequest(req) {
       return jsonError2("canonical Negotium node is unavailable", 503);
     }
     return forwardGatewayRequest(req, {
-      nodeOrigin: `http://127.0.0.1:${node.info.port}`
+      nodeOrigin: `http://127.0.0.1:${node.info.port}`,
+      surfaceScope: surfaceScopeForCell(peer.verified.viaCellId),
+      strictScope: !unscopedRoomsAddressable()
     });
   }
   if (req.method === "GET") {
@@ -44215,41 +44640,89 @@ var init_peer_server = __esm(async () => {
   init_protocol();
   await init_session_bridge();
   await init_store2();
+  await init_workspace_scope();
   RUNTIME_VERSION = NEGOTIUM_VERSION;
 });
 
 // ../../adapters/otium/src/index.ts
+function acquireGlobalOtiumServices() {
+  if (globalServices) {
+    globalServices.refs += 1;
+  } else {
+    const unregisterRuntimeBridge = registerPeerRuntimeBridge(otiumPeerRuntimeBridge);
+    const unregisterSessionBridge = registerPeerSessionBridge(otiumPeerSessionBridge);
+    const sessionBridgeIpc = startPeerSessionBridgeIpc(otiumPeerSessionBridge);
+    const canonicalMcpBridge = startCanonicalMcpBridge();
+    const stopPeerReplyOutbox = startPeerReplyOutboxWorker();
+    const uninstallFileHooks = installPeerFileHooks();
+    const unsubscribeTopicCleanup = runtimeBus().subscribe((event) => {
+      if (event.type !== "topic-deleted")
+        return;
+      const removed = cleanupPeerStateForLocalTopic(event.topicId);
+      if (removed.inboxRequests + removed.remoteAsks > 0) {
+        logger.info({ topicId: event.topicId, ...removed }, "otium: removed peer state for deleted local topic");
+      }
+    });
+    failInterruptedRemoteAskCallbacks().then((failedAsks) => {
+      if (failedAsks > 0) {
+        logger.warn({ failedAsks }, "otium: failed remote asks interrupted by previous process");
+      }
+    });
+    globalServices = {
+      refs: 1,
+      stop: () => {
+        unsubscribeTopicCleanup();
+        unregisterRuntimeBridge();
+        unregisterSessionBridge();
+        sessionBridgeIpc.stop();
+        canonicalMcpBridge.stop();
+        stopPeerReplyOutbox();
+        uninstallFileHooks();
+      }
+    };
+  }
+  let released = false;
+  return () => {
+    if (released || !globalServices)
+      return;
+    released = true;
+    globalServices.refs -= 1;
+    if (globalServices.refs > 0)
+      return;
+    globalServices.stop();
+    globalServices = null;
+  };
+}
+function refreshDefaultSurfaceScope() {
+  const scopes = [...mountedScopes.values()];
+  setDefaultSurfaceScope(scopes.length === 1 ? scopes[0] ?? null : null);
+  setSurfaceScopeRequired(scopes.length > 1);
+}
 function startOtiumNodeRuntime(options) {
   const { join: join43 } = options;
-  configureOtiumCentral(join43);
-  const unregisterRuntimeBridge = registerPeerRuntimeBridge(otiumPeerRuntimeBridge);
-  const unregisterSessionBridge = registerPeerSessionBridge(otiumPeerSessionBridge);
-  const sessionBridgeIpc = startPeerSessionBridgeIpc(otiumPeerSessionBridge);
-  const canonicalMcpBridge = startCanonicalMcpBridge();
-  const stopPeerReplyOutbox = startPeerReplyOutboxWorker();
-  failInterruptedRemoteAskCallbacks().then((failedAsks) => {
-    if (failedAsks > 0) {
-      logger.warn({ failedAsks }, "otium: failed remote asks interrupted by previous process");
-    }
-  });
-  const uninstallFileHooks = installPeerFileHooks();
-  const unsubscribeTopicCleanup = runtimeBus().subscribe((event) => {
-    if (event.type !== "topic-deleted")
-      return;
-    const removed = cleanupPeerStateForLocalTopic(event.topicId);
-    if (removed.inboxRequests + removed.remoteAsks > 0) {
-      logger.info({ topicId: event.topicId, ...removed }, "otium: removed peer state for deleted local topic");
-    }
-  });
+  attachOtiumCentralCell(join43);
+  const releaseGlobals = acquireGlobalOtiumServices();
   let stopped = false;
   logger.info({ central: join43.central, cellId: join43.cellId }, "otium: worker mode enabled");
-  selfPeerNode().then((self) => {
+  mountedScopes.set(join43.cellId, cachedSurfaceScope(join43));
+  refreshDefaultSurfaceScope();
+  selfPeerNodeForCell(join43.cellId).then((self) => {
     if (self) {
       logger.info({ nodeName: self.nodeName, baseUrl: self.baseUrl }, "otium: attached to workspace");
     }
   }).catch((err2) => {
     logger.warn({ err: err2 }, "otium: self check against central failed (will retry per request)");
   });
+  resolveSurfaceScope(join43).then((scope) => {
+    if (!scope || stopped)
+      return;
+    mountedScopes.set(join43.cellId, scope);
+    refreshDefaultSurfaceScope();
+    if (mountedScopes.size === 1)
+      stampUnscopedOtiumTopics(scope);
+  }).catch((err2) => {
+    logger.warn({ err: err2 }, "otium: workspace scope resolution failed");
+  });
   return {
     name: "otium",
     join: join43,
@@ -44257,14 +44730,10 @@ function startOtiumNodeRuntime(options) {
       if (stopped)
         return;
       stopped = true;
-      unsubscribeTopicCleanup();
-      unregisterRuntimeBridge();
-      unregisterSessionBridge();
-      sessionBridgeIpc.stop();
-      canonicalMcpBridge.stop();
-      stopPeerReplyOutbox();
-      uninstallFileHooks();
-      configureOtiumCentral(null);
+      mountedScopes.delete(join43.cellId);
+      refreshDefaultSurfaceScope();
+      detachOtiumCentralCell(join43.cellId);
+      releaseGlobals();
     }
   };
 }
@@ -44302,7 +44771,7 @@ function startOtiumAdapter(options) {
     }
   };
 }
-var otiumAdapter;
+var globalServices = null, mountedScopes, otiumAdapter;
 var init_src8 = __esm(async () => {
   await init_src();
   await init_canonical_mcp_bridge();
@@ -44314,6 +44783,7 @@ var init_src8 = __esm(async () => {
   init_session_bridge_ipc();
   await init_store2();
   init_tunnel_client();
+  await init_workspace_scope();
   await init_central();
   await init_enrollment();
   await init_join();
@@ -44323,6 +44793,8 @@ var init_src8 = __esm(async () => {
   await init_runtime_bridge();
   await init_store2();
   init_tunnel_client();
+  await init_workspace_scope();
+  mountedScopes = new Map;
   otiumAdapter = defineNegotiumAdapter({
     name: "otium",
     capabilities: {
@@ -44342,12 +44814,59 @@ var init_src8 = __esm(async () => {
 // ../../adapters/otium/src/node-runtime.ts
 var exports_node_runtime = {};
 __export(exports_node_runtime, {
+  reconcileOtiumWorkspaces: () => reconcileOtiumWorkspaces,
+  mountedOtiumWorkspaces: () => mountedOtiumWorkspaces,
   mountConfiguredOtiumNodeRuntime: () => mountConfiguredOtiumNodeRuntime,
   handleOtiumAdapterControlRequest: () => handleOtiumAdapterControlRequest,
+  detachOtiumWorkspace: () => detachOtiumWorkspace,
+  attachOtiumWorkspace: () => attachOtiumWorkspace,
   OTIUM_ADAPTER_CONTROL_PREFIX: () => OTIUM_ADAPTER_CONTROL_PREFIX,
   OTIUM_ADAPTER_CONTROL_HEADER: () => OTIUM_ADAPTER_CONTROL_HEADER,
   MAX_PEER_REQUEST_BODY_BYTES: () => MAX_PEER_REQUEST_BODY_BYTES
 });
+function sameCredentials(left, right) {
+  return left.central === right.central && left.relay === right.relay && left.secret === right.secret;
+}
+function attachOtiumWorkspace(join43) {
+  const current3 = mounted.get(join43.cellId);
+  if (current3) {
+    if (sameCredentials(current3.join, join43))
+      return false;
+    detachOtiumWorkspace(join43.cellId);
+  }
+  mounted.set(join43.cellId, startOtiumNodeRuntime({ join: join43 }));
+  return true;
+}
+function detachOtiumWorkspace(cellId) {
+  const runtime2 = mounted.get(cellId);
+  if (!runtime2)
+    return false;
+  mounted.delete(cellId);
+  runtime2.stop();
+  return true;
+}
+function mountedOtiumWorkspaces() {
+  return [...mounted.values()].map((runtime2) => runtime2.join);
+}
+function reconcileOtiumWorkspaces(joins = loadJoins()) {
+  const wanted = new Map(joins.map((join43) => [join43.cellId, join43]));
+  const detached = [];
+  for (const cellId of [...mounted.keys()]) {
+    if (wanted.has(cellId))
+      continue;
+    detachOtiumWorkspace(cellId);
+    detached.push(cellId);
+  }
+  const attached = [];
+  for (const [cellId, join43] of wanted) {
+    if (attachOtiumWorkspace(join43))
+      attached.push(cellId);
+  }
+  if (attached.length > 0 || detached.length > 0) {
+    logger.info({ attached, detached }, "otium: workspace attachments reconciled");
+  }
+  return { attached, detached };
+}
 async function handleOtiumAdapterControlRequest(req) {
   const url = new URL(req.url);
   if (!url.pathname.startsWith(`${OTIUM_ADAPTER_CONTROL_PREFIX}/`))
@@ -44356,6 +44875,25 @@ async function handleOtiumAdapterControlRequest(req) {
     return Response.json({ ok: false, error: "Unauthorized" }, { status: 401 });
   }
   const peerPath = url.pathname.slice(OTIUM_ADAPTER_CONTROL_PREFIX.length) || "/";
+  if (peerPath === OTIUM_WORKSPACES_CONTROL_PATH) {
+    if (req.headers.get(OTIUM_RELAYED_HEADER)) {
+      return Response.json({ ok: false, error: "not found" }, { status: 404 });
+    }
+    if (req.method === "GET") {
+      return Response.json({
+        ok: true,
+        workspaces: mountedOtiumWorkspaces().map((join43) => ({
+          cellId: join43.cellId,
+          central: join43.central
+        }))
+      });
+    }
+    if (req.method === "POST") {
+      const result = reconcileOtiumWorkspaces();
+      return Response.json({ ok: true, ...result });
+    }
+    return Response.json({ ok: false, error: "method not allowed" }, { status: 405 });
+  }
   const peerUrl = new URL(req.url);
   peerUrl.pathname = peerPath;
   const headers = new Headers(req.headers);
@@ -44364,29 +44902,72 @@ async function handleOtiumAdapterControlRequest(req) {
   return await handleOtiumPeerRequest(new Request(peerUrl.toString(), { method: req.method, headers, body, signal: req.signal })) ?? Response.json({ ok: false, error: "Otium route not found" }, { status: 404 });
 }
 function mountConfiguredOtiumNodeRuntime() {
-  const join43 = loadJoin();
-  if (!join43)
+  const joins = loadJoins();
+  if (joins.length === 0)
     return null;
-  const runtime2 = startOtiumNodeRuntime({ join: join43 });
+  for (const join43 of joins)
+    attachOtiumWorkspace(join43);
   registerNodeRequestHandler("otium-adapter-control", handleOtiumAdapterControlRequest);
   let stopped = false;
   return {
-    ...runtime2,
+    name: "otium",
+    join: joins[0],
     stop() {
       if (stopped)
         return;
       stopped = true;
       unregisterNodeRequestHandler("otium-adapter-control");
-      runtime2.stop();
+      for (const cellId of [...mounted.keys()])
+        detachOtiumWorkspace(cellId);
     }
   };
 }
+var mounted;
 var init_node_runtime = __esm(async () => {
   await init_src();
   await init_src8();
   await init_join();
   await init_peer_server();
   init_protocol();
+  mounted = new Map;
+});
+
+// ../../adapters/otium/src/workspace-control.ts
+var exports_workspace_control = {};
+__export(exports_workspace_control, {
+  reconcileRunningNodeWorkspaces: () => reconcileRunningNodeWorkspaces
+});
+async function reconcileRunningNodeWorkspaces() {
+  try {
+    const { inspectNodeDaemon: inspectNodeDaemon2 } = await init_src5().then(() => exports_src3);
+    const status = await inspectNodeDaemon2();
+    if (!status.running || !status.info) {
+      return { ok: false, attached: [], detached: [], error: "node is not running" };
+    }
+    const response = await fetch(`http://127.0.0.1:${status.info.port}${OTIUM_ADAPTER_CONTROL_PREFIX}${OTIUM_WORKSPACES_CONTROL_PATH}`, {
+      method: "POST",
+      headers: {
+        [OTIUM_ADAPTER_CONTROL_HEADER]: NODE_CONTROL_TOKEN,
+        "content-type": "application/json"
+      },
+      signal: AbortSignal.timeout(5000)
+    });
+    const body = await response.json().catch(() => null);
+    if (!response.ok || !body?.ok) {
+      return {
+        ok: false,
+        attached: [],
+        detached: [],
+        error: body?.error ?? `node returned ${response.status}`
+      };
+    }
+    return { ok: true, attached: body.attached ?? [], detached: body.detached ?? [] };
+  } catch (error2) {
+    return { ok: false, attached: [], detached: [], error: error2.message };
+  }
+}
+var init_workspace_control = __esm(async () => {
+  await init_src();
 });
 
 // ../../adapters/otium/src/join-cli.ts
@@ -44480,6 +45061,12 @@ async function joinCommand(args) {
   } finally {
     configureOtiumCentral(null);
   }
+  const { reconcileRunningNodeWorkspaces: reconcileRunningNodeWorkspaces2 } = await init_workspace_control().then(() => exports_workspace_control);
+  const applied = await reconcileRunningNodeWorkspaces2();
+  if (applied.ok && applied.attached.length > 0) {
+    console.log("the running node attached this workspace; the others kept running");
+    return;
+  }
   console.log("\nnext: `negotium-otium serve` (mounts the otium peer routes automatically)");
 }
 var init_join_cli = __esm(async () => {
@@ -44494,9 +45081,15 @@ __export(exports_sidecar, {
   runOtiumSidecar: () => runOtiumSidecar,
   proxyOtiumPeerRequest: () => proxyOtiumPeerRequest
 });
+function isPublicPeerPath(pathname) {
+  return pathname === "/ready" || pathname.startsWith("/api/v1/peer/");
+}
 async function proxyOtiumPeerRequest(req, dependencies = {}) {
   const inspectNode = dependencies.inspectNode ?? inspectNodeDaemon;
   const fetchRequest = dependencies.fetch ?? fetch;
+  if (!isPublicPeerPath(new URL(req.url).pathname)) {
+    return Response.json({ ok: false, error: "not found" }, { status: 404 });
+  }
   const status = await inspectNode();
   if (!status.running || !status.info) {
     return Response.json({ ok: false, error: "canonical Negotium node is unavailable" }, { status: 503 });
@@ -44507,6 +45100,7 @@ async function proxyOtiumPeerRequest(req, dependencies = {}) {
   target.search = source.search;
   const headers = new Headers(req.headers);
   headers.set(OTIUM_ADAPTER_CONTROL_HEADER, NODE_CONTROL_TOKEN);
+  headers.set(OTIUM_RELAYED_HEADER, "1");
   try {
     const body = req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer();
     headers.delete("transfer-encoding");
@@ -44563,8 +45157,8 @@ async function runOtiumSidecar(options) {
   }) : null;
   tunnel?.start();
   let resolveCompleted;
-  const completed = new Promise((resolve26) => {
-    resolveCompleted = resolve26;
+  const completed = new Promise((resolve27) => {
+    resolveCompleted = resolve27;
   });
   onShutdown("otium-sidecar-server", 130, () => server?.stop(true));
   onShutdown("otium-sidecar-tunnel", 120, () => tunnel?.stop());
@@ -44690,16 +45284,28 @@ async function runOtiumCli(args = process.argv.slice(2)) {
       break;
     }
     case "leave": {
-      if (commandArgs.length > 0)
-        throw new Error(`usage: negotium otium ${command}`);
+      const targetCellId = commandArgs[0]?.trim();
+      if (commandArgs.length > 1 || targetCellId?.startsWith("-")) {
+        throw new Error(`usage: negotium otium ${command} [<cell-id>]`);
+      }
       if (process.env.OTIUM_CENTRAL_URL || process.env.OTIUM_CELL_ID || process.env.OTIUM_CELL_SECRET) {
         throw new Error("Otium join is configured by environment; remove OTIUM_CENTRAL_URL, OTIUM_CELL_ID, and OTIUM_CELL_SECRET to disconnect");
       }
-      const { loadJoin: loadJoin2, removeJoin: removeJoin2 } = await init_join().then(() => exports_join);
-      if (!loadJoin2())
+      const { loadJoins: loadJoins2, removeJoin: removeJoin2 } = await init_join().then(() => exports_join);
+      const joins = loadJoins2();
+      if (joins.length === 0)
         throw new Error("not joined to an Otium workspace");
-      removeJoin2();
-      console.log("disconnected from Otium; workspace credentials removed");
+      if (!targetCellId && joins.length > 1) {
+        throw new Error(`this node is joined to ${joins.length} workspaces; name one to leave: ${joins.map((join43) => join43.cellId).join(", ")}`);
+      }
+      if (targetCellId && !joins.some((join43) => join43.cellId === targetCellId)) {
+        throw new Error(`not joined as ${targetCellId}`);
+      }
+      removeJoin2(targetCellId);
+      console.log(targetCellId ? `left Otium workspace ${targetCellId}; its credentials were removed` : "disconnected from Otium; workspace credentials removed");
+      const { reconcileRunningNodeWorkspaces: reconcileRunningNodeWorkspaces2 } = await init_workspace_control().then(() => exports_workspace_control);
+      const applied = await reconcileRunningNodeWorkspaces2();
+      console.log(applied.ok ? "the running node has detached it; other workspaces are unaffected" : "restart the node to apply this");
       break;
     }
     case "serve": {
@@ -44722,8 +45328,9 @@ async function runOtiumCli(args = process.argv.slice(2)) {
         "  serve [--port <port>] [--relay <url>]",
         "                 run peer routes and an outbound relay tunnel",
         "",
-        "Publish a topic to the workspace with /public in that topic; the hub",
-        "discovers it over the Runtime Gateway. /private withdraws it."
+        "Rooms on the otium surface are discovered by the hub over the Runtime",
+        "Gateway. There is nothing to publish or withdraw: a room's surface is",
+        "fixed when it is created."
       ].join(`
 `));
       if (command && command !== "help" && command !== "--help")
@@ -44766,7 +45373,7 @@ __export(exports_topics, {
   topicsCommand: () => topicsCommand
 });
 function topicsCommand() {
-  const topics = getVisibleTopics();
+  const topics = getVisibleTopics({ surface: "terminal" });
   if (topics.length === 0) {
     console.log("no topics yet - start `negotium` to create one in Terminal");
     return;
@@ -45265,6 +45872,16 @@ function renderCliHelp() {
 // ../cli/src/main.ts
 var [, , rawCommand, ...args] = process.argv;
 var command = normalizeCliCommand(rawCommand);
+async function runOtium(args2) {
+  const { runOtiumCli: runOtiumCli2 } = await loadOtiumCli();
+  try {
+    await runOtiumCli2(args2);
+  } catch (error2) {
+    process.stderr.write(`negotium otium: ${error2 instanceof Error ? error2.message : String(error2)}
+`);
+    process.exitCode = 1;
+  }
+}
 function numericOption(values, name, fallback) {
   const prefix = `--${name}=`;
   const parsed = Number.parseInt(values.find((value) => value.startsWith(prefix))?.slice(prefix.length) ?? "", 10);
@@ -45290,7 +45907,7 @@ async function runCanonicalNode(port) {
   });
   console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
   await node.completed;
-  await new Promise((resolve26) => setImmediate(resolve26));
+  await new Promise((resolve27) => setImmediate(resolve27));
   process.exit(0);
 }
 async function stopAdapter(name) {
@@ -45322,8 +45939,7 @@ switch (command) {
   }
   case "serve": {
     if (args[0] === "otium") {
-      const { runOtiumCli: runOtiumCli2 } = await loadOtiumCli();
-      await runOtiumCli2(["serve", ...args.slice(1)]);
+      await runOtium(["serve", ...args.slice(1)]);
       break;
     }
     await runCanonicalNode(numericOption(args, "port", 7777));
@@ -45407,11 +46023,10 @@ switch (command) {
     break;
   }
   case "otium": {
-    const { runOtiumCli: runOtiumCli2 } = await loadOtiumCli();
     if (args[0] === "serve") {
       process.stderr.write("warning: `negotium otium serve` is deprecated; use `negotium serve otium`\n");
     }
-    await runOtiumCli2(args);
+    await runOtium(args);
     break;
   }
   default: {
@@ -45421,4 +46036,4 @@ switch (command) {
   }
 }
 
-//# debugId=57EA2CF6F8F9DA8164756E2164756E21
+//# debugId=EDB732002F3171B764756E2164756E21