oasis_test_v2 2.2.82 → 2.2.84

package/dist/index.js

@@ -1347,6 +1347,21 @@ function actualModelId(model) {
   if (!t) return void 0;
   return isPseudoModelId(t) ? void 0 : t;
 }
+function modelSourceRank(model, source) {
+  if (!actualModelId(model)) return -1;
+  return source ? MODEL_SOURCE_RANK[source] ?? 1 : 1;
+}
+function preferRunModel(existing, incoming, tie = "keep") {
+  const incomingModel = actualModelId(incoming.effectiveModel);
+  if (!incomingModel) return null;
+  const existingRank = modelSourceRank(existing.effectiveModel, existing.modelSource);
+  const incomingRank = modelSourceRank(incomingModel, incoming.modelSource);
+  if (incomingRank > existingRank) return { effectiveModel: incomingModel, modelSource: incoming.modelSource ?? null };
+  if (incomingRank === existingRank && tie === "replace") {
+    return { effectiveModel: incomingModel, modelSource: incoming.modelSource ?? null };
+  }
+  return null;
+}
 function legacyScopeIsEmpty(scope2) {
   return scope2.artifactIds.length === 0 && scope2.chatSessionIds.length === 0 && (scope2.runtimeInstanceIds?.length ?? 0) === 0;
 }
@@ -1356,11 +1371,20 @@ function legacyScopeMatcher(scope2) {
   const runtimes = new Set(scope2.runtimeInstanceIds ?? []);
   return (run) => run.artifactId != null && artifacts.has(run.artifactId) || run.chatSessionId != null && sessions.has(run.chatSessionId) || run.runtimeInstanceId != null && runtimes.has(run.runtimeInstanceId);
 }
-var PSEUDO_MODEL_IDS, DISPLAY_CNY_PER_USD, USAGE_POINT_FINAL_SEQ;
+var PSEUDO_MODEL_IDS, MODEL_SOURCE_RANK, DISPLAY_CNY_PER_USD, USAGE_POINT_FINAL_SEQ;
 var init_trace = __esm({
   "../contract/src/trace.ts"() {
     "use strict";
     PSEUDO_MODEL_IDS = ["default", "default[]", "auto"];
+    MODEL_SOURCE_RANK = {
+      runtime: 2,
+      runtime_rollout: 2,
+      requested: 1,
+      session_override: 1,
+      actor_config: 1,
+      runtime_default: 1,
+      unknown: 0
+    };
     DISPLAY_CNY_PER_USD = 7.2;
     USAGE_POINT_FINAL_SEQ = 2147483647;
   }
@@ -8506,14 +8530,46 @@ async function runACPSession(job, cfg) {
   let runtimeReportedModel;
   let requestedModelAccepted;
   const reportedModel = () => pickReportedModel({ runtime: [routedModel, runtimeReportedModel], requested: requestedModelAccepted });
+  let turnIndex = 0;
+  let turnStartedMs = Date.now();
+  let freshSession = true;
+  let routedPollInflight = false;
   const pollRoutedModel = async () => {
-    if (routedModel || !cfg.readRoutedModel || !capturedSessionId) return;
-    if (actualModelId(runtimeReportedModel)) return;
+    if (!cfg.readRoutedModel || !capturedSessionId || exited) return false;
+    if (actualModelId(runtimeReportedModel)) return true;
+    if (routedPollInflight) return false;
+    routedPollInflight = true;
+    const turn = turnIndex;
     try {
-      routedModel = await cfg.readRoutedModel(capturedSessionId);
+      const found2 = actualModelId(await cfg.readRoutedModel(capturedSessionId, {
+        turnStartedMs,
+        freshSession
+      }));
+      if (!found2 || turn !== turnIndex) return false;
+      if (found2 !== routedModel) {
+        routedModel = found2;
+        emitUsageCheckpoint();
+      }
+      return true;
     } catch {
+      return false;
+    } finally {
+      routedPollInflight = false;
     }
-    if (routedModel) emitUsageCheckpoint();
+  };
+  const ROUTED_MODEL_POLL_DELAYS_MS = [0, 150, 400, 900, 2e3];
+  let routedSamplingTurn = -1;
+  const startRoutedModelSampling = () => {
+    if (!cfg.readRoutedModel || routedSamplingTurn === turnIndex) return;
+    routedSamplingTurn = turnIndex;
+    const turn = turnIndex;
+    void (async () => {
+      for (const delay of ROUTED_MODEL_POLL_DELAYS_MS) {
+        if (delay > 0) await new Promise((r) => setTimeout(r, delay));
+        if (exited || turn !== turnIndex) return;
+        if (await pollRoutedModel()) return;
+      }
+    })();
   };
   const modelForUsage = () => reportedModel()?.model;
   const usageCheckpointCbs = [];
@@ -8639,11 +8695,15 @@ ${note}` : note };
     },
     (text7) => {
       confirmAppendBatch();
+      startRoutedModelSampling();
       if (cfg.classifyPromptFailure && turnMessage.length < PROMPT_TURN_MESSAGE_MAX) turnMessage += text7;
       for (const cb of outputCbs) cb(text7);
     },
     (e) => {
-      if (["message", "thought", "tool_use", "tool_result"].includes(e.kind)) confirmAppendBatch();
+      if (["message", "thought", "tool_use", "tool_result"].includes(e.kind)) {
+        confirmAppendBatch();
+        startRoutedModelSampling();
+      }
       for (const cb of telemetryCbs) cb(e);
     },
     // runtime 自己用 stopReason=cancelled 收尾时也保留取消语义；此前误记成 error，
@@ -8712,6 +8772,7 @@ ${note}` : note };
             sessionId = job.runtimeSessionId;
             ambiguousResume = true;
           }
+          if (sessionId) freshSession = false;
         } catch {
           sessionId = "";
         }
@@ -8725,6 +8786,7 @@ ${note}` : note };
         sessionId = extractSessionID(sessionRes);
         runtimeReportedModel = extractCurrentModelID(sessionRes) ?? runtimeReportedModel;
         if (!sessionId) throw new Error("session/new returned no sessionId");
+        freshSession = true;
       }
       capturedSessionId = sessionId;
       if (resolvedModel2) {
@@ -8761,6 +8823,8 @@ ${task}` : task;
       const sendPrompt = async (text7) => {
         turnMessage = "";
         turnStderr = [];
+        turnIndex += 1;
+        turnStartedMs = Date.now();
         const p2 = client.request("session/prompt", { sessionId, prompt: [{ type: "text", text: text7 }] });
         inflightStopReason = p2.then((r) => extractStopReason(r), () => "");
         try {
@@ -8780,6 +8844,7 @@ ${task}` : task;
         sessionId = extractSessionID(sessionRes);
         runtimeReportedModel = extractCurrentModelID(sessionRes) ?? runtimeReportedModel;
         if (!sessionId) throw new Error("session/new returned no sessionId");
+        freshSession = true;
         capturedSessionId = sessionId;
         emitUsageCheckpoint();
         promptResult = await sendPrompt(userText);
@@ -9548,14 +9613,59 @@ function pickCursorModelName(value2) {
   };
   return visit(value2, 0) ?? fallback;
 }
-function modelNameInCell(cell) {
-  if (typeof cell !== "string" || !cell.includes("modelName")) return void 0;
+function parseCell(cell) {
+  if (typeof cell !== "string") return void 0;
   try {
-    return pickCursorModelName(JSON.parse(cell));
+    return JSON.parse(cell);
   } catch {
     return void 0;
   }
 }
+function looksLikeTimeKey(key2) {
+  const tokens2 = key2.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  const last = tokens2[tokens2.length - 1];
+  if (!last || !TIME_KEY_TAILS.includes(last)) return false;
+  return last !== "at" || tokens2.length > 1;
+}
+function cursorTimeValueMs(value2) {
+  if (typeof value2 === "bigint") return cursorTimeValueMs(Number(value2));
+  if (typeof value2 === "number") {
+    if (!Number.isFinite(value2)) return void 0;
+    if (value2 > 1e15) return Math.floor(value2 / 1e3);
+    if (value2 > 1e12) return value2;
+    if (value2 > 1e9) return value2 * 1e3;
+    return void 0;
+  }
+  if (typeof value2 === "string") {
+    const t = value2.trim();
+    if (!t) return void 0;
+    if (/^\d+$/.test(t)) return cursorTimeValueMs(Number(t));
+    const ms = Date.parse(t);
+    return Number.isFinite(ms) ? ms : void 0;
+  }
+  return void 0;
+}
+function cursorRowTimeMs(row, parsedCells) {
+  let best;
+  const take = (v2) => {
+    const ms = cursorTimeValueMs(v2);
+    if (ms !== void 0 && (best === void 0 || ms > best)) best = ms;
+  };
+  for (const [key2, value2] of Object.entries(row)) if (looksLikeTimeKey(key2)) take(value2);
+  const visit = (node2, depth) => {
+    if (depth > 8 || node2 === null || typeof node2 !== "object") return;
+    if (Array.isArray(node2)) {
+      for (const item of node2) visit(item, depth + 1);
+      return;
+    }
+    for (const [key2, value2] of Object.entries(node2)) {
+      if (looksLikeTimeKey(key2)) take(value2);
+      visit(value2, depth + 1);
+    }
+  };
+  for (const parsed of parsedCells) visit(parsed, 0);
+  return best;
+}
 async function openReadOnly(file) {
   try {
     const sqlite = await import("node:sqlite");
@@ -9564,7 +9674,9 @@ async function openReadOnly(file) {
     return null;
   }
 }
-async function readCursorRoutedModel(sessionId, env = process.env) {
+async function readCursorRoutedModel(sessionId, window3) {
+  const env = window3.env ?? process.env;
+  const earliest = window3.turnStartedMs - TURN_CLOCK_TOLERANCE_MS;
   const file = cursorAcpSessionStorePath(sessionId, env);
   if (!file) return void 0;
   const db = await openReadOnly(file);
@@ -9580,10 +9692,17 @@ async function readCursorRoutedModel(sessionId, env = process.env) {
         continue;
       }
       for (const row of rows) {
-        for (const cell of Object.values(row)) {
-          const model = modelNameInCell(cell);
-          if (model) return model;
+        const cells = Object.values(row);
+        if (!cells.some((cell) => typeof cell === "string" && cell.includes("modelName"))) continue;
+        const parsed = cells.map(parseCell);
+        const model = parsed.map((value2) => value2 === void 0 ? void 0 : pickCursorModelName(value2)).find((name) => !!name);
+        if (!model) continue;
+        const rowMs = cursorRowTimeMs(row, parsed);
+        if (rowMs !== void 0) {
+          if (rowMs >= earliest) return model;
+          continue;
         }
+        if (window3.freshSession) return model;
       }
     }
     return void 0;
@@ -9596,7 +9715,7 @@ async function readCursorRoutedModel(sessionId, env = process.env) {
     }
   }
 }
-var fs10, os6, path12, MAX_TABLES, MAX_ROWS_PER_TABLE;
+var fs10, os6, path12, MAX_TABLES, MAX_ROWS_PER_TABLE, TURN_CLOCK_TOLERANCE_MS, TIME_KEY_TAILS;
 var init_local_store = __esm({
   "../adapters/src/cursor/local-store.ts"() {
     "use strict";
@@ -9605,6 +9724,8 @@ var init_local_store = __esm({
     path12 = __toESM(require("node:path"), 1);
     MAX_TABLES = 24;
     MAX_ROWS_PER_TABLE = 200;
+    TURN_CLOCK_TOLERANCE_MS = 1e3;
+    TIME_KEY_TAILS = ["at", "ts", "time", "timestamp", "date", "millis", "epoch"];
   }
 });
 
@@ -9652,7 +9773,7 @@ var init_cursor = __esm({
           // 采集点 4：「自动」档下 cursor 对外只报 `default[]`（不是型号、查不到价，v2 上 385 条记的就是它），
           // 而它自己的 `~/.cursor/acp-sessions/<会话号>/store.db` 里逐条回复都带实际路由到的模型。
           // 这是 cursor 的内部格式：读不到就退回会话级自报值，绝不报错（见 local-store.ts）。
-          readRoutedModel: (sessionId) => readCursorRoutedModel(sessionId),
+          readRoutedModel: (sessionId, window3) => readCursorRoutedModel(sessionId, window3),
           ...this.opts.syncSkills ? { syncSkills: this.opts.syncSkills } : {}
         });
       }
@@ -35188,7 +35309,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes14, createHash: createHash45 } = require("crypto");
+    var { randomBytes: randomBytes15, createHash: createHash45 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -35726,7 +35847,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key2 = randomBytes14(16).toString("base64");
+      const key2 = randomBytes15(16).toString("base64");
       const request2 = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -130137,7 +130258,7 @@ var require_utils3 = __commonJS({
     var nodeCrypto = require("crypto");
     module2.exports = {
       postgresMd5PasswordHash,
-      randomBytes: randomBytes14,
+      randomBytes: randomBytes15,
       deriveKey,
       sha256: sha2563,
       hashByName,
@@ -130147,7 +130268,7 @@ var require_utils3 = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes14(length) {
+    function randomBytes15(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string7) {
@@ -140939,16 +141060,32 @@ ${m2.spec.split("\n").map((l) => `  > ${l}`).join("\n")}`);
     //
     // 这些字段不能成为「没做完也能交」的出口：真正未满足交付标准时继续完成，外部阻塞走 oasis gap。
     // 四项本身只传递一份已达标成果的非阻塞残余信息，不参与 conclude 判据。
-    ...args.action === "review" ? [] : [
+    //
+    // ★ 2026-09-23（语菲，验收用例 H-01）：此前只列参数名、没说挂在哪条命令上，agent 常把它们写到
+    // `oasis conclude` 上——conclude 只收 `--note`，其余参数被静默丢掉（v2 上 143 次执行里写过这四项
+    // 16 次，6 次写在 conclude 上、全丢）。所以点名「是 propose 的参数」并给一条**追加式**示例：
+    // 只示范「在那条命令末尾加上什么」，不给整条 propose——design（交稿目录不是 deliverable/）、
+    // 分批续跑（要带 --checkpoint --continue）各有自己的提交命令，照抄一整条会交错目录或漏参数。
+    // 「没有就连参数名也不写」：只写参数名不跟值会被 parseArgs 拒（CLI 侧已对这四项放宽为空值，
+    // 但未升级的节点包仍会拒），提示词也把这条路堵上。
+    //
+    // 集成会话（integrating || queueTaskDue）不出这段：那一档「怎么提交」明令「绝不要用 oasis propose」，
+    // 而 `oasis integrate` 也不收这四项——再教「这是 propose 的参数」只会把它引去 propose，
+    // 队列从 N 变 N+1、随后 conclude 撞 queue not quiescent（本文件「怎么提交」那段注释记的卡死形状）。
+    ...args.action === "review" || integrating || queueTaskDue ? [] : [
       ``,
       `### \u4EA4\u4ED8\u65F6\u7684\u975E\u963B\u585E\u4FE1\u606F`,
-      `\`--reason\` \u5199\u660E\u76F8\u5BF9\u4E0A\u4E00\u7248\u6539\u4E86\u4EC0\u4E48\u3001\u4E3A\u4EC0\u4E48\u3001\u53EF\u80FD\u5F71\u54CD\u4EC0\u4E48\uFF1B\u9996\u6B21\u7248\u672C\u8BF4\u660E\u672C\u7248\u5B8C\u6210\u5185\u5BB9\u3002`,
-      `\u53EA\u6709\u5F53\u524D\u7248\u672C\u5DF2\u7ECF\u8FBE\u5230\u4EA4\u4ED8\u6807\u51C6\u65F6\uFF0C\u624D\u53EF\u4EE5\u8BB0\u5F55\uFF1A`,
+      `\u4E0B\u9762\u51E0\u9879\u662F\u4EA4\u4ED8\u547D\u4EE4\uFF08\`oasis propose\`\uFF09\u7684\u53C2\u6570\uFF0C\u76F4\u63A5\u52A0\u5728\u90A3\u6761\u547D\u4EE4\u540E\u9762\uFF0C\u548C \`--reason\` \u5199\u5728\u4E00\u8D77\uFF1B\`oasis conclude\` \u53EA\u6536 \`--note\`\uFF0C\u5199\u5728 conclude \u4E0A\u7684\u5176\u5B83\u53C2\u6570\u4E0D\u4F1A\u88AB\u8BB0\u5F55\u3002`,
+      `\`--reason\` \u5199\u660E\u76F8\u5BF9\u4E0A\u4E00\u7248\u6539\u4E86\u4EC0\u4E48\u3001\u4E3A\u4EC0\u4E48\u3001\u53EF\u80FD\u5F71\u54CD\u4EC0\u4E48\uFF1B\u9996\u6B21\u7248\u672C\u8BF4\u660E\u672C\u7248\u5B8C\u6210\u601D\u8DEF\u548C\u5185\u5BB9\u3002`,
+      `\u53EA\u6709\u5F53\u524D\u7248\u672C\u5DF2\u7ECF\u8FBE\u5230\u4EA4\u4ED8\u6807\u51C6\u65F6\uFF0C\u624D\u53EF\u4EE5\u8BB0\u5F55\uFF08\u6BCF\u9879\u53EF\u4EE5\u5199\u591A\u6761\uFF0C\u7528\u82F1\u6587\u5206\u53F7 \`;\` \u9694\u5F00\uFF1B\u4EE5\u4E0B\u67D0\u4E00\u9879\u5982\u679C\u6CA1\u6709\u5C31\u4E0D\u5199\uFF0C\u540C\u65F6\u8BE5\u53C2\u6570\u4E5F\u4E0D\u5199\uFF09\uFF1A`,
       `- \`--unresolved\`\uFF1A\u4EFB\u52A1\u8303\u56F4\u4E4B\u5916\u7684\u5DF2\u77E5\u95EE\u9898\uFF1B`,
       `- \`--risks\`\uFF1A\u6210\u679C\u53EF\u4EA4\u4ED8\uFF0C\u4F46\u4F7F\u7528\u65F6\u9700\u6CE8\u610F\u7684\u6B8B\u4F59\u98CE\u9669\uFF1B`,
       `- \`--gaps\`\uFF1A\u4E0D\u5C5E\u4E8E\u672C\u6B21\u5F3A\u5236\u9A8C\u6536\u6761\u4EF6\u7684\u9A8C\u8BC1\u8303\u56F4\u9650\u5236\uFF1B`,
       `- \`--next\`\uFF1A\u4E0B\u6E38\u5982\u4F55\u4F7F\u7528\u6210\u679C\uFF0C\u4E0D\u662F\u4F60\u5269\u4F59\u6CA1\u505A\u7684\u5DE5\u4F5C\u3002`,
-      `\u672A\u8FBE\u5230\u4EA4\u4ED8\u6807\u51C6\u7684\u4E8B\u9879\u4E0D\u80FD\u653E\u5728\u8FD9\u91CC\uFF0C\u5E94\u7EE7\u7EED\u5B8C\u6210\u6216\u8FD0\u884C \`oasis gap\`\u3002`,
+      `\u4F8B\u5982\u5728\u90A3\u6761\u547D\u4EE4\u672B\u5C3E\u52A0\u4E0A\uFF1A\`--risks "<\u98CE\u9669\u4E00>; <\u98CE\u9669\u4E8C>" --next "<\u4E0B\u6E38\u600E\u4E48\u7528>"\``,
+      `\u672A\u8FBE\u5230\u4EA4\u4ED8\u6807\u51C6\u7684\u4E8B\u9879\u4E0D\u80FD\u653E\u5728\u8FD9\u91CC\uFF0C\u5E94\u7EE7\u7EED\u5B8C\u6210\u6216\u8FD0\u884C \`oasis gap\`\u3002`
+    ],
+    ...args.action === "review" ? [] : [
       ``,
       `### \u4F1A\u8BDD\u53EF\u80FD\u88AB\u780D\uFF1A\u4E2D\u9014\u7559\u4E2A\u65AD\u70B9`,
       // ★ 2026-08-18：`continuity-checkpoint` 此前在任务书里出现 **0 次**——说明书只在
@@ -208705,11 +208842,17 @@ var init_app_adopt = __esm({
 });
 
 // ../connectors/src/github/app-manifest.ts
+function randomAppNameSuffix() {
+  const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+  return Array.from((0, import_node_crypto42.randomBytes)(4), (b2) => alphabet[b2 % alphabet.length]).join("");
+}
 function buildAppManifest(args) {
   const base = args.baseUrl.replace(/\/+$/, "");
+  const suffix = args.nameSuffix ?? randomAppNameSuffix();
+  const room = GITHUB_APP_NAME_MAX - args.namePrefix.length - suffix.length - 2;
+  const middle = args.employeeSlug.slice(0, Math.max(0, room)).replace(/-+$/, "");
   return {
-    name: `${args.namePrefix}-${args.employeeSlug}`.slice(0, 34),
-    // GitHub App 名上限 34 字符
+    name: [args.namePrefix, middle, suffix].filter(Boolean).join("-"),
     url: base,
     redirect_url: `${base}${args.redirectPath}`,
     public: false,
@@ -208787,10 +208930,11 @@ function checkAppOwnership(conv, want) {
   }
   return null;
 }
-var GITHUB_APP_DEFAULT_PERMISSIONS, GITHUB_APP_PERMISSION_LABELS, PENDING_TTL_MS, REQUIRED_WRITE_PERMISSIONS, PERMISSION_RANK, FORBIDDEN_IMPORT_PERMISSION_KEYS;
+var import_node_crypto42, GITHUB_APP_DEFAULT_PERMISSIONS, GITHUB_APP_PERMISSION_LABELS, GITHUB_APP_NAME_MAX, PENDING_TTL_MS, REQUIRED_WRITE_PERMISSIONS, PERMISSION_RANK, FORBIDDEN_IMPORT_PERMISSION_KEYS;
 var init_app_manifest = __esm({
   "../connectors/src/github/app-manifest.ts"() {
     "use strict";
+    import_node_crypto42 = require("node:crypto");
     GITHUB_APP_DEFAULT_PERMISSIONS = {
       contents: "write",
       // clone / push
@@ -208819,6 +208963,7 @@ var init_app_manifest = __esm({
       { key: "workflows", label: "\u5DE5\u4F5C\u6D41\u6587\u4EF6\uFF08\u8BFB\u5199\uFF09", desc: "\u4FEE\u6539 .github/workflows \u4E0B\u7684 CI \u914D\u7F6E" },
       { key: "issues", label: "Issue\uFF08\u8BFB\u5199\uFF09", desc: "\u521B\u5EFA\u4E0E\u8BC4\u8BBA Issue" }
     ];
+    GITHUB_APP_NAME_MAX = 34;
     PENDING_TTL_MS = 15 * 60 * 1e3;
     REQUIRED_WRITE_PERMISSIONS = ["contents", "pull_requests"];
     PERMISSION_RANK = { read: 1, write: 2, admin: 3 };
@@ -208835,6 +208980,195 @@ var init_app_manifest = __esm({
   }
 });
 
+// ../connectors/src/github/app-inventory.ts
+function permissionVerdict(perms) {
+  const missingRequired = REQUIRED_WRITE.filter((k2) => perms[k2] !== "write" && perms[k2] !== "admin");
+  const excess = excessAppPermissions(perms);
+  return {
+    missingRequired: [...missingRequired],
+    missing: missingAppPermissions(perms),
+    excess,
+    usable: missingRequired.length === 0 && excess.length === 0
+  };
+}
+async function listOrgInstalledApps(args, deps = {}) {
+  const d = { ...defaultDeps3, ...deps };
+  let resp;
+  try {
+    resp = await d.fetch(`${GITHUB_API2}/orgs/${encodeURIComponent(args.org)}/installations?per_page=100`, {
+      headers: {
+        authorization: `Bearer ${args.token}`,
+        accept: "application/vnd.github+json",
+        "x-github-api-version": "2022-11-28"
+      }
+    });
+  } catch (e) {
+    return { status: "error", message: String(e) };
+  }
+  if (resp.status === 401 || resp.status === 403) return { status: "needsAuth", httpStatus: resp.status };
+  const body2 = await resp.json().catch(() => ({}));
+  if (!resp.ok) return { status: "error", message: `GitHub \u8FD4\u56DE HTTP ${resp.status} ${String(body2["message"] ?? "")}`.trim() };
+  const list2 = Array.isArray(body2["installations"]) ? body2["installations"] : [];
+  const all2 = list2.flatMap((raw) => {
+    const item = raw;
+    const appId = item["app_id"] === void 0 ? "" : String(item["app_id"]);
+    const installationId = item["id"] === void 0 ? "" : String(item["id"]);
+    if (!appId || !installationId) return [];
+    const rawPerms = item["permissions"];
+    const permissions = {};
+    for (const [k2, v2] of Object.entries(rawPerms ?? {})) if (typeof v2 === "string") permissions[k2] = v2;
+    return [{ appId, slug: String(item["app_slug"] ?? ""), installationId, org: args.org, permissions }];
+  });
+  const owned = await Promise.all(all2.map(async (app) => {
+    if (!app.slug) return app;
+    try {
+      const r = await d.fetch(`${GITHUB_API2}/apps/${encodeURIComponent(app.slug)}`, {
+        headers: {
+          authorization: `Bearer ${args.token}`,
+          accept: "application/vnd.github+json",
+          "x-github-api-version": "2022-11-28"
+        }
+      });
+      if (!r.ok) return app;
+      const meta = await r.json().catch(() => ({}));
+      const login = meta.owner?.login;
+      return login && login.toLowerCase() !== args.org.toLowerCase() ? null : app;
+    } catch {
+      return app;
+    }
+  }));
+  return { status: "ok", apps: owned.filter((a) => a !== null) };
+}
+async function uninstallAppInstallation(args, deps = {}) {
+  const d = { ...defaultDeps3, ...deps };
+  const jwt = createAppJwt(args.appId, args.privateKeyPem, d.nowMs());
+  const resp = await d.fetch(`${GITHUB_API2}/app/installations/${encodeURIComponent(args.installationId)}`, {
+    method: "DELETE",
+    headers: {
+      authorization: `Bearer ${jwt}`,
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28"
+    }
+  });
+  if (resp.status === 204 || resp.status === 404) return;
+  const body2 = await resp.json().catch(() => ({}));
+  throw new Error(`github app: uninstall failed HTTP ${resp.status} ${String(body2["message"] ?? "")}`.trim());
+}
+function appSettingsUrl(owner, slug6) {
+  const s2 = encodeURIComponent(slug6);
+  return owner.kind === "org" ? `https://github.com/organizations/${encodeURIComponent(owner.login)}/settings/apps/${s2}` : `https://github.com/settings/apps/${s2}`;
+}
+function appInstallPageUrl(slug6) {
+  return `https://github.com/apps/${encodeURIComponent(slug6)}/installations/new`;
+}
+function appDeleteUrl(owner, slug6) {
+  return `${appSettingsUrl(owner, slug6)}/advanced`;
+}
+function ownerMatches(app, owner) {
+  if (owner.kind === "org") {
+    return app.ownerType === "Organization" && app.ownerLogin.toLowerCase() === owner.login.toLowerCase();
+  }
+  if (app.ownerType !== "User") return false;
+  return !owner.login || app.ownerLogin.toLowerCase() === owner.login.toLowerCase();
+}
+function buildReuseCandidates(args) {
+  const { owner } = args;
+  const known = new Set(args.oasisApps.map((a2) => a2.appId));
+  const a = args.oasisApps.filter((app) => ownerMatches(app, owner)).map((app) => {
+    const verdict = app.permissions ? permissionVerdict(app.permissions) : null;
+    const selectable = verdict ? verdict.usable : true;
+    const action = !selectable ? "blocked" : app.installationIds.length === 0 ? "install" : "bind";
+    return {
+      kind: "oasis",
+      action,
+      appId: app.appId,
+      slug: app.slug,
+      ...app.installationIds[0] ? { installationId: app.installationIds[0] } : {},
+      usedBy: app.usedBy,
+      isOrgDefault: app.isOrgDefault,
+      permissionsUnknown: !verdict,
+      verdict,
+      selectable,
+      settingsUrl: appSettingsUrl(owner, app.slug),
+      permissionsUrl: `${appSettingsUrl(owner, app.slug)}/permissions`,
+      installUrl: appInstallPageUrl(app.slug)
+    };
+  });
+  const b2 = owner.kind === "org" ? args.installed.filter((i) => !known.has(i.appId) && i.org.toLowerCase() === owner.login.toLowerCase()).map((i) => {
+    const verdict = permissionVerdict(i.permissions);
+    return {
+      kind: "installed",
+      action: verdict.usable ? "import" : "blocked",
+      appId: i.appId,
+      slug: i.slug,
+      installationId: i.installationId,
+      usedBy: [],
+      isOrgDefault: false,
+      permissionsUnknown: false,
+      verdict,
+      selectable: verdict.usable,
+      settingsUrl: appSettingsUrl(owner, i.slug),
+      permissionsUrl: `${appSettingsUrl(owner, i.slug)}/permissions`,
+      installUrl: appInstallPageUrl(i.slug)
+    };
+  }) : [];
+  return [...a, ...b2].sort((x2, y) => Number(y.selectable) - Number(x2.selectable));
+}
+function buildAppInventory(args) {
+  const rows = /* @__PURE__ */ new Map();
+  const ownerOf = (login, type) => !login ? null : type === "Organization" ? { kind: "org", login } : { kind: "user", login };
+  for (const app of args.oasisApps) {
+    const inUse = app.isOrgDefault || app.usedBy.length > 0;
+    const owner = ownerOf(app.ownerLogin, app.ownerType);
+    rows.set(app.appId, {
+      appId: app.appId,
+      slug: app.slug,
+      ownerLogin: app.ownerLogin,
+      hasKey: true,
+      usedBy: app.usedBy,
+      isOrgDefault: app.isOrgDefault,
+      inUse,
+      installationIds: [...app.installationIds],
+      canUninstall: !inUse && app.installationIds.length > 0,
+      deleteUrl: owner && app.slug ? appDeleteUrl(owner, app.slug) : ""
+    });
+  }
+  for (const i of args.installed) {
+    const prev = rows.get(i.appId);
+    if (prev) {
+      if (!prev.installationIds.includes(i.installationId)) prev.installationIds.push(i.installationId);
+      prev.canUninstall = !prev.inUse && prev.installationIds.length > 0;
+      if (!prev.ownerLogin) prev.ownerLogin = i.org;
+      if (!prev.deleteUrl && prev.slug) prev.deleteUrl = appDeleteUrl({ kind: "org", login: i.org }, prev.slug);
+      continue;
+    }
+    rows.set(i.appId, {
+      appId: i.appId,
+      slug: i.slug,
+      ownerLogin: i.org,
+      hasKey: false,
+      usedBy: [],
+      isOrgDefault: false,
+      inUse: false,
+      installationIds: [i.installationId],
+      canUninstall: false,
+      deleteUrl: i.slug ? appDeleteUrl({ kind: "org", login: i.org }, i.slug) : ""
+    });
+  }
+  return [...rows.values()].sort((x2, y) => Number(x2.inUse) - Number(y.inUse) || x2.slug.localeCompare(y.slug));
+}
+var GITHUB_API2, defaultDeps3, REQUIRED_WRITE;
+var init_app_inventory = __esm({
+  "../connectors/src/github/app-inventory.ts"() {
+    "use strict";
+    init_app_auth();
+    init_app_manifest();
+    GITHUB_API2 = "https://api.github.com";
+    defaultDeps3 = { fetch: (...a) => globalThis.fetch(...a), nowMs: () => Date.now() };
+    REQUIRED_WRITE = ["contents", "pull_requests"];
+  }
+});
+
 // ../connectors/src/registry.ts
 function createConnectorBySlug(slug6) {
   switch (slug6) {
@@ -209291,6 +209625,7 @@ var init_src8 = __esm({
     init_app_auth();
     init_app_adopt();
     init_app_manifest();
+    init_app_inventory();
     init_registry2();
     init_provision();
     init_prepare_job();
@@ -209299,6 +209634,118 @@ var init_src8 = __esm({
   }
 });
 
+// ../server/src/github-app-inventory.ts
+async function collectOasisGithubApps(svc) {
+  const rows = (await svc.listVariables()).filter((r) => r.scope === "global" || r.scope === "personal");
+  const agents = await svc.listActors({ kind: "agent", status: "active" });
+  const nameOf2 = new Map(agents.map((a) => [a.id, a.name || a.id]));
+  const plain = (key2, actorId) => rows.find((r) => r.key === key2 && r.actorId === actorId && !r.encrypted)?.maskedValue ?? "";
+  const byAppId = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    if (r.key !== "GITHUB_APP_ID" || r.encrypted || !r.maskedValue) continue;
+    const e = byAppId.get(r.maskedValue) ?? {
+      slug: "",
+      installationId: "",
+      keyActorId: void 0,
+      usedBy: [],
+      isOrgDefault: false,
+      sources: []
+    };
+    e.sources.push(r.actorId);
+    if (!r.actorId) e.isOrgDefault = true;
+    else if (nameOf2.has(r.actorId) && !e.usedBy.includes(r.actorId)) e.usedBy.push(r.actorId);
+    byAppId.set(r.maskedValue, e);
+  }
+  const out = await Promise.all([...byAppId.entries()].map(async ([appId, e]) => {
+    let pem = null;
+    let keyActorId;
+    for (const src of [...e.sources].sort((a, b2) => Number(Boolean(a)) - Number(Boolean(b2)))) {
+      pem = await svc.revealVariable("GITHUB_APP_PRIVATE_KEY", src).catch(() => null);
+      if (pem) {
+        keyActorId = src;
+        break;
+      }
+    }
+    if (!pem) return null;
+    const slug6 = plain("GITHUB_APP_SLUG", keyActorId);
+    const storedInstallationId = plain("GITHUB_APP_INSTALLATION_ID", keyActorId);
+    const [meta, installs] = await Promise.all([
+      fetchAppSelfMetadata({ appId, privateKeyPem: pem }).catch(() => null),
+      listAppInstallations({ appId, privateKeyPem: pem }).catch(() => null)
+    ]);
+    const stored = installs?.find((i) => i.installationId === storedInstallationId) ?? installs?.[0];
+    const permissions = stored && Object.keys(stored.permissions).length > 0 ? stored.permissions : meta?.permissions ?? null;
+    const app = {
+      appId,
+      slug: meta?.slug || slug6,
+      ownerLogin: meta?.ownerLogin ?? "",
+      ownerType: meta?.ownerType ?? "",
+      usedBy: e.usedBy,
+      usedByNames: e.usedBy.map((id) => nameOf2.get(id) ?? id),
+      isOrgDefault: e.isOrgDefault,
+      // 列不出来（私钥失效等）时退回库里记的那一处，卸载时 404 也当成功。
+      installationIds: installs ? installs.map((i) => i.installationId) : storedInstallationId ? [storedInstallationId] : [],
+      permissions,
+      keyActorId
+    };
+    return app;
+  }));
+  return out.filter((a) => a !== null);
+}
+async function ghUser(token, path47) {
+  const r = await fetch(`https://api.github.com${path47}`, {
+    headers: {
+      authorization: `Bearer ${token}`,
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28"
+    }
+  });
+  return { status: r.status, body: r.ok ? await r.json().catch(() => null) : null };
+}
+async function githubLoginOf(token) {
+  const r = await ghUser(token, "/user").catch(() => null);
+  return r?.body?.login ?? "";
+}
+async function listMemberships(token) {
+  const r = await ghUser(
+    token,
+    "/user/memberships/orgs?state=active&per_page=100"
+  );
+  if (!r.body) return null;
+  return r.body.flatMap((m2) => m2.organization?.login ? [{ login: m2.organization.login, role: m2.role ?? "member" }] : []);
+}
+async function orgInstalledAppsFor(token, org) {
+  if (!token) return { state: { status: "needsAuth" }, apps: [] };
+  const m2 = await ghUser(token, `/user/memberships/orgs/${encodeURIComponent(org)}`);
+  if (m2.status === 401) return { state: { status: "needsAuth" }, apps: [] };
+  if (m2.body && m2.body.role !== "admin") return { state: { status: "notAdmin" }, apps: [] };
+  if (!m2.body && m2.status === 404) return { state: { status: "notAdmin" }, apps: [] };
+  if (!m2.body) return { state: { status: "needsAuth" }, apps: [] };
+  const r = await listOrgInstalledApps({ token, org });
+  if (r.status === "ok") return { state: { status: "ok" }, apps: r.apps };
+  if (r.status === "needsAuth") return { state: { status: "needsAuth" }, apps: [] };
+  return { state: { status: "error", message: r.message }, apps: [] };
+}
+async function pickUserToken(svc) {
+  const rows = await svc.listVariables();
+  const sources = [void 0, ...rows.filter((r) => r.key === "GITHUB_TOKEN" && r.scope === "personal" && r.actorId).map((r) => r.actorId)];
+  const tried = /* @__PURE__ */ new Set();
+  for (const src of sources) {
+    const token = await svc.revealVariable("GITHUB_TOKEN", src).catch(() => null);
+    if (!token || tried.has(token)) continue;
+    tried.add(token);
+    const memberships = await listMemberships(token).catch(() => null);
+    if (memberships) return { token, memberships };
+  }
+  return null;
+}
+var init_github_app_inventory = __esm({
+  "../server/src/github-app-inventory.ts"() {
+    "use strict";
+    init_src8();
+  }
+});
+
 // ../server/src/server.ts
 function isBundleFrozen(err) {
   return typeof err === "object" && err !== null && err.code === "TENANT_BUNDLE_FROZEN";
@@ -212740,7 +213187,7 @@ async function startOasisServer(opts) {
             entry = {
               // 旧 CLI 未带 waiterId 时给它塞一个服务端本地生成的——它绝不可能出现在 leave 上，
               // 也就绝不会误命中 leftWaiterIds、绝不会被别人的 leave 摘掉。行为与旧 CLI 相同。
-              waiterId: clientWaiterId ?? `server:${(0, import_node_crypto42.randomUUID)()}`,
+              waiterId: clientWaiterId ?? `server:${(0, import_node_crypto43.randomUUID)()}`,
               onResolve,
               expiresAt: expiresAt2,
               cleanup: () => clearTimeout(expiryTimer),
@@ -214878,57 +215325,71 @@ ${composed}`;
           }
           if (url.pathname === "/api/connectors/github/app/available" && req.method === "POST") {
             try {
+              const { actorId, owner } = JSON.parse(rawBody || "{}");
               const svc = await connectorActorsService();
               if (!svc) throw new Error("actors service unavailable");
-              const rows = await svc.listVariables();
-              const plain = (key2, actorId) => rows.find((r) => r.key === key2 && r.actorId === actorId && !r.encrypted)?.maskedValue ?? "";
-              const byAppId = /* @__PURE__ */ new Map();
-              for (const r of rows) {
-                if (r.key !== "GITHUB_APP_ID" || r.encrypted || !r.maskedValue) continue;
-                const appId = r.maskedValue;
-                const prev = byAppId.get(appId);
-                if (prev) {
-                  prev.usedBy += 1;
-                  if (!r.actorId && prev.scope === "personal") {
-                    prev.scope = "global";
-                    delete prev.actorId;
-                    prev.installationId = plain("GITHUB_APP_INSTALLATION_ID");
-                    prev.slug = plain("GITHUB_APP_SLUG");
-                  }
-                  continue;
-                }
-                byAppId.set(appId, {
-                  appId,
-                  slug: plain("GITHUB_APP_SLUG", r.actorId),
-                  installationId: plain("GITHUB_APP_INSTALLATION_ID", r.actorId),
-                  scope: r.actorId ? "personal" : "global",
-                  ...r.actorId ? { actorId: r.actorId } : {},
-                  usedBy: 1
-                });
+              const token = await svc.revealResolvedVariable("GITHUB_TOKEN", actorId);
+              const appOwner = owner?.kind === "org" && owner.login ? { kind: "org", login: owner.login } : { kind: "user", ...token ? { login: await githubLoginOf(token) } : {} };
+              const [oasisApps, installed] = await Promise.all([
+                collectOasisGithubApps(svc),
+                appOwner.kind === "org" ? orgInstalledAppsFor(token, appOwner.login) : Promise.resolve({ state: { status: "ok" }, apps: [] })
+              ]);
+              const names = new Map(oasisApps.map((a) => [a.appId, a.usedByNames]));
+              const candidates = buildReuseCandidates({ owner: appOwner, oasisApps, installed: installed.apps }).map((c) => ({ ...c, usedBy: names.get(c.appId) ?? [] }));
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ candidates, installed: installed.state }));
+            } catch (e) {
+              res.writeHead(500, { "content-type": "application/json" }).end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+          }
+          if (url.pathname === "/api/connectors/github/app/inventory" && req.method === "POST") {
+            try {
+              const svc = await connectorActorsService();
+              if (!svc) throw new Error("actors service unavailable");
+              const [oasisApps, picked] = await Promise.all([collectOasisGithubApps(svc), pickUserToken(svc)]);
+              const adminOrgs = picked ? picked.memberships.filter((m2) => m2.role === "admin").map((m2) => m2.login) : [];
+              const perOrg = picked ? await Promise.all(adminOrgs.map((org) => orgInstalledAppsFor(picked.token, org))) : [];
+              const rows = buildAppInventory({ oasisApps, installed: perOrg.flatMap((r) => r.apps) });
+              const names = new Map(oasisApps.map((a) => [a.appId, a.usedByNames]));
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({
+                rows: rows.map((r) => ({ ...r, usedBy: names.get(r.appId) ?? [] })),
+                /** 组织里装着的那部分列没列出来：needsAuth = 没有可用的 GitHub 登录；notAdmin = 不是任何组织的管理员。 */
+                installed: !picked ? { status: "needsAuth" } : adminOrgs.length === 0 ? { status: "notAdmin" } : perOrg.find((r) => r.state.status !== "ok")?.state ?? { status: "ok" },
+                orgs: adminOrgs
+              }));
+            } catch (e) {
+              res.writeHead(500, { "content-type": "application/json" }).end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+          }
+          if (url.pathname === "/api/connectors/github/app/uninstall" && req.method === "POST") {
+            try {
+              const { appIds } = JSON.parse(rawBody || "{}");
+              if (!Array.isArray(appIds) || appIds.length === 0 || !appIds.every((x2) => typeof x2 === "string")) {
+                res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: "\u8BF7\u5148\u52FE\u9009\u8981\u5378\u8F7D\u7684 App" }));
+                return;
               }
-              const apps = await Promise.all([...byAppId.values()].map(async (a) => {
-                const base = {
-                  appId: a.appId,
-                  slug: a.slug,
-                  account: a.slug ? `${a.slug}[bot]` : a.appId,
-                  isOrgDefault: a.scope === "global",
-                  usedBy: a.usedBy,
-                  ...a.slug ? { settingsUrl: appPermissionSettingsUrl({ slug: a.slug }) } : {}
-                };
+              const svc = await connectorActorsService();
+              if (!svc) throw new Error("actors service unavailable");
+              const apps = new Map((await collectOasisGithubApps(svc)).map((a) => [a.appId, a]));
+              const results = await Promise.all(appIds.map(async (appId) => {
+                const app = apps.get(appId);
+                if (!app) return { appId, ok: false, error: "Oasis \u6CA1\u6709\u8FD9\u4E2A App \u7684\u79C1\u94A5\uFF0C\u5378\u8F7D\u4E0D\u4E86\uFF0C\u8BF7\u53BB GitHub \u9875\u9762\u5904\u7406" };
+                if (app.isOrgDefault || app.usedBy.length > 0) {
+                  return { appId, slug: app.slug, ok: false, error: `\u8FD8\u6709 agent \u5728\u7528\uFF08${app.isOrgDefault ? "\u7EC4\u7EC7\u9ED8\u8BA4" : app.usedByNames.join("\u3001")}\uFF09\uFF0C\u4E0D\u80FD\u5378\u8F7D` };
+                }
+                const pem = await svc.revealVariable("GITHUB_APP_PRIVATE_KEY", app.keyActorId);
+                if (!pem) return { appId, slug: app.slug, ok: false, error: "\u79C1\u94A5\u8BFB\u4E0D\u51FA\u6765\uFF0C\u5378\u8F7D\u4E0D\u4E86" };
                 try {
-                  const pem = await svc.revealVariable("GITHUB_APP_PRIVATE_KEY", a.actorId);
-                  if (!pem || !a.installationId) return { ...base, permissionsUnknown: true };
-                  const perms = await fetchInstallationPermissions({
-                    appId: a.appId,
-                    privateKeyPem: pem,
-                    installationId: a.installationId
-                  });
-                  return { ...base, missing: missingAppPermissions(perms) };
-                } catch {
-                  return { ...base, permissionsUnknown: true };
+                  for (const installationId of app.installationIds) {
+                    await uninstallAppInstallation({ appId, privateKeyPem: pem, installationId });
+                  }
+                  return { appId, slug: app.slug, ok: true };
+                } catch (e) {
+                  return { appId, slug: app.slug, ok: false, error: `GitHub \u62D2\u7EDD\u4E86\u5378\u8F7D\uFF1A${String(e).replace(/^Error:\s*/, "")}` };
                 }
               }));
-              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ apps }));
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ results }));
             } catch (e) {
               res.writeHead(500, { "content-type": "application/json" }).end(JSON.stringify({ error: String(e) }));
             }
@@ -214957,9 +215418,11 @@ ${composed}`;
                 return;
               }
               const pick3 = (key2) => rows.find((r) => r.key === key2 && r.actorId === srcActor && !r.encrypted)?.maskedValue ?? "";
-              const installationId = pick3("GITHUB_APP_INSTALLATION_ID");
+              const storedInstallationId = pick3("GITHUB_APP_INSTALLATION_ID");
+              const live = await listAppInstallations({ appId, privateKeyPem: pem }).catch(() => null);
+              const installationId = live ? (live.find((i) => i.installationId === storedInstallationId) ?? live[0])?.installationId ?? "" : storedInstallationId;
               if (!installationId) {
-                res.writeHead(409, { "content-type": "application/json" }).end(JSON.stringify({ error: "\u8FD9\u4E2A App \u8FD8\u6CA1\u6709\u5B89\u88C5\u8BB0\u5F55\uFF0C\u65E0\u6CD5\u94F8 token" }));
+                res.writeHead(409, { "content-type": "application/json" }).end(JSON.stringify({ error: "\u8FD9\u4E2A App \u8FD8\u6CA1\u88C5\u5230\u4EFB\u4F55\u8D26\u53F7\u2014\u2014\u5148\u5728 GitHub \u4E0A\u5B89\u88C5\u5B83\uFF0C\u88C5\u597D\u540E\u518D\u70B9\u8FDE\u63A5" }));
                 return;
               }
               const slug6 = pick3("GITHUB_APP_SLUG");
@@ -214997,7 +215460,7 @@ ${composed}`;
                 const msg = String(e);
                 bad(
                   400,
-                  /HTTP 401/.test(msg) ? "App ID \u4E0E\u79C1\u94A5\u5BF9\u4E0D\u4E0A\u2014\u2014\u786E\u8BA4 App ID \u6284\u81EA\u540C\u4E00\u4E2A App \u7684\u8BBE\u7F6E\u9875" : /私钥解析失败/.test(msg) ? msg.replace(/^Error:\s*/, "").replace(/^github app:\s*/, "") : `GitHub \u62D2\u7EDD\u4E86\u8FD9\u5BF9\u51ED\u636E\uFF1A${msg}`
+                  /HTTP 401/.test(msg) ? "\u8FD9\u4E2A\u79C1\u94A5\u548C\u6240\u9009\u7684 App \u5BF9\u4E0D\u4E0A\u2014\u2014\u8BF7\u786E\u8BA4\u5B83\u662F\u5728\u8FD9\u4E2A App \u7684\u8BBE\u7F6E\u9875\u70B9 Generate a private key \u4E0B\u8F7D\u7684\u90A3\u4E00\u4EFD\uFF08\u624B\u586B App ID \u65F6\u4E5F\u6838\u5BF9\u4E00\u4E0B\u6709\u6CA1\u6709\u6284\u9519\uFF09" : /私钥解析失败/.test(msg) ? msg.replace(/^Error:\s*/, "").replace(/^github app:\s*/, "") : `GitHub \u62D2\u7EDD\u4E86\u8FD9\u5BF9\u51ED\u636E\uFF1A${msg}`
                 );
                 return;
               }
@@ -215667,14 +216130,14 @@ async function markDeliveredWithRetry(store, messageId, attempts = 3) {
   }
   return false;
 }
-var http, import_node_crypto42, CONNECTOR_AUTH_SNAPSHOT_TTL_MS, defaultResolveActor, enc, CHAT_OUTPUT_LIMIT, APPEND_TURN_START_WAIT_MS, STREAMING_PATHS, PLANNER_BLOCKING_CODES, WILL_VERBS, GOVERNANCE_COMMANDS, READ_ONLY_COMMANDS, isAgent, isHuman;
+var http, import_node_crypto43, CONNECTOR_AUTH_SNAPSHOT_TTL_MS, defaultResolveActor, enc, CHAT_OUTPUT_LIMIT, APPEND_TURN_START_WAIT_MS, STREAMING_PATHS, PLANNER_BLOCKING_CODES, WILL_VERBS, GOVERNANCE_COMMANDS, READ_ONLY_COMMANDS, isAgent, isHuman;
 var init_server3 = __esm({
   "../server/src/server.ts"() {
     "use strict";
     init_src();
     init_file_limits2();
     http = __toESM(require("node:http"), 1);
-    import_node_crypto42 = require("node:crypto");
+    import_node_crypto43 = require("node:crypto");
     init_chat_session();
     init_chat_system_message();
     init_sealed_node_receipt();
@@ -215740,6 +216203,7 @@ var init_server3 = __esm({
     init_child_live_turn();
     init_registry_audit_sink();
     init_src8();
+    init_github_app_inventory();
     init_continuation3();
     CONNECTOR_AUTH_SNAPSHOT_TTL_MS = 30 * 60 * 1e3;
     defaultResolveActor = (token) => token.startsWith("token:") ? token.slice("token:".length) : null;
@@ -215854,7 +216318,7 @@ function createNodeTokenStore(file) {
   return {
     issue(nodeId) {
       const table = read3();
-      const token = `ont_${(0, import_node_crypto43.randomBytes)(24).toString("base64url")}`;
+      const token = `ont_${(0, import_node_crypto44.randomBytes)(24).toString("base64url")}`;
       table[token] = nodeId;
       write(table);
       return token;
@@ -215914,7 +216378,7 @@ function createEnrollTokenStore(defaultTtlMs = 30 * 60 * 1e3, file) {
   return {
     issue(name, ttlMs = defaultTtlMs, companyId) {
       const m2 = prune();
-      const token = `ent_${(0, import_node_crypto43.randomBytes)(24).toString("base64url")}`;
+      const token = `ent_${(0, import_node_crypto44.randomBytes)(24).toString("base64url")}`;
       const expiresAt2 = Date.now() + ttlMs;
       m2.set(token, { name, expiresAt: expiresAt2, ...companyId !== void 0 ? { companyId } : {} });
       write(m2);
@@ -215963,33 +216427,33 @@ function createEnrollTokenStore(defaultTtlMs = 30 * 60 * 1e3, file) {
     }
   };
 }
-var import_node_crypto43, fs22, path21, SESSION_TOKEN_PREFIX, b64url2, fromB64url, readOrCreateSecret, sign, signatureMatches, isTokenClaims;
+var import_node_crypto44, fs22, path21, SESSION_TOKEN_PREFIX, b64url2, fromB64url, readOrCreateSecret, sign, signatureMatches, isTokenClaims;
 var init_tokens = __esm({
   "../server/src/tokens.ts"() {
     "use strict";
-    import_node_crypto43 = require("node:crypto");
+    import_node_crypto44 = require("node:crypto");
     fs22 = __toESM(require("node:fs"), 1);
     path21 = __toESM(require("node:path"), 1);
     SESSION_TOKEN_PREFIX = "oat_v2_";
     b64url2 = (value2) => Buffer.from(value2).toString("base64url");
     fromB64url = (value2) => Buffer.from(value2, "base64url").toString("utf8");
     readOrCreateSecret = (file) => {
-      if (!file) return (0, import_node_crypto43.randomBytes)(32);
+      if (!file) return (0, import_node_crypto44.randomBytes)(32);
       try {
         const raw = fs22.readFileSync(file, "utf8").trim();
         if (raw) return Buffer.from(raw, "base64url");
       } catch {
       }
-      const secret = (0, import_node_crypto43.randomBytes)(32);
+      const secret = (0, import_node_crypto44.randomBytes)(32);
       fs22.mkdirSync(path21.dirname(file), { recursive: true });
       fs22.writeFileSync(file, secret.toString("base64url"), { mode: 384 });
       return secret;
     };
-    sign = (secret, payload2) => (0, import_node_crypto43.createHmac)("sha256", secret).update(payload2).digest("base64url");
+    sign = (secret, payload2) => (0, import_node_crypto44.createHmac)("sha256", secret).update(payload2).digest("base64url");
     signatureMatches = (actual, expected) => {
       const a = Buffer.from(actual);
       const b2 = Buffer.from(expected);
-      return a.length === b2.length && (0, import_node_crypto43.timingSafeEqual)(a, b2);
+      return a.length === b2.length && (0, import_node_crypto44.timingSafeEqual)(a, b2);
     };
     isTokenClaims = (value2) => {
       if (value2 === null || typeof value2 !== "object") return false;
@@ -216051,31 +216515,31 @@ function createDataplaneTokenIssuer(opts = {}) {
     }
   };
 }
-var import_node_crypto44, fs23, path22, PREFIX2, b64url3, fromB64url2, sign2, sigMatches, readOrCreateSecret2, isClaims, isDataplaneToken;
+var import_node_crypto45, fs23, path22, PREFIX2, b64url3, fromB64url2, sign2, sigMatches, readOrCreateSecret2, isClaims, isDataplaneToken;
 var init_session_dataplane_token = __esm({
   "../server/src/session-dataplane-token.ts"() {
     "use strict";
-    import_node_crypto44 = require("node:crypto");
+    import_node_crypto45 = require("node:crypto");
     fs23 = __toESM(require("node:fs"), 1);
     path22 = __toESM(require("node:path"), 1);
     init_src();
     PREFIX2 = "osd_";
     b64url3 = (v2) => Buffer.from(v2, "utf8").toString("base64url");
     fromB64url2 = (v2) => Buffer.from(v2, "base64url").toString("utf8");
-    sign2 = (secret, payload2) => (0, import_node_crypto44.createHmac)("sha256", secret).update(payload2).digest("base64url");
+    sign2 = (secret, payload2) => (0, import_node_crypto45.createHmac)("sha256", secret).update(payload2).digest("base64url");
     sigMatches = (actual, expected) => {
       const a = Buffer.from(actual);
       const b2 = Buffer.from(expected);
-      return a.length === b2.length && (0, import_node_crypto44.timingSafeEqual)(a, b2);
+      return a.length === b2.length && (0, import_node_crypto45.timingSafeEqual)(a, b2);
     };
     readOrCreateSecret2 = (file) => {
-      if (!file) return (0, import_node_crypto44.randomBytes)(32);
+      if (!file) return (0, import_node_crypto45.randomBytes)(32);
       try {
         const raw = fs23.readFileSync(file, "utf8").trim();
         if (raw) return Buffer.from(raw, "base64url");
       } catch {
       }
-      const secret = (0, import_node_crypto44.randomBytes)(32);
+      const secret = (0, import_node_crypto45.randomBytes)(32);
       fs23.mkdirSync(path22.dirname(file), { recursive: true });
       fs23.writeFileSync(file, secret.toString("base64url"), { mode: 384 });
       return secret;
@@ -218877,11 +219341,11 @@ function onlyHits(pool, q2) {
   if (!q2.requireMatch || q2.keywords.length === 0) return [...pool];
   return pool.filter((r) => memoryMatchScore(r, q2.keywords) > 0);
 }
-var import_node_crypto45, MemoryActorMemoryStore, toIndexEntry;
+var import_node_crypto46, MemoryActorMemoryStore, toIndexEntry;
 var init_memory_actor_memory_store = __esm({
   "../testkit/src/memory-actor-memory-store.ts"() {
     "use strict";
-    import_node_crypto45 = require("node:crypto");
+    import_node_crypto46 = require("node:crypto");
     init_src();
     MemoryActorMemoryStore = class {
       rows = /* @__PURE__ */ new Map();
@@ -218935,7 +219399,7 @@ var init_memory_actor_memory_store = __esm({
       async write(input, now) {
         if (input.memId === void 0) {
           const rec2 = {
-            memId: `mem:${(0, import_node_crypto45.randomUUID)()}`,
+            memId: `mem:${(0, import_node_crypto46.randomUUID)()}`,
             actorId: input.actorId,
             projectId: input.projectId,
             keywords: [...input.keywords],
@@ -220634,13 +221098,13 @@ var init_stats = __esm({
 
 // ../server/src/domains/projects/project-id.ts
 function randomProjectId() {
-  return projectIdFromUuid((0, import_node_crypto46.randomUUID)());
+  return projectIdFromUuid((0, import_node_crypto47.randomUUID)());
 }
-var import_node_crypto46;
+var import_node_crypto47;
 var init_project_id = __esm({
   "../server/src/domains/projects/project-id.ts"() {
     "use strict";
-    import_node_crypto46 = require("node:crypto");
+    import_node_crypto47 = require("node:crypto");
     init_src();
   }
 });
@@ -222715,12 +223179,12 @@ function applyTurnPatch(t, patch) {
     ...patch.lastError !== void 0 ? { lastError: patch.lastError } : {}
   };
 }
-var import_node_crypto47, fs24, path23, NdjsonOplogStore, DirBlobStore, MUTATORS, FileTypeRegistryStore, FileRoleRegistryStore, FileRegistryStore, FileAssistantBindStore, FileHumanPrefsStore, FileProjectStateStore, FileArtifactStateStore, FileTraceStore, MemoryChatSessionStore, FileChatSessionStore, MemoryChatTurnStore, FileChatTurnStore, MemoryReadMarkerStore, FileReadMarkerStore;
+var import_node_crypto48, fs24, path23, NdjsonOplogStore, DirBlobStore, MUTATORS, FileTypeRegistryStore, FileRoleRegistryStore, FileRegistryStore, FileAssistantBindStore, FileHumanPrefsStore, FileProjectStateStore, FileArtifactStateStore, FileTraceStore, MemoryChatSessionStore, FileChatSessionStore, MemoryChatTurnStore, FileChatTurnStore, MemoryReadMarkerStore, FileReadMarkerStore;
 var init_dev_store = __esm({
   "../server/src/dev-store.ts"() {
     "use strict";
     init_src();
-    import_node_crypto47 = require("node:crypto");
+    import_node_crypto48 = require("node:crypto");
     fs24 = __toESM(require("node:fs"), 1);
     path23 = __toESM(require("node:path"), 1);
     init_src();
@@ -222774,7 +223238,7 @@ var init_dev_store = __esm({
         return path23.join(this.dir, hash3);
       }
       async put(bytes2) {
-        const hash3 = (0, import_node_crypto47.createHash)("sha256").update(bytes2).digest("hex");
+        const hash3 = (0, import_node_crypto48.createHash)("sha256").update(bytes2).digest("hex");
         const file = this.fileOf(hash3);
         if (!fs24.existsSync(file)) fs24.writeFileSync(file, bytes2);
         return hash3;
@@ -224069,7 +224533,7 @@ var init_company_engine_router = __esm({
 
 // ../server/src/skill-market-client.ts
 function digestOf2(bytes2) {
-  return `sha256:${(0, import_node_crypto48.createHash)("sha256").update(bytes2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto49.createHash)("sha256").update(bytes2).digest("hex")}`;
 }
 function createSkillMarketClientFromEnv(env = process.env) {
   const base = env["SKILL_MARKET_BASE_URL"];
@@ -224080,11 +224544,11 @@ function createSkillMarketClientFromEnv(env = process.env) {
 function sleep4(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
-var import_node_crypto48, DisabledSkillMarketClient, FakeSkillMarketClient, HttpSkillMarketClient;
+var import_node_crypto49, DisabledSkillMarketClient, FakeSkillMarketClient, HttpSkillMarketClient;
 var init_skill_market_client = __esm({
   "../server/src/skill-market-client.ts"() {
     "use strict";
-    import_node_crypto48 = require("node:crypto");
+    import_node_crypto49 = require("node:crypto");
     init_src();
     DisabledSkillMarketClient = class {
       async listSkills(_input) {
@@ -224935,7 +225399,7 @@ async function copySessionOutputs(deps) {
       continue;
     }
     const saved = existing?.[file.path];
-    if (saved && savedContentHash(saved) === (0, import_node_crypto49.createHash)("sha256").update(bytes2).digest("hex")) {
+    if (saved && savedContentHash(saved) === (0, import_node_crypto50.createHash)("sha256").update(bytes2).digest("hex")) {
       const aligned = { ...saved, size: bytes2.length, mtime: file.mtime };
       delete aligned.editedAt;
       realigned.push(aligned);
@@ -225032,11 +225496,11 @@ function createOutputCopyScheduler(deps) {
     }
   };
 }
-var import_node_crypto49, OUTPUT_COPY_LIMITS;
+var import_node_crypto50, OUTPUT_COPY_LIMITS;
 var init_outputs_copy = __esm({
   "../server/src/domains/chat-sessions/outputs-copy.ts"() {
     "use strict";
-    import_node_crypto49 = require("node:crypto");
+    import_node_crypto50 = require("node:crypto");
     init_src();
     OUTPUT_COPY_LIMITS = {
       maxFileBytes: FILE_CONTENT_MAX_BYTES,
@@ -225421,11 +225885,11 @@ function typeDefError(def, mode) {
   }
   return null;
 }
-var import_node_crypto50, RESERVED_FIELD_NAMES, ARTIFACT_TYPE_ACCENTS, TYPE_DEF_SCHEMA, TypesAdminService;
+var import_node_crypto51, RESERVED_FIELD_NAMES, ARTIFACT_TYPE_ACCENTS, TYPE_DEF_SCHEMA, TypesAdminService;
 var init_types_admin = __esm({
   "../server/src/types-admin.ts"() {
     "use strict";
-    import_node_crypto50 = require("node:crypto");
+    import_node_crypto51 = require("node:crypto");
     init_zod();
     init_src7();
     init_config_audit();
@@ -225552,7 +226016,7 @@ var init_types_admin = __esm({
       async trace(change, target, by, detail) {
         try {
           await this.audit?.({
-            id: `reg_${(0, import_node_crypto50.randomUUID)()}`,
+            id: `reg_${(0, import_node_crypto51.randomUUID)()}`,
             actor: by ?? SYSTEM_CONFIG_ACTOR,
             kind: "registry_change",
             target,
@@ -225700,11 +226164,11 @@ function roleDefError(def, mode) {
   }
   return null;
 }
-var import_node_crypto51, ACCENTS, ROLE_DEF_SCHEMA, RolesAdminService;
+var import_node_crypto52, ACCENTS, ROLE_DEF_SCHEMA, RolesAdminService;
 var init_roles_admin = __esm({
   "../server/src/roles-admin.ts"() {
     "use strict";
-    import_node_crypto51 = require("node:crypto");
+    import_node_crypto52 = require("node:crypto");
     init_zod();
     init_src7();
     init_config_audit();
@@ -225729,7 +226193,7 @@ var init_roles_admin = __esm({
       async trace(change, target, by, detail) {
         try {
           await this.deps.audit?.({
-            id: `reg_${(0, import_node_crypto51.randomUUID)()}`,
+            id: `reg_${(0, import_node_crypto52.randomUUID)()}`,
             actor: by ?? SYSTEM_CONFIG_ACTOR,
             kind: "registry_change",
             target,
@@ -226920,14 +227384,13 @@ function frameTokenTotal(usage) {
   return (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0) + (usage.cacheReadTokens ?? 0) + (usage.cacheCreationTokens ?? 0);
 }
 async function backfillRunModel(target, run, model, modelSource, warn) {
-  const effectiveModel = actualModelId(model);
-  if (!effectiveModel) return;
-  if (hasModelName(run.effectiveModel)) return;
+  const patch = preferRunModel(
+    { effectiveModel: run.effectiveModel, modelSource: run.modelSource },
+    { effectiveModel: model, modelSource: modelSource === "requested" ? "requested" : "runtime" }
+  );
+  if (!patch) return;
   try {
-    await target.store.updateRun(target.runId, {
-      effectiveModel,
-      modelSource: modelSource === "requested" ? "requested" : "runtime"
-    });
+    await target.store.updateRun(target.runId, patch);
   } catch (err) {
     warn(`[usage-ledger] run ${target.runId} \u7684\u6A21\u578B\u540D\u8865\u5199\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u4F1A\u8BDD\uFF09\uFF1A${String(err)}`);
   }
@@ -227693,8 +228156,10 @@ var init_sink = __esm({
           const isErr = status === "failed" || status === "timeout";
           const errorFields = isErr ? { errorCode: update.exit.reason ?? "error", errorMessage: formatExitError(update.exit) } : {};
           const exitModel = actualModelId(update.exit.model);
-          const model = exitModel ?? actualModelId(st.observedModel) ?? null;
-          const modelSource = exitModel && update.exit.modelSource === "requested" ? "requested" : "runtime";
+          const observedModel = actualModelId(st.observedModel);
+          const exitIsRequestedOnly = update.exit.modelSource === "requested";
+          const model = (exitIsRequestedOnly ? observedModel ?? exitModel : exitModel ?? observedModel) ?? null;
+          const modelSource = model && model === exitModel && exitIsRequestedOnly && !observedModel ? "requested" : "runtime";
           const exitRtId = typeof update.exit.runtimeSessionId === "string" && update.exit.runtimeSessionId.trim() ? update.exit.runtimeSessionId.trim() : void 0;
           if (exitRtId) st.baseMetadata = { ...st.baseMetadata, runtimeSessionId: exitRtId };
           const exitWorkdir = typeof update.exit.workdirRef === "string" && update.exit.workdirRef.trim() ? update.exit.workdirRef.trim() : void 0;
@@ -227725,6 +228190,12 @@ var init_sink = __esm({
               createdAt: update.exit.at
             });
           }
+          const currentRun = model ? await this.store.getRun(st.runId).catch(() => null) : null;
+          const modelPatch = model ? preferRunModel(
+            { effectiveModel: currentRun?.effectiveModel, modelSource: currentRun?.modelSource },
+            { effectiveModel: model, modelSource },
+            "replace"
+          ) : null;
           const finished = await this.store.updateRun(st.runId, {
             status,
             endedAt: update.exit.at,
@@ -227740,7 +228211,7 @@ var init_sink = __esm({
             // token/成本来自 adapter 解析 stream-json（含 cache）；不带则不写、保持 null。
             ...update.exit.usage ? { usage: update.exit.usage } : {},
             // effectiveModel/modelSource 喂用量聚合（聚合键含 model）；与 chat/finishRun 路径一致。
-            ...model ? { effectiveModel: model, modelSource } : {},
+            ...modelPatch ?? {},
             // metadata 整列替换：必须带上 baseMetadata（bundleManifest/runtimeSessionId）一起写回。
             // model 有则并入（前端 findModelInValue 直接读 metadata.model）。**不能只在有 model 时才写**
             // ——否则无 model 的 run（如回捕型 runtime 没报模型）会把 exit 校正过的会话号丢掉。
@@ -228095,10 +228566,8 @@ function wireRecoveredChatTurn(deps) {
     live.emit({ type: "done", ...plan.runtimeSessionId ? { sessionId: plan.runtimeSessionId } : {} });
     live.finish(failed ? "error" : "done");
     deps.unregister();
-    const nativeSessionMetadata = info.runtimeSessionId && info.runtimeSessionId !== plan.runtimeSessionId ? nativeRuntimeSessionMetadata(
-      (await trace.getRun(plan.runId).catch(() => null))?.metadata,
-      info.runtimeSessionId
-    ) : void 0;
+    const currentRun = await trace.getRun(plan.runId).catch(() => null);
+    const nativeSessionMetadata = info.runtimeSessionId && info.runtimeSessionId !== plan.runtimeSessionId ? nativeRuntimeSessionMetadata(currentRun?.metadata, info.runtimeSessionId) : void 0;
     enqueueTrace(async () => {
       await appender.append([{
         eventType: "run.finished",
@@ -228107,7 +228576,7 @@ function wireRecoveredChatTurn(deps) {
         startedAt: finishedAt
       }]);
       await appender.update({
-        ...runTerminalPatch(info, plan.startedAt, finishedAt),
+        ...runTerminalPatch(info, plan.startedAt, finishedAt, currentRun),
         // 运行时自己退干净了，但平台没把输出接全——运行记录不许写「成功」（Bug 0123）。
         // 退出帧本身已经是失败时保持它的归因，只补一句缺口说明。
         ...outputGapRunPatch(droppedFrames, exitIsFailure, info),
@@ -228331,7 +228800,7 @@ async function reconcileChatExitFrame(deps) {
       ];
       await deps.trace.appendEvents(row.runId, seqless.map((e, i) => ({ ...e, seq: baseSeq + i + 1 })));
       await deps.trace.updateRun(row.runId, {
-        ...runTerminalPatch(info, run.startedAt, finishedAt),
+        ...runTerminalPatch(info, run.startedAt, finishedAt, run),
         ...outputGapRunPatch(droppedFrames, exitIsFailure, info),
         // 首轮占位会话号 → runtime 报回的原生号（Bug 0171，判据见本函数上方那一段）。
         ...nativeSessionMetadata ? { metadata: nativeSessionMetadata } : {}
@@ -228560,6 +229029,7 @@ var init_chat_recovery = __esm({
     "use strict";
     init_file_restore();
     init_continuation3();
+    init_src();
     init_chat_parts();
     init_sink();
     init_usage_ledger();
@@ -228587,7 +229057,7 @@ var init_chat_recovery = __esm({
       const existing = formatExitError(info);
       return { errorMessage: existing ? `${existing}\uFF1B${gap}` : gap };
     };
-    runTerminalPatch = (info, startedAt, endedAt) => ({
+    runTerminalPatch = (info, startedAt, endedAt, current) => ({
       status: classifySessionExitStatus(info),
       endedAt,
       durationMs: Date.parse(endedAt) - Date.parse(startedAt),
@@ -228600,15 +229070,19 @@ var init_chat_recovery = __esm({
       // 不能用 null 覆盖，否则恢复轮的 token 会掉进「未知模型」桶。
       // 伪型号（`default[]` / `auto`）不是模型名，不写；请求值（`requested`）与实际值分开记来源
       // ——重挂路与 chat 主路、派发路三处必须同一判据，否则同一条 run 换条路收尾归属就变了。
-      ...chatExitModelFields(info.model, null, null, info.modelSource)
+      ...preferRunModel(
+        { effectiveModel: current?.effectiveModel, modelSource: current?.modelSource },
+        chatExitModelFields(info.model, null, null, info.modelSource),
+        "replace"
+      ) ?? {}
     });
   }
 });
 
 // ../server/src/auth/crypto.ts
 function hashPassword(password) {
-  const salt = (0, import_node_crypto52.randomBytes)(16);
-  const dk = (0, import_node_crypto52.scryptSync)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, maxmem: 64 * 1024 * 1024 });
+  const salt = (0, import_node_crypto53.randomBytes)(16);
+  const dk = (0, import_node_crypto53.scryptSync)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, maxmem: 64 * 1024 * 1024 });
   return `scrypt$${SCRYPT_N}$${salt.toString("base64url")}$${dk.toString("base64url")}`;
 }
 function verifyPassword(password, stored) {
@@ -228625,8 +229099,8 @@ function verifyPassword(password, stored) {
     return false;
   }
   if (expected.length === 0) return false;
-  const dk = (0, import_node_crypto52.scryptSync)(password, salt, expected.length, { N, maxmem: 64 * 1024 * 1024 });
-  return dk.length === expected.length && (0, import_node_crypto52.timingSafeEqual)(dk, expected);
+  const dk = (0, import_node_crypto53.scryptSync)(password, salt, expected.length, { N, maxmem: 64 * 1024 * 1024 });
+  return dk.length === expected.length && (0, import_node_crypto53.timingSafeEqual)(dk, expected);
 }
 function b64urlJson(value2) {
   return Buffer.from(JSON.stringify(value2)).toString("base64url");
@@ -228634,17 +229108,17 @@ function b64urlJson(value2) {
 function signSession(claims, secret) {
   const head = b64urlJson({ alg: "HS256", typ: "JWT" });
   const body2 = b64urlJson(claims);
-  const sig = (0, import_node_crypto52.createHmac)("sha256", secret).update(`${head}.${body2}`).digest("base64url");
+  const sig = (0, import_node_crypto53.createHmac)("sha256", secret).update(`${head}.${body2}`).digest("base64url");
   return `${head}.${body2}.${sig}`;
 }
 function verifySession(token, secret, nowMs) {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
   const [head, body2, sig] = parts;
-  const expected = (0, import_node_crypto52.createHmac)("sha256", secret).update(`${head}.${body2}`).digest("base64url");
+  const expected = (0, import_node_crypto53.createHmac)("sha256", secret).update(`${head}.${body2}`).digest("base64url");
   const got = Buffer.from(sig);
   const exp = Buffer.from(expected);
-  if (got.length !== exp.length || !(0, import_node_crypto52.timingSafeEqual)(got, exp)) return null;
+  if (got.length !== exp.length || !(0, import_node_crypto53.timingSafeEqual)(got, exp)) return null;
   let claims;
   try {
     claims = JSON.parse(Buffer.from(body2, "base64url").toString("utf8"));
@@ -228656,21 +229130,21 @@ function verifySession(token, secret, nowMs) {
   return claims;
 }
 function generateCode() {
-  return String((0, import_node_crypto52.randomInt)(0, 1e6)).padStart(6, "0");
+  return String((0, import_node_crypto53.randomInt)(0, 1e6)).padStart(6, "0");
 }
 function hashCode(code2, secret) {
-  return (0, import_node_crypto52.createHmac)("sha256", secret).update(`code:${code2}`).digest("base64url");
+  return (0, import_node_crypto53.createHmac)("sha256", secret).update(`code:${code2}`).digest("base64url");
 }
 function safeEqualHash(a, b2) {
   const ba = Buffer.from(a);
   const bb = Buffer.from(b2);
-  return ba.length === bb.length && (0, import_node_crypto52.timingSafeEqual)(ba, bb);
+  return ba.length === bb.length && (0, import_node_crypto53.timingSafeEqual)(ba, bb);
 }
-var import_node_crypto52, SCRYPT_N, SCRYPT_KEYLEN;
+var import_node_crypto53, SCRYPT_N, SCRYPT_KEYLEN;
 var init_crypto2 = __esm({
   "../server/src/auth/crypto.ts"() {
     "use strict";
-    import_node_crypto52 = require("node:crypto");
+    import_node_crypto53 = require("node:crypto");
     SCRYPT_N = 16384;
     SCRYPT_KEYLEN = 32;
   }
@@ -230054,18 +230528,18 @@ function variableKeyFromEnv(env = process.env) {
     return buf;
   }
   if (env.NODE_ENV === "production") throw new Error("OASIS_VAR_KEY is required in production");
-  return (0, import_node_crypto53.createHash)("sha256").update("oasis-dev-only-variable-key").digest();
+  return (0, import_node_crypto54.createHash)("sha256").update("oasis-dev-only-variable-key").digest();
 }
 function dedupe2(ids2) {
   return [...new Set(ids2.filter((x2) => typeof x2 === "string" && x2.length > 0))];
 }
-var import_node_crypto53, REDACTED_MARKER, ActorsService, MASK_TAIL_MIN_LENGTH, mask, changedKeys;
+var import_node_crypto54, REDACTED_MARKER, ActorsService, MASK_TAIL_MIN_LENGTH, mask, changedKeys;
 var init_service5 = __esm({
   "../server/src/domains/actors/service.ts"() {
     "use strict";
     init_file_limits2();
     init_keyed_mutex();
-    import_node_crypto53 = require("node:crypto");
+    import_node_crypto54 = require("node:crypto");
     init_skill_fetcher();
     init_identity();
     init_migrate();
@@ -230689,7 +231163,7 @@ ${input.description}
        */
       buildSkillFile(skillId, path47, content3, now) {
         const bytes2 = new TextEncoder().encode(content3);
-        const blobHash = (0, import_node_crypto53.createHash)("sha256").update(bytes2).digest("hex");
+        const blobHash = (0, import_node_crypto54.createHash)("sha256").update(bytes2).digest("hex");
         return { skillId, path: path47, content: content3, blobHash, size: bytes2.length, updatedAt: now };
       }
       /**
@@ -231812,15 +232286,15 @@ ${input.description}
         return hit ? { value: hit.value, ...hit.origin ? { origin: hit.origin } : {} } : null;
       }
       encrypt(plain) {
-        const iv = (0, import_node_crypto53.randomBytes)(12);
-        const cipher = (0, import_node_crypto53.createCipheriv)("aes-256-gcm", this.opts.variableKey, iv);
+        const iv = (0, import_node_crypto54.randomBytes)(12);
+        const cipher = (0, import_node_crypto54.createCipheriv)("aes-256-gcm", this.opts.variableKey, iv);
         const enc3 = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
         return [iv.toString("base64"), cipher.getAuthTag().toString("base64"), enc3.toString("base64")].join(".");
       }
       decrypt(packed) {
         const [iv, tag, data] = packed.split(".");
         if (!iv || !tag || typeof data !== "string") throw new Error("malformed ciphertext");
-        const decipher = (0, import_node_crypto53.createDecipheriv)("aes-256-gcm", this.opts.variableKey, Buffer.from(iv, "base64"));
+        const decipher = (0, import_node_crypto54.createDecipheriv)("aes-256-gcm", this.opts.variableKey, Buffer.from(iv, "base64"));
         decipher.setAuthTag(Buffer.from(tag, "base64"));
         return Buffer.concat([decipher.update(Buffer.from(data, "base64")), decipher.final()]).toString("utf8");
       }
@@ -232434,7 +232908,7 @@ async function listSkillMetadataForActor(args) {
     usedDirs.add(dir);
     const sorted = [...metas].sort((a, b2) => a.path.localeCompare(b2.path));
     let latest = "1970-01-01T00:00:00.000Z";
-    const hasher = (0, import_node_crypto54.createHash)("sha256");
+    const hasher = (0, import_node_crypto55.createHash)("sha256");
     for (const m2 of sorted) {
       if (m2.updatedAt > latest) latest = m2.updatedAt;
       hasher.update(m2.path);
@@ -232459,11 +232933,11 @@ async function listSkillMetadataForActor(args) {
     const dir = sanitizeSkillDir(c.name, c.slug);
     if (usedDirs.has(dir)) continue;
     usedDirs.add(dir);
-    const hasher = (0, import_node_crypto54.createHash)("sha256");
+    const hasher = (0, import_node_crypto55.createHash)("sha256");
     for (const p2 of paths) {
       hasher.update(p2);
       hasher.update("\0");
-      hasher.update((0, import_node_crypto54.createHash)("sha256").update(c.files[p2]).digest("hex"));
+      hasher.update((0, import_node_crypto55.createHash)("sha256").update(c.files[p2]).digest("hex"));
       hasher.update("\0");
     }
     out.push({
@@ -232484,11 +232958,11 @@ async function listSkillMetadataForActor(args) {
     const dir = sanitizeSkillDir(b2.name, b2.id);
     if (usedDirs.has(dir)) continue;
     usedDirs.add(dir);
-    const hasher = (0, import_node_crypto54.createHash)("sha256");
+    const hasher = (0, import_node_crypto55.createHash)("sha256");
     for (const p2 of paths) {
       hasher.update(p2);
       hasher.update("\0");
-      hasher.update((0, import_node_crypto54.createHash)("sha256").update(b2.files[p2]).digest("hex"));
+      hasher.update((0, import_node_crypto55.createHash)("sha256").update(b2.files[p2]).digest("hex"));
       hasher.update("\0");
     }
     out.push({
@@ -232508,7 +232982,7 @@ function builtinSkillToFiles(b2) {
     skillId: `builtin:${b2.id}`,
     path: path47,
     content: content3,
-    blobHash: (0, import_node_crypto54.createHash)("sha256").update(content3).digest("hex"),
+    blobHash: (0, import_node_crypto55.createHash)("sha256").update(content3).digest("hex"),
     size: Buffer.byteLength(content3, "utf8"),
     updatedAt: "1970-01-01T00:00:00.000Z"
   }));
@@ -232532,7 +233006,7 @@ function sanitizeSkillDir(name, fallbackId) {
   if (byName) return byName;
   const byId = fallbackId ? fold2(fallbackId) : "";
   if (byId) return byId;
-  return `skill-${(0, import_node_crypto54.createHash)("sha256").update(name).digest("hex").slice(0, 8)}`;
+  return `skill-${(0, import_node_crypto55.createHash)("sha256").update(name).digest("hex").slice(0, 8)}`;
 }
 async function materializeSkillFiles(args) {
   const skills = await args.service.listInstalledSkillsForActor(args.actorId);
@@ -232565,7 +233039,7 @@ function connectorSkillToFiles(c) {
     skillId: c.id,
     path: path47,
     content: content3,
-    blobHash: (0, import_node_crypto54.createHash)("sha256").update(content3).digest("hex"),
+    blobHash: (0, import_node_crypto55.createHash)("sha256").update(content3).digest("hex"),
     size: Buffer.byteLength(content3, "utf8"),
     updatedAt: "1970-01-01T00:00:00.000Z"
   }));
@@ -232582,11 +233056,11 @@ function connectorSkillDisplayRows(connectorSkills, enabledConnectors) {
     ...s2.version !== void 0 ? { version: s2.version } : {}
   }));
 }
-var import_node_crypto54;
+var import_node_crypto55;
 var init_skill_materializer = __esm({
   "../server/src/domains/actors/skill-materializer.ts"() {
     "use strict";
-    import_node_crypto54 = require("node:crypto");
+    import_node_crypto55 = require("node:crypto");
   }
 });
 
@@ -234693,7 +235167,7 @@ function createActorsDomain(opts) {
     ...kernel !== void 0 ? { onRolesChanged: (a, r) => kernel.setActorRoles(a, r) } : {},
     audit: async (entry) => {
       await opts.audit?.({
-        id: `reg_${(0, import_node_crypto55.randomUUID)()}`,
+        id: `reg_${(0, import_node_crypto56.randomUUID)()}`,
         actor: entry.by,
         kind: "registry_change",
         target: entry.actorId,
@@ -234733,11 +235207,11 @@ function createActorsDomain(opts) {
     register: actorsDomain({ resolveCtx, ...opts.resolveTrace ? { resolveTrace: opts.resolveTrace } : {}, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {}, ...opts.resolveDispatchScope ? { resolveDispatchScope: opts.resolveDispatchScope } : {}, ...opts.projectExists ? { projectExists: opts.projectExists } : {}, ...opts.companyMemberRole ? { companyMemberRole: opts.companyMemberRole } : {}, ...opts.credentialAudit ? { credentialAudit: opts.credentialAudit } : {}, ...opts.readCredentialAudit ? { readCredentialAudit: opts.readCredentialAudit } : {}, ...opts.credentialRevealLimits ? { credentialRevealLimits: opts.credentialRevealLimits } : {}, ...opts.skillMarket ? { skillMarket: opts.skillMarket } : {}, ...opts.resolveNodeTenancy ? { resolveNodeTenancy: opts.resolveNodeTenancy } : {}, ...opts.agentManageGuard ? { agentManageGuard: opts.agentManageGuard } : {} })
   };
 }
-var import_node_crypto55;
+var import_node_crypto56;
 var init_actors = __esm({
   "../server/src/domains/actors/index.ts"() {
     "use strict";
-    import_node_crypto55 = require("node:crypto");
+    import_node_crypto56 = require("node:crypto");
     init_service5();
     init_routes3();
     init_service5();
@@ -236426,6 +236900,13 @@ function isPendingActor(id) {
 function isAgentActor(id) {
   return typeof id === "string" && id.startsWith("actor:agent:");
 }
+function isBlockingBackpressure(i) {
+  if (i.kind === "gap" || i.kind === "escalation") return false;
+  if (i.intent === "advisory") return false;
+  const from = i.raisedByNodeId;
+  const about = i.aboutNodeId;
+  return !!from && !!about && from !== about;
+}
 function isDispatchLayerFailure(detail) {
   const reason = detail?.reason;
   return typeof reason === "string" && reason.startsWith("dispatch ");
@@ -236650,12 +237131,8 @@ function buildWorkorderActivity(input) {
     } else if (r.decision === "approved" || r.decision === "completed") h.to = h.to ?? r.decidedAt ?? r.at;
   }
   for (const i of snap.issues) {
-    if (i.kind === "gap" || i.kind === "escalation") continue;
-    if (i.intent === "advisory") continue;
-    const from = i.raisedByNodeId;
-    const about = i.aboutNodeId;
-    if (!from || !about || from === about) continue;
-    addHold(from, { kind: "backpressure", from: i.createdAt, to: i.resolvedAt ?? null, upstream: about });
+    if (!isBlockingBackpressure(i)) continue;
+    addHold(i.raisedByNodeId, { kind: "backpressure", from: i.createdAt, to: i.resolvedAt ?? null, upstream: i.aboutNodeId });
   }
   const HOLD_RANK = { paused: 0, continuationDenied: 1, continuation: 2, backpressure: 3 };
   const holdOf2 = (w2) => {
@@ -236675,11 +237152,50 @@ function buildWorkorderActivity(input) {
   };
   const lastStampOf = (w2) => [w2.createdAt, w2.startedAt, w2.endedAt, w2.deadAt, w2.cancelledAt].filter((t) => !!t).sort().at(-1);
   const concludedRootBriefNodeIds = /* @__PURE__ */ new Set();
+  const blockingBackpressure = snap.issues.filter((i) => isBlockingBackpressure(i));
+  const blockingBackpressureIds = new Set(blockingBackpressure.map((i) => i.id));
+  const backpressureRaisedBy = /* @__PURE__ */ new Map();
+  for (const i of [...blockingBackpressure].sort((a, b2) => a.createdAt.localeCompare(b2.createdAt) || a.id.localeCompare(b2.id))) {
+    const from = i.raisedByNodeId;
+    backpressureRaisedBy.set(from, [...backpressureRaisedBy.get(from) ?? [], i]);
+  }
+  const backpressureOnRaiserCard = /* @__PURE__ */ new Set();
+  const backpressureDriving = /* @__PURE__ */ new Map();
+  {
+    const add = (workId, issueId) => {
+      if (!issueId || !blockingBackpressureIds.has(issueId)) return;
+      const list2 = backpressureDriving.get(workId) ?? [];
+      if (!list2.includes(issueId)) list2.push(issueId);
+      backpressureDriving.set(workId, list2);
+    };
+    for (const rec2 of events) {
+      const ev = rec2.event;
+      if (ev.kind !== "work.create" || !ev.workId) continue;
+      for (const r of ev.reasons ?? []) if (r.kind === "issue") add(ev.workId, r.issueId);
+    }
+    for (const w2 of snap.works) for (const id of w2.frozenIssueIds ?? []) add(w2.id, id);
+  }
+  const backpressureTargetName = (nodeId) => nodeId && rootBriefNodeIds.has(nodeId) ? "\u4EFB\u52A1\u8BF4\u660E" : nodeName(nodeId);
+  const backpressureOwnerOf = (nodeId) => {
+    const assignee = nodeId ? nodeById.get(nodeId)?.assigneeActorId : void 0;
+    return assignee && !isPendingActor(assignee) ? assignee : ownerId;
+  };
+  const backpressureRaisersOf = (workId) => {
+    const ids2 = backpressureDriving.get(workId);
+    if (!ids2?.length) return void 0;
+    const authors = [...new Set(ids2.map((id) => issueById.get(id)?.authorActorId).filter((a) => !!a))];
+    return authors.length ? authors.map(nameOf2).join("\u3001") : void 0;
+  };
   for (const [nodeId, works] of worksOfNode) {
     const interrupts = [...interruptsOfNode.get(nodeId) ?? []].sort((a, b2) => a.at.localeCompare(b2.at) || a.issueId.localeCompare(b2.issueId));
     const trips = stopLossOfNode.get(nodeId) ?? [];
     const interventions = [...interventionsOfNode.get(nodeId) ?? []].sort();
     const humanBetween = (prev, w2) => !!prev && interventions.some((t) => t >= lastStampOf(prev) && t <= w2.createdAt);
+    const upstreamRoundBetween = (prev, w2) => {
+      if (!prev) return false;
+      const ancestors = ancestorsOf(nodeId);
+      return snap.works.some((u) => u.lane !== "reply" && ancestors.has(u.nodeId) && u.createdAt > prev.createdAt && u.createdAt <= w2.createdAt);
+    };
     const node2 = nodeById.get(nodeId);
     const nodeCancelledAt = node2?.cancelledAt ?? null;
     const name = nodeName(nodeId);
@@ -236691,17 +237207,20 @@ function buildWorkorderActivity(input) {
       const st = statusOf2(w2);
       const nextStart = nextStartOf.get(w2.id) ?? null;
       const interrupt = interrupts.find((t) => t.at >= w2.createdAt && (!nextStart || t.at < nextStart));
+      const roundEndedAt = w2.endedAt ?? w2.deadAt ?? w2.cancelledAt;
+      const raisedHere = !w2.conclusion && !interrupt ? (backpressureRaisedBy.get(nodeId) ?? []).filter((i) => i.createdAt >= w2.createdAt && (!nextStart || i.createdAt < nextStart) && (!roundEndedAt || i.createdAt <= roundEndedAt)) : [];
+      const halted = !!interrupt || raisedHere.length > 0;
       const tripsHere = trips.filter((t) => t.at >= w2.createdAt && (!nextStart || t.at < nextStart));
       const removedHere = !!nodeCancelledAt && nodeCancelledAt >= w2.createdAt && (!next || nodeCancelledAt < next.createdAt);
       const reassigned = !!next && next.assigneeActorId !== w2.assigneeActorId;
       const killedByPlan = !!(w2.deadAt || w2.cancelledAt) && !!next && (reassigned || (next.nodeVersion ?? 0) > (w2.nodeVersion ?? 0));
       const killedAtOfRound = w2.deadAt ?? w2.cancelledAt;
-      const supersededBy = !w2.conclusion && !interrupt && !removedHere && !killedByPlan && killedAtOfRound && next && !killedByWorkorderPause(w2, killedAtOfRound) ? supersedingUpstreamVersion(nodeId, w2, killedAtOfRound, next) : void 0;
-      const failedRound = !w2.conclusion && !interrupt && !removedHere && !killedByPlan && !supersededBy && (!!w2.deadAt || !!w2.cancelledAt || st === "failed" || st === "retry" || noOutputRound(w2));
+      const supersededBy = !w2.conclusion && !halted && !removedHere && !killedByPlan && killedAtOfRound && next && !killedByWorkorderPause(w2, killedAtOfRound) ? supersedingUpstreamVersion(nodeId, w2, killedAtOfRound, next) : void 0;
+      const failedRound = !w2.conclusion && !halted && !removedHere && !killedByPlan && !supersededBy && (!!w2.deadAt || !!w2.cancelledAt || st === "failed" || st === "retry" || noOutputRound(w2));
       const foldableFailure = failedRound && !(killedAtOfRound && killedByWorkorderPause(w2, killedAtOfRound));
-      const ackedRound = st === "success" && !!w2.upstreamAck && !w2.conclusion && artifacts.length === 0 && !interrupt && !removedHere && !killedByPlan && !supersededBy && !failedRound;
-      const held = !w2.conclusion && !interrupt && !removedHere && !killedByPlan && !supersededBy && !failedRound && !ackedRound ? holdOf2(w2) : void 0;
-      const handedOverRound = !w2.conclusion && !interrupt && !removedHere && !killedByPlan && !supersededBy && !failedRound && !held && !ackedRound && st === "success" && !!w2.endedAt && !!next;
+      const ackedRound = st === "success" && !!w2.upstreamAck && !w2.conclusion && artifacts.length === 0 && !halted && !removedHere && !killedByPlan && !supersededBy && !failedRound;
+      const held = !w2.conclusion && !halted && !removedHere && !killedByPlan && !supersededBy && !failedRound && !ackedRound ? holdOf2(w2) : void 0;
+      const handedOverRound = !w2.conclusion && !halted && !removedHere && !killedByPlan && !supersededBy && !failedRound && !held && !ackedRound && st === "success" && !!w2.endedAt && !!next;
       const refiredByFuse = tripsHere.some((t) => t.kind === "output_stall");
       const brokenByHuman = humanBetween(works[idx - 1], w2) && !refiredByFuse;
       if (foldableFailure && fold2 && !brokenByHuman) {
@@ -236714,7 +237233,7 @@ function buildWorkorderActivity(input) {
         if (tripsHere.length) fold2.stopLossTrips = [...fold2.stopLossTrips ?? [], ...tripsHere];
         continue;
       }
-      const absorb2 = fold2 && !brokenByHuman && !!w2.conclusion && fold2.executorId === w2.assigneeActorId ? fold2 : null;
+      const absorb2 = fold2 && !brokenByHuman && !!w2.conclusion && fold2.executorId === w2.assigneeActorId && !upstreamRoundBetween(works[idx - 1], w2) ? fold2 : null;
       fold2 = null;
       if (handedOverRound && handoverFold && handoverFold.executorId === w2.assigneeActorId) {
         handoverFold.traceWorkIds.push(w2.id);
@@ -236749,6 +237268,7 @@ function buildWorkorderActivity(input) {
       }
       executionCards.push(card2);
       cardOfWork.set(w2.id, card2);
+      if (isHumanActorId(card2.executorId) && backpressureDriving.has(w2.id)) card2.humanTrace = true;
       if (w2.conclusion) {
         card2.phase = "done";
         if (rootBriefNodeIds.has(nodeId)) {
@@ -236764,6 +237284,10 @@ function buildWorkorderActivity(input) {
             card2.status = awaits ? ACTIVITY_COPY.doneAwaitingReview(name) : ACTIVITY_COPY.done(name);
           }
         }
+        const bpRaisers = backpressureRaisersOf(w2.id);
+        if (bpRaisers && (card2.status === ACTIVITY_COPY.done(name) || card2.status === ACTIVITY_COPY.goalConfirmed || card2.status === ACTIVITY_COPY.goalRevised)) {
+          card2.status = ACTIVITY_COPY.backpressureAddressed(bpRaisers, backpressureTargetName(nodeId));
+        }
       } else if (interrupt) {
         card2.phase = "stuck";
         card2.segmentOpen = false;
@@ -236772,6 +237296,18 @@ function buildWorkorderActivity(input) {
           card2.actions = [{ kind: "open_thread", label: BUTTON.view, target: gapThreadSessionId(interrupt.authorId), variant: "quiet" }];
         }
         if (interrupt.at > card2.updatedAt) card2.updatedAt = interrupt.at;
+      } else if (raisedHere.length) {
+        card2.phase = "stuck";
+        card2.segmentOpen = false;
+        card2.awaitingHuman = false;
+        const upstreams = [...new Set(raisedHere.map((i) => i.aboutNodeId))];
+        const targets = upstreams.map(backpressureTargetName);
+        const owners = [...new Set(upstreams.map((u) => nameOf2(backpressureOwnerOf(u))))];
+        card2.status = artifacts.length ? ACTIVITY_COPY.backpressureAfterStage(name, targets, owners) : ACTIVITY_COPY.backpressure(nameOf2(card2.executorId), targets, owners);
+        for (const i of raisedHere) {
+          backpressureOnRaiserCard.add(i.id);
+          if (i.createdAt > card2.updatedAt) card2.updatedAt = i.createdAt;
+        }
       } else if (supersededBy) {
         card2.phase = "stuck";
         card2.segmentOpen = false;
@@ -236934,7 +237470,7 @@ function buildWorkorderActivity(input) {
         const forcedBy = str5(reasons.find((r) => r.kind === "forced")?.actorId);
         const parentWorkId = str5(workById.get(workId)?.parentWorkId);
         const reworkOfRejected = !!parentWorkId && workById.get(parentWorkId)?.acceptanceState === "rejected";
-        const status = reasonKinds.has("rework") || reworkOfRejected ? ACTIVITY_COPY.reworking(nodeName(nodeId)) : reasonKinds.has("resumed") ? ACTIVITY_COPY.resumed(nameOf2(d.executorId), nodeName(nodeId)) : reasonKinds.has("spec_changed") ? ACTIVITY_COPY.specChanged(nodeName(nodeId)) : reasonKinds.has("issue") ? ACTIVITY_COPY.issueDriven(nodeName(nodeId)) : forcedBy ? ACTIVITY_COPY.forcedRerun(nameOf2(forcedBy), nodeName(nodeId)) : ACTIVITY_COPY.working(nodeName(nodeId));
+        const status = reasonKinds.has("rework") || reworkOfRejected ? ACTIVITY_COPY.reworking(nodeName(nodeId)) : reasonKinds.has("resumed") ? ACTIVITY_COPY.resumed(nameOf2(d.executorId), nodeName(nodeId)) : reasonKinds.has("spec_changed") ? ACTIVITY_COPY.specChanged(nodeName(nodeId)) : reasonKinds.has("issue") ? backpressureRaisersOf(workId) ? ACTIVITY_COPY.backpressureInProgress(backpressureRaisersOf(workId), backpressureTargetName(nodeId)) : ACTIVITY_COPY.issueDriven(nodeName(nodeId)) : forcedBy ? ACTIVITY_COPY.forcedRerun(nameOf2(forcedBy), nodeName(nodeId)) : ACTIVITY_COPY.working(nodeName(nodeId));
         for (const r of reasons) {
           if (r.kind !== "issue") continue;
           const issueId = str5(r.issueId);
@@ -237052,6 +237588,7 @@ function buildWorkorderActivity(input) {
         const raisedFrom = str5(ev.raisedByNodeId);
         const isBackpressure = !isEscalation && !isGap && !!raisedFrom && raisedFrom !== nodeId;
         if (isBackpressure) backpressureIssueIds.add(issueId);
+        if (isBackpressure && backpressureOnRaiserCard.has(issueId)) break;
         const body2 = str5(ev.body) ?? "";
         if (isEscalation) {
           const linkedGapId = str5(ev.gapId);
@@ -237106,8 +237643,8 @@ function buildWorkorderActivity(input) {
           ...isBackpressure ? { segmentOpen: false, awaitingHuman: false } : {},
           status: isBackpressure ? ACTIVITY_COPY.backpressure(
             nameOf2(authorId),
-            nodeName(nodeId),
-            nameOf2((nodeId ? nodeById.get(nodeId)?.assigneeActorId : void 0) ?? ownerId)
+            [backpressureTargetName(nodeId)],
+            [nameOf2((nodeId ? nodeById.get(nodeId)?.assigneeActorId : void 0) ?? ownerId)]
           ) : ACTIVITY_COPY.commentRaised(nameOf2(authorId), nameOf2(commentTargetId ?? ownerId), nodeName(nodeId)),
           /* **正文一律不上卡**：缺口去缺口线、回压去产物批注、留言去留言线。
              此前只有缺口/回压被排除，留言仍是「正文当小状态 + 展开区再印一遍」，
@@ -237441,7 +237978,7 @@ function buildWorkorderActivity(input) {
     card2.phaseLabel = PHASE_LABEL.escalationPending;
     card2.segmentOpen = true;
     card2.awaitingHuman = true;
-    card2.status = ACTIVITY_COPY.backpressureAwaitingOwner(nameOf2(card2.executorId), nodeName(card2.nodeId));
+    card2.status = ACTIVITY_COPY.backpressureAwaitingOwner(nameOf2(card2.executorId), backpressureTargetName(card2.nodeId));
     card2.actions = [{ kind: "open_issue", label: BUTTON.handle, target: issueId, variant: "primary" }];
   }
   for (const card2 of executionCards) {
@@ -237644,7 +238181,7 @@ function buildWorkorderActivity(input) {
       artifacts: d.artifacts,
       actions: d.actions,
       ...traced && d.traceAvailable ? { traceAvailable: true } : {},
-      ...d.traceWorkIds?.length ? { traceWorkIds: d.traceWorkIds, ...traced ? { traceAvailable: true } : {} } : {},
+      ...d.traceWorkIds?.length ? { traceWorkIds: d.traceWorkIds, ...traced || d.humanTrace ? { traceAvailable: true } : {} } : {},
       .../* @__PURE__ */ ((r) => r ? { runId: r, traceAvailable: true } : {})(traced ? runIdOfCard(d) : void 0)
     };
   });
@@ -237901,6 +238438,7 @@ var init_activity2 = __esm({
       heldByContinuation: (node2) => `\u300A${node2}\u300B\u5DF2\u4EA4\u4ED8\u9636\u6BB5\u6210\u679C\uFF0C\u672C\u6279\u7EED\u8DD1\u989D\u5EA6\u5DF2\u7528\u5B8C\uFF0C\u7B49\u5F85\u6279\u51C6\u7EE7\u7EED\u3002`,
       heldByContinuationDenied: (node2) => `\u300A${node2}\u300B\u5DF2\u4EA4\u4ED8\u9636\u6BB5\u6210\u679C\uFF0C\u7EED\u8DD1\u7533\u8BF7\u672A\u83B7\u6279\u51C6\uFF0C\u8282\u70B9\u5DF2\u6682\u505C\uFF0C\u7B49\u5F85\u653E\u884C\u3002`,
       heldByWorkorderPause: (node2) => `\u300A${node2}\u300B\u5DF2\u4EA4\u4ED8\u9636\u6BB5\u6210\u679C\uFF0C\u4EFB\u52A1\u5DF2\u6682\u505C\uFF0C\u7B49\u5F85\u6062\u590D\u3002`,
+      /** 只剩「交完稿、这一轮结束之后才补提」的那一档；同一轮里提的见 {@link ACTIVITY_COPY.backpressureAfterStage}（ADR 0623 补章）。 */
       heldByBackpressure: (node2, upstreams) => `\u300A${node2}\u300B\u5DF2\u4EA4\u4ED8\uFF0C\u7B49\u5F85${upstreams.map((u) => `\u300A${u}\u300B`).join("\u3001")}\u5904\u7406\u4FEE\u6539\u8981\u6C42\u540E\u518D\u6536\u53E3\u3002`,
       /** `works.status=retry`：这一轮没跑成，等引擎重派。谁按的重试由 `plan.node_retry` 补进这句。 */
       awaitingRedispatch: (executor, node2) => `${executor} \u8FD9\u4E00\u8F6E\u6CA1\u8DD1\u6210\u300A${node2}\u300B\uFF0C\u7B49\u5F85\u91CD\u6D3E\u3002`,
@@ -237953,8 +238491,27 @@ var init_activity2 = __esm({
          （「{X} 遇到处理不了的问题，需要 @{Y} 的协助」）——**别在别处复用**：系统代开的两种止损
          上报根本没有人「开口」，套这句话是假话（生产上它已经把 `actor:system` 渲染成了句子的主语）。
          ①「缺口卡」也删掉（F4）：它和执行卡挂的是同一段运行、同一份轨迹，点哪张打开的都一样。 */
-      /** 回压（下游对上游提修改要求）——发起人 2026-09-08 认可的措辞。 */
-      backpressure: (raiser, upstream, owner) => `${raiser} \u5BF9\u300A${upstream}\u300B\u63D0\u51FA\u4FEE\u6539\u8981\u6C42\uFF0C\u9700\u8981 @${owner} \u5904\u7406\u3002`,
+      /**
+       * 回压（下游对上游提修改要求）——发起人 2026-09-08 认可的措辞。
+       *
+       * 2026-09-23 起它是**提出方那一轮执行卡的结局句**（奕璇定，与缺口 F4 同一做法）：提要求这件事就发生在
+       * 那一轮里，不再单独出一张 `issue:` 卡。同一轮对几个上游提了要求时并成一句（《A》、《B》 / @X、@Y）。
+       * 🚨 **之后一个字不改**：要求关掉了也不翻署名、不改写成「已基于…更新了一版」——那是被要求方那张卡的事。
+       */
+      backpressure: (raiser, upstreams, owners) => `${raiser} \u5BF9${upstreams.map((u) => `\u300A${u}\u300B`).join("\u3001")}\u63D0\u51FA\u4FEE\u6539\u8981\u6C42\uFF0C\u9700\u8981 ${owners.map((o) => `@${o}`).join("\u3001")} \u5904\u7406\u3002`,
+      /**
+       * 同上，但提出方**这一轮先交了阶段成果**（propose 了、没 conclude）、同一轮又提了修改要求（奕璇 2026-09-23 定，
+       * ADR 0623 补章）：此前这一档出两张卡——自己那轮「已交付，等待《X》处理修改要求后再收口」+ 一张 `issue:` 回压卡。
+       * 合成这一句：「交了什么」由卡上 / 轨迹里的交付物说，句子说「停在哪、等谁」。之后同样一个字不改。
+       */
+      backpressureAfterStage: (node2, upstreams, owners) => `\u300A${node2}\u300B\u5DF2\u63D0\u4EA4\u9636\u6BB5\u6210\u679C\uFF0C\u5BF9${upstreams.map((u) => `\u300A${u}\u300B`).join("\u3001")}\u63D0\u51FA\u4FEE\u6539\u8981\u6C42\uFF0C\u9700\u8981 ${owners.map((o) => `@${o}`).join("\u3001")} \u5904\u7406\u3002`,
+      /** 被要求方是 agent、正在按修改要求改的那一轮（取代通用的「正在根据反馈调整」：说清是谁提的）。 */
+      backpressureInProgress: (raisers, node2) => `\u6B63\u5728\u6839\u636E ${raisers} \u7684\u4FEE\u6539\u8981\u6C42\u8C03\u6574\u300A${node2}\u300B\u3002`,
+      /**
+       * 被要求方按修改要求交出了新一版（agent / 真人同一句）。取代「《X》已完成」「已修订目标」——
+       * 此前同一件事还另有一张回压卡收口成「{X} 已基于 {Z} 的留言更新了一版」，一件事三张卡。
+       */
+      backpressureAddressed: (raisers, node2) => `\u5DF2\u6309 ${raisers} \u7684\u4FEE\u6539\u8981\u6C42\u66F4\u65B0\u300A${node2}\u300B\u3002`,
       /**
        * 被回压节点的负责人是**真人**时，系统为他开的那一轮（奕璇 2026-09-22 定）：这一轮不会自己跑，
        * 是在等他动手——不能再说「正在根据反馈调整」（`issueDriven`），那句会让一张没人在动的卡挂成「进行中」。
@@ -238113,6 +238670,26 @@ function buildWorkorderActivityTrace(input) {
       if (!briefing) continue;
       firstBriefing ??= briefing;
       const sources = sourcesOfWork(work, input, briefing);
+      const humanBackpressureRound = isHumanActorId(work.assigneeActorId) && sources.some((src) => {
+        const issue2 = src.kind === "comment" ? snap.issues.find((i) => i.id === src.issueId) : void 0;
+        return !!issue2 && isBlockingBackpressure(issue2);
+      });
+      if (humanBackpressureRound) {
+        const before = previousVersionOf(work, snap);
+        works.push({
+          workId,
+          at: work.createdAt,
+          nodeTitle: briefing.nodeTitle,
+          ...briefing.spec ? { spec: briefing.spec } : {},
+          sources,
+          attempts: [],
+          artifacts: [
+            ...before ? artifactsOfWork(before, input).map((a) => ({ ...a, name: `${a.name}\uFF08\u6539\u524D\uFF09` })) : [],
+            ...artifactsOfWork(work, input).map((a) => ({ ...a, name: `${a.name}\uFF08\u6539\u540E\uFF09` }))
+          ]
+        });
+        continue;
+      }
       const artifacts = single.attempts.at(-1)?.artifacts ?? artifactsOfWork(work, input);
       works.push({
         workId,
@@ -238186,6 +238763,13 @@ function sourcesOfWork(work, input, briefing) {
     ...briefing.spec ? { content: briefing.spec } : {}
   }];
 }
+function previousVersionOf(work, snap) {
+  const delivered = new Set(snap.artifacts.map((a) => a.workId));
+  const parentId = work.parentWorkId;
+  const parent = parentId ? snap.works.find((w2) => w2.id === parentId && delivered.has(w2.id)) : void 0;
+  if (parent) return parent;
+  return snap.works.filter((w2) => w2.nodeId === work.nodeId && w2.id !== work.id && w2.createdAt < work.createdAt && delivered.has(w2.id)).sort((a, b2) => a.createdAt.localeCompare(b2.createdAt) || a.id.localeCompare(b2.id)).at(-1);
+}
 function artifactsOfWork(work, input) {
   const snap = input.snap;
   const workId = work.id;
@@ -238344,6 +238928,7 @@ var init_activity_trace = __esm({
     "use strict";
     init_src6();
     init_review_activity();
+    init_src();
     init_activity2();
     init_workorder_manager();
     init_src7();
@@ -239255,11 +239840,11 @@ function fromRow(row) {
   for (const [k2, v2] of opt) if (v2 !== void 0 && v2 !== null) r[k2] = v2;
   return r;
 }
-var import_node_crypto56, import_node_fs16, DEFAULT_PAGE, MAX_PAGE, pageSize, MemoryNotificationStore, ident3, iso2, str2, PostgresNotificationStore;
+var import_node_crypto57, import_node_fs16, DEFAULT_PAGE, MAX_PAGE, pageSize, MemoryNotificationStore, ident3, iso2, str2, PostgresNotificationStore;
 var init_notification_store = __esm({
   "../server/src/domains/collab/notification-store.ts"() {
     "use strict";
-    import_node_crypto56 = require("node:crypto");
+    import_node_crypto57 = require("node:crypto");
     import_node_fs16 = __toESM(require("node:fs"), 1);
     DEFAULT_PAGE = 50;
     MAX_PAGE = 200;
@@ -239292,7 +239877,7 @@ var init_notification_store = __esm({
       async insert(n) {
         const existing = this.findLive(n.recipient, n.sourceKey, n.category);
         if (existing) return existing;
-        const row = { ...n, id: `ntf:${(0, import_node_crypto56.randomUUID)()}`, updatedAt: n.enteredAt };
+        const row = { ...n, id: `ntf:${(0, import_node_crypto57.randomUUID)()}`, updatedAt: n.enteredAt };
         this.rows.set(row.id, row);
         this.save();
         return row;
@@ -239425,7 +240010,7 @@ var init_notification_store = __esm({
         return new _PostgresNotificationStore(sql, schema);
       }
       async insert(n) {
-        const id = `ntf:${(0, import_node_crypto56.randomUUID)()}`;
+        const id = `ntf:${(0, import_node_crypto57.randomUUID)()}`;
         const r = await this.sql.query(
           `INSERT INTO ${this.t} (id, recipient, category, source_key, kind, workorder_id, node_id, card_id, actor_id,
          title, workspace_title, entered_at, updated_at, status, read_at, item)
@@ -240554,13 +241139,13 @@ function nameKey(name) {
 function cleanName(name) {
   return name.trim().replace(/\s+/g, " ");
 }
-var import_node_fs17, import_node_path21, import_node_crypto57, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
+var import_node_fs17, import_node_path21, import_node_crypto58, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
 var init_tags = __esm({
   "../server/src/domains/collab/tags.ts"() {
     "use strict";
     import_node_fs17 = __toESM(require("node:fs"), 1);
     import_node_path21 = __toESM(require("node:path"), 1);
-    import_node_crypto57 = __toESM(require("node:crypto"), 1);
+    import_node_crypto58 = __toESM(require("node:crypto"), 1);
     SEP = "::";
     keyOf = (companyId, id) => `${companyId}${SEP}${id}`;
     prefixOf = (companyId) => `${companyId}${SEP}`;
@@ -240578,7 +241163,7 @@ var init_tags = __esm({
         if (!name) return null;
         if (this.entries(companyId).some((t) => nameKey(t.name) === nameKey(name))) return null;
         const tag = {
-          id: `tag-${import_node_crypto57.default.randomBytes(6).toString("hex")}`,
+          id: `tag-${import_node_crypto58.default.randomBytes(6).toString("hex")}`,
           name,
           ...input.color?.trim() ? { color: input.color.trim() } : {},
           ...input.description?.trim() ? { description: input.description.trim() } : {}
@@ -241967,11 +242552,11 @@ async function isEmployedElsewhere(store, companyId, accountId) {
   const memberships = await store.listMembershipsForAccount(accountId);
   return memberships.some((m2) => m2.companyId !== companyId);
 }
-var import_node_crypto58, ROLES, INVITABLE_ROLES, INVITATION_TTL_MS, INVITE_LINK_TTL_MS, INVITE_LINK_TOKEN_BYTES, INVITE_LINK_ROLE, SLUG_RE, CompanyError, CompaniesService;
+var import_node_crypto59, ROLES, INVITABLE_ROLES, INVITATION_TTL_MS, INVITE_LINK_TTL_MS, INVITE_LINK_TOKEN_BYTES, INVITE_LINK_ROLE, SLUG_RE, CompanyError, CompaniesService;
 var init_service6 = __esm({
   "../server/src/domains/companies/service.ts"() {
     "use strict";
-    import_node_crypto58 = require("node:crypto");
+    import_node_crypto59 = require("node:crypto");
     init_console_url();
     ROLES = ["owner", "admin", "member"];
     INVITABLE_ROLES = ["admin", "member"];
@@ -242070,9 +242655,13 @@ var init_service6 = __esm({
         await this.store.updateCompany(id, { name });
         return { ...company, name };
       }
-      /** 设置/清除公司头像引用（"blob:<哈希>"；null = 回到默认首字母标识）。 */
+      /**
+       * 设置/清除公司头像引用（"blob:<哈希>"；null = 回到默认首字母标识）。
+       * 权限（本组织 owner/admin）由路由层 `requireOwnerOrAdmin` 强制；这里只守「组织还可用」
+       * ——与本域其余写面同一条判据（D8.2：闸不只长在路由上），解散之后 404 COMPANY_NOT_FOUND。
+       */
       async setAvatar(id, ref2) {
-        const company = await this.requireCompany(id);
+        const company = await this.requireActiveCompany(id);
         await this.store.updateCompany(id, { avatar: ref2 });
         const next = ref2 === null ? (({ avatar: _drop, ...rest }) => rest)(company) : { ...company, avatar: ref2 };
         return next;
@@ -242086,7 +242675,7 @@ var init_service6 = __esm({
         const existing = await this.store.getAccountByEmail(normalized4);
         if (existing) return existing;
         const account = {
-          id: `actor:human:${(0, import_node_crypto58.randomUUID)()}`,
+          id: `actor:human:${(0, import_node_crypto59.randomUUID)()}`,
           email: normalized4,
           name: name ?? normalized4,
           status: "active"
@@ -242484,7 +243073,7 @@ var init_service6 = __esm({
         }
         const nowMs = Date.parse(this.now());
         const invitation = {
-          id: `invitation:${(0, import_node_crypto58.randomUUID)()}`,
+          id: `invitation:${(0, import_node_crypto59.randomUUID)()}`,
           companyId,
           email: mail,
           role,
@@ -242615,7 +243204,7 @@ var init_service6 = __esm({
         const nowMs = Date.parse(this.now());
         const link = {
           companyId,
-          token: (0, import_node_crypto58.randomBytes)(INVITE_LINK_TOKEN_BYTES).toString("base64url"),
+          token: (0, import_node_crypto59.randomBytes)(INVITE_LINK_TOKEN_BYTES).toString("base64url"),
           role: INVITE_LINK_ROLE,
           createdAt: new Date(nowMs).toISOString(),
           expiresAt: new Date(nowMs + INVITE_LINK_TTL_MS).toISOString(),
@@ -242672,7 +243261,7 @@ var init_service6 = __esm({
         const reusable = existing.find((inv) => !this.isExpired(inv));
         if (reusable) return reusable;
         const invitation = {
-          id: `invitation:${(0, import_node_crypto58.randomUUID)()}`,
+          id: `invitation:${(0, import_node_crypto59.randomUUID)()}`,
           companyId: link.companyId,
           email: mail,
           role: link.role,
@@ -242718,9 +243307,9 @@ var init_service6 = __esm({
        * 登录身份查自己那条 membership；不是成员 → 404。
        */
       async completeMemberOnboarding(companyId, accountId) {
-        await this.requireCompany(companyId);
         const member = await this.store.getMember(companyId, accountId);
         if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        await this.requireActiveCompany(companyId);
         if (member.onboardingCompletedAt) return member;
         const next = { ...member, onboardingCompletedAt: this.now() };
         await this.store.upsertMember(next);
@@ -242744,9 +243333,9 @@ var init_service6 = __esm({
       async setMemberOnboardingStep(companyId, accountId, step) {
         const trimmed = step?.trim();
         if (!trimmed) throw new CompanyError(400, "BAD_REQUEST", "step \u4E0D\u80FD\u4E3A\u7A7A");
-        await this.requireCompany(companyId);
         const member = await this.store.getMember(companyId, accountId);
         if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        await this.requireActiveCompany(companyId);
         const next = { ...member, onboardingStep: trimmed };
         await this.store.upsertMember(next);
         return next;
@@ -242906,11 +243495,11 @@ var init_service6 = __esm({
 });
 
 // ../server/src/domains/companies/offboarding.ts
-var import_node_crypto59, OWNER_PROTECTED_MESSAGE, MemberOffboardingService;
+var import_node_crypto60, OWNER_PROTECTED_MESSAGE, MemberOffboardingService;
 var init_offboarding = __esm({
   "../server/src/domains/companies/offboarding.ts"() {
     "use strict";
-    import_node_crypto59 = require("node:crypto");
+    import_node_crypto60 = require("node:crypto");
     init_service6();
     OWNER_PROTECTED_MESSAGE = "\u7EC4\u7EC7\u7BA1\u7406\u5458\u4E0D\u53EF\u88AB\u79FB\u9664\uFF0C\u53EA\u80FD\u7531\u672C\u4EBA\u8F6C\u4EA4\u6216\u89E3\u6563\u7EC4\u7EC7";
     MemberOffboardingService = class {
@@ -242987,7 +243576,7 @@ var init_offboarding = __esm({
         const { ownedAgents, inFlight } = await this.snapshot(companyId, accountId);
         const at2 = this.now();
         const started = await this.store.startMemberOffboarding({
-          operationId: `off:${(0, import_node_crypto59.randomUUID)()}`,
+          operationId: `off:${(0, import_node_crypto60.randomUUID)()}`,
           companyId,
           accountId,
           initiatedBy,
@@ -243219,6 +243808,13 @@ function companiesDomain(opts) {
     await requireActiveCompany(companyId);
     return me;
   };
+  const requireActiveSelfMember = async (req, companyId) => {
+    const me = await whoami(req);
+    const member = await service.getMember(companyId, me.accountId);
+    if (!member) throw new ApiError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${me.accountId}`);
+    await requireActiveCompany(companyId);
+    return { me, member };
+  };
   return (router) => {
     router.get("/api/companies", async (req) => {
       const me = await whoami(req);
@@ -243268,13 +243864,17 @@ function companiesDomain(opts) {
       return { status: 201, body: company };
     });
     router.post("/api/companies/:id/avatar", async (req) => {
+      const cid = req.params.id;
+      await requireOwnerOrAdmin(req, cid);
       if (!blobs) throw new ApiError(501, "NOT_IMPLEMENTED", "blob \u5B58\u50A8\u672A\u63A5\u5165");
       const ref2 = await storeImageBlob(blobs, req.body?.data);
-      const company = await service.setAvatar(req.params.id, ref2).catch(mapErr);
+      const company = await service.setAvatar(cid, ref2).catch(mapErr);
       return { status: 201, body: { avatar: company.avatar } };
     });
     router.delete("/api/companies/:id/avatar", async (req) => {
-      await service.setAvatar(req.params.id, null).catch(mapErr);
+      const cid = req.params.id;
+      await requireOwnerOrAdmin(req, cid);
+      await service.setAvatar(cid, null).catch(mapErr);
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/companies/:id/members", async (req) => {
@@ -243284,23 +243884,23 @@ function companiesDomain(opts) {
       return { status: 200, body: { items } };
     });
     router.get("/api/companies/:id/members/me", async (req) => {
-      const me = await whoami(req);
-      const member = await service.getMember(req.params.id, me.accountId);
-      if (!member) throw new ApiError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${me.accountId}`);
+      const { member } = await requireActiveSelfMember(req, req.params.id);
       return { status: 200, body: member };
     });
     router.post("/api/companies/:id/members/me/onboarding-complete", async (req) => {
-      const me = await whoami(req);
-      const member = await service.completeMemberOnboarding(req.params.id, me.accountId).catch(mapErr);
+      const cid = req.params.id;
+      const { me } = await requireActiveSelfMember(req, cid);
+      const member = await service.completeMemberOnboarding(cid, me.accountId).catch(mapErr);
       return { status: 200, body: member };
     });
     router.post("/api/companies/:id/members/me/onboarding-step", async (req) => {
-      const me = await whoami(req);
+      const cid = req.params.id;
+      const { me } = await requireActiveSelfMember(req, cid);
       const body2 = req.body ?? {};
       if (typeof body2.step !== "string") {
         throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 step: string");
       }
-      const member = await service.setMemberOnboardingStep(req.params.id, me.accountId, body2.step).catch(mapErr);
+      const member = await service.setMemberOnboardingStep(cid, me.accountId, body2.step).catch(mapErr);
       return { status: 200, body: member };
     });
     router.patch("/api/companies/:id/members/:accountId", async (req) => {
@@ -243598,18 +244198,18 @@ var init_routes6 = __esm({
 
 // ../server/src/domains/companies/agent-credentials.ts
 function hashAgentToken(token, secret) {
-  return HASH_PREFIX + (0, import_node_crypto60.createHmac)("sha256", secret).update(`agent-token:${token}`).digest("base64url");
+  return HASH_PREFIX + (0, import_node_crypto61.createHmac)("sha256", secret).update(`agent-token:${token}`).digest("base64url");
 }
 function safeEqual(a, b2) {
   const ba = Buffer.from(a);
   const bb = Buffer.from(b2);
-  return ba.length === bb.length && (0, import_node_crypto60.timingSafeEqual)(ba, bb);
+  return ba.length === bb.length && (0, import_node_crypto61.timingSafeEqual)(ba, bb);
 }
-var import_node_crypto60, HASH_PREFIX, TOKEN_PREFIX, AgentCredentialService;
+var import_node_crypto61, HASH_PREFIX, TOKEN_PREFIX, AgentCredentialService;
 var init_agent_credentials = __esm({
   "../server/src/domains/companies/agent-credentials.ts"() {
     "use strict";
-    import_node_crypto60 = require("node:crypto");
+    import_node_crypto61 = require("node:crypto");
     init_service6();
     HASH_PREFIX = "ac1$";
     TOKEN_PREFIX = "oak_";
@@ -243634,7 +244234,7 @@ var init_agent_credentials = __esm({
         if (employee.status !== "active") {
           throw new CompanyError(409, "AGENT_LEFT", `\u6570\u5B57\u5458\u5DE5\u5DF2\u79BB\u5F00\uFF0C\u4E0D\u80FD\u7B7E\u53D1\u51ED\u8BC1\uFF1A${agentId}`);
         }
-        const token = `${TOKEN_PREFIX}${(0, import_node_crypto60.randomBytes)(32).toString("base64url")}`;
+        const token = `${TOKEN_PREFIX}${(0, import_node_crypto61.randomBytes)(32).toString("base64url")}`;
         const credential = {
           tokenHash: hashAgentToken(token, this.secret),
           companyId,
@@ -244146,7 +244746,7 @@ function gatewayInstanceSlug(gatewayUrl) {
 }
 function connectInstanceName(gatewayUrl, token, companyId) {
   const scope2 = companyId?.trim();
-  const suffix = scope2 ? `c${(0, import_node_crypto61.createHash)("sha256").update(`${gatewayUrl}\0${scope2}`).digest("hex").slice(0, 10)}` : token.replace(/[^a-z0-9]/gi, "").slice(-8).toLowerCase() || "enroll";
+  const suffix = scope2 ? `c${(0, import_node_crypto62.createHash)("sha256").update(`${gatewayUrl}\0${scope2}`).digest("hex").slice(0, 10)}` : token.replace(/[^a-z0-9]/gi, "").slice(-8).toLowerCase() || "enroll";
   const base = gatewayInstanceSlug(gatewayUrl);
   return base.slice(0, Math.max(1, 64 - suffix.length - 1)) + "-" + suffix;
 }
@@ -244475,12 +245075,12 @@ function buildNpxCmd(p2) {
   const prefix = daemonNpmPrefix();
   return `npm install -g --prefer-online --prefix ${prefix} ${DAEMON_NPM_PACKAGE}@latest && ${prefix}/bin/oasis daemon start --instance ${shellQuote(instanceName)} --server-ws ${shellQuote(p2.gatewayUrl)}${companyPart}${namePart} --pkg ${shellQuote(DAEMON_NPM_PACKAGE)} --upgrade --enroll-token ${shellQuote(p2.token)}`;
 }
-var import_node_crypto61;
+var import_node_crypto62;
 var init_connect_script = __esm({
   "../server/src/domains/nodes/connect-script.ts"() {
     "use strict";
     init_src();
-    import_node_crypto61 = require("node:crypto");
+    import_node_crypto62 = require("node:crypto");
   }
 });
 
@@ -244940,7 +245540,7 @@ function nodesDomain(deps) {
     if (!daemon.meta.adapters.some((kind) => QUOTA_CAPABLE_KINDS.has(kind))) {
       return { ok: false, code: "no-quota-runtime", reason: "\u8FD9\u53F0\u673A\u5668\u4E0A\u6CA1\u6709\u4F1A\u4E0A\u62A5\u989D\u5EA6\u7684\u8FD0\u884C\u65F6\uFF08\u53EA\u6709 Claude Code \u548C Codex \u80FD\u67E5\u5230\u8BA2\u9605\u989D\u5EA6\uFF09" };
     }
-    const requestId = (0, import_node_crypto62.randomUUID)();
+    const requestId = (0, import_node_crypto63.randomUUID)();
     const task = new Promise((resolve12) => {
       const timer = setTimeout(() => {
         quotaRefreshWaiters.delete(requestId);
@@ -245316,7 +245916,7 @@ function nodesDomain(deps) {
         }
         deps.enrollTokens.setIssuedNodeId(enrollToken, nodeId);
       } else {
-        nodeId = `node-${(0, import_node_crypto62.randomUUID)().slice(0, 8)}`;
+        nodeId = `node-${(0, import_node_crypto63.randomUUID)().slice(0, 8)}`;
         deps.enrollTokens.setIssuedNodeId(enrollToken, nodeId);
       }
       const existingNode = await deps.nodeStore.getNode(nodeId);
@@ -245582,16 +246182,16 @@ function normalizeGatewayUrl(raw) {
   }
 }
 function newNodeId() {
-  return "node-" + (0, import_node_crypto62.randomUUID)().replace(/-/g, "").slice(0, 12);
+  return "node-" + (0, import_node_crypto63.randomUUID)().replace(/-/g, "").slice(0, 12);
 }
-var import_node_crypto62, import_node_fs18, import_node_url6, import_node_path22, NODE_NAME_MAX_LENGTH;
+var import_node_crypto63, import_node_fs18, import_node_url6, import_node_path22, NODE_NAME_MAX_LENGTH;
 var init_routes7 = __esm({
   "../server/src/domains/nodes/routes.ts"() {
     "use strict";
     init_src();
     init_faults();
     init_runtime_status();
-    import_node_crypto62 = require("node:crypto");
+    import_node_crypto63 = require("node:crypto");
     import_node_fs18 = require("node:fs");
     import_node_url6 = require("node:url");
     import_node_path22 = require("node:path");
@@ -247258,7 +247858,7 @@ function createBundle(root, target, input) {
     }
   }
   const bytes2 = fs29.statSync(absBundle).size;
-  const digest = (0, import_node_crypto63.createHash)("sha256").update(fs29.readFileSync(absBundle)).digest("hex");
+  const digest = (0, import_node_crypto64.createHash)("sha256").update(fs29.readFileSync(absBundle)).digest("hex");
   const relBase = `inputs/git-bundles/${safeRepo}-${commit.slice(0, 12)}`;
   return {
     absoluteBundlePath: absBundle,
@@ -247354,12 +247954,12 @@ function classifyGitError(fallback, err, where) {
 function oneLine2(msg) {
   return msg.split("\n").map((s2) => s2.trim()).filter(Boolean).slice(0, 3).join(" ");
 }
-var import_node_child_process17, import_node_crypto63, fs29, os8, path26, GitReadonlyBundleError, HEX40, FETCH_TIMEOUT_MS2;
+var import_node_child_process17, import_node_crypto64, fs29, os8, path26, GitReadonlyBundleError, HEX40, FETCH_TIMEOUT_MS2;
 var init_readonly_bundle = __esm({
   "../server/src/git/readonly-bundle.ts"() {
     "use strict";
     import_node_child_process17 = require("node:child_process");
-    import_node_crypto63 = require("node:crypto");
+    import_node_crypto64 = require("node:crypto");
     fs29 = __toESM(require("node:fs"), 1);
     os8 = __toESM(require("node:os"), 1);
     path26 = __toESM(require("node:path"), 1);
@@ -247380,7 +247980,7 @@ var init_readonly_bundle = __esm({
 // ../server/src/domains/collab/create-seeded-workorder.ts
 function makeSeededWorkorderCreator(deps) {
   const locks = createKeyedMutex();
-  const genWorkspace = deps.genWorkspace ?? (() => `ws:wo-${(0, import_node_crypto64.randomUUID)().slice(0, 8)}`);
+  const genWorkspace = deps.genWorkspace ?? (() => `ws:wo-${(0, import_node_crypto65.randomUUID)().slice(0, 8)}`);
   const create = async (input) => {
     const company = input.companyId && deps.resolveCompany ? await deps.resolveCompany(input.companyId) : void 0;
     const kernel = company?.kernel ?? deps.kernel;
@@ -247467,7 +248067,7 @@ function makeSeededWorkorderCreator(deps) {
     return await finishCreation({ workspace, rootArtifactId: planned.rootArtifactId, spawned: planned.spawned });
   };
   return async (input) => {
-    const release = await locks.acquire(`${input.companyId ?? ""}\0${input.idempotencyKey ?? (0, import_node_crypto64.randomUUID)()}`);
+    const release = await locks.acquire(`${input.companyId ?? ""}\0${input.idempotencyKey ?? (0, import_node_crypto65.randomUUID)()}`);
     try {
       return await create(input);
     } finally {
@@ -247476,7 +248076,7 @@ function makeSeededWorkorderCreator(deps) {
   };
 }
 function workspaceForKey(key2) {
-  return `ws:wo-${(0, import_node_crypto64.createHash)("sha256").update(key2).digest("hex").slice(0, 8)}`;
+  return `ws:wo-${(0, import_node_crypto65.createHash)("sha256").update(key2).digest("hex").slice(0, 8)}`;
 }
 function existingWorkorder(snapshot, workspace, actor) {
   if (!snapshot?.nodes.length) return null;
@@ -247488,11 +248088,11 @@ function existingWorkorder(snapshot, workspace, actor) {
     spawned: snapshot.nodes.map((node2) => ({ id: node2.id, type: node2.type, owner: node2.assigneeActorId ?? actor }))
   };
 }
-var import_node_crypto64;
+var import_node_crypto65;
 var init_create_seeded_workorder = __esm({
   "../server/src/domains/collab/create-seeded-workorder.ts"() {
     "use strict";
-    import_node_crypto64 = require("node:crypto");
+    import_node_crypto65 = require("node:crypto");
     init_uncategorized_project();
     init_src();
     init_planner();
@@ -247718,8 +248318,16 @@ var init_service8 = __esm({
           errorCode: input.errorCode ?? null,
           errorMessage: input.errorMessage ?? null,
           usage: input.usage ?? null,
-          effectiveModel: input.effectiveModel ?? run.effectiveModel ?? null,
-          modelSource: input.modelSource ?? run.modelSource ?? null,
+          // 模型那两格按取值优先级挑（上游诊断 ④），不是无条件「收尾值优先」：`input` 里可能只剩
+          // 请求值（claude 一条 init 都没吐就退出、ACP `set_model` 被接受但运行时从没回报），
+          // 而 run 行上可能已经由运行中检查点补上了运行时回报的**实际值**——请求值顶掉实际值，
+          // 这一轮就永远记在一个没跑过的型号头上（PR #2213 评审阻断项 1）。同档以收尾值为准
+          // （`replace`）：收尾只写一次，且它是这一轮解析链的最终结论。
+          ...preferRunModel(
+            { effectiveModel: run.effectiveModel, modelSource: run.modelSource },
+            { effectiveModel: input.effectiveModel, modelSource: input.modelSource },
+            "replace"
+          ) ?? { effectiveModel: run.effectiveModel ?? null, modelSource: run.modelSource ?? null },
           transcriptRef: input.transcriptRef ?? null
         };
         const updated = await this.store.updateRun(id, patch);
@@ -248995,12 +249603,12 @@ function stateFromAttempt(attempt, handoff, checkpoint, now, stalledAfterMs, ope
   if (attempt.status === "no-output") return handoff?.unresolvedIssues.length ? "blocked" : "no_change";
   return "failed";
 }
-var import_node_crypto65, BLOCKING_STATES, HANDOFF_OUTCOMES2, RESUME_EXTERNAL_EFFECT_LIMIT, RESUME_SNAPSHOT_PREFIX, RESUME_SNAPSHOT_SUFFIX, ExecutionContinuityService;
+var import_node_crypto66, BLOCKING_STATES, HANDOFF_OUTCOMES2, RESUME_EXTERNAL_EFFECT_LIMIT, RESUME_SNAPSHOT_PREFIX, RESUME_SNAPSHOT_SUFFIX, ExecutionContinuityService;
 var init_service9 = __esm({
   "../server/src/domains/execution-continuity/service.ts"() {
     "use strict";
     init_src();
-    import_node_crypto65 = require("node:crypto");
+    import_node_crypto66 = require("node:crypto");
     init_src7();
     BLOCKING_STATES = /* @__PURE__ */ new Set(["stalled", "failed", "blocked"]);
     HANDOFF_OUTCOMES2 = /* @__PURE__ */ new Set(["succeeded", "no-output", "failed", "cancelled", "timeout", "orphaned"]);
@@ -249231,7 +249839,7 @@ var init_service9 = __esm({
         if (typeof expectedHash !== "string" || !this.readBundleFile) return null;
         const injectedResume = this.readBundleFile(attempt.id, "execution/RESUME.md");
         if (!injectedResume) return null;
-        const actualHash = (0, import_node_crypto65.createHash)("sha256").update(injectedResume).digest("hex");
+        const actualHash = (0, import_node_crypto66.createHash)("sha256").update(injectedResume).digest("hex");
         if (actualHash !== expectedHash) return null;
         const recoverySnapshot = parseResumePackSnapshot(injectedResume);
         if (!recoverySnapshot || recoverySnapshot.scenario !== "redispatch" || !recoverySnapshot.previousAttempt || recoverySnapshot.node.nodeId !== attempt.nodeId || recoverySnapshot.jobKey !== attempt.jobKey || recoverySnapshot.part !== attempt.part) return null;
@@ -250413,7 +251021,7 @@ function createChatSessionsDomain(opts) {
       if (!text7.trim()) throw new ApiError(400, "BAD_REQUEST", "text required");
       const now = Date.now();
       sweepDrafts(now);
-      const id = `cd_${(0, import_node_crypto66.randomUUID)()}`;
+      const id = `cd_${(0, import_node_crypto67.randomUUID)()}`;
       drafts.set(id, { text: text7, actor: req.auth.actor, expiresAt: now + DRAFT_TTL_MS });
       return { status: 201, body: { id, expiresInMs: DRAFT_TTL_MS } };
     });
@@ -250490,7 +251098,7 @@ function createChatSessionsDomain(opts) {
       const runtimeId = agentDefault.binding?.nodeId ?? "unknown";
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const session = {
-        id: (0, import_node_crypto66.randomUUID)(),
+        id: (0, import_node_crypto67.randomUUID)(),
         humanActorId: req.auth.actor,
         // 注：这里**刻意不写 companyId**。新会话要不要带公司归属，按 ws:wo-6d588f8e 的 ADR
         // （每公司 schema、最终移除表内 company 列）统一定，不在本节点自行发明。
@@ -250625,7 +251233,7 @@ function createChatSessionsDomain(opts) {
       if (body2.role !== "user" && body2.role !== "assistant") throw new ApiError(400, "BAD_REQUEST", "role must be user or assistant");
       const role = body2.role;
       const msg = await store2.appendMessage({
-        id: (0, import_node_crypto66.randomUUID)(),
+        id: (0, import_node_crypto67.randomUUID)(),
         sessionId: req.params.id,
         role,
         content: role === "user" ? stripInjectedChatContext(body2.content) : body2.content,
@@ -250667,7 +251275,7 @@ function createChatSessionsDomain(opts) {
       const known = key2 ? cur.find((x2) => x2.clientKey === key2) : void 0;
       if (!known && cur.length >= QUEUE_MAX) throw new ApiError(409, "QUEUE_FULL", `\u961F\u5217\u5DF2\u6EE1\uFF08\u4E0A\u9650 ${QUEUE_MAX} \u6761\uFF09`);
       const item = await store2.enqueuePendingMessage({
-        id: (0, import_node_crypto66.randomUUID)(),
+        id: (0, import_node_crypto67.randomUUID)(),
         chatSessionId: sid,
         text: text7,
         ...attachments.length ? { attachments } : {},
@@ -251520,12 +252128,12 @@ async function legacySendFailureCards(entries, deps) {
   }
   return out;
 }
-var import_node_crypto66, DEFAULT_SNAPSHOT_ITEMS, INFLIGHT_INSERT_SETTLE_WAIT_MS, MAX_SNAPSHOT_ITEMS, PROJECTED_CARD_LIMIT, SUBMISSION_NOT_DELIVERED_NOTE, SUBMISSION_UNCONFIRMED_NOTE, LEGACY_CARD_LIMIT;
+var import_node_crypto67, DEFAULT_SNAPSHOT_ITEMS, INFLIGHT_INSERT_SETTLE_WAIT_MS, MAX_SNAPSHOT_ITEMS, PROJECTED_CARD_LIMIT, SUBMISSION_NOT_DELIVERED_NOTE, SUBMISSION_UNCONFIRMED_NOTE, LEGACY_CARD_LIMIT;
 var init_chat_sessions2 = __esm({
   "../server/src/domains/chat-sessions/index.ts"() {
     "use strict";
     init_file_limits2();
-    import_node_crypto66 = require("node:crypto");
+    import_node_crypto67 = require("node:crypto");
     init_src();
     init_chat_session();
     init_persistent_files();
@@ -252985,7 +253593,7 @@ function busyError(chatSessionId, blockedBy) {
   return `\u76EE\u6807\u4F1A\u8BDD ${chatSessionId} \u6B63\u6709\u4E00\u8F6E\u5728\u8DD1${blockedBy ? `\uFF08${blockedBy}\uFF09` : ""}\u2014\u2014\u672C\u6B21\u89E6\u53D1\u5DF2\u4E22\u5F03\uFF0C\u4E0D\u6392\u961F\u3001\u4E0D\u8865\u8DD1`;
 }
 function genWebhookToken() {
-  return `owt_${(0, import_node_crypto67.randomBytes)(32).toString("base64url")}`;
+  return `owt_${(0, import_node_crypto68.randomBytes)(32).toString("base64url")}`;
 }
 function validateTitleTemplate(tpl) {
   const residue = tpl.replace(DATE_TOKEN, "");
@@ -253041,11 +253649,11 @@ function appendSourceNote(brief, automation, source, atIso) {
 ---
 \u672C\u5DE5\u5355\u7531\u81EA\u52A8\u5316\u300C${automation.name}\u300D\u4E8E ${atIso} \u89E6\u53D1\uFF08\u6765\u6E90\uFF1A${source}\uFF09\u3002\u5F00\u5DE5\u540E\u8BF7\u628A\u5DE5\u5355\u6807\u9898\u6539\u6210\u51C6\u786E\u53CD\u6620\u5B9E\u9645\u5DE5\u4F5C\u7684\u63CF\u8FF0\u3002`;
 }
-var import_node_crypto67, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
+var import_node_crypto68, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
 var init_service10 = __esm({
   "../server/src/domains/automations/service.ts"() {
     "use strict";
-    import_node_crypto67 = require("node:crypto");
+    import_node_crypto68 = require("node:crypto");
     init_src();
     init_registry3();
     init_attribution();
@@ -253859,11 +254467,11 @@ function verifySignature(rawBody, headers, secret) {
   if (!secret) return "not_required";
   const given = header1(headers, "x-hub-signature-256");
   if (!given) return "missing";
-  const expected = `sha256=${(0, import_node_crypto68.createHmac)("sha256", secret).update(rawBody).digest("hex")}`;
+  const expected = `sha256=${(0, import_node_crypto69.createHmac)("sha256", secret).update(rawBody).digest("hex")}`;
   const a = Buffer.from(given);
   const b2 = Buffer.from(expected);
   if (a.length !== b2.length) return "invalid";
-  return (0, import_node_crypto68.timingSafeEqual)(a, b2) ? "valid" : "invalid";
+  return (0, import_node_crypto69.timingSafeEqual)(a, b2) ? "valid" : "invalid";
 }
 function eventAllowed(filters, envelope) {
   if (!filters || filters.length === 0) return true;
@@ -253893,11 +254501,11 @@ function splitEvent(envelope) {
   }
   return { eventName, actionCandidates: candidates };
 }
-var import_node_crypto68, MAX_BODY_BYTES, AutomationWebhookService, header1, PROVIDER_PREFIXES;
+var import_node_crypto69, MAX_BODY_BYTES, AutomationWebhookService, header1, PROVIDER_PREFIXES;
 var init_webhook = __esm({
   "../server/src/domains/automations/webhook.ts"() {
     "use strict";
-    import_node_crypto68 = require("node:crypto");
+    import_node_crypto69 = require("node:crypto");
     MAX_BODY_BYTES = 256 * 1024;
     AutomationWebhookService = class {
       store;
@@ -255049,7 +255657,7 @@ function playbooksDomain(opts) {
       opts.overrides.set(companyOf(req), ref2, nodeKey, nextOverride);
       try {
         await opts.audit?.({
-          id: `reg_${(0, import_node_crypto69.randomUUID)()}`,
+          id: `reg_${(0, import_node_crypto70.randomUUID)()}`,
           actor: req.auth.actor,
           kind: "registry_change",
           target: `playbook:${ref2}#${nodeKey}`,
@@ -255066,11 +255674,11 @@ function playbooksDomain(opts) {
     });
   };
 }
-var import_node_crypto69;
+var import_node_crypto70;
 var init_routes12 = __esm({
   "../server/src/domains/playbooks/routes.ts"() {
     "use strict";
-    import_node_crypto69 = require("node:crypto");
+    import_node_crypto70 = require("node:crypto");
     init_router();
     init_registry3();
     init_planner();
@@ -255199,17 +255807,17 @@ function completionFingerprint(workspace, members) {
     workspace,
     members: [...members].sort((a, b2) => a.artifactId < b2.artifactId ? -1 : a.artifactId > b2.artifactId ? 1 : 0).map((m2) => ({ artifactId: m2.artifactId, currentRevisionId: m2.currentRevisionId ?? null }))
   });
-  return (0, import_node_crypto70.createHash)("sha256").update(canonical2).digest("hex");
+  return (0, import_node_crypto71.createHash)("sha256").update(canonical2).digest("hex");
 }
 function eventConsumptionKey(args) {
   const raw = `project-event:${EVENT_KEY_VERSION}:${args.triggerId}:${args.event}:${args.workspace}:${args.fingerprint}`;
-  return raw.length <= 200 ? raw : `project-event:${EVENT_KEY_VERSION}:sha256:${(0, import_node_crypto70.createHash)("sha256").update(raw).digest("hex")}`;
+  return raw.length <= 200 ? raw : `project-event:${EVENT_KEY_VERSION}:sha256:${(0, import_node_crypto71.createHash)("sha256").update(raw).digest("hex")}`;
 }
-var import_node_crypto70, EVENT_KEY_VERSION, EMPTY_METRICS, AUTOMATION_EVENT_HANDLERS, ProjectEventPoller;
+var import_node_crypto71, EVENT_KEY_VERSION, EMPTY_METRICS, AUTOMATION_EVENT_HANDLERS, ProjectEventPoller;
 var init_project_event_poller = __esm({
   "../server/src/automations/project-event-poller.ts"() {
     "use strict";
-    import_node_crypto70 = require("node:crypto");
+    import_node_crypto71 = require("node:crypto");
     EVENT_KEY_VERSION = "v1";
     EMPTY_METRICS = () => ({
       scanDurationMs: 0,
@@ -255419,7 +256027,7 @@ function queryInputReceipt(hub, nodeId, dispatchId, clientMessageKey, pending, t
     const viaSession = hub.hasSession?.(dispatchId) === true;
     const supported = viaSession ? hub.supportsInputReceiptQuery?.(dispatchId) === true : daemonMetaOf(hub, nodeId)?.supportsInputReceiptQuery === true;
     if (!supported) return Promise.resolve({ status: "unknown", reason: "unsupported" });
-    const requestId = (0, import_node_crypto71.randomUUID)();
+    const requestId = (0, import_node_crypto72.randomUUID)();
     return new Promise((resolve12) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
@@ -255481,7 +256089,7 @@ function sendAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs, sessi
   if (input.requireConsumptionReceipt && !hub.supportsInputConsumptionReceipts?.(dispatchId)) {
     return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
   }
-  const requestId = (0, import_node_crypto71.randomUUID)();
+  const requestId = (0, import_node_crypto72.randomUUID)();
   const sent = routeToSession(hub, nodeId, dispatchId, { type: "append_input", dispatchId, input, requestId });
   if (!sent) return Promise.resolve({ accepted: false, reason: "session-closing", ...unknownIfInterrupting });
   return new Promise((resolve12) => {
@@ -255494,11 +256102,11 @@ function sendAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs, sessi
     entry.appendWaiters.push({ requestId, requireConsumptionReceipt: input.requireConsumptionReceipt, resolve: resolve12, timer });
   });
 }
-var import_node_crypto71, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_TOTAL_FRAMES, STASH_MAX_IDS, STASH_LOSS_MAX_IDS, STASH_LOSS_TTL_MS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
+var import_node_crypto72, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_TOTAL_FRAMES, STASH_MAX_IDS, STASH_LOSS_MAX_IDS, STASH_LOSS_TTL_MS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
 var init_daemon_adapter = __esm({
   "../server/src/daemon-adapter.ts"() {
     "use strict";
-    import_node_crypto71 = require("node:crypto");
+    import_node_crypto72 = require("node:crypto");
     init_src();
     STASH_TTL_MS = 5 * 6e4;
     STASH_MAX_FRAMES_PER_ID = 1e4;
@@ -255938,7 +256546,7 @@ var init_daemon_adapter = __esm({
       async spawn(job) {
         const nodeId = job.binding?.nodeId;
         if (!nodeId) throw new Error("DaemonHubAdapter \u9700\u8981 job.binding.nodeId\uFF08\u8DEF\u7531\u9519\u8BEF\uFF09");
-        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto71.randomUUID)()}`;
+        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto72.randomUUID)()}`;
         if (job.dispatchId && this.pending.has(dispatchId)) {
           return this.recover(dispatchId, nodeId, job.binding?.runtimeKind, job.actor);
         }
@@ -256194,7 +256802,7 @@ var init_daemon_adapter = __esm({
         return daemon?.meta.supportsWorkdirWalk === true;
       }
       request(nodeId, buildFrame) {
-        const requestId = (0, import_node_crypto71.randomUUID)();
+        const requestId = (0, import_node_crypto72.randomUUID)();
         const sent = this.hub.dispatch(nodeId, buildFrame(requestId));
         if (!sent) return Promise.resolve({ ok: false, code: "NODE_OFFLINE" });
         return new Promise((resolve12) => {
@@ -256302,13 +256910,13 @@ function classifyPage(page, lastPushedHash, serviceAccount) {
   if (sha(body2) === lastPushedHash) return { kind: "echo" };
   return { kind: "human-edit", content: body2, updatedBy: page.updatedBy };
 }
-var import_node_crypto72, sha, enc2, dec, MirrorEngine, MemoryMirrorStateStore, MapMirrorIdentities;
+var import_node_crypto73, sha, enc2, dec, MirrorEngine, MemoryMirrorStateStore, MapMirrorIdentities;
 var init_engine = __esm({
   "../server/src/mirror/engine.ts"() {
     "use strict";
-    import_node_crypto72 = require("node:crypto");
+    import_node_crypto73 = require("node:crypto");
     init_src();
-    sha = (s2) => (0, import_node_crypto72.createHash)("sha256").update(s2, "utf8").digest("hex");
+    sha = (s2) => (0, import_node_crypto73.createHash)("sha256").update(s2, "utf8").digest("hex");
     enc2 = (s2) => new TextEncoder().encode(s2);
     dec = (b2) => new TextDecoder().decode(b2);
     MirrorEngine = class {
@@ -256589,11 +257197,11 @@ function humanExitCause(exit3) {
   const base = (exit3.reason ? label2[exit3.reason] : void 0) ?? `\u4F1A\u8BDD\u5F02\u5E38\u7ED3\u675F\uFF08${exit3.reason ?? "\u65E0\u9000\u51FA\u4FE1\u606F"}\uFF09`;
   return exit3.errorMessage ? `${base}\uFF1A${exit3.errorMessage.slice(0, 200)}` : base;
 }
-var import_node_crypto73, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, REJECTED_PROPOSALS_IN_TASK, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
+var import_node_crypto74, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, REJECTED_PROPOSALS_IN_TASK, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
 var init_worker = __esm({
   "../server/src/coordinator/worker.ts"() {
     "use strict";
-    import_node_crypto73 = require("node:crypto");
+    import_node_crypto74 = require("node:crypto");
     init_src7();
     init_identity();
     AUTONOMOUS_ETHOS = `\u4F60\u662F\u8FD9\u4E2A\u5DE5\u5355\u7684**\u7BA1\u7406\u8005**\u2014\u2014\u804C\u8D23\u662F\u8BA9\u5B83\u987A\u7545\u8DD1\u5B8C\u3002\u7CFB\u7EDF\u5728\u67D0\u4E2A\u8282\u70B9\u5361\u4F4F\u3001\u673A\u68B0\u5206\u8BCA\u786E\u8BA4"\u9700\u8981\u4F60"\u65F6\u5524\u8D77\u4F60\uFF08\u65E0\u4EBA\u5728\u573A\uFF0C\u4F60\u8FD9\u4E00\u8F6E\u628A\u80FD\u505A\u7684\u505A\u6389\uFF09\u3002\u4F60\u7684\u624B\u6BB5\u5F88\u5BBD\uFF1A
@@ -256863,7 +257471,7 @@ ${HIGH_RISK_COMMANDS}`;
         return this.deps.kernel.model.lastSeq.get(artifactId) ?? 0;
       }
       evaluationKey(kind, artifactId, evidence) {
-        const fingerprint2 = (0, import_node_crypto73.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
+        const fingerprint2 = (0, import_node_crypto74.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
         return `${kind}:${artifactId}:${fingerprint2}`;
       }
       artifactEvidence(id) {
@@ -257252,8 +257860,8 @@ ${ctx.nodeFault}
         const taskWithRejections = rejectedSection ? `${task}
 
 ${rejectedSection}` : task;
-        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto73.randomUUID)();
-        const coordinatorRunId = `coordinate:${(0, import_node_crypto73.randomUUID)()}`;
+        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto74.randomUUID)();
+        const coordinatorRunId = `coordinate:${(0, import_node_crypto74.randomUUID)()}`;
         const taskWithContext = coordinatorContext ? [
           taskWithRejections,
           ``,
@@ -257297,7 +257905,7 @@ ${rejectedSection}` : task;
         const startedAtMs = Date.now();
         let trajectoryStarted = false;
         if (this.deps.trajectory) {
-          const bundleManifest = Object.fromEntries(Object.entries(job.bundle.files).map(([name, content3]) => [name, (0, import_node_crypto73.createHash)("sha256").update(content3).digest("hex")]));
+          const bundleManifest = Object.fromEntries(Object.entries(job.bundle.files).map(([name, content3]) => [name, (0, import_node_crypto74.createHash)("sha256").update(content3).digest("hex")]));
           const session = {
             runId: coordinatorRunId,
             runtimeSessionId,
@@ -257508,11 +258116,11 @@ var init_pg_ident = __esm({
 });
 
 // ../storage/src/postgres.ts
-var import_node_crypto74, ident4, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
+var import_node_crypto75, ident4, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
 var init_postgres = __esm({
   "../storage/src/postgres.ts"() {
     "use strict";
-    import_node_crypto74 = require("node:crypto");
+    import_node_crypto75 = require("node:crypto");
     init_pg_ident();
     init_esm();
     init_src();
@@ -257692,7 +258300,7 @@ var init_postgres = __esm({
         return new _PostgresBlobStore(pool, schema);
       }
       async put(bytes2) {
-        const hash3 = (0, import_node_crypto74.createHash)("sha256").update(bytes2).digest("hex");
+        const hash3 = (0, import_node_crypto75.createHash)("sha256").update(bytes2).digest("hex");
         await this.pool.query(
           `INSERT INTO ${this.t} (hash, bytes, size, content_type) VALUES ($1, $2, $3, $4) ON CONFLICT (hash) DO NOTHING`,
           [hash3, Buffer.from(bytes2), bytes2.byteLength, sniffContentType(bytes2) ?? null]
@@ -257740,7 +258348,7 @@ function stageAtLeast(stage, min2) {
   return STAGES.indexOf(stage) >= STAGES.indexOf(min2);
 }
 function newVariableId() {
-  return `var_${(0, import_node_crypto75.randomUUID)()}`;
+  return `var_${(0, import_node_crypto76.randomUUID)()}`;
 }
 async function declareRecordsAware(db) {
   await db.query(`SELECT set_config('${RECORDS_AWARE_SETTING}', 'on', true)`);
@@ -258096,11 +258704,11 @@ async function listBindingTargetIds(db, s2, kind) {
     [kind]
   )).rows.map((x2) => x2.target_id);
 }
-var import_node_crypto75, STAGES, RECORDS_AWARE_SETTING, markLockName;
+var import_node_crypto76, STAGES, RECORDS_AWARE_SETTING, markLockName;
 var init_variable_bindings = __esm({
   "../storage/src/variable-bindings.ts"() {
     "use strict";
-    import_node_crypto75 = require("node:crypto");
+    import_node_crypto76 = require("node:crypto");
     init_src();
     STAGES = ["off", "dual", "read", "records"];
     RECORDS_AWARE_SETTING = "oasis.variable_records_aware";
@@ -268162,11 +268770,11 @@ var init_postgres_delegations = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto76, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
+var import_node_crypto77, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
-    import_node_crypto76 = require("node:crypto");
+    import_node_crypto77 = require("node:crypto");
     init_pg_ident();
     init_esm();
     ident13 = (s2) => {
@@ -268516,7 +269124,7 @@ var init_postgres_nodes = __esm({
         return store;
       }
       issue(nodeId) {
-        const token = `ont_${(0, import_node_crypto76.randomBytes)(24).toString("base64url")}`;
+        const token = `ont_${(0, import_node_crypto77.randomBytes)(24).toString("base64url")}`;
         this.cache.set(token, nodeId);
         void this.pool.query(`INSERT INTO ${this.s}.node_tokens (token,node_id) VALUES ($1,$2)`, [token, nodeId]);
         return token;
@@ -268818,11 +269426,11 @@ var init_postgres_type_registry = __esm({
 });
 
 // ../storage/src/postgres-actor-memory.ts
-var import_node_crypto77, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
+var import_node_crypto78, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
 var init_postgres_actor_memory = __esm({
   "../storage/src/postgres-actor-memory.ts"() {
     "use strict";
-    import_node_crypto77 = require("node:crypto");
+    import_node_crypto78 = require("node:crypto");
     init_pg_ident();
     init_src();
     matchClause = (q2) => q2.requireMatch && q2.keywords.length > 0 ? " WHERE m > 0" : "";
@@ -269032,7 +269640,7 @@ var init_postgres_actor_memory = __esm({
       }
       async write(input, now) {
         if (input.memId === void 0) {
-          const memId = `mem:${(0, import_node_crypto77.randomUUID)()}`;
+          const memId = `mem:${(0, import_node_crypto78.randomUUID)()}`;
           const r2 = await this.pool.query(
             `INSERT INTO ${this.s}.actor_memories
            (mem_id, actor_id, project_id, keywords, content, version, created_at, updated_at, accessed_at, source_artifact_id, source_session_id)
@@ -270603,14 +271211,14 @@ function companySchemaName(companyId) {
   if (typeof companyId !== "string" || !companyId.trim()) {
     throw new Error("company schema mapping \u9700\u8981\u975E\u7A7A companyId\uFF08fail-closed\uFF1A\u4E0D\u56DE\u9000\u9ED8\u8BA4\u516C\u53F8\uFF09");
   }
-  const hex = (0, import_node_crypto78.createHash)("sha256").update(companyId, "utf8").digest("hex");
+  const hex = (0, import_node_crypto79.createHash)("sha256").update(companyId, "utf8").digest("hex");
   return `${COMPANY_SCHEMA_PREFIX}${hex.slice(0, DIGEST_HEX_LEN)}`;
 }
-var import_node_crypto78, COMPANY_SCHEMA_PREFIX, DIGEST_HEX_LEN, SchemaMappingConflictError, TenantStorageLocationStore;
+var import_node_crypto79, COMPANY_SCHEMA_PREFIX, DIGEST_HEX_LEN, SchemaMappingConflictError, TenantStorageLocationStore;
 var init_tenant_schema_mapping = __esm({
   "../storage/src/tenant-schema-mapping.ts"() {
     "use strict";
-    import_node_crypto78 = require("node:crypto");
+    import_node_crypto79 = require("node:crypto");
     init_esm();
     init_pg_ident();
     COMPANY_SCHEMA_PREFIX = "c_";
@@ -270684,7 +271292,7 @@ var init_tenant_schema_mapping = __esm({
 
 // ../storage/src/company-data-plane-schema.ts
 function canonicalTypeDefHash(def) {
-  return `sha256:${(0, import_node_crypto79.createHash)("sha256").update(JSON.stringify(def), "utf8").digest("hex")}`;
+  return `sha256:${(0, import_node_crypto80.createHash)("sha256").update(JSON.stringify(def), "utf8").digest("hex")}`;
 }
 function defaultArtifactTypeTemplate() {
   return [
@@ -270866,11 +271474,11 @@ async function seedDefaultArtifactTypes(pool, schema, templates = defaultArtifac
   }
   return { inserted };
 }
-var import_node_crypto79, DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION;
+var import_node_crypto80, DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION;
 var init_company_data_plane_schema = __esm({
   "../storage/src/company-data-plane-schema.ts"() {
     "use strict";
-    import_node_crypto79 = require("node:crypto");
+    import_node_crypto80 = require("node:crypto");
     init_esm();
     init_pg_ident();
     DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION = "4c368e5c-types-v1";
@@ -270949,11 +271557,11 @@ function rowToFile2(row) {
     updatedAt: new Date(row.updated_at).toISOString()
   };
 }
-var import_node_crypto80, COMPANY_CONFLICT_MSG, CompanyIdentifierConflictError, CompanyOwnedRegistryStore;
+var import_node_crypto81, COMPANY_CONFLICT_MSG, CompanyIdentifierConflictError, CompanyOwnedRegistryStore;
 var init_company_owned_registry_store = __esm({
   "../storage/src/company-owned-registry-store.ts"() {
     "use strict";
-    import_node_crypto80 = require("node:crypto");
+    import_node_crypto81 = require("node:crypto");
     init_esm();
     init_src();
     init_pg_ident();
@@ -271338,7 +271946,7 @@ var init_company_owned_registry_store = __esm({
           enabled: skill.enabled,
           files: files.map((f2) => ({ path: f2.path, blobHash: f2.blobHash }))
         });
-        return (0, import_node_crypto80.createHash)("sha256").update(body2).digest("hex");
+        return (0, import_node_crypto81.createHash)("sha256").update(body2).digest("hex");
       }
     };
   }
@@ -274148,7 +274756,7 @@ function sourceSetConservation(input) {
   return input.sourceFinal === input.copied + input.approvedRuntimeConversion + input.approvedArchive + input.approvedDiscard;
 }
 function payloadChecksum(value2) {
-  return (0, import_node_crypto81.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
+  return (0, import_node_crypto82.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
 }
 async function copyWorkorderDraftsIdempotent(pool, companyId, companySchema, manifestId, opts) {
   const cs = quoteIdent2(companySchema);
@@ -274540,11 +275148,11 @@ async function copyTraceFamilyIdempotent(pool, companyId, companySchema, manifes
     sequences
   };
 }
-var import_node_crypto81, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
+var import_node_crypto82, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
 var init_tenant_migration_operator = __esm({
   "../storage/src/tenant-migration-operator.ts"() {
     "use strict";
-    import_node_crypto81 = require("node:crypto");
+    import_node_crypto82 = require("node:crypto");
     init_esm();
     init_pg_ident();
     init_tenancy_attribution();
@@ -274780,8 +275388,8 @@ var init_tenant_new_company_provision = __esm({
 // ../storage/src/knowledge-snapshot-crypto.ts
 function sealSnapshot(snapshot, key2) {
   if (snapshot.content.startsWith(PREFIX3)) return structuredClone(snapshot);
-  const iv = (0, import_node_crypto82.randomBytes)(12);
-  const cipher = (0, import_node_crypto82.createCipheriv)("aes-256-gcm", bytes(key2), iv);
+  const iv = (0, import_node_crypto83.randomBytes)(12);
+  const cipher = (0, import_node_crypto83.createCipheriv)("aes-256-gcm", bytes(key2), iv);
   cipher.setAAD(aad2(snapshot));
   const encrypted = Buffer.concat([cipher.update(snapshot.content, "utf8"), cipher.final()]);
   return { ...structuredClone(snapshot), content: `${PREFIX3}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}` };
@@ -274791,7 +275399,7 @@ function openSnapshot(snapshot, key2) {
   const packed = snapshot.content.slice(PREFIX3.length).split(".");
   if (packed.length !== 3 || packed.some((part) => !part)) throw new Error(`knowledge snapshot ${snapshot.ref} ciphertext is malformed`);
   const [iv, tag, data] = packed;
-  const decipher = (0, import_node_crypto82.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
+  const decipher = (0, import_node_crypto83.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
   decipher.setAAD(aad2(snapshot));
   decipher.setAuthTag(Buffer.from(tag, "base64url"));
   return {
@@ -274799,11 +275407,11 @@ function openSnapshot(snapshot, key2) {
     content: Buffer.concat([decipher.update(Buffer.from(data, "base64url")), decipher.final()]).toString("utf8")
   };
 }
-var import_node_crypto82, PREFIX3, bytes, aad2;
+var import_node_crypto83, PREFIX3, bytes, aad2;
 var init_knowledge_snapshot_crypto = __esm({
   "../storage/src/knowledge-snapshot-crypto.ts"() {
     "use strict";
-    import_node_crypto82 = require("node:crypto");
+    import_node_crypto83 = require("node:crypto");
     PREFIX3 = "oasis-knowledge:v1:";
     bytes = (key2) => {
       const value2 = Buffer.from(key2);
@@ -275695,7 +276303,7 @@ function reportedCost(v2) {
 }
 function newUsageBackfillManifestId(now = /* @__PURE__ */ new Date()) {
   const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  return `ulb-${stamp}-${(0, import_node_crypto83.randomBytes)(3).toString("hex")}`;
+  return `ulb-${stamp}-${(0, import_node_crypto84.randomBytes)(3).toString("hex")}`;
 }
 async function backfillUsageLedger(ledger, opts) {
   if (!opts.dryRun && !opts.manifestId) throw new Error("execute \u9700\u8981 manifestId");
@@ -276244,11 +276852,11 @@ async function audit(c, s2, manifestId, runId, field, before, after, createdAt)
     [manifestId, runId, field, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), createdAt]
   );
 }
-var import_node_crypto83, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
+var import_node_crypto84, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
 var init_usage_ledger_backfill = __esm({
   "../storage/src/usage-ledger-backfill.ts"() {
     "use strict";
-    import_node_crypto83 = require("node:crypto");
+    import_node_crypto84 = require("node:crypto");
     init_src();
     init_pg_ident();
     init_postgres_trace();
@@ -276827,31 +277435,64 @@ var init_connector_tool_versions = __esm({
 });
 
 // ../server/src/design/board-watch.ts
-function decideBoardLetter(c, nowMs, quietMs) {
-  if (c.hasOpenWatchLetter) return false;
-  if (c.freshTerminalRunId !== null) return true;
-  if (c.boardMtime === null) return false;
-  if (!c.hasRevision) return false;
-  if (c.lastOpAtMs === null || c.boardMtime <= c.lastOpAtMs) return false;
-  if (nowMs - c.boardMtime < quietMs) return false;
-  if (c.lastWatchMtime !== null && c.boardMtime <= c.lastWatchMtime) return false;
-  return true;
+function parseOdTime(v2) {
+  if (typeof v2 === "number") return Number.isFinite(v2) ? v2 : null;
+  if (typeof v2 !== "string" || v2.trim().length === 0) return null;
+  const s2 = v2.trim();
+  if (/^\d+(\.\d+)?$/.test(s2)) return Number(s2);
+  const t = Date.parse(s2);
+  return Number.isFinite(t) ? t : null;
+}
+function nonEmpty2(v2) {
+  return typeof v2 === "string" && v2.trim().length > 0 ? v2 : null;
 }
-var MARKER_PREFIX, boardWatchMarker, parseMarker, RUN_MARKER_PREFIX, boardWatchRunMarker, parseRunMarker, TERMINAL_RUN_STATUS, BoardWatcher;
+function roundOfMessage(m2, conversationId = null) {
+  if (m2["role"] !== "assistant") return null;
+  const status = nonEmpty2(m2["runStatus"]);
+  if (status === null || !TERMINAL_RUN_STATUS.has(status)) return null;
+  const endedAt = parseOdTime(m2["endedAt"]);
+  if (endedAt === null) return null;
+  const runId = nonEmpty2(m2["runId"]);
+  const messageId = nonEmpty2(m2["id"]);
+  if (runId === null && messageId === null) return null;
+  const files = Array.isArray(m2["producedFiles"]) ? m2["producedFiles"] : [];
+  const producedFiles = files.map((f2) => typeof f2 === "string" ? f2 : f2 && typeof f2 === "object" ? nonEmpty2(f2["path"]) ?? nonEmpty2(f2["name"]) : null).filter((s2) => s2 !== null);
+  const { error: error2, errorCode } = messageError(m2, status);
+  return {
+    key: runId ?? `msg:${messageId}`,
+    conversationId,
+    runId,
+    status,
+    agentId: nonEmpty2(m2["agentId"]),
+    endedAt,
+    producedFiles,
+    error: error2,
+    errorCode
+  };
+}
+function messageError(m2, status) {
+  const events = Array.isArray(m2["events"]) ? m2["events"] : [];
+  for (let i = events.length - 1; i >= 0; i--) {
+    const e = events[i];
+    if (!e || typeof e !== "object") continue;
+    const ev = e;
+    if (ev["kind"] !== "status" || ev["label"] !== "error") continue;
+    const detail = nonEmpty2(ev["detail"]);
+    if (detail !== null) return { error: detail, errorCode: nonEmpty2(ev["code"]) };
+  }
+  if (status !== "succeeded") {
+    const content3 = nonEmpty2(m2["content"]);
+    if (content3 !== null) return { error: content3, errorCode: null };
+  }
+  return { error: null, errorCode: null };
+}
+var RUN_MARKER_PREFIX, boardWatchRunMarker, parseRunMarker, SINCE_MARKER_PREFIX, boardWatchSinceMarker, parseSinceMarker, TERMINAL_RUN_STATUS, MAX_REASON_CHARS, MAX_LISTED_FILES, BoardWatcher;
 var init_board_watch = __esm({
   "../server/src/design/board-watch.ts"() {
     "use strict";
     init_src7();
-    MARKER_PREFIX = "[od-board-watch mtime:";
-    boardWatchMarker = (mtimeMs) => `${MARKER_PREFIX}${mtimeMs}]`;
-    parseMarker = (body2) => {
-      const i = body2.indexOf(MARKER_PREFIX);
-      if (i < 0) return null;
-      const n = Number.parseInt(body2.slice(i + MARKER_PREFIX.length), 10);
-      return Number.isFinite(n) ? n : null;
-    };
     RUN_MARKER_PREFIX = "[od-board-watch run:";
-    boardWatchRunMarker = (runId) => `${RUN_MARKER_PREFIX}${runId}]`;
+    boardWatchRunMarker = (roundKey) => `${RUN_MARKER_PREFIX}${roundKey}]`;
     parseRunMarker = (body2) => {
       const i = body2.indexOf(RUN_MARKER_PREFIX);
       if (i < 0) return null;
@@ -276860,113 +277501,183 @@ var init_board_watch = __esm({
       const id = body2.slice(i + RUN_MARKER_PREFIX.length, j);
       return id.length > 0 ? id : null;
     };
+    SINCE_MARKER_PREFIX = "[od-board-watch since:";
+    boardWatchSinceMarker = (sinceMs) => `${SINCE_MARKER_PREFIX}${sinceMs}]`;
+    parseSinceMarker = (body2) => {
+      const i = body2.indexOf(SINCE_MARKER_PREFIX);
+      if (i < 0) return null;
+      const n = Number.parseInt(body2.slice(i + SINCE_MARKER_PREFIX.length), 10);
+      return Number.isFinite(n) ? n : null;
+    };
     TERMINAL_RUN_STATUS = /* @__PURE__ */ new Set(["succeeded", "failed", "canceled", "cancelled"]);
+    MAX_REASON_CHARS = 500;
+    MAX_LISTED_FILES = 10;
     BoardWatcher = class {
       constructor(deps) {
         this.deps = deps;
-      }
-      odGet(path47) {
+        if (!deps.kernel && !(deps.listCompanies && deps.kernelFor)) throw new Error("BoardWatcher \u9700\u8981 kernel\uFF0C\u6216 listCompanies + kernelFor");
+      }
+      /** `<公司>\0<artifactId>` → 本进程第一次读成功时钉住的起算点（还没写过带 since 的信时用），免得在第一封信之前随时间往后漂。 */
+      pinnedSince = /* @__PURE__ */ new Map();
+      /** `<公司>\0<boardKey>\0<conversationId>` → 本进程上次把这个对话的轮次处理完时它的 updatedAt。 */
+      seenConvAt = /* @__PURE__ */ new Map();
+      /** 公司 → 上次记下的失败原文（同样的错只记一次；成功一轮就清掉）。 */
+      companyLastError = /* @__PURE__ */ new Map();
+      async odGet(path47) {
         const fetchImpl = this.deps.fetchImpl ?? fetch;
-        return fetchImpl(`${this.deps.odBase}${path47}`, this.deps.odToken ? { headers: { authorization: `Bearer ${this.deps.odToken}` } } : void 0);
-      }
-      /** 查一块板的交付物（排 task-context/、只算带 artifactManifest 的）。404/网络错 → null（板不存在）。 */
-      async boardFiles(boardKey) {
         try {
-          const res = await this.odGet(`/api/projects/${encodeURIComponent(boardKey)}/files`);
-          if (!res.ok) return null;
-          const body2 = await res.json();
-          return (body2.files ?? []).filter((f2) => !f2.path.startsWith("task-context/") && f2.artifactManifest !== void 0).map((f2) => ({ path: f2.path, kind: f2.kind ?? null, mtime: f2.mtime ?? null }));
-        } catch {
-          return null;
+          const res = await fetchImpl(`${this.deps.odBase}${path47}`, this.deps.odToken ? { headers: { authorization: `Bearer ${this.deps.odToken}` } } : void 0);
+          if (res.status === 401 || res.status === 403) return { kind: "denied", status: res.status };
+          if (res.status === 404) return { kind: "missing" };
+          if (!res.ok) return { kind: "error", detail: `HTTP ${res.status}` };
+          return { kind: "ok", value: await res.json() };
+        } catch (err) {
+          return { kind: "error", detail: String(err) };
         }
       }
       /**
-       * 查一块板的 run 列表（`GET /api/runs?projectId=`，与 CLI `design status` 同源）。
-       * run 注册表是 od 的**内存态**——重启即空，查不到不代表没跑过；所以这里失败一律降级成空数组，
-       * 由板文件 mtime 那条慢路径兜底，绝不因为查不到 run 就压掉写信。
+       * 列出一块板上结束时间可能晚于 since 的轮次（跨对话；顺序不重要，调用方按 endedAt 排）。
+       *
+       * 省流：od 的 assistant 消息带整段 events 与 content，每分钟把每个对话的 /messages 全拉一遍，轮次多的板
+       * 一分钟就是几 MB。所以先用 /conversations 列表里的 updatedAt / latestRun.endedAt（取较大）筛：
+       * - 不晚于 since → 这个对话里不可能有要写信的轮次，跳过；
+       * - 和本进程上次看完时一样 → 没变，跳过（seenConvAt，serve 重启即清空，退回只按 since 筛，run marker 去重兜着）。
+       * 两个时间都没有的对话照拉，不猜。返回每个拉过的对话的 updatedAt，由 tick 在它的轮次都写完信后记进 seenConvAt。
        */
-      async boardRuns(boardKey) {
-        try {
-          const res = await this.odGet(`/api/runs?projectId=${encodeURIComponent(boardKey)}`);
-          if (!res.ok) return [];
-          const body2 = await res.json();
-          return (body2.runs ?? []).map((r) => ({ runId: String(r["runId"] ?? r["id"] ?? ""), status: String(r["status"] ?? "unknown") })).filter((r) => r.runId.length > 0);
-        } catch {
-          return [];
-        }
+      async boardRounds(company, boardKey, since) {
+        const base = `/api/projects/${encodeURIComponent(boardKey)}/conversations`;
+        const convs = await this.odGet(base);
+        if (convs.kind !== "ok") return convs;
+        const rounds = [];
+        const fetched = /* @__PURE__ */ new Map();
+        for (const c of convs.value.conversations ?? []) {
+          const cid = nonEmpty2(c["id"]);
+          if (cid === null) continue;
+          const latestRun = c["latestRun"] && typeof c["latestRun"] === "object" ? c["latestRun"] : {};
+          const times = [parseOdTime(c["updatedAt"]), parseOdTime(latestRun["endedAt"])].filter((t) => t !== null);
+          const convAt = times.length > 0 ? Math.max(...times) : null;
+          if (convAt !== null && (convAt <= since || this.seenConvAt.get(`${company}\0${boardKey}\0${cid}`) === convAt)) continue;
+          const msgs = await this.odGet(`${base}/${encodeURIComponent(cid)}/messages`);
+          if (msgs.kind === "missing") continue;
+          if (msgs.kind !== "ok") return msgs;
+          fetched.set(cid, convAt);
+          for (const m2 of msgs.value.messages ?? []) {
+            if (!m2 || typeof m2 !== "object") continue;
+            const r = roundOfMessage(m2, cid);
+            if (r !== null) rounds.push(r);
+          }
+        }
+        return { kind: "ok", value: { rounds, fetched } };
+      }
+      /** 失败轮消息上没有错误原文时，去 `/api/runs` 按 runId 找 od 记的 error；找不到（含 od 重启过）→ null。 */
+      async runErrorFromRegistry(boardKey, runId) {
+        const res = await this.odGet(`/api/runs?projectId=${encodeURIComponent(boardKey)}`);
+        if (res.kind !== "ok") return null;
+        const hit = (res.value.runs ?? []).find((r) => String(r["runId"] ?? r["id"] ?? "") === runId);
+        return hit ? nonEmpty2(hit["error"]) : null;
       }
       async tick(now = Date.now()) {
-        const { kernel, boardKeyOf, log: log3 } = this.deps;
-        const quietMs = this.deps.quietMs ?? 10 * 6e4;
+        const { log: log3 } = this.deps;
+        const denied = [];
+        const { listCompanies, kernelFor } = this.deps;
+        if (listCompanies && kernelFor) {
+          for (const companyId of await listCompanies()) {
+            try {
+              await this.tickCompany(companyId, await kernelFor(companyId), now, denied);
+              this.companyLastError.delete(companyId);
+            } catch (err) {
+              const msg = String(err);
+              if (this.companyLastError.get(companyId) === msg) continue;
+              this.companyLastError.set(companyId, msg);
+              log3?.(`[board-watch] [${companyId}] \u8FD9\u4E00\u8F6E\u6CA1\u5DE1\u6210\uFF08\u5176\u4F59\u516C\u53F8\u7EE7\u7EED\uFF09\uFF1A${msg}`);
+            }
+          }
+        } else {
+          await this.tickCompany("", this.deps.kernel, now, denied);
+        }
+        if (denied.length > 0) {
+          const codes = [...new Set(denied.map((d) => d.status))].join("/");
+          const eg = denied[0];
+          log3?.(
+            `[board-watch] od \u62D2\u7EDD\u4E86\u5DE1\u68C0\u8BF7\u6C42\uFF08HTTP ${codes}\uFF0C${denied.length} \u5757\u677F\uFF0C\u5982 ${eg.company ? `[${eg.company}] ` : ""}${eg.boardKey}\uFF09\uFF1A${this.deps.odToken ? "\u5E26\u4E86 OASIS_OPEN_DESIGN_TOKEN \u4F46 od \u4E0D\u8BA4\uFF0C\u6838\u5BF9\u5B83\u4E0E od \u7684 OD_API_TOKEN \u662F\u5426\u4E00\u81F4" : "\u6CA1\u914D OASIS_OPEN_DESIGN_TOKEN\uFF0Cod \u8981\u4EE4\u724C"}\u3002\u8FD9\u4E9B\u677F\u672C\u8F6E\u6CA1\u770B\u6210`
+          );
+        }
+      }
+      /** 巡一家公司（company 为空串 = 单 kernel 模式）；被拒的板记进 denied，由 tick 统一汇总成一行。 */
+      async tickCompany(company, kernel, now, denied) {
+        const { boardKeyOf, log: log3 } = this.deps;
+        const graceMs = this.deps.firstLookGraceMs ?? 10 * 6e4;
         const maxPerTick = this.deps.maxLettersPerTick ?? 2;
         const actor = this.deps.actor ?? "actor:system";
+        const tag = company ? `[${company}] ` : "";
         const model = kernel.model;
         let written = 0;
-        for (const a of model.artifacts.values()) {
-          if (a.type !== "design") continue;
-          if (lifecycleOf(model, a.id) !== "active") continue;
+        for (const a of [...model.artifacts.values()]) {
           if (written >= maxPerTick) {
-            log3?.(`[board-watch] \u672C\u8F6E\u5199\u4FE1\u5DF2\u8FBE\u4E0A\u9650 ${maxPerTick}\uFF0C\u5176\u4F59\u677F\u4E0B\u8F6E\u518D\u770B`);
+            log3?.(`[board-watch] ${tag}\u672C\u8F6E\u5199\u4FE1\u5DF2\u8FBE\u4E0A\u9650 ${maxPerTick}\uFF0C\u5176\u4F59\u677F\u4E0B\u8F6E\u518D\u770B`);
             break;
           }
+          if (a.type !== "design") continue;
+          if (lifecycleOf(model, a.id) !== "active") continue;
           const boardKey = boardKeyOf(a.id);
-          const files = await this.boardFiles(boardKey);
-          if (files === null) continue;
-          const runs = await this.boardRuns(boardKey);
-          if (files.length === 0 && runs.length === 0) continue;
-          const boardMtime = files.reduce((mx, f2) => f2.mtime !== null && (mx === null || f2.mtime > mx) ? f2.mtime : mx, null);
-          const watchLetters = annotationsOf(model, a.id).filter(
-            (x2) => x2.author === actor && (parseMarker(x2.body) !== null || parseRunMarker(x2.body) !== null)
-          );
-          const letteredRuns = new Set(
-            watchLetters.map((x2) => parseRunMarker(x2.body)).filter((s2) => s2 !== null)
-          );
-          const newestTerminalRun = runs.find((r) => TERMINAL_RUN_STATUS.has(r.status)) ?? null;
-          const lastOpAt = model.lastOpAt.get(a.id);
-          const candidate = {
-            boardMtime,
-            hasRevision: revisionsOf(model, a.id).length > 0,
-            lastOpAtMs: lastOpAt ? Date.parse(lastOpAt) : null,
-            hasOpenWatchLetter: watchLetters.some((x2) => x2.state === "open"),
-            lastWatchMtime: watchLetters.reduce((mx, x2) => {
-              const m2 = parseMarker(x2.body);
-              return m2 !== null && (mx === null || m2 > mx) ? m2 : mx;
-            }, null),
-            freshTerminalRunId: newestTerminalRun !== null && !letteredRuns.has(newestTerminalRun.runId) ? newestTerminalRun.runId : null
-          };
-          if (!decideBoardLetter(candidate, now, quietMs)) continue;
-          const fmt = (fs52) => fs52.slice(0, 5).map((f2) => `- ${f2.path}\uFF08${f2.kind ?? "?"}\uFF09\xB7 ${f2.mtime ? new Date(f2.mtime).toISOString() : "?"}`).join("\n");
-          let body2;
-          let logLine;
-          if (candidate.freshTerminalRunId !== null) {
-            const status = newestTerminalRun.status;
-            const ok3 = status === "succeeded";
-            const listed = files.length > 0 ? fmt([...files].sort((x2, y) => (y.mtime ?? 0) - (x2.mtime ?? 0))) : "\uFF08\u677F\u4E0A\u6682\u65E0\u4EA4\u4ED8\u7269\uFF09";
-            body2 = [
-              // 两个 marker 都带：run marker 管快路径去重，mtime marker 顺手把慢路径也盖住——
-              // 否则这封信被 resolve 后，慢路径会就**同一批板内容**再写一封（两路去重各管各的）。
-              boardMtime !== null ? `${boardWatchRunMarker(candidate.freshTerminalRunId)} ${boardWatchMarker(boardMtime)}` : boardWatchRunMarker(candidate.freshTerminalRunId),
-              ok3 ? `\u753B\u677F ${boardKey} \u7684\u5F15\u64CE\u8DD1\u5B8C\u4E86\uFF08run ${candidate.freshTerminalRunId.slice(0, 8)} \u7EC8\u6001=${status}\uFF09\uFF0C\u8D27\u5728\u677F\u4E0A\u7B49\u4F60\u6536\uFF1A` : `\u753B\u677F ${boardKey} \u7684\u5F15\u64CE\u8FD9\u4E00\u8F6E**\u6CA1\u8DD1\u6210**\uFF08run ${candidate.freshTerminalRunId.slice(0, 8)} \u7EC8\u6001=${status}\uFF09\u3002\u677F\u4E0A\u5F53\u524D\u5185\u5BB9\uFF1A`,
-              listed,
-              ``,
-              ok3 ? `\u53D6\u8D27\u6838\u5BF9\uFF1A\`oasis design status ${a.id} --pull\` \u2192 \u5BF9\u7740 DESIGN_BRIEF.md \u4E0E inputs/ \u9010\u5B57\u6BB5\u6838\uFF08\u6570\u636E\u5BF9\u4E0D\u5BF9\u3001\u72B6\u6001\u5168\u4E0D\u5168\u3001\u6709\u6CA1\u6709\u7F16\u9020\uFF09\u3002\u591F\u597D\u5C31 \`oasis propose ${a.id} --from-dir <\u76EE\u5F55> --reason "<\u8FD9\u7248\u505A\u4E86\u4EC0\u4E48>"\`\uFF1B\u8981\u6539\u5C31\u56DE\u677F\u4E0A\u518D\u6765\u4E00\u8F6E \`oasis design chat ${a.id} --turn continue --message "<\u8981\u6539\u4EC0\u4E48>" --async\`\uFF08\u26D4 \u522B\u628A --pull \u4E0B\u6765\u7684\u6587\u4EF6\u5728\u672C\u5730\u624B\u6539\u540E propose\uFF09\u3002` : `\u5148 \`oasis design status ${a.id}\` \u770B\u677F\u4E0A\u6709\u6CA1\u6709\u53EF\u7528\u7684\u4E0A\u4E00\u7248\uFF1A\u6709\u5C31\u7167\u5E38\u53D6\u8D27\u6838\u5BF9\uFF1B\u6CA1\u6709\u5C31\u628A\u9700\u6C42\u4E0E\u771F\u5B9E\u6570\u636E\u9489\u5F97\u66F4\u6B7B\u540E\u91CD\u8D77\u4E00\u8F6E \`oasis design chat ${a.id} --message "<\u2026>" --async\`\uFF0C\u4ECD\u4E0D\u884C\u7528 \`oasis gap ${a.id} --desc "<\u5361\u5728\u54EA>"\` \u5192\u6CE1\u7ED9\u4EBA\u3002`
-            ].join("\n");
-            logLine = `[board-watch] ${a.id} \u2190 \u677F ${boardKey} \u5F15\u64CE\u6536\u5C3E\uFF08run ${candidate.freshTerminalRunId.slice(0, 8)} ${status}\uFF09\u2192 \u5DF2\u5199\u4FE1\u5524 owner`;
-          } else {
-            const newest = files.filter((f2) => f2.mtime !== null && candidate.lastOpAtMs !== null && f2.mtime > candidate.lastOpAtMs).sort((x2, y) => (y.mtime ?? 0) - (x2.mtime ?? 0));
-            body2 = [
-              boardWatchMarker(boardMtime),
-              `\u753B\u677F ${boardKey} \u4E0A\u6709 Oasis \u4E4B\u5916\u7684\u65B0\u52A8\u9759\uFF08\u4EBA\u5728\u677F\u4E0A\u5BF9\u8BDD/\u6539\u7A3F\uFF0C\u6216\u5F15\u64CE\u4EA7\u4E86\u6CA1\u4EBA\u6536\u7684\u65B0\u7248\uFF09\uFF0C\u6BD4\u672C\u4EA7\u7269\u6700\u8FD1\u4E00\u6B21\u64CD\u4F5C\uFF08${lastOpAt ?? "?"}\uFF09\u65B0\u3001\u4E14\u5DF2\u9759\u9ED8 ${Math.round(quietMs / 6e4)} \u5206\u949F\uFF1A`,
-              fmt(newest.length > 0 ? newest : files),
-              ``,
-              `\u8BF7\u53D6\u8D27\u6838\u5BF9\uFF1A\`oasis design status ${a.id} --pull\` \u2192 \u5185\u5BB9\u5408\u610F\u5C31 \`oasis propose ${a.id} --from-dir <\u76EE\u5F55> --reason "<\u6536\u5F55\u677F\u4E0A\u4EBA\u5DE5\u8FED\u4EE3>"\` \u6536\u5F55\u4E3A\u65B0\u7248\u672C\uFF1B\u4E0D\u5408\u610F/\u4E0D\u5FC5\u6536\u5F55\uFF0C\u56DE\u5E16\u8BF4\u660E\u540E\u6309 wontfix \u5904\u7406\u5373\u53EF\uFF08\u540C\u4E00\u7248\u4E0D\u4F1A\u518D\u6765\u4FE1\uFF09\u3002`
-            ].join("\n");
-            logLine = `[board-watch] ${a.id} \u2190 \u677F ${boardKey} \u6709\u65B0\u5185\u5BB9\uFF08mtime=${new Date(boardMtime).toISOString()}\uFF09\u2192 \u5DF2\u5199\u4FE1\u5524 owner`;
+          const pinKey = `${company}\0${a.id}`;
+          const watchLetters = annotationsOf(model, a.id).filter((x2) => x2.author === actor && x2.body.includes("[od-board-watch "));
+          const lettered = new Set(watchLetters.map((x2) => parseRunMarker(x2.body)).filter((s2) => s2 !== null));
+          const recordedSince = watchLetters.reduce((mn, x2) => {
+            const s2 = parseSinceMarker(x2.body);
+            return s2 !== null && (mn === null || s2 < mn) ? s2 : mn;
+          }, null);
+          const since = recordedSince ?? this.pinnedSince.get(pinKey) ?? now - graceMs;
+          const read3 = await this.boardRounds(company, boardKey, since);
+          if (read3.kind === "missing") continue;
+          if (read3.kind === "denied") {
+            denied.push({ company, boardKey, status: read3.status });
+            continue;
           }
-          await kernel.annotate({ artifactId: a.id, actor, body: body2, kind: "comment" });
-          written++;
-          log3?.(logLine);
+          if (read3.kind === "error") {
+            log3?.(`[board-watch] ${tag}\u8BFB\u753B\u677F ${boardKey} \u5931\u8D25\uFF08${read3.detail}\uFF09\uFF0C\u672C\u8F6E\u8DF3\u8FC7`);
+            continue;
+          }
+          if (recordedSince === null && !this.pinnedSince.has(pinKey)) this.pinnedSince.set(pinKey, since);
+          const fresh = read3.value.rounds.filter((r) => r.endedAt > since && !lettered.has(r.key)).sort((x2, y) => x2.endedAt - y.endedAt);
+          const seen = /* @__PURE__ */ new Set();
+          for (const r of fresh) {
+            if (written >= maxPerTick) break;
+            if (seen.has(r.key)) continue;
+            seen.add(r.key);
+            const ok3 = r.status === "succeeded";
+            const reason = ok3 ? null : r.error ?? (r.runId !== null ? await this.runErrorFromRegistry(boardKey, r.runId) : null);
+            await kernel.annotate({ artifactId: a.id, actor, body: this.letterBody(a.id, boardKey, r, since, reason), kind: "comment" });
+            written++;
+            log3?.(`[board-watch] ${tag}${a.id} \u2190 \u677F ${boardKey} \u4E00\u8F6E\u5BF9\u8BDD\u7ED3\u675F\uFF08${r.key.slice(0, 12)} ${r.status}${r.agentId ? ` ${r.agentId}` : ""}\uFF09\u2192 \u5DF2\u5199\u4FE1\u5524 owner`);
+          }
+          const pending = new Set(fresh.filter((r) => !seen.has(r.key)).map((r) => r.conversationId));
+          for (const [cid, convAt] of read3.value.fetched) {
+            if (convAt !== null && !pending.has(cid)) this.seenConvAt.set(`${company}\0${boardKey}\0${cid}`, convAt);
+          }
+        }
+      }
+      letterBody(artifactId, boardKey, r, since, reason) {
+        const marker = `${boardWatchRunMarker(r.key)} ${boardWatchSinceMarker(since)}`;
+        const round = `${r.runId !== null ? `run ${r.runId.slice(0, 8)}` : `\u6D88\u606F ${r.key.slice(4, 12)}`}\uFF0C\u5F15\u64CE=${r.agentId ?? "?"}\uFF0C\u7ED3\u675F\u4E8E ${new Date(r.endedAt).toISOString()}`;
+        if (r.status === "succeeded") {
+          const files = r.producedFiles.length > 0 ? [...r.producedFiles.slice(0, MAX_LISTED_FILES).map((f2) => `- ${f2}`), ...r.producedFiles.length > MAX_LISTED_FILES ? [`- \u2026\u53E6 ${r.producedFiles.length - MAX_LISTED_FILES} \u4E2A`] : []].join("\n") : "\uFF08\u8FD9\u4E00\u8F6E\u6CA1\u6709\u767B\u8BB0\u4EA7\u51FA\u6587\u4EF6\uFF09";
+          return [
+            marker,
+            `\u753B\u677F ${boardKey} \u4E0A\u6709\u4E00\u8F6E\u5BF9\u8BDD\u8DD1\u5B8C\u4E86\uFF08${round}\uFF09\uFF0C\u8FD9\u4E00\u8F6E\u4EA7\u51FA\uFF1A`,
+            files,
+            ``,
+            `\u53D6\u8D27\u6838\u5BF9\uFF1A\`oasis design status ${artifactId} --pull\` \u2192 \u5BF9\u7740 DESIGN_BRIEF.md \u4E0E inputs/ \u9010\u5B57\u6BB5\u6838\uFF08\u6570\u636E\u5BF9\u4E0D\u5BF9\u3001\u72B6\u6001\u5168\u4E0D\u5168\u3001\u6709\u6CA1\u6709\u7F16\u9020\uFF09\u3002\u591F\u597D\u5C31 \`oasis propose ${artifactId} --from-dir <\u76EE\u5F55> --reason "<\u8FD9\u7248\u505A\u4E86\u4EC0\u4E48>"\`\uFF1B\u8981\u6539\u5C31\u56DE\u677F\u4E0A\u518D\u6765\u4E00\u8F6E \`oasis design chat ${artifactId} --turn continue --message "<\u8981\u6539\u4EC0\u4E48>" --async\`\uFF08\u26D4 \u522B\u628A --pull \u4E0B\u6765\u7684\u6587\u4EF6\u5728\u672C\u5730\u624B\u6539\u540E propose\uFF09\u3002\u8FD9\u4E00\u8F6E\u82E5\u662F\u4EBA\u76F4\u63A5\u5728\u677F\u4E0A\u804A\u51FA\u6765\u7684\u3001\u5185\u5BB9\u4E0D\u5FC5\u6536\u5F55\uFF0C\u56DE\u5E16\u8BF4\u660E\u540E\u6309 wontfix \u5904\u7406\u5373\u53EF\uFF08\u540C\u4E00\u8F6E\u4E0D\u4F1A\u518D\u6765\u4FE1\uFF09\u3002`
+          ].join("\n");
         }
+        const quoted = reason === null ? null : reason.length > MAX_REASON_CHARS ? `${reason.slice(0, MAX_REASON_CHARS)}\u2026` : reason;
+        return [
+          marker,
+          `\u753B\u677F ${boardKey} \u4E0A\u6709\u4E00\u8F6E\u5BF9\u8BDD**\u6CA1\u8DD1\u6210**\uFF08\u7EC8\u6001=${r.status}\uFF0C${round}\uFF09\u3002`,
+          quoted !== null ? `od \u8BB0\u7684\u539F\u56E0\uFF08\u539F\u6587\uFF09\uFF1A${quoted}${r.errorCode !== null ? `\uFF08\u9519\u8BEF\u7801 ${r.errorCode}\uFF09` : ""}` : `od \u6CA1\u6709\u8BB0\u5F55\u8FD9\u4E00\u8F6E\u7684\u5931\u8D25\u539F\u56E0\u3002`,
+          ``,
+          `\u5148 \`oasis design status ${artifactId}\` \u770B\u677F\u4E0A\u6709\u6CA1\u6709\u53EF\u7528\u7684\u4E0A\u4E00\u7248\uFF1A\u6709\u5C31\u7167\u5E38\u53D6\u8D27\u6838\u5BF9\u3002\u8981\u91CD\u8DD1\u5C31\u81EA\u5DF1\u5224\u65AD\uFF1A\u50CF\u662F\u989D\u5EA6/\u9650\u6D41\u5C31\u7B49\u6062\u590D\u540E\u518D\u6765\uFF0C\u6216\u6362\u4E2A\u5F15\u64CE \`oasis design chat ${artifactId} --agent <\u5F15\u64CE> --message "<\u2026>" --async\`\uFF1B\u50CF\u662F\u9700\u6C42/\u6570\u636E\u95EE\u9898\u5C31\u628A\u5B83\u4EEC\u9489\u5F97\u66F4\u6B7B\u540E\u91CD\u8D77\u4E00\u8F6E\uFF1B\u4ECD\u4E0D\u884C\u7528 \`oasis gap ${artifactId} --desc "<\u5361\u5728\u54EA>"\` \u5192\u6CE1\u7ED9\u4EBA\u3002`
+        ].join("\n");
       }
     };
   }
@@ -277848,8 +278559,8 @@ __export(src_exports2, {
   bindWorkorderProject: () => bindWorkorderProject,
   bindingResolverFromRegistry: () => bindingResolverFromRegistry,
   bindingRuntimeState: () => bindingRuntimeState,
-  boardWatchMarker: () => boardWatchMarker,
   boardWatchRunMarker: () => boardWatchRunMarker,
+  boardWatchSinceMarker: () => boardWatchSinceMarker,
   broadcastMessageId: () => broadcastMessageId,
   broadcastMessageText: () => broadcastMessageText,
   bucketRuntimeRuns: () => bucketRuntimeRuns,
@@ -277953,7 +278664,6 @@ __export(src_exports2, {
   cronNext: () => cronNext,
   cronNextN: () => cronNextN,
   deadlineClockTick: () => deadlineClockTick,
-  decideBoardLetter: () => decideBoardLetter,
   defaultAvatarRefOf: () => defaultAvatarRefOf,
   delegationArtifactsView: () => delegationArtifactsView,
   delegationBundleAdditions: () => delegationBundleAdditions,
@@ -278104,6 +278814,7 @@ __export(src_exports2, {
   parseConnectorSkillId: () => parseConnectorSkillId,
   parseKnowledgeAnswerOutput: () => parseKnowledgeAnswerOutput,
   parseKnowledgePlan: () => parseKnowledgePlan,
+  parseOdTime: () => parseOdTime,
   parseReadScope: () => parseReadScope,
   parseSkillFrontmatter: () => parseSkillFrontmatter,
   parseSymrefHead: () => parseSymrefHead,
@@ -278193,6 +278904,7 @@ __export(src_exports2, {
   retireCdGateInTypeStore: () => retireCdGateInTypeStore,
   rolesDomain: () => rolesDomain,
   rollbackOrgIdentity: () => rollbackOrgIdentity,
+  roundOfMessage: () => roundOfMessage,
   routeFusedSignal: () => routeFusedSignal,
   runtimeConnectionStatus: () => runtimeConnectionStatus,
   runtimeDriftBlock: () => runtimeDriftBlock,
@@ -278758,14 +279470,14 @@ init_src();
 var os16 = __toESM(require("node:os"));
 var path46 = __toESM(require("node:path"));
 var import_node_child_process26 = require("node:child_process");
-var import_node_crypto94 = require("node:crypto");
+var import_node_crypto95 = require("node:crypto");
 
 // ../cli/src/cli.ts
 init_src();
 var fs44 = __toESM(require("node:fs"), 1);
 var os13 = __toESM(require("node:os"), 1);
 var path39 = __toESM(require("node:path"), 1);
-var import_node_crypto92 = require("node:crypto");
+var import_node_crypto93 = require("node:crypto");
 
 // ../cli/src/serve.ts
 init_src11();
@@ -278777,11 +279489,11 @@ var fs36 = __toESM(require("node:fs"), 1);
 var os9 = __toESM(require("node:os"), 1);
 var path30 = __toESM(require("node:path"), 1);
 var import_node_child_process18 = require("node:child_process");
-var import_node_crypto88 = require("node:crypto");
+var import_node_crypto89 = require("node:crypto");
 var import_node_url7 = require("node:url");
 
 // ../cli/src/artifact-discovery-source.ts
-var import_node_crypto84 = require("node:crypto");
+var import_node_crypto85 = require("node:crypto");
 init_src7();
 var ArtifactDiscoverySourceUnreadableError = class extends Error {
   constructor(message) {
@@ -278811,7 +279523,7 @@ async function resolveArtifactDiscoverySourceContent(blobs, input) {
     throw new ArtifactDiscoverySourceUnreadableError(`Artifact Revision ${input.revisionId} \u7684 contentKind \u4E0D\u53D7\u652F\u6301\uFF1A${String(input.contentKind)}`);
   }
   const rootBytes = await blobs.get(input.contentRef);
-  const sourceFingerprint = (0, import_node_crypto84.createHash)("sha256").update(rootBytes).digest("hex");
+  const sourceFingerprint = (0, import_node_crypto85.createHash)("sha256").update(rootBytes).digest("hex");
   if (input.contentKind === "inline-blob") {
     const sourceContent = decodeText3(rootBytes);
     if (sourceContent === null) {
@@ -278835,7 +279547,7 @@ ${entry.text}`).join("\n\n"),
 }
 
 // ../server/src/domains/discussions/service.ts
-var import_node_crypto85 = require("node:crypto");
+var import_node_crypto86 = require("node:crypto");
 init_zod();
 init_discussions();
 init_router();
@@ -278897,7 +279609,7 @@ function remapTopics(topics, removed) {
   return [...out].map(([topic_id, summary]) => ({ topic_id, summary }));
 }
 var entryId = (projectId2, id) => JSON.stringify([projectId2, id]);
-var hash2 = (s2) => (0, import_node_crypto85.createHash)("sha256").update(s2).digest("hex").slice(0, 24);
+var hash2 = (s2) => (0, import_node_crypto86.createHash)("sha256").update(s2).digest("hex").slice(0, 24);
 var canonical = (s2) => s2.normalize("NFKC").trim().toLocaleLowerCase();
 function decisionFingerprint(d) {
   return hash2(JSON.stringify([d.statement, d.rationale, d.alternatives]));
@@ -279117,7 +279829,7 @@ var DiscussionService = class {
         throw new ApiError(409, "DISCUSSION_CONFLICT", "\u9879\u76EE\u8BAE\u9898\u6216\u51B3\u7B56\u5DF2\u53D8\u5316\uFF0C\u8BF7\u8BFB\u53D6\u6700\u65B0\u5185\u5BB9\u540E\u4FEE\u6B63");
       }
     }
-    const operation = (value2) => tx.put("operation", (0, import_node_crypto85.randomUUID)(), {
+    const operation = (value2) => tx.put("operation", (0, import_node_crypto86.randomUUID)(), {
       ...value2,
       projectId: projectId2,
       actorId: ctx.actorId,
@@ -279134,7 +279846,7 @@ var DiscussionService = class {
       if (id.startsWith("new:")) {
         if (BUG_TOPIC.test(t.title.trim())) invalid("topics.title", `\u300C${t.title}\u300D\u662F\u5355\u4E2A Bug\uFF1A\u4FEE\u590D\u60C5\u51B5\u5199\u8FDB\u8BA8\u8BBA\u8BB0\u5F55\uFF0C\u5B9A\u51FA\u7684\u89C4\u5219\u6302\u5230\u5BF9\u5E94\u529F\u80FD\u8BAE\u9898\u4E0B\uFF0C\u4E0D\u6309 Bug \u53F7\u5EFA\u8BAE\u9898`);
         const existing = [...topicMap.values()].find((x2) => canonical(x2.title) === canonical(t.title));
-        id = existing?.topicId ?? `topic_${(0, import_node_crypto85.randomUUID)()}`;
+        id = existing?.topicId ?? `topic_${(0, import_node_crypto86.randomUUID)()}`;
         if (!existing) createdTopics.add(id);
       } else if (!topicMap.has(id)) invalid("topics.topic_id", `\u8BAE\u9898 ${id} \u4E0D\u5B58\u5728\uFF1B\u65B0\u8BAE\u9898\u4F7F\u7528 new: \u524D\u7F00`);
       topicAliases.set(t.topic_id, id);
@@ -279186,7 +279898,7 @@ var DiscussionService = class {
       if (id.startsWith("new:")) {
         const candidateKey = JSON.stringify([topicId, canonical(d.record.statement)]);
         const existing = [...decisionMap.values()].find((x2) => x2.topicId === topicId && canonical(x2.record.statement) === canonical(d.record.statement));
-        id = existing?.decisionId ?? candidateIds.get(candidateKey) ?? `decision_${(0, import_node_crypto85.randomUUID)()}`;
+        id = existing?.decisionId ?? candidateIds.get(candidateKey) ?? `decision_${(0, import_node_crypto86.randomUUID)()}`;
         candidateIds.set(candidateKey, id);
       } else if (!decisionMap.has(id)) invalid("decision_id", `\u51B3\u7B56 ${id} \u4E0D\u5B58\u5728\uFF1B\u65B0\u51B3\u7B56\u4F7F\u7528 new: \u524D\u7F00`);
       decisionAliases.set(d.decision_id, id);
@@ -279448,7 +280160,7 @@ var DiscussionService = class {
           ...row.value.confirmation ? { confirmation: { ...row.value.confirmation, fingerprint: decisionFingerprint(record9) } } : {}
         };
         await tx.put("decision", row.id, value2);
-        await tx.put("operation", (0, import_node_crypto85.randomUUID)(), {
+        await tx.put("operation", (0, import_node_crypto86.randomUUID)(), {
           action: "edit",
           kind: "decision",
           projectId: projectId2,
@@ -279512,7 +280224,7 @@ var DiscussionService = class {
         if (!current || current.revision !== row.revision) throw new ApiError(409, "DISCUSSION_CONFLICT", `\u8BA8\u8BBA ${row.id} \u5DF2\u88AB\u4FEE\u6539\uFF0C\u8BF7\u8BFB\u53D6\u6700\u65B0\u5185\u5BB9\u540E\u91CD\u8BD5`);
         const summary = given.get(row.id);
         await tx.put("discussion", row.id, { ...current.value, record: { ...current.value.record, summary } });
-        await tx.put("operation", (0, import_node_crypto85.randomUUID)(), {
+        await tx.put("operation", (0, import_node_crypto86.randomUUID)(), {
           action: "edit",
           kind: "discussion",
           projectId: current.value.record.project_id,
@@ -279528,7 +280240,7 @@ var DiscussionService = class {
     });
   }
   async operation(tx, actorId, kind, id, from, to) {
-    await tx.put("operation", (0, import_node_crypto85.randomUUID)(), { actorId, kind, id, from, to, at: new Date(this.now()).toISOString() });
+    await tx.put("operation", (0, import_node_crypto86.randomUUID)(), { actorId, kind, id, from, to, at: new Date(this.now()).toISOString() });
   }
 };
 function pickDiscussionContent(d) {
@@ -279828,7 +280540,7 @@ var DiscussionContext = class {
 };
 
 // ../server/src/domains/discussions/worker.ts
-var import_node_crypto86 = require("node:crypto");
+var import_node_crypto87 = require("node:crypto");
 var DISCUSSION_IDLE_MS = 15 * 6e4;
 var DISCUSSION_MAX_CORRECTIONS = 3;
 var DISCUSSION_LEASE_MS = 2 * 6e4;
@@ -279854,7 +280566,7 @@ var DiscussionWorker = class {
     if (await this.isReplying(sessionId)) return false;
     const cutoff = eligibleCutoff(await this.service.chat.listMessages(sessionId), this.service.now());
     if (!cutoff) return false;
-    const owner = (0, import_node_crypto86.randomUUID)();
+    const owner = (0, import_node_crypto87.randomUUID)();
     const claimed = await this.service.store.transaction(async (tx) => {
       const old = (await tx.get("job", sessionId))?.value;
       if (old?.status === "running" && (old.leaseUntil ?? 0) > this.service.now()) return null;
@@ -280576,7 +281288,7 @@ function createDiscussionRuntime(options) {
 }
 
 // ../server/src/domains/discussions/store.ts
-var import_node_crypto87 = require("node:crypto");
+var import_node_crypto88 = require("node:crypto");
 var import_promises17 = require("node:fs/promises");
 var import_node_path27 = require("node:path");
 var key = (kind, id) => JSON.stringify([kind, id]);
@@ -280621,7 +281333,7 @@ var MemoryDiscussionStore = class _MemoryDiscussionStore {
       if (changed) {
         if (this.filename) {
           await (0, import_promises17.mkdir)((0, import_node_path27.dirname)(this.filename), { recursive: true });
-          const temp = `${this.filename}.${(0, import_node_crypto87.randomUUID)()}.tmp`;
+          const temp = `${this.filename}.${(0, import_node_crypto88.randomUUID)()}.tmp`;
           await (0, import_promises17.writeFile)(temp, JSON.stringify(next), "utf8");
           await (0, import_promises17.rename)(temp, this.filename);
         }
@@ -281570,7 +282282,7 @@ function oasisWrapperScript() {
   const repoRoot = (0, import_node_url7.fileURLToPath)(new URL("../../../", __esm_import_meta_url));
   const tsx = path30.join(repoRoot, "node_modules/.bin/tsx");
   const main = path30.join(repoRoot, "packages/cli/src/main.ts");
-  const key2 = (0, import_node_crypto88.createHash)("sha256").update(repoRoot).digest("hex").slice(0, 12);
+  const key2 = (0, import_node_crypto89.createHash)("sha256").update(repoRoot).digest("hex").slice(0, 12);
   const uid = typeof process.getuid === "function" ? process.getuid() : "na";
   const stable = path30.join(os9.tmpdir(), `oasis-cli-wrapper-${uid}-${key2}`);
   let dir;
@@ -281963,7 +282675,7 @@ async function startServe(opts) {
     if (!hub) return Promise.resolve({ ok: false, reason: "\u672C\u8FDB\u7A0B\u6CA1\u6709\u8282\u70B9\u7F51\u5173" });
     const online = hub.connectedDaemons().some((d) => d.daemonId === nodeId);
     if (!online) return Promise.resolve({ ok: false, reason: "\u8282\u70B9\u5F53\u524D\u4E0D\u5728\u7EBF\uFF0C\u7528\u7684\u662F\u5B83\u4E0A\u6B21\u62A5\u7684\u6E05\u5355" });
-    const requestId = (0, import_node_crypto88.randomUUID)();
+    const requestId = (0, import_node_crypto89.randomUUID)();
     const task = new Promise((resolve12) => {
       const timer = setTimeout(() => {
         modelRefreshWaiters.delete(requestId);
@@ -282792,7 +283504,7 @@ async function startServe(opts) {
             const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
             if (buf || session.runId) {
               await turnStore.appendMessage({
-                id: (0, import_node_crypto88.randomUUID)(),
+                id: (0, import_node_crypto89.randomUUID)(),
                 sessionId: chatSessionId,
                 role: "assistant",
                 content: buf,
@@ -282838,7 +283550,7 @@ async function startServe(opts) {
     chatTargets: {
       inspect: inspectChatTarget,
       createTargetSession: async ({ companyId, agentId, ownerHumanActorId, title }) => {
-        const sessionId = (0, import_node_crypto88.randomUUID)();
+        const sessionId = (0, import_node_crypto89.randomUUID)();
         const nowIso = (/* @__PURE__ */ new Date()).toISOString();
         const binding = await registryStore.getBinding(agentId).catch(() => null);
         await (await chatStoreFor(companyId)).createSession({
@@ -284240,7 +284952,7 @@ async function startServe(opts) {
         }));
       }
       const limits = { wallClockMs: wallClockForKind("planner") };
-      const artifactId = `artifact:planner:${(0, import_node_crypto88.randomUUID)()}`;
+      const artifactId = `artifact:planner:${(0, import_node_crypto89.randomUUID)()}`;
       const handle = await chatRemoteAdapter.spawn({
         actor: planner.id,
         // companyId 同协调者：planner 用的就是默认公司的 actors 服务，漏签会让它一调公司域端点就 404。
@@ -285161,10 +285873,10 @@ async function startServe(opts) {
         if (isDeletedActor(dispatchTarget)) {
           throw new ApiError(409, ACTOR_DELETED_ERROR_CODE, ACTOR_DELETED_CHAT_MESSAGE);
         }
-        const runtimeSessionId = sessionId ?? (requestDispatchId ? deterministicUuid(`chat-runtime:${requestDispatchId}`) : (0, import_node_crypto88.randomUUID)());
+        const runtimeSessionId = sessionId ?? (requestDispatchId ? deterministicUuid(`chat-runtime:${requestDispatchId}`) : (0, import_node_crypto89.randomUUID)());
         const resumeRuntimeSession = Boolean(sessionId);
-        const traceRunId = requestDispatchId ? stableChatTraceRunId(requestDispatchId) : `chat-run:${(0, import_node_crypto88.randomUUID)()}`;
-        const artifactId = requestDispatchId ? `artifact:chat:${deterministicUuid(`chat-artifact:${requestDispatchId}`)}` : `artifact:chat:${(0, import_node_crypto88.randomUUID)()}`;
+        const traceRunId = requestDispatchId ? stableChatTraceRunId(requestDispatchId) : `chat-run:${(0, import_node_crypto89.randomUUID)()}`;
+        const artifactId = requestDispatchId ? `artifact:chat:${deterministicUuid(`chat-artifact:${requestDispatchId}`)}` : `artifact:chat:${(0, import_node_crypto89.randomUUID)()}`;
         let stableDispatch = requestDispatchId ? await resolveStableChatDispatch({ store: await traceStoreFor(runCompanyId), runId: traceRunId }) : null;
         if (stableDispatch && !stableDispatch.shouldDispatch) {
           if (isHumanSubmitDispatchId(requestDispatchId)) {
@@ -285638,7 +286350,13 @@ async function startServe(opts) {
             metadata: { ...base, dispatchId: handle.id },
             // 恢复路径拿不到 dispatchChat 闭包里的 fallback 解析结果，开跑时先写进账本；退出帧若上报
             // 更精确 model 仍会覆盖为 runtime 来源。
-            ...chatModel ? { effectiveModel: chatModel, modelSource: chatModelSource } : {}
+            // 这是**请求值**（会话选择 / 员工配置 / runtime 默认），按 ④ 排在实际值之下：采集点 1 的
+            // 首帧检查点可能已经先一步把运行时回报的实际值写进这一行（两条路都是异步入队，谁先到不定），
+            // 预写不能把它顶掉。
+            ...preferRunModel(
+              { effectiveModel: run.effectiveModel, modelSource: run.modelSource },
+              { effectiveModel: chatModel, modelSource: chatModelSource }
+            ) ?? {}
           });
         });
         const buffered = [];
@@ -285710,11 +286428,17 @@ async function startServe(opts) {
               }]);
               const usage = info.usage ?? null;
               const modelFields = chatExitModelFields(info.model, chatModel, chatModelSource, info.modelSource);
+              const needsNativeSessionMetadata = !!info.runtimeSessionId && info.runtimeSessionId !== runtimeSessionId;
+              const currentRun = needsNativeSessionMetadata || "effectiveModel" in modelFields ? await (await traceStoreFor(runCompanyId)).getRun(traceRunId).catch(() => null) : null;
               let nativeSessionMetadata;
-              if (info.runtimeSessionId && info.runtimeSessionId !== runtimeSessionId) {
-                const run = await (await traceStoreFor(runCompanyId)).getRun(traceRunId).catch(() => null);
-                nativeSessionMetadata = nativeRuntimeSessionMetadata(run?.metadata, info.runtimeSessionId);
+              if (needsNativeSessionMetadata) {
+                nativeSessionMetadata = nativeRuntimeSessionMetadata(currentRun?.metadata, info.runtimeSessionId);
               }
+              const modelPatch = preferRunModel(
+                { effectiveModel: currentRun?.effectiveModel, modelSource: currentRun?.modelSource },
+                { effectiveModel: modelFields.effectiveModel, modelSource: modelFields.modelSource },
+                "replace"
+              ) ?? {};
               await traceAppender.update({
                 status: classifySessionExitStatus(info),
                 endedAt,
@@ -285724,7 +286448,7 @@ async function startServe(opts) {
                 ...!isHealthySessionExit(info) && info.reason !== "cancelled" ? { errorCode: info.reason ?? "error", errorMessage: formatExitError(info) } : {},
                 transcriptRef: info.transcriptRef ?? null,
                 usage,
-                ...modelFields,
+                ...modelPatch,
                 ...nativeSessionMetadata ? { metadata: nativeSessionMetadata } : {}
               });
               if (usage) await settleRunUsage(await traceStoreFor(runCompanyId), traceRunId);
@@ -286622,7 +287346,7 @@ async function startServe(opts) {
             console.log(`[new-engine] dispatchWork ${workId} \u662F human work\u2014\u2014\u4E0D\u6D3E runtime\uFF0C\u7B49\u5F85\u4EBA\u5DE5\u5904\u7406`);
             return;
           }
-          const ledgerId = opts2?.protocolRecovery?.dispatchId ?? `dispatch:${(0, import_node_crypto88.randomUUID)()}`;
+          const ledgerId = opts2?.protocolRecovery?.dispatchId ?? `dispatch:${(0, import_node_crypto89.randomUUID)()}`;
           try {
             const inserted = await (await dispatchLedgerFor(companyId)).insertOpen({
               id: ledgerId,
@@ -286722,7 +287446,7 @@ async function startServe(opts) {
           const kernelModel = newKernel.model;
           const art = kernelModel.artifacts.get(nodeId);
           const revWid = art?.workspace ?? "";
-          const ledgerId = `dispatch:${(0, import_node_crypto88.randomUUID)()}`;
+          const ledgerId = `dispatch:${(0, import_node_crypto89.randomUUID)()}`;
           try {
             await (await dispatchLedgerFor(companyId)).insertOpen({
               id: ledgerId,
@@ -287116,7 +287840,7 @@ async function startServe(opts) {
         resolveSupplementalContext: server.knowledgeGovernance ? async ({ actorId, artifactId, workOrderId, action, part, runtimeKind, taskMarkdown }) => {
           try {
             const governance = server.knowledgeGovernance;
-            const taskFingerprint = (0, import_node_crypto88.createHash)("sha256").update(JSON.stringify({ artifactId, workOrderId, action, part: part ?? null, taskMarkdown })).digest("hex");
+            const taskFingerprint = (0, import_node_crypto89.createHash)("sha256").update(JSON.stringify({ artifactId, workOrderId, action, part: part ?? null, taskMarkdown })).digest("hex");
             const requestContext = {
               organizationId: companyId,
               actorId,
@@ -288579,7 +289303,12 @@ ${nodeFault}` : "");
     const odBase = (process.env["OASIS_OPEN_DESIGN_URL"] ?? "http://127.0.0.1:7457").replace(/\/$/, "");
     const odToken = process.env["OASIS_OPEN_DESIGN_TOKEN"]?.trim() || void 0;
     const boardWatcher = new BoardWatcher({
-      kernel: defaultCompanyKernel,
+      listCompanies: async () => {
+        if (!chatStoreRouter) return [defaultCompanyId];
+        const active = (await controlPlaneStore.listCompanies()).filter((c) => c.status === "active").map((c) => c.id);
+        return [defaultCompanyId, ...active.filter((id) => id !== defaultCompanyId)];
+      },
+      kernelFor: async (companyId) => (await getEngine(companyId)).kernel,
       odBase,
       ...odToken ? { odToken } : {},
       boardKeyOf: deriveBoardKey,
@@ -288588,7 +289317,7 @@ ${nodeFault}` : "");
     boardWatchTimer = setInterval(() => {
       void boardWatcher.tick().catch((err) => console.error(`[board-watch] tick \u5931\u8D25: ${String(err)}`));
     }, 6e4);
-    console.log(`[serve] \u753B\u677F\u76D1\u89C6\u5668\u5DF2\u542F\u7528\uFF08od=${odBase}${odToken ? "\uFF0C\u5E26\u4EE4\u724C" : ""}\uFF0C\u9759\u9ED8\u7A97 10min\uFF0C\u6BCF\u8F6E\u4E0A\u9650 2 \u5C01\u4FE1\uFF1BOASIS_BOARD_WATCH=0 \u53EF\u5173\uFF09`);
+    console.log(`[serve] \u753B\u677F\u76D1\u89C6\u5668\u5DF2\u542F\u7528\uFF08od=${odBase}${odToken ? "\uFF0C\u5E26\u4EE4\u724C" : ""}\uFF0C\u5DE1\u6240\u6709\u516C\u53F8\uFF0C\u6BCF\u7ED3\u675F\u4E00\u8F6E\u5BF9\u8BDD\u5199\u4E00\u5C01\u4FE1\uFF0C\u6BCF\u8F6E\u6BCF\u5BB6\u516C\u53F8\u4E0A\u9650 2 \u5C01\uFF1BOASIS_BOARD_WATCH=0 \u53EF\u5173\uFF09`);
   } else {
     console.log(`[serve] \u753B\u677F\u76D1\u89C6\u5668\u5DF2\u88AB OASIS_BOARD_WATCH=${boardWatchFlag} \u663E\u5F0F\u5173\u95ED`);
   }
@@ -289835,7 +290564,7 @@ var RuntimeQuotaMonitor = class {
 init_wrapper();
 init_src();
 var import_node_os11 = require("node:os");
-var import_node_crypto89 = require("node:crypto");
+var import_node_crypto90 = require("node:crypto");
 init_src8();
 init_src2();
 
@@ -290739,7 +291468,7 @@ var DaemonWsClient = class {
    */
   async queryArtifactStates(artifactIds, timeoutMs = 15e3) {
     if (artifactIds.length === 0) return {};
-    const requestId = (0, import_node_crypto89.randomUUID)();
+    const requestId = (0, import_node_crypto90.randomUUID)();
     return new Promise((resolve12, reject) => {
       const timer = setTimeout(() => {
         this.gcPending.delete(requestId);
@@ -291153,7 +291882,7 @@ function forwardSignal(child, sig, killGroup = (pgid, signal) => {
 // ../cli/src/daemon/machine-id.ts
 var import_node_child_process23 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
-var import_node_crypto90 = require("node:crypto");
+var import_node_crypto91 = require("node:crypto");
 var import_node_os14 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
@@ -291219,7 +291948,7 @@ var defaultSources = {
 function resolveNodeId(sources = {}) {
   const s2 = { ...defaultSources, ...sources };
   const material = `${s2.machineFingerprint()}:${s2.osUser()}`;
-  const digest = (0, import_node_crypto90.createHash)("sha256").update(material).digest("hex").slice(0, 12);
+  const digest = (0, import_node_crypto91.createHash)("sha256").update(material).digest("hex").slice(0, 12);
   return `node-${digest}`;
 }
 
@@ -293091,13 +293820,13 @@ function ownFlagsFromDecl(command2) {
 }
 
 // ../cli/src/connector-effect-runner.ts
-var import_node_crypto91 = require("node:crypto");
+var import_node_crypto92 = require("node:crypto");
 var import_node_child_process24 = require("node:child_process");
 init_src8();
 function stableKey(effect) {
   const keyFields = Object.fromEntries(Object.entries(effect.keyFields).sort(([a], [b2]) => a.localeCompare(b2)));
   const canonical2 = JSON.stringify({ kind: effect.kind, target: effect.target, keyFields });
-  return `sha256:${(0, import_node_crypto91.createHash)("sha256").update(canonical2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto92.createHash)("sha256").update(canonical2).digest("hex")}`;
 }
 async function runConnectorEffect(connector, toolArgs, deps) {
   const effect = connector.describeExternalEffect?.(toolArgs) ?? null;
@@ -293473,6 +294202,7 @@ ${buildCommandIndex()}
 ${USAGE_FOOTER}`;
 var COMMAND_HELP = buildCommandHelp();
 var HISTORICAL_REVIEW_GUIDANCE = "\u672C\u7968\u4E0D\u53C2\u4E0E\u672C\u8F6E quorum\uFF1B\u4F46\u5B83\u6307\u51FA\u7684\u95EE\u9898\u53EF\u80FD\u4ECD\u7136\u5B58\u5728\uFF0C\u9700\u9010\u6761\u5BF9\u7167 diff \u786E\u8BA4";
+var EMPTY_OK_NOTE_FLAGS = /* @__PURE__ */ new Set(["unresolved", "risks", "gaps", "next"]);
 function parseArgs(argv) {
   const positional = [];
   const flags = /* @__PURE__ */ new Map();
@@ -293499,6 +294229,10 @@ function parseArgs(argv) {
       const value2 = argv[i + 1];
       const key2 = a.slice(2);
       if (value2 === void 0 || value2.startsWith("--")) {
+        if (EMPTY_OK_NOTE_FLAGS.has(key2)) {
+          flags.set(key2, "");
+          continue;
+        }
         if (!booleanFlags.has(key2)) throw new Error(`flag ${a} \u9700\u8981\u4E00\u4E2A\u503C`);
         flags.set(key2, "true");
       } else {
@@ -293652,7 +294386,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
   const timeoutMs = resolveAuthWaitMs();
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const waiterId = (0, import_node_crypto92.randomUUID)();
+  const waiterId = (0, import_node_crypto93.randomUUID)();
   process.stderr.write(
     `\u7B49\u5F85\u4EBA\u5DE5\u6388\u6743\u4E2D\u2026\u2026\u6700\u591A ${Math.round(timeoutMs / 1e3)} \u79D2\uFF0C\u8D85\u65F6\u4F1A\u81EA\u52A8\u8F6C\u4E3A\u5F85\u5BA1\uFF1B\u8FD9\u4E0D\u662F\u9519\u8BEF\uFF0C\u8BF7\u52FF\u91CD\u8BD5\u540C\u4E00\u6761\u547D\u4EE4\u3002
 `
@@ -293736,7 +294470,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.82" ? "2.2.82" : "dev";
+var CLI_VERSION = "2.2.84" ? "2.2.84" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -294102,7 +294836,7 @@ async function runCli(argv, println = console.log, progressln = console.error) {
     const store = createNodeTokenStore(path39.join(dir, "node-tokens.json"));
     const sub = positional[0];
     if (sub === "issue") {
-      const id = flags.get("id") ?? `node-${(0, import_node_crypto92.randomUUID)()}`;
+      const id = flags.get("id") ?? `node-${(0, import_node_crypto93.randomUUID)()}`;
       const token2 = store.issue(id);
       println(token2);
       process.stderr.write(
@@ -295252,7 +295986,7 @@ ${t.ref}  ${t.name}  [\u5267\u672C=${t.playbookRef}]`);
         if (!name) throw new Error("\u9879\u76EE\u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A");
         const goal = flags.get("goal")?.trim();
         const slug6 = flags.get("slug");
-        const id = slug6 !== void 0 ? projectSlug(slug6) : projectIdFromUuid((0, import_node_crypto92.randomUUID)());
+        const id = slug6 !== void 0 ? projectSlug(slug6) : projectIdFromUuid((0, import_node_crypto93.randomUUID)());
         const result = await api.request("POST", "/api/projects", {
           ...id ? { id } : {},
           name,
@@ -295603,6 +296337,10 @@ ${res.warning}`);
         note: flags.get("note")
       });
       println(message);
+      const ignoredNotes = [...EMPTY_OK_NOTE_FLAGS].filter((k2) => flags.has(k2)).map((k2) => `--${k2}`);
+      if (ignoredNotes.length > 0) {
+        println(`\u26A0 ${ignoredNotes.join("\u3001")} \u6CA1\u6709\u88AB\u8BB0\u5F55\uFF1Aoasis conclude \u53EA\u6536 --note\u3002\u8FD9\u51E0\u9879\u8981\u5199\u5728 oasis propose \u4E0A\uFF0C\u4E0B\u6B21\u4EA4\u4ED8\u65F6\u4E00\u8D77\u5E26\u4E0A\u3002`);
+      }
       break;
     }
     case "review": {
@@ -297523,13 +298261,13 @@ function runtimeAssetSourceRoots(input) {
 }
 
 // src/install.ts
-var import_node_crypto93 = require("node:crypto");
+var import_node_crypto94 = require("node:crypto");
 var fs50 = __toESM(require("node:fs"));
 var path45 = __toESM(require("node:path"));
 function versionLabel(sourceFile, pkgVersion, npmPrefixDir, pkgName = LEGACY_PKG_NAME) {
   const tag = pkgName === LEGACY_PKG_NAME ? "" : `+pkg.${pkgName.replace(/[^A-Za-z0-9-]/g, "-")}`;
   if (isFromNpmPrefix(sourceFile, npmPrefixDir)) return `${pkgVersion}${tag}`;
-  const digest = (0, import_node_crypto93.createHash)("sha256").update(fs50.readFileSync(sourceFile)).digest("hex").slice(0, 8);
+  const digest = (0, import_node_crypto94.createHash)("sha256").update(fs50.readFileSync(sourceFile)).digest("hex").slice(0, 8);
   return tag ? `${pkgVersion}${tag}.local.${digest}` : `${pkgVersion}+local.${digest}`;
 }
 function isFromNpmPrefix(sourceFile, npmPrefixDir) {
@@ -297652,7 +298390,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.82" : "dev";
+var PKG_VERSION = true ? "2.2.84" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;
@@ -297960,7 +298698,7 @@ function newInstanceName() {
   const existing = new Set(listInstances());
   if (!existing.has(DEFAULT_INSTANCE)) return DEFAULT_INSTANCE;
   for (; ; ) {
-    const n = `inst-${(0, import_node_crypto94.randomBytes)(3).toString("hex")}`;
+    const n = `inst-${(0, import_node_crypto95.randomBytes)(3).toString("hex")}`;
     if (!existing.has(n)) return n;
   }
 }