openmeld 0.3.222 → 0.3.224

package/dist/{service-CfO38_a-.js → service-Dz2MsvGr.js}

@@ -1,39 +1,39 @@
 #!/usr/bin/env node
 
-import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, F as accountsDir, W as isPublishedOpenMeldHome, ct as resolveOpenMeldEnvPreset, et as openMeldRootDir, i as isOpenMeldLockError, k as formatLocalMachineIssueMessage, lt as resolveOpenMeldRootDir, q as normalizeAccountKey, u as resolveOpenMeldOrphanedLockIssue, ut as resolveOpenMeldServiceOwnedPathInput, x as resolveOpenMeldLaneDescriptor } from "./lock-Bsl_ElWy.js";
-import { Ai as createProjectResponseSchema, Bn as DAEMON_STREAM_KEEPALIVE_PING, Ci as serviceConnectionEvidenceEventSchema, Di as localProjectControlDaemonFrameSchema, Ei as localProjectControlConnectionSchema, Fi as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, Fr as organizationSkillReleaseSummarySchema, Gr as spaceMemberDirectorySchema, Hr as spaceMemberAgentWakeAvailabilitySchema, Ii as OPENMELD_RUNTIME_CAPABILITIES_HEADER, Ir as organizationSkillSummarySchema, Kr as spaceMemberKindSchema, Li as computerFileAccessDaemonFrameSchema, Mi as projectSchema, Mr as getOrganizationSkillResponseSchema, Ni as updateProjectResponseSchema, Nr as listOrganizationSkillsResponseSchema, Oi as localProjectControlDiscoverProjectsResponseSchema, Si as centerAgentToolSpeakerSchema, Ur as spaceMemberDirectoryAllowedRelationsSchema, Zr as organizationComputersResponseSchema, ar as betterAuthDeviceAuthorizationErrorResponseSchema, br as submitFeedbackIssueRequestSchema, ci as deleteCenterAgentRoutineResponseSchema, cr as betterAuthSessionSnapshotResponseSchema, di as pauseCenterAgentRoutineResponseSchema, fi as resumeCenterAgentRoutineResponseSchema, ir as betterAuthDeviceAuthorizationCodeResponseSchema, ji as listProjectsResponseSchema, ki as archiveProjectResponseSchema, li as listCenterAgentRoutineRunsResponseSchema, nr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, on as createServiceConnectionEvidenceApi, or as betterAuthDeviceAuthorizationTokenRequestSchema, pi as updateCenterAgentRoutineResponseSchema, rr as betterAuthDeviceAuthorizationCodeRequestSchema, si as createCenterAgentRoutineResponseSchema, sr as betterAuthDeviceAuthorizationTokenResponseSchema, ti as agentActivitySessionInventoryResponseSchema, ui as listCenterAgentRoutinesResponseSchema, vr as organizationSpaceDirectoryWithMemberCountsResponseSchema, wi as serviceConnectionEvidenceJournalSchema, xi as agentActivitySnapshotResponseSchema, xr as submitFeedbackIssueResponseSchema, yr as organizationDirectoryResponseSchema } from "./dist-B07ziN_u.js";
-import { At as ensureOpenMeldManagedProfileWorkspace, Bt as createMutableRouteCatalogState, Cr as MAX_HEARTBEAT_INTERVAL_MS, Dn as emitReconcileCompletedEvidence, Dr as pruneStaleLeases, En as emitDriftDetectedEvidence, Er as applyIntervalJitterMs$1, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hn as buildAuthenticatedControlPlaneResponse, Ht as summarizeSkippedDaemonProfiles, I as listAgentTargetStates, It as setCustomProfileWorkspace, Jt as isDaemonReconcileInProgressError, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, On as emitReconcileStartedEvidence, Or as resolveAdaptiveHeartbeatIntervalMs, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Sr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Tr as applyAcceptedLeases, Ut as syncDaemonRouteCatalogState, Vt as createRouteCatalogFromMutableState, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, kn as DaemonServiceRunError, kr as resolveCatalogSyncIntervalMs, ln as resolveCatalogSyncSkippedProfilesLogState, lt as ProjectBindingStoreUpdateRequiredError, pt as listProjectConnectionsWithStatus, tn as buildLocalServiceDiagnosticsPayload, ut as bindProject, wr as MIN_HEARTBEAT_INTERVAL_MS, xr as resolveRouteRegistrationReconcileDecision } from "./prepare-provider-runtime-CWZcuMF6.js";
-import { A as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Ar as OPENMELD_REASONING_STREAM_HEADER, Br as localFolderPickerHelperResultSchema, Bt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Ir as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Lr as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, M as runtimeTransportOpenMeldToolsControlFramePayloadSchema, N as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, O as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, P as runtimeTransportRegisterSessionRequestSchema, Rr as localFolderPickerDaemonFrameSchema, Sn as OPENMELD_COMPUTER_CARE_HEADER, li as openMeldRequestContextSchema, n as OPENMELD_EXECUTION_ADMISSION_HEADER, o as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tt as sanitizeDispatchErrorSummary, x as runtimeTransportHeartbeatRequestSchema, z as runtimeTransportRouteCatalogChangedFramePayloadSchema, zr as localFolderPickerHelperProtocolResultSchema } from "./runtime-transport-Cc_RN-PL.js";
-import { E as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-nhS8jyux.js";
-import { s as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-e3W6PD2M.js";
-import { F as iso, G as string, L as literal, N as enumFactory, W as strictObject, X as url, a as formatLocalSetupActionLabel, f as localServiceComponentUpdateProjectionSchema, i as formatLocalSetupActionDescription, j as discriminatedUnion, k as boolean, n as formatLocalComponentsSummaryDescription, o as installedLocalComponentsSnapshotSchema, r as formatLocalComponentsSummaryLabel, s as localCliComponentUpdateProjectionSchema } from "./local-components-B6SCXZf9.js";
+import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, F as accountsDir, W as isPublishedOpenMeldHome, dt as resolveOpenMeldServiceOwnedPathInput, i as isOpenMeldLockError, k as formatLocalMachineIssueMessage, lt as resolveOpenMeldEnvPreset, q as normalizeAccountKey, tt as openMeldRootDir, u as resolveOpenMeldOrphanedLockIssue, ut as resolveOpenMeldRootDir, x as resolveOpenMeldLaneDescriptor } from "./lock-iue1J2xy.js";
+import { Ci as serviceConnectionEvidenceEventSchema, Di as localProjectControlDaemonFrameSchema, Fi as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, Ii as OPENMELD_RUNTIME_CAPABILITIES_HEADER, Li as computerFileAccessDaemonFrameSchema, Oi as localProjectControlDiscoverProjectsResponseSchema, Vn as DAEMON_STREAM_KEEPALIVE_PING, ar as betterAuthDeviceAuthorizationCodeResponseSchema, cr as betterAuthDeviceAuthorizationTokenResponseSchema, ir as betterAuthDeviceAuthorizationCodeRequestSchema, lr as betterAuthSessionSnapshotResponseSchema, or as betterAuthDeviceAuthorizationErrorResponseSchema, rr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, sn as createServiceConnectionEvidenceApi, sr as betterAuthDeviceAuthorizationTokenRequestSchema, wi as serviceConnectionEvidenceJournalSchema } from "./dist-BeJcIdCZ.js";
+import { Ar as pruneStaleLeases, At as ensureOpenMeldManagedProfileWorkspace, Bt as createMutableRouteCatalogState, Dn as emitReconcileCompletedEvidence, Dr as MIN_HEARTBEAT_INTERVAL_MS, En as emitDriftDetectedEvidence, Er as MAX_HEARTBEAT_INTERVAL_MS, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hn as buildAuthenticatedControlPlaneResponse, Ht as summarizeSkippedDaemonProfiles, I as listAgentTargetStates, It as setCustomProfileWorkspace, Jt as isDaemonReconcileInProgressError, Mr as resolveCatalogSyncIntervalMs, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, On as emitReconcileStartedEvidence, Or as applyAcceptedLeases, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Tr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Ut as syncDaemonRouteCatalogState, Vt as createRouteCatalogFromMutableState, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, jr as resolveAdaptiveHeartbeatIntervalMs, kn as DaemonServiceRunError, kr as applyIntervalJitterMs$1, ln as resolveCatalogSyncSkippedProfilesLogState, lt as ProjectBindingStoreUpdateRequiredError, pt as listProjectConnectionsWithStatus, tn as buildLocalServiceDiagnosticsPayload, ut as bindProject, wr as resolveRouteRegistrationReconcileDecision } from "./prepare-provider-runtime-MB-BxOgt.js";
+import { B as runtimeTransportRouteCatalogChangedFramePayloadSchema, Br as localFolderPickerDaemonFrameSchema, Cn as OPENMELD_COMPUTER_CARE_HEADER, F as runtimeTransportRegisterSessionRequestSchema, Hr as localFolderPickerHelperResultSchema, Mr as OPENMELD_REASONING_STREAM_HEADER, N as runtimeTransportOpenMeldToolsControlFramePayloadSchema, P as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, Rr as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, S as runtimeTransportHeartbeatRequestSchema, Vr as localFolderPickerHelperProtocolResultSchema, Vt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, j as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, k as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, n as OPENMELD_ADMISSION_EVIDENCE_HEADER, nt as sanitizeDispatchErrorSummary, r as OPENMELD_EXECUTION_ADMISSION_HEADER, s as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, zr as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER } from "./runtime-transport-YIYHSJPn.js";
+import { E as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-uEk_Tx6T.js";
+import { s as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-rTE2rHZ5.js";
+import { a as formatLocalSetupActionLabel, i as formatLocalSetupActionDescription, n as formatLocalComponentsSummaryDescription, o as installedLocalComponentsSnapshotSchema, r as formatLocalComponentsSummaryLabel } from "./local-components-DleLEzSU.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
-import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-CQG3k9eh.js";
-import { i as serviceControlCapabilitiesSchema } from "./service-account-admission-Dy2W3n3_.js";
-import { $ as buildCommandAuthenticationPromptMessage$1, A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, Q as buildAuthenticationStatusLabel, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, Y as readDaemonCatalogSyncSignal, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, et as buildHumanAuthenticationCard, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, nt as extractAuthenticationPromptAction, ot as resolveAuthenticationReasonFromState, r as resolveDaemonDeviceId, rt as resolveAuthenticationGuidance, s as emitRunLine, tt as createAuthenticationError, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-DWO9_QW6.js";
-import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-bKt0YjC7.js";
-import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_REPAIR_ANOMALIES, Bt as assessCliUpdate, C as formatDaemonServiceRefreshReliabilityMessage, Ct as readDaemonRuntimeContractRepairReport, D as writeDaemonStartFailureState, E as clearDaemonStartFailureState, Et as isVersionDowngrade, Ft as resolveServiceUpdateUrgency, Ht as buildDaemonSystemServiceCommandSpec, It as assessServerRequiredVersion, Lt as describeServerRequiredVersionUnavailableReason, Mt as classifyDaemonServiceRunStartability, Nt as classifyDaemonServiceWakeability, Ot as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, Pt as resolveCurrentDaemonExpectedVersion, Q as buildDaemonServiceDependencySummary, S as buildDaemonServiceUpdateRequiredNextStep, St as ensureDaemonRuntimeContractState, Tt as resolveDaemonServiceAlignmentDecision, Ut as ensureDaemonSystemServiceCommandFiles, W as resolveLocalServiceDemand, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as resolveDaemonStopStrategy, a as isDaemonInventoryRunningAndStartReady$1, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, dt as uninstallDaemonServiceUpdateWorker, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as inspectDaemonServiceInventory, g as resolveServiceReadiness, gt as readCurrentDaemonOwnerSnapshot, h as resolveDaemonStatusAuthenticationAttention, ht as hasActiveDaemonOwners, i as runDaemonServiceLifecycle, kt as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as formatDaemonOwnerSummaryLabel, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as buildDaemonOwnerSnapshotFromObservedState, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveStoppedContractWriteBlockedReason, w as formatDaemonServiceUpdateRequiredMessage, wt as buildDaemonServiceTargetSpec, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as summarizeDaemonOwnerSnapshot } from "./daemon-service-update-coordinator-D8O1uTtu.js";
-import { $ as emitDaemonDispatchJournalEvent, R as resolveNextRuntimeAgentControllerReportSyncAtMs, it as updateComputerFileAccessPolicy, n as handleDaemonTransportFrame, nt as readComputerFileAccessPolicy, o as sendDaemonFrame, r as parseDaemonFrame, rt as resolveComputerFileAccessStorePath, s as collectObservedSessionWorkingDirectories, tt as ComputerFileAccessStoreError } from "./daemon-frame-transport-D2-tazuK.js";
-import { c as serviceExecutionHostSnapshotSchema, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError } from "./channel-ggx0o_aG.js";
-import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-D7uE_xTo.js";
-import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-CNus0e6E.js";
+import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-GxF_KAM1.js";
+import { $ as emitDaemonDispatchJournalEvent, R as resolveNextRuntimeAgentControllerReportSyncAtMs, it as updateComputerFileAccessPolicy, n as handleDaemonTransportFrame, nt as readComputerFileAccessPolicy, o as sendDaemonFrame, r as parseDaemonFrame, rt as resolveComputerFileAccessStorePath, s as collectObservedSessionWorkingDirectories, tt as ComputerFileAccessStoreError, xn as cliJsonOutputEnvelopeSchema } from "./daemon-frame-transport-WiB73yhT.js";
+import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-CBJtgM4P.js";
+import { A as DEFAULT_RECONNECT_DELAY_MS, B as requireOpenMeldProfile, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, Q as readDaemonCatalogSyncSignal, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, V as resolveOpenMeldProfileOrNull, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, ct as buildHumanAuthenticationCard, d as normalizeText$1, dt as resolveAuthenticationGuidance, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, lt as createAuthenticationError, mt as resolveAuthenticationReasonFromState, n as ensureDaemonRuntimePaths, ot as buildAuthenticationStatusLabel, r as resolveDaemonDeviceId, s as emitRunLine, st as buildCommandAuthenticationPromptMessage$1, tt as clearAllSelectedOpenMeldProfileIds, u as normalizeOptionalText$1, ut as extractAuthenticationPromptAction, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-B1Af2Zmn.js";
+import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-1LMeZ6IS.js";
+import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-BQLdaZdB.js";
+import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_REPAIR_ANOMALIES, Bt as assessCliUpdate, C as formatDaemonServiceRefreshReliabilityMessage, Ct as readDaemonRuntimeContractRepairReport, D as writeDaemonStartFailureState, E as clearDaemonStartFailureState, Et as isVersionDowngrade, Ft as resolveServiceUpdateUrgency, Ht as ensureDaemonSystemServiceCommandFiles, It as assessServerRequiredVersion, Lt as describeServerRequiredVersionUnavailableReason, Mt as classifyDaemonServiceRunStartability, Nt as classifyDaemonServiceWakeability, Ot as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, Pt as resolveCurrentDaemonExpectedVersion, Q as buildDaemonServiceDependencySummary, S as buildDaemonServiceUpdateRequiredNextStep, St as ensureDaemonRuntimeContractState, Tt as resolveDaemonServiceAlignmentDecision, Ut as resolveInstalledDaemonSystemServiceCommandSpec, W as resolveLocalServiceDemand, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as resolveDaemonStopStrategy, a as isDaemonInventoryRunningAndStartReady$1, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, dt as uninstallDaemonServiceUpdateWorker, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as inspectDaemonServiceInventory, g as resolveServiceReadiness, gt as readCurrentDaemonOwnerSnapshot, h as resolveDaemonStatusAuthenticationAttention, ht as hasActiveDaemonOwners, i as runDaemonServiceLifecycle, kt as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as formatDaemonOwnerSummaryLabel, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as buildDaemonOwnerSnapshotFromObservedState, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveStoppedContractWriteBlockedReason, w as formatDaemonServiceUpdateRequiredMessage, wt as buildDaemonServiceTargetSpec, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as summarizeDaemonOwnerSnapshot } from "./daemon-service-update-coordinator-0LB_XGVZ.js";
+import { c as serviceExecutionHostSnapshotSchema, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError } from "./channel-B2fD2_be.js";
+import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-DvjOkKPs.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
-import { A as getDaemonStatus, G as withDaemonServiceRegistrationMutationLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, K as withDaemonServiceRunLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, W as withDaemonServiceReconcileLock, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceStopLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-B44aq2nm.js";
-import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
+import { A as getDaemonStatus, G as withDaemonServiceRegistrationMutationLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, K as withDaemonServiceRunLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, W as withDaemonServiceReconcileLock, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceStopLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-Ca0WK5x0.js";
+import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-GLmAxsq-.js";
 import { a as formatOpenMeldCliTextBlock, n as formatOpenMeldCliCommand, r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
-import { r as resolveAuthBaseUrl, t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-B6HqY0_a.js";
-import { t as admitServiceAccountStop } from "./service-account-authorization-DKpIpxXo.js";
-import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DyKx1xzm.js";
+import { r as resolveAuthBaseUrl, t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-BBn5Ko6p.js";
+import { t as admitServiceAccountStop } from "./service-account-authorization-DZbUOD29.js";
+import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-CDZLWgMj.js";
 import { n as toErrorMessage$6, t as sleep } from "./dist-BLuEEVHh.js";
-import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-HL4VKbIU.js";
-import { a as requireOpenMeldProfile, c as clearAllSelectedOpenMeldProfileIds, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull } from "./context-l_31Mn4X.js";
-import { a as outJsonLine, n as sanitizeTerminalDisplayText, o as outLine, t as createPresenter } from "./presenter-BcxiQyJg.js";
-import { X as getCommandEntryContract, _ as createAuthLoginGuideError, a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, pt as validateDaemonControlTargetInput, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo, xt as buildAgentOverviewFromContract } from "./elapsed-time-Ooo4IC25.js";
-import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-DnJ_JYli.js";
-import { t as childExecutionHostChannel } from "./process-channel-BQwtOlRc.js";
-import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-DThnBEhV.js";
+import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-C8RUCMDo.js";
+import { n as resolveRuntimeContext } from "./context-Bdh3nAzw.js";
+import { n as outJsonLine, r as outLine } from "./io-DT66typ4.js";
+import { n as sanitizeTerminalDisplayText, t as createPresenter } from "./presenter-MJ5YgsOT.js";
+import { X as getCommandEntryContract, _ as createAuthLoginGuideError, a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, pt as validateDaemonControlTargetInput, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo, xt as buildAgentOverviewFromContract } from "./elapsed-time-q8lSPcfm.js";
+import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-DpVwrgh-.js";
+import { t as childExecutionHostChannel } from "./process-channel-CgbduFCz.js";
+import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-C5FsAvrf.js";
 import { createHash, randomUUID } from "node:crypto";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { access, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -51,510 +51,6 @@ import WebSocket from "ws";
 const SERVICE_CONNECTION_ID_QUERY_PARAMETER = "connectionId";
 z$1.uuid();
 //#endregion
-//#region ../../packages/schemas/dist/schemas/cli/daemon-status-server-requirement.js
-const cliVersionVerdictKindSchema = z$1.enum([
-	"aligned",
-	"channel_behind",
-	"channel_ahead",
-	"channel_unavailable",
-	"server_unavailable"
-]);
-const serviceVersionVerdictKindSchema = z$1.enum([
-	"aligned",
-	"update_available",
-	"update_required",
-	"unknown",
-	"server_unavailable"
-]);
-const cliVersionVerdictSchema = z$1.strictObject({
-	kind: cliVersionVerdictKindSchema,
-	message: z$1.string().trim().min(1)
-});
-const serviceVersionVerdictSchema = z$1.strictObject({
-	kind: serviceVersionVerdictKindSchema,
-	message: z$1.string().trim().min(1)
-});
-const daemonStatusServerRequirementUnavailableReasonSchema = z$1.enum([
-	"signed_out",
-	"offline",
-	"request_failed"
-]);
-const availableDaemonStatusServerRequirementSchema = z$1.strictObject({
-	available: z$1.literal(true),
-	generatedAt: z$1.iso.datetime({ offset: true }),
-	cli: localCliComponentUpdateProjectionSchema,
-	service: localServiceComponentUpdateProjectionSchema,
-	verdict: z$1.strictObject({
-		cli: cliVersionVerdictSchema,
-		service: serviceVersionVerdictSchema
-	})
-});
-const unavailableDaemonStatusServerRequirementSchema = z$1.strictObject({
-	available: z$1.literal(false),
-	reason: daemonStatusServerRequirementUnavailableReasonSchema,
-	detail: z$1.string().nullable()
-});
-const daemonStatusServerRequirementSchema = z$1.discriminatedUnion("available", [availableDaemonStatusServerRequirementSchema, unavailableDaemonStatusServerRequirementSchema]);
-//#endregion
-//#region ../../packages/schemas/dist/schemas/http/organization-join-link.js
-const ORGANIZATION_JOIN_LINK_ACCEPT_RATE_LIMITED_ERROR_CODE = "organization.join_link.accept.rate_limited";
-const organizationJoinLinkTokenSchema = string().regex(/^joinlink_[0-9a-f]{64}$/);
-const organizationJoinLinkManagementQuerySchema = strictObject({
-	organizationId: string().trim().min(1).max(255),
-	spaceId: string().trim().min(1).max(255).optional(),
-	mode: enumFactory(["direct", "request"]).optional(),
-	responseVersion: literal("3").optional()
-});
-const organizationJoinLinkSchema = strictObject({
-	id: string().min(1),
-	organizationId: string().min(1),
-	token: organizationJoinLinkTokenSchema,
-	url: url(),
-	role: literal("member"),
-	createdBy: string().min(1),
-	createdAt: iso.datetime(),
-	mode: enumFactory(["direct", "request"]).optional(),
-	expiresAt: iso.datetime().nullable().optional(),
-	spaceId: string().min(1).nullable().optional()
-});
-const getOrganizationJoinLinkResponseSchema = strictObject({
-	ok: literal(true),
-	joinLink: organizationJoinLinkSchema.nullable()
-});
-const CENTER_AGENT_ORGANIZATION_INVITE_LINK_GENERATION_GUIDANCE = {
-	requiredRole: "member",
-	settingsLocation: "Settings → Workspace → General",
-	settingsSection: "Invite link"
-};
-strictObject({ context: openMeldRequestContextSchema });
-const centerAgentOrganizationInviteLinkGenerationGuidanceSchema = strictObject({
-	requiredRole: literal(CENTER_AGENT_ORGANIZATION_INVITE_LINK_GENERATION_GUIDANCE.requiredRole),
-	settingsLocation: literal(CENTER_AGENT_ORGANIZATION_INVITE_LINK_GENERATION_GUIDANCE.settingsLocation),
-	settingsSection: literal(CENTER_AGENT_ORGANIZATION_INVITE_LINK_GENERATION_GUIDANCE.settingsSection)
-});
-discriminatedUnion("active", [strictObject({
-	active: literal(true),
-	organizationName: string().trim().min(1),
-	url: url()
-}), strictObject({
-	active: literal(false),
-	generationGuidance: centerAgentOrganizationInviteLinkGenerationGuidanceSchema
-})]);
-const organizationJoinLinkEnsureErrorCodeSchema = enumFactory([
-	"organization.join_link.forbidden",
-	"organization.join_link.inactive",
-	"organization.join_link.invalid_input",
-	"organization.metadata_invalid",
-	"organization.personal_no_members"
-]);
-strictObject({
-	actorUserId: string().trim().min(1).max(255),
-	organizationId: string().trim().min(1).max(255)
-});
-discriminatedUnion("ok", [strictObject({
-	joinLink: organizationJoinLinkSchema,
-	ok: literal(true),
-	organizationName: string().trim().min(1)
-}), strictObject({
-	code: organizationJoinLinkEnsureErrorCodeSchema,
-	message: string().trim().min(1),
-	ok: literal(false)
-})]);
-strictObject({
-	context: openMeldRequestContextSchema,
-	speakerMember: centerAgentToolSpeakerSchema
-});
-discriminatedUnion("ok", [strictObject({
-	ok: literal(true),
-	organizationName: string().trim().min(1),
-	url: url()
-}), strictObject({
-	error: strictObject({
-		code: organizationJoinLinkEnsureErrorCodeSchema,
-		message: string().trim().min(1)
-	}),
-	ok: literal(false)
-})]);
-const revokeOrganizationJoinLinkResponseSchema = strictObject({
-	ok: literal(true),
-	revoked: boolean()
-});
-strictObject({
-	token: organizationJoinLinkTokenSchema,
-	responseVersion: enumFactory(["2", "3"]).optional()
-});
-discriminatedUnion("active", [strictObject({
-	ok: literal(true),
-	active: literal(true),
-	organizationName: string().min(1),
-	organizationSlug: string().min(1),
-	mode: enumFactory(["direct", "request"]).optional(),
-	expiresAt: iso.datetime().nullable().optional(),
-	spaceId: string().min(1).nullable().optional()
-}), strictObject({
-	ok: literal(true),
-	active: literal(false)
-})]);
-const acceptOrganizationJoinLinkBodySchema = strictObject({ token: organizationJoinLinkTokenSchema });
-strictObject({
-	ok: literal(true),
-	organizationId: string().min(1),
-	organizationName: string().min(1),
-	organizationSlug: string().min(1),
-	role: enumFactory([
-		"owner",
-		"admin",
-		"member"
-	]),
-	alreadyMember: boolean()
-});
-const organizationJoinLinkErrorCodeSchema = enumFactory([
-	"auth.invalid_origin",
-	ORGANIZATION_JOIN_LINK_ACCEPT_RATE_LIMITED_ERROR_CODE,
-	"organization.join_link.invalid_input",
-	"organization.join_link.authentication_required",
-	"organization.join_link.approval_required",
-	"organization.join_link.forbidden",
-	"organization.join_link.email_verification_required",
-	"organization.join_link.inactive",
-	"organization.personal_no_members",
-	"organization.metadata_invalid"
-]);
-const organizationJoinLinkErrorResponseSchema = strictObject({
-	ok: literal(false),
-	code: organizationJoinLinkErrorCodeSchema,
-	message: string().min(1)
-});
-//#endregion
-//#region ../../packages/schemas/dist/schemas/cli/json-output.js
-const schemaVersionSchema = z$1.literal(1);
-z$1.enum([
-	"auth.authentication_required",
-	"auth.session_token_unavailable",
-	"profile.required",
-	"local_state.repair_required",
-	"upgrade.required"
-]);
-/**
-* The failure envelope: the top-level boundary prints exactly this when a
-* command throws (or a blocking entry-check fires) under `--json`, then exits 1.
-* Fully owned, so it is strict.
-*/
-const cliJsonErrorEnvelopeSchema = z$1.strictObject({
-	schemaVersion: schemaVersionSchema,
-	type: z$1.literal("error"),
-	error: z$1.strictObject({
-		code: z$1.string(),
-		message: z$1.string(),
-		requestId: z$1.string().optional()
-	})
-});
-/**
-* Success envelopes share the `{ schemaVersion, type }` frame and then flatten a
-* command-specific result onto the envelope. The deep result shapes (daemon
-* install/run/status state, runtime projections, agent registration summaries)
-* are owned by their respective daemon / agents runtime contracts. This envelope
-* is the FRAME owner: it pins the version literal and the closed `type`
-* discriminant, and deliberately RELAXES the flattened payload via
-* `z.looseObject` rather than re-deriving those domain-owned shapes here — doing
-* so would create a second source of truth for payloads another owner already
-* defines. (`shared-contracts.md`: "Document any relaxed object boundary.")
-*
-* Only fields the CLI authors directly on the envelope (and that carry a stable
-* literal or primitive shape) are validated here; everything flattened from a
-* domain payload passes through the relaxed boundary.
-*/
-function defineSuccessEnvelope(type, shape) {
-	return z$1.looseObject({
-		schemaVersion: schemaVersionSchema,
-		type: z$1.literal(type),
-		...shape
-	});
-}
-function defineStrictSuccessEnvelope(type, shape) {
-	return z$1.strictObject({
-		schemaVersion: schemaVersionSchema,
-		type: z$1.literal(type),
-		...shape
-	});
-}
-const cliJsonDaemonRunEnvelopeSchema = defineSuccessEnvelope("daemon.run", { ok: z$1.boolean() });
-const cliJsonDaemonInstallEnvelopeSchema = defineSuccessEnvelope("daemon.install", { status: z$1.string() });
-const cliJsonDaemonUninstallEnvelopeSchema = defineSuccessEnvelope("daemon.uninstall", { status: z$1.enum(["removed", "not_installed"]) });
-const cliJsonDaemonReinstallEnvelopeSchema = defineSuccessEnvelope("daemon.reinstall", {});
-const cliJsonDaemonStatusEnvelopeSchema = defineSuccessEnvelope("daemon.status", {
-	runtimeFlavor: z$1.enum(["binary", "node-bundle"]).optional(),
-	serverRequirement: daemonStatusServerRequirementSchema.optional()
-});
-const cliJsonServiceControlCapabilitiesEnvelopeSchema = defineSuccessEnvelope("service.control_capabilities", serviceControlCapabilitiesSchema.shape);
-const cliJsonDaemonStopEnvelopeSchema = defineSuccessEnvelope("daemon.stop", {});
-const cliJsonDaemonAutostartEnvelopeSchema = defineSuccessEnvelope("daemon.autostart", {
-	action: z$1.enum(["enable", "disable"]),
-	enabled: z$1.boolean()
-});
-const cliJsonAgentsDetectEnvelopeSchema = defineSuccessEnvelope("agents.detect", { count: z$1.number().int().nonnegative() });
-const cliJsonAgentsListEnvelopeSchema = defineSuccessEnvelope("agents.list", { count: z$1.number().int().nonnegative() });
-const cliJsonAgentsShowEnvelopeSchema = defineSuccessEnvelope("agents.show", {});
-const cliJsonAgentsEnableEnvelopeSchema = defineSuccessEnvelope("agents.enable", {});
-const cliJsonAgentsDisableEnvelopeSchema = defineSuccessEnvelope("agents.disable", {});
-const cliJsonFeedbackSubmittedEnvelopeSchema = defineSuccessEnvelope("feedback_submitted", {
-	issueId: submitFeedbackIssueResponseSchema.shape.issueId,
-	category: submitFeedbackIssueRequestSchema.shape.category,
-	submitterKind: submitFeedbackIssueRequestSchema.shape.submitterKind,
-	anonymous: z$1.boolean()
-});
-const cliJsonAgentActivityLocalBindingSchema = z$1.strictObject({
-	boundAtMs: z$1.number().int().nonnegative(),
-	organizationId: z$1.string().min(1),
-	projectId: z$1.string().min(1),
-	projectSlug: z$1.string().min(1),
-	repositoryFingerprint: z$1.string().nullable(),
-	repositoryPath: z$1.string().min(1)
-});
-const cliJsonProjectsListEnvelopeSchema = defineStrictSuccessEnvelope("projects.list", {
-	...listProjectsResponseSchema.shape,
-	localBindings: z$1.array(cliJsonAgentActivityLocalBindingSchema)
-});
-const cliJsonProjectsCreateEnvelopeSchema = defineStrictSuccessEnvelope("projects.create", createProjectResponseSchema.shape);
-const cliJsonProjectsUpdateEnvelopeSchema = defineStrictSuccessEnvelope("projects.update", updateProjectResponseSchema.shape);
-const cliJsonProjectsArchiveEnvelopeSchema = defineStrictSuccessEnvelope("projects.archive", archiveProjectResponseSchema.shape);
-const cliJsonAgentActivityIntegrationUpdateSchema = z$1.strictObject({
-	claude: z$1.enum([
-		"changed",
-		"missing",
-		"reused"
-	]),
-	codex: z$1.enum([
-		"changed",
-		"missing",
-		"reused"
-	]),
-	cursor: z$1.enum([
-		"changed",
-		"missing",
-		"reused"
-	]),
-	openCode: z$1.enum([
-		"changed",
-		"missing",
-		"reused"
-	])
-});
-const cliJsonProjectsBindEnvelopeSchema = defineStrictSuccessEnvelope("projects.bind", {
-	binding: cliJsonAgentActivityLocalBindingSchema,
-	integrationSetup: z$1.discriminatedUnion("status", [z$1.strictObject({
-		integrations: cliJsonAgentActivityIntegrationUpdateSchema,
-		status: z$1.literal("ready")
-	}), z$1.strictObject({
-		message: z$1.string().trim().min(1).max(512),
-		status: z$1.literal("needs_attention")
-	})]),
-	project: projectSchema
-});
-const cliJsonProjectsUnbindEnvelopeSchema = defineStrictSuccessEnvelope("projects.unbind", {
-	organizationId: z$1.string().min(1),
-	projectSlug: z$1.string().min(1),
-	unbound: z$1.literal(true)
-});
-const cliJsonProjectConnectionSnapshotShape = {
-	organizationId: z$1.string().min(1),
-	projectId: z$1.string().min(1),
-	projectSlug: z$1.string().min(1),
-	connections: z$1.array(localProjectControlConnectionSchema)
-};
-const cliJsonProjectsConnectionsListEnvelopeSchema = defineStrictSuccessEnvelope("projects.connections.list", { ...cliJsonProjectConnectionSnapshotShape });
-const cliJsonProjectsConnectionsSetDefaultEnvelopeSchema = defineStrictSuccessEnvelope("projects.connections.set_default", {
-	...cliJsonProjectConnectionSnapshotShape,
-	status: z$1.enum(["updated", "unchanged"])
-});
-const cliJsonProjectsConnectionsRemoveEnvelopeSchema = defineStrictSuccessEnvelope("projects.connections.remove", {
-	...cliJsonProjectConnectionSnapshotShape,
-	status: z$1.enum(["removed", "unchanged"])
-});
-const cliJsonAgentActivityReadEnvelopeSchema = defineStrictSuccessEnvelope("activity.read", agentActivitySnapshotResponseSchema.shape);
-const cliJsonAgentActivitySessionsEnvelopeSchema = defineStrictSuccessEnvelope("activity.sessions", agentActivitySessionInventoryResponseSchema.shape);
-const cliJsonAgentActivityIntegrationStatusSchema = z$1.strictObject({
-	claude: z$1.boolean(),
-	codex: z$1.boolean(),
-	cursor: z$1.boolean(),
-	openCode: z$1.boolean()
-});
-const cliJsonAgentActivityHealthSchema = z$1.strictObject({
-	pending: z$1.number().int().nonnegative(),
-	permanentlyRejected: z$1.number().int().nonnegative(),
-	retrying: z$1.number().int().nonnegative()
-});
-const cliJsonAgentActivityInstallEnvelopeSchema = defineStrictSuccessEnvelope("activity.install", { integrations: cliJsonAgentActivityIntegrationUpdateSchema });
-const cliJsonAgentActivityUninstallEnvelopeSchema = defineStrictSuccessEnvelope("activity.uninstall", { integrations: cliJsonAgentActivityIntegrationUpdateSchema });
-const cliJsonAgentActivityStatusEnvelopeSchema = defineStrictSuccessEnvelope("activity.status", {
-	controllerTaskHealth: cliJsonAgentActivityHealthSchema,
-	health: cliJsonAgentActivityHealthSchema,
-	integrations: cliJsonAgentActivityIntegrationStatusSchema
-});
-const cliJsonAgentActivityHealthEnvelopeSchema = defineStrictSuccessEnvelope("activity.health", {
-	controllerTaskHealth: cliJsonAgentActivityHealthSchema,
-	health: cliJsonAgentActivityHealthSchema
-});
-const cliJsonAgentActivitySyncEnvelopeSchema = defineStrictSuccessEnvelope("activity.sync", { result: z$1.strictObject({
-	controllerTaskEventSubmittedCount: z$1.number().int().nonnegative(),
-	controllerTaskHealth: cliJsonAgentActivityHealthSchema,
-	health: cliJsonAgentActivityHealthSchema,
-	observedCount: z$1.number().int().nonnegative(),
-	reason: z$1.enum([
-		"service_contract_unavailable",
-		"auth_unavailable",
-		"registration_rejected",
-		"write_auth_rejected",
-		"write_endpoint_unavailable",
-		"write_retryable_http_failure",
-		"write_response_invalid",
-		"write_timeout",
-		"write_transport_failure",
-		"inventory_write_auth_rejected",
-		"inventory_endpoint_unavailable",
-		"inventory_write_retryable_http_failure",
-		"inventory_write_transport_failure"
-	]).nullable(),
-	sessionInventory: z$1.strictObject({
-		reason: z$1.enum([
-			"service_contract_unavailable",
-			"auth_unavailable",
-			"registration_rejected",
-			"inventory_write_auth_rejected",
-			"inventory_endpoint_unavailable",
-			"inventory_write_retryable_http_failure",
-			"inventory_write_transport_failure"
-		]).nullable(),
-		sessionCount: z$1.number().int().nonnegative(),
-		sourceCount: z$1.number().int().nonnegative(),
-		status: z$1.enum([
-			"idle",
-			"submitted",
-			"unavailable"
-		]),
-		submittedSourceCount: z$1.number().int().nonnegative()
-	}),
-	status: z$1.enum([
-		"idle",
-		"submitted",
-		"unavailable"
-	]),
-	submittedCount: z$1.number().int().nonnegative()
-}) });
-const cliJsonAgentActivityContextEnvelopeSchema = defineStrictSuccessEnvelope("activity.context", { context: z$1.string().min(1).max(300).nullable() });
-const cliJsonRoutinesListEnvelopeSchema = defineStrictSuccessEnvelope("routines.list", listCenterAgentRoutinesResponseSchema.shape);
-const cliJsonRoutinesCreateEnvelopeSchema = defineStrictSuccessEnvelope("routines.create", createCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesShowEnvelopeSchema = defineStrictSuccessEnvelope("routines.show", createCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesUpdateEnvelopeSchema = defineStrictSuccessEnvelope("routines.update", updateCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesPauseEnvelopeSchema = defineStrictSuccessEnvelope("routines.pause", pauseCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesResumeEnvelopeSchema = defineStrictSuccessEnvelope("routines.resume", resumeCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesDeleteEnvelopeSchema = defineStrictSuccessEnvelope("routines.delete", deleteCenterAgentRoutineResponseSchema.shape);
-const cliJsonRoutinesRunsEnvelopeSchema = defineStrictSuccessEnvelope("routines.runs", listCenterAgentRoutineRunsResponseSchema.shape);
-const cliJsonSpaceMembersEnvelopeSchema = defineStrictSuccessEnvelope("space.members", spaceMemberDirectorySchema.shape);
-const cliJsonSpaceMembersBriefEnvelopeSchema = defineStrictSuccessEnvelope("space.members.brief", {
-	spaceId: z$1.string().trim().min(1),
-	generatedAt: z$1.iso.datetime({ offset: true }),
-	members: z$1.array(z$1.strictObject({
-		profileId: z$1.string().trim().min(1),
-		displayName: z$1.string().trim().min(1),
-		profileKind: spaceMemberKindSchema,
-		primaryMentionLabel: z$1.string().trim().min(1),
-		allowedRelations: spaceMemberDirectoryAllowedRelationsSchema,
-		wakeAvailability: spaceMemberAgentWakeAvailabilitySchema.pick({
-			action: true,
-			phase: true,
-			reasonCode: true,
-			status: true,
-			summary: true
-		}).optional(),
-		canWakeNow: z$1.boolean().optional()
-	}))
-});
-const cliJsonSpaceListOrganizationEnvelopeSchema = defineStrictSuccessEnvelope("space.list.organization", {
-	scope: z$1.literal("organization"),
-	organizationId: organizationSpaceDirectoryWithMemberCountsResponseSchema.shape.organizationId,
-	generatedAt: organizationSpaceDirectoryWithMemberCountsResponseSchema.shape.generatedAt,
-	total: z$1.number().int().nonnegative(),
-	returned: z$1.number().int().nonnegative(),
-	spaces: organizationSpaceDirectoryWithMemberCountsResponseSchema.shape.spaces
-});
-const cliJsonOrganizationDirectoryEnvelopeSchema = defineStrictSuccessEnvelope("organization.directory", organizationDirectoryResponseSchema.shape);
-const cliJsonOrganizationComputersEnvelopeSchema = defineStrictSuccessEnvelope("organization.computers", organizationComputersResponseSchema.shape);
-const cliJsonOrganizationInviteLinkGetEnvelopeSchema = defineStrictSuccessEnvelope("organization.invite_link.get", getOrganizationJoinLinkResponseSchema.shape);
-const cliJsonOrganizationInviteLinkCreateEnvelopeSchema = defineStrictSuccessEnvelope("organization.invite_link.create", getOrganizationJoinLinkResponseSchema.shape);
-const cliJsonOrganizationInviteLinkRevokeEnvelopeSchema = defineStrictSuccessEnvelope("organization.invite_link.revoke", revokeOrganizationJoinLinkResponseSchema.shape);
-const cliJsonSkillsListEnvelopeSchema = defineStrictSuccessEnvelope("skills.list", listOrganizationSkillsResponseSchema.shape);
-const cliJsonSkillsShowEnvelopeSchema = defineStrictSuccessEnvelope("skills.show", getOrganizationSkillResponseSchema.shape);
-const cliJsonSkillsLoadEnvelopeSchema = defineStrictSuccessEnvelope("skills.load", {
-	cachePath: z$1.string().min(1),
-	digest: organizationSkillReleaseSummarySchema.shape.digest,
-	organizationId: organizationSkillSummarySchema.shape.organizationId,
-	releaseId: organizationSkillReleaseSummarySchema.shape.id,
-	resourcePaths: z$1.array(z$1.string().min(1)).max(128),
-	reused: z$1.boolean(),
-	skillId: organizationSkillSummarySchema.shape.id,
-	skillMarkdownPath: z$1.string().min(1),
-	skillName: organizationSkillSummarySchema.shape.name
-});
-/**
-* The full `--json` output envelope: the failure envelope plus every success
-* envelope, discriminated on `type`. A `--json` driver dispatches on
-* `schemaVersion` + `type`; that frame is the contract this validates.
-*/
-const cliJsonOutputEnvelopeSchema = z$1.discriminatedUnion("type", [
-	cliJsonErrorEnvelopeSchema,
-	cliJsonDaemonRunEnvelopeSchema,
-	cliJsonDaemonInstallEnvelopeSchema,
-	cliJsonDaemonUninstallEnvelopeSchema,
-	cliJsonDaemonReinstallEnvelopeSchema,
-	cliJsonDaemonStatusEnvelopeSchema,
-	cliJsonServiceControlCapabilitiesEnvelopeSchema,
-	cliJsonDaemonStopEnvelopeSchema,
-	cliJsonDaemonAutostartEnvelopeSchema,
-	cliJsonAgentsDetectEnvelopeSchema,
-	cliJsonAgentsListEnvelopeSchema,
-	cliJsonAgentsShowEnvelopeSchema,
-	cliJsonAgentsEnableEnvelopeSchema,
-	cliJsonAgentsDisableEnvelopeSchema,
-	cliJsonFeedbackSubmittedEnvelopeSchema,
-	cliJsonProjectsListEnvelopeSchema,
-	cliJsonProjectsCreateEnvelopeSchema,
-	cliJsonProjectsUpdateEnvelopeSchema,
-	cliJsonProjectsArchiveEnvelopeSchema,
-	cliJsonProjectsBindEnvelopeSchema,
-	cliJsonProjectsUnbindEnvelopeSchema,
-	cliJsonProjectsConnectionsListEnvelopeSchema,
-	cliJsonProjectsConnectionsSetDefaultEnvelopeSchema,
-	cliJsonProjectsConnectionsRemoveEnvelopeSchema,
-	cliJsonAgentActivityReadEnvelopeSchema,
-	cliJsonAgentActivitySessionsEnvelopeSchema,
-	cliJsonAgentActivityInstallEnvelopeSchema,
-	cliJsonAgentActivityUninstallEnvelopeSchema,
-	cliJsonAgentActivityStatusEnvelopeSchema,
-	cliJsonAgentActivityHealthEnvelopeSchema,
-	cliJsonAgentActivitySyncEnvelopeSchema,
-	cliJsonAgentActivityContextEnvelopeSchema,
-	cliJsonRoutinesListEnvelopeSchema,
-	cliJsonRoutinesCreateEnvelopeSchema,
-	cliJsonRoutinesShowEnvelopeSchema,
-	cliJsonRoutinesUpdateEnvelopeSchema,
-	cliJsonRoutinesPauseEnvelopeSchema,
-	cliJsonRoutinesResumeEnvelopeSchema,
-	cliJsonRoutinesDeleteEnvelopeSchema,
-	cliJsonRoutinesRunsEnvelopeSchema,
-	cliJsonSpaceMembersEnvelopeSchema,
-	cliJsonSpaceMembersBriefEnvelopeSchema,
-	cliJsonSpaceListOrganizationEnvelopeSchema,
-	cliJsonOrganizationDirectoryEnvelopeSchema,
-	cliJsonOrganizationComputersEnvelopeSchema,
-	cliJsonOrganizationInviteLinkGetEnvelopeSchema,
-	cliJsonOrganizationInviteLinkCreateEnvelopeSchema,
-	cliJsonOrganizationInviteLinkRevokeEnvelopeSchema,
-	cliJsonSkillsListEnvelopeSchema,
-	cliJsonSkillsShowEnvelopeSchema,
-	cliJsonSkillsLoadEnvelopeSchema
-]);
-//#endregion
 //#region src/commands/auth-device-session-client.ts
 const DEFAULT_DEVICE_CLIENT_ID = "openmeld-cli";
 const DEVICE_CLIENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{1,63}$/;
@@ -3272,8 +2768,8 @@ function launchExecutionHost(input) {
 		serialization: "json",
 		stdio: [
 			"ignore",
-			"inherit",
-			"inherit",
+			process.stdout.fd,
+			process.stderr.fd,
 			"ipc"
 		],
 		windowsHide: true
@@ -4085,7 +3581,7 @@ async function reconcileSupervisorRegistrationOnce(input) {
 	try {
 		await markDaemonServiceRegistrationRepairPending(manager.controller);
 		await ensureDaemonSystemServiceCommandFiles({ controller: manager.controller });
-		await manager.install(buildDaemonSystemServiceCommandSpec({ controller: manager.controller }));
+		await manager.install(await resolveInstalledDaemonSystemServiceCommandSpec({ controller: manager.controller }));
 		await clearDaemonServiceRegistrationRepairPending();
 		await emitDaemonLifecycleEvent({
 			type: "service_manager.registration_reconcile",
@@ -4724,6 +4220,11 @@ function resolveDaemonCapabilitiesFromAdapterIds(input) {
 }
 //#endregion
 //#region src/local-service/execution-host/socket-link.ts
+const ADMISSION_DETAIL_CODE_PATTERN = /^[a-z][a-z0-9_.-]{0,79}$/u;
+const admissionDetailCode = (error, fallback) => {
+	const code = error instanceof ExecutionHostError ? error.code : fallback;
+	return ADMISSION_DETAIL_CODE_PATTERN.test(code) ? code : fallback;
+};
 function createExecutionHostSocketLink(input) {
 	let generation = null;
 	let bound = false;
@@ -4734,11 +4235,38 @@ function createExecutionHostSocketLink(input) {
 	let configuration = Promise.resolve();
 	let queuedFrames = 0;
 	let publishedAdmission = false;
+	let admissionRevision = 0;
+	let admissionEvidence = null;
+	let configureFailureCode = null;
+	let healthFailureCode = null;
+	let connectionInitializingReason = "connection_initializing";
 	const canAccept = () => !closed && bound && input.host.available() && observed?.admission === "open" && !observed.startupReplayPending;
-	const notifyAdmission = () => {
+	const currentAdmissionReason = () => {
+		if (!bound) return configureFailureCode ? {
+			reasonCode: "host_configure_failed",
+			detailCode: configureFailureCode
+		} : { reasonCode: connectionInitializingReason };
+		if (!input.host.available()) return { reasonCode: "host_unavailable" };
+		if (!observed) return healthFailureCode ? {
+			reasonCode: "host_health_unconfirmed",
+			detailCode: healthFailureCode
+		} : { reasonCode: "host_health_unconfirmed" };
+		if (observed.admission !== "open") return { reasonCode: "host_draining" };
+		if (observed.startupReplayPending) return { reasonCode: "startup_replay_pending" };
+		return { reasonCode: "host_ready" };
+	};
+	const notifyAdmission = (reasonCode) => {
 		const next = canAccept();
-		if (next !== publishedAdmission) {
+		const reason = reasonCode ? { reasonCode } : currentAdmissionReason();
+		if (next !== publishedAdmission || generation !== null && (admissionEvidence?.reasonCode !== reason.reasonCode || admissionEvidence?.detailCode !== reason.detailCode)) {
 			publishedAdmission = next;
+			if (generation !== null) admissionEvidence = {
+				acceptingDispatches: next,
+				connectionGeneration: generation,
+				revision: ++admissionRevision,
+				changedAtMs: Date.now(),
+				...reason
+			};
 			input.onAdmissionChanged();
 		}
 	};
@@ -4751,8 +4279,10 @@ function createExecutionHostSocketLink(input) {
 			observationDirty = false;
 			observation = input.host.call("health", {}).then((next) => {
 				observed = next;
+				healthFailureCode = null;
 			}).catch((error) => {
 				observed = null;
+				healthFailureCode = admissionDetailCode(error, "host.health_failed");
 				input.onError(error);
 			}).finally(() => {
 				observation = null;
@@ -4785,22 +4315,46 @@ function createExecutionHostSocketLink(input) {
 	});
 	return {
 		canAccept,
+		admissionEvidence: () => admissionEvidence,
 		snapshot: () => observed,
 		async configure(request) {
 			const previous = configuration;
-			bound = false;
+			const previousGeneration = generation;
+			if (generation !== request.connectionGeneration) {
+				bound = false;
+				configureFailureCode = null;
+				connectionInitializingReason = previousGeneration === null ? "connection_initializing" : "connection_replaced";
+				admissionRevision = 0;
+				admissionEvidence = {
+					acceptingDispatches: false,
+					connectionGeneration: request.connectionGeneration,
+					revision: 0,
+					changedAtMs: Date.now(),
+					reasonCode: connectionInitializingReason
+				};
+			}
 			generation = request.connectionGeneration;
 			notifyAdmission();
-			const next = previous.catch(() => void 0).then(async () => {
+			configuration = previous.catch(() => void 0).then(async () => {
 				if (closed || generation !== request.connectionGeneration) throw new ExecutionHostError("host.connection_replaced", "This socket was replaced before Host configuration.");
-				observed = await input.host.call("configureConnection", request);
+				const nextObservation = await input.host.call("configureConnection", request);
 				if (!closed && generation === request.connectionGeneration) {
+					observed = nextObservation;
+					healthFailureCode = null;
+					configureFailureCode = null;
 					bound = true;
 					notifyAdmission();
 				}
+			}).catch((error) => {
+				if (!closed && generation === request.connectionGeneration) {
+					bound = false;
+					observed = null;
+					configureFailureCode = admissionDetailCode(error, "host.configure_failed");
+					notifyAdmission();
+				}
+				throw error;
 			});
-			configuration = next;
-			await next;
+			await configuration;
 		},
 		forward(frame) {
 			const request = serviceExecutionHostMethods.handleFrame.input.safeParse({
@@ -4838,10 +4392,12 @@ function createExecutionHostSocketLink(input) {
 			}, { timeoutMs: 2e3 }).then((next) => {
 				if (!closed && generation === expectedGeneration) {
 					observed = next;
+					healthFailureCode = null;
 					notifyAdmission();
 				}
 			}).catch((error) => {
 				observed = null;
+				healthFailureCode = admissionDetailCode(error, "host.heartbeat_failed");
 				input.onError(error);
 				if (!closed) notifyAdmission();
 			});
@@ -6327,6 +5883,7 @@ async function runDaemonSocketSession(input) {
 	let admissionHeartbeatPending = false;
 	const heartbeatIdleWaiters = [];
 	let acceptingDispatches = false;
+	let shutdownAdmissionEvidence = null;
 	let shutdownStopCause = null;
 	let controlledShutdownCompleted = false;
 	let routeCatalogSyncInFlight = false;
@@ -6382,6 +5939,12 @@ async function runDaemonSocketSession(input) {
 		socket: input.socket,
 		onAdmissionChanged: () => {
 			acceptingDispatches = !shutdownStopCause && hostLink.canAccept();
+			emitRunLine({
+				presenter: input.presenter,
+				code: "daemon.run.admission_changed",
+				text: `Local dispatch admission is ${acceptingDispatches ? "open" : "closed"}.`,
+				payload: shutdownAdmissionEvidence ?? hostLink.admissionEvidence()
+			});
 			if (heartbeatInFlight || lastHeartbeatSentAtMs !== null) scheduleHeartbeat({
 				delayMs: 0,
 				reason: "execution_host_admission_changed"
@@ -6583,6 +6146,7 @@ async function runDaemonSocketSession(input) {
 					acceptingDispatches,
 					stopCause: shutdownStopCause
 				}),
+				...admissionEvidenceSupported && (shutdownAdmissionEvidence ?? hostLink.admissionEvidence()) ? { admissionEvidence: shutdownAdmissionEvidence ?? hostLink.admissionEvidence() } : {},
 				serviceVersion,
 				leases,
 				runtimeContract: { epoch: DAEMON_RUNTIME_CONTRACT_EPOCH },
@@ -6780,6 +6344,7 @@ async function runDaemonSocketSession(input) {
 	const serviceVersion = OPENMELD_VERSION;
 	let computerCareSupported = false;
 	let executionAdmissionSupported = false;
+	let admissionEvidenceSupported = false;
 	const readSessionLocalComponentsStatus = () => input.localComponentsObservation.read(() => {
 		if (lastHeartbeatSentAtMs !== null) scheduleHeartbeat({
 			delayMs: 0,
@@ -6828,6 +6393,7 @@ async function runDaemonSocketSession(input) {
 		});
 		computerCareSupported = response.computerCare === true;
 		executionAdmissionSupported = response.executionAdmissionConfirmation === true;
+		admissionEvidenceSupported = response.admissionEvidence === true;
 		return response;
 	};
 	const resolveCatalogSyncForcePayload = (inputSync) => inputSync?.forceReason ? { forceReason: inputSync.forceReason } : void 0;
@@ -7439,6 +7005,15 @@ async function runDaemonSocketSession(input) {
 	async function finishControlledShutdown(stopCause) {
 		acceptingDispatches = false;
 		shutdownStopCause = stopCause;
+		const priorAdmissionEvidence = hostLink.admissionEvidence();
+		shutdownAdmissionEvidence = {
+			acceptingDispatches: false,
+			connectionGeneration: activeConnectionGeneration,
+			revision: (priorAdmissionEvidence?.revision ?? 0) + 1,
+			changedAtMs: Date.now(),
+			reasonCode: "controlled_stop",
+			detailCode: stopCause
+		};
 		await input.executionHost.call("beginDrain", {});
 		clearHeartbeatTimer();
 		emitRunLine({
@@ -7709,9 +7284,9 @@ async function resolveDaemonServiceParticipationStatus(input) {
 }
 //#endregion
 //#region src/local-components/manifest.ts
-const OPENMELD_CLI_COMMAND_CONTRACT_VERSION = "openmeld-cli-command-contract-2026-09-space-task-result-review-v1";
+const OPENMELD_CLI_COMMAND_CONTRACT_VERSION = "openmeld-cli-command-contract-2026-09-space-files-1gib-v1";
 const OPENMELD_SKILLS_CONTRACT_VERSION = "openmeld-skills-contract-2026-09-explicit-space-recipients-v1";
-const OPENMELD_SERVICE_CONTRACT_VERSION = "openmeld-service-contract-2026-09-antigravity-permissions-v1";
+const OPENMELD_SERVICE_CONTRACT_VERSION = "openmeld-service-contract-2026-09-space-files-1gib-v1";
 const LOCAL_COMPONENTS_SNAPSHOT_FILE = "local-components.json";
 const SERVICE_COMPONENT_UPDATE_CODES = /* @__PURE__ */ new Set([
 	"version_outdated",
@@ -8109,6 +7684,7 @@ function buildLocalServiceCapabilityHeaders(input) {
 		[OPENMELD_REASONING_STREAM_HEADER]: "1",
 		[OPENMELD_COMPUTER_CARE_HEADER]: "1",
 		[OPENMELD_EXECUTION_ADMISSION_HEADER]: "1",
+		[OPENMELD_ADMISSION_EVIDENCE_HEADER]: "1",
 		...input.localFolderPickerAvailable ? { [OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER]: LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY } : {},
 		[OPENMELD_RUNTIME_CAPABILITIES_HEADER]: COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY
 	};
@@ -9810,7 +9386,7 @@ async function removeSystemServiceRegistration(systemManager) {
 }
 async function repairSystemServiceRegistration(input) {
 	if (!input.systemManager) return;
-	const serviceCommandSpec = buildDaemonSystemServiceCommandSpec({
+	const serviceCommandSpec = await resolveInstalledDaemonSystemServiceCommandSpec({
 		controller: input.systemManager.controller,
 		environmentTarget: await resolveOpenMeldEnvironmentTarget({ gatewayUrl: input.gatewayUrl })
 	});
@@ -12292,7 +11868,7 @@ function buildSystemServiceStartupFailureReportFromVerdict(verdict, options) {
 	}
 	const crashExitCode = jobDiagnostics ? readDaemonServiceJobCrashExitCode(jobDiagnostics) : null;
 	if (jobDiagnostics && crashExitCode !== null) {
-		const summary = "OpenMeld Service keeps stopping after it starts.";
+		const summary = "OpenMeld Service stopped after it started.";
 		const card = buildDaemonStartNeedsAttentionCard({
 			summary,
 			nextStep: formatInlineOpenMeldCliCommands("Run `openmeld service repair` once. OpenMeld saved the startup evidence for diagnostics."),
@@ -15593,7 +15169,7 @@ async function recoverSystemServiceStartupAfterTimeout(input) {
 }
 async function runSystemServiceManager(input) {
 	const startedAtMs = Date.now();
-	const serviceCommandSpec = buildDaemonSystemServiceCommandSpec({
+	const serviceCommandSpec = await resolveInstalledDaemonSystemServiceCommandSpec({
 		controller: input.systemManager.controller,
 		environmentTarget: await resolveOpenMeldEnvironmentTarget({ gatewayUrl: input.gatewayUrl })
 	});
@@ -16362,6 +15938,6 @@ function parseDaemonRunMode(rawMode) {
 	return DEFAULT_DAEMON_RUN_MODE;
 }
 //#endregion
-export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, cliJsonSkillsShowEnvelopeSchema as Ct, createDelayedSpinner as D, organizationJoinLinkManagementQuerySchema as Dt, emitDaemonAgentOverview as E, organizationJoinLinkErrorResponseSchema as Et, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, revokeOrganizationJoinLinkResponseSchema as Ot, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, cliJsonSkillsLoadEnvelopeSchema as St, createQuietPresenter as T, getOrganizationJoinLinkResponseSchema as Tt, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, cliJsonOutputEnvelopeSchema as bt, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, acceptOrganizationJoinLinkBodySchema as wt, resolveServiceParticipationReadiness as x, cliJsonSkillsListEnvelopeSchema as xt, formatServiceParticipationReadinessLabel as y, cliJsonErrorEnvelopeSchema as yt, writeInstalledLocalComponentsSnapshot as z };
+export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, createDelayedSpinner as D, emitDaemonAgentOverview as E, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, createQuietPresenter as T, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, resolveServiceParticipationReadiness as x, formatServiceParticipationReadinessLabel as y, writeInstalledLocalComponentsSnapshot as z };
 
-//# sourceMappingURL=service-CfO38_a-.js.map
+//# sourceMappingURL=service-Dz2MsvGr.js.map