switchroom 0.19.30 → 0.19.31

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.30", COMMIT_SHA = "efe8e2a7";
+var VERSION = "0.19.31", COMMIT_SHA = "d24ee3cc";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -16154,6 +16154,7 @@ var init_hindsight_context_budget = __esm(() => {
 var exports_atomic = {};
 __export(exports_atomic, {
   writeConfigFileSync: () => writeConfigFileSync,
+  fsyncPathSync: () => fsyncPathSync,
   atomicWriteJsonSync: () => atomicWriteJsonSync,
   atomicWriteFileSync: () => atomicWriteFileSync
 });
@@ -16195,6 +16196,14 @@ function atomicWriteFileSync(destPath, contents, modeOrOpts = 384) {
     throw err;
   }
 }
+function fsyncPathSync(path) {
+  const fd = openSync2(path, constants.O_RDONLY);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
 function atomicWriteJsonSync(destPath, value, mode = 384) {
   atomicWriteFileSync(destPath, JSON.stringify(value, null, 2) + `
 `, mode);
@@ -32499,8 +32508,41 @@ import {
   realpathSync as realpathSync3,
   statSync as statSync9
 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
 import { join as join15 } from "node:path";
-function resolveOperatorUid() {
+function operatorHomeCandidates(env2, home2) {
+  const roots = [env2.SWITCHROOM_HOST_HOME?.trim(), home2, CONTAINER_OPERATOR_HOME];
+  const out = [];
+  for (const r of roots) {
+    if (!r || r.length === 0)
+      continue;
+    const dir = join15(r, ".switchroom");
+    if (!out.includes(dir))
+      out.push(dir);
+  }
+  return out;
+}
+function resolveOperatorUidFromOwnership(deps = {}) {
+  const env2 = deps.env ?? process.env;
+  const home2 = deps.home ?? homedir7();
+  const exists = deps.exists ?? ((p) => existsSync20(p));
+  const statUid = deps.statUid ?? ((p) => {
+    try {
+      return statSync9(p).uid;
+    } catch {
+      return;
+    }
+  });
+  for (const dir of operatorHomeCandidates(env2, home2)) {
+    if (!exists(join15(dir, SWITCHROOM_HOME_MARKER)))
+      continue;
+    const uid = statUid(dir);
+    if (uid !== undefined && Number.isFinite(uid) && uid > 0)
+      return uid;
+  }
+  return;
+}
+function resolveOperatorUid(ownershipDeps = {}) {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
     const parsed = parseInt(sudoUid, 10);
@@ -32518,7 +32560,7 @@ function resolveOperatorUid() {
     if (Number.isFinite(parsed) && parsed > 0)
       return parsed;
   }
-  return;
+  return resolveOperatorUidFromOwnership(ownershipDeps);
 }
 function operatorOwnedPaths(home2) {
   const root = join15(home2, ".switchroom");
@@ -32597,12 +32639,13 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   }
   return chowned;
 }
+var CONTAINER_OPERATOR_HOME = "/host-home", SWITCHROOM_HOME_MARKER = "switchroom.yaml";
 var init_operator_uid = () => {};
 
 // src/cli/write-compose.ts
 import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { basename as basename4, dirname as dirname9, join as join16 } from "node:path";
 function agentHadLiteLLMRouting(composeContent, agentName) {
   const lines = composeContent.split(`
@@ -32713,7 +32756,7 @@ function resolveHostHomeForCompose() {
 
 ` + `Recovery: run \`switchroom apply\`/\`update\` from the HOST shell, or via hostd (both set SWITCHROOM_HOST_HOME). Do NOT deploy via an ad-hoc ` + `\`docker run <agent-image> switchroom \u2026\` that mounts the operator home.`);
   }
-  return homedir7();
+  return homedir8();
 }
 async function computeComposeContent(opts) {
   const release = resolveRelease({ override: opts.releaseOverride, root: opts.config.release });
@@ -32734,7 +32777,7 @@ async function computeComposeContent(opts) {
     buildMode: opts.buildMode ?? "pull",
     buildContext: opts.buildContext,
     homeDir: resolveHostHomeForCompose(),
-    probeHomeDir: homedir7(),
+    probeHomeDir: homedir8(),
     switchroomConfigPath: resolvedConfigPath,
     operatorUid
   });
@@ -32852,7 +32895,7 @@ var init_compose_env = () => {};
 // src/agents/docker-fleet.ts
 import { resolve as resolve14 } from "node:path";
 import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { execFileSync as execFileSync8 } from "node:child_process";
 function resolveSwitchroomHome(explicit) {
   if (explicit && explicit.length > 0)
@@ -32876,7 +32919,7 @@ function bringUpAgentService(opts) {
   }
   const compose = opts.generateComposeContent?.() ?? generateCompose({
     config: opts.config,
-    homeDir: homedir8(),
+    homeDir: homedir9(),
     switchroomConfigPath
   });
   const composePath = resolve14(composeDir, "docker-compose.yml");
@@ -35074,7 +35117,7 @@ __export(exports_client2, {
   AuthBrokerClient: () => AuthBrokerClient
 });
 import * as net2 from "node:net";
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { randomUUID } from "node:crypto";
 import { join as join25 } from "node:path";
 function reviveDate(v) {
@@ -35085,7 +35128,7 @@ function reviveDate(v) {
   const d = new Date(v);
   return Number.isNaN(d.getTime()) ? null : d;
 }
-function operatorSocketPath(home2 = homedir10()) {
+function operatorSocketPath(home2 = homedir11()) {
   return join25(home2, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath(opts) {
@@ -35466,7 +35509,7 @@ import {
   rmSync as rmSync11,
   statSync as statSync19
 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { join as join27, resolve as resolve24 } from "node:path";
 function accountsRootOverride() {
   const v = process.env.SWITCHROOM_ACCOUNTS_DIR;
@@ -35474,19 +35517,19 @@ function accountsRootOverride() {
     return v;
   return;
 }
-function accountsRoot(home2 = homedir12()) {
+function accountsRoot(home2 = homedir13()) {
   return accountsRootOverride() ?? resolve24(home2, ".switchroom", "accounts");
 }
-function accountDir(label, home2 = homedir12()) {
+function accountDir(label, home2 = homedir13()) {
   return join27(accountsRoot(home2), label);
 }
-function accountCredentialsPath(label, home2 = homedir12()) {
+function accountCredentialsPath(label, home2 = homedir13()) {
   return join27(accountDir(label, home2), "credentials.json");
 }
-function accountMetaPath(label, home2 = homedir12()) {
+function accountMetaPath(label, home2 = homedir13()) {
   return join27(accountDir(label, home2), "meta.json");
 }
-function listAccounts(home2 = homedir12()) {
+function listAccounts(home2 = homedir13()) {
   const root = accountsRoot(home2);
   if (!existsSync34(root))
     return [];
@@ -35502,7 +35545,7 @@ function listAccounts(home2 = homedir12()) {
     return [];
   }
 }
-function readAccountCredentials(label, home2 = homedir12()) {
+function readAccountCredentials(label, home2 = homedir13()) {
   const p = accountCredentialsPath(label, home2);
   if (!existsSync34(p))
     return null;
@@ -35512,7 +35555,7 @@ function readAccountCredentials(label, home2 = homedir12()) {
     return null;
   }
 }
-function readAccountMeta(label, home2 = homedir12()) {
+function readAccountMeta(label, home2 = homedir13()) {
   const p = accountMetaPath(label, home2);
   if (!existsSync34(p))
     return null;
@@ -35522,7 +35565,7 @@ function readAccountMeta(label, home2 = homedir12()) {
     return null;
   }
 }
-function accountHealth(label, now = Date.now(), home2 = homedir12()) {
+function accountHealth(label, now = Date.now(), home2 = homedir13()) {
   const creds = readAccountCredentials(label, home2);
   if (!creds?.claudeAiOauth?.accessToken)
     return "missing-credentials";
@@ -35538,7 +35581,7 @@ function accountHealth(label, now = Date.now(), home2 = homedir12()) {
   }
   return "healthy";
 }
-function getAccountInfos(now = Date.now(), home2 = homedir12()) {
+function getAccountInfos(now = Date.now(), home2 = homedir13()) {
   return listAccounts(home2).map((label) => {
     const creds = readAccountCredentials(label, home2);
     const meta = readAccountMeta(label, home2);
@@ -36182,12 +36225,12 @@ var init_disconnect = __esm(() => {
 
 // src/vault/approvals/client.ts
 import { existsSync as existsSync35 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
+import { homedir as homedir14 } from "node:os";
 import { join as join28 } from "node:path";
-function kernelOperatorSocketPath(home2 = homedir13()) {
+function kernelOperatorSocketPath(home2 = homedir14()) {
   return join28(home2, ".switchroom", "state", "kernel-operator", "sock");
 }
-function resolveKernelOperatorSocket(home2 = homedir13()) {
+function resolveKernelOperatorSocket(home2 = homedir14()) {
   const p = kernelOperatorSocketPath(home2);
   return existsSync35(p) ? p : null;
 }
@@ -37999,7 +38042,7 @@ var init_audit_hashchain = () => {};
 
 // src/vault/broker/test-isolation-guard.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
-import { homedir as homedir15, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir16, tmpdir as tmpdir3 } from "node:os";
 import { join as join34, resolve as resolve28, sep } from "node:path";
 function isTestRuntime() {
   return process.env.VITEST !== undefined;
@@ -38008,7 +38051,7 @@ function escapeHatchSet() {
   return process.env.SWITCHROOM_ALLOW_PROD_VAULT_IN_TEST === "1";
 }
 function realSwitchroomHome() {
-  return resolve28(homedir15(), ".switchroom");
+  return resolve28(homedir16(), ".switchroom");
 }
 function isUnderRealSwitchroomHome(p) {
   const home2 = realSwitchroomHome();
@@ -39190,9 +39233,9 @@ var init_audit_rotation_config = __esm(() => {
 
 // src/host-control/audit-reader.ts
 import { closeSync as closeSync12, existsSync as existsSync51, openSync as openSync12, readSync as readSync3, statSync as statSync33 } from "node:fs";
-import { homedir as homedir22 } from "node:os";
+import { homedir as homedir23 } from "node:os";
 import { join as join47 } from "node:path";
-function defaultAuditLogPath2(home2 = homedir22()) {
+function defaultAuditLogPath2(home2 = homedir23()) {
   return join47(home2, ".switchroom", "host-control-audit.log");
 }
 function auditRotation() {
@@ -39351,6 +39394,9 @@ function parseAuditLine2(line) {
     entry.failed_step = o.failed_step;
   if (typeof o.failed_agent === "string")
     entry.failed_agent = o.failed_agent;
+  if (Array.isArray(o.drifted) && o.drifted.every((x) => typeof x === "string")) {
+    entry.drifted = o.drifted;
+  }
   if (typeof o.agent === "string")
     entry.agent = o.agent;
   if (typeof o.n === "number")
@@ -44237,8 +44283,8 @@ var init_client5 = __esm(() => {
 // src/web/fleet-health-read.ts
 import { readFileSync as readFileSync51 } from "node:fs";
 import { resolve as resolve32 } from "node:path";
-import { homedir as homedir25 } from "node:os";
-function fleetHealthLedgerPath(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir25()) {
+import { homedir as homedir26 } from "node:os";
+function fleetHealthLedgerPath(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir26()) {
   return resolve32(home2, ".switchroom", "fleet-health", "ledger.json");
 }
 function readFleetHealth(path6) {
@@ -45484,6 +45530,241 @@ var init_doctor_hnsw_index = __esm(() => {
   ];
 });
 
+// src/cli/doctor-observation-scopes.ts
+function computeScopeSaturation(scopes, cap, warnRatio = OBSERVATION_SCOPE_WARN_RATIO) {
+  if (cap < 0)
+    return [];
+  const sets = scopes.map((s) => ({ tags: s.tags, set: new Set(s.tags), count: s.count }));
+  const postings = new Map;
+  sets.forEach((entry, i) => {
+    for (const tag of entry.set) {
+      const list = postings.get(tag);
+      if (list)
+        list.push(i);
+      else
+        postings.set(tag, [i]);
+    }
+  });
+  const out = [];
+  for (const entry of sets) {
+    if (entry.set.size === 0)
+      continue;
+    let candidates;
+    for (const tag of entry.set) {
+      const list = postings.get(tag);
+      if (list && (candidates === undefined || list.length < candidates.length)) {
+        candidates = list;
+      }
+    }
+    let effective = 0;
+    for (const idx of candidates ?? []) {
+      const other = sets[idx];
+      if (other === undefined)
+        continue;
+      let contains = true;
+      for (const tag of entry.set) {
+        if (!other.set.has(tag)) {
+          contains = false;
+          break;
+        }
+      }
+      if (contains)
+        effective += other.count;
+    }
+    const status = cap > 0 && effective >= cap ? "fail" : cap > 0 && effective >= cap * warnRatio ? "warn" : "ok";
+    out.push({ tags: [...entry.tags], exact: entry.count, effective, cap, status });
+  }
+  out.sort((a, b) => b.effective - a.effective);
+  return out;
+}
+function describeScope(bankId, s) {
+  return `${bankId}/${s.tags.join(",")} (${s.effective}/${s.cap})`;
+}
+function classifyObservationScopeSaturation(reports) {
+  const name = OBSERVATION_SCOPE_CHECK_NAME;
+  if (reports.length === 0) {
+    return { name, status: "skip", detail: "no banks to inspect" };
+  }
+  const unreadable = reports.filter((r) => !r.ok);
+  const readable = reports.filter((r) => r.ok);
+  if (readable.length === 0) {
+    return {
+      name,
+      status: "skip",
+      detail: `could not read observation scopes for ${unreadable.length} bank(s): ` + unreadable.map((r) => `${r.bankId} (${r.reason ?? "unknown"})`).join(", ")
+    };
+  }
+  const unjudged = readable.filter((r) => r.hasScopeLimitRules || !r.observationsEnabled);
+  const judged = readable.filter((r) => !r.hasScopeLimitRules && r.observationsEnabled);
+  const notes = [];
+  if (unreadable.length > 0) {
+    notes.push(`${unreadable.length} bank(s) unreadable: ` + unreadable.map((r) => `${r.bankId} (${r.reason ?? "unknown"})`).join(", "));
+  }
+  const withRules = unjudged.filter((r) => r.hasScopeLimitRules);
+  if (withRules.length > 0) {
+    notes.push(`${withRules.length} bank(s) not judged \u2014 observation_scope_limits sets a ` + `per-scope cap this check does not resolve: ${withRules.map((r) => r.bankId).join(", ")}`);
+  }
+  const disabled = unjudged.filter((r) => !r.hasScopeLimitRules && !r.observationsEnabled);
+  if (disabled.length > 0) {
+    notes.push(`${disabled.length} bank(s) have observations disabled: ` + disabled.map((r) => r.bankId).join(", "));
+  }
+  const suffix = notes.length > 0 ? ` \u00b7 ${notes.join(" \u00b7 ")}` : "";
+  if (judged.length === 0) {
+    return { name, status: "skip", detail: `no bank could be judged${suffix}` };
+  }
+  const closed = judged.filter((r) => r.cap === 0);
+  const unlimited = judged.filter((r) => r.cap < 0);
+  const capped = judged.filter((r) => r.cap > 0);
+  const failing = capped.flatMap((r) => r.saturated.filter((s) => s.status === "fail").map((s) => ({ report: r, scope: s })));
+  const warning = capped.flatMap((r) => r.saturated.filter((s) => s.status === "warn").map((s) => ({ report: r, scope: s })));
+  failing.sort((a, b) => b.scope.effective - a.scope.effective);
+  warning.sort((a, b) => b.scope.effective - a.scope.effective);
+  const backlog = (rows) => {
+    const seen = new Map;
+    for (const { report } of rows) {
+      if (report.pendingConsolidation != null && !seen.has(report.bankId)) {
+        seen.set(report.bankId, report.pendingConsolidation);
+      }
+    }
+    if (seen.size === 0)
+      return "";
+    const parts = [...seen].sort((a, b) => b[1] - a[1]).map(([bank, pending]) => `${bank} ${pending.toLocaleString()}`);
+    return ` \u00b7 memories pending consolidation: ${parts.join(", ")}`;
+  };
+  const list = (rows) => {
+    const shown = rows.slice(0, OBSERVATION_SCOPE_MAX_LISTED).map(({ report, scope }) => describeScope(report.bankId, scope)).join("; ");
+    const rest = rows.length - Math.min(rows.length, OBSERVATION_SCOPE_MAX_LISTED);
+    return rest > 0 ? `${shown}; +${rest} more` : shown;
+  };
+  const fix = "Consolidation keeps running against a full scope \u2014 it recalls, spends an " + "extraction-model call, and can only apply updates/deletes " + "(engine/consolidation/consolidator.py:1604-1613), so every pass on that " + "scope is paid for and its creates are discarded. Remedy: raise the cap, " + "via `hindsight.env.HINDSIGHT_API_MAX_OBSERVATIONS_PER_SCOPE` in " + "switchroom.yaml (fleet-wide) or `max_observations_per_scope` on the bank " + "(PATCH /v1/default/banks/<bank>/config). Confirm the counts first with " + "GET /v1/default/banks/<bank>/observations/scopes \u2014 but note they are EXACT " + "tag sets, while the engine counts by CONTAINMENT (`tags @> scope`), so a " + "scope's child scopes count toward it and its true number is higher than " + "that endpoint shows. Retiring a scope instead is NOT a single call: " + "DELETE /v1/default/banks/<bank>/observations clears the WHOLE bank's " + "observations, so enumerate the scope first " + "(GET /graph?type=observation&tags=<scope>&tags_match=exact) and delete " + "per memory.";
+  if (failing.length > 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `${failing.length} observation scope(s) at or over the cap \u2014 consolidation ` + `output is being discarded on them right now: ${list(failing)}` + (warning.length > 0 ? ` \u00b7 ${warning.length} more above ${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}%` : "") + backlog([...failing, ...warning]) + suffix,
+      fix
+    };
+  }
+  if (warning.length > 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `${warning.length} observation scope(s) above ` + `${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}% of the cap and still writable: ` + `${list(warning)}` + backlog(warning) + suffix,
+      fix
+    };
+  }
+  const totalScopes = capped.reduce((n, r) => n + r.scopeCount, 0);
+  const detailBase = capped.length === 0 ? `no bank has a positive observation cap` : `${totalScopes} scope(s) across ${capped.length} bank(s) below ` + `${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}% of the cap`;
+  const extra = [];
+  if (unlimited.length > 0) {
+    extra.push(`${unlimited.length} bank(s) uncapped (-1)`);
+  }
+  if (closed.length > 0) {
+    extra.push(`${closed.length} bank(s) deliberately closed to new observations (cap 0): ` + closed.map((r) => r.bankId).join(", "));
+  }
+  return {
+    name,
+    status: "ok",
+    detail: detailBase + (extra.length > 0 ? ` \u00b7 ${extra.join(" \u00b7 ")}` : "") + suffix
+  };
+}
+async function getJson2(url, opts) {
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const timeoutMs = opts?.timeoutMs ?? 15000;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(url, { signal: controller.signal });
+    clearTimeout(timeout);
+    if (!resp.ok)
+      return { ok: false, reason: `HTTP ${resp.status}` };
+    return { ok: true, data: await resp.json() };
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err.name === "AbortError")
+      return { ok: false, reason: "Timeout" };
+    return { ok: false, reason: String(err.message ?? err) };
+  }
+}
+async function inspectBankScopes(apiUrl, bankId, opts) {
+  const base = hindsightRestBase(apiUrl);
+  const bank = encodeURIComponent(bankId);
+  const fail4 = (reason) => ({
+    bankId,
+    ok: false,
+    reason,
+    cap: -1,
+    observationsEnabled: false,
+    hasScopeLimitRules: false,
+    scopeCount: 0,
+    saturated: [],
+    pendingConsolidation: null
+  });
+  const cfg = await getJson2(`${base}/v1/default/banks/${bank}/config`, opts);
+  if (!cfg.ok)
+    return fail4(cfg.reason);
+  const config = cfg.data?.config;
+  if (config == null || typeof config !== "object")
+    return fail4("Unexpected shape");
+  const rawCap = config["max_observations_per_scope"];
+  if (typeof rawCap !== "number" || !Number.isFinite(rawCap)) {
+    return fail4("Unexpected shape");
+  }
+  const rules = config["observation_scope_limits"];
+  const hasScopeLimitRules = Array.isArray(rules) && rules.length > 0;
+  const observationsEnabled = config["enable_observations"] !== false;
+  const scopesResp = await getJson2(`${base}/v1/default/banks/${bank}/observations/scopes`, opts);
+  if (!scopesResp.ok)
+    return fail4(scopesResp.reason);
+  const rawScopes = scopesResp.data?.scopes;
+  if (!Array.isArray(rawScopes))
+    return fail4("Unexpected shape");
+  const scopes = [];
+  for (const entry of rawScopes) {
+    const tags = entry?.tags;
+    const count = entry?.count;
+    if (!Array.isArray(tags) || typeof count !== "number")
+      continue;
+    if (!tags.every((t) => typeof t === "string"))
+      continue;
+    scopes.push({ tags, count });
+  }
+  const saturated = computeScopeSaturation(scopes, rawCap).filter((s) => s.status !== "ok");
+  let pendingConsolidation = null;
+  if (saturated.length > 0 && !hasScopeLimitRules && observationsEnabled) {
+    const stats = await getJson2(`${base}/v1/default/banks/${bank}/stats`, opts);
+    if (stats.ok && typeof stats.data?.pending_consolidation === "number") {
+      pendingConsolidation = stats.data.pending_consolidation;
+    }
+  }
+  return {
+    bankId,
+    ok: true,
+    cap: rawCap,
+    observationsEnabled,
+    hasScopeLimitRules,
+    scopeCount: scopes.length,
+    saturated,
+    pendingConsolidation
+  };
+}
+async function checkObservationScopeSaturation(config, apiUrl, opts) {
+  const banks = new Set;
+  for (const [agentName, agentConfig] of Object.entries(config.agents ?? {})) {
+    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
+    banks.add(resolved.memory?.collection ?? agentName);
+  }
+  for (const bank of collectProfileBanks(config))
+    banks.add(bank);
+  const reports = await Promise.all([...banks].map((bankId) => inspectBankScopes(apiUrl, bankId, opts)));
+  return classifyObservationScopeSaturation(reports);
+}
+var OBSERVATION_SCOPE_CHECK_NAME = "hindsight observation scopes", OBSERVATION_SCOPE_WARN_RATIO = 0.8, OBSERVATION_SCOPE_MAX_LISTED = 6;
+var init_doctor_observation_scopes = __esm(() => {
+  init_merge();
+  init_hindsight2();
+});
+
 // src/hindsight-watch/install-cron.ts
 import { existsSync as existsSync63, mkdirSync as mkdirSync35, readFileSync as readFileSync60, renameSync as renameSync15, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname22 } from "node:path";
@@ -45538,9 +45819,9 @@ var init_types5 = () => {};
 
 // src/hindsight-watch/state.ts
 import { mkdirSync as mkdirSync36, readFileSync as readFileSync61, renameSync as renameSync16, writeFileSync as writeFileSync23 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
+import { homedir as homedir31 } from "node:os";
 import { dirname as dirname23, resolve as resolve36 } from "node:path";
-function defaultStatePath2(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir30()) {
+function defaultStatePath2(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir31()) {
   return resolve36(home2, ".switchroom", "hindsight-watch", "state.json");
 }
 function loadState(path6) {
@@ -46434,12 +46715,121 @@ var init_key_allowlist_check = __esm(() => {
   init_key_allowlist();
 });
 
+// src/cli/doctor-routing-mode.ts
+import { readFileSync as readFileSync62 } from "node:fs";
+import { join as join59 } from "node:path";
+function routingModePath(agentDir) {
+  return join59(agentDir, ROUTING_MODE_FILENAME);
+}
+function parseRoutingModeRecord(text) {
+  const line = text.split(`
+`).find((l) => l.trim().length > 0);
+  if (!line)
+    return null;
+  const fields = {};
+  for (const tok of line.trim().split(/\s+/)) {
+    const eq = tok.indexOf("=");
+    if (eq <= 0)
+      continue;
+    fields[tok.slice(0, eq)] = tok.slice(eq + 1);
+  }
+  if (!fields.mode || !fields.declared)
+    return null;
+  return {
+    mode: fields.mode,
+    base: fields.base ?? "",
+    model: fields.model ?? "",
+    litellmOk: fields.litellm_ok ?? "",
+    declared: fields.declared,
+    ts: fields.ts ?? ""
+  };
+}
+function classifyRoutingMode(rec) {
+  if (!LITELLM_DECLARED_MODES.has(rec.declared))
+    return null;
+  if (rec.mode !== UNTRACKED_MODE)
+    return null;
+  const when = rec.ts ? ` at its last boot (${rec.ts})` : "";
+  return {
+    status: "warn",
+    detail: `landed on direct-oauth${when} but its declared routing is ` + `\`${rec.declared}\` \u2014 start.sh's missing-key fail-open stripped the ` + `LiteLLM routing env, so this agent runs UNTRACKED on direct Anthropic ` + `OAuth: no spend attribution, no guardrails` + (rec.model ? ` (model \`${rec.model}\`)` : "") + `.`
+  };
+}
+function runRoutingModeChecks(config, deps = {}) {
+  const results = [];
+  const agents = Object.keys(config.agents ?? {});
+  if (agents.length === 0)
+    return results;
+  const readFile2 = deps.readFile ?? ((p) => readFileSync62(p, "utf-8"));
+  let agentsDir = deps.agentsDir;
+  if (agentsDir === undefined) {
+    try {
+      agentsDir = resolveAgentsDir(config);
+    } catch {
+      agentsDir = undefined;
+    }
+  }
+  if (agentsDir === undefined) {
+    return [
+      {
+        name: "litellm routing",
+        status: "warn",
+        detail: "could not resolve the agents directory (no switchroom block) \u2014 " + "skipped the boot routing-mode check"
+      }
+    ];
+  }
+  for (const name of agents) {
+    const path6 = routingModePath(join59(agentsDir, name));
+    let text;
+    try {
+      text = readFile2(path6);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT")
+        continue;
+      results.push({
+        name: `litellm routing: ${name}`,
+        status: "warn",
+        detail: `could not read the boot routing record at ${path6} ` + `(${code ?? err.message}) \u2014 an untracked boot would go ` + `unreported here.`,
+        fix: `Check the file's ownership and mode (start.sh writes it 0644 before \`exec claude\`).`
+      });
+      continue;
+    }
+    const rec = parseRoutingModeRecord(text);
+    if (!rec) {
+      results.push({
+        name: `litellm routing: ${name}`,
+        status: "warn",
+        detail: `the boot routing record at ${path6} is malformed (no \`mode=\`/` + `\`declared=\` fields) \u2014 an untracked boot would go unreported here.`,
+        fix: `Delete it and restart the agent to have start.sh rewrite it: rm ${path6}`
+      });
+      continue;
+    }
+    const verdict = classifyRoutingMode(rec);
+    if (!verdict)
+      continue;
+    results.push({
+      name: `litellm routing: ${name}`,
+      status: verdict.status,
+      detail: verdict.detail,
+      fix: FIX2
+    });
+  }
+  return results;
+}
+var LITELLM_DECLARED_MODES, UNTRACKED_MODE = "direct-oauth", ROUTING_MODE_FILENAME = ".routing-mode", FIX2;
+var init_doctor_routing_mode = __esm(() => {
+  init_loader();
+  LITELLM_DECLARED_MODES = new Set(["passthrough", "router-root"]);
+  FIX2 = "start.sh could not fetch this agent's `litellm/<agent>/api-key` from the " + "vault-broker. Re-run `switchroom apply` (it provisions the per-agent " + "virtual key idempotently and re-grants the agent's `secrets:` ACL), then " + "RESTART the agent \u2014 the strip is decided once at boot and is never " + "re-evaluated for the life of the session, so a fixed key does not take " + "effect until the next boot. Confirm from the agent's `.routing-mode` line " + "afterwards.";
+});
+
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync65, readFileSync as readFileSync62 } from "node:fs";
+import { existsSync as existsSync65, readFileSync as readFileSync63 } from "node:fs";
 import { createHash as createHash14 } from "node:crypto";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import { homedir as homedir31 } from "node:os";
-import { join as join59 } from "node:path";
+import { homedir as homedir32 } from "node:os";
+import { join as join60 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
     const r = spawnSync10("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
@@ -46539,7 +46929,7 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join59(stateDir, "sha-index.json");
+  const indexPath = join60(stateDir, "sha-index.json");
   if (!existsSync65(indexPath)) {
     return {
       name: "auth-broker: drift",
@@ -46549,7 +46939,7 @@ function checkAuthBrokerDrift(deps = {}) {
   }
   let index;
   try {
-    index = JSON.parse(readFileSync62(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync63(indexPath, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: drift",
@@ -46558,7 +46948,7 @@ function checkAuthBrokerDrift(deps = {}) {
       fix: "Inspect `~/.switchroom/state/auth-broker/sha-index.json` for corruption."
     };
   }
-  const home2 = deps.home ?? homedir31();
+  const home2 = deps.home ?? homedir32();
   const divergent = [];
   const missingOnDisk = [];
   for (const [label, expected] of Object.entries(index)) {
@@ -46569,7 +46959,7 @@ function checkAuthBrokerDrift(deps = {}) {
     }
     let got;
     try {
-      got = sha256Hex(readFileSync62(credsPath, "utf-8"));
+      got = sha256Hex(readFileSync63(credsPath, "utf-8"));
     } catch (err) {
       divergent.push(`${label} (read failed: ${err.message})`);
       continue;
@@ -46600,7 +46990,7 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path6 = join59(stateDir, "threshold-violations.json");
+  const path6 = join60(stateDir, "threshold-violations.json");
   if (!existsSync65(path6)) {
     return {
       name: "auth-broker: threshold violations",
@@ -46610,7 +47000,7 @@ function checkAuthBrokerThresholdViolations(deps = {}) {
   }
   let violations;
   try {
-    violations = JSON.parse(readFileSync62(path6, "utf-8"));
+    violations = JSON.parse(readFileSync63(path6, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: threshold violations",
@@ -46644,7 +47034,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
       fix: "Run `switchroom auth use <label>` to pin a fleet-wide account, then `switchroom apply`. Without an active account every agent boot fails."
     };
   }
-  const home2 = deps.home ?? homedir31();
+  const home2 = deps.home ?? homedir32();
   const dir = accountDir(active, home2);
   if (!existsSync65(dir)) {
     return {
@@ -46796,8 +47186,8 @@ import {
   realpathSync as realpathSync5,
   statSync as statSync39
 } from "node:fs";
-import { userInfo, homedir as homedir32 } from "node:os";
-import { join as join60 } from "node:path";
+import { userInfo, homedir as homedir33 } from "node:os";
+import { join as join61 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
@@ -46946,7 +47336,7 @@ async function runSecretAccessChecks(config, deps = {}) {
     }
   }
   const statPath = deps.statPath ?? statVault;
-  const home2 = deps.operatorHome ?? homedir32();
+  const home2 = deps.operatorHome ?? homedir33();
   const ownedRoots = deps.ownedRoots ?? operatorOwnedPaths(home2);
   const walkOwned = deps.walkOwned ?? ((root) => walkOperatorOwnedTargets(home2, {}, [root]));
   for (const root of ownedRoots) {
@@ -46969,7 +47359,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join60(homedir32(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join61(homedir33(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -47061,8 +47451,8 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join61, resolve as resolve37 } from "node:path";
-import { homedir as homedir33 } from "node:os";
+import { join as join62, resolve as resolve37 } from "node:path";
+import { homedir as homedir34 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
@@ -47185,8 +47575,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join61(agentDir, ".mcp.json");
-    const claudeJsonPath = join61(agentDir, ".claude", ".claude.json");
+    const mcpPath = join62(agentDir, ".mcp.json");
+    const claudeJsonPath = join62(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -47299,7 +47689,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join61(homedir33(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join62(homedir34(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -47353,8 +47743,8 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join62 } from "node:path";
-import { homedir as homedir34 } from "node:os";
+import { join as join63 } from "node:path";
+import { homedir as homedir35 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
   try {
@@ -47382,7 +47772,7 @@ function resolveDeps2(config, deps) {
     }
   }
   return {
-    homeDir: deps.homeDir ?? homedir34(),
+    homeDir: deps.homeDir ?? homedir35(),
     agentsDir,
     existsSync: deps.existsSync ?? ((p) => realExistsSync2(p)),
     readFileSync: deps.readFileSync ?? ((p) => realReadFileSync2(p, "utf-8")),
@@ -47411,7 +47801,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join62(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join63(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -47441,14 +47831,14 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const sharedCloakDir = join62(d.homeDir, ".switchroom", "cloakbrowser");
-  const legacyCloakDir = join62(d.homeDir, ".cloakbrowser");
+  const sharedCloakDir = join63(d.homeDir, ".switchroom", "cloakbrowser");
+  const legacyCloakDir = join63(d.homeDir, ".cloakbrowser");
   const hasChromium = (dir) => {
     if (!d.existsSync(dir))
       return false;
     try {
       for (const entry of d.readdirSync(dir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join62(dir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join63(dir, entry, "chrome"))) {
           return true;
         }
       }
@@ -47485,9 +47875,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join62(d.agentsDir, agent);
-    const settingsPath = join62(agentDir, ".claude", "settings.json");
-    const mcpPath = join62(agentDir, ".mcp.json");
+    const agentDir = join63(d.agentsDir, agent);
+    const settingsPath = join63(agentDir, ".claude", "settings.json");
+    const mcpPath = join63(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -47787,10 +48177,10 @@ var init_doctor_cron_session = __esm(() => {
 });
 
 // telegram-plugin/flood-429-ledger.ts
-import { readFileSync as readFileSync63, writeFileSync as writeFileSync24, mkdirSync as mkdirSync37, chmodSync as chmodSync11, unlinkSync as unlinkSync14 } from "node:fs";
-import { dirname as dirname24, join as join63 } from "node:path";
+import { readFileSync as readFileSync64, writeFileSync as writeFileSync24, mkdirSync as mkdirSync37, chmodSync as chmodSync11, unlinkSync as unlinkSync14 } from "node:fs";
+import { dirname as dirname24, join as join64 } from "node:path";
 function flood429LedgerPath(stateDir) {
-  return join63(stateDir, FLOOD_429_LEDGER_FILE);
+  return join64(stateDir, FLOOD_429_LEDGER_FILE);
 }
 function parseEpisode(raw) {
   if (typeof raw !== "object" || raw === null)
@@ -47810,7 +48200,7 @@ function parseEpisode(raw) {
     count: num2(r.count) ?? 1
   };
 }
-function readFlood429LedgerResult(path6, readFile2 = (p) => readFileSync63(p, "utf-8")) {
+function readFlood429LedgerResult(path6, readFile2 = (p) => readFileSync64(p, "utf-8")) {
   let text;
   try {
     text = readFile2(path6);
@@ -47920,14 +48310,14 @@ var init_flood_429_ledger = __esm(() => {
 });
 
 // src/cli/doctor-flood-pressure.ts
-import { readFileSync as readFileSync64 } from "node:fs";
-import { join as join64 } from "node:path";
+import { readFileSync as readFileSync65 } from "node:fs";
+import { join as join65 } from "node:path";
 function runFloodPressureChecks(config, deps = {}) {
   const results = [];
   const agents = Object.keys(config.agents ?? {});
   if (agents.length === 0)
     return results;
-  const readFile2 = deps.readFile ?? ((p) => readFileSync64(p, "utf-8"));
+  const readFile2 = deps.readFile ?? ((p) => readFileSync65(p, "utf-8"));
   const now = deps.now ?? Date.now();
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
@@ -47947,7 +48337,7 @@ function runFloodPressureChecks(config, deps = {}) {
     ];
   }
   for (const name of agents) {
-    const path6 = flood429LedgerPath(join64(agentsDir, name, "telegram"));
+    const path6 = flood429LedgerPath(join65(agentsDir, name, "telegram"));
     const read = readFlood429LedgerResult(path6, readFile2);
     if (read.status === "unreadable" || read.status === "corrupt") {
       results.push({
@@ -47967,16 +48357,16 @@ function runFloodPressureChecks(config, deps = {}) {
       name: `429 flood pressure: ${name}`,
       status: verdict.status,
       detail: verdict.detail,
-      fix: FIX2
+      fix: FIX3
     });
   }
   return results;
 }
-var FIX2;
+var FIX3;
 var init_doctor_flood_pressure = __esm(() => {
   init_loader();
   init_flood_429_ledger();
-  FIX2 = "A flood ban is server-side and cannot be cleared early \u2014 cut the outbound " + "rate that earns it. Check the gateway's `send-gate stats` and " + "`edit-flood-fuse` lines for the class doing the sending (progress cards and " + "the worker feed are the usual culprits), and see " + "`telegram-plugin/edit-flood-fuse.ts` for the per-class ceilings.";
+  FIX3 = "A flood ban is server-side and cannot be cleared early \u2014 cut the outbound " + "rate that earns it. Check the gateway's `send-gate stats` and " + "`edit-flood-fuse` lines for the class doing the sending (progress cards and " + "the worker feed are the usual culprits), and see " + "`telegram-plugin/edit-flood-fuse.ts` for the per-class ceilings.";
 });
 
 // src/litellm/budget.ts
@@ -48680,7 +49070,7 @@ async function runMcpSecretChecks(config, deps = {}) {
 
 // src/agents/connection-health.ts
 import { mkdirSync as mkdirSync38, writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   const reqs = computeMcpSecretRequirements(config).filter((r) => r.agent === agentName);
   if (reqs.length === 0)
@@ -48737,8 +49127,8 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   return issues;
 }
 function writeConnectionHealthFile(agentDir, health, deps) {
-  const dir = join65(agentDir, ".claude");
-  const path6 = join65(dir, CONNECTION_HEALTH_FILENAME);
+  const dir = join66(agentDir, ".claude");
+  const path6 = join66(dir, CONNECTION_HEALTH_FILENAME);
   (deps?.mkdir ?? ((p, o) => mkdirSync38(p, o)))(dir, { recursive: true });
   (deps?.writeFile ?? ((p, d) => writeFileSync25(p, d)))(path6, JSON.stringify(health, null, 2) + `
 `);
@@ -48761,10 +49151,10 @@ var CONNECTION_HEALTH_FILENAME = "connection-health.json";
 var init_connection_health = () => {};
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync67, readFileSync as readFileSync65, writeFileSync as writeFileSync26, chmodSync as chmodSync12, mkdirSync as mkdirSync39 } from "node:fs";
-import { join as join66 } from "node:path";
+import { existsSync as existsSync67, readFileSync as readFileSync66, writeFileSync as writeFileSync26, chmodSync as chmodSync12, mkdirSync as mkdirSync39 } from "node:fs";
+import { join as join67 } from "node:path";
 function containerHookCommand() {
-  return join66(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
+  return join67(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
 }
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -48830,12 +49220,12 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join66(agentDir, ".claude", "hooks");
+  const hooksDir = join67(agentDir, ".claude", "hooks");
   mkdirSync39(hooksDir, { recursive: true });
-  const scriptPath = join66(hooksDir, HOOK_FILENAME);
+  const scriptPath = join67(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync67(scriptPath) ? readFileSync65(scriptPath, "utf-8") : "";
+  const existing = existsSync67(scriptPath) ? readFileSync66(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync26(scriptPath, desired, { mode: 493 });
     chmodSync12(scriptPath, 493);
@@ -48845,11 +49235,11 @@ function installUpdatePromptHook(agentDir) {
       chmodSync12(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join66(agentDir, ".claude", "settings.json");
+  const settingsPath = join67(agentDir, ".claude", "settings.json");
   if (!existsSync67(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync65(settingsPath, "utf-8");
+  const raw = readFileSync66(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -48975,7 +49365,7 @@ __export(exports_voice_sidecar_token, {
   VOICE_SIDECAR_TOKEN_ENV: () => VOICE_SIDECAR_TOKEN_ENV
 });
 import { randomBytes as randomBytes12 } from "node:crypto";
-import { chmodSync as chmodSync13, chownSync as chownSync6, existsSync as existsSync69, mkdirSync as mkdirSync40, readFileSync as readFileSync66, rmSync as rmSync12, writeFileSync as writeFileSync27 } from "node:fs";
+import { chmodSync as chmodSync13, chownSync as chownSync6, existsSync as existsSync69, mkdirSync as mkdirSync40, readFileSync as readFileSync67, rmSync as rmSync12, writeFileSync as writeFileSync27 } from "node:fs";
 import { dirname as dirname27 } from "node:path";
 async function defaultResolveOrSeedToken(home2, writeErr) {
   const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { resolveOperatorVaultPassphrase }] = await Promise.all([
@@ -49011,7 +49401,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
   if (engine !== "local") {
     try {
       if (existsSync69(envPath)) {
-        const body = readFileSync66(envPath, "utf-8");
+        const body = readFileSync67(envPath, "utf-8");
         if (body.includes(`${VOICE_SIDECAR_TOKEN_ENV}=`))
           rmSync12(envPath);
       }
@@ -49034,7 +49424,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
     let body = "";
     try {
       if (existsSync69(envPath))
-        body = readFileSync66(envPath, "utf-8");
+        body = readFileSync67(envPath, "utf-8");
     } catch {}
     const line = `${VOICE_SIDECAR_TOKEN_ENV}=${token}`;
     const keyRe = new RegExp(`^${VOICE_SIDECAR_TOKEN_ENV}=.*$`, "m");
@@ -49096,12 +49486,12 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync2, chmodSync as chmodSync14, chownSync as chownSync7, constants as fsConstants5, copyFileSync as copyFileSync10, existsSync as existsSync70, mkdirSync as mkdirSync41, readFileSync as readFileSync67, readdirSync as readdirSync24, renameSync as renameSync17, statSync as statSync40, writeFileSync as writeFileSync28 } from "node:fs";
+import { accessSync as accessSync2, chmodSync as chmodSync14, chownSync as chownSync7, constants as fsConstants5, copyFileSync as copyFileSync10, existsSync as existsSync70, mkdirSync as mkdirSync41, readFileSync as readFileSync68, readdirSync as readdirSync24, renameSync as renameSync17, statSync as statSync40, writeFileSync as writeFileSync28 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
-import { dirname as dirname28, join as join68, resolve as resolve40 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { dirname as dirname28, join as join69, resolve as resolve40 } from "node:path";
+import { homedir as homedir37 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
   return agentResolvedLitellm?.enabled ?? config.litellm?.enabled ?? false;
@@ -49112,7 +49502,7 @@ async function resolveOperatorVaultPassphrase(home2) {
     return envPass;
   try {
     const { readAutoUnlockFile: readAutoUnlockFile2 } = await Promise.resolve().then(() => (init_auto_unlock(), exports_auto_unlock));
-    const blobPath = join68(home2, ".switchroom", "vault-auto-unlock");
+    const blobPath = join69(home2, ".switchroom", "vault-auto-unlock");
     const pass = readAutoUnlockFile2(blobPath);
     return pass && pass.length > 0 ? pass : null;
   } catch {
@@ -49121,9 +49511,9 @@ async function resolveOperatorVaultPassphrase(home2) {
 }
 function materializeLitellmMasterKeyForBroker(masterKey, home2 = process.env.HOME ?? "/root") {
   try {
-    const stateDir = join68(home2, ".switchroom", "state", "auth-broker");
+    const stateDir = join69(home2, ".switchroom", "state", "auth-broker");
     mkdirSync41(stateDir, { recursive: true, mode: 448 });
-    const path7 = join68(stateDir, LITELLM_MASTER_KEY_STATE_BASENAME);
+    const path7 = join69(stateDir, LITELLM_MASTER_KEY_STATE_BASENAME);
     writeFileSync28(path7, masterKey.trim() + `
 `, { mode: 384 });
     try {
@@ -49159,7 +49549,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
     Promise.resolve().then(() => (init_provision(), exports_provision)),
     Promise.resolve().then(() => (init_telegram_yaml(), exports_telegram_yaml))
   ]);
-  const passphrase = await resolveOperatorVaultPassphrase(ctx.home ?? homedir36());
+  const passphrase = await resolveOperatorVaultPassphrase(ctx.home ?? homedir37());
   if (passphrase === null) {
     const { getViaBrokerStructured: getViaBrokerStructured3 } = await Promise.resolve().then(() => (init_client(), exports_client));
     const alreadyProvisioned = [];
@@ -49222,7 +49612,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   let configText = null;
   if (switchroomConfigPath && existsSync70(switchroomConfigPath)) {
     try {
-      configText = readFileSync67(switchroomConfigPath, "utf-8");
+      configText = readFileSync68(switchroomConfigPath, "utf-8");
     } catch (err) {
       ctx.writeErr(source_default.yellow(`  ! litellm: could not read config for ACL grants (${err.message}); keys will be provisioned but agents may lack read-ACL.
 `));
@@ -49269,7 +49659,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
         }
       }
       if (masterKey && !brokerKeyMaterialized) {
-        const mat = materializeLitellmMasterKeyForBroker(masterKey, ctx.home ?? homedir36());
+        const mat = materializeLitellmMasterKeyForBroker(masterKey, ctx.home ?? homedir37());
         brokerKeyMaterialized = true;
         if (!mat.ok) {
           ctx.writeErr(source_default.yellow(`  ! litellm: could not materialize master key for auth-broker external-spend (${mat.error})
@@ -49552,7 +49942,7 @@ function resolveVaultBindMountDir(homeDir, ctx) {
   if (isCustomPath && ctx.customVaultPath) {
     return dirname28(ctx.customVaultPath);
   }
-  return join68(homeDir, ".switchroom", "vault");
+  return join69(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync70(vaultDir))
@@ -49583,41 +49973,41 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = resolveHostHomeForCompose();
   const dirs = [
-    join68(home2, ".switchroom", "approvals"),
-    join68(home2, ".switchroom", "scheduler"),
-    join68(home2, ".switchroom", "logs"),
-    join68(home2, ".switchroom", "compose"),
-    join68(home2, ".switchroom", "broker-operator")
+    join69(home2, ".switchroom", "approvals"),
+    join69(home2, ".switchroom", "scheduler"),
+    join69(home2, ".switchroom", "logs"),
+    join69(home2, ".switchroom", "compose"),
+    join69(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join68(home2, ".switchroom", "agents", name));
-    dirs.push(join68(home2, ".switchroom", "logs", name));
-    dirs.push(join68(home2, ".claude", "projects", name));
-    dirs.push(join68(home2, ".switchroom", "audit", name));
-    if (existsSync70(join68(home2, ".switchroom-config"))) {
-      dirs.push(join68(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join69(home2, ".switchroom", "agents", name));
+    dirs.push(join69(home2, ".switchroom", "logs", name));
+    dirs.push(join69(home2, ".claude", "projects", name));
+    dirs.push(join69(home2, ".switchroom", "audit", name));
+    if (existsSync70(join69(home2, ".switchroom-config"))) {
+      dirs.push(join69(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join68(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join69(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync70(autoUnlockPath)) {
     writeFileSync28(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join68(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join69(home2, ".switchroom", "vault-audit.log");
   if (!existsSync70(auditLogPath)) {
     writeFileSync28(auditLogPath, "", { mode: 420 });
   }
   const grantsDbDir = getGrantsDbDir(home2);
   mkdirSync41(grantsDbDir, { recursive: true, mode: 448 });
   migrateLegacyGrantsDbLocation(getGrantsDbPath(home2));
-  const hostdAuditLogPath = join68(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join69(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync70(hostdAuditLogPath)) {
     writeFileSync28(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join68(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join69(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync70(tokenPath)) {
       writeFileSync28(tokenPath, "", { mode: 384 });
     }
@@ -49626,15 +50016,15 @@ async function ensureHostMountSources(config) {
       chownSync7(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join68(home2, ".switchroom", "fleet");
+  const fleetDir = join69(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join68(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join69(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync70(invariantsPath) ? readFileSync67(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync70(invariantsPath) ? readFileSync68(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync28(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join68(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join69(fleetDir, "CLAUDE.md");
   if (!existsSync70(fleetClaudePath)) {
     writeFileSync28(fleetClaudePath, renderFleetDefaultsClaudeMd(), {
       mode: 420
@@ -49718,10 +50108,10 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir36()) {
+function writeInstallTypeCache(homeDir = homedir37()) {
   const ctx = detectInstallType();
-  const dir = join68(homeDir, ".switchroom");
-  const out = join68(dir, "install-type.json");
+  const dir = join69(homeDir, ".switchroom");
+  const out = join69(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync41(dir, { recursive: true });
   const payload = {
@@ -49788,17 +50178,17 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join68(agentsDir, name));
+        installUpdatePromptHook(join69(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
-      await refreshAgentConnectionHealth(config, name, join68(agentsDir, name), {
+      await refreshAgentConnectionHealth(config, name, join69(agentsDir, name), {
         vaultAclReader: connHealthVaultAclReader
       });
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join68(agentsDir, name), uid, {
+        alignAgentUid(name, join69(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49842,7 +50232,7 @@ Applying switchroom config...
       writeOut,
       writeErr,
       failures,
-      home: homedir36()
+      home: homedir37()
     });
   }
   await ensureHostMountSources(config);
@@ -49850,7 +50240,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join68(agentsDir, name), uid, {
+        alignAgentUid(name, join69(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49864,7 +50254,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir36(), {
+  const migrationResult = migrateVaultLayout(homedir37(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -49890,7 +50280,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir36());
+  const postMigrationInspect = inspectVaultLayout(homedir37());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -49905,7 +50295,7 @@ Expected one of: ${acceptable.join(", ")}
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir36(), {
+  const vaultDir = resolveVaultBindMountDir(homedir37(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -49936,7 +50326,7 @@ vault.enc.lock (PID-file flock from saveVault), and
   });
   if (!skipScaffold) {
     const { provisionVoiceSidecarToken: provisionVoiceSidecarToken2 } = await Promise.resolve().then(() => (init_voice_sidecar_token(), exports_voice_sidecar_token));
-    await provisionVoiceSidecarToken2(composePath, homedir36(), {
+    await provisionVoiceSidecarToken2(composePath, homedir37(), {
       writeOut,
       writeErr,
       operatorUid
@@ -49952,7 +50342,7 @@ Wrote `) + displayComposePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir36(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir37(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -50057,7 +50447,7 @@ Dry-run: validating switchroom config (no changes will be written)...
     }
   }
   try {
-    const probe2 = await probeVaultProvisioning(config, agentNames, homedir36());
+    const probe2 = await probeVaultProvisioning(config, agentNames, homedir37());
     if (probe2.alreadyProvisioned.length > 0) {
       info.push(`litellm: ${probe2.alreadyProvisioned.length} agent(s) already provisioned (${probe2.alreadyProvisioned.join(", ")}).`);
     }
@@ -50210,7 +50600,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join68(agentsDir, name, "start.sh");
+    const startSh = join69(agentsDir, name, "start.sh");
     if (!existsSync70(startSh))
       continue;
     try {
@@ -50416,7 +50806,7 @@ var init_apply = __esm(() => {
     switchroom: switchroom_default,
     minimal: minimal_default
   };
-  DEFAULT_COMPOSE_PATH = join68(homedir36(), ".switchroom", "compose", "docker-compose.yml");
+  DEFAULT_COMPOSE_PATH = join69(homedir37(), ".switchroom", "compose", "docker-compose.yml");
   IN_AGENT_CONTAINER_APPLY_MSG = "`switchroom apply`'s full per-agent scaffold cannot run from inside an " + "agent container \u2014 this is a host/hostd operation by construction " + "(no vault at the container HOME, and no `docker compose` v2 plugin here).\nTo roll the fleet to a new version, drive the hostd rollout (`mcp__hostd__rollout`): it runs a `--compose-only` apply plus a per-agent restart-reconcile, and each agent refreshes its own templates " + `on restart \u2014 the roll completes without any agent running a full apply.
 ` + "A full host-side `sudo switchroom apply` is only needed for structural changes (compose regeneration / new-agent scaffolding), and is run by the operator on the host, never from inside an agent.";
   SELF_ELEVATE_PRESERVED_ENV = [
@@ -50434,12 +50824,12 @@ import { createHash as createHash15 } from "node:crypto";
 import {
   existsSync as existsSync71,
   lstatSync as lstatSync9,
-  readFileSync as readFileSync68,
+  readFileSync as readFileSync69,
   readdirSync as readdirSync25,
   readlinkSync as readlinkSync7,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname29, isAbsolute as isAbsolute5, join as join69, resolve as resolve41 } from "node:path";
+import { dirname as dirname29, isAbsolute as isAbsolute5, join as join70, resolve as resolve41 } from "node:path";
 async function detectComposeDrift(opts) {
   let result;
   try {
@@ -50472,7 +50862,7 @@ function detectHooksSurfaceDrift(name, agentConfig, agentDir, config, configPath
     useSwitchroomPlugin: usesSwitchroomTelegramPlugin(agentConfig),
     configPath
   });
-  const settingsPath = join69(agentDir, ".claude", "settings.json");
+  const settingsPath = join70(agentDir, ".claude", "settings.json");
   if (!existsSync71(settingsPath)) {
     return [
       {
@@ -50485,7 +50875,7 @@ function detectHooksSurfaceDrift(name, agentConfig, agentDir, config, configPath
   }
   let actual;
   try {
-    const raw = JSON.parse(readFileSync68(settingsPath, "utf-8"));
+    const raw = JSON.parse(readFileSync69(settingsPath, "utf-8"));
     actual = raw.hooks ?? {};
   } catch {
     return [
@@ -50525,7 +50915,7 @@ function detectTemplateStampDrift(name, agentConfig, agentDir, opts = {}) {
 }
 function detectSkillsDrift(name, agentDir) {
   const findings = [];
-  const skillsDir = join69(agentDir, ".claude", "skills");
+  const skillsDir = join70(agentDir, ".claude", "skills");
   const liveEntries = new Set;
   if (existsSync71(skillsDir)) {
     let entries = [];
@@ -50535,7 +50925,7 @@ function detectSkillsDrift(name, agentDir) {
       entries = [];
     }
     for (const entry of entries) {
-      const p = join69(skillsDir, entry);
+      const p = join70(skillsDir, entry);
       let st;
       try {
         st = lstatSync9(p);
@@ -50562,7 +50952,7 @@ function detectSkillsDrift(name, agentDir) {
       liveEntries.add(entry);
     }
   }
-  const overlayDir = join69(agentDir, "skills.d");
+  const overlayDir = join70(agentDir, "skills.d");
   if (existsSync71(overlayDir)) {
     let overlayEntries = [];
     try {
@@ -50589,8 +50979,8 @@ function detectSkillsDrift(name, agentDir) {
 function locateInstallBinDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    if (existsSync71(join69(dir, "dependencies.json")) && existsSync71(join69(dir, "bin"))) {
-      return join69(dir, "bin");
+    if (existsSync71(join70(dir, "dependencies.json")) && existsSync71(join70(dir, "bin"))) {
+      return join70(dir, "bin");
     }
     dir = dirname29(dir);
   }
@@ -50610,7 +51000,7 @@ function detectHookScriptDrift(name, opts = {}) {
   }
   for (const f of names) {
     try {
-      expected.set(f, createHash15("sha256").update(readFileSync68(join69(binDir, f))).digest("hex"));
+      expected.set(f, createHash15("sha256").update(readFileSync69(join70(binDir, f))).digest("hex"));
     } catch {}
   }
   if (expected.size === 0)
@@ -50662,17 +51052,17 @@ function detectHindsightRecallTunableDrift(name, agentConfig, agentDir, config)
   const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
   if (resolved.memory?.auto_recall === false)
     return [];
-  const pluginDir = join69(agentDir, ".claude", "plugins", "hindsight-memory");
+  const pluginDir = join70(agentDir, ".claude", "plugins", "hindsight-memory");
   if (!existsSync71(pluginDir))
     return [];
   const expected = resolveHindsightRecallTunables(resolved.memory?.recall);
   const findings = [];
   const mismatches = [];
-  const hooksPath = join69(pluginDir, "hooks", "hooks.json");
+  const hooksPath = join70(pluginDir, "hooks", "hooks.json");
   if (existsSync71(hooksPath)) {
     let installedHookTimeout = null;
     try {
-      installedHookTimeout = readHooksRecallTimeout(readFileSync68(hooksPath, "utf-8"));
+      installedHookTimeout = readHooksRecallTimeout(readFileSync69(hooksPath, "utf-8"));
     } catch {
       installedHookTimeout = null;
     }
@@ -50682,11 +51072,11 @@ function detectHindsightRecallTunableDrift(name, agentConfig, agentDir, config)
       mismatches.push(`hook ceiling is ${installedHookTimeout}s, expected ` + `${expected.hookTimeoutSeconds}s (memory.recall.hook_timeout_seconds)`);
     }
   }
-  const settingsPath = join69(pluginDir, "settings.json");
+  const settingsPath = join70(pluginDir, "settings.json");
   if (existsSync71(settingsPath)) {
     let settings = null;
     try {
-      settings = JSON.parse(readFileSync68(settingsPath, "utf-8"));
+      settings = JSON.parse(readFileSync69(settingsPath, "utf-8"));
     } catch {
       settings = null;
     }
@@ -50740,7 +51130,7 @@ function writeDriftReport(agentDir, findings) {
       generatedAt: new Date().toISOString(),
       findings: findings.map(({ surface, detail }) => ({ surface, detail }))
     };
-    writeFileSync29(join69(agentDir, DRIFT_REPORT_FILE), JSON.stringify(report, null, 2) + `
+    writeFileSync29(join70(agentDir, DRIFT_REPORT_FILE), JSON.stringify(report, null, 2) + `
 `, "utf-8");
   } catch {}
 }
@@ -50994,19 +51384,79 @@ var init_component_versions = __esm(() => {
   SEMVER_TAG_RE = /^v\d+\.\d+\.\d+$/;
 });
 
+// src/cli/component-scope.ts
+function imageRepoName(imageRef) {
+  if (!imageRef)
+    return null;
+  const at = imageRef.indexOf("@");
+  const withoutDigest = at >= 0 ? imageRef.slice(0, at) : imageRef;
+  const slash = withoutDigest.lastIndexOf("/");
+  if (slash < 0)
+    return null;
+  const afterSlash = withoutDigest.slice(slash + 1);
+  const colon = afterSlash.indexOf(":");
+  const repo = colon >= 0 ? afterSlash.slice(0, colon) : afterSlash;
+  return /^switchroom-[a-z0-9-]+$/.test(repo) ? repo : null;
+}
+function classifyComponent(c) {
+  if (c.kind === "cli")
+    return { kind: "cli" };
+  const repo = imageRepoName(c.imageRef);
+  switch (repo) {
+    case "switchroom-web":
+      return { kind: "web" };
+    case "switchroom-hostd":
+      return { kind: "hostd" };
+    case "switchroom-hindsight":
+      return { kind: "hindsight" };
+    case "switchroom-agent": {
+      const agent = c.name.startsWith("switchroom-") ? c.name.slice("switchroom-".length) : c.name;
+      return agent ? { kind: "fleet", agent } : { kind: "fleet" };
+    }
+    default:
+      return { kind: "fleet" };
+  }
+}
+function remediationFor(owner, target) {
+  switch (owner.kind) {
+    case "cli":
+      return `switchroom update  (self-updates the host CLI to ${target} first, then everything else)`;
+    case "web":
+      return `switchroom webd install --tag ${target}  (separate compose project \u2014 regenerates + recreates switchroom-web)`;
+    case "hostd":
+      return `switchroom hostd install --tag ${target}  (regenerates the hostd compose project \u2014 both hostd and the autoheal sidecar)`;
+    case "hindsight":
+      return `switchroom memory setup --recreate --tag ${target}  (standalone container \u2014 not a compose service)`;
+    case "fleet":
+      return owner.agent ? `switchroom rollout --pin ${target} --agents ${owner.agent}  (agent-fleet compose project)` : `switchroom rollout --pin ${target}  (agent-fleet compose project \u2014 the singletons self-heal on the first agent restart)`;
+  }
+}
+function gatedOwners(stepKinds, hostdContext) {
+  const kinds = new Set(stepKinds);
+  const owners = new Set(["fleet"]);
+  if (kinds.has("refresh-web"))
+    owners.add("web");
+  if (kinds.has("refresh-hindsight"))
+    owners.add("hindsight");
+  if (kinds.has("refresh-hostd") || hostdContext)
+    owners.add("hostd");
+  return owners;
+}
+function partitionDrift(behind, opts) {
+  const gated = [];
+  const exempt = [];
+  for (const c of behind) {
+    const owner = classifyComponent(c);
+    const inScope = owner.kind === "fleet" && owner.agent !== undefined ? opts.rolledAgents.has(owner.agent) : opts.owners.has(owner.kind);
+    (inScope ? gated : exempt).push(c);
+  }
+  return { gated, exempt };
+}
+
 // src/cli/doctor-component-versions.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 function fixFor(c, target) {
-  if (c.kind === "cli") {
-    return `switchroom update  (self-updates the host CLI to ${target} first, then everything else)`;
-  }
-  if (c.name === "switchroom-web") {
-    return `switchroom webd install --tag ${target}  (run host-side: webd install fails inside hostd when the hostd compose predates SWITCHROOM_HOSTD_OPERATOR_UID)`;
-  }
-  if (c.name === "switchroom-hindsight-autoheal" || c.name === "switchroom-hostd") {
-    return `switchroom hostd install --tag ${target}  (regenerates the hostd compose project \u2014 both hostd and the autoheal sidecar)`;
-  }
-  return `switchroom update`;
+  return remediationFor(classifyComponent(c), target);
 }
 function runComponentVersionChecks(config, opts = {}) {
   const exec = opts.exec ?? defaultExec2;
@@ -51064,7 +51514,7 @@ var init_doctor_component_versions = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join70, resolve as resolve43 } from "node:path";
+import { join as join71, resolve as resolve43 } from "node:path";
 function readJson2(d, path7) {
   if (!d.existsSync(path7))
     return { kind: "absent" };
@@ -51107,8 +51557,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join70(agentDir, ".mcp.json");
-    const claudeJsonPath = join70(agentDir, ".claude", ".claude.json");
+    const mcpPath = join71(agentDir, ".mcp.json");
+    const claudeJsonPath = join71(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -51172,14 +51622,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join71 } from "node:path";
-import { homedir as homedir37 } from "node:os";
+import { join as join72 } from "node:path";
+import { homedir as homedir38 } from "node:os";
 function resolveDeps3(deps) {
-  const home2 = deps.homeDir?.() ?? homedir37();
+  const home2 = deps.homeDir?.() ?? homedir38();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join71(home2, ".switchroom", "agents"),
+    agentsDir: join72(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -51269,7 +51719,7 @@ function heartbeatFileName(config, agentName, account) {
   return "m365-launcher.heartbeat.json";
 }
 function readHeartbeatFile(d, agentName, fileName) {
-  const path7 = join71(d.agentsDir, agentName, fileName);
+  const path7 = join72(d.agentsDir, agentName, fileName);
   if (!d.existsSync(path7)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -51375,15 +51825,15 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync2
 } from "node:fs";
-import { join as join72 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { join as join73 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 function resolveDeps4(deps) {
-  const home2 = deps.homeDir?.() ?? homedir38();
+  const home2 = deps.homeDir?.() ?? homedir39();
   return {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync2,
-    agentsDir: join72(home2, ".switchroom", "agents"),
+    agentsDir: join73(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -51508,7 +51958,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join72(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join73(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -51623,10 +52073,10 @@ import {
   readdirSync as realReaddirSync2,
   statSync as realStatSync3
 } from "node:fs";
-import { homedir as homedir39 } from "node:os";
-import { join as join73 } from "node:path";
+import { homedir as homedir40 } from "node:os";
+import { join as join74 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join73(homedir39(), ".switchroom", "credentials");
+  const credDir = deps.credentialsDir ?? join74(homedir40(), ".switchroom", "credentials");
   const existsSync73 = deps.existsSync ?? ((p) => realExistsSync5(p));
   const readdirSync26 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
@@ -51654,7 +52104,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join73(credDir, e);
+    const full = join74(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -51683,14 +52133,14 @@ var init_doctor_credentials_migration = () => {};
 
 // src/cli/doctor-agent-dotfile-ownership.ts
 import { existsSync as existsSync73, lstatSync as lstatSync10, statSync as statSync41 } from "node:fs";
-import { join as join74 } from "node:path";
+import { join as join75 } from "node:path";
 function agentDotfileCandidates(agentDir) {
   return [
-    join74(agentDir, ".claude", "settings.json"),
-    join74(agentDir, ".claude.json"),
-    join74(agentDir, ".claude", ".claude.json"),
-    join74(agentDir, ".mcp.json"),
-    join74(agentDir, ".claude-cron", ".mcp.json")
+    join75(agentDir, ".claude", "settings.json"),
+    join75(agentDir, ".claude.json"),
+    join75(agentDir, ".claude", ".claude.json"),
+    join75(agentDir, ".mcp.json"),
+    join75(agentDir, ".claude-cron", ".mcp.json")
   ];
 }
 function runAgentDotfileOwnershipChecks(config, deps = {}) {
@@ -51718,7 +52168,7 @@ function runAgentDotfileOwnershipChecks(config, deps = {}) {
     ];
   }
   for (const name of agents) {
-    const agentDir = join74(agentsDir, name);
+    const agentDir = join75(agentsDir, name);
     if (!exists(agentDir)) {
       continue;
     }
@@ -51846,7 +52296,7 @@ var init_doctor_inlined_secrets = __esm(() => {
 // src/cli/doctor-approval-attribution.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { join as join75 } from "node:path";
+import { join as join76 } from "node:path";
 function parseApproverSet(canonical) {
   try {
     const arr = JSON.parse(canonical);
@@ -51965,7 +52415,7 @@ function loadLiveAllowFromAccessFiles(agentNames, agentsDir, readFile2 = (p) =>
   let readAny = false;
   for (const name of agentNames) {
     try {
-      const raw = readFile2(join75(agentsDir, name, "telegram", "access.json"));
+      const raw = readFile2(join76(agentsDir, name, "telegram", "access.json"));
       const parsed = JSON.parse(raw);
       readAny = true;
       if (Array.isArray(parsed.allowFrom)) {
@@ -51998,13 +52448,13 @@ var init_doctor_approval_attribution = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync3 } from "node:fs";
-import { homedir as homedir40 } from "node:os";
-import { join as join76 } from "node:path";
+import { homedir as homedir41 } from "node:os";
+import { join as join77 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
     {
       label: "vault-broker",
-      path: join76(home2, ".switchroom", "vault-audit.log"),
+      path: join77(home2, ".switchroom", "vault-audit.log"),
       maxFiles: resolveRotationConfig({
         envBytesVar: "SWITCHROOM_VAULT_AUDIT_MAX_BYTES",
         envFilesVar: "SWITCHROOM_VAULT_AUDIT_MAX_FILES",
@@ -52014,7 +52464,7 @@ function rootWrittenLogs(home2) {
     },
     {
       label: "hostd",
-      path: join76(home2, ".switchroom", "host-control-audit.log"),
+      path: join77(home2, ".switchroom", "host-control-audit.log"),
       maxFiles: resolveRotationConfig({
         envBytesVar: "SWITCHROOM_HOSTD_AUDIT_MAX_BYTES",
         envFilesVar: "SWITCHROOM_HOSTD_AUDIT_MAX_FILES",
@@ -52046,11 +52496,11 @@ function readRetainedHistory(read, path7, maxFiles) {
   return { text, sources: parts.map((p) => p.path), unreadable };
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir40();
+  const home2 = deps.homeDir ?? homedir41();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync3(p, "utf8"));
   const readFailOpen = deps.readFailOpenState ?? readFailOpenState;
   const results = [];
-  const vaultAuditLog = join76(home2, ".switchroom", "vault-audit.log");
+  const vaultAuditLog = join77(home2, ".switchroom", "vault-audit.log");
   const failOpen = readFailOpen(failOpenStatePath(vaultAuditLog));
   if (failOpen.failOpenCount > 0) {
     const when = failOpen.lastFailureTs ? ` (last at ${failOpen.lastFailureTs})` : ``;
@@ -52133,14 +52583,14 @@ var init_doctor_audit_integrity = __esm(() => {
 
 // src/cli/doctor-agent-smoke.ts
 import { existsSync as existsSync74 } from "node:fs";
-import { homedir as homedir41 } from "node:os";
-import { join as join77 } from "node:path";
+import { homedir as homedir42 } from "node:os";
+import { join as join78 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir41();
-  const sock = deps.operatorSockPath ?? join77(home2, ".switchroom", "hostd", "operator", "sock");
+  const home2 = deps.homeDir ?? homedir42();
+  const sock = deps.operatorSockPath ?? join78(home2, ".switchroom", "hostd", "operator", "sock");
   if (!deps.hostdRequestImpl && !existsSync74(sock)) {
     return [
       {
@@ -52219,9 +52669,9 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { existsSync as existsSync75, statSync as statSync42, readFileSync as readFileSync69 } from "node:fs";
-import { homedir as homedir42 } from "node:os";
-import { join as join78 } from "node:path";
+import { existsSync as existsSync75, statSync as statSync42, readFileSync as readFileSync70 } from "node:fs";
+import { homedir as homedir43 } from "node:os";
+import { join as join79 } from "node:path";
 import { createRequire as createRequire2 } from "node:module";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
@@ -52365,13 +52815,13 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir42();
+  const home2 = homedir43();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join78(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join78(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join79(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join79(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
     formatBindMountResult("vault-broker: vault-grants dir bind mount (#1737 / #3289)", getGrantsDbDir(home2), GRANTS_DB_CONTAINER_DIR, probe2(getGrantsDbDir(home2), GRANTS_DB_CONTAINER_DIR)),
     probeGrantsWalDivergence(opts?.walStatBroker),
     probeOrphanVaultTokens(_config, {
@@ -52380,14 +52830,14 @@ function runVaultBrokerDurabilityChecks(_config, opts) {
       readTokenId: opts?.readTokenId,
       tokenMtimeMs: opts?.tokenMtimeMs
     }),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join78(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join78(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join79(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join79(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join78(home2, ".switchroom", "approvals");
+  const hostDir = join79(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -52520,7 +52970,7 @@ function probeGrantsWalDivergence(statBroker = defaultWalStatBroker, opts) {
 }
 function probeOrphanVaultTokens(config, opts) {
   const name = "vault-broker: no orphan .vault-token grants (#1737 / #3289)";
-  const home2 = opts?.home ?? homedir42();
+  const home2 = opts?.home ?? homedir43();
   const agents = Object.keys(config.agents ?? {});
   const readTokenId = opts?.readTokenId ?? defaultReadTokenId;
   const grantIdExists = opts?.grantIdExists ?? defaultGrantIdExists;
@@ -52585,15 +53035,15 @@ function probeOrphanVaultTokens(config, opts) {
 }
 function defaultTokenMtimeMs(agent, home2) {
   try {
-    return statSync42(join78(home2, ".switchroom", "agents", agent, ".vault-token")).mtimeMs;
+    return statSync42(join79(home2, ".switchroom", "agents", agent, ".vault-token")).mtimeMs;
   } catch {
     return null;
   }
 }
 function defaultReadTokenId(agent, home2) {
-  const tokenPath = join78(home2, ".switchroom", "agents", agent, ".vault-token");
+  const tokenPath = join79(home2, ".switchroom", "agents", agent, ".vault-token");
   try {
-    const raw = readFileSync69(tokenPath, "utf8").trim();
+    const raw = readFileSync70(tokenPath, "utf8").trim();
     if (!raw)
       return null;
     const dot = raw.indexOf(".");
@@ -52624,7 +53074,7 @@ function defaultGrantIdExists(id) {
   }
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join78(home2, ".switchroom", "vault-auto-unlock");
+  const blobPath = join79(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync75(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -52754,7 +53204,7 @@ var init_doctor_timezone = __esm(() => {
 });
 
 // src/cli/doctor-fix-session-model.ts
-import { join as join79 } from "node:path";
+import { join as join80 } from "node:path";
 function describeReconcileChanges(changes) {
   if (changes.length === 0)
     return "Reconcile rewrote no other files.";
@@ -52767,7 +53217,7 @@ function fixSessionModelCarrierDrift(config, deps) {
   const agentsDir = resolveAgentsDir(config);
   const results = [];
   for (const name of Object.keys(config.agents ?? {})) {
-    const startShPath = join79(agentsDir, name, "start.sh");
+    const startShPath = join80(agentsDir, name, "start.sh");
     const label = `${name}: start.sh /model session carrier (--fix)`;
     const pre = deps.check(name, startShPath);
     if (pre.status === "ok") {
@@ -52818,8 +53268,8 @@ var init_doctor_fix_session_model = __esm(() => {
 
 // src/cli/doctor-claude-cli.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { existsSync as existsSync76, readFileSync as readFileSync70 } from "node:fs";
-import { dirname as dirname30, join as join80 } from "node:path";
+import { existsSync as existsSync76, readFileSync as readFileSync71 } from "node:fs";
+import { dirname as dirname30, join as join81 } from "node:path";
 function parseClaudeCliVersion(raw) {
   const m = raw.trim().match(/^v?(\d+)\.(\d+)\.(\d+)/);
   if (!m)
@@ -52842,7 +53292,7 @@ function claudeCliMeetsFloor(raw, floor) {
 function locateRepoFile(relative4) {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join80(dir, relative4);
+    const candidate = join81(dir, relative4);
     if (existsSync76(candidate))
       return candidate;
     dir = dirname30(dir);
@@ -52850,12 +53300,12 @@ function locateRepoFile(relative4) {
   return null;
 }
 function readPinnedClaudeCliVersion(dockerfilePath) {
-  const path7 = dockerfilePath === undefined ? locateRepoFile(join80("docker", "Dockerfile.base")) : dockerfilePath;
+  const path7 = dockerfilePath === undefined ? locateRepoFile(join81("docker", "Dockerfile.base")) : dockerfilePath;
   if (!path7)
     return null;
   let text;
   try {
-    text = readFileSync70(path7, "utf-8");
+    text = readFileSync71(path7, "utf-8");
   } catch {
     return null;
   }
@@ -53013,34 +53463,34 @@ import {
   existsSync as existsSync77,
   lstatSync as lstatSync11,
   mkdirSync as mkdirSync42,
-  readFileSync as readFileSync71,
+  readFileSync as readFileSync72,
   readdirSync as readdirSync26,
   statSync as statSync43
 } from "node:fs";
-import { dirname as dirname31, join as join81, resolve as resolve44 } from "node:path";
+import { dirname as dirname31, join as join82, resolve as resolve44 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function readLitellmConfigText() {
   const candidates = [
     process.env.LITELLM_CONFIG_PATH,
     "/data/coolify/services/litellm/litellm-config.yaml",
-    join81(process.cwd(), "docker", "litellm-proxy", "litellm-config.yaml")
+    join82(process.cwd(), "docker", "litellm-proxy", "litellm-config.yaml")
   ].filter((p) => typeof p === "string" && p.length > 0);
   for (const p of candidates) {
     try {
       if (existsSync77(p))
-        return readFileSync71(p, "utf-8");
+        return readFileSync72(p, "utf-8");
     } catch {}
   }
   return null;
 }
 function findInNvm(bin) {
-  const nvmRoot = join81(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join82(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync77(nvmRoot))
     return null;
   try {
     const versions = readdirSync26(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join81(nvmRoot, v, "bin", bin);
+      const candidate = join82(nvmRoot, v, "bin", bin);
       try {
         const s = statSync43(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -53067,7 +53517,7 @@ function whichOnPath(bin) {
   for (const dir of pathEnv.split(":")) {
     if (!dir)
       continue;
-    const candidate = join81(dir, bin);
+    const candidate = join82(dir, bin);
     if (isX(candidate))
       return candidate;
   }
@@ -53233,7 +53683,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join81(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join82(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync77(cacheDir))
       continue;
@@ -53241,10 +53691,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync26(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join81(cacheDir, entry, "chrome-linux64", "chrome"),
-          join81(cacheDir, entry, "chrome-linux", "chrome"),
-          join81(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join81(cacheDir, entry, "chrome-linux", "headless_shell")
+          join82(cacheDir, entry, "chrome-linux64", "chrome"),
+          join82(cacheDir, entry, "chrome-linux", "chrome"),
+          join82(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join82(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path7 of candidates2) {
           if (existsSync77(path7))
@@ -53376,7 +53826,7 @@ function checkDeployMounts(opts) {
   const home2 = opts?.home ?? process.env.HOME ?? "/root";
   const { pathKind } = opts?.deps ?? DEFAULT_DEPLOY_MOUNTS_DEPS;
   const results = [];
-  const dockerComposePlugin = join81(home2, ".docker", "cli-plugins", "docker-compose");
+  const dockerComposePlugin = join82(home2, ".docker", "cli-plugins", "docker-compose");
   const pluginKind = pathKind(dockerComposePlugin);
   if (pluginKind === "dir") {
     results.push({
@@ -53414,7 +53864,7 @@ function checkDeployMounts(opts) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join81(h, LEGACY_STATE_DIR);
+  const clerkDir = join82(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync77(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -53424,7 +53874,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join81(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join82(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync11(legacySock);
@@ -53914,6 +54364,7 @@ async function checkHindsight(config) {
   results.push(await checkHindsightHealthEndpoint(url));
   results.push(...await checkBankIngestHealth(config, url, { includeConsolidationBacklog: true }));
   results.push(...await checkBankObservationsMissions(config, url));
+  results.push(await checkObservationScopeSaturation(config, url));
   const memoryAgentsDir = resolveAgentsDir(config);
   for (const agentName of Object.keys(config.agents)) {
     results.push(checkAgentRecallHealth(agentName, resolve44(memoryAgentsDir, agentName)));
@@ -54092,7 +54543,7 @@ function classifyReadError(err) {
 }
 function tryReadHostFile(path7) {
   try {
-    return { kind: "ok", content: readFileSync71(path7, "utf-8") };
+    return { kind: "ok", content: readFileSync72(path7, "utf-8") };
   } catch (err) {
     const kind = classifyReadError(err);
     const error = err?.message ?? String(err);
@@ -54108,7 +54559,7 @@ function parseEnvFile(path7) {
     return {};
   let content;
   try {
-    content = readFileSync71(path7, "utf-8");
+    content = readFileSync72(path7, "utf-8");
   } catch {
     return {};
   }
@@ -54163,7 +54614,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join81(agentsDir, name, "telegram", ".env");
+    const envPath = join82(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -54225,7 +54676,7 @@ function checkStartShStale(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync71(startShPath, "utf-8");
+    content = readFileSync72(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -54256,7 +54707,7 @@ function checkStartShSessionModelCarrier(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync71(startShPath, "utf-8");
+    content = readFileSync72(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -54293,7 +54744,7 @@ function checkStartShSessionModelCarrier(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path7 = join81(agentDir, "home", ".switchroom");
+  const path7 = join82(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync11(path7);
@@ -54330,7 +54781,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join81(repoRoot, "clerk-export");
+  const exportDir = join82(repoRoot, "clerk-export");
   if (existsSync77(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -54339,7 +54790,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join81(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join82(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync77(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -54357,7 +54808,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join81(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join82(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -54380,12 +54831,12 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync77(join81(dir, ".git")))
+    if (!existsSync77(join82(dir, ".git")))
       return false;
-    const pkgPath = join81(dir, "package.json");
+    const pkgPath = join82(dir, "package.json");
     if (!existsSync77(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync71(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync72(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
   } catch {
     return false;
@@ -54419,8 +54870,8 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join81(agentDir, "start.sh")));
-    results.push(checkStartShSessionModelCarrier(name, join81(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join82(agentDir, "start.sh")));
+    results.push(checkStartShSessionModelCarrier(name, join82(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -54497,7 +54948,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join81(agentDir, ".mcp.json");
+      const mcpJsonPath = join82(agentDir, ".mcp.json");
       if (!existsSync77(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -54507,7 +54958,7 @@ function checkAgents(config, configPath) {
         });
       } else {
         try {
-          const mcp = JSON.parse(readFileSync71(mcpJsonPath, "utf-8"));
+          const mcp = JSON.parse(readFileSync72(mcpJsonPath, "utf-8"));
           const hasSwitchroomTelegram = !!mcp.mcpServers?.["switchroom-telegram"];
           const memoryEnabled = isHindsightEnabled(config);
           const hasHindsight = !!mcp.mcpServers?.hindsight;
@@ -54799,7 +55250,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname31(envPath);
-  const authScript = join81(credDir, "claude-auth.py");
+  const authScript = join82(credDir, "claude-auth.py");
   if (!existsSync77(authScript)) {
     return {
       name: "mff: auth flow",
@@ -55002,11 +55453,11 @@ function runDockerSection(config) {
   let composeYaml;
   let dockerfileAgent;
   try {
-    composeYaml = readFileSync71(composePath, "utf8");
+    composeYaml = readFileSync72(composePath, "utf8");
   } catch {}
   const dockerfilePath = resolve44(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
-    dockerfileAgent = readFileSync71(dockerfilePath, "utf8");
+    dockerfileAgent = readFileSync72(dockerfilePath, "utf8");
   } catch {}
   return runDockerChecks({
     config,
@@ -55152,6 +55603,10 @@ function registerDoctorCommand(program3) {
           }
         })
       },
+      {
+        title: "LiteLLM boot routing",
+        results: runRoutingModeChecks(config)
+      },
       { title: "Telegram", results: await checkTelegram(config) },
       {
         title: "Telegram flood pressure (429)",
@@ -55331,8 +55786,10 @@ var init_doctor = __esm(() => {
   init_doctor_memory();
   init_doctor_recall_health();
   init_doctor_hnsw_index();
+  init_doctor_observation_scopes();
   init_doctor_hindsight_watch();
   init_key_allowlist_check();
+  init_doctor_routing_mode();
   init_resolver();
   init_doctor_docker();
   init_doctor_auth_broker();
@@ -69302,7 +69759,7 @@ var init_server4 = __esm(() => {
     },
     {
       name: "rollout",
-      description: "SAFELY roll the fleet to a pinned SEMVER version, staggered and " + "canary-gated (#2487). Unlike update_apply (a blunt all-at-once " + "recreate), this restarts agents one at a time canary-first, asserts " + "each agent's in-container `switchroom --version` matches the target, " + "and STOPS on the first mismatch \u2014 so a bad build fails on the canary " + "before touching the rest of the fleet. The durable release.pin is " + "persisted only AFTER the canary confirms (a failed canary never " + "strands a bad pin). `pin` MUST be a tagged semver (vX.Y.Z) \u2014 sha " + "pins are rejected because the version assert needs a semver to " + "compare against. When the target pin is NEWER than hostd's own CLI " + "(every freshly tagged release), hostd SELF-BUMPS first (#2645): its " + "container restarts on the target image (~30-60s blip on this MCP " + "socket), then the roll resumes AUTOMATICALLY under the SAME " + "request_id \u2014 do NOT re-issue the rollout during the blip; poll " + "get_status (pass the returned request_id as its `request_id` " + "argument) once the socket is back. " + "The web + hindsight singletons are refreshed in-plan on this path " + "(only the hostd template regen + host operator CLI stay host-side; " + "the terminal warnings name exactly what is still on the prior " + "version and the commands to finish). By default downgrade pins " + "are rejected \u2014 pass `allow_downgrade: true` for the operator-approved " + "rollback path to a known-good earlier tag; all other safety rails " + "(canary order, version-assert, stop-on-mismatch) apply unchanged. " + "Admin-only at the wire layer AND deliberately NOT pre-approved \u2014 every " + "call surfaces a Telegram approval card for the operator to tap. " + "ALWAYS pass a one-line `reason` explaining why you're rolling the " + "fleet to this pin; it renders on the card's `why:` line so the " + "operator can decide in context. " + "Returns `started`; poll get_status with `request_id` for the " + "structured outcome (which agents rolled / where it stopped).",
+      description: "SAFELY roll the fleet to a pinned SEMVER version, staggered and " + "canary-gated (#2487). Unlike update_apply (a blunt all-at-once " + "recreate), this restarts agents one at a time canary-first, asserts " + "each agent's in-container `switchroom --version` matches the target, " + "and STOPS on the first mismatch \u2014 so a bad build fails on the canary " + "before touching the rest of the fleet. The durable release.pin is " + "persisted only AFTER the canary confirms (a failed canary never " + "strands a bad pin). `pin` MUST be a tagged semver (vX.Y.Z) \u2014 sha " + "pins are rejected because the version assert needs a semver to " + "compare against. When the target pin is NEWER than hostd's own CLI " + "(every freshly tagged release), hostd SELF-BUMPS first (#2645): its " + "container restarts on the target image (~30-60s blip on this MCP " + "socket), then the roll resumes AUTOMATICALLY under the SAME " + "request_id \u2014 do NOT re-issue the rollout during the blip; poll " + "get_status (pass the returned request_id as its `request_id` " + "argument) once the socket is back. " + "The web + hindsight singletons are refreshed in-plan on this path " + "(only the hostd template regen + host operator CLI stay host-side; " + "the terminal warnings name exactly what is still on the prior " + "version and the commands to finish). The roll ENDS by re-reading " + "the same component inventory `update --check` uses and FAILS if " + "any in-scope component is still behind the target (#3928), so a " + "`completed` result means the host actually converged \u2014 never just " + "the agents. On that failure get_status returns " + '`failedStep: "verify-components"` plus `drifted[]`. By default downgrade pins ' + "are rejected \u2014 pass `allow_downgrade: true` for the operator-approved " + "rollback path to a known-good earlier tag; all other safety rails " + "(canary order, version-assert, stop-on-mismatch) apply unchanged. " + "Admin-only at the wire layer AND deliberately NOT pre-approved \u2014 every " + "call surfaces a Telegram approval card for the operator to tap. " + "ALWAYS pass a one-line `reason` explaining why you're rolling the " + "fleet to this pin; it renders on the card's `why:` line so the " + "operator can decide in context. " + "Returns `started`; poll get_status with `request_id` for the " + "structured outcome (which agents rolled / where it stopped).",
       inputSchema: {
         type: "object",
         required: ["pin"],
@@ -69362,7 +69819,7 @@ var init_server4 = __esm(() => {
     },
     {
       name: "get_status",
-      description: "Look up the status of a prior async fleet mutation. With " + "`request_id` (the id echoed by rollout / update_apply / " + "agent_restart etc.), asks the host-control daemon for that " + "specific request's live status \u2014 for an in-flight `rollout` " + "this is the ONLY way to see progress: the response payload " + "carries the current phase, n/m counters, rolled[] agents, " + "failedStep/failedAgent and pin, and it keeps working across a " + "hostd self-bump/restart via the durable audit-log fallback. " + "This is the tool the `rollout` description tells you to poll " + "with the returned request_id. Without `request_id`, falls back " + "to reading the most recent terminal `update_apply` audit row " + "(channel, pin, resolved_sha, install_context, result, " + "exit_code, stderr_tail) \u2014 use that no-arg form only to report " + "the last blunt update on demand; it CANNOT see rollouts or " + "in-flight work. Read-only; returns JSON.",
+      description: "Look up the status of a prior async fleet mutation. With " + "`request_id` (the id echoed by rollout / update_apply / " + "agent_restart etc.), asks the host-control daemon for that " + "specific request's live status \u2014 for an in-flight `rollout` " + "this is the ONLY way to see progress: the response payload " + "carries the current phase, n/m counters, rolled[] agents, " + "failedStep/failedAgent and pin, and it keeps working across a " + "hostd self-bump/restart via the durable audit-log fallback. " + "When `failedStep` is `verify-components` the payload also " + "carries `drifted[]` \u2014 the components that are STILL behind the " + "target after the roll. Report those names verbatim: re-running " + "the roll will not fix them, the named component's own install " + "must be run. " + "This is the tool the `rollout` description tells you to poll " + "with the returned request_id. Without `request_id`, falls back " + "to reading the most recent terminal `update_apply` audit row " + "(channel, pin, resolved_sha, install_context, result, " + "exit_code, stderr_tail) \u2014 use that no-arg form only to report " + "the last blunt update on demand; it CANNOT see rollouts or " + "in-flight work. Read-only; returns JSON.",
       inputSchema: {
         type: "object",
         properties: {
@@ -69900,7 +70357,7 @@ var init_header_passthrough_guard = __esm(() => {
 });
 
 // src/fleet-health/litellm-config-sensor.ts
-import { readFileSync as readFileSync96, existsSync as existsSync109 } from "node:fs";
+import { readFileSync as readFileSync97, existsSync as existsSync109 } from "node:fs";
 function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitellmConfigPath()) {
   if (explicit)
     return explicit;
@@ -69912,7 +70369,7 @@ function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitel
 function scanLitellmConfig(opts = {}) {
   const path10 = resolveLitellmConfigPath(opts.path, opts.discoverFn);
   const exists = opts.existsFn ?? existsSync109;
-  const read = opts.readFn ?? ((p) => readFileSync96(p, "utf-8"));
+  const read = opts.readFn ?? ((p) => readFileSync97(p, "utf-8"));
   const log = opts.log ?? (() => {});
   const nowIso = opts.nowIso ?? new Date().toISOString();
   if (path10 === null) {
@@ -69987,15 +70444,15 @@ __export(exports_scan, {
   ledgerPathForBase: () => ledgerPathForBase
 });
 import {
-  readFileSync as readFileSync97,
+  readFileSync as readFileSync98,
   readdirSync as readdirSync42,
   existsSync as existsSync110,
   mkdirSync as mkdirSync63,
   writeFileSync as writeFileSync46
 } from "node:fs";
 import { resolve as resolve61, dirname as dirname42 } from "node:path";
-import { homedir as homedir60 } from "node:os";
-function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir60()) {
+import { homedir as homedir61 } from "node:os";
+function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir61()) {
   return resolve61(home2, ".switchroom");
 }
 function listAgents(base) {
@@ -70030,7 +70487,7 @@ function runScan(opts = {}) {
     let sawArtifact = false;
     try {
       if (existsSync110(turnsPath)) {
-        turnsText = readFileSync97(turnsPath, "utf-8");
+        turnsText = readFileSync98(turnsPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -70038,7 +70495,7 @@ function runScan(opts = {}) {
     }
     try {
       if (existsSync110(gwPath)) {
-        gwText = readFileSync97(gwPath, "utf-8");
+        gwText = readFileSync98(gwPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -70082,7 +70539,7 @@ function readLedgerIfPresent(base) {
   try {
     if (!existsSync110(path10))
       return null;
-    return JSON.parse(readFileSync97(path10, "utf-8"));
+    return JSON.parse(readFileSync98(path10, "utf-8"));
   } catch {
     return null;
   }
@@ -70114,7 +70571,7 @@ init_esm();
 init_source();
 import { join as join24, resolve as resolve23 } from "node:path";
 import { rmSync as rmSync10, existsSync as existsSync33, readFileSync as readFileSync26, statSync as statSync18 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 
 // src/agents/scheduler-state.ts
 import { closeSync, openSync, readSync, statSync } from "node:fs";
@@ -70459,6 +70916,7 @@ import { join as join19 } from "node:path";
 import { execFileSync as execFileSync11 } from "node:child_process";
 
 // src/agents/handoff-summarizer.ts
+init_atomic();
 init_observation_scopes();
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync9, renameSync as renameSync7, mkdirSync as mkdirSync16, existsSync as existsSync23, statSync as statSync11, readdirSync as readdirSync10 } from "node:fs";
 import { join as join18 } from "node:path";
@@ -70603,8 +71061,13 @@ function writeSidecarsAtomic(agentDir, briefing, topic) {
   const topicTmp = topicPath + ".tmp";
   writeFileSync9(handoffTmp, briefing, "utf-8");
   writeFileSync9(topicTmp, topic, "utf-8");
+  fsyncPathSync(handoffTmp);
+  fsyncPathSync(topicTmp);
   renameSync7(handoffTmp, handoffPath);
   renameSync7(topicTmp, topicPath);
+  try {
+    fsyncPathSync(agentDir);
+  } catch {}
 }
 async function buildHandoff(opts) {
   const maxTurns = opts.maxTurns ?? DEFAULT_MAX_TURNS;
@@ -72840,7 +73303,7 @@ function registerAgentCommand(program3) {
       }
       return;
     }
-    const logsDir = join24(homedir9(), ".switchroom", "logs");
+    const logsDir = join24(homedir10(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     if (opts.json) {
       const data = agentNames.map((name) => {
@@ -73909,7 +74372,7 @@ init_source();
 init_lifecycle();
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir12 } from "node:os";
 import { join as join26 } from "node:path";
 init_helpers();
 init_broker_call();
@@ -73982,7 +74445,7 @@ function registerStatusCommand(program3) {
     const config = getConfig(program3);
     const agentNames = Object.keys(config.agents ?? {}).sort();
     const statuses = getAllAgentStatuses(config);
-    const logsDir = join26(homedir11(), ".switchroom", "logs");
+    const logsDir = join26(homedir12(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     const accountsP = fetchAccounts();
     const mcpEnabled = opts.mcp !== false;
@@ -76423,12 +76886,12 @@ function loadCredentialsFromGlobalAccount(label) {
   };
 }
 async function loadCredentialsViaClaude(label) {
-  const [{ runViaClaude: runViaClaude2 }, { homedir: homedir14 }, { default: readline }] = await Promise.all([
+  const [{ runViaClaude: runViaClaude2 }, { homedir: homedir15 }, { default: readline }] = await Promise.all([
     Promise.resolve().then(() => (init_via_claude(), exports_via_claude)),
     import("node:os"),
     import("node:readline")
   ]);
-  const configDir = join30(homedir14(), ".switchroom", "accounts", label);
+  const configDir = join30(homedir15(), ".switchroom", "accounts", label);
   const result = await runViaClaude2({
     configDir,
     promptForCode: async (_url) => {
@@ -76695,7 +77158,7 @@ init_hindsight2();
 import { readFileSync as readFileSync32, writeFileSync as writeFileSync13, copyFileSync as copyFileSync6, existsSync as existsSync38, readdirSync as readdirSync17, statSync as statSync23 } from "node:fs";
 import { execFileSync as execFileSync17 } from "node:child_process";
 import { join as join31 } from "node:path";
-import { homedir as homedir14 } from "node:os";
+import { homedir as homedir15 } from "node:os";
 function getVaultPath2(configPath) {
   try {
     const config = loadConfig(configPath);
@@ -76710,7 +77173,7 @@ function maskToken(s) {
   return "***";
 }
 function findClaudeTranscripts() {
-  const root = join31(homedir14(), ".claude", "projects");
+  const root = join31(homedir15(), ".claude", "projects");
   if (!existsSync38(root))
     return [];
   const out = [];
@@ -76742,7 +77205,7 @@ function findClaudeTranscripts() {
 function findTelegramHistoryDb() {
   const candidates = [
     process.env.TELEGRAM_STATE_DIR ? join31(process.env.TELEGRAM_STATE_DIR, "history.db") : null,
-    join31(homedir14(), ".claude", "channels", "telegram", "history.db")
+    join31(homedir15(), ".claude", "channels", "telegram", "history.db")
   ].filter(Boolean);
   for (const c of candidates) {
     if (existsSync38(c))
@@ -81361,7 +81824,7 @@ init_auto_unlock();
 var import_yaml11 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { readFileSync as readFileSync39, statSync as statSync28 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
+import { homedir as homedir19 } from "node:os";
 import { join as join40 } from "node:path";
 
 class EncryptFailedError extends Error {
@@ -81400,7 +81863,7 @@ function setVaultBrokerAutoUnlock(configPath, value) {
   } catch {}
   writeConfigFileSync(configPath, doc.toString(), mode);
 }
-var DEFAULT_COMPOSE_FILE = join40(homedir18(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_FILE = join40(homedir19(), ".switchroom", "compose", "docker-compose.yml");
 async function applyAutoUnlock(opts = {}) {
   const log = opts.log ?? ((s) => console.log(s));
   const err = opts.err ?? ((s) => console.error(s));
@@ -82121,7 +82584,7 @@ init_loader();
 init_loader();
 init_client();
 import { join as join41 } from "node:path";
-import { homedir as homedir19 } from "node:os";
+import { homedir as homedir20 } from "node:os";
 function parseDuration(raw) {
   const lower = raw.toLowerCase().trim();
   if (lower === "0" || lower === "never" || lower === "none")
@@ -82213,7 +82676,7 @@ function registerVaultGrantCommands(vault, program3) {
       console.error(source_default.red(`Failed to mint grant: ${result.msg}`));
       process.exit(1);
     }
-    const tokenPath = join41(homedir19(), ".switchroom", "agents", agent, ".vault-token");
+    const tokenPath = join41(homedir20(), ".switchroom", "agents", agent, ".vault-token");
     console.log(source_default.green(`\u2713 Grant minted`));
     if (process.stdout.isTTY) {
       console.log(source_default.bold("Token: ") + result.token);
@@ -82287,7 +82750,7 @@ import {
   unlinkSync as unlinkSync12,
   writeSync as writeSync7
 } from "node:fs";
-import { homedir as homedir20 } from "node:os";
+import { homedir as homedir21 } from "node:os";
 import { join as join42, resolve as resolvePath2 } from "node:path";
 var LATEST_SYMLINK = "vault.enc.latest.bak";
 var MANIFEST_FILE = "manifest.jsonl";
@@ -82486,7 +82949,7 @@ function backupVault(opts) {
   };
 }
 function defaultHome() {
-  return process.env.HOME ?? homedir20();
+  return process.env.HOME ?? homedir21();
 }
 
 // src/cli/vault-backup.ts
@@ -84957,7 +85420,7 @@ Demoting memory ${source_default.cyan(memoryId)}`));
 // src/cli/web.ts
 init_source();
 import { join as join56 } from "node:path";
-import { homedir as homedir29 } from "node:os";
+import { homedir as homedir30 } from "node:os";
 
 // src/web/server.ts
 init_merge();
@@ -84974,7 +85437,7 @@ import {
   constants as fsConstants3
 } from "node:fs";
 import { resolve as resolve34, extname, join as join55, relative as relative3, dirname as dirname18 } from "node:path";
-import { homedir as homedir28 } from "node:os";
+import { homedir as homedir29 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
 // src/web/api.ts
@@ -85053,8 +85516,8 @@ init_hindsight();
 // src/web/blocked-approvals-read.ts
 import { readFileSync as readFileSync47, readdirSync as readdirSync21 } from "node:fs";
 import { resolve as resolve30, join as join46 } from "node:path";
-import { homedir as homedir21 } from "node:os";
-function blockedApprovalsDir(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir21()) {
+import { homedir as homedir22 } from "node:os";
+function blockedApprovalsDir(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir22()) {
   return resolve30(home2, ".switchroom", "blocked-approvals");
 }
 var FALLBACK_RECORD_NAME = "blocked-approval.json";
@@ -85256,7 +85719,7 @@ init_client();
 init_posthog();
 init_loader();
 init_merge();
-import { homedir as homedir24 } from "node:os";
+import { homedir as homedir25 } from "node:os";
 
 // src/web/config-edit-plan.ts
 init_schema();
@@ -85351,7 +85814,7 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
 // src/web/hostd-config-propose.ts
 init_client5();
 import { existsSync as existsSync53 } from "node:fs";
-import { homedir as homedir23 } from "node:os";
+import { homedir as homedir24 } from "node:os";
 import { join as join49 } from "node:path";
 var PROPOSE_TIMEOUT_MS = 61 * 60 * 1000;
 function resolveHostdOperatorSocket(env2 = process.env) {
@@ -85360,7 +85823,7 @@ function resolveHostdOperatorSocket(env2 = process.env) {
     return override;
   const candidates = [
     "/host-home/.switchroom/hostd/operator/sock",
-    join49(homedir23(), ".switchroom", "hostd", "operator", "sock")
+    join49(homedir24(), ".switchroom", "hostd", "operator", "sock")
   ];
   for (const c of candidates) {
     if (existsSync53(c))
@@ -85628,7 +86091,7 @@ var PHASE4_MIGRATIONS = [
 ];
 function applySchema(db) {
   db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA synchronous = NORMAL");
+  db.exec("PRAGMA synchronous = FULL");
   db.exec("PRAGMA busy_timeout = 5000");
   db.exec(SCHEMA_SQL);
   for (const sql of [...PHASE1_MIGRATIONS, ...PHASE2_MIGRATIONS, ...PHASE3_MIGRATIONS, ...PHASE4_MIGRATIONS]) {
@@ -86613,10 +87076,10 @@ async function handleGetApprovals() {
   const sorted = [...decisions].sort((a, b) => b.granted_at - a.granted_at);
   return { reachable: true, decisions: sorted };
 }
-function brokerOperatorSocketPath(home2 = process.env.HOME || homedir24()) {
+function brokerOperatorSocketPath(home2 = process.env.HOME || homedir25()) {
   return join51(home2, ".switchroom", "broker-operator", "sock");
 }
-function resolveBrokerOperatorSocket(home2 = process.env.HOME || homedir24()) {
+function resolveBrokerOperatorSocket(home2 = process.env.HOME || homedir25()) {
   const p = brokerOperatorSocketPath(home2);
   return existsSync54(p) ? p : null;
 }
@@ -87011,7 +87474,7 @@ init_fleet_health_read();
 // src/web/webhook-handler.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync56, mkdirSync as mkdirSync31, readFileSync as readFileSync53, writeFileSync as writeFileSync20 } from "fs";
 import { join as join53 } from "path";
-import { homedir as homedir27 } from "os";
+import { homedir as homedir28 } from "os";
 
 // src/web/webhook-verify.ts
 import { createHmac as createHmac2, timingSafeEqual } from "crypto";
@@ -87221,11 +87684,11 @@ function forwardToGateway(socketPath, req, opts = {}) {
 // src/web/webhook-edge.ts
 import { existsSync as existsSync55, readFileSync as readFileSync52 } from "fs";
 import { join as join52 } from "path";
-import { homedir as homedir26 } from "os";
+import { homedir as homedir27 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join52(homedir26(), ".switchroom", "webhook-edge-secret");
+  return join52(homedir27(), ".switchroom", "webhook-edge-secret");
 }
 function loadEdgeSecret(path6) {
   const p = path6 ?? edgeSecretPath();
@@ -87385,7 +87848,7 @@ function writeThrottleIssue(agent, source, now, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join53(homedir27(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join53(homedir28(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   if (!args.agentExists) {
@@ -88450,7 +88913,7 @@ function resolveWebToken() {
   const fromEnv = process.env.SWITCHROOM_WEB_TOKEN;
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
-  const home2 = process.env.HOME ?? homedir28();
+  const home2 = process.env.HOME ?? homedir29();
   const tokenPath = join55(home2, ".switchroom", "web-token");
   if (existsSync58(tokenPath)) {
     const existing = readFileSync55(tokenPath, "utf8").trim();
@@ -88543,7 +89006,7 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path6 = join55(homedir28(), ".switchroom", "webhook-secrets.json");
+  const path6 = join55(homedir29(), ".switchroom", "webhook-secrets.json");
   if (!existsSync58(path6))
     return {};
   try {
@@ -89251,7 +89714,7 @@ async function handleWebStartupFailure(err, configPath, stateFile) {
   throw err;
 }
 function webCrashStatePath() {
-  return join56(homedir29(), ".switchroom", "web", ".crashloop-state.json");
+  return join56(homedir30(), ".switchroom", "web", ".crashloop-state.json");
 }
 function registerWebCommand(program3) {
   program3.command("web").description("Start the web dashboard for monitoring agents").option("-p, --port <port>", "Port to listen on", "8080").option("-b, --bind <host>", "Host/IP to bind to (default: 127.0.0.1, localhost-only)", "127.0.0.1").action(withConfigError(async (opts) => {
@@ -90803,10 +91266,10 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync73, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
+import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync74, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
 import { spawnSync as spawnSync16 } from "node:child_process";
-import { join as join83, dirname as dirname33, resolve as resolve45 } from "node:path";
-import { homedir as homedir43 } from "node:os";
+import { join as join84, dirname as dirname33, resolve as resolve45 } from "node:path";
+import { homedir as homedir44 } from "node:os";
 
 // src/cli/release-yaml.ts
 var import_yaml19 = __toESM(require_dist(), 1);
@@ -90938,13 +91401,13 @@ import {
   cpSync as cpSync2,
   existsSync as existsSync78,
   mkdirSync as mkdirSync43,
-  readFileSync as readFileSync72,
+  readFileSync as readFileSync73,
   readdirSync as readdirSync27,
   renameSync as renameSync18,
   rmSync as rmSync13,
   writeFileSync as writeFileSync30
 } from "node:fs";
-import { join as join82 } from "node:path";
+import { join as join83 } from "node:path";
 var BUNDLED_SKILL_MANIFEST_NAME = ".switchroom-manifest.json";
 function listSkillDirs(dir) {
   if (!existsSync78(dir))
@@ -90952,11 +91415,11 @@ function listSkillDirs(dir) {
   return readdirSync27(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
 }
 function readBundledSkillManifest(poolDir) {
-  const path7 = join82(poolDir, BUNDLED_SKILL_MANIFEST_NAME);
+  const path7 = join83(poolDir, BUNDLED_SKILL_MANIFEST_NAME);
   if (!existsSync78(path7))
     return { firstRun: true };
   try {
-    const parsed = JSON.parse(readFileSync72(path7, "utf8"));
+    const parsed = JSON.parse(readFileSync73(path7, "utf8"));
     if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.skills) || !parsed.skills.every((s) => typeof s === "string")) {
       return { corrupt: true };
     }
@@ -90967,7 +91430,7 @@ function readBundledSkillManifest(poolDir) {
   }
 }
 function stageAndSwap(srcSkill, destSkill, poolDir, name) {
-  const staging = join82(poolDir, `.tmp-${name}-${process.pid}-${Date.now()}`);
+  const staging = join83(poolDir, `.tmp-${name}-${process.pid}-${Date.now()}`);
   try {
     rmSync13(staging, { recursive: true, force: true });
     cpSync2(srcSkill, staging, { recursive: true, dereference: false });
@@ -90996,11 +91459,11 @@ function syncBundledSkills(opts) {
   const shipped = listSkillDirs(source).sort();
   const shippedSet = new Set(shipped);
   for (const name of shipped) {
-    const destSkill = join82(dest, name);
+    const destSkill = join83(dest, name);
     const existed = existsSync78(destSkill);
     let transferred = false;
     if (existed && !priorSkills.has(name) && !result.firstRun) {
-      const backup = join82(dest, `${name}.operator-backup-${process.pid}-${Date.now()}`);
+      const backup = join83(dest, `${name}.operator-backup-${process.pid}-${Date.now()}`);
       try {
         renameSync18(destSkill, backup);
         transferred = true;
@@ -91014,7 +91477,7 @@ function syncBundledSkills(opts) {
         continue;
       }
     }
-    stageAndSwap(join82(source, name), destSkill, dest, name);
+    stageAndSwap(join83(source, name), destSkill, dest, name);
     if (!transferred && (priorSkills.has(name) || existed))
       result.updated.push(name);
     else
@@ -91024,7 +91487,7 @@ function syncBundledSkills(opts) {
     for (const name of priorSkills) {
       if (shippedSet.has(name))
         continue;
-      const target = join82(dest, name);
+      const target = join83(dest, name);
       if (existsSync78(target)) {
         rmSync13(target, { recursive: true, force: true });
         result.removed.push(name);
@@ -91043,8 +91506,8 @@ function syncBundledSkills(opts) {
     skills: shipped,
     updatedAt: new Date().toISOString()
   };
-  const manifestPath = join82(dest, BUNDLED_SKILL_MANIFEST_NAME);
-  const manifestTmp = join82(dest, `${BUNDLED_SKILL_MANIFEST_NAME}.tmp-${process.pid}-${Date.now()}`);
+  const manifestPath = join83(dest, BUNDLED_SKILL_MANIFEST_NAME);
+  const manifestTmp = join83(dest, `${BUNDLED_SKILL_MANIFEST_NAME}.tmp-${process.pid}-${Date.now()}`);
   writeFileSync30(manifestTmp, JSON.stringify(manifest, null, 2) + `
 `, "utf8");
   renameSync18(manifestTmp, manifestPath);
@@ -91336,7 +91799,7 @@ init_component_versions();
 function defaultPersistPin(configPath) {
   return (pin) => {
     const path7 = configPath ?? findConfigFile();
-    const before = readFileSync73(path7, "utf8");
+    const before = readFileSync74(path7, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
@@ -91350,13 +91813,13 @@ function defaultPersistPin(configPath) {
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH2 = join83(homedir43(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join84(homedir44(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname33(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync80(join83(dir, ".git"))) {
+    if (existsSync80(join84(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync73(join83(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync74(join84(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -91622,7 +92085,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve45(import.meta.dirname, "../../skills");
-      const dest = join83(homedir43(), ".switchroom", "skills", "_bundled");
+      const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
       if (!existsSync80(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -91654,11 +92117,11 @@ function planUpdate(opts) {
     run: () => {
       if (opts.syncBundledSkillsFn)
         return;
-      const dest = join83(homedir43(), ".switchroom", "skills", "_bundled");
+      const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
       if (!existsSync80(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync80(join83(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync80(join84(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -91693,7 +92156,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync73(composePath, "utf8");
+        const composeText = readFileSync74(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -91772,10 +92235,10 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname33(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join83(dir, "package.json");
+        const pkgPath = join84(dir, "package.json");
         if (existsSync80(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync73(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync74(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -92044,22 +92507,22 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync18 } from "node:child_process";
-import { readFileSync as readFileSync75, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
-import { homedir as homedir45 } from "node:os";
+import { readFileSync as readFileSync76, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
+import { homedir as homedir46 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
   existsSync as existsSync81,
-  readFileSync as readFileSync74,
+  readFileSync as readFileSync75,
   writeFileSync as writeFileSync31,
   renameSync as renameSync20,
   unlinkSync as unlinkSync15,
   statSync as statSync46,
   mkdirSync as mkdirSync46
 } from "node:fs";
-import { homedir as homedir44 } from "node:os";
+import { homedir as homedir45 } from "node:os";
 import { createHash as createHash17 } from "node:crypto";
-import { join as join84, basename as basename9, resolve as resolve46, dirname as dirname34 } from "node:path";
+import { join as join85, basename as basename9, resolve as resolve46, dirname as dirname34 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -92072,12 +92535,12 @@ function pinJournalDir(configPath) {
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
-  return join84(homedir44(), STATE_DIR_NAME);
+  return join85(homedir45(), STATE_DIR_NAME);
 }
 function pinJournalPath(configPath) {
   const abs = resolve46(configPath);
   const key = createHash17("sha256").update(abs).digest("hex").slice(0, 12);
-  return join84(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
+  return join85(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -92111,7 +92574,7 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync74(p, "utf8");
+    raw = readFileSync75(p, "utf8");
   } catch (e) {
     if (existsSync81(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
@@ -92164,7 +92627,7 @@ function beginPinPersist(configPath, pin, opts = {}) {
     warn(`\u26a0\ufe0f  rollout pin journal: overwriting an ABANDONED journal at ${p} ` + `(pid ${existing.pid} recorded ${existing.at}, provisional pin ` + `${existing.pin}). Its roll never committed or reverted; \`release.pin\` ` + `in ${configPath} may still name that unproven build \u2014 verify it.
 `);
   }
-  const priorPin = getReleasePinFromConfig(readFileSync74(configPath, "utf8"));
+  const priorPin = getReleasePinFromConfig(readFileSync75(configPath, "utf8"));
   const journal = {
     v: 1,
     configPath,
@@ -92207,7 +92670,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync74(configPath, "utf8");
+    const current = readFileSync75(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
@@ -92306,6 +92769,8 @@ function checkDowngrade(opts) {
 
 // src/cli/rollout.ts
 init_agent_owned_tree();
+init_component_versions();
+var VERIFY_COMPONENTS_STEP = "verify-components";
 function normalizeVersion(v) {
   return v.trim().replace(/^v/, "");
 }
@@ -92339,6 +92804,7 @@ function planRollout(agents, opts = {}) {
     }
     steps.push({ kind: "refresh-hindsight" });
     steps.push({ kind: "sweep" });
+    steps.push({ kind: "verify-components" });
     return steps;
   }
   if (opts.pinToPersist)
@@ -92353,6 +92819,7 @@ function planRollout(agents, opts = {}) {
     steps.push({ kind: "refresh-hindsight" });
   }
   steps.push({ kind: "sweep" });
+  steps.push({ kind: "verify-components" });
   return steps;
 }
 function formatRolloutPlan(steps, target) {
@@ -92382,6 +92849,9 @@ function formatRolloutPlan(steps, target) {
       case "sweep":
         lines.push(`  ${n}. sweep \u2014 print per-agent version table`);
         break;
+      case "verify-components":
+        lines.push(`  ${n}. verify-components \u2014 assert EVERY in-scope component is on ${target} ` + `(same inventory \`switchroom update --check\` uses); non-zero exit if any is behind`);
+        break;
     }
   }
   lines.push("");
@@ -92429,9 +92899,17 @@ function encodeRolloutResultLine(result) {
     ...result.got !== undefined ? { got: result.got } : {},
     ...result.timedOut ? { timedOut: true } : {},
     ...result.pinReverted ? { pinReverted: true } : {},
+    ...result.drifted && result.drifted.length > 0 ? { drifted: result.drifted } : {},
     warnings: result.warnings
   });
 }
+function evaluateRolloutDrift(components, target, steps, hostdContext) {
+  const report = detectComponentDrift(components, `v${normalizeVersion(target)}`);
+  const owners = gatedOwners(steps.map((s) => s.kind), hostdContext);
+  const rolledAgents = new Set(steps.flatMap((s) => s.kind === "restart-agent" ? [s.agent] : []));
+  const { gated, exempt } = partitionDrift(report.behind, { owners, rolledAgents });
+  return { gated, exempt, target: report.target };
+}
 function executeRollout(steps, target, deps, execOpts = {}) {
   const targetNorm = normalizeVersion(target);
   const rolled = [];
@@ -92440,6 +92918,7 @@ function executeRollout(steps, target, deps, execOpts = {}) {
   const totalAgents = steps.filter((s) => s.kind === "restart-agent").length;
   let agentIndex = 0;
   let pinPersisted = false;
+  let driftVerdict = null;
   const fail4 = (partial) => {
     let pinReverted = false;
     if (pinPersisted && deps.revertPin) {
@@ -92580,6 +93059,25 @@ function executeRollout(steps, target, deps, execOpts = {}) {
           }
           break;
         }
+        case "verify-components": {
+          deps.log(`ROLL_STEP verify-components \u2014 asserting every in-scope component is on ${target}`);
+          if (!deps.collectComponents) {
+            warnings.push(`verify-components ran with NO component collector wired, so this ` + `roll did not prove the host converged. Confirm with ` + `\`switchroom update --check\` \u2014 anything still BEHIND ${target} ` + `was NOT caught here.`);
+            break;
+          }
+          let inventory;
+          try {
+            inventory = deps.collectComponents();
+          } catch (e) {
+            warnings.push(`verify-components could not read the component inventory ` + `(${e.message}), so this roll did not prove the host ` + `converged. Confirm with \`switchroom update --check\`.`);
+            break;
+          }
+          driftVerdict = evaluateRolloutDrift(inventory, target, steps, execOpts.hostdContext === true);
+          for (const c of driftVerdict.exempt) {
+            warnings.push(`${c.name} is on ${c.version ?? "an unreadable version"}, behind ` + `${target}, but was OUTSIDE this roll's scope (no step in this ` + `plan owns it). Finish it: ` + `${remediationFor(classifyComponent(c), `v${normalizeVersion(target)}`)}`);
+          }
+          break;
+        }
       }
     }
   } catch (e) {
@@ -92599,10 +93097,25 @@ function executeRollout(steps, target, deps, execOpts = {}) {
       warnings.push(`roll succeeded but committing the durable release.pin threw: ` + `${e.message}. The pin IS written; a stale rollout ` + `journal may cause a later boot to revert it \u2014 verify host-side.`);
     }
   }
+  if (driftVerdict && driftVerdict.gated.length > 0) {
+    const normalizedTarget = `v${normalizeVersion(target)}`;
+    for (const c of driftVerdict.gated) {
+      deps.log(`  \u2717 ${c.name} \u2192 ${c.version ?? "<unreadable>"} (expected ${target}) \u2014 STILL BEHIND`);
+      warnings.push(`${c.name} is STILL on ${c.version ?? "an unreadable version"} after ` + `the roll to ${target} \u2014 it was in this roll's scope and did not ` + `converge. Finish it: ` + `${remediationFor(classifyComponent(c), normalizedTarget)}`);
+    }
+    deps.log(`  \u2717 verify-components FAILED \u2014 ${driftVerdict.gated.length} component(s) ` + `still behind ${target}: ${driftVerdict.gated.map((c) => c.name).join(", ")}`);
+    return {
+      ok: false,
+      rolled,
+      warnings,
+      failedStep: VERIFY_COMPONENTS_STEP,
+      drifted: driftVerdict.gated.map((c) => c.name)
+    };
+  }
   return { ok: true, rolled, warnings };
 }
 function resolveRollbackTarget(auditLogPath) {
-  const logPath = auditLogPath ?? defaultAuditLogPath2(homedir45());
+  const logPath = auditLogPath ?? defaultAuditLogPath2(homedir46());
   let raw;
   try {
     raw = readAuditRaw(logPath, {
@@ -92714,8 +93227,14 @@ function createRolloutDeps(params) {
       const r = dockerRun(args);
       return r.ok ? r.stdout : null;
     }),
+    collectComponents: () => collectComponents(SWITCHROOM_VERSION, (cmd, args) => {
+      if (cmd !== "docker")
+        return { status: 1, stdout: "" };
+      const r = dockerRun(args);
+      return { status: r.ok ? 0 : 1, stdout: r.stdout };
+    }),
     persistPin: (pin) => {
-      const before = readFileSync75(configPath, "utf8");
+      const before = readFileSync76(configPath, "utf8");
       const after = setReleasePinInConfig(before, pin);
       if (after === before)
         return false;
@@ -92852,6 +93371,15 @@ function registerRolloutCommand(program3) {
       process.stdout.write(encodeRolloutResultLine(result) + `
 `);
     }
+    if (!result.ok && result.failedStep === VERIFY_COMPONENTS_STEP) {
+      process.stderr.write(`
+\u2717 Rollout INCOMPLETE \u2014 ${(result.drifted ?? []).length} component(s) ` + `still behind ${target}: ${(result.drifted ?? []).join(", ") || "unknown"}.
+` + `  ${result.rolled.length} agent(s) DID reach ${target} and the pin is ` + `committed \u2014 re-running the agent roll will not fix this.
+` + `  Run the per-component command named in the warning(s) above, then ` + `\`switchroom update --check\` to confirm the host is converged.
+`);
+      process.exitCode = 1;
+      return;
+    }
     if (!result.ok) {
       process.stderr.write(`
 \u2717 Rollout STOPPED at ${result.failedStep}` + (result.failedAgent ? ` (${result.failedAgent} \u2192 ${result.got ?? "unreachable"})` : "") + `.
@@ -92894,8 +93422,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync82, readFileSync as readFileSync76 } from "node:fs";
-import { dirname as dirname35, join as join85 } from "node:path";
+import { existsSync as existsSync82, readFileSync as readFileSync77 } from "node:fs";
+import { dirname as dirname35, join as join86 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -92945,11 +93473,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join85(dir, "package.json");
+    const pkgPath = join86(dir, "package.json");
     if (existsSync82(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync76(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync82(join85(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync77(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync82(join86(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -93133,12 +93661,12 @@ import {
   statSync as statSync48,
   unlinkSync as unlinkSync16
 } from "node:fs";
-import { join as join86 } from "node:path";
+import { join as join87 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join86(claudeConfigDir, "projects");
+  const projects = join87(claudeConfigDir, "projects");
   if (!existsSync83(projects))
     return [];
   const found = [];
@@ -93150,7 +93678,7 @@ function collectSessionJsonl(claudeConfigDir) {
       return;
     }
     for (const name of entries) {
-      const full = join86(dir, name);
+      const full = join87(dir, name);
       let st;
       try {
         st = statSync48(full);
@@ -93279,14 +93807,14 @@ import {
   mkdirSync as mkdirSync47,
   openSync as openSync16,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync77,
+  readFileSync as readFileSync78,
   renameSync as renameSync21,
   statSync as statSync49,
   unlinkSync as unlinkSync17,
   writeFileSync as writeFileSync32,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join87 } from "node:path";
+import { join as join88 } from "node:path";
 import { randomBytes as randomBytes13 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -93717,12 +94245,12 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path7 = join87(stateDir, ISSUES_FILE);
+  const path7 = join88(stateDir, ISSUES_FILE);
   if (!existsSync84(path7))
     return [];
   let raw;
   try {
-    raw = readFileSync77(path7, "utf-8");
+    raw = readFileSync78(path7, "utf-8");
   } catch {
     return [];
   }
@@ -93795,7 +94323,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve49(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93813,7 +94341,7 @@ function resolve49(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93831,7 +94359,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93864,7 +94392,7 @@ function ensureDir(stateDir) {
   mkdirSync47(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path7 = join87(stateDir, ISSUES_FILE);
+  const path7 = join88(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path7}.tmp-${process.pid}-${randomBytes13(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -93886,7 +94414,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join87(stateDir, entry);
+    const tmpPath = join88(stateDir, entry);
     try {
       const stat = statSync49(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -93898,7 +94426,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join87(stateDir, ISSUES_LOCK);
+  const lockPath = join88(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -93933,7 +94461,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync77(lockPath, "utf-8").trim();
+    pidStr = readFileSync78(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -94182,20 +94710,20 @@ function relTime(deltaMs) {
 // src/cli/deps.ts
 init_source();
 import { existsSync as existsSync87 } from "node:fs";
-import { homedir as homedir48 } from "node:os";
-import { join as join90, resolve as resolve50 } from "node:path";
+import { homedir as homedir49 } from "node:os";
+import { join as join91, resolve as resolve50 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash18 } from "node:crypto";
 import {
   existsSync as existsSync85,
   mkdirSync as mkdirSync48,
-  readFileSync as readFileSync78,
+  readFileSync as readFileSync79,
   rmSync as rmSync15,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { dirname as dirname36, join as join88 } from "node:path";
-import { homedir as homedir46 } from "node:os";
+import { dirname as dirname36, join as join89 } from "node:path";
+import { homedir as homedir47 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -94207,10 +94735,10 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join88(homedir46(), ".switchroom", "deps", "python");
+  return join89(homedir47(), ".switchroom", "deps", "python");
 }
 function hashFile(path7) {
-  return createHash18("sha256").update(readFileSync78(path7)).digest("hex");
+  return createHash18("sha256").update(readFileSync79(path7)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
@@ -94219,14 +94747,14 @@ function ensurePythonEnv(opts) {
   if (!existsSync85(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join88(cacheRoot, skillName);
-  const stampPath = join88(venvDir, ".requirements.sha256");
-  const binDir = join88(venvDir, "bin");
-  const pythonBin = join88(binDir, "python");
-  const pipBin = join88(binDir, "pip");
+  const venvDir = join89(cacheRoot, skillName);
+  const stampPath = join89(venvDir, ".requirements.sha256");
+  const binDir = join89(venvDir, "bin");
+  const pythonBin = join89(binDir, "python");
+  const pipBin = join89(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync85(stampPath) && existsSync85(pythonBin)) {
-    const existingHash = readFileSync78(stampPath, "utf8").trim();
+    const existingHash = readFileSync79(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -94278,12 +94806,12 @@ import {
   copyFileSync as copyFileSync12,
   existsSync as existsSync86,
   mkdirSync as mkdirSync49,
-  readFileSync as readFileSync79,
+  readFileSync as readFileSync80,
   rmSync as rmSync16,
   writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname37, join as join89 } from "node:path";
-import { homedir as homedir47 } from "node:os";
+import { dirname as dirname37, join as join90 } from "node:path";
+import { homedir as homedir48 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -94306,23 +94834,23 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join89(homedir47(), ".switchroom", "deps", "node");
+  return join90(homedir48(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname37(packageJsonPath);
   const hasher = createHash19("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync79(packageJsonPath));
+  hasher.update(readFileSync80(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join89(sourceDir, lockName);
+    const lockPath = join90(sourceDir, lockName);
     if (existsSync86(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync79(lockPath));
+      hasher.update(readFileSync80(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -94335,13 +94863,13 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname37(packageJsonPath);
-  const envDir = join89(cacheRoot, skillName);
-  const stampPath = join89(envDir, ".package.sha256");
-  const nodeModulesDir = join89(envDir, "node_modules");
-  const binDir = join89(nodeModulesDir, ".bin");
+  const envDir = join90(cacheRoot, skillName);
+  const stampPath = join90(envDir, ".package.sha256");
+  const nodeModulesDir = join90(envDir, "node_modules");
+  const binDir = join90(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync86(stampPath) && existsSync86(nodeModulesDir)) {
-    const existingHash = readFileSync79(stampPath, "utf8").trim();
+    const existingHash = readFileSync80(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -94356,12 +94884,12 @@ function ensureNodeEnv(opts) {
     rmSync16(envDir, { recursive: true, force: true });
   }
   mkdirSync49(envDir, { recursive: true });
-  copyFileSync12(packageJsonPath, join89(envDir, "package.json"));
+  copyFileSync12(packageJsonPath, join90(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join89(sourceDir, lockName);
+    const lockPath = join90(sourceDir, lockName);
     if (existsSync86(lockPath)) {
-      copyFileSync12(lockPath, join89(envDir, lockName));
+      copyFileSync12(lockPath, join90(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -94390,7 +94918,7 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve50(homedir48(), ".switchroom/skills/_bundled");
+  return resolve50(homedir49(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
@@ -94400,13 +94928,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join90(skillsRoot, skill);
+    const skillDir = join91(skillsRoot, skill);
     if (!existsSync87(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join90(skillDir, "requirements.txt");
-    const packageJsonPath = join90(skillDir, "package.json");
+    const requirementsPath = join91(skillDir, "requirements.txt");
+    const packageJsonPath = join91(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync87(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync87(packageJsonPath));
     let did = 0;
@@ -95360,8 +95888,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync13, existsSync as existsSync89, readFileSync as readFileSync80, writeFileSync as writeFileSync35 } from "node:fs";
-import { join as join91, resolve as resolve52 } from "node:path";
+import { copyFileSync as copyFileSync13, existsSync as existsSync89, readFileSync as readFileSync81, writeFileSync as writeFileSync35 } from "node:fs";
+import { join as join92, resolve as resolve52 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -95387,7 +95915,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join91(workspaceDir, "SOUL.md"),
+    soulPath: join92(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -95408,7 +95936,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync80(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync81(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -95453,8 +95981,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync90, readFileSync as readFileSync81, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
-import { resolve as resolve53, join as join92 } from "node:path";
+import { existsSync as existsSync90, readFileSync as readFileSync82, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
+import { resolve as resolve53, join as join93 } from "node:path";
 import { createHash as createHash20 } from "node:crypto";
 init_merge();
 init_hindsight2();
@@ -95465,11 +95993,11 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join92(agentDir, ".mcp.json");
+  const mcpPath = join93(agentDir, ".mcp.json");
   if (!existsSync90(mcpPath))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync81(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync82(mcpPath, "utf-8"));
     return Object.keys(parsed.mcpServers ?? {});
   } catch {
     return null;
@@ -95479,7 +96007,7 @@ function sha256(content) {
   return createHash20("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join92(claudeConfigDir, "projects");
+  const projectsDir = join93(claudeConfigDir, "projects");
   if (!existsSync90(projectsDir))
     return;
   try {
@@ -95488,8 +96016,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join92(projectsDir, entry.name);
-      const transcriptPath = join92(projectPath, "transcript.jsonl");
+      const projectPath = join93(projectsDir, entry.name);
+      const transcriptPath = join93(projectPath, "transcript.jsonl");
       if (!existsSync90(transcriptPath))
         continue;
       const stat3 = statSync50(transcriptPath);
@@ -95504,7 +96032,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync81(transcriptPath, "utf-8");
+    const content = readFileSync82(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -95558,11 +96086,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join92(agentDir, ".claude");
-    const claudeMdPath = join92(agentDir, "CLAUDE.md");
-    const soulMdPath = join92(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join92(workspaceDir, "SOUL.md");
-    const handoffPath = join92(agentDir, ".handoff.md");
+    const claudeConfigDir = join93(agentDir, ".claude");
+    const claudeMdPath = join93(agentDir, "CLAUDE.md");
+    const soulMdPath = join93(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join93(workspaceDir, "SOUL.md");
+    const handoffPath = join93(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -95608,7 +96136,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync90(handoffPath) ? readFileSync81(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync90(handoffPath) ? readFileSync82(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -95619,7 +96147,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync90(claudeMdPath) ? readFileSync81(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync90(claudeMdPath) ? readFileSync82(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -95630,7 +96158,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync90(soulMdPath) ? readFileSync81(soulMdPath, "utf-8") : existsSync90(workspaceSoulMdPath) ? readFileSync81(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync90(soulMdPath) ? readFileSync82(soulMdPath, "utf-8") : existsSync90(workspaceSoulMdPath) ? readFileSync82(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -95691,11 +96219,11 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join92(agentsDir, "..", "fleet");
-    const fleetInvPath = join92(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join92(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync90(fleetInvPath) ? readFileSync81(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync90(fleetClaudePath) ? readFileSync81(fleetClaudePath, "utf-8").length : 0;
+    const fleetDir = join93(agentsDir, "..", "fleet");
+    const fleetInvPath = join93(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join93(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync90(fleetInvPath) ? readFileSync82(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync90(fleetClaudePath) ? readFileSync82(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -95729,27 +96257,27 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync26 } from "node:child_process";
 import { closeSync as closeSync17, mkdirSync as mkdirSync51, openSync as openSync17, existsSync as existsSync92, unlinkSync as unlinkSync19 } from "node:fs";
-import { join as join94, resolve as resolve55 } from "node:path";
-import { homedir as homedir50 } from "node:os";
+import { join as join95, resolve as resolve55 } from "node:path";
+import { homedir as homedir51 } from "node:os";
 import { randomBytes as randomBytes14 } from "node:crypto";
 
 // src/worktree/registry.ts
 import {
   mkdirSync as mkdirSync50,
   writeFileSync as writeFileSync36,
-  readFileSync as readFileSync82,
+  readFileSync as readFileSync83,
   readdirSync as readdirSync31,
   unlinkSync as unlinkSync18,
   existsSync as existsSync91,
   renameSync as renameSync22
 } from "node:fs";
-import { join as join93, resolve as resolve54 } from "node:path";
-import { homedir as homedir49 } from "node:os";
+import { join as join94, resolve as resolve54 } from "node:path";
+import { homedir as homedir50 } from "node:os";
 function registryDir() {
-  return resolve54(process.env.SWITCHROOM_WORKTREE_DIR ?? join93(homedir49(), ".switchroom", "worktrees"));
+  return resolve54(process.env.SWITCHROOM_WORKTREE_DIR ?? join94(homedir50(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join93(registryDir(), `${id}.json`);
+  return join94(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync50(registryDir(), { recursive: true });
@@ -95765,7 +96293,7 @@ function writeRecord(record2) {
 function readRecord(id) {
   const path10 = recordPath(id);
   try {
-    const raw = readFileSync82(path10, "utf8");
+    const raw = readFileSync83(path10, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -95800,7 +96328,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync51(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join94(lockDir, `.lock-${lockName}`);
+  const lockPath = join95(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -95827,7 +96355,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve55(process.env.SWITCHROOM_WORKTREE_BASE ?? join94(homedir50(), ".switchroom", "worktree-checkouts"));
+  return resolve55(process.env.SWITCHROOM_WORKTREE_BASE ?? join95(homedir51(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes14(4).toString("hex");
@@ -95849,7 +96377,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join94(homedir50(), p.slice(2));
+    return join95(homedir51(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -95877,7 +96405,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync51(baseDir, { recursive: true });
-    worktreePath = join94(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join95(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
     const now = new Date().toISOString();
@@ -96100,15 +96628,15 @@ function runReaper(nowMs, deps = {}) {
 import { execFileSync as execFileSync29 } from "node:child_process";
 import {
   existsSync as existsSync95,
-  readFileSync as readFileSync83,
+  readFileSync as readFileSync84,
   readdirSync as readdirSync32,
   statSync as statSync51,
   renameSync as renameSync23,
   mkdirSync as mkdirSync52,
   rmSync as rmSync17
 } from "node:fs";
-import { homedir as homedir51 } from "node:os";
-import { join as join95, resolve as resolve56 } from "node:path";
+import { homedir as homedir52 } from "node:os";
+import { join as join96, resolve as resolve56 } from "node:path";
 function parseGitdirPointer(dotGitFileContents) {
   const m = /^gitdir:\s*(.+?)\s*$/m.exec(dotGitFileContents);
   return m ? m[1] : null;
@@ -96223,17 +96751,17 @@ function defaultPrSignal(repo, branch, exec) {
   }
 }
 function trashRoot() {
-  return resolve56(process.env.SWITCHROOM_WORKTREE_TRASH ?? join95(homedir51(), ".switchroom", "worktree-gc-trash"));
+  return resolve56(process.env.SWITCHROOM_WORKTREE_TRASH ?? join96(homedir52(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
   const exists = deps.existsSync ?? existsSync95;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
-  const readFile4 = deps.readFile ?? ((p) => readFileSync83(p, "utf8"));
+  const readFile4 = deps.readFile ?? ((p) => readFileSync84(p, "utf8"));
   const stat3 = deps.stat ?? ((p) => statSync51(p));
   const exec = deps.exec ?? defaultExec3;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
-  const trash = join95(trashRoot(), stamp);
+  const trash = join96(trashRoot(), stamp);
   let claimed;
   try {
     claimed = new Set(listRecords().map((r) => resolve56(r.path)));
@@ -96269,10 +96797,10 @@ function planGc(roots, deps = {}) {
       continue;
     }
     for (const name of entries) {
-      const dir = join95(root, name);
+      const dir = join96(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join95(dir, ".git");
+      const dotGit = join96(dir, ".git");
       if (!exists(dotGit))
         continue;
       let st;
@@ -96301,7 +96829,7 @@ function planGc(roots, deps = {}) {
       ownerRepos.add(repoRoot);
       if (exists(ptr))
         continue;
-      orphans.push({ dir, owner: repoRoot, dest: join95(trash, name) });
+      orphans.push({ dir, owner: repoRoot, dest: join96(trash, name) });
     }
   }
   const registered = [];
@@ -96412,7 +96940,7 @@ function listTrashEntries(nowMs, deps = {}) {
     return [];
   const out = [];
   for (const stamp of readDir(root)) {
-    const stampDir = join95(root, stamp);
+    const stampDir = join96(root, stamp);
     let names;
     try {
       names = readDir(stampDir);
@@ -96420,7 +96948,7 @@ function listTrashEntries(nowMs, deps = {}) {
       continue;
     }
     for (const name of names) {
-      const p = join95(stampDir, name);
+      const p = join96(stampDir, name);
       let mtimeMs = nowMs;
       try {
         mtimeMs = statSync51(p).mtimeMs;
@@ -96444,7 +96972,7 @@ function purgeTrash(paths) {
   return { deleted, errors: errors2 };
 }
 function defaultRoots() {
-  return [join95(homedir51(), "code")];
+  return [join96(homedir52(), "code")];
 }
 
 // src/cli/worktree.ts
@@ -96672,7 +97200,7 @@ import {
   rmSync as rmSync18,
   writeFileSync as writeFileSync37
 } from "node:fs";
-import { join as join96 } from "node:path";
+import { join as join97 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -96862,16 +97390,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join96(stateBase, "google-workspace-mcp", "credentials");
+  return join97(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync53(dir, { recursive: true, mode: 448 });
   chmodSync16(dir, 448);
   for (const name of readdirSync33(dir)) {
-    rmSync18(join96(dir, name), { force: true, recursive: true });
+    rmSync18(join97(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join96(dir, filename);
+  const filePath = join97(dir, filename);
   writeFileSync37(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync16(filePath, 384);
   return filePath;
@@ -97031,7 +97559,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { writeFileSync as writeFileSync38, mkdirSync as mkdirSync54 } from "node:fs";
-import { dirname as dirname38, join as join97 } from "node:path";
+import { dirname as dirname38, join as join98 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -97076,7 +97604,7 @@ function heartbeatPath(agentName, account) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
     const base = slug ? `m365-launcher-${agentName}-${slug}` : `m365-launcher-${agentName}`;
-    return join97(override, `${base}.heartbeat.json`);
+    return join98(override, `${base}.heartbeat.json`);
   }
   return slug ? `/state/agent/m365-launcher-${slug}.heartbeat.json` : "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -97432,9 +97960,9 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/hindsight-mcp-shim.ts
 init_hindsight();
-import { mkdirSync as mkdirSync56, readFileSync as readFileSync84, renameSync as renameSync24, writeFileSync as writeFileSync40 } from "node:fs";
+import { mkdirSync as mkdirSync56, readFileSync as readFileSync85, renameSync as renameSync24, writeFileSync as writeFileSync40 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join98 } from "node:path";
+import { join as join99 } from "node:path";
 import { createInterface as createInterface6 } from "node:readline";
 var SHIM_SUPPORTED_PROTOCOL_VERSIONS = [
   "2025-06-18",
@@ -97660,12 +98188,12 @@ class HindsightShim {
 `));
   }
   get cachePath() {
-    return join98(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
+    return join99(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
   }
   writeCache(result) {
     try {
       mkdirSync56(this.opts.cacheDir, { recursive: true });
-      const tmp = join98(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
+      const tmp = join99(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
       writeFileSync40(tmp, JSON.stringify(result, null, 2) + `
 `);
       renameSync24(tmp, this.cachePath);
@@ -97675,7 +98203,7 @@ class HindsightShim {
   }
   readCache() {
     try {
-      const parsed = JSON.parse(readFileSync84(this.cachePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync85(this.cachePath, "utf-8"));
       if (Array.isArray(parsed.tools))
         return parsed;
       return null;
@@ -97838,7 +98366,7 @@ function resolveShimOptionsFromEnv(env2) {
   return {
     url: env2.HINDSIGHT_MCP_URL || HINDSIGHT_DEFAULT_MCP_URL,
     bankId: env2.HINDSIGHT_BANK_ID || "",
-    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join98(home2, ".hindsight-shim")
+    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join99(home2, ".hindsight-shim")
   };
 }
 function registerHindsightMcpShimCommand(program3) {
@@ -97851,7 +98379,7 @@ function registerHindsightMcpShimCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync85, statSync as statSync52 } from "node:fs";
+import { readFileSync as readFileSync86, statSync as statSync52 } from "node:fs";
 import { basename as basename13 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -98191,7 +98719,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync52(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync85(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync86(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -98512,9 +99040,9 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync86, existsSync as existsSync97, readdirSync as readdirSync34 } from "node:fs";
-import { join as join99 } from "node:path";
-import { homedir as homedir52 } from "node:os";
+import { readFileSync as readFileSync87, existsSync as existsSync97, readdirSync as readdirSync34 } from "node:fs";
+import { join as join100 } from "node:path";
+import { homedir as homedir53 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -98788,7 +99316,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync86(src.path, "utf-8");
+      content = readFileSync87(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -98849,7 +99377,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join99(homedir52(), ".switchroom", "agents");
+    agentsDir = join100(homedir53(), ".switchroom", "agents");
   }
   if (!existsSync97(agentsDir))
     return [];
@@ -98861,7 +99389,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path10 = join99(agentsDir, name, "runtime-metrics.jsonl");
+    const path10 = join100(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync97(path10)) {
       sources.push({ path: path10, agent: name });
     }
@@ -98897,27 +99425,27 @@ import {
   mkdirSync as mkdirSync57,
   openSync as openSync18,
   readdirSync as readdirSync35,
-  readFileSync as readFileSync87,
+  readFileSync as readFileSync88,
   renameSync as renameSync25,
   statSync as statSync53,
   unlinkSync as unlinkSync20,
   writeSync as writeSync10
 } from "node:fs";
-import { join as join100, resolve as resolve57 } from "node:path";
+import { join as join101, resolve as resolve57 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve57(opts.root, agent) : resolve57(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join100(base, "schedule.d");
-  const scheduleStagingDir = join100(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join100(base, "skills.d");
-  const skillsStagingDir = join100(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join101(base, "schedule.d");
+  const scheduleStagingDir = join101(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join101(base, "skills.d");
+  const skillsStagingDir = join101(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join100(base, ".lock"),
+    lockPath: join101(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -98971,8 +99499,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join100(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join100(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join101(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync18(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -98988,8 +99516,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join100(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join100(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join101(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join101(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync18(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -99004,7 +99532,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join100(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join101(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync98(finalPath))
       return false;
     unlinkSync20(finalPath);
@@ -99019,9 +99547,9 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync35(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join100(paths.skillsDir, name);
+    const full = join101(paths.skillsDir, name);
     try {
-      const raw = readFileSync87(full, "utf-8");
+      const raw = readFileSync88(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -99031,7 +99559,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join100(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync98(finalPath))
       return false;
     unlinkSync20(finalPath);
@@ -99046,9 +99574,9 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync35(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join100(paths.scheduleDir, name);
+    const full = join101(paths.scheduleDir, name);
     try {
-      const raw = readFileSync87(full, "utf-8");
+      const raw = readFileSync88(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -99273,18 +99801,18 @@ import {
   mkdirSync as mkdirSync58,
   openSync as openSync19,
   readdirSync as readdirSync36,
-  readFileSync as readFileSync88,
+  readFileSync as readFileSync89,
   renameSync as renameSync26,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync41,
   writeSync as writeSync11
 } from "node:fs";
-import { join as join101 } from "node:path";
+import { join as join102 } from "node:path";
 import { randomBytes as randomBytes15 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join101(paths.scheduleDir, ".pending");
+  return join102(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -99297,8 +99825,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join101(dir, `${stageId}.yaml`);
-  const metaPath = join101(dir, `${stageId}.meta.json`);
+  const yamlPath = join102(dir, `${stageId}.yaml`);
+  const metaPath = join102(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -99332,12 +99860,12 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join101(dir, name);
-    const yamlPath = join101(dir, `${stageId}.yaml`);
+    const metaPath = join102(dir, name);
+    const yamlPath = join102(dir, `${stageId}.yaml`);
     if (!existsSync99(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync88(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync89(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -99352,7 +99880,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join102(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync99(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -99375,7 +99903,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync100, readFileSync as readFileSync89 } from "node:fs";
+import { existsSync as existsSync100, readFileSync as readFileSync90 } from "node:fs";
 import { execFileSync as execFileSync30 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -99766,7 +100294,7 @@ function scheduleRemove(opts) {
   let priorContent = null;
   try {
     if (existsSync100(match.path))
-      priorContent = readFileSync89(match.path, "utf-8");
+      priorContent = readFileSync90(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -99969,7 +100497,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync100(opts.jsonl) ? readFileSync89(opts.jsonl, "utf-8") : "";
+      blob = existsSync100(opts.jsonl) ? readFileSync90(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync30("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -100005,7 +100533,7 @@ import { existsSync as existsSync101 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { join as join102 } from "node:path";
+import { join as join103 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -100080,7 +100608,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join102(poolDir, skillName);
+  const skillPath = join103(poolDir, skillName);
   if (!existsSync101(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -100250,7 +100778,7 @@ import {
   mkdirSync as mkdirSync59,
   mkdtempSync as mkdtempSync5,
   openSync as openSync20,
-  readFileSync as readFileSync90,
+  readFileSync as readFileSync91,
   readdirSync as readdirSync37,
   realpathSync as realpathSync7,
   renameSync as renameSync27,
@@ -100258,8 +100786,8 @@ import {
   statSync as statSync54,
   writeFileSync as writeFileSync42
 } from "node:fs";
-import { tmpdir as tmpdir6, homedir as homedir53 } from "node:os";
-import { dirname as dirname40, join as join103, relative as relative4, resolve as resolve58 } from "node:path";
+import { tmpdir as tmpdir6, homedir as homedir54 } from "node:os";
+import { dirname as dirname40, join as join104, relative as relative4, resolve as resolve58 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -100493,10 +101021,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join103(homedir53(), raw.slice(2));
+    return join104(homedir54(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir53();
+    return homedir54();
   return resolve58(raw);
 }
 function readStdinSync() {
@@ -100532,7 +101060,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync37(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join103(sub, ent.name);
+      const full = join104(sub, ent.name);
       const rel = relative4(abs, full);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink inside --from dir: ${rel}`);
@@ -100542,7 +101070,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync90(full);
+        const buf = readFileSync91(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -100567,7 +101095,7 @@ function loadFromTarball(tarPath) {
       fail4(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join103(tmpdir6(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join104(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync20("tar", [
@@ -100591,7 +101119,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync90(filePath, "utf-8");
+  const content = readFileSync91(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -100653,8 +101181,8 @@ function validatePayload(name, files) {
           errors2.push(`${path10} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path10)) {
-        const tmp = mkdtempSync5(join103(tmpdir6(), "skill-apply-py-"));
-        const tmpPy = join103(tmp, "check.py");
+        const tmp = mkdtempSync5(join104(tmpdir6(), "skill-apply-py-"));
+        const tmpPy = join104(tmp, "check.py");
         try {
           writeFileSync42(tmpPy, content);
           const r = spawnSync20("python3", ["-m", "py_compile", tmpPy], {
@@ -100677,12 +101205,12 @@ function diffSummary(currentDir, files) {
   if (existsSync102(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync37(sub, { withFileTypes: true })) {
-        const full = join103(sub, ent.name);
+        const full = join104(sub, ent.name);
         const rel = relative4(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync90(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync91(full, "utf-8");
         }
       }
     };
@@ -100713,7 +101241,7 @@ function writePayload(poolDir, name, files) {
   if (!existsSync102(poolDir)) {
     mkdirSync59(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join103(poolDir, name);
+  const target = join104(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync12(target);
@@ -100724,11 +101252,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail4(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join103(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join104(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
-      const full = join103(staging, path10);
+      const full = join104(staging, path10);
       mkdirSync59(dirname40(full), { recursive: true, mode: 493 });
       const fd = openSync20(full, "wx");
       try {
@@ -100806,7 +101334,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join103(poolDir, name);
+    const currentDir = join104(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -100843,7 +101371,7 @@ import {
   mkdirSync as mkdirSync60,
   mkdtempSync as mkdtempSync6,
   openSync as openSync21,
-  readFileSync as readFileSync91,
+  readFileSync as readFileSync92,
   readdirSync as readdirSync38,
   renameSync as renameSync28,
   rmSync as rmSync20,
@@ -100851,8 +101379,8 @@ import {
   utimesSync,
   writeFileSync as writeFileSync43
 } from "node:fs";
-import { dirname as dirname41, join as join104, relative as relative5, resolve as resolve59 } from "node:path";
-import { homedir as homedir54, tmpdir as tmpdir7 } from "node:os";
+import { dirname as dirname41, join as join105, relative as relative5, resolve as resolve59 } from "node:path";
+import { homedir as homedir55, tmpdir as tmpdir7 } from "node:os";
 import { spawnSync as spawnSync21 } from "node:child_process";
 init_helpers();
 init_agent_config();
@@ -100863,10 +101391,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve59(override) : join104(homedir54(), ".switchroom-config");
+  const candidate = override ? resolve59(override) : join105(homedir55(), ".switchroom-config");
   if (!existsSync103(candidate))
     return null;
-  return join104(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join105(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -100884,7 +101412,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync20(join104(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync20(join105(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -100893,7 +101421,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join104(configSkillsRoot, name);
+  const dest = join105(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -100908,31 +101436,31 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync103(dest)) {
-        const trash = join104(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join105(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync28(dest, trash);
       }
       return;
     }
     mkdirSync60(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join104(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join105(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync60(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync38(src, { withFileTypes: true })) {
-        const s = join104(src, ent.name);
-        const d = join104(dst, ent.name);
+        const s = join105(src, ent.name);
+        const d = join105(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync43(d, readFileSync91(s));
+          writeFileSync43(d, readFileSync92(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
     if (existsSync103(dest)) {
-      const prior = join104(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join105(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync28(dest, prior);
     }
     renameSync28(staging, dest);
@@ -100962,16 +101490,16 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve59(opts.root);
-  return join104(homedir54(), ".switchroom", "agents");
+  return join105(homedir55(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join104(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join105(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join104(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join105(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function countPersonalSkills(agentsRoot, agent) {
-  const skillsDir = join104(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
   if (!existsSync103(skillsDir))
     return 0;
   let n = 0;
@@ -101009,7 +101537,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync38(sub, { withFileTypes: true })) {
-      const full = join104(sub, ent.name);
+      const full = join105(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail5(`refusing to read symlink in --from dir: ${relative5(abs, full)}`);
       }
@@ -101019,7 +101547,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative5(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync91(full, "utf-8");
+        files[rel] = readFileSync92(full, "utf-8");
       }
     }
   };
@@ -101062,8 +101590,8 @@ function behavioralValidate(files) {
         errors2.push(`${path10} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path10)) {
-      const tmp = mkdtempSync6(join104(tmpdir7(), "skill-personal-py-"));
-      const tmpPy = join104(tmp, "check.py");
+      const tmp = mkdtempSync6(join105(tmpdir7(), "skill-personal-py-"));
+      const tmpPy = join105(tmp, "check.py");
       try {
         writeFileSync43(tmpPy, content);
         const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
@@ -101087,7 +101615,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync38(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join104(trash, ent.name);
+    const entPath = join105(trash, ent.name);
     try {
       const st = statSync55(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -101108,11 +101636,11 @@ function writePersonalSkill(targetDir, files) {
     fail5(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync60(dirname41(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join104(dirname41(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join105(dirname41(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
-      const full = join104(staging, path10);
+      const full = join105(staging, path10);
       mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
       const fd = openSync21(full, "wx");
       try {
@@ -101219,7 +101747,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync91(p, "utf-8") };
+    return { "SKILL.md": readFileSync92(p, "utf-8") };
   }
   fail5(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -101259,10 +101787,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join104(homedir54(), ".switchroom", "skills");
+  return join105(homedir55(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join104(homedir54(), ".switchroom", "skills", "_bundled");
+  return join105(homedir55(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -101272,7 +101800,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join104(root, slug);
+  const dir = join105(root, slug);
   if (!existsSync103(dir)) {
     fail5(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -101288,7 +101816,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync38(sub, { withFileTypes: true })) {
-      const full = join104(sub, ent.name);
+      const full = join105(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -101308,7 +101836,7 @@ function readSourceFiles(dir) {
             fail5(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync91(full, "utf-8");
+        files[rel] = readFileSync92(full, "utf-8");
       }
     }
   };
@@ -101399,7 +101927,7 @@ function removePersonalAction(name, opts) {
   const trashRoot2 = trashDir(agentsRoot, agent);
   mkdirSync60(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join104(trashRoot2, `${name}-${ts}`);
+  const trashTarget = join105(trashRoot2, `${name}-${ts}`);
   renameSync28(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -101418,7 +101946,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join104(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync103(skillsDir)) {
     for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
@@ -101427,7 +101955,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join104(skillsDir, ent.name);
+      const skillPath = join105(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -101435,10 +101963,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync55(join104(sub, e.name)).size;
+              totalBytes += statSync55(join105(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join104(sub, e.name));
+            walk2(join105(sub, e.name));
           }
         }
       };
@@ -101476,12 +102004,12 @@ function registerSkillPersonalCommands(program3) {
 
 // src/cli/self-improve-propose-skill.ts
 import { createConnection as createConnection4 } from "node:net";
-import { homedir as homedir55 } from "node:os";
-import { join as join105 } from "node:path";
-import { readFileSync as readFileSync92 } from "node:fs";
+import { homedir as homedir56 } from "node:os";
+import { join as join106 } from "node:path";
+import { readFileSync as readFileSync93 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join105(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join105(homedir55(), ".claude", "channels", "telegram", "gateway.sock"));
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join106(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join106(homedir56(), ".claude", "channels", "telegram", "gateway.sock"));
 }
 function fail6(msg, code = 1) {
   console.error(msg);
@@ -101516,7 +102044,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
       fail6("agent name required (--agent or $SWITCHROOM_AGENT_NAME)");
     let draft;
     try {
-      draft = JSON.parse(readFileSync92(opts.draft, "utf-8"));
+      draft = JSON.parse(readFileSync93(opts.draft, "utf-8"));
     } catch (e) {
       fail6(`failed to read/parse --draft: ${e.message}`);
     }
@@ -101553,28 +102081,28 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync104, readdirSync as readdirSync39, readFileSync as readFileSync93, statSync as statSync56 } from "node:fs";
-import { homedir as homedir56 } from "node:os";
-import { join as join106, resolve as resolve60 } from "node:path";
+import { existsSync as existsSync104, readdirSync as readdirSync39, readFileSync as readFileSync94, statSync as statSync56 } from "node:fs";
+import { homedir as homedir57 } from "node:os";
+import { join as join107, resolve as resolve60 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve60(homedir56(), ".switchroom/agents");
+  return resolve60(homedir57(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve60(homedir56(), ".switchroom/skills");
+  return resolve60(homedir57(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve60(homedir56(), ".switchroom/skills/_bundled");
+  return resolve60(homedir57(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join106(skillDir, "SKILL.md");
+  const mdPath = join107(skillDir, "SKILL.md");
   if (!existsSync104(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync93(mdPath, "utf-8");
+    content = readFileSync94(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -101602,7 +102130,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join106(skillDir, "SKILL.md");
+  const mdPath = join107(skillDir, "SKILL.md");
   try {
     const st = statSync56(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -101613,7 +102141,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join106(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join107(agentsRoot, agent, ".claude/skills");
   if (!existsSync104(skillsDir))
     return [];
   const out = [];
@@ -101626,7 +102154,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join106(skillsDir, ent);
+    const dirPath = join107(skillsDir, ent);
     try {
       if (!statSync56(dirPath).isDirectory())
         continue;
@@ -101666,7 +102194,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join106(sharedRoot, ent);
+    const dirPath = join107(sharedRoot, ent);
     try {
       if (!statSync56(dirPath).isDirectory())
         continue;
@@ -101702,7 +102230,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join106(bundledRoot, ent);
+    const dirPath = join107(bundledRoot, ent);
     try {
       if (!statSync56(dirPath).isDirectory())
         continue;
@@ -101857,8 +102385,8 @@ import {
   realpathSync as realpathSync8,
   copyFileSync as copyFileSync14
 } from "node:fs";
-import { homedir as homedir57 } from "node:os";
-import { join as join107 } from "node:path";
+import { homedir as homedir58 } from "node:os";
+import { join as join108 } from "node:path";
 import { spawnSync as spawnSync24 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
@@ -102196,7 +102724,7 @@ networks:
 # operator surface; the daemon's stderr lands in \`docker logs switchroom-hostd\`.
 `;
 }
-function resolveHostdHostHome(env2 = process.env, home2 = homedir57()) {
+function resolveHostdHostHome(env2 = process.env, home2 = homedir58()) {
   const fromEnv = env2.SWITCHROOM_HOST_HOME?.trim();
   const resolved = fromEnv && fromEnv.length > 0 ? fromEnv : home2;
   if (resolved === "/host-home" || resolved.startsWith("/host-home/")) {
@@ -102207,7 +102735,7 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir57()) {
   return resolved;
 }
 function resolveHostdSkillsTarget(hostHome) {
-  const skillsPath = join107(hostHome, ".switchroom", "skills");
+  const skillsPath = join108(hostHome, ".switchroom", "skills");
   let st;
   try {
     st = lstatSync14(skillsPath);
@@ -102231,10 +102759,10 @@ function resolveHostdSkillsTarget(hostHome) {
   return target;
 }
 function hostdDir() {
-  return join107(homedir57(), ".switchroom", "hostd");
+  return join108(homedir58(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join107(hostdDir(), "docker-compose.yml");
+  return join108(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -102363,7 +102891,7 @@ function doStatus() {
       for (const name of readdirSync40(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join107(dir, name, "sock");
+        const sockPath = join108(dir, name, "sock");
         if (existsSync106(sockPath)) {
           const st = statSync57(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -102455,22 +102983,25 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 init_operator_uid();
+init_compose();
 import { chownSync as chownSync10, existsSync as existsSync107, mkdirSync as mkdirSync62, writeFileSync as writeFileSync45, copyFileSync as copyFileSync15 } from "node:fs";
-import { homedir as homedir58 } from "node:os";
-import { join as join108 } from "node:path";
+import { homedir as homedir59 } from "node:os";
+import { join as join109 } from "node:path";
 import { spawnSync as spawnSync25 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
     return explicitTag;
   return resolveImageTag(resolveRelease({ root: release }));
 }
-function resolveWebHostHome(env2 = process.env, home2 = homedir58()) {
+function resolveWebHostHome(env2 = process.env, home2 = homedir59()) {
   const fromEnv = env2.SWITCHROOM_HOST_HOME?.trim();
   const resolved = fromEnv && fromEnv.length > 0 ? fromEnv : home2;
-  if (resolved === "/host-home" || resolved.startsWith("/host-home/")) {
-    throw new Error(`switchroom webd install: refusing to generate \u2014 the host home resolved to ` + `"${resolved}", the in-container mount point of the operator home (never a ` + `valid host bind source). Emitting it would make Docker create empty ` + `/host-home dirs on the host and break every webhook forward + secret read.
+  try {
+    assertPlausibleHostHome(resolved);
+  } catch {
+    throw new Error(`switchroom webd install: refusing to generate \u2014 the host home resolved to ` + `"${resolved}", an in-container path (never a valid host bind source). ` + `Emitting it would make Docker create empty dirs on the host and break ` + `every webhook forward + secret read.
 
-` + `Recovery: run \`switchroom webd install\` from the HOST shell, or set ` + `SWITCHROOM_HOST_HOME to the real host home first.`);
+` + `Recovery: set SWITCHROOM_HOST_HOME to the real host home, or drive the ` + `install from hostd / the host shell (both set it).`);
   }
   return resolved;
 }
@@ -102557,10 +103088,10 @@ services:
 `;
 }
 function webdDir() {
-  return join108(homedir58(), ".switchroom", "web");
+  return join109(homedir59(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join108(webdDir(), "docker-compose.yml");
+  return join109(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -102582,9 +103113,15 @@ function runDocker2(args) {
 async function doInstall2(opts, program3) {
   const operatorUid = resolveOperatorUid();
   if (operatorUid === undefined) {
-    console.error(source_default.red(`Could not resolve the operator uid (no SUDO_UID and getuid() is 0 or unavailable).
+    console.error(source_default.red(`Could not resolve the operator uid.
 ` + `The web container must run as the operator uid so its webhook forwards pass
-` + "each agent gateway's peercred ACL. Run `switchroom webd install` as the\n" + "operator user (not root), or under `sudo` from the operator's shell."));
+` + `each agent gateway's peercred ACL; running as root would be silently 503'd.
+` + `
+` + `Tried, in order: SUDO_UID, this process's own uid (non-root only),
+` + `SWITCHROOM_HOSTD_OPERATOR_UID, and the owner of ~/.switchroom.
+` + `
+` + "Recovery (no shell required): re-run `switchroom hostd install` so the\n" + `hostd container carries SWITCHROOM_HOSTD_OPERATOR_UID, or make
+` + "~/.switchroom owned by the operator account (`chown -R <operator>:<operator>\n" + "~/.switchroom`) so it can be derived. If neither is possible, set\n" + "SWITCHROOM_HOSTD_OPERATOR_UID to the operator's numeric uid."));
     process.exit(1);
   }
   const dir = webdDir();
@@ -102719,10 +103256,10 @@ function registerWebdCommand(program3) {
 
 // src/cli/host-repair.ts
 init_source();
-import { homedir as homedir59 } from "node:os";
-import { join as join109 } from "node:path";
+import { homedir as homedir60 } from "node:os";
+import { join as join110 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join109(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join110(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {
@@ -102771,7 +103308,7 @@ function isStateBogusAutoDir(probe2) {
   return true;
 }
 function planMountRepairs(probe2, opts = {}) {
-  const home2 = opts.hostHome ?? homedir59();
+  const home2 = opts.hostHome ?? homedir60();
   const items = [];
   const dockerComposePath = ARTIFACT_ALLOWLIST.dockerComposePluginDir(home2);
   const dockerComposeSt = probe2.lstat(dockerComposePath);
@@ -103177,8 +103714,8 @@ function printDeepDiveBrief(targets) {
 // src/cli/hindsight-watch.ts
 init_source();
 import { existsSync as existsSync112, readdirSync as readdirSync45 } from "node:fs";
-import { homedir as homedir62 } from "node:os";
-import { join as join111, resolve as resolve63 } from "node:path";
+import { homedir as homedir63 } from "node:os";
+import { join as join112, resolve as resolve63 } from "node:path";
 
 // src/host-control/config-degraded.ts
 import { connect as connect3 } from "node:net";
@@ -103247,8 +103784,8 @@ init_install_cron();
 
 // src/hindsight-watch/probe.ts
 import { spawnSync as spawnSync27 } from "node:child_process";
-import { readFileSync as readFileSync98, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
-import { homedir as homedir61 } from "node:os";
+import { readFileSync as readFileSync99, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
+import { homedir as homedir62 } from "node:os";
 import { resolve as resolve62 } from "node:path";
 
 // src/hindsight-watch/metrics.ts
@@ -103376,12 +103913,12 @@ function readLlmSignals(series) {
 
 // src/hindsight-watch/recall-log.ts
 import { closeSync as closeSync22, existsSync as existsSync111, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
-import { join as join110 } from "node:path";
+import { join as join111 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
 var RECALL_MAX_ROW_AGE_MS = 24 * 60 * 60 * 1000;
 function recallLogPath2(agentDir) {
-  return join110(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  return join111(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
 }
 function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
   if (!existsSync111(path10))
@@ -103529,7 +104066,7 @@ function probeRecallLogs(agentsDir, now, windowRows = RECALL_WINDOW_ROWS, maxAge
   const all = [];
   let agents = 0;
   for (const name of names) {
-    const rows = withinWindow(readRecallLogTail2(recallLogPath2(join110(agentsDir, name)), windowRows), now, maxAgeMs);
+    const rows = withinWindow(readRecallLogTail2(recallLogPath2(join111(agentsDir, name)), windowRows), now, maxAgeMs);
     if (rows.length > 0)
       agents++;
     all.push(...rows);
@@ -103624,7 +104161,7 @@ function readDropCount(hindsightDir) {
   try {
     if (statSync59(path10).size > DROPS_LEDGER_MAX_BYTES)
       return 0;
-    parsed = JSON.parse(readFileSync98(path10, "utf8"));
+    parsed = JSON.parse(readFileSync99(path10, "utf8"));
   } catch {
     return 0;
   }
@@ -103634,7 +104171,7 @@ function readDropCount(hindsightDir) {
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 function resolveAgentsDir2(explicit) {
-  return explicit ?? resolve62(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir61(), ".switchroom", "agents");
+  return explicit ?? resolve62(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir62(), ".switchroom", "agents");
 }
 function probeSpool(agentsDir = resolveAgentsDir2()) {
   let names;
@@ -104324,7 +104861,7 @@ function registerHindsightWatchCommand(program3) {
       process.exitCode = runInstallCron(opts.cronUser);
       return;
     }
-    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join111(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir62(), ".switchroom", "agents");
+    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join112(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir63(), ".switchroom", "agents");
     const statePath = opts.state ?? defaultStatePath2();
     const log = (m) => {
       process.stderr.write(`${m}
@@ -104433,11 +104970,11 @@ async function notifyOperator(agentsDir, text, log) {
 // src/cli/openrouter-watch.ts
 init_source();
 import { existsSync as existsSync114, readdirSync as readdirSync46 } from "node:fs";
-import { homedir as homedir64 } from "node:os";
-import { join as join112, resolve as resolve65 } from "node:path";
+import { homedir as homedir65 } from "node:os";
+import { join as join113, resolve as resolve65 } from "node:path";
 
 // src/openrouter/install-cron.ts
-import { existsSync as existsSync113, mkdirSync as mkdirSync64, readFileSync as readFileSync99, renameSync as renameSync29, writeFileSync as writeFileSync47 } from "node:fs";
+import { existsSync as existsSync113, mkdirSync as mkdirSync64, readFileSync as readFileSync100, renameSync as renameSync29, writeFileSync as writeFileSync47 } from "node:fs";
 import { dirname as dirname43 } from "node:path";
 var CRON_PATH2 = "/etc/cron.d/openrouter-watch";
 var CRON_SCHEDULE2 = "17 * * * *";
@@ -104457,7 +104994,7 @@ function installCron2(opts) {
   const content = renderCron2(opts);
   if (existsSync113(path10)) {
     try {
-      if (readFileSync99(path10, "utf8") === content) {
+      if (readFileSync100(path10, "utf8") === content) {
         return { status: "unchanged", path: path10, content };
       }
     } catch {}
@@ -104469,16 +105006,16 @@ function installCron2(opts) {
   return { status: "installed", path: path10, content };
 }
 // src/openrouter/state.ts
-import { mkdirSync as mkdirSync65, readFileSync as readFileSync100, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
-import { homedir as homedir63 } from "node:os";
+import { mkdirSync as mkdirSync65, readFileSync as readFileSync101, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
+import { homedir as homedir64 } from "node:os";
 import { dirname as dirname44, resolve as resolve64 } from "node:path";
-function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir63()) {
+function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir64()) {
   return resolve64(home2, ".switchroom", "openrouter-watch", "state.json");
 }
 function loadState2(path10) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync100(path10, "utf8"));
+    parsed = JSON.parse(readFileSync101(path10, "utf8"));
   } catch {
     return {};
   }
@@ -104589,7 +105126,7 @@ function registerOpenRouterWatchCommand(program3) {
       process.exitCode = runInstallCron2(opts.cronUser);
       return;
     }
-    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join112(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir64(), ".switchroom", "agents");
+    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join113(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir65(), ".switchroom", "agents");
     const statePath = opts.state ?? defaultStatePath3();
     const log = (m) => {
       process.stderr.write(`${m}