switchroom 0.19.38 → 0.19.40

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.38", COMMIT_SHA = "9ec88983";
+var VERSION = "0.19.40", COMMIT_SHA = "89286b22";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13593,7 +13593,7 @@ function resolveObservationScope(configured, env2 = process.env) {
     return classifyObservationScope(configured);
   return classifyObservationScope(env2[OBSERVATION_SCOPES_ENV]);
 }
-var OBSERVATION_SCOPES, OBSERVATION_SCOPES_ENV = "HINDSIGHT_OBSERVATION_SCOPES";
+var OBSERVATION_SCOPES, OBSERVATION_SCOPES_ENV = "HINDSIGHT_OBSERVATION_SCOPES", OBSERVATION_SCOPE_STRATEGIES;
 var init_observation_scopes = __esm(() => {
   OBSERVATION_SCOPES = [
     "per_tag",
@@ -13601,13 +13601,19 @@ var init_observation_scopes = __esm(() => {
     "all_combinations",
     "shared"
   ];
+  OBSERVATION_SCOPE_STRATEGIES = [
+    "curated",
+    "shared",
+    "combined",
+    "off"
+  ];
 });
 
 // src/config/schema.ts
 function isValidTimezone(value) {
   return TIMEZONE_REGEX.test(value);
 }
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -13722,7 +13728,8 @@ var init_schema = __esm(() => {
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
     deny: exports_external.array(exports_external.string()).default([]).describe("Denied tools (overrides allow)")
   }).optional();
-  ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Per-row observation scope stamped on every memory this agent " + `retains. "shared" makes Hindsight's consolidation write the ` + "resulting observations into ONE global untagged scope instead of a " + "scope per tag \u2014 what several agents pooling one bank need so their " + "observations actually merge rather than sitting in parallel " + "per-tag silos. OMITTED BY DEFAULT: unset means the field never goes " + "on the wire and the engine's own default stands, which is the " + "shipped behaviour. Applies to every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
+  ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Operator PIN for the per-row observation scope, overriding the " + 'default `curated` strategy (see docs/configuration.md). "shared" ' + "forces Hindsight's consolidation to write EVERY observation into ONE " + "global untagged scope \u2014 what several agents pooling one bank want so " + "their observations merge rather than sitting in parallel silos. " + '"combined" is the pin form of opting out (restores the pre-#4035 ' + "engine default). UNSET does NOT mean 'nothing on the wire': the " + "`curated` strategy still computes a scope per retain. Applies to " + "every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
+  ObservationScopeStrategySchema = exports_external.enum(OBSERVATION_SCOPE_STRATEGIES).optional().describe("Per-retain strategy that decides how the observation scope is " + 'computed when no `observation_scopes` pin is set. "curated" ' + "(the default since #4035) strips volatile per-session provenance " + "tags from each retain's consolidation scope \u2014 keeping the stable " + "semantic ones on the source fact \u2014 so an agent's observations dedup " + "and merge across sessions instead of pocketing one-per-session. " + '"shared" sends every retain to the one global untagged scope. ' + '"combined" / "off" opt OUT: no per-row scope goes on the wire, ' + "restoring the pre-feature engine default (byte-identical to an " + "unconfigured client). OMITTED BY DEFAULT: unset leaves the plugin's " + "own default (`curated`) in force. A manual `observation_scopes` pin " + "wins over this strategy. Accepted values: " + `${OBSERVATION_SCOPE_STRATEGIES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -13758,6 +13765,7 @@ var init_schema = __esm(() => {
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis \u2014 a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true \u2014 Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never \u2026", "from now on \u2026", ' + `"stop doing \u2026", a stated preference, "that's wrong, it's \u2026") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex \u2014 the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
     observation_scopes: ObservationScopesSchema,
+    observation_scope_strategy: ObservationScopeStrategySchema,
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
@@ -14158,6 +14166,7 @@ var init_schema = __esm(() => {
       isolation: exports_external.enum(["default", "strict"]).optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       observation_scopes: ObservationScopesSchema,
+      observation_scope_strategy: ObservationScopeStrategySchema,
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),
         cache_ttl_secs: exports_external.number().int().min(0).optional(),
@@ -15830,7 +15839,7 @@ function hindsightPgEnv(overrides = new Map) {
   }
   return out;
 }
-var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION, HINDSIGHT_PG_APP_ANON_MIB = 2560, HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB = 2048, HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB, HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB = 3072, HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB = 7168, HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE", HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS", HINDSIGHT_PG_FSYNC_ENV = "SWITCHROOM_HINDSIGHT_PG_FSYNC", HINDSIGHT_PG_DEFAULT_FSYNC = "on", HINDSIGHT_PG_DEFAULTS, HINDSIGHT_PG_ENV_KEYS;
+var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION, HINDSIGHT_PG_APP_ANON_MIB = 2560, HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB = 2048, HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB, HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB = 6144, HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB = 12288, HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE", HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS", HINDSIGHT_PG_FSYNC_ENV = "SWITCHROOM_HINDSIGHT_PG_FSYNC", HINDSIGHT_PG_DEFAULT_FSYNC = "on", HINDSIGHT_PG_DEFAULTS, HINDSIGHT_PG_ENV_KEYS;
 var init_hindsight_pg_defaults = __esm(() => {
   HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION = 16 * 1024;
   HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB = HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION - HINDSIGHT_PG_APP_ANON_MIB - HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB;
@@ -15908,7 +15917,7 @@ function hindsightPerfEnv(caps, overrides = new Map) {
 function findUnmanagedHindsightEnvKeys(configEnv) {
   return Object.keys(configEnv ?? {}).filter((key) => !HINDSIGHT_PERF_ENV_KEYS.has(key) && !HINDSIGHT_PG_ENV_KEYS.has(key)).sort();
 }
-var HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION = 150, HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE, HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT = 50, HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2, HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low", HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT, HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true", HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128, HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true", HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 500, HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential", HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30, HINDSIGHT_PERF_DEFAULTS_UNGATED, HINDSIGHT_PERF_DEFAULTS_GPU, HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM, HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS, HINDSIGHT_PERF_ENV_KEYS;
+var HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION = 150, HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE, HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT = 50, HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2, HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low", HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT, HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true", HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128, HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true", HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 250, HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential", HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30, HINDSIGHT_PERF_DEFAULTS_UNGATED, HINDSIGHT_PERF_DEFAULTS_GPU, HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM, HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS, HINDSIGHT_PERF_ENV_KEYS;
 var init_hindsight_perf_defaults = __esm(() => {
   init_hindsight_pg_defaults();
   HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE = Math.ceil(HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION * 0.4);
@@ -29102,6 +29111,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightObservationScopes,
+    hindsightObservationScopeStrategy,
     hindsightTopicAliasesJson,
     hindsightSenderBanksJson,
     hindsightTopicFilterMode
@@ -29156,6 +29166,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
+    hindsightObservationScopeStrategyQ: hindsightObservationScopeStrategy ? shellSingleQuote(hindsightObservationScopeStrategy) : undefined,
     hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
     hindsightSenderBanksJsonQ: hindsightSenderBanksJson ? shellSingleQuote(hindsightSenderBanksJson) : undefined,
     hindsightTopicFilterMode,
@@ -29421,6 +29432,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
   const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
+  const hindsightObservationScopeStrategy = agentConfig.memory?.observation_scope_strategy;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
   const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
   const senderBanks = switchroomConfig ? resolveUsers(switchroomConfig, name).senderBanks : agentConfig.memory?.recall?.sender_banks ?? {};
@@ -29457,6 +29469,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightObservationScopes,
+    hindsightObservationScopeStrategy,
     hindsightTopicAliasesJson,
     hindsightSenderBanksJson,
     hindsightTopicFilterMode
@@ -30402,6 +30415,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
   const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
+  const hindsightObservationScopeStrategy = agentConfig.memory?.observation_scope_strategy;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
   const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
   const senderBanks = switchroomConfig ? resolveUsers(switchroomConfig, name).senderBanks : agentConfig.memory?.recall?.sender_banks ?? {};
@@ -30451,6 +30465,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
       hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
+      hindsightObservationScopeStrategyQ: hindsightObservationScopeStrategy ? shellSingleQuote(hindsightObservationScopeStrategy) : undefined,
       hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
       hindsightSenderBanksJsonQ: hindsightSenderBanksJson ? shellSingleQuote(hindsightSenderBanksJson) : undefined,
       hindsightTopicFilterMode,
@@ -30874,6 +30889,7 @@ ${body}
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
       hindsightObservationScopes,
+      hindsightObservationScopeStrategy,
       hindsightTopicAliasesJson,
       hindsightSenderBanksJson,
       hindsightTopicFilterMode
@@ -39115,168 +39131,6 @@ var init_telegram_yaml = __esm(() => {
   import_yaml12 = __toESM(require_dist(), 1);
 });
 
-// src/memory/hindsight-tools.ts
-var HINDSIGHT_MIN_API_VERSION = "0.8.5", HINDSIGHT_REPAIR_MIN_API_VERSION = "0.8.5", EXPECTED_HINDSIGHT_TOOLS;
-var init_hindsight_tools = __esm(() => {
-  EXPECTED_HINDSIGHT_TOOLS = {
-    recall: { required: ["query"] },
-    reflect: { required: ["query"] },
-    retain: { required: ["content"] },
-    sync_retain: { required: ["content"] },
-    delete_document: { required: ["document_id"] },
-    create_directive: { required: ["content", "name"] },
-    list_directives: { required: [] },
-    delete_directive: { required: ["directive_id"] },
-    create_bank: { required: ["bank_id"] },
-    update_bank: { required: [] },
-    list_banks: { required: [] },
-    create_mental_model: { required: ["name", "source_query"] },
-    list_mental_models: { required: [] },
-    update_mental_model: { required: ["mental_model_id"] },
-    refresh_mental_model: { required: ["mental_model_id"] },
-    list_memories: { required: [] },
-    get_memory: { required: ["memory_id"] },
-    update_memory: { required: ["memory_id"] },
-    invalidate_memory: { required: ["memory_id"] }
-  };
-});
-
-// src/memory/hindsight-repair.ts
-function buildRepairBankArgv(opts) {
-  const hasBank = typeof opts.bank === "string" && opts.bank.length > 0;
-  if (hasBank === Boolean(opts.all)) {
-    throw new Error("pass exactly one of --bank <id> or --all");
-  }
-  const cmdArgs = ["repair-bank"];
-  if (hasBank)
-    cmdArgs.push("--bank", opts.bank);
-  if (opts.all)
-    cmdArgs.push("--all");
-  if (opts.schema)
-    cmdArgs.push("--schema", opts.schema);
-  if (opts.dryRun)
-    cmdArgs.push("--dry-run");
-  const script = `if command -v hindsight-admin >/dev/null 2>&1; then exec hindsight-admin "$@"; fi; ` + `exec ${HINDSIGHT_ADMIN_BIN} "$@"`;
-  return [
-    "exec",
-    opts.container ?? HINDSIGHT_CONTAINER_NAME,
-    "sh",
-    "-c",
-    script,
-    "--",
-    ...cmdArgs
-  ];
-}
-function parseRepairSummary(stdout) {
-  const m = stdout.match(/Done:\s*(\d+)\s+schema\(s\),\s*(\d+)\s+bank\(s\) scanned,\s*(\d+)\s+already present,\s*(\d+)\s+created,\s*(\d+)\s+to-create \(dry-run\),\s*(\d+)\s+failed/);
-  if (!m)
-    return null;
-  return {
-    schemas: Number(m[1]),
-    banksScanned: Number(m[2]),
-    alreadyPresent: Number(m[3]),
-    created: Number(m[4]),
-    toCreate: Number(m[5]),
-    failed: Number(m[6])
-  };
-}
-function compareApiVersion(a, b) {
-  const part = (v, i) => {
-    const raw = v.split(".")[i];
-    if (raw === undefined)
-      return 0;
-    const n = parseInt(raw, 10);
-    return Number.isFinite(n) ? n : 0;
-  };
-  const len = Math.max(a.split(".").length, b.split(".").length);
-  for (let i = 0;i < len; i++) {
-    const d = part(a, i) - part(b, i);
-    if (d !== 0)
-      return d;
-  }
-  return 0;
-}
-async function fetchHindsightApiVersion(mcpUrl, opts = {}) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const origin = mcpUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "");
-  const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 4000);
-  try {
-    const res = await doFetch(`${origin}/version`, { signal: controller.signal });
-    if (!res.ok)
-      return null;
-    const body = await res.json();
-    return typeof body?.api_version === "string" ? body.api_version : null;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function classifyRepairPreflight(liveVersion) {
-  if (liveVersion === null)
-    return { ok: true };
-  if (compareApiVersion(liveVersion, HINDSIGHT_REPAIR_MIN_API_VERSION) < 0) {
-    return {
-      ok: false,
-      reason: `hindsight ${liveVersion} has no \`repair-bank\` command \u2014 it lands in ` + `${HINDSIGHT_REPAIR_MIN_API_VERSION} (upstream #2645). Without it there is no ` + `supported way to rebuild a bank's vector-index coverage. Update the ` + `pinned image in docker/Dockerfile.hindsight and recreate the container ` + `with \`switchroom memory --update\`, then re-run this command.`
-    };
-  }
-  return { ok: true };
-}
-function classifyRepairOutcome(run) {
-  if (run.childExit !== 0) {
-    return {
-      exit: REPAIR_FAILED_EXIT,
-      level: "fail",
-      headline: `repair-bank exited ${run.childExit}.`,
-      detail: run.childExit === 2 ? "Exit 2 from the admin CLI is a usage error \u2014 check --bank / --schema spelling. " + "Nothing was repaired and coverage is unknown." : "Failed indexes are dropped, so a re-run is safe and is the documented retry."
-    };
-  }
-  if (run.summary === null) {
-    return {
-      exit: REPAIR_UNVERIFIED_EXIT,
-      level: "fail",
-      headline: "repair-bank exited 0 but printed no summary \u2014 coverage was NOT confirmed.",
-      detail: "Read its output above. This is not a pass: a backend with a single global " + "index, an aborted scan, or an output-format change upstream all look like " + "this, and none of them means coverage is complete."
-    };
-  }
-  if (run.summary.banksScanned === 0) {
-    return {
-      exit: REPAIR_UNVERIFIED_EXIT,
-      level: "fail",
-      headline: "repair-bank scanned 0 bank(s) \u2014 nothing was checked.",
-      detail: "A scan that examined no bank proves nothing about coverage. Usual cause is a " + "--bank id or --schema name that matches nothing; `switchroom memory banks` " + "lists the real ids."
-    };
-  }
-  if (run.summary.failed > 0) {
-    return {
-      exit: REPAIR_FAILED_EXIT,
-      level: "fail",
-      headline: `${run.summary.failed} index(es) failed to build.`,
-      detail: "Those banks still under-return on recall. Failed indexes are dropped, so " + "re-running is safe and is the documented retry; if it repeats, the hindsight " + "container logs carry the postgres error."
-    };
-  }
-  if (run.dryRun && run.summary.toCreate > 0) {
-    return {
-      exit: REPAIR_COVERAGE_MISSING_EXIT,
-      level: "fail",
-      headline: `${run.summary.toCreate} vector index(es) missing across ${run.summary.banksScanned} bank(s).`,
-      detail: "Recall on those banks silently under-returns. Re-run without --dry-run to fix."
-    };
-  }
-  return {
-    exit: 0,
-    level: "ok",
-    headline: "repair-bank finished.",
-    detail: run.dryRun ? `Coverage complete: ${run.summary.alreadyPresent} index(es) present across ` + `${run.summary.banksScanned} bank(s), nothing to create.` : `${run.summary.created} created, ${run.summary.alreadyPresent} already present ` + `across ${run.summary.banksScanned} bank(s). Re-run \`switchroom doctor\` to confirm.`
-  };
-}
-var HINDSIGHT_CONTAINER_NAME = "switchroom-hindsight", HINDSIGHT_ADMIN_BIN = "/app/api/.venv/bin/hindsight-admin", REPAIR_FAILED_EXIT = 1, REPAIR_COVERAGE_MISSING_EXIT = 3, REPAIR_UNVERIFIED_EXIT = 4;
-var init_hindsight_repair = __esm(() => {
-  init_hindsight_tools();
-});
-
 // src/memory/bank-health.ts
 function hindsightRestBase(mcpUrl) {
   return mcpUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "");
@@ -39446,6 +39300,168 @@ function recentUnextracted(docs, withinDays = 30, now = new Date, minTextLength
 }
 var DOCUMENTS_PAGE_LIMIT = 500;
 
+// src/memory/hindsight-tools.ts
+var HINDSIGHT_MIN_API_VERSION = "0.8.5", HINDSIGHT_REPAIR_MIN_API_VERSION = "0.8.5", EXPECTED_HINDSIGHT_TOOLS;
+var init_hindsight_tools = __esm(() => {
+  EXPECTED_HINDSIGHT_TOOLS = {
+    recall: { required: ["query"] },
+    reflect: { required: ["query"] },
+    retain: { required: ["content"] },
+    sync_retain: { required: ["content"] },
+    delete_document: { required: ["document_id"] },
+    create_directive: { required: ["content", "name"] },
+    list_directives: { required: [] },
+    delete_directive: { required: ["directive_id"] },
+    create_bank: { required: ["bank_id"] },
+    update_bank: { required: [] },
+    list_banks: { required: [] },
+    create_mental_model: { required: ["name", "source_query"] },
+    list_mental_models: { required: [] },
+    update_mental_model: { required: ["mental_model_id"] },
+    refresh_mental_model: { required: ["mental_model_id"] },
+    list_memories: { required: [] },
+    get_memory: { required: ["memory_id"] },
+    update_memory: { required: ["memory_id"] },
+    invalidate_memory: { required: ["memory_id"] }
+  };
+});
+
+// src/memory/hindsight-repair.ts
+function buildRepairBankArgv(opts) {
+  const hasBank = typeof opts.bank === "string" && opts.bank.length > 0;
+  if (hasBank === Boolean(opts.all)) {
+    throw new Error("pass exactly one of --bank <id> or --all");
+  }
+  const cmdArgs = ["repair-bank"];
+  if (hasBank)
+    cmdArgs.push("--bank", opts.bank);
+  if (opts.all)
+    cmdArgs.push("--all");
+  if (opts.schema)
+    cmdArgs.push("--schema", opts.schema);
+  if (opts.dryRun)
+    cmdArgs.push("--dry-run");
+  const script = `if command -v hindsight-admin >/dev/null 2>&1; then exec hindsight-admin "$@"; fi; ` + `exec ${HINDSIGHT_ADMIN_BIN} "$@"`;
+  return [
+    "exec",
+    opts.container ?? HINDSIGHT_CONTAINER_NAME,
+    "sh",
+    "-c",
+    script,
+    "--",
+    ...cmdArgs
+  ];
+}
+function parseRepairSummary(stdout) {
+  const m = stdout.match(/Done:\s*(\d+)\s+schema\(s\),\s*(\d+)\s+bank\(s\) scanned,\s*(\d+)\s+already present,\s*(\d+)\s+created,\s*(\d+)\s+to-create \(dry-run\),\s*(\d+)\s+failed/);
+  if (!m)
+    return null;
+  return {
+    schemas: Number(m[1]),
+    banksScanned: Number(m[2]),
+    alreadyPresent: Number(m[3]),
+    created: Number(m[4]),
+    toCreate: Number(m[5]),
+    failed: Number(m[6])
+  };
+}
+function compareApiVersion(a, b) {
+  const part = (v, i) => {
+    const raw = v.split(".")[i];
+    if (raw === undefined)
+      return 0;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) ? n : 0;
+  };
+  const len = Math.max(a.split(".").length, b.split(".").length);
+  for (let i = 0;i < len; i++) {
+    const d = part(a, i) - part(b, i);
+    if (d !== 0)
+      return d;
+  }
+  return 0;
+}
+async function fetchHindsightApiVersion(mcpUrl, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const origin = mcpUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "");
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 4000);
+  try {
+    const res = await doFetch(`${origin}/version`, { signal: controller.signal });
+    if (!res.ok)
+      return null;
+    const body = await res.json();
+    return typeof body?.api_version === "string" ? body.api_version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function classifyRepairPreflight(liveVersion) {
+  if (liveVersion === null)
+    return { ok: true };
+  if (compareApiVersion(liveVersion, HINDSIGHT_REPAIR_MIN_API_VERSION) < 0) {
+    return {
+      ok: false,
+      reason: `hindsight ${liveVersion} has no \`repair-bank\` command \u2014 it lands in ` + `${HINDSIGHT_REPAIR_MIN_API_VERSION} (upstream #2645). Without it there is no ` + `supported way to rebuild a bank's vector-index coverage. Update the ` + `pinned image in docker/Dockerfile.hindsight and recreate the container ` + `with \`switchroom memory --update\`, then re-run this command.`
+    };
+  }
+  return { ok: true };
+}
+function classifyRepairOutcome(run) {
+  if (run.childExit !== 0) {
+    return {
+      exit: REPAIR_FAILED_EXIT,
+      level: "fail",
+      headline: `repair-bank exited ${run.childExit}.`,
+      detail: run.childExit === 2 ? "Exit 2 from the admin CLI is a usage error \u2014 check --bank / --schema spelling. " + "Nothing was repaired and coverage is unknown." : "Failed indexes are dropped, so a re-run is safe and is the documented retry."
+    };
+  }
+  if (run.summary === null) {
+    return {
+      exit: REPAIR_UNVERIFIED_EXIT,
+      level: "fail",
+      headline: "repair-bank exited 0 but printed no summary \u2014 coverage was NOT confirmed.",
+      detail: "Read its output above. This is not a pass: a backend with a single global " + "index, an aborted scan, or an output-format change upstream all look like " + "this, and none of them means coverage is complete."
+    };
+  }
+  if (run.summary.banksScanned === 0) {
+    return {
+      exit: REPAIR_UNVERIFIED_EXIT,
+      level: "fail",
+      headline: "repair-bank scanned 0 bank(s) \u2014 nothing was checked.",
+      detail: "A scan that examined no bank proves nothing about coverage. Usual cause is a " + "--bank id or --schema name that matches nothing; `switchroom memory banks` " + "lists the real ids."
+    };
+  }
+  if (run.summary.failed > 0) {
+    return {
+      exit: REPAIR_FAILED_EXIT,
+      level: "fail",
+      headline: `${run.summary.failed} index(es) failed to build.`,
+      detail: "Those banks still under-return on recall. Failed indexes are dropped, so " + "re-running is safe and is the documented retry; if it repeats, the hindsight " + "container logs carry the postgres error."
+    };
+  }
+  if (run.dryRun && run.summary.toCreate > 0) {
+    return {
+      exit: REPAIR_COVERAGE_MISSING_EXIT,
+      level: "fail",
+      headline: `${run.summary.toCreate} vector index(es) missing across ${run.summary.banksScanned} bank(s).`,
+      detail: "Recall on those banks silently under-returns. Re-run without --dry-run to fix."
+    };
+  }
+  return {
+    exit: 0,
+    level: "ok",
+    headline: "repair-bank finished.",
+    detail: run.dryRun ? `Coverage complete: ${run.summary.alreadyPresent} index(es) present across ` + `${run.summary.banksScanned} bank(s), nothing to create.` : `${run.summary.created} created, ${run.summary.alreadyPresent} already present ` + `across ${run.summary.banksScanned} bank(s). Re-run \`switchroom doctor\` to confirm.`
+  };
+}
+var HINDSIGHT_CONTAINER_NAME = "switchroom-hindsight", HINDSIGHT_ADMIN_BIN = "/app/api/.venv/bin/hindsight-admin", REPAIR_FAILED_EXIT = 1, REPAIR_COVERAGE_MISSING_EXIT = 3, REPAIR_UNVERIFIED_EXIT = 4;
+var init_hindsight_repair = __esm(() => {
+  init_hindsight_tools();
+});
+
 // src/host-control/audit-rotation-config.ts
 var DEFAULT_HOSTD_AUDIT_MAX_BYTES, DEFAULT_HOSTD_AUDIT_MAX_FILES = 3;
 var init_audit_rotation_config = __esm(() => {
@@ -45781,6 +45797,8 @@ function classifyObservationScopeSaturation(reports) {
   }
   const unreadable = reports.filter((r) => !r.ok);
   const readable = reports.filter((r) => r.ok);
+  const growing = readable.filter((r) => r.observationsEnabled && r.untaggedCount >= OBSERVATION_SCOPE_UNTAGGED_WARN_COUNT).sort((a, b) => b.untaggedCount - a.untaggedCount);
+  const growthNote = growing.length > 0 ? `${growing.length} bank(s) with an untagged global scope over ` + `${OBSERVATION_SCOPE_UNTAGGED_WARN_COUNT.toLocaleString()} observations ` + `(uncapped curated sink, growth watch): ` + growing.slice(0, OBSERVATION_SCOPE_MAX_LISTED).map((r) => `${r.bankId} ${r.untaggedCount.toLocaleString()}`).join(", ") + (growing.length > OBSERVATION_SCOPE_MAX_LISTED ? `; +${growing.length - OBSERVATION_SCOPE_MAX_LISTED} more` : "") : "";
   if (readable.length === 0) {
     return {
       name,
@@ -45803,7 +45821,11 @@ function classifyObservationScopeSaturation(reports) {
     notes.push(`${disabled.length} bank(s) have observations disabled: ` + disabled.map((r) => r.bankId).join(", "));
   }
   const suffix = notes.length > 0 ? ` \u00b7 ${notes.join(" \u00b7 ")}` : "";
+  const growthSuffix = growthNote ? ` \u00b7 ${growthNote}` : "";
   if (judged.length === 0) {
+    if (growing.length > 0) {
+      return { name, status: "warn", detail: `${growthNote}${suffix}` };
+    }
     return { name, status: "skip", detail: `no bank could be judged${suffix}` };
   }
   const closed = judged.filter((r) => r.cap === 0);
@@ -45835,17 +45857,14 @@ function classifyObservationScopeSaturation(reports) {
     return {
       name,
       status: "fail",
-      detail: `${failing.length} observation scope(s) at or over the cap \u2014 consolidation ` + `output is being discarded on them right now: ${list(failing)}` + (warning.length > 0 ? ` \u00b7 ${warning.length} more above ${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}%` : "") + backlog([...failing, ...warning]) + suffix,
+      detail: `${failing.length} observation scope(s) at or over the cap \u2014 consolidation ` + `output is being discarded on them right now: ${list(failing)}` + (warning.length > 0 ? ` \u00b7 ${warning.length} more above ${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}%` : "") + backlog([...failing, ...warning]) + growthSuffix + suffix,
       fix
     };
   }
-  if (warning.length > 0) {
-    return {
-      name,
-      status: "warn",
-      detail: `${warning.length} observation scope(s) above ` + `${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}% of the cap and still writable: ` + `${list(warning)}` + backlog(warning) + suffix,
-      fix
-    };
+  if (warning.length > 0 || growing.length > 0) {
+    const scopeClause = warning.length > 0 ? `${warning.length} observation scope(s) above ` + `${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}% of the cap and still writable: ` + `${list(warning)}` + backlog(warning) : "";
+    const detail = warning.length > 0 ? scopeClause + growthSuffix + suffix : `${growthNote}${suffix}`;
+    return { name, status: "warn", detail, ...warning.length > 0 ? { fix } : {} };
   }
   const totalScopes = capped.reduce((n, r) => n + r.scopeCount, 0);
   const detailBase = capped.length === 0 ? `no bank has a positive observation cap` : `${totalScopes} scope(s) across ${capped.length} bank(s) below ` + `${Math.round(OBSERVATION_SCOPE_WARN_RATIO * 100)}% of the cap`;
@@ -45862,7 +45881,7 @@ function classifyObservationScopeSaturation(reports) {
     detail: detailBase + (extra.length > 0 ? ` \u00b7 ${extra.join(" \u00b7 ")}` : "") + suffix
   };
 }
-async function getJson2(url, opts) {
+async function getJson3(url, opts) {
   const fetchImpl = opts?.fetchImpl ?? fetch;
   const timeoutMs = opts?.timeoutMs ?? 15000;
   const controller = new AbortController;
@@ -45891,10 +45910,11 @@ async function inspectBankScopes(apiUrl, bankId, opts) {
     observationsEnabled: false,
     hasScopeLimitRules: false,
     scopeCount: 0,
+    untaggedCount: 0,
     saturated: [],
     pendingConsolidation: null
   });
-  const cfg = await getJson2(`${base}/v1/default/banks/${bank}/config`, opts);
+  const cfg = await getJson3(`${base}/v1/default/banks/${bank}/config`, opts);
   if (!cfg.ok)
     return fail4(cfg.reason);
   const config = cfg.data?.config;
@@ -45907,7 +45927,7 @@ async function inspectBankScopes(apiUrl, bankId, opts) {
   const rules = config["observation_scope_limits"];
   const hasScopeLimitRules = Array.isArray(rules) && rules.length > 0;
   const observationsEnabled = config["enable_observations"] !== false;
-  const scopesResp = await getJson2(`${base}/v1/default/banks/${bank}/observations/scopes`, opts);
+  const scopesResp = await getJson3(`${base}/v1/default/banks/${bank}/observations/scopes`, opts);
   if (!scopesResp.ok)
     return fail4(scopesResp.reason);
   const rawScopes = scopesResp.data?.scopes;
@@ -45924,9 +45944,10 @@ async function inspectBankScopes(apiUrl, bankId, opts) {
     scopes.push({ tags, count });
   }
   const saturated = computeScopeSaturation(scopes, rawCap).filter((s) => s.status !== "ok");
+  const untaggedCount = scopes.filter((s) => s.tags.length === 0).reduce((n, s) => n + s.count, 0);
   let pendingConsolidation = null;
   if (saturated.length > 0 && !hasScopeLimitRules && observationsEnabled) {
-    const stats = await getJson2(`${base}/v1/default/banks/${bank}/stats`, opts);
+    const stats = await getJson3(`${base}/v1/default/banks/${bank}/stats`, opts);
     if (stats.ok && typeof stats.data?.pending_consolidation === "number") {
       pendingConsolidation = stats.data.pending_consolidation;
     }
@@ -45938,6 +45959,7 @@ async function inspectBankScopes(apiUrl, bankId, opts) {
     observationsEnabled,
     hasScopeLimitRules,
     scopeCount: scopes.length,
+    untaggedCount,
     saturated,
     pendingConsolidation
   };
@@ -45953,7 +45975,7 @@ async function checkObservationScopeSaturation(config, apiUrl, opts) {
   const reports = await Promise.all([...banks].map((bankId) => inspectBankScopes(apiUrl, bankId, opts)));
   return classifyObservationScopeSaturation(reports);
 }
-var OBSERVATION_SCOPE_CHECK_NAME = "hindsight observation scopes", OBSERVATION_SCOPE_WARN_RATIO = 0.8, OBSERVATION_SCOPE_MAX_LISTED = 6;
+var OBSERVATION_SCOPE_CHECK_NAME = "hindsight observation scopes", OBSERVATION_SCOPE_WARN_RATIO = 0.8, OBSERVATION_SCOPE_MAX_LISTED = 6, OBSERVATION_SCOPE_UNTAGGED_WARN_COUNT = 1e4;
 var init_doctor_observation_scopes = __esm(() => {
   init_merge();
   init_hindsight2();
@@ -45987,6 +46009,38 @@ function installCron(opts) {
   renameSync15(tmp, path6);
   return { status: "installed", path: path6, content };
 }
+function parseCronUser(content) {
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    if (!trimmed.includes("hindsight-watch"))
+      continue;
+    const fields = trimmed.split(/\s+/);
+    if (fields.length >= 7)
+      return fields[5];
+  }
+  return null;
+}
+function reconcileCron(opts) {
+  const path6 = opts.path ?? CRON_PATH;
+  if (!existsSync63(path6))
+    return { status: "absent", path: path6 };
+  let user = opts.fallbackUser;
+  try {
+    user = parseCronUser(readFileSync60(path6, "utf8")) ?? opts.fallbackUser;
+  } catch {}
+  if (!user) {
+    throw new Error(`cannot reconcile ${path6}: no cron-user parseable from the existing fragment and no fallback user available`);
+  }
+  const r = installCron({ user, binary: opts.binary, path: path6 });
+  return {
+    status: r.status === "installed" ? "reconciled" : "unchanged",
+    path: path6,
+    content: r.content
+  };
+}
 var CRON_PATH = "/etc/cron.d/hindsight-watch", CRON_SCHEDULE = "*/15 * * * *", CRON_LOG_PATH = "/var/log/hindsight-watch.log", CRON_LOCK_PATH = "/run/lock/hindsight-watch.lock";
 var init_install_cron = () => {};
 
@@ -51689,6 +51743,9 @@ import { spawnSync as spawnSync12 } from "node:child_process";
 function fixFor(c, target) {
   return remediationFor(classifyComponent(c), target);
 }
+function hostCliBehindStatus(c) {
+  return c.kind === "cli" ? "fail" : "warn";
+}
 function runComponentVersionChecks(config, opts = {}) {
   const exec = opts.exec ?? defaultExec2;
   const components = collectComponents(opts.cliVersion ?? SWITCHROOM_VERSION, exec);
@@ -51712,10 +51769,11 @@ function runComponentVersionChecks(config, opts = {}) {
     });
   }
   for (const c of report.behind) {
+    const status = hostCliBehindStatus(c);
     results.push({
       name: `component behind: ${c.name}`,
-      status: "warn",
-      detail: `on ${c.version}, expected ${report.target} (${src})`,
+      status,
+      detail: status === "fail" ? `on ${c.version}, expected ${report.target} (${src}) \u2014 the host CLI must never trail the fleet; it self-heals in-band via \`switchroom update\`` : `on ${c.version}, expected ${report.target} (${src})`,
       fix: fixFor(c, report.target)
     });
   }
@@ -68980,9 +69038,9 @@ __export(exports_server, {
   dispatchTool: () => dispatchTool,
   TOOLS: () => TOOLS
 });
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function execCli(args, stdin) {
-  const r = spawnSync22(CLI_BIN, args, {
+  const r = spawnSync23(CLI_BIN, args, {
     encoding: "utf-8",
     env: process.env,
     timeout: 15000,
@@ -69491,7 +69549,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes16 } from "node:crypto";
-import { existsSync as existsSync105 } from "node:fs";
+import { existsSync as existsSync106 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -69518,7 +69576,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync105(sockPath)) {
+  if (!existsSync106(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -69769,13 +69827,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync105(bindMounted))
+  if (existsSync106(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path10 = resolveAuditLogPath();
-  if (!existsSync105(path10)) {
+  if (!existsSync106(path10)) {
     return errorText2(`get_status: audit log not found at ${path10}. No update_apply has run yet?`);
   }
   let raw;
@@ -70494,11 +70552,11 @@ var init_test_agents = __esm(() => {
 });
 
 // src/litellm/header-passthrough-guard.ts
-import { existsSync as existsSync108, readdirSync as readdirSync41 } from "node:fs";
+import { existsSync as existsSync109, readdirSync as readdirSync41 } from "node:fs";
 function discoverLiveLitellmConfigPath(opts) {
   const servicesDir = opts?.servicesDir ?? COOLIFY_SERVICES_DIR;
   const readdir2 = opts?.readdirFn ?? ((p) => readdirSync41(p));
-  const exists = opts?.existsFn ?? existsSync108;
+  const exists = opts?.existsFn ?? existsSync109;
   let entries;
   try {
     entries = readdir2(servicesDir);
@@ -70588,7 +70646,7 @@ var init_header_passthrough_guard = __esm(() => {
 });
 
 // src/fleet-health/litellm-config-sensor.ts
-import { readFileSync as readFileSync97, existsSync as existsSync109 } from "node:fs";
+import { readFileSync as readFileSync98, existsSync as existsSync110 } from "node:fs";
 function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitellmConfigPath()) {
   if (explicit)
     return explicit;
@@ -70599,8 +70657,8 @@ function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitel
 }
 function scanLitellmConfig(opts = {}) {
   const path10 = resolveLitellmConfigPath(opts.path, opts.discoverFn);
-  const exists = opts.existsFn ?? existsSync109;
-  const read = opts.readFn ?? ((p) => readFileSync97(p, "utf-8"));
+  const exists = opts.existsFn ?? existsSync110;
+  const read = opts.readFn ?? ((p) => readFileSync98(p, "utf-8"));
   const log = opts.log ?? (() => {});
   const nowIso = opts.nowIso ?? new Date().toISOString();
   if (path10 === null) {
@@ -70675,20 +70733,20 @@ __export(exports_scan, {
   ledgerPathForBase: () => ledgerPathForBase
 });
 import {
-  readFileSync as readFileSync98,
+  readFileSync as readFileSync99,
   readdirSync as readdirSync42,
-  existsSync as existsSync110,
-  mkdirSync as mkdirSync63,
-  writeFileSync as writeFileSync46
+  existsSync as existsSync111,
+  mkdirSync as mkdirSync64,
+  writeFileSync as writeFileSync47
 } from "node:fs";
-import { resolve as resolve61, dirname as dirname42 } from "node:path";
+import { resolve as resolve61, dirname as dirname43 } from "node:path";
 import { homedir as homedir61 } from "node:os";
 function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir61()) {
   return resolve61(home2, ".switchroom");
 }
 function listAgents(base) {
   const dir = resolve61(base, "agents");
-  if (!existsSync110(dir))
+  if (!existsSync111(dir))
     return [];
   try {
     return readdirSync42(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
@@ -70717,16 +70775,16 @@ function runScan(opts = {}) {
     let gwText = "";
     let sawArtifact = false;
     try {
-      if (existsSync110(turnsPath)) {
-        turnsText = readFileSync98(turnsPath, "utf-8");
+      if (existsSync111(turnsPath)) {
+        turnsText = readFileSync99(turnsPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
       log(`fleet-health: WARN skipping ${agent} turns.jsonl unreadable: ${String(e)}`);
     }
     try {
-      if (existsSync110(gwPath)) {
-        gwText = readFileSync98(gwPath, "utf-8");
+      if (existsSync111(gwPath)) {
+        gwText = readFileSync99(gwPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -70768,20 +70826,20 @@ function runScan(opts = {}) {
 function readLedgerIfPresent(base) {
   const path10 = ledgerPathForBase(base);
   try {
-    if (!existsSync110(path10))
+    if (!existsSync111(path10))
       return null;
-    return JSON.parse(readFileSync98(path10, "utf-8"));
+    return JSON.parse(readFileSync99(path10, "utf-8"));
   } catch {
     return null;
   }
 }
 function ledgerPathForBase(base) {
-  return fleetHealthLedgerPath(dirname42(base));
+  return fleetHealthLedgerPath(dirname43(base));
 }
 function writeLedger(base, ledger) {
   const path10 = ledgerPathForBase(base);
-  mkdirSync63(dirname42(path10), { recursive: true });
-  writeFileSync46(path10, JSON.stringify(ledger, null, 2) + `
+  mkdirSync64(dirname43(path10), { recursive: true });
+  writeFileSync47(path10, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path10;
 }
@@ -85438,6 +85496,174 @@ function reflectAcrossAgents(config) {
   return { eligible, excluded, commands };
 }
 
+// src/memory/observation-scope-cleanup.ts
+var CLEANUP_VOLATILE_PATTERNS = [
+  /^parent_session:/,
+  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(-sub-.+)?$/
+];
+var CLEANUP_STALE_PATTERNS = [/^agent-[0-9a-f]{8,}$/];
+function matchesAny(tag, patterns) {
+  return patterns.some((p) => p.test(tag));
+}
+function scopeKey(tags) {
+  return tags.length === 0 ? "shared" : [...tags].sort().join(",");
+}
+function planScopeCleanup(bankId, scopes, options = {}) {
+  const volatilePatterns = options.volatilePatterns ?? CLEANUP_VOLATILE_PATTERNS;
+  const stalePatterns = options.stalePatterns ?? CLEANUP_STALE_PATTERNS;
+  const retireStale = options.retireStale ?? false;
+  const totalScopes = scopes.length;
+  const totalObservations = scopes.reduce((n, s) => n + s.count, 0);
+  const reclassified = [];
+  const breakdown = {
+    allVolatileScopes: 0,
+    allVolatileObservations: 0,
+    mixedScopes: 0,
+    mixedObservations: 0,
+    staleScopes: 0,
+    staleObservations: 0
+  };
+  const targets = new Map;
+  for (const s of scopes) {
+    const volatileTags = s.tags.filter((t) => matchesAny(t, volatilePatterns));
+    const staleTags = s.tags.filter((t) => matchesAny(t, stalePatterns));
+    const stripped = s.tags.filter((t) => {
+      if (matchesAny(t, volatilePatterns))
+        return false;
+      if (retireStale && matchesAny(t, stalePatterns))
+        return false;
+      return true;
+    });
+    const toKey = scopeKey(stripped);
+    const changed = scopeKey(s.tags) !== toKey;
+    const hasStable = s.tags.some((t) => !matchesAny(t, volatilePatterns) && !matchesAny(t, stalePatterns));
+    if (staleTags.length > 0) {
+      breakdown.staleScopes += 1;
+      breakdown.staleObservations += s.count;
+    }
+    if (volatileTags.length > 0 && !hasStable && staleTags.length === 0) {
+      breakdown.allVolatileScopes += 1;
+      breakdown.allVolatileObservations += s.count;
+    } else if (volatileTags.length > 0 && hasStable) {
+      breakdown.mixedScopes += 1;
+      breakdown.mixedObservations += s.count;
+    }
+    const entry = targets.get(toKey) ?? { sources: 0, observations: 0, changed: false };
+    entry.sources += 1;
+    entry.observations += s.count;
+    entry.changed = entry.changed || changed;
+    targets.set(toKey, entry);
+    if (changed) {
+      reclassified.push({
+        from: s.tags,
+        to: toKey,
+        count: s.count,
+        strippedVolatile: volatileTags,
+        strippedStale: retireStale ? staleTags : []
+      });
+    }
+  }
+  reclassified.sort((a, b) => b.count - a.count);
+  const merges = [...targets.entries()].filter(([, v]) => v.sources > 1 && v.changed).map(([target, v]) => ({ target, sourceScopes: v.sources, observations: v.observations })).sort((a, b) => b.observations - a.observations);
+  const affectedObservations = reclassified.reduce((n, r) => n + r.count, 0);
+  const resultingScopeCount = targets.size;
+  return {
+    bankId,
+    ok: true,
+    totalScopes,
+    totalObservations,
+    reclassified,
+    merges,
+    affectedScopes: reclassified.length,
+    affectedObservations,
+    resultingScopeCount,
+    scopeReduction: totalScopes - resultingScopeCount,
+    breakdown
+  };
+}
+async function getJson2(url, opts) {
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const timeoutMs = opts?.timeoutMs ?? 15000;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(url, { signal: controller.signal });
+    clearTimeout(timeout);
+    if (!resp.ok)
+      return { ok: false, reason: `HTTP ${resp.status}` };
+    return { ok: true, data: await resp.json() };
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err.name === "AbortError")
+      return { ok: false, reason: "Timeout" };
+    return { ok: false, reason: String(err.message ?? err) };
+  }
+}
+async function planBankCleanup(apiUrl, bankId, options = {}, fetchOpts) {
+  const base = hindsightRestBase(apiUrl);
+  const bank = encodeURIComponent(bankId);
+  const resp = await getJson2(`${base}/v1/default/banks/${bank}/observations/scopes`, fetchOpts);
+  if (!resp.ok) {
+    return {
+      bankId,
+      ok: false,
+      reason: resp.reason,
+      totalScopes: 0,
+      totalObservations: 0,
+      reclassified: [],
+      merges: [],
+      affectedScopes: 0,
+      affectedObservations: 0,
+      resultingScopeCount: 0,
+      scopeReduction: 0,
+      breakdown: {
+        allVolatileScopes: 0,
+        allVolatileObservations: 0,
+        mixedScopes: 0,
+        mixedObservations: 0,
+        staleScopes: 0,
+        staleObservations: 0
+      }
+    };
+  }
+  const raw = resp.data?.scopes;
+  const scopes = [];
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      const tags = entry?.tags;
+      const count = entry?.count;
+      if (!Array.isArray(tags) || typeof count !== "number")
+        continue;
+      if (!tags.every((t) => typeof t === "string"))
+        continue;
+      scopes.push({ tags, count });
+    }
+  }
+  return planScopeCleanup(bankId, scopes, options);
+}
+function formatCleanupPlan(plan, maxMerges = 10) {
+  if (!plan.ok) {
+    return `bank ${plan.bankId}: UNREADABLE (${plan.reason ?? "unknown"})`;
+  }
+  const b = plan.breakdown;
+  const lines = [];
+  lines.push(`bank ${plan.bankId}`);
+  lines.push(`  today: ${plan.totalScopes} scopes, ${plan.totalObservations.toLocaleString()} observations`);
+  lines.push(`  legacy fragmentation:` + ` all-volatile ${b.allVolatileScopes} scopes / ${b.allVolatileObservations.toLocaleString()} obs;` + ` mixed ${b.mixedScopes} scopes / ${b.mixedObservations.toLocaleString()} obs;` + ` stale agent-<hex> ${b.staleScopes} scopes / ${b.staleObservations.toLocaleString()} obs`);
+  lines.push(`  WOULD change: ${plan.affectedScopes} scopes` + ` (${plan.affectedObservations.toLocaleString()} obs re-homed),` + ` ${plan.totalScopes} \u2192 ${plan.resultingScopeCount} scopes` + ` (\u2212${plan.scopeReduction})`);
+  if (plan.merges.length > 0) {
+    lines.push(`  top merges:`);
+    for (const m of plan.merges.slice(0, maxMerges)) {
+      lines.push(`    ${m.sourceScopes} scopes \u2192 ${m.target}  (${m.observations.toLocaleString()} obs)`);
+    }
+    if (plan.merges.length > maxMerges) {
+      lines.push(`    +${plan.merges.length - maxMerges} more merge targets`);
+    }
+  }
+  return lines.join(`
+`);
+}
+
 // src/cli/memory.ts
 init_helpers();
 init_hindsight();
@@ -86164,6 +86390,55 @@ Demoting memory ${source_default.cyan(memoryId)}`));
 ` + "  If the ID itself is suspect: `switchroom memory recall-log " + agent + " --json`."));
     process.exit(1);
   }));
+  memory.command("cleanup-scopes [agent]").description("Dry-run audit of legacy pre-#4035 observation-scope fragmentation " + "(per-session UUID islands, stale agent-<hex> scopes). Reads only; " + "prints the blast radius of a curated re-home. Pass an agent, or --all.").option("--all", "Audit every agent bank and profile bank").option("--retire-stale", "Also fold stale agent-<hex> producer scopes into shared (opt-in; not part of the #4035 heal)").option("--execute", "(refused) live mutation is not supported \u2014 see the printed reason").option("--json", "Emit the plans as JSON").action(withConfigError(async (agent, opts) => {
+    const config = getConfig(program3);
+    const apiUrl = config.memory?.config?.url ?? HINDSIGHT_DEFAULT_MCP_URL;
+    if (opts.execute) {
+      console.error(source_default.red("\u2717 --execute is not supported: legacy-scope healing is not mechanizable"));
+      console.error(source_default.gray(`  Hindsight exposes no per-memory tag-write (update_memory / PATCH memories/{id}
+` + "  silently drop a `tags` argument, #3772) and no per-scope delete (DELETE\n" + `  .../observations clears the WHOLE bank). So an observation's scope cannot be
+` + `  edited in place, and this tool stays a read-only audit. A live heal needs an
+` + `  upstream tag-write path or a deliberate, operator-approved enumerate-and-
+` + "  invalidate pass \u2014 neither is run from here."));
+      process.exit(1);
+    }
+    const banks = new Set;
+    if (agent) {
+      if (!config.agents[agent]) {
+        console.error(source_default.red(`Agent "${agent}" is not defined in switchroom.yaml`));
+        process.exit(1);
+      }
+      banks.add(getCollectionForAgent(agent, config));
+    } else if (opts.all) {
+      for (const name of Object.keys(config.agents)) {
+        banks.add(getCollectionForAgent(name, config));
+      }
+      for (const bank of collectProfileBanks(config))
+        banks.add(bank);
+    } else {
+      console.error(source_default.red("Pass an agent name, or --all to audit every bank."));
+      process.exit(1);
+    }
+    const plans = await Promise.all([...banks].map((bankId) => planBankCleanup(apiUrl, bankId, { retireStale: opts.retireStale })));
+    plans.sort((a, b) => b.affectedObservations - a.affectedObservations);
+    if (opts.json) {
+      console.log(JSON.stringify(plans, null, 2));
+      return;
+    }
+    console.log(source_default.bold(`
+Observation-scope cleanup \u2014 DRY RUN (no writes)
+`));
+    console.log(source_default.gray(`  api=${apiUrl}  retireStale=${Boolean(opts.retireStale)}
+`));
+    for (const plan of plans) {
+      console.log(formatCleanupPlan(plan));
+      console.log();
+    }
+    const totalObs = plans.reduce((n, p) => n + p.affectedObservations, 0);
+    const totalScopes = plans.reduce((n, p) => n + p.scopeReduction, 0);
+    console.log(source_default.cyan(`Fleet total (would change): ${totalObs.toLocaleString()} observations re-homed, ` + `${totalScopes.toLocaleString()} scopes removed.`));
+    console.log(source_default.gray("Nothing was written. Live execution is not supported from this tool " + "(--execute prints why)."));
+  }));
   const restBase = (url) => (url ?? HINDSIGHT_DEFAULT_MCP_URL).replace(/\/mcp\/?$/, "").replace(/\/$/, "");
   const VALID_BANK = /^[a-zA-Z0-9_.-]+$/;
   const profile = memory.command("profile").description("Author + inspect operator profile banks (shared/per-user memory; wire via memory.recall.additional_banks)");
@@ -92108,9 +92383,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync74, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
-import { spawnSync as spawnSync16 } from "node:child_process";
-import { join as join84, dirname as dirname33, resolve as resolve45 } from "node:path";
+import { existsSync as existsSync81, mkdirSync as mkdirSync46, readFileSync as readFileSync75, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { join as join84, dirname as dirname34, resolve as resolve45 } from "node:path";
 import { homedir as homedir44 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -92639,10 +92914,151 @@ function defaultSelfUpdateIO() {
 // src/cli/update.ts
 init_self_invoke();
 init_component_versions();
+init_install_cron();
+
+// src/host-cli-self-heal/install-timer.ts
+import { spawnSync as spawnSync16 } from "node:child_process";
+import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync74, renameSync as renameSync20, writeFileSync as writeFileSync31 } from "node:fs";
+import { dirname as dirname33 } from "node:path";
+var SERVICE_PATH = "/etc/systemd/system/switchroom-self-heal.service";
+var TIMER_PATH = "/etc/systemd/system/switchroom-self-heal.timer";
+var TIMER_UNIT = "switchroom-self-heal.timer";
+var SYSTEMD_MARKER = "/run/systemd/system";
+var DOC_URL = "https://github.com/switchroom/switchroom/blob/main/docs/operators/host-cli-self-heal.md";
+function renderService(opts) {
+  const homeLine = opts.home ? `Environment=HOME=${opts.home}
+` : "";
+  return `# switchroom host CLI self-heal \u2014 keeps /usr/local/bin/switchroom from silently
+` + `# trailing the fleet. Managed by \`switchroom update\`; edits are overwritten.
+` + `[Unit]
+` + `Description=Switchroom host CLI self-heal (re-run \`switchroom update\` so the host binary can't silently trail the fleet)
+` + `Documentation=${DOC_URL}
+` + `After=network-online.target docker.service
+` + `Wants=network-online.target
+` + `
+` + `[Service]
+` + `Type=oneshot
+` + `# Run as the operator whose ~/.switchroom holds the fleet config \u2014 NOT root.
+` + `User=${opts.user}
+` + homeLine + `# --skip-images keeps each tick cheap: self-update-cli (the host binary swap)
+` + `# still runs; GHCR pulls and container recreation do not.
+` + `ExecStart=${opts.binary} update --skip-images
+` + `# Self-heal must never wedge the host: bound the run and run at low priority.
+` + `TimeoutStartSec=600
+` + `Nice=10
+`;
+}
+function renderTimer() {
+  return `# switchroom host CLI self-heal timer. Managed by \`switchroom update\`.
+` + `[Unit]
+` + `Description=Run the Switchroom host CLI self-heal every 30 minutes
+` + `Documentation=${DOC_URL}
+` + `
+` + `[Timer]
+` + `OnBootSec=5min
+` + `OnUnitActiveSec=30min
+` + `RandomizedDelaySec=2min
+` + `Persistent=true
+` + `
+` + `[Install]
+` + `WantedBy=timers.target
+`;
+}
+function writeUnitIdempotent(path7, content) {
+  if (existsSync80(path7)) {
+    try {
+      if (readFileSync74(path7, "utf8") === content)
+        return "unchanged";
+    } catch {}
+  }
+  mkdirSync45(dirname33(path7), { recursive: true });
+  const tmp = `${path7}.${process.pid}.tmp`;
+  writeFileSync31(tmp, content, { mode: 420 });
+  renameSync20(tmp, path7);
+  return "written";
+}
+function homeFromPasswd(user) {
+  try {
+    for (const line of readFileSync74("/etc/passwd", "utf8").split(`
+`)) {
+      const f = line.split(":");
+      if (f[0] === user && f[5])
+        return f[5];
+    }
+  } catch {}
+  return;
+}
+function resolveOperatorUser(env2) {
+  const user = env2.SUDO_USER ?? env2.USER ?? env2.LOGNAME;
+  if (!user || user === "root")
+    return null;
+  return user;
+}
+function installSelfHealTimer(deps = {}) {
+  const env2 = deps.env ?? process.env;
+  const systemdBooted = deps.systemdBooted ?? (() => existsSync80(SYSTEMD_MARKER));
+  const geteuid = deps.geteuid ?? (() => typeof process.geteuid === "function" ? process.geteuid() : undefined);
+  const homeForUser = deps.homeForUser ?? homeFromPasswd;
+  const servicePath = deps.servicePath ?? SERVICE_PATH;
+  const timerPath = deps.timerPath ?? TIMER_PATH;
+  const binary = env2.SWITCHROOM_BINARY ?? "/usr/local/bin/switchroom";
+  const user = resolveOperatorUser(env2);
+  const renderUser = user ?? "OPERATOR";
+  const home2 = user ? homeForUser(user) : undefined;
+  const serviceContent = renderService({ binary, user: renderUser, ...home2 ? { home: home2 } : {} });
+  const timerContent = renderTimer();
+  const manualCommands = [
+    "sudo systemctl daemon-reload",
+    `sudo systemctl enable --now ${TIMER_UNIT}`
+  ];
+  const base = { servicePath, timerPath, serviceContent, timerContent, manualCommands };
+  if (!binary.startsWith("/")) {
+    return {
+      status: "skipped",
+      reason: `SWITCHROOM_BINARY must be an absolute path (got ${binary})`,
+      ...base
+    };
+  }
+  if (!systemdBooted()) {
+    return {
+      status: "skipped",
+      reason: "host is not systemd-booted (/run/systemd/system absent)",
+      ...base
+    };
+  }
+  if (geteuid() !== 0) {
+    return { status: "skipped", reason: "not privileged (euid != 0)", ...base };
+  }
+  if (!user) {
+    return {
+      status: "skipped",
+      reason: "no non-root operator user resolvable (SUDO_USER / USER / LOGNAME all unset or root)",
+      ...base
+    };
+  }
+  const svc = writeUnitIdempotent(servicePath, serviceContent);
+  const tim = writeUnitIdempotent(timerPath, timerContent);
+  const changed = svc === "written" || tim === "written";
+  const runner = deps.runner ?? ((cmd, args) => {
+    const r = spawnSync16(cmd, args, { stdio: "inherit" });
+    return { status: r.status ?? 1 };
+  });
+  const reload = runner("systemctl", ["daemon-reload"]);
+  if (reload.status !== 0) {
+    throw new Error(`systemctl daemon-reload failed (exit ${reload.status})`);
+  }
+  const enable = runner("systemctl", ["enable", "--now", TIMER_UNIT]);
+  if (enable.status !== 0) {
+    throw new Error(`systemctl enable --now ${TIMER_UNIT} failed (exit ${enable.status})`);
+  }
+  return { status: changed ? "installed" : "unchanged", ...base };
+}
+
+// src/cli/update.ts
 function defaultPersistPin(configPath) {
   return (pin) => {
     const path7 = configPath ?? findConfigFile();
-    const before = readFileSync74(path7, "utf8");
+    const before = readFileSync75(path7, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
@@ -92658,16 +93074,16 @@ function defaultPersistPin(configPath) {
 }
 var DEFAULT_COMPOSE_PATH2 = join84(homedir44(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname33(scriptPath);
+  let dir = dirname34(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync80(join84(dir, ".git"))) {
+    if (existsSync81(join84(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync74(join84(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync75(join84(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
     }
-    const parent = dirname33(dir);
+    const parent = dirname34(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -92728,7 +93144,7 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath,
         scriptPath,
-        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync80("/.dockerenv")
+        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync81("/.dockerenv")
       });
       if (detection.kind !== "static-binary") {
         say(source_default.gray(`  host CLI not self-updated: ${detection.reason}
@@ -92801,7 +93217,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync80(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync81(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -92846,6 +93262,69 @@ function planUpdate(opts) {
         throw new Error("switchroom apply failed");
     }
   });
+  steps.push({
+    name: "reconcile-hindsight-watch-cron",
+    description: "Reconcile /etc/cron.d/hindsight-watch (binary path / schedule / flags) on already-armed hosts \u2014 idempotent; no-op when unarmed or already current",
+    skipReason: hostdContext ? "deferred (hostd-context): /etc/cron.d is on the host, not in the hostd container \u2014 finish host-side with `switchroom hindsight-watch --install-cron`" : undefined,
+    isHostdDeferred: hostdContext,
+    run: () => {
+      const say = opts.stdout ?? ((t) => process.stdout.write(t));
+      const binary = process.env.SWITCHROOM_BINARY ?? "/usr/local/bin/switchroom";
+      const fallbackUser = process.env.SUDO_USER ?? process.env.USER ?? process.env.LOGNAME;
+      let res;
+      try {
+        res = reconcileCron({
+          binary,
+          fallbackUser,
+          ...opts.watchCronPath ? { path: opts.watchCronPath } : {}
+        });
+      } catch (e) {
+        say(source_default.yellow(`  hindsight-watch cron not reconciled: ${e.message}
+`));
+        return;
+      }
+      if (res.status === "absent") {
+        say(source_default.gray("  hindsight-watch cron not armed \u2014 skipping reconcile " + "(arm with `switchroom hindsight-watch --install-cron`; doctor FAILs while unarmed)\n"));
+      } else if (res.status === "reconciled") {
+        say(source_default.green(`  hindsight-watch cron reconciled at ${res.path}
+`));
+      } else {
+        say(source_default.gray(`  hindsight-watch cron already current at ${res.path}
+`));
+      }
+    }
+  });
+  steps.push({
+    name: "install-self-heal-timer",
+    description: "Install + enable the switchroom-self-heal systemd timer so a shipped release converges the host binary automatically \u2014 graceful no-op without systemd/privilege",
+    skipReason: hostdContext ? "deferred (hostd-context): /etc/systemd/system is on the host, not in the hostd container \u2014 finish host-side by re-running `switchroom update` on the host" : undefined,
+    isHostdDeferred: hostdContext,
+    run: () => {
+      const say = opts.stdout ?? ((t) => process.stdout.write(t));
+      let res;
+      try {
+        res = installSelfHealTimer(opts.selfHealTimerDeps ?? {});
+      } catch (e) {
+        say(source_default.yellow(`  self-heal timer not installed: ${e.message}
+`));
+        return;
+      }
+      if (res.status === "installed") {
+        say(source_default.green(`  self-heal timer installed + enabled (${res.servicePath}, ${res.timerPath})
+`));
+      } else if (res.status === "unchanged") {
+        say(source_default.gray(`  self-heal timer already current + enabled at ${res.timerPath}
+`));
+      } else {
+        say(source_default.gray(`  self-heal timer not installed automatically: ${res.reason}
+`) + source_default.gray(`  Install it by hand:
+`) + source_default.gray(`    # ${res.servicePath}
+`) + res.serviceContent.replace(/^/gm, source_default.gray("    ")) + source_default.gray(`    # ${res.timerPath}
+`) + res.timerContent.replace(/^/gm, source_default.gray("    ")) + res.manualCommands.map((c) => source_default.gray(`    ${c}
+`)).join(""));
+      }
+    }
+  });
   let hostControlEnabled;
   if (typeof opts.hostControlEnabled === "boolean") {
     hostControlEnabled = opts.hostControlEnabled;
@@ -92922,13 +93401,13 @@ function planUpdate(opts) {
       }
       const source = resolve45(import.meta.dirname, "../../skills");
       const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
-      if (!existsSync80(source)) {
+      if (!existsSync81(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        mkdirSync45(dirname33(dest), { recursive: true });
+        mkdirSync46(dirname34(dest), { recursive: true });
         const r = syncBundledSkills({
           source,
           dest,
@@ -92954,10 +93433,10 @@ function planUpdate(opts) {
       if (opts.syncBundledSkillsFn)
         return;
       const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
-      if (!existsSync80(dest)) {
+      if (!existsSync81(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync80(join84(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync81(join84(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -92992,7 +93471,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync74(composePath, "utf8");
+        const composeText = readFileSync75(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -93026,7 +93505,7 @@ function planUpdate(opts) {
   return steps;
 }
 function defaultRunner2(cmd, args) {
-  const r = spawnSync16(cmd, args, { stdio: "inherit" });
+  const r = spawnSync17(cmd, args, { stdio: "inherit" });
   return { status: r.status ?? 1 };
 }
 function writeMarkerInPreferredLocation(agent, reason, runner) {
@@ -93069,12 +93548,12 @@ function defaultStatusProbe(composePath) {
       try {
         cliBuiltAt = new Date(statSync45(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname33(scriptPath);
+      let dir = dirname34(scriptPath);
       for (let i = 0;i < 8; i++) {
         const pkgPath = join84(dir, "package.json");
-        if (existsSync80(pkgPath)) {
+        if (existsSync81(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync74(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync75(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -93082,7 +93561,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname33(dir);
+        const parent = dirname34(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -93095,13 +93574,13 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync80(composePath)) {
+  if (!existsSync81(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
   let serviceList = [];
   try {
-    const r = spawnSync16("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
+    const r = spawnSync17("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
     if (r.status !== 0) {
       warnings.push(`docker compose config --services failed: ${r.stderr?.trim() ?? r.error?.message ?? "unknown"}`);
       return { cliVersion, cliBuiltAt, services, warnings };
@@ -93118,7 +93597,7 @@ function defaultStatusProbe(composePath) {
     let containerCreatedAt = null;
     let status = "<unknown>";
     try {
-      const r = spawnSync16("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
+      const r = spawnSync17("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
       if (r.status === 0) {
         const [img, created, st] = r.stdout.trim().split("|");
         image = img ?? null;
@@ -93134,7 +93613,7 @@ function defaultStatusProbe(composePath) {
     let imagePulledAt = null;
     if (image) {
       try {
-        const r = spawnSync16("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
+        const r = spawnSync17("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
         if (r.status === 0) {
           const [id, created, lastTag] = r.stdout.trim().split("|");
           imageDigestShort = id?.replace(/^sha256:/, "").slice(0, 12) ?? null;
@@ -93209,7 +93688,7 @@ function buildReexecArgs(opts) {
   return args;
 }
 function defaultReexec(binaryPath, args) {
-  const r = spawnSync16(binaryPath, args, {
+  const r = spawnSync17(binaryPath, args, {
     stdio: "inherit",
     env: { ...process.env, [SELF_UPDATE_ENV_SENTINEL]: "1" }
   });
@@ -93218,7 +93697,7 @@ function defaultReexec(binaryPath, args) {
 function renderDriftPreamble(opts) {
   try {
     const exec = opts.componentExec ?? ((cmd, args) => {
-      const r = spawnSync16(cmd, args, { encoding: "utf-8", timeout: 1e4 });
+      const r = spawnSync17(cmd, args, { encoding: "utf-8", timeout: 1e4 });
       return { status: r.status ?? 1, stdout: r.stdout ?? "" };
     });
     let pin;
@@ -93342,23 +93821,23 @@ function registerUpdateCommand(program3) {
 
 // src/cli/rollout.ts
 init_helpers();
-import { spawnSync as spawnSync18 } from "node:child_process";
-import { readFileSync as readFileSync76, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
+import { spawnSync as spawnSync19 } from "node:child_process";
+import { readFileSync as readFileSync77, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
 import { homedir as homedir46 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync81,
-  readFileSync as readFileSync75,
-  writeFileSync as writeFileSync31,
-  renameSync as renameSync20,
+  existsSync as existsSync82,
+  readFileSync as readFileSync76,
+  writeFileSync as writeFileSync32,
+  renameSync as renameSync21,
   unlinkSync as unlinkSync15,
   statSync as statSync46,
-  mkdirSync as mkdirSync46
+  mkdirSync as mkdirSync47
 } from "node:fs";
 import { homedir as homedir45 } from "node:os";
 import { createHash as createHash17 } from "node:crypto";
-import { join as join85, basename as basename9, resolve as resolve46, dirname as dirname34 } from "node:path";
+import { join as join85, basename as basename9, resolve as resolve46, dirname as dirname35 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -93367,7 +93846,7 @@ function pinJournalDir(configPath) {
   if (override && override.trim().length > 0)
     return override.trim();
   if (configPath) {
-    const dir = dirname34(resolve46(configPath));
+    const dir = dirname35(resolve46(configPath));
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
@@ -93410,9 +93889,9 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync75(p, "utf8");
+    raw = readFileSync76(p, "utf8");
   } catch (e) {
-    if (existsSync81(p)) {
+    if (existsSync82(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
 `);
     }
@@ -93463,7 +93942,7 @@ function beginPinPersist(configPath, pin, opts = {}) {
     warn(`\u26a0\ufe0f  rollout pin journal: overwriting an ABANDONED journal at ${p} ` + `(pid ${existing.pid} recorded ${existing.at}, provisional pin ` + `${existing.pin}). Its roll never committed or reverted; \`release.pin\` ` + `in ${configPath} may still name that unproven build \u2014 verify it.
 `);
   }
-  const priorPin = getReleasePinFromConfig(readFileSync75(configPath, "utf8"));
+  const priorPin = getReleasePinFromConfig(readFileSync76(configPath, "utf8"));
   const journal = {
     v: 1,
     configPath,
@@ -93472,10 +93951,10 @@ function beginPinPersist(configPath, pin, opts = {}) {
     pid: process.pid,
     at: new Date().toISOString()
   };
-  mkdirSync46(dirname34(p), { recursive: true });
+  mkdirSync47(dirname35(p), { recursive: true });
   const tmp = `${p}.${process.pid}.tmp`;
-  writeFileSync31(tmp, JSON.stringify(journal), { encoding: "utf8", mode: 384 });
-  renameSync20(tmp, p);
+  writeFileSync32(tmp, JSON.stringify(journal), { encoding: "utf8", mode: 384 });
+  renameSync21(tmp, p);
   return journal;
 }
 function commitPinPersist(configPath) {
@@ -93484,7 +93963,7 @@ function commitPinPersist(configPath) {
     unlinkSync15(p);
     return null;
   } catch (e) {
-    if (!existsSync81(p))
+    if (!existsSync82(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side \u2014 while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -93506,7 +93985,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync75(configPath, "utf8");
+    const current = readFileSync76(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
@@ -93515,7 +93994,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     if (opts.writeConfig) {
       opts.writeConfig(configPath, next, mode);
     } else {
-      writeFileSync31(configPath, next, { encoding: "utf8", mode });
+      writeFileSync32(configPath, next, { encoding: "utf8", mode });
     }
   } catch (e) {
     return {
@@ -93561,12 +94040,13 @@ init_atomic();
 init_resolve_version();
 init_audit_reader();
 init_hindsight();
+init_hindsight2();
 
 // src/cli/deploy-version-guard.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 var DOCKER_INSPECT_TIMEOUT_MS = 60 * 1000;
 var defaultRunner3 = (args) => {
-  const r = spawnSync17("docker", args, {
+  const r = spawnSync18("docker", args, {
     encoding: "utf8",
     timeout: DOCKER_INSPECT_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -93608,22 +94088,31 @@ function checkDowngrade(opts) {
 init_agent_owned_tree();
 init_component_versions();
 var VERIFY_COMPONENTS_STEP = "verify-components";
+var ENSURE_BANKS_STEP = "ensure-banks";
 function normalizeVersion(v) {
   return v.trim().replace(/^v/, "");
 }
 function isVersionAssertable(target) {
   return /^v?\d+\.\d+\.\d+$/.test(target.trim());
 }
-function orderAgentsCanaryFirst(agents) {
+var ROLLOUT_PRIORITY_AGENTS = [
+  "overlord",
+  "carrie",
+  "finn"
+];
+function orderAgentsForRoll(agents) {
   const canary = agents.filter((a) => a === "test-harness");
-  const rest = agents.filter((a) => a !== "test-harness");
-  return [...canary, ...rest];
+  const priority = ROLLOUT_PRIORITY_AGENTS.filter((p) => p !== "test-harness" && agents.includes(p));
+  const prioritySet = new Set(priority);
+  const rest = agents.filter((a) => a !== "test-harness" && !prioritySet.has(a));
+  return [...canary, ...priority, ...rest];
 }
 function planRollout(agents, opts = {}) {
   const steps = [];
-  const ordered = orderAgentsCanaryFirst(agents);
+  const ordered = orderAgentsForRoll(agents);
   if (opts.hostdContext) {
     steps.push({ kind: "apply" });
+    steps.push({ kind: "refresh-hindsight" });
     const [canary, ...rest] = ordered;
     if (canary !== undefined) {
       steps.push({ kind: "restart-agent", agent: canary });
@@ -93639,23 +94128,26 @@ function planRollout(agents, opts = {}) {
     if (!opts.skipWeb) {
       steps.push({ kind: "refresh-web" });
     }
-    steps.push({ kind: "refresh-hindsight" });
     steps.push({ kind: "sweep" });
+    steps.push({ kind: "ensure-banks" });
     steps.push({ kind: "verify-components" });
     return steps;
   }
   if (opts.pinToPersist)
     steps.push({ kind: "persist-pin", pin: opts.pinToPersist });
   steps.push({ kind: "apply" });
+  if (!opts.skipWeb) {
+    steps.push({ kind: "refresh-hindsight" });
+  }
   for (const agent of ordered) {
     steps.push({ kind: "restart-agent", agent });
   }
   if (!opts.skipWeb) {
     steps.push({ kind: "refresh-web" });
     steps.push({ kind: "refresh-hostd" });
-    steps.push({ kind: "refresh-hindsight" });
   }
   steps.push({ kind: "sweep" });
+  steps.push({ kind: "ensure-banks" });
   steps.push({ kind: "verify-components" });
   return steps;
 }
@@ -93686,6 +94178,9 @@ function formatRolloutPlan(steps, target) {
       case "sweep":
         lines.push(`  ${n}. sweep \u2014 print per-agent version table`);
         break;
+      case "ensure-banks":
+        lines.push(`  ${n}. ensure-banks \u2014 create any missing agent Hindsight bank ` + `(idempotent backstop; structured failure if one stays missing)`);
+        break;
       case "verify-components":
         lines.push(`  ${n}. verify-components \u2014 assert EVERY in-scope component is on ${target} ` + `(same inventory \`switchroom update --check\` uses); non-zero exit if any is behind`);
         break;
@@ -93747,7 +94242,7 @@ function evaluateRolloutDrift(components, target, steps, hostdContext) {
   const { gated, exempt } = partitionDrift(report.behind, { owners, rolledAgents });
   return { gated, exempt, target: report.target };
 }
-function executeRollout(steps, target, deps, execOpts = {}) {
+async function executeRollout(steps, target, deps, execOpts = {}) {
   const targetNorm = normalizeVersion(target);
   const rolled = [];
   const warnings = [];
@@ -93756,6 +94251,7 @@ function executeRollout(steps, target, deps, execOpts = {}) {
   let agentIndex = 0;
   let pinPersisted = false;
   let driftVerdict = null;
+  const bankEnsureFailed = [];
   const fail4 = (partial) => {
     let pinReverted = false;
     if (pinPersisted && deps.revertPin) {
@@ -93860,6 +94356,10 @@ function executeRollout(steps, target, deps, execOpts = {}) {
           const webTag = deps.webImageTag?.();
           if (webTag !== undefined && webTag !== null && isVersionAssertable(webTag) && normalizeVersion(webTag) !== targetNorm) {
             warnings.push(`web refresh completed but switchroom-web is running ${webTag}, ` + `NOT the roll target ${target} (most likely its downgrade guard ` + `skipped the install). Finish it host-side: \`switchroom webd ` + `install --tag ${target} --allow-downgrade\`.`);
+            break;
+          }
+          if (webTag !== undefined && webTag !== null && isVersionAssertable(webTag) && normalizeVersion(webTag) === targetNorm) {
+            emit({ phase: "web-refresh-done", target });
           }
           break;
         }
@@ -93875,9 +94375,11 @@ function executeRollout(steps, target, deps, execOpts = {}) {
           const hindsightExists = deps.hindsightExists ?? isHindsightContainerExists;
           if (!hindsightExists()) {
             deps.log(`ROLL_STEP refresh-hindsight \u2014 no hindsight container on this host; skipping`);
+            emit({ phase: "hindsight-skipped", target });
             break;
           }
           deps.log(`ROLL_STEP refresh-hindsight \u2014 memory setup --recreate --tag ${target} (pull ${target} + recreate)`);
+          emit({ phase: "hindsight-refresh", target });
           const r = deps.run(["memory", "setup", "--recreate", "--tag", target]);
           if (r.status !== 0) {
             deps.log(`  \u2717 hindsight recreate FAILED \u2014 the memory backend is DOWN (the ` + `recreate stopped + removed the old container before the failed ` + `start). Run \`switchroom memory setup\` to bring it back. \u2014 STOPPING`);
@@ -93886,6 +94388,7 @@ function executeRollout(steps, target, deps, execOpts = {}) {
               ...r.timedOut ? { timedOut: true } : {}
             });
           }
+          emit({ phase: "hindsight-refresh-done", target });
           break;
         }
         case "sweep": {
@@ -93896,6 +94399,38 @@ function executeRollout(steps, target, deps, execOpts = {}) {
           }
           break;
         }
+        case "ensure-banks": {
+          const hindsightExists = deps.hindsightExists ?? isHindsightContainerExists;
+          if (!hindsightExists()) {
+            deps.log(`ROLL_STEP ensure-banks \u2014 no hindsight container on this host; skipping`);
+            break;
+          }
+          if (!deps.ensureBank) {
+            warnings.push(`ensure-banks ran with NO bank-ensure hook wired, so brand-new ` + `agents' Hindsight banks were NOT verified. If an agent's first ` + `\`retain\` fails with a foreign-key error, its bank was never ` + `created \u2014 recreate it by restarting that agent.`);
+            break;
+          }
+          deps.log(`ROLL_STEP ensure-banks \u2014 creating any missing agent bank (idempotent) for ${rolled.length} agent(s)`);
+          for (const a of rolled) {
+            let res;
+            try {
+              res = await deps.ensureBank(a);
+            } catch (e) {
+              res = { ok: false, reason: e.message };
+            }
+            if (res.ok) {
+              deps.log(`  ${a}: bank present`);
+              continue;
+            }
+            if (/unreachable|timeout/i.test(res.reason)) {
+              deps.log(`  ${a}: bank check ${res.reason.toLowerCase()} (degraded to warning)`);
+              warnings.push(`ensure-banks could not reach Hindsight to verify ${a}'s bank ` + `(${res.reason}). If ${a} is brand-new and its first \`retain\` ` + `fails with a foreign-key error, restart it to recreate the bank.`);
+              continue;
+            }
+            deps.log(`  \u2717 ${a}: bank could NOT be created \u2014 ${res.reason}`);
+            bankEnsureFailed.push(a);
+          }
+          break;
+        }
         case "verify-components": {
           deps.log(`ROLL_STEP verify-components \u2014 asserting every in-scope component is on ${target}`);
           if (!deps.collectComponents) {
@@ -93934,6 +94469,19 @@ function executeRollout(steps, target, deps, execOpts = {}) {
       warnings.push(`roll succeeded but committing the durable release.pin threw: ` + `${e.message}. The pin IS written; a stale rollout ` + `journal may cause a later boot to revert it \u2014 verify host-side.`);
     }
   }
+  if (bankEnsureFailed.length > 0) {
+    for (const a of bankEnsureFailed) {
+      warnings.push(`${a}'s Hindsight bank could NOT be created during the roll \u2014 its ` + `first \`retain\` will fail with a foreign-key error until the bank ` + `exists. Restart ${a} to re-run its bank creation now that Hindsight ` + `is back up.`);
+    }
+    deps.log(`  \u2717 ensure-banks FAILED \u2014 ${bankEnsureFailed.length} agent bank(s) ` + `could not be created: ${bankEnsureFailed.join(", ")}`);
+    return {
+      ok: false,
+      rolled,
+      warnings,
+      failedStep: ENSURE_BANKS_STEP,
+      drifted: bankEnsureFailed
+    };
+  }
   if (driftVerdict && driftVerdict.gated.length > 0) {
     const normalizedTarget = `v${normalizeVersion(target)}`;
     for (const c of driftVerdict.gated) {
@@ -93990,7 +94538,7 @@ function isSpawnTimeout(r, killSignal) {
 var ROLLOUT_KILL_SIGNAL = "SIGKILL";
 function createRolloutDeps(params) {
   const { configPath, scriptPath, hostdCtx } = params;
-  const spawn6 = params.spawn ?? spawnSync18;
+  const spawn6 = params.spawn ?? spawnSync19;
   const warn = params.warn ?? ((line) => process.stderr.write(line));
   const self = resolveSelfInvocation({
     execPath: params.execPath ?? process.execPath,
@@ -94075,7 +94623,7 @@ function createRolloutDeps(params) {
       return { status: r.ok ? 0 : 1, stdout: r.stdout };
     }),
     persistPin: (pin) => {
-      const before = readFileSync76(configPath, "utf8");
+      const before = readFileSync77(configPath, "utf8");
       const after = setReleasePinInConfig(before, pin);
       if (after === before)
         return false;
@@ -94100,7 +94648,12 @@ function createRolloutDeps(params) {
 `);
       }
       return outcome.reverted;
-    }
+    },
+    ...params.hindsightApiUrl && params.resolveBankId ? {
+      ensureBank: (agent) => createBank(params.hindsightApiUrl, params.resolveBankId(agent), {
+        timeoutMs: 5000
+      })
+    } : {}
   };
 }
 function registerRolloutCommand(program3) {
@@ -94193,10 +94746,23 @@ function registerRolloutCommand(program3) {
     }
     const configPath = getConfigPath(program3);
     const scriptPath = process.argv[1] ?? "";
-    const deps = createRolloutDeps({ configPath, scriptPath, hostdCtx });
+    let hindsightApiUrl;
+    let resolveBankId;
+    if (isHindsightEnabled(config)) {
+      const rawUrl = config.memory?.config?.url;
+      hindsightApiUrl = rawUrl ? rawUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "") : HINDSIGHT_DEFAULT_API_BASE_URL;
+      resolveBankId = (agent) => config.agents?.[agent]?.memory?.collection ?? agent;
+    }
+    const deps = createRolloutDeps({
+      configPath,
+      scriptPath,
+      hostdCtx,
+      hindsightApiUrl,
+      resolveBankId
+    });
     process.stdout.write(`${opts.allowDowngrade ? "Rolling back" : "Rolling"} ${requested.length} agent(s) to ${target}\u2026
 `);
-    const result = executeRollout(steps, target, deps, {
+    const result = await executeRollout(steps, target, deps, {
       hostdContext: hostdCtx,
       allowDowngrade: opts.allowDowngrade
     });
@@ -94217,6 +94783,15 @@ function registerRolloutCommand(program3) {
 \u2717 Rollout INCOMPLETE \u2014 ${(result.drifted ?? []).length} component(s) ` + `still behind ${target}: ${(result.drifted ?? []).join(", ") || "unknown"}.
 ` + `  ${result.rolled.length} agent(s) DID reach ${target} and the pin is ` + `committed \u2014 re-running the agent roll will not fix this.
 ` + `  Run the per-component command named in the warning(s) above, then ` + `\`switchroom update --check\` to confirm the host is converged.
+`);
+      process.exitCode = 1;
+      return;
+    }
+    if (!result.ok && result.failedStep === ENSURE_BANKS_STEP) {
+      process.stderr.write(`
+\u2717 Rollout INCOMPLETE \u2014 ${(result.drifted ?? []).length} agent(s) ` + `reached ${target} but their Hindsight bank could NOT be created: ` + `${(result.drifted ?? []).join(", ") || "unknown"}.
+` + `  The pin is committed and the agents ARE on the target \u2014 re-running ` + `the agent roll will not fix this.
+` + `  Restart the named agent(s) to re-run bank creation now that ` + `Hindsight is back up (their first \`retain\` fails with a foreign-key ` + `error until the bank exists).
 `);
       process.exitCode = 1;
       return;
@@ -94263,8 +94838,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync82, readFileSync as readFileSync77 } from "node:fs";
-import { dirname as dirname35, join as join86 } from "node:path";
+import { existsSync as existsSync83, readFileSync as readFileSync78 } from "node:fs";
+import { dirname as dirname36, join as join86 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -94315,15 +94890,15 @@ function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
     const pkgPath = join86(dir, "package.json");
-    if (existsSync82(pkgPath)) {
+    if (existsSync83(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync77(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync82(join86(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync78(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync83(join86(dir, ".git"))) {
           return dir;
         }
       } catch {}
     }
-    dir = dirname35(dir);
+    dir = dirname36(dir);
   }
   return null;
 }
@@ -94497,7 +95072,7 @@ init_merge();
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync83,
+  existsSync as existsSync84,
   readdirSync as readdirSync28,
   statSync as statSync48,
   unlinkSync as unlinkSync16
@@ -94508,7 +95083,7 @@ var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
   const projects = join87(claudeConfigDir, "projects");
-  if (!existsSync83(projects))
+  if (!existsSync84(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
@@ -94644,15 +95219,15 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync84,
-  mkdirSync as mkdirSync47,
+  existsSync as existsSync85,
+  mkdirSync as mkdirSync48,
   openSync as openSync16,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync78,
-  renameSync as renameSync21,
+  readFileSync as readFileSync79,
+  renameSync as renameSync22,
   statSync as statSync49,
   unlinkSync as unlinkSync17,
-  writeFileSync as writeFileSync32,
+  writeFileSync as writeFileSync33,
   writeSync as writeSync9
 } from "node:fs";
 import { join as join88 } from "node:path";
@@ -94683,11 +95258,11 @@ var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
   const path7 = join88(stateDir, ISSUES_FILE);
-  if (!existsSync84(path7))
+  if (!existsSync85(path7))
     return [];
   let raw;
   try {
-    raw = readFileSync78(path7, "utf-8");
+    raw = readFileSync79(path7, "utf-8");
   } catch {
     return [];
   }
@@ -94760,7 +95335,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve49(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94778,7 +95353,7 @@ function resolve49(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94796,7 +95371,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94826,7 +95401,7 @@ function prune(stateDir, opts = {}) {
   });
 }
 function ensureDir(stateDir) {
-  mkdirSync47(stateDir, { recursive: true });
+  mkdirSync48(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
   const path7 = join88(stateDir, ISSUES_FILE);
@@ -94835,8 +95410,8 @@ function writeAll(stateDir, events) {
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync32(tmp, body, "utf-8");
-  renameSync21(tmp, path7);
+  writeFileSync33(tmp, body, "utf-8");
+  renameSync22(tmp, path7);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
@@ -94898,7 +95473,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync78(lockPath, "utf-8").trim();
+    pidStr = readFileSync79(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -95146,20 +95721,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync87 } from "node:fs";
+import { existsSync as existsSync88 } from "node:fs";
 import { homedir as homedir49 } from "node:os";
 import { join as join91, resolve as resolve50 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash18 } from "node:crypto";
 import {
-  existsSync as existsSync85,
-  mkdirSync as mkdirSync48,
-  readFileSync as readFileSync79,
+  existsSync as existsSync86,
+  mkdirSync as mkdirSync49,
+  readFileSync as readFileSync80,
   rmSync as rmSync15,
-  writeFileSync as writeFileSync33
+  writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname36, join as join89 } from "node:path";
+import { dirname as dirname37, join as join89 } from "node:path";
 import { homedir as homedir47 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 
@@ -95175,13 +95750,13 @@ function defaultPythonCacheRoot() {
   return join89(homedir47(), ".switchroom", "deps", "python");
 }
 function hashFile(path7) {
-  return createHash18("sha256").update(readFileSync79(path7)).digest("hex");
+  return createHash18("sha256").update(readFileSync80(path7)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync85(requirementsPath)) {
+  if (!existsSync86(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
   const venvDir = join89(cacheRoot, skillName);
@@ -95190,8 +95765,8 @@ function ensurePythonEnv(opts) {
   const pythonBin = join89(binDir, "python");
   const pipBin = join89(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync85(stampPath) && existsSync85(pythonBin)) {
-    const existingHash = readFileSync79(stampPath, "utf8").trim();
+  if (!force && existsSync86(stampPath) && existsSync86(pythonBin)) {
+    const existingHash = readFileSync80(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -95203,10 +95778,10 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync85(venvDir)) {
+  if (existsSync86(venvDir)) {
     rmSync15(venvDir, { recursive: true, force: true });
   }
-  mkdirSync48(dirname36(venvDir), { recursive: true });
+  mkdirSync49(dirname37(venvDir), { recursive: true });
   try {
     execFileSync24(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -95225,7 +95800,7 @@ function ensurePythonEnv(opts) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync33(stampPath, targetHash + `
+  writeFileSync34(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -95241,13 +95816,13 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash19 } from "node:crypto";
 import {
   copyFileSync as copyFileSync12,
-  existsSync as existsSync86,
-  mkdirSync as mkdirSync49,
-  readFileSync as readFileSync80,
+  existsSync as existsSync87,
+  mkdirSync as mkdirSync50,
+  readFileSync as readFileSync81,
   rmSync as rmSync16,
-  writeFileSync as writeFileSync34
+  writeFileSync as writeFileSync35
 } from "node:fs";
-import { dirname as dirname37, join as join90 } from "node:path";
+import { dirname as dirname38, join as join90 } from "node:path";
 import { homedir as homedir48 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 
@@ -95274,20 +95849,20 @@ function defaultNodeCacheRoot() {
   return join90(homedir48(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname37(packageJsonPath);
+  const sourceDir = dirname38(packageJsonPath);
   const hasher = createHash19("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync80(packageJsonPath));
+  hasher.update(readFileSync81(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
     const lockPath = join90(sourceDir, lockName);
-    if (existsSync86(lockPath)) {
+    if (existsSync87(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync80(lockPath));
+      hasher.update(readFileSync81(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -95296,17 +95871,17 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync86(packageJsonPath)) {
+  if (!existsSync87(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname37(packageJsonPath);
+  const sourceDir = dirname38(packageJsonPath);
   const envDir = join90(cacheRoot, skillName);
   const stampPath = join90(envDir, ".package.sha256");
   const nodeModulesDir = join90(envDir, "node_modules");
   const binDir = join90(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync86(stampPath) && existsSync86(nodeModulesDir)) {
-    const existingHash = readFileSync80(stampPath, "utf8").trim();
+  if (!force && existsSync87(stampPath) && existsSync87(nodeModulesDir)) {
+    const existingHash = readFileSync81(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -95317,15 +95892,15 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync86(envDir)) {
+  if (existsSync87(envDir)) {
     rmSync16(envDir, { recursive: true, force: true });
   }
-  mkdirSync49(envDir, { recursive: true });
+  mkdirSync50(envDir, { recursive: true });
   copyFileSync12(packageJsonPath, join90(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
     const lockPath = join90(sourceDir, lockName);
-    if (existsSync86(lockPath)) {
+    if (existsSync87(lockPath)) {
       copyFileSync12(lockPath, join90(envDir, lockName));
       copiedLockfile = true;
     }
@@ -95342,7 +95917,7 @@ function ensureNodeEnv(opts) {
     const e = err;
     throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync34(stampPath, targetHash + `
+  writeFileSync35(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -95361,22 +95936,22 @@ function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync87(skillsRoot)) {
+    if (!existsSync88(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
     const skillDir = join91(skillsRoot, skill);
-    if (!existsSync87(skillDir)) {
+    if (!existsSync88(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
     const requirementsPath = join91(skillDir, "requirements.txt");
     const packageJsonPath = join91(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync87(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync87(packageJsonPath));
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync88(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync88(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync87(requirementsPath)) {
+      if (!existsSync88(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -95400,7 +95975,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync87(packageJsonPath)) {
+      if (!existsSync88(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -95433,9 +96008,9 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync88 } from "node:fs";
+import { existsSync as existsSync89 } from "node:fs";
 import { resolve as resolve51, sep as sep4 } from "node:path";
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/agents/workspace.ts
 import { readFile as readFile2, stat } from "node:fs/promises";
@@ -96148,7 +96723,7 @@ function registerWorkspaceCommand(program3) {
       process.exit(1);
     }
     const editor = process.env["EDITOR"] ?? process.env["VISUAL"] ?? "vi";
-    const child = spawnSync19(editor, [target], { stdio: "inherit" });
+    const child = spawnSync20(editor, [target], { stdio: "inherit" });
     if (child.status !== 0 && child.status !== null) {
       process.exit(child.status);
     }
@@ -96210,12 +96785,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync88(gitDir)) {
+    if (!existsSync89(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
     }
-    const statusResult = spawnSync19("git", ["status", "--short"], {
+    const statusResult = spawnSync20("git", ["status", "--short"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96230,7 +96805,7 @@ function registerWorkspaceCommand(program3) {
       return;
     }
     const message = opts.message || `checkpoint: ${new Date().toISOString()}`;
-    const addResult = spawnSync19("git", ["add", "-A"], {
+    const addResult = spawnSync20("git", ["add", "-A"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96239,7 +96814,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const commitResult = spawnSync19("git", ["commit", "-m", message], {
+    const commitResult = spawnSync20("git", ["commit", "-m", message], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96248,7 +96823,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const shaResult = spawnSync19("git", ["rev-parse", "--short", "HEAD"], {
+    const shaResult = spawnSync20("git", ["rev-parse", "--short", "HEAD"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96264,12 +96839,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync88(gitDir)) {
+    if (!existsSync89(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
     }
-    const child = spawnSync19("git", ["status", "--short"], {
+    const child = spawnSync20("git", ["status", "--short"], {
       cwd: dir,
       stdio: "inherit"
     });
@@ -96289,7 +96864,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve51(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync88(dir)) {
+  if (!existsSync89(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -96325,7 +96900,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync13, existsSync as existsSync89, readFileSync as readFileSync81, writeFileSync as writeFileSync35 } from "node:fs";
+import { copyFileSync as copyFileSync13, existsSync as existsSync90, readFileSync as readFileSync82, writeFileSync as writeFileSync36 } from "node:fs";
 import { join as join92, resolve as resolve52 } from "node:path";
 init_scaffold();
 init_profiles();
@@ -96343,7 +96918,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve52(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync89(workspaceDir)) {
+  if (!existsSync90(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -96369,11 +96944,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync89(t.soulPath)) {
+    if (!existsSync90(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync81(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync82(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -96384,7 +96959,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync89(t.soulPath);
+    const exists = existsSync90(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -96399,12 +96974,12 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync89(backupPath)) {
+      if (existsSync90(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync13(t.soulPath, backupPath);
     }
-    writeFileSync35(t.soulPath, content, "utf-8");
+    writeFileSync36(t.soulPath, content, "utf-8");
     if (backupPath) {
       console.log(`soul: re-seeded ${agentName}'s SOUL.md from profile ` + `"${t.profileName}".
 ` + `      Previous version saved to ${backupPath}`);
@@ -96418,7 +96993,7 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync90, readFileSync as readFileSync82, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
+import { existsSync as existsSync91, readFileSync as readFileSync83, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
 import { resolve as resolve53, join as join93 } from "node:path";
 import { createHash as createHash20 } from "node:crypto";
 init_merge();
@@ -96431,10 +97006,10 @@ function estimateTokens(bytes) {
 }
 function readMcpServerNames(agentDir) {
   const mcpPath = join93(agentDir, ".mcp.json");
-  if (!existsSync90(mcpPath))
+  if (!existsSync91(mcpPath))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync82(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync83(mcpPath, "utf-8"));
     return Object.keys(parsed.mcpServers ?? {});
   } catch {
     return null;
@@ -96445,7 +97020,7 @@ function sha256(content) {
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
   const projectsDir = join93(claudeConfigDir, "projects");
-  if (!existsSync90(projectsDir))
+  if (!existsSync91(projectsDir))
     return;
   try {
     const entries = readdirSync30(projectsDir, { withFileTypes: true });
@@ -96455,7 +97030,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
         continue;
       const projectPath = join93(projectsDir, entry.name);
       const transcriptPath = join93(projectPath, "transcript.jsonl");
-      if (!existsSync90(transcriptPath))
+      if (!existsSync91(transcriptPath))
         continue;
       const stat3 = statSync50(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
@@ -96469,7 +97044,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync82(transcriptPath, "utf-8");
+    const content = readFileSync83(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -96518,7 +97093,7 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve53(agentsDir, agentName);
-    if (!existsSync90(agentDir)) {
+    if (!existsSync91(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
@@ -96573,7 +97148,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync90(handoffPath) ? readFileSync82(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync91(handoffPath) ? readFileSync83(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -96584,7 +97159,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync90(claudeMdPath) ? readFileSync82(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync91(claudeMdPath) ? readFileSync83(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -96595,7 +97170,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync90(soulMdPath) ? readFileSync82(soulMdPath, "utf-8") : existsSync90(workspaceSoulMdPath) ? readFileSync82(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync91(soulMdPath) ? readFileSync83(soulMdPath, "utf-8") : existsSync91(workspaceSoulMdPath) ? readFileSync83(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -96659,8 +97234,8 @@ function registerDebugCommand(program3) {
     const fleetDir = join93(agentsDir, "..", "fleet");
     const fleetInvPath = join93(fleetDir, "switchroom-invariants.md");
     const fleetClaudePath = join93(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync90(fleetInvPath) ? readFileSync82(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync90(fleetClaudePath) ? readFileSync82(fleetClaudePath, "utf-8").length : 0;
+    const fleetInvBytes = existsSync91(fleetInvPath) ? readFileSync83(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync91(fleetClaudePath) ? readFileSync83(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -96693,20 +97268,20 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync26 } from "node:child_process";
-import { closeSync as closeSync17, mkdirSync as mkdirSync51, openSync as openSync17, existsSync as existsSync92, unlinkSync as unlinkSync19 } from "node:fs";
+import { closeSync as closeSync17, mkdirSync as mkdirSync52, openSync as openSync17, existsSync as existsSync93, unlinkSync as unlinkSync19 } from "node:fs";
 import { join as join95, resolve as resolve55 } from "node:path";
 import { homedir as homedir51 } from "node:os";
 import { randomBytes as randomBytes14 } from "node:crypto";
 
 // src/worktree/registry.ts
 import {
-  mkdirSync as mkdirSync50,
-  writeFileSync as writeFileSync36,
-  readFileSync as readFileSync83,
+  mkdirSync as mkdirSync51,
+  writeFileSync as writeFileSync37,
+  readFileSync as readFileSync84,
   readdirSync as readdirSync31,
   unlinkSync as unlinkSync18,
-  existsSync as existsSync91,
-  renameSync as renameSync22
+  existsSync as existsSync92,
+  renameSync as renameSync23
 } from "node:fs";
 import { join as join94, resolve as resolve54 } from "node:path";
 import { homedir as homedir50 } from "node:os";
@@ -96717,20 +97292,20 @@ function recordPath(id) {
   return join94(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
-  mkdirSync50(registryDir(), { recursive: true });
+  mkdirSync51(registryDir(), { recursive: true });
 }
 function writeRecord(record2) {
   ensureDir2();
   const target = recordPath(record2.id);
   const tmp = `${target}.tmp${process.pid}`;
-  writeFileSync36(tmp, JSON.stringify(record2, null, 2) + `
+  writeFileSync37(tmp, JSON.stringify(record2, null, 2) + `
 `, { mode: 384 });
-  renameSync22(tmp, target);
+  renameSync23(tmp, target);
 }
 function readRecord(id) {
   const path10 = recordPath(id);
   try {
-    const raw = readFileSync83(path10, "utf8");
+    const raw = readFileSync84(path10, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -96763,7 +97338,7 @@ function countByRepo(repoPath) {
 // src/worktree/claim.ts
 function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
-  mkdirSync51(lockDir, { recursive: true });
+  mkdirSync52(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
   const lockPath = join95(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
@@ -96819,7 +97394,7 @@ function expandHome(p) {
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync92(repoPath)) {
+  if (!existsSync93(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -96841,7 +97416,7 @@ async function claimWorktree(input, codeRepos) {
     const taskSuffix = input.taskName ? sanitizeTaskName(input.taskName) : "task";
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
-    mkdirSync51(baseDir, { recursive: true });
+    mkdirSync52(baseDir, { recursive: true });
     worktreePath = join95(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
@@ -96875,7 +97450,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync27 } from "node:child_process";
-import { existsSync as existsSync93 } from "node:fs";
+import { existsSync as existsSync94 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -96883,7 +97458,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync93(record2.path)) {
+  if (existsSync94(record2.path)) {
     try {
       execFileSync27("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -96922,7 +97497,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync28 } from "node:child_process";
-import { existsSync as existsSync94 } from "node:fs";
+import { existsSync as existsSync95 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function reapSkipReasonText(action) {
   switch (action) {
@@ -96983,7 +97558,7 @@ function planReaper(nowMs, deps = {}) {
   const plan = [];
   for (const record2 of listRecords()) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync94(record2.path);
+    const worktreeExists = existsSync95(record2.path);
     if (!worktreeExists) {
       plan.push({
         record: record2,
@@ -97064,12 +97639,12 @@ function runReaper(nowMs, deps = {}) {
 // src/worktree/gc.ts
 import { execFileSync as execFileSync29 } from "node:child_process";
 import {
-  existsSync as existsSync95,
-  readFileSync as readFileSync84,
+  existsSync as existsSync96,
+  readFileSync as readFileSync85,
   readdirSync as readdirSync32,
   statSync as statSync51,
-  renameSync as renameSync23,
-  mkdirSync as mkdirSync52,
+  renameSync as renameSync24,
+  mkdirSync as mkdirSync53,
   rmSync as rmSync17
 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
@@ -97191,9 +97766,9 @@ function trashRoot() {
   return resolve56(process.env.SWITCHROOM_WORKTREE_TRASH ?? join96(homedir52(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
-  const exists = deps.existsSync ?? existsSync95;
+  const exists = deps.existsSync ?? existsSync96;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
-  const readFile4 = deps.readFile ?? ((p) => readFileSync84(p, "utf8"));
+  const readFile4 = deps.readFile ?? ((p) => readFileSync85(p, "utf8"));
   const stat3 = deps.stat ?? ((p) => statSync51(p));
   const exec = deps.exec ?? defaultExec3;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
@@ -97321,10 +97896,10 @@ function planGc(roots, deps = {}) {
 }
 function applyGc(plan, deps = {}) {
   const exec = deps.exec ?? defaultExec3;
-  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync52(p, { recursive: true }));
+  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync53(p, { recursive: true }));
   const move = deps.move ?? ((src, dest) => {
     try {
-      renameSync23(src, dest);
+      renameSync24(src, dest);
     } catch {
       exec("mv", [src, dest]);
     }
@@ -97370,7 +97945,7 @@ function selectPurgeTargets(entries, olderThanDays) {
   return entries.filter((e) => e.ageDays >= olderThanDays).map((e) => e.path);
 }
 function listTrashEntries(nowMs, deps = {}) {
-  const exists = deps.existsSync ?? existsSync95;
+  const exists = deps.existsSync ?? existsSync96;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
   const root = trashRoot();
   if (!exists(root))
@@ -97632,10 +98207,10 @@ init_drive();
 init_scaffold_integration();
 import {
   chmodSync as chmodSync16,
-  mkdirSync as mkdirSync53,
+  mkdirSync as mkdirSync54,
   readdirSync as readdirSync33,
   rmSync as rmSync18,
-  writeFileSync as writeFileSync37
+  writeFileSync as writeFileSync38
 } from "node:fs";
 import { join as join97 } from "node:path";
 function encodeCredentialsFilename(email) {
@@ -97830,14 +98405,14 @@ function resolveCredentialsDir(env2) {
   return join97(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
-  mkdirSync53(dir, { recursive: true, mode: 448 });
+  mkdirSync54(dir, { recursive: true, mode: 448 });
   chmodSync16(dir, 448);
   for (const name of readdirSync33(dir)) {
     rmSync18(join97(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
   const filePath = join97(dir, filename);
-  writeFileSync37(filePath, JSON.stringify(seed), { mode: 384 });
+  writeFileSync38(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync16(filePath, 384);
   return filePath;
 }
@@ -97995,8 +98570,8 @@ function registerDriveMcpLauncherCommand(program3) {
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { writeFileSync as writeFileSync38, mkdirSync as mkdirSync54 } from "node:fs";
-import { dirname as dirname38, join as join98 } from "node:path";
+import { writeFileSync as writeFileSync39, mkdirSync as mkdirSync55 } from "node:fs";
+import { dirname as dirname39, join as join98 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -98032,8 +98607,8 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data, account) {
   const path10 = heartbeatPath(agentName, account);
   try {
-    mkdirSync54(dirname38(path10), { recursive: true });
-    writeFileSync38(path10, JSON.stringify(data, null, 2), { mode: 420 });
+    mkdirSync55(dirname39(path10), { recursive: true });
+    writeFileSync39(path10, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
 function heartbeatPath(agentName, account) {
@@ -98273,8 +98848,8 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync96, mkdirSync as mkdirSync55, writeFileSync as writeFileSync39 } from "node:fs";
-import { dirname as dirname39 } from "node:path";
+import { existsSync as existsSync97, mkdirSync as mkdirSync56, writeFileSync as writeFileSync40 } from "node:fs";
+import { dirname as dirname40 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -98284,10 +98859,10 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path10, contents) {
   try {
-    const dir = dirname39(path10);
-    if (!existsSync96(dir))
-      mkdirSync55(dir, { recursive: true });
-    writeFileSync39(path10, contents);
+    const dir = dirname40(path10);
+    if (!existsSync97(dir))
+      mkdirSync56(dir, { recursive: true });
+    writeFileSync40(path10, contents);
   } catch {}
 }
 async function runNotionMcpLauncher(opts, runtime) {
@@ -98396,7 +98971,7 @@ function registerNotionMcpLauncherCommand(program3) {
 }
 
 // src/cli/hindsight-mcp-shim.ts
-import { mkdirSync as mkdirSync56, readFileSync as readFileSync85, renameSync as renameSync24, writeFileSync as writeFileSync40 } from "node:fs";
+import { mkdirSync as mkdirSync57, readFileSync as readFileSync86, renameSync as renameSync25, writeFileSync as writeFileSync41 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join99 } from "node:path";
 import { createInterface as createInterface6 } from "node:readline";
@@ -98848,18 +99423,18 @@ class HindsightShim {
   }
   writeCache(result) {
     try {
-      mkdirSync56(this.opts.cacheDir, { recursive: true });
+      mkdirSync57(this.opts.cacheDir, { recursive: true });
       const tmp = join99(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
-      writeFileSync40(tmp, JSON.stringify(result, null, 2) + `
+      writeFileSync41(tmp, JSON.stringify(result, null, 2) + `
 `);
-      renameSync24(tmp, this.cachePath);
+      renameSync25(tmp, this.cachePath);
     } catch (err) {
       this.log(`[hindsight-shim] cache write failed: ${String(err)}`);
     }
   }
   readCache() {
     try {
-      const parsed = JSON.parse(readFileSync85(this.cachePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync86(this.cachePath, "utf-8"));
       if (Array.isArray(parsed.tools))
         return parsed;
       return null;
@@ -99092,7 +99667,7 @@ function registerHindsightMcpShimCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync86, statSync as statSync52 } from "node:fs";
+import { readFileSync as readFileSync87, statSync as statSync52 } from "node:fs";
 import { basename as basename13 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -99432,7 +100007,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync52(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync86(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync87(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -99753,7 +100328,7 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync87, existsSync as existsSync97, readdirSync as readdirSync34 } from "node:fs";
+import { readFileSync as readFileSync88, existsSync as existsSync98, readdirSync as readdirSync34 } from "node:fs";
 import { join as join100 } from "node:path";
 import { homedir as homedir53 } from "node:os";
 
@@ -100029,7 +100604,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync87(src.path, "utf-8");
+      content = readFileSync88(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -100076,7 +100651,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync97(trimmed)) {
+    if (!existsSync98(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -100092,7 +100667,7 @@ function resolveSources(explicitPath) {
   } catch {
     agentsDir = join100(homedir53(), ".switchroom", "agents");
   }
-  if (!existsSync97(agentsDir))
+  if (!existsSync98(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -100103,7 +100678,7 @@ function resolveSources(explicitPath) {
   }
   for (const name of entries) {
     const path10 = join100(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync97(path10)) {
+    if (existsSync98(path10)) {
       sources.push({ path: path10, agent: name });
     }
   }
@@ -100133,13 +100708,13 @@ var import_yaml21 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync18,
-  existsSync as existsSync98,
+  existsSync as existsSync99,
   fsyncSync as fsyncSync8,
-  mkdirSync as mkdirSync57,
+  mkdirSync as mkdirSync58,
   openSync as openSync18,
   readdirSync as readdirSync35,
-  readFileSync as readFileSync88,
-  renameSync as renameSync25,
+  readFileSync as readFileSync89,
+  renameSync as renameSync26,
   statSync as statSync53,
   unlinkSync as unlinkSync20,
   writeSync as writeSync10
@@ -100163,15 +100738,15 @@ function overlayPathsFor(agent, opts = {}) {
   };
 }
 function ensureDirs(paths) {
-  mkdirSync57(paths.scheduleDir, { recursive: true });
-  mkdirSync57(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync58(paths.scheduleDir, { recursive: true });
+  mkdirSync58(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync57(paths.skillsDir, { recursive: true });
-  mkdirSync57(paths.skillsStagingDir, { recursive: true });
+  mkdirSync58(paths.skillsDir, { recursive: true });
+  mkdirSync58(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync57(paths.agentRoot, { recursive: true });
+  mkdirSync58(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
@@ -100221,7 +100796,7 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync18(fd);
     }
-    renameSync25(stagingPath, finalPath);
+    renameSync26(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -100238,7 +100813,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync18(fd);
     }
-    renameSync25(stagingPath, finalPath);
+    renameSync26(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -100246,7 +100821,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join101(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync98(finalPath))
+    if (!existsSync99(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -100254,7 +100829,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync98(paths.skillsDir))
+  if (!existsSync99(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.skillsDir)) {
@@ -100262,7 +100837,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
       continue;
     const full = join101(paths.skillsDir, name);
     try {
-      const raw = readFileSync88(full, "utf-8");
+      const raw = readFileSync89(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -100273,7 +100848,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync98(finalPath))
+    if (!existsSync99(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -100281,7 +100856,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync98(paths.scheduleDir))
+  if (!existsSync99(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.scheduleDir)) {
@@ -100289,7 +100864,7 @@ function listOverlayEntries(agent, opts = {}) {
       continue;
     const full = join101(paths.scheduleDir, name);
     try {
-      const raw = readFileSync88(full, "utf-8");
+      const raw = readFileSync89(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -100509,15 +101084,15 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync19,
-  existsSync as existsSync99,
+  existsSync as existsSync100,
   fsyncSync as fsyncSync9,
-  mkdirSync as mkdirSync58,
+  mkdirSync as mkdirSync59,
   openSync as openSync19,
   readdirSync as readdirSync36,
-  readFileSync as readFileSync89,
-  renameSync as renameSync26,
+  readFileSync as readFileSync90,
+  renameSync as renameSync27,
   unlinkSync as unlinkSync21,
-  writeFileSync as writeFileSync41,
+  writeFileSync as writeFileSync42,
   writeSync as writeSync11
 } from "node:fs";
 import { join as join102 } from "node:path";
@@ -100529,7 +101104,7 @@ function pendingDir(agent, opts = {}) {
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync58(dir, { recursive: true });
+  mkdirSync59(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -100558,15 +101133,15 @@ function stagePendingScheduleEntry(opts) {
     } finally {
       closeSync19(fd);
     }
-    renameSync26(yamlTmp, yamlPath);
+    renameSync27(yamlTmp, yamlPath);
   }
-  writeFileSync41(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync42(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync99(dir))
+  if (!existsSync100(dir))
     return [];
   const out = [];
   for (const name of readdirSync36(dir).sort()) {
@@ -100575,10 +101150,10 @@ function listPendingScheduleEntries(agent, opts = {}) {
     const stageId = name.slice(0, -".meta.json".length);
     const metaPath = join102(dir, name);
     const yamlPath = join102(dir, `${stageId}.yaml`);
-    if (!existsSync99(yamlPath))
+    if (!existsSync100(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync89(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync90(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -100594,10 +101169,10 @@ function commitPendingScheduleEntry(opts) {
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
   const finalPath = join102(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync99(finalPath)) {
+  if (existsSync100(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
-  renameSync26(match.yamlPath, finalPath);
+  renameSync27(match.yamlPath, finalPath);
   unlinkSync21(match.metaPath);
   return { committed: true, path: finalPath, slug };
 }
@@ -100616,7 +101191,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync100, readFileSync as readFileSync90 } from "node:fs";
+import { existsSync as existsSync101, readFileSync as readFileSync91 } from "node:fs";
 import { execFileSync as execFileSync30 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -101006,8 +101581,8 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync100(match.path))
-      priorContent = readFileSync90(match.path, "utf-8");
+    if (existsSync101(match.path))
+      priorContent = readFileSync91(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -101210,7 +101785,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync100(opts.jsonl) ? readFileSync90(opts.jsonl, "utf-8") : "";
+      blob = existsSync101(opts.jsonl) ? readFileSync91(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync30("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -101242,7 +101817,7 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml22 = __toESM(require_dist(), 1);
-import { existsSync as existsSync101 } from "node:fs";
+import { existsSync as existsSync102 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
@@ -101322,7 +101897,7 @@ function skillInstall(opts) {
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
   const skillPath = join103(poolDir, skillName);
-  if (!existsSync101(skillPath)) {
+  if (!existsSync102(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml22.stringify({ skills: [skillName] });
@@ -101486,22 +102061,22 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync20,
-  existsSync as existsSync102,
+  existsSync as existsSync103,
   lstatSync as lstatSync12,
-  mkdirSync as mkdirSync59,
+  mkdirSync as mkdirSync60,
   mkdtempSync as mkdtempSync5,
   openSync as openSync20,
-  readFileSync as readFileSync91,
+  readFileSync as readFileSync92,
   readdirSync as readdirSync37,
   realpathSync as realpathSync7,
-  renameSync as renameSync27,
+  renameSync as renameSync28,
   rmSync as rmSync19,
   statSync as statSync54,
-  writeFileSync as writeFileSync42
+  writeFileSync as writeFileSync43
 } from "node:fs";
 import { tmpdir as tmpdir6, homedir as homedir54 } from "node:os";
-import { dirname as dirname40, join as join104, relative as relative4, resolve as resolve58 } from "node:path";
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { dirname as dirname41, join as join104, relative as relative4, resolve as resolve58 } from "node:path";
+import { spawnSync as spawnSync21 } from "node:child_process";
 
 // src/cli/skill-common.ts
 var import_yaml24 = __toESM(require_dist(), 1);
@@ -101784,7 +102359,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync91(full);
+        const buf = readFileSync92(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -101795,7 +102370,7 @@ function loadFromDir(dir) {
 function loadFromTarball(tarPath) {
   const isGz = tarPath.endsWith(".gz") || tarPath.endsWith(".tgz");
   const listFlags = isGz ? ["-tzf"] : ["-tf"];
-  const list2 = spawnSync20("tar", [...listFlags, tarPath], {
+  const list2 = spawnSync21("tar", [...listFlags, tarPath], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -101812,7 +102387,7 @@ function loadFromTarball(tarPath) {
   const staging = mkdtempSync5(join104(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
-    const r = spawnSync20("tar", [
+    const r = spawnSync21("tar", [
       ...flags,
       tarPath,
       "-C",
@@ -101833,7 +102408,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync91(filePath, "utf-8");
+  const content = readFileSync92(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -101887,7 +102462,7 @@ function validatePayload(name, files) {
   if (errors2.length === 0) {
     for (const [path10, content] of Object.entries(files)) {
       if (SH_SCRIPT_RE2.test(path10)) {
-        const r = spawnSync20("bash", ["-n"], {
+        const r = spawnSync21("bash", ["-n"], {
           input: content,
           encoding: "utf-8"
         });
@@ -101898,8 +102473,8 @@ function validatePayload(name, files) {
         const tmp = mkdtempSync5(join104(tmpdir6(), "skill-apply-py-"));
         const tmpPy = join104(tmp, "check.py");
         try {
-          writeFileSync42(tmpPy, content);
-          const r = spawnSync20("python3", ["-m", "py_compile", tmpPy], {
+          writeFileSync43(tmpPy, content);
+          const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
           if (r.status !== 0) {
@@ -101916,7 +102491,7 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync102(currentDir)) {
+  if (existsSync103(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync37(sub, { withFileTypes: true })) {
         const full = join104(sub, ent.name);
@@ -101924,7 +102499,7 @@ function diffSummary(currentDir, files) {
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync91(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync92(full, "utf-8");
         }
       }
     };
@@ -101952,8 +102527,8 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync102(poolDir)) {
-    mkdirSync59(poolDir, { recursive: true, mode: 493 });
+  if (!existsSync103(poolDir)) {
+    mkdirSync60(poolDir, { recursive: true, mode: 493 });
   }
   const target = join104(poolDir, name);
   let targetIsSymlink = false;
@@ -101971,10 +102546,10 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join104(staging, path10);
-      mkdirSync59(dirname40(full), { recursive: true, mode: 493 });
+      mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
       const fd = openSync20(full, "wx");
       try {
-        writeFileSync42(fd, content);
+        writeFileSync43(fd, content);
       } finally {
         closeSync20(fd);
       }
@@ -101990,9 +102565,9 @@ function writePayload(poolDir, name, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${target}.skill-apply-old-${Date.now()}`;
-      renameSync27(target, oldRename);
+      renameSync28(target, oldRename);
     }
-    renameSync27(staging, target);
+    renameSync28(staging, target);
     if (oldRename) {
       rmSync19(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -102001,12 +102576,12 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync19(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync102(oldRename)) {
+    if (oldRename && existsSync103(oldRename)) {
       try {
-        if (existsSync102(target)) {
+        if (existsSync103(target)) {
           rmSync19(target, { recursive: true, force: true });
         }
-        renameSync27(oldRename, target);
+        renameSync28(oldRename, target);
       } catch {}
     }
     throw err2;
@@ -102024,7 +102599,7 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve58(opts.from);
-      if (!existsSync102(fromPath)) {
+      if (!existsSync103(fromPath)) {
         fail4(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync54(fromPath);
@@ -102062,7 +102637,7 @@ function registerSkillCommand(program3) {
 \u2713 Wrote ${name} to ${currentDir}`));
     const self = selfInvokeArgv(["apply", "--non-interactive"]);
     console.log(source_default.gray(`Running \`switchroom apply --non-interactive\`...`));
-    const r = spawnSync20(self.command, self.argv, { stdio: "inherit" });
+    const r = spawnSync21(self.command, self.argv, { stdio: "inherit" });
     if (r.status !== 0) {
       console.error(source_default.yellow(`(warning: \`switchroom apply\` exited ${r.status} \u2014 skill is ` + `in the pool but symlinks may not be refreshed. Re-run manually.)`));
     }
@@ -102080,22 +102655,22 @@ function sumBytes(files) {
 init_esm();
 import {
   closeSync as closeSync21,
-  existsSync as existsSync103,
+  existsSync as existsSync104,
   lstatSync as lstatSync13,
-  mkdirSync as mkdirSync60,
+  mkdirSync as mkdirSync61,
   mkdtempSync as mkdtempSync6,
   openSync as openSync21,
-  readFileSync as readFileSync92,
+  readFileSync as readFileSync93,
   readdirSync as readdirSync38,
-  renameSync as renameSync28,
+  renameSync as renameSync29,
   rmSync as rmSync20,
   statSync as statSync55,
   utimesSync,
-  writeFileSync as writeFileSync43
+  writeFileSync as writeFileSync44
 } from "node:fs";
-import { dirname as dirname41, join as join105, relative as relative5, resolve as resolve59 } from "node:path";
+import { dirname as dirname42, join as join105, relative as relative5, resolve as resolve59 } from "node:path";
 import { homedir as homedir55, tmpdir as tmpdir7 } from "node:os";
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 init_helpers();
 init_agent_config();
 init_source();
@@ -102106,14 +102681,14 @@ var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
   const candidate = override ? resolve59(override) : join105(homedir55(), ".switchroom-config");
-  if (!existsSync103(candidate))
+  if (!existsSync104(candidate))
     return null;
   return join105(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync103(configSkillsRoot))
+    if (!existsSync104(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync38(configSkillsRoot)) {
@@ -102149,17 +102724,17 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync103(dest)) {
+      if (existsSync104(dest)) {
         const trash = join105(configSkillsRoot, `.${name}-trash-${Date.now()}`);
-        renameSync28(dest, trash);
+        renameSync29(dest, trash);
       }
       return;
     }
-    mkdirSync60(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync61(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
     const staging = mkdtempSync6(join105(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync60(dst, { recursive: true, mode: 493 });
+      mkdirSync61(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync38(src, { withFileTypes: true })) {
         const s = join105(src, ent.name);
         const d = join105(dst, ent.name);
@@ -102168,16 +102743,16 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync43(d, readFileSync92(s));
+          writeFileSync44(d, readFileSync93(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync103(dest)) {
+    if (existsSync104(dest)) {
       const prior = join105(configSkillsRoot, `.${name}-prior-${Date.now()}`);
-      renameSync28(dest, prior);
+      renameSync29(dest, prior);
     }
-    renameSync28(staging, dest);
+    renameSync29(staging, dest);
   } catch (err2) {
     process.stderr.write(source_default.yellow(`warning: mirror to ${dest} failed (${err2.message ?? err2}); ` + `live copy still works, but this skill is not version-controlled until next successful sync.
 `));
@@ -102214,7 +102789,7 @@ function trashDir(agentsRoot, agent) {
 }
 function countPersonalSkills(agentsRoot, agent) {
   const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
-  if (!existsSync103(skillsDir))
+  if (!existsSync104(skillsDir))
     return 0;
   let n = 0;
   for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
@@ -102261,7 +102836,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative5(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync92(full, "utf-8");
+        files[rel] = readFileSync93(full, "utf-8");
       }
     }
   };
@@ -102299,7 +102874,7 @@ function behavioralValidate(files) {
   const errors2 = [];
   for (const [path10, content] of Object.entries(files)) {
     if (SH_SCRIPT_RE.test(path10)) {
-      const r = spawnSync21("bash", ["-n"], { input: content, encoding: "utf-8" });
+      const r = spawnSync22("bash", ["-n"], { input: content, encoding: "utf-8" });
       if (r.status !== 0) {
         errors2.push(`${path10} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
@@ -102307,8 +102882,8 @@ function behavioralValidate(files) {
       const tmp = mkdtempSync6(join105(tmpdir7(), "skill-personal-py-"));
       const tmpPy = join105(tmp, "check.py");
       try {
-        writeFileSync43(tmpPy, content);
-        const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
+        writeFileSync44(tmpPy, content);
+        const r = spawnSync22("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
         if (r.status !== 0) {
@@ -102323,7 +102898,7 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync103(trash))
+  if (!existsSync104(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync38(trash, { withFileTypes: true })) {
@@ -102349,16 +102924,16 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail5(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync60(dirname41(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join105(dirname41(targetDir), `.skill-personal-stage-`));
+  mkdirSync61(dirname42(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join105(dirname42(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join105(staging, path10);
-      mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
+      mkdirSync61(dirname42(full), { recursive: true, mode: 493 });
       const fd = openSync21(full, "wx");
       try {
-        writeFileSync43(fd, content);
+        writeFileSync44(fd, content);
       } finally {
         closeSync21(fd);
       }
@@ -102374,9 +102949,9 @@ function writePersonalSkill(targetDir, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${targetDir}.personal-old-${Date.now()}`;
-      renameSync28(targetDir, oldRename);
+      renameSync29(targetDir, oldRename);
     }
-    renameSync28(staging, targetDir);
+    renameSync29(staging, targetDir);
     if (oldRename) {
       rmSync20(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -102385,12 +102960,12 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync20(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync103(oldRename)) {
+    if (oldRename && existsSync104(oldRename)) {
       try {
-        if (existsSync103(targetDir)) {
+        if (existsSync104(targetDir)) {
           rmSync20(targetDir, { recursive: true, force: true });
         }
-        renameSync28(oldRename, targetDir);
+        renameSync29(oldRename, targetDir);
       } catch {}
     }
     throw err2;
@@ -102453,7 +103028,7 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve59(opts.from);
-  if (!existsSync103(p)) {
+  if (!existsSync104(p)) {
     fail5(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync55(p);
@@ -102461,7 +103036,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync92(p, "utf-8") };
+    return { "SKILL.md": readFileSync93(p, "utf-8") };
   }
   fail5(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -102515,7 +103090,7 @@ function resolveCloneSource(source, opts) {
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
   const dir = join105(root, slug);
-  if (!existsSync103(dir)) {
+  if (!existsSync104(dir)) {
     fail5(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync13(dir);
@@ -102550,7 +103125,7 @@ function readSourceFiles(dir) {
             fail5(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync92(full, "utf-8");
+        files[rel] = readFileSync93(full, "utf-8");
       }
     }
   };
@@ -102639,10 +103214,10 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot2 = trashDir(agentsRoot, agent);
-  mkdirSync60(trashRoot2, { recursive: true, mode: 493 });
+  mkdirSync61(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
   const trashTarget = join105(trashRoot2, `${name}-${ts}`);
-  renameSync28(target, trashTarget);
+  renameSync29(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
   mirrorToConfigRepo(agent, name, null);
@@ -102662,7 +103237,7 @@ function listPersonalAction(opts) {
   sweepTrash(agentsRoot, agent);
   const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync103(skillsDir)) {
+  if (existsSync104(skillsDir)) {
     for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
@@ -102720,7 +103295,7 @@ function registerSkillPersonalCommands(program3) {
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir56 } from "node:os";
 import { join as join106 } from "node:path";
-import { readFileSync as readFileSync93 } from "node:fs";
+import { readFileSync as readFileSync94 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
   return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join106(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join106(homedir56(), ".claude", "channels", "telegram", "gateway.sock"));
@@ -102758,7 +103333,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
       fail6("agent name required (--agent or $SWITCHROOM_AGENT_NAME)");
     let draft;
     try {
-      draft = JSON.parse(readFileSync93(opts.draft, "utf-8"));
+      draft = JSON.parse(readFileSync94(opts.draft, "utf-8"));
     } catch (e) {
       fail6(`failed to read/parse --draft: ${e.message}`);
     }
@@ -102795,7 +103370,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync104, readdirSync as readdirSync39, readFileSync as readFileSync94, statSync as statSync56 } from "node:fs";
+import { existsSync as existsSync105, readdirSync as readdirSync39, readFileSync as readFileSync95, statSync as statSync56 } from "node:fs";
 import { homedir as homedir57 } from "node:os";
 import { join as join107, resolve as resolve60 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -102812,11 +103387,11 @@ function defaultBundledRoot2() {
 }
 function readSkillFrontmatter(skillDir) {
   const mdPath = join107(skillDir, "SKILL.md");
-  if (!existsSync104(mdPath))
+  if (!existsSync105(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync94(mdPath, "utf-8");
+    content = readFileSync95(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -102856,7 +103431,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
   const skillsDir = join107(agentsRoot, agent, ".claude/skills");
-  if (!existsSync104(skillsDir))
+  if (!existsSync105(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -102894,7 +103469,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync104(sharedRoot))
+  if (!existsSync105(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -102932,7 +103507,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync104(bundledRoot))
+  if (!existsSync105(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -103090,10 +103665,10 @@ init_source();
 init_helpers();
 init_operator_uid();
 import {
-  existsSync as existsSync106,
-  mkdirSync as mkdirSync61,
+  existsSync as existsSync107,
+  mkdirSync as mkdirSync62,
   readdirSync as readdirSync40,
-  writeFileSync as writeFileSync44,
+  writeFileSync as writeFileSync45,
   statSync as statSync57,
   lstatSync as lstatSync14,
   realpathSync as realpathSync8,
@@ -103101,13 +103676,13 @@ import {
 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
 import { join as join108 } from "node:path";
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 function makeDockerRunner() {
   return (args) => {
-    const r = spawnSync23("docker", args, { encoding: "utf8" });
+    const r = spawnSync24("docker", args, { encoding: "utf8" });
     return {
       ok: r.status === 0,
       stdout: r.stdout ?? "",
@@ -103466,7 +104041,7 @@ function resolveHostdSkillsTarget(hostHome) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills is a symlink whose target ` + `does not resolve (dangling) \u2014 skipping the skills bind mount. Bundled ` + `skills will be unavailable to rollout/update until the symlink is fixed.`);
     return;
   }
-  if (!existsSync106(target)) {
+  if (!existsSync107(target)) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills resolves to "${target}", ` + `which does not exist \u2014 skipping the skills bind mount. Bundled skills ` + `will be unavailable to rollout/update until the symlink target exists.`);
     return;
   }
@@ -103480,7 +104055,7 @@ function hostdComposePath() {
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync106(p))
+  if (!existsSync107(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -103488,7 +104063,7 @@ function backupExistingCompose() {
   return bak;
 }
 function runDocker(args) {
-  const r = spawnSync24("docker", args, { encoding: "utf8" });
+  const r = spawnSync25("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -103513,7 +104088,7 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync61(dir, { recursive: true });
+  mkdirSync62(dir, { recursive: true });
   const imageTag = resolveHostdImageTag(opts.tag, cfg.release);
   const guard = checkDowngrade({
     container: "switchroom-hostd",
@@ -103546,7 +104121,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync44(composePath, yaml, "utf8");
+  writeFileSync45(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   const adminAgents = Object.entries(cfg.agents ?? {}).filter(([, a]) => a?.admin === true).map(([name]) => name);
   console.log(source_default.dim(`    agents served (one socket each): ${allAgents.length === 0 ? "(none)" : allAgents.join(", ")}`));
@@ -103578,7 +104153,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -103599,14 +104174,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync106(dir)) {
+  if (existsSync107(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync40(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
         const sockPath = join108(dir, name, "sock");
-        if (existsSync106(sockPath)) {
+        if (existsSync107(sockPath)) {
           const st = statSync57(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -103625,7 +104200,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -103649,7 +104224,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync106(logPath)) {
+    if (!existsSync107(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
@@ -103698,10 +104273,10 @@ init_source();
 init_helpers();
 init_operator_uid();
 init_compose();
-import { chownSync as chownSync10, existsSync as existsSync107, mkdirSync as mkdirSync62, writeFileSync as writeFileSync45, copyFileSync as copyFileSync15 } from "node:fs";
+import { chownSync as chownSync10, existsSync as existsSync108, mkdirSync as mkdirSync63, writeFileSync as writeFileSync46, copyFileSync as copyFileSync15 } from "node:fs";
 import { homedir as homedir59 } from "node:os";
 import { join as join109 } from "node:path";
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
     return explicitTag;
@@ -103809,7 +104384,7 @@ function webdComposePath() {
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync107(p))
+  if (!existsSync108(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -103817,7 +104392,7 @@ function backupExistingCompose2() {
   return bak;
 }
 function runDocker2(args) {
-  const r = spawnSync25("docker", args, { encoding: "utf8" });
+  const r = spawnSync26("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -103840,7 +104415,7 @@ async function doInstall2(opts, program3) {
   }
   const dir = webdDir();
   const composePath = webdComposePath();
-  mkdirSync62(dir, { recursive: true });
+  mkdirSync63(dir, { recursive: true });
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
   const port = cfg.web_service?.port ?? 8080;
@@ -103875,7 +104450,7 @@ async function doInstall2(opts, program3) {
   const bak = backupExistingCompose2();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync45(composePath, yaml, "utf8");
+  writeFileSync46(composePath, yaml, "utf8");
   try {
     if (typeof process.geteuid === "function" && process.geteuid() === 0) {
       chownSync10(dir, operatorUid, operatorUid);
@@ -103917,7 +104492,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync107(composeYml)) {
+  if (!existsSync108(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -103941,7 +104516,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync107(composeYml)) {
+  if (!existsSync108(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }
@@ -104216,13 +104791,13 @@ init_helpers();
 init_scan();
 
 // src/fleet-health/gh-sync.ts
-import { spawnSync as spawnSync26 } from "node:child_process";
+import { spawnSync as spawnSync27 } from "node:child_process";
 var LABEL = "fleet-health";
 function defaultGhDeps(log) {
   return {
     log,
     run: (args) => {
-      const r = spawnSync26("gh", args, { encoding: "utf-8" });
+      const r = spawnSync27("gh", args, { encoding: "utf-8" });
       return {
         ok: r.status === 0,
         stdout: (r.stdout ?? "").trim(),
@@ -104427,7 +105002,7 @@ function printDeepDiveBrief(targets) {
 
 // src/cli/hindsight-watch.ts
 init_source();
-import { existsSync as existsSync112, readdirSync as readdirSync45 } from "node:fs";
+import { existsSync as existsSync113, readdirSync as readdirSync45 } from "node:fs";
 import { homedir as homedir63 } from "node:os";
 import { join as join112, resolve as resolve63 } from "node:path";
 
@@ -104497,8 +105072,8 @@ function postOperatorNoticeViaGateways(candidates, text, log, connectTimeoutMs =
 init_install_cron();
 
 // src/hindsight-watch/probe.ts
-import { spawnSync as spawnSync27 } from "node:child_process";
-import { readFileSync as readFileSync99, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
+import { spawnSync as spawnSync28 } from "node:child_process";
+import { readFileSync as readFileSync100, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
 import { homedir as homedir62 } from "node:os";
 import { resolve as resolve62 } from "node:path";
 
@@ -104626,7 +105201,7 @@ function readLlmSignals(series) {
 }
 
 // src/hindsight-watch/recall-log.ts
-import { closeSync as closeSync22, existsSync as existsSync111, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
+import { closeSync as closeSync22, existsSync as existsSync112, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
 import { join as join111 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
@@ -104635,7 +105210,7 @@ function recallLogPath2(agentDir) {
   return join111(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
 }
 function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
-  if (!existsSync111(path10))
+  if (!existsSync112(path10))
     return [];
   let text;
   let truncatedHead = false;
@@ -104847,7 +105422,7 @@ async function probeMetrics(url = DEFAULT_METRICS_URL, fetchImpl = fetch) {
   }
 }
 var defaultRunner4 = (cmd, args) => {
-  const r = spawnSync27(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
+  const r = spawnSync28(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
   if (r.error)
     return { status: null, stdout: "", stderr: r.error.message };
   return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
@@ -104875,7 +105450,7 @@ function readDropCount(hindsightDir) {
   try {
     if (statSync59(path10).size > DROPS_LEDGER_MAX_BYTES)
       return 0;
-    parsed = JSON.parse(readFileSync99(path10, "utf8"));
+    parsed = JSON.parse(readFileSync100(path10, "utf8"));
   } catch {
     return 0;
   }
@@ -105923,7 +106498,7 @@ function collectRelayCandidates(agentsDir) {
   const candidates = [];
   for (const name of readdirSync45(agentsDir).sort()) {
     const sock = resolve63(agentsDir, name, "telegram", "gateway.sock");
-    if (existsSync112(sock))
+    if (existsSync113(sock))
       candidates.push({ agent: name, sock });
   }
   return orderRelayCandidates(candidates);
@@ -105945,13 +106520,13 @@ async function notifyOperator(agentsDir, text, log) {
 
 // src/cli/openrouter-watch.ts
 init_source();
-import { existsSync as existsSync114, readdirSync as readdirSync46 } from "node:fs";
+import { existsSync as existsSync115, readdirSync as readdirSync46 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
 import { join as join113, resolve as resolve65 } from "node:path";
 
 // src/openrouter/install-cron.ts
-import { existsSync as existsSync113, mkdirSync as mkdirSync64, readFileSync as readFileSync100, renameSync as renameSync29, writeFileSync as writeFileSync47 } from "node:fs";
-import { dirname as dirname43 } from "node:path";
+import { existsSync as existsSync114, mkdirSync as mkdirSync65, readFileSync as readFileSync101, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
+import { dirname as dirname44 } from "node:path";
 var CRON_PATH2 = "/etc/cron.d/openrouter-watch";
 var CRON_SCHEDULE2 = "17 * * * *";
 var CRON_LOG_PATH2 = "/var/log/openrouter-watch.log";
@@ -105968,30 +106543,30 @@ function renderCron2(opts) {
 function installCron2(opts) {
   const path10 = opts.path ?? CRON_PATH2;
   const content = renderCron2(opts);
-  if (existsSync113(path10)) {
+  if (existsSync114(path10)) {
     try {
-      if (readFileSync100(path10, "utf8") === content) {
+      if (readFileSync101(path10, "utf8") === content) {
         return { status: "unchanged", path: path10, content };
       }
     } catch {}
   }
-  mkdirSync64(dirname43(path10), { recursive: true });
+  mkdirSync65(dirname44(path10), { recursive: true });
   const tmp = `${path10}.${process.pid}.tmp`;
-  writeFileSync47(tmp, content, { mode: 420 });
-  renameSync29(tmp, path10);
+  writeFileSync48(tmp, content, { mode: 420 });
+  renameSync30(tmp, path10);
   return { status: "installed", path: path10, content };
 }
 // src/openrouter/state.ts
-import { mkdirSync as mkdirSync65, readFileSync as readFileSync101, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
+import { mkdirSync as mkdirSync66, readFileSync as readFileSync102, renameSync as renameSync31, writeFileSync as writeFileSync49 } from "node:fs";
 import { homedir as homedir64 } from "node:os";
-import { dirname as dirname44, resolve as resolve64 } from "node:path";
+import { dirname as dirname45, resolve as resolve64 } from "node:path";
 function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir64()) {
   return resolve64(home2, ".switchroom", "openrouter-watch", "state.json");
 }
 function loadState2(path10) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync101(path10, "utf8"));
+    parsed = JSON.parse(readFileSync102(path10, "utf8"));
   } catch {
     return {};
   }
@@ -106011,12 +106586,12 @@ function loadState2(path10) {
   return out;
 }
 function saveState2(path10, state) {
-  mkdirSync65(dirname44(path10), { recursive: true, mode: 448 });
+  mkdirSync66(dirname45(path10), { recursive: true, mode: 448 });
   const tmp = `${path10}.${process.pid}.tmp`;
   const payload = { v: 1, ...state };
-  writeFileSync48(tmp, JSON.stringify(payload, null, 2) + `
+  writeFileSync49(tmp, JSON.stringify(payload, null, 2) + `
 `, { mode: 384 });
-  renameSync30(tmp, path10);
+  renameSync31(tmp, path10);
 }
 
 // src/openrouter/watch.ts
@@ -106201,7 +106776,7 @@ async function notifyOperator2(agentsDir, text, log) {
   try {
     for (const name of readdirSync46(agentsDir).sort()) {
       const sock = resolve65(agentsDir, name, "telegram", "gateway.sock");
-      if (existsSync114(sock))
+      if (existsSync115(sock))
         candidates.push({ agent: name, sock });
     }
   } catch (e) {