switchroom 0.21.13 → 0.21.14

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.21.13", COMMIT_SHA = "4a70ee58", COMMIT_DATE = "2026-08-15T09:11:57Z";
+var VERSION = "0.21.14", COMMIT_SHA = "2d43063c", COMMIT_DATE = "2026-08-16T08:34:12Z";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -16025,6 +16025,23 @@ function loadHostCapabilities() {
   warnDegradedHostCapabilities(read);
   return read.caps;
 }
+function isDefaultedVoiceEngine(r) {
+  return r.reason !== "verdict";
+}
+function resolveVoiceEngine() {
+  const read = readHostCapabilities();
+  warnDegradedHostCapabilities(read);
+  if (read.status === "ok" && read.caps) {
+    return {
+      engine: read.caps.voice.engine,
+      reason: "verdict",
+      path: read.path,
+      detail: ""
+    };
+  }
+  const reason = read.status === "absent" ? "no-verdict" : read.status === "unreadable" ? "unreadable" : "malformed";
+  return { engine: "cloud", reason, path: read.path, detail: read.detail };
+}
 var HOST_CAPABILITIES_VERSION = 1, _warnedReads;
 var init_host_capabilities = __esm(() => {
   init_paths();
@@ -33772,7 +33789,7 @@ function generateCompose(opts) {
   const precreateHostDirs = opts.precreateHostDirs ?? (opts.homeDir !== undefined || opts.probeHomeDir !== undefined);
   const switchroomConfigPath = resolveConfigMountSource(opts.switchroomConfigPath, homePrefix);
   const bundledSkillsPoolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const voiceEngine = opts.voiceEngine ?? loadHostCapabilities()?.voice.engine ?? "cloud";
+  const voiceEngine = opts.voiceEngine ?? resolveVoiceEngine().engine;
   let resolvedAnalyticsId = null;
   if (probeHome !== "") {
     const idPath = join18(probeHome, ".switchroom", "analytics-id");
@@ -34549,11 +34566,118 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
 var CONTAINER_OPERATOR_HOME = "/host-home", SWITCHROOM_HOME_MARKER = "switchroom.yaml";
 var init_operator_uid = () => {};
 
+// src/agents/compose-env.ts
+import { existsSync as existsSync25 } from "node:fs";
+import { dirname as dirname10 } from "node:path";
+function composeEnvPath(composePath) {
+  return dirname10(composePath) + "/.env";
+}
+function composeEnvFileArgs(composePath) {
+  const envPath = composeEnvPath(composePath);
+  return existsSync25(envPath) ? ["--env-file", envPath] : [];
+}
+var init_compose_env = () => {};
+
+// src/agents/singleton-reconcile.ts
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { readFileSync as readFileSync19 } from "node:fs";
+function resolveSingletonServices(voiceEngine) {
+  const engine = voiceEngine ?? resolveVoiceEngine().engine;
+  return engine === "local" ? [...CORE_SINGLETON_SERVICES, VOICE_SIDECAR_SERVICE] : [...CORE_SINGLETON_SERVICES];
+}
+function singletonContainerName(svc) {
+  return svc.startsWith("switchroom-") ? svc : `switchroom-${svc}`;
+}
+function readPinnedSingletonImages(composeText, services = SINGLETON_SERVICES) {
+  let doc;
+  try {
+    doc = import_yaml3.parse(composeText);
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const svc of services) {
+    const img = doc?.services?.[svc]?.image;
+    if (typeof img === "string" && img.length > 0)
+      out[svc] = img;
+  }
+  return out;
+}
+function defaultInspectImage(dockerBin, container) {
+  try {
+    const out = execFileSync9(dockerBin, ["inspect", "-f", "{{.Config.Image}}", container], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 5000 }).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function detectSingletonDrift(deps) {
+  const dockerBin = deps.dockerBin ?? "docker";
+  const readCompose = deps.readCompose ?? ((p) => readFileSync19(p, "utf-8"));
+  const inspectImage = deps.inspectImage ?? ((c) => defaultInspectImage(dockerBin, c));
+  const services = resolveSingletonServices(deps.voiceEngine);
+  let pinned = {};
+  try {
+    pinned = readPinnedSingletonImages(readCompose(deps.composeFile), services);
+  } catch {
+    pinned = {};
+  }
+  return services.map((service) => {
+    const container = singletonContainerName(service);
+    const running = inspectImage(container);
+    const pin = pinned[service] ?? null;
+    const needsRecreate = pin !== null && running !== pin;
+    return { service, container, running, pinned: pin, needsRecreate };
+  });
+}
+function defaultRecreate(dockerBin, project, composeFile, service) {
+  execFileSync9(dockerBin, ["compose", "-p", project, "-f", composeFile, ...composeEnvFileArgs(composeFile), "up", "-d", "--no-deps", service], { stdio: ["ignore", "pipe", "pipe"], timeout: 120000 });
+}
+function reconcileSingletons(deps) {
+  const dockerBin = deps.dockerBin ?? "docker";
+  const project = deps.project ?? "switchroom";
+  const log = deps.log ?? ((m) => process.stderr.write(m + `
+`));
+  const recreate = deps.recreate ?? ((svc) => defaultRecreate(dockerBin, project, deps.composeFile, svc));
+  const drift = detectSingletonDrift(deps);
+  const recreated = [];
+  const failed = [];
+  for (const d of drift) {
+    if (!d.needsRecreate)
+      continue;
+    log(`singleton-reconcile: ${d.service} drift ${d.running ?? "<absent>"} \u2192 ${d.pinned} \u2014 recreating`);
+    try {
+      recreate(d.service);
+      recreated.push(d.service);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(`singleton-reconcile: ${d.service} recreate FAILED: ${msg}`);
+      failed.push({ service: d.service, error: msg });
+    }
+  }
+  return { drift, recreated, failed };
+}
+var import_yaml3, CORE_SINGLETON_SERVICES, VOICE_SIDECAR_SERVICE = "voice-sidecar", SINGLETON_SERVICES;
+var init_singleton_reconcile = __esm(() => {
+  init_host_capabilities();
+  init_compose_env();
+  import_yaml3 = __toESM(require_dist(), 1);
+  CORE_SINGLETON_SERVICES = [
+    "vault-broker",
+    "approval-kernel",
+    "switchroom-auth-broker"
+  ];
+  SINGLETON_SERVICES = [
+    ...CORE_SINGLETON_SERVICES,
+    VOICE_SIDECAR_SERVICE
+  ];
+});
+
 // src/cli/write-compose.ts
 import { chownSync as chownSync3 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { basename as basename4, dirname as dirname10, join as join20 } from "node:path";
+import { basename as basename4, dirname as dirname11, join as join20 } from "node:path";
 function agentHadLiteLLMRouting(composeContent, agentName) {
   const lines = composeContent.split(`
 `);
@@ -34665,6 +34789,46 @@ function resolveHostHomeForCompose() {
   }
   return homedir10();
 }
+function parseComposeServiceNames(compose) {
+  const lines = compose.split(`
+`);
+  const names = [];
+  let inServices = false;
+  for (const line of lines) {
+    if (/^services:\s*$/.test(line)) {
+      inServices = true;
+      continue;
+    }
+    if (inServices && /^\S/.test(line))
+      break;
+    if (!inServices)
+      continue;
+    const m = /^ {2}([A-Za-z0-9_.-]+):\s*$/.exec(line);
+    if (m)
+      names.push(m[1]);
+  }
+  return names;
+}
+function voiceSidecarDropMessage(r) {
+  const why = r.reason === "no-verdict" ? `no verdict file at ${r.path}` : `the verdict at ${r.path} is ${r.reason} \u2014 ${r.detail}`;
+  return `voice-sidecar is being REMOVED because ${why}, so the voice engine ` + "defaulted to `cloud`. This host is not known to lack a GPU \u2014 switchroom " + "could not tell. Re-run `switchroom setup` to re-probe before applying, or confirm the removal is intended.";
+}
+function detectVoiceSidecarDrop(previous, content, resolution) {
+  if (!isDefaultedVoiceEngine(resolution))
+    return null;
+  if (previous === null)
+    return null;
+  if (!parseComposeServiceNames(previous).includes(VOICE_SIDECAR_SERVICE))
+    return null;
+  if (parseComposeServiceNames(content).includes(VOICE_SIDECAR_SERVICE))
+    return null;
+  return {
+    reason: resolution.reason,
+    path: resolution.path,
+    detail: resolution.detail,
+    message: voiceSidecarDropMessage(resolution)
+  };
+}
 async function computeComposeContent(opts) {
   const release = resolveRelease({ override: opts.releaseOverride, root: opts.config.release });
   const imageTag = resolveImageTag(release);
@@ -34677,10 +34841,12 @@ async function computeComposeContent(opts) {
     previous = null;
   }
   const litellmConfirmedAgents = await resolveLiteLLMConfirmedAgents(opts.config, previous);
+  const voiceResolution = resolveVoiceEngine();
   const content = generateCompose({
     config: opts.config,
     imageTag,
     litellmConfirmedAgents,
+    voiceEngine: voiceResolution.engine,
     buildMode: opts.buildMode ?? "pull",
     buildContext: opts.buildContext,
     homeDir: resolveHostHomeForCompose(),
@@ -34690,7 +34856,13 @@ async function computeComposeContent(opts) {
     dockerSocketPath: resolveDockerSocketPath()
   });
   const previousImageTag = previous ? AGENT_IMAGE_TAG_RE.exec(previous)?.[1] ?? null : null;
-  return { content, imageTag, previous, previousImageTag };
+  const voiceSidecarDrop = detectVoiceSidecarDrop(previous, content, voiceResolution);
+  if (voiceSidecarDrop && !_warnedVoiceDrop) {
+    _warnedVoiceDrop = true;
+    process.stderr.write(`[switchroom] WARNING: ${voiceSidecarDrop.message}
+`);
+  }
+  return { content, imageTag, previous, previousImageTag, voiceSidecarDrop };
 }
 function composeBackupPath(composePath) {
   return composePath + BACKUP_SUFFIX;
@@ -34721,7 +34893,7 @@ function shouldBackupCompose(previous, next, existingBackupTag) {
 async function writeComposeFile(opts) {
   const { content, imageTag, previous, previousImageTag } = await computeComposeContent(opts);
   const operatorUid = resolveOperatorUid();
-  await mkdir(dirname10(opts.composePath), { recursive: true });
+  await mkdir(dirname11(opts.composePath), { recursive: true });
   if (shouldBackupCompose(previous, content, await readBackupImageTag(opts.composePath))) {
     try {
       await copyFile(opts.composePath, composeBackupPath(opts.composePath));
@@ -34743,18 +34915,20 @@ async function writeComposeFile(opts) {
     previousImageTag
   };
 }
-var AGENT_IMAGE_TAG_RE, CONTAINER_CONFIG_PREFIX = "/state/config/", BACKUP_SUFFIX = ".bak";
+var AGENT_IMAGE_TAG_RE, CONTAINER_CONFIG_PREFIX = "/state/config/", _warnedVoiceDrop = false, BACKUP_SUFFIX = ".bak";
 var init_write_compose = __esm(() => {
   init_compose();
   init_docker_socket();
   init_agent_config();
   init_operator_uid();
   init_merge();
+  init_singleton_reconcile();
+  init_host_capabilities();
   AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
 });
 
 // src/agents/tmux.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 function sendAgentInterrupt(opts) {
   const { agentName } = opts;
   const attempts = typeof opts.attempts === "number" && opts.attempts > 0 ? opts.attempts : 1;
@@ -34764,7 +34938,7 @@ function sendAgentInterrupt(opts) {
   let lastError = null;
   for (let i = 0;i < attempts; i++) {
     try {
-      execFileSync9("tmux", args, {
+      execFileSync10("tmux", args, {
         timeout: 3000,
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -34789,23 +34963,11 @@ var init_tmux = __esm(() => {
   MAX_BYTES = 10 * 1024 * 1024;
 });
 
-// src/agents/compose-env.ts
-import { existsSync as existsSync25 } from "node:fs";
-import { dirname as dirname11 } from "node:path";
-function composeEnvPath(composePath) {
-  return dirname11(composePath) + "/.env";
-}
-function composeEnvFileArgs(composePath) {
-  const envPath = composeEnvPath(composePath);
-  return existsSync25(envPath) ? ["--env-file", envPath] : [];
-}
-var init_compose_env = () => {};
-
 // src/agents/docker-fleet.ts
 import { resolve as resolve17 } from "node:path";
 import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 function resolveSwitchroomHome(explicit) {
   if (explicit && explicit.length > 0)
     return explicit;
@@ -34837,7 +34999,7 @@ function bringUpAgentService(opts) {
   const dockerBin = opts.dockerBin ?? "docker";
   const stdio = opts.stdio ?? "inherit";
   for (const svc of ["vault-broker", "approval-kernel", "switchroom-auth-broker"]) {
-    execFileSync10(dockerBin, [
+    execFileSync11(dockerBin, [
       "compose",
       "-f",
       composePath,
@@ -34849,7 +35011,7 @@ function bringUpAgentService(opts) {
       svc
     ], { stdio });
   }
-  execFileSync10(dockerBin, [
+  execFileSync11(dockerBin, [
     "compose",
     "-f",
     composePath,
@@ -34868,101 +35030,6 @@ var init_docker_fleet = __esm(() => {
   init_loader();
 });
 
-// src/agents/singleton-reconcile.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
-import { readFileSync as readFileSync19 } from "node:fs";
-function resolveSingletonServices(voiceEngine) {
-  const engine = voiceEngine ?? loadHostCapabilities()?.voice.engine ?? "cloud";
-  return engine === "local" ? [...CORE_SINGLETON_SERVICES, VOICE_SIDECAR_SERVICE] : [...CORE_SINGLETON_SERVICES];
-}
-function singletonContainerName(svc) {
-  return svc.startsWith("switchroom-") ? svc : `switchroom-${svc}`;
-}
-function readPinnedSingletonImages(composeText, services = SINGLETON_SERVICES) {
-  let doc;
-  try {
-    doc = import_yaml3.parse(composeText);
-  } catch {
-    return {};
-  }
-  const out = {};
-  for (const svc of services) {
-    const img = doc?.services?.[svc]?.image;
-    if (typeof img === "string" && img.length > 0)
-      out[svc] = img;
-  }
-  return out;
-}
-function defaultInspectImage(dockerBin, container) {
-  try {
-    const out = execFileSync11(dockerBin, ["inspect", "-f", "{{.Config.Image}}", container], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 5000 }).trim();
-    return out.length > 0 ? out : null;
-  } catch {
-    return null;
-  }
-}
-function detectSingletonDrift(deps) {
-  const dockerBin = deps.dockerBin ?? "docker";
-  const readCompose = deps.readCompose ?? ((p) => readFileSync19(p, "utf-8"));
-  const inspectImage = deps.inspectImage ?? ((c) => defaultInspectImage(dockerBin, c));
-  const services = resolveSingletonServices(deps.voiceEngine);
-  let pinned = {};
-  try {
-    pinned = readPinnedSingletonImages(readCompose(deps.composeFile), services);
-  } catch {
-    pinned = {};
-  }
-  return services.map((service) => {
-    const container = singletonContainerName(service);
-    const running = inspectImage(container);
-    const pin = pinned[service] ?? null;
-    const needsRecreate = pin !== null && running !== pin;
-    return { service, container, running, pinned: pin, needsRecreate };
-  });
-}
-function defaultRecreate(dockerBin, project, composeFile, service) {
-  execFileSync11(dockerBin, ["compose", "-p", project, "-f", composeFile, ...composeEnvFileArgs(composeFile), "up", "-d", "--no-deps", service], { stdio: ["ignore", "pipe", "pipe"], timeout: 120000 });
-}
-function reconcileSingletons(deps) {
-  const dockerBin = deps.dockerBin ?? "docker";
-  const project = deps.project ?? "switchroom";
-  const log = deps.log ?? ((m) => process.stderr.write(m + `
-`));
-  const recreate = deps.recreate ?? ((svc) => defaultRecreate(dockerBin, project, deps.composeFile, svc));
-  const drift = detectSingletonDrift(deps);
-  const recreated = [];
-  const failed = [];
-  for (const d of drift) {
-    if (!d.needsRecreate)
-      continue;
-    log(`singleton-reconcile: ${d.service} drift ${d.running ?? "<absent>"} \u2192 ${d.pinned} \u2014 recreating`);
-    try {
-      recreate(d.service);
-      recreated.push(d.service);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      log(`singleton-reconcile: ${d.service} recreate FAILED: ${msg}`);
-      failed.push({ service: d.service, error: msg });
-    }
-  }
-  return { drift, recreated, failed };
-}
-var import_yaml3, CORE_SINGLETON_SERVICES, VOICE_SIDECAR_SERVICE = "voice-sidecar", SINGLETON_SERVICES;
-var init_singleton_reconcile = __esm(() => {
-  init_host_capabilities();
-  init_compose_env();
-  import_yaml3 = __toESM(require_dist(), 1);
-  CORE_SINGLETON_SERVICES = [
-    "vault-broker",
-    "approval-kernel",
-    "switchroom-auth-broker"
-  ];
-  SINGLETON_SERVICES = [
-    ...CORE_SINGLETON_SERVICES,
-    VOICE_SIDECAR_SERVICE
-  ];
-});
-
 // src/agents/lifecycle.ts
 import { execFileSync as execFileSync12, spawn, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync26, mkdirSync as mkdirSync18, writeFileSync as writeFileSync9, renameSync as renameSync7, readFileSync as readFileSync20 } from "node:fs";
@@ -48724,8 +48791,213 @@ var init_doctor_memory = __esm(() => {
   MIN_HINDSIGHT_SHM_BYTES = 1024 * 1024 * 1024;
 });
 
+// src/memory/hindsight-shim-contract.ts
+function openApiHasRoute(spec, route) {
+  const methods = spec.paths?.[route.path];
+  if (!methods || typeof methods !== "object")
+    return false;
+  return Object.prototype.hasOwnProperty.call(methods, route.method.toLowerCase());
+}
+function missingRoutesForTool(spec, toolName) {
+  const required = SYNTHESIZED_TOOL_ROUTES[toolName];
+  if (!required)
+    return [];
+  return required.filter((r) => !openApiHasRoute(spec, r));
+}
+async function fetchHindsightOpenApi(apiBaseUrl, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const base = apiBaseUrl.replace(/\/+$/, "");
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? OPENAPI_FETCH_TIMEOUT_MS);
+  try {
+    const res = await doFetch(`${base}/openapi.json`, { signal: controller.signal });
+    if (!res.ok)
+      return null;
+    const body = await res.json();
+    if (!body || typeof body !== "object" || typeof body.paths !== "object") {
+      return null;
+    }
+    return body;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+class ShimContractPin {
+  apiBaseUrl;
+  opts;
+  cached = null;
+  cachedAt = null;
+  failedAt = null;
+  constructor(apiBaseUrl, opts = {}) {
+    this.apiBaseUrl = apiBaseUrl;
+    this.opts = opts;
+  }
+  now() {
+    return this.opts.now ? this.opts.now() : Date.now();
+  }
+  async spec() {
+    const positiveCacheMs = this.opts.positiveCacheMs ?? 0;
+    if (this.cached) {
+      const stale = positiveCacheMs > 0 && this.cachedAt !== null && this.now() - this.cachedAt >= positiveCacheMs;
+      if (!stale)
+        return this.cached;
+      this.cached = null;
+      this.cachedAt = null;
+    }
+    const negativeCacheMs = this.opts.negativeCacheMs ?? 0;
+    if (negativeCacheMs > 0 && this.failedAt !== null && this.now() - this.failedAt < negativeCacheMs) {
+      return null;
+    }
+    const fetched = await fetchHindsightOpenApi(this.apiBaseUrl, this.opts);
+    if (fetched) {
+      this.cached = fetched;
+      this.cachedAt = this.now();
+      this.failedAt = null;
+    } else if (negativeCacheMs > 0) {
+      this.failedAt = this.now();
+    }
+    return fetched;
+  }
+  async preflight(toolName) {
+    const spec = await this.spec();
+    if (!spec)
+      return { ok: true };
+    const missing = missingRoutesForTool(spec, toolName);
+    if (missing.length === 0)
+      return { ok: true };
+    const engineVersion = spec.info?.version ?? "unknown";
+    const routeList = missing.map((r) => `${r.method.toUpperCase()} ${r.path}`).join(", ");
+    return {
+      ok: false,
+      text: `${toolName} is unavailable: the live Hindsight engine (api_version ` + `${engineVersion}) no longer exposes the REST route(s) this tool is ` + `synthesized over: ${routeList}. This is not a silent empty result \u2014 ` + `the shim confirmed the route is gone and is refusing the call rather ` + `than guessing. If the engine renamed/moved the route, this tool's ` + `implementation needs updating; if the engine now ships this ` + `capability as a real MCP tool, the synthesis should be retired (see ` + `the retirement seam in withSynthesizedTools, hindsight-mcp-shim.ts). ` + `\`switchroom doctor\`'s hindsight shim contract rows carry the same ` + `finding fleet-wide.`
+    };
+  }
+}
+var OPENAPI_FETCH_TIMEOUT_MS = 3000, SYNTHESIZED_TOOL_ROUTES, SYNTHESIZED_ROUTE_TOOL_NAMES;
+var init_hindsight_shim_contract = __esm(() => {
+  SYNTHESIZED_TOOL_ROUTES = {
+    deactivate_directive: [
+      { path: "/v1/default/banks/{bank_id}/directives", method: "get" },
+      {
+        path: "/v1/default/banks/{bank_id}/directives/{directive_id}",
+        method: "patch"
+      }
+    ],
+    reactivate_directive: [
+      { path: "/v1/default/banks/{bank_id}/directives", method: "get" },
+      {
+        path: "/v1/default/banks/{bank_id}/directives/{directive_id}",
+        method: "patch"
+      }
+    ],
+    search_knowledge_pages: [
+      {
+        path: "/v1/default/banks/{bank_id}/knowledge-base/search",
+        method: "get"
+      }
+    ],
+    get_knowledge_page: [
+      {
+        path: "/v1/default/banks/{bank_id}/knowledge-base/pages/{page_id}",
+        method: "get"
+      }
+    ],
+    get_knowledge_tree: [
+      {
+        path: "/v1/default/banks/{bank_id}/knowledge-base/tree",
+        method: "get"
+      }
+    ]
+  };
+  SYNTHESIZED_ROUTE_TOOL_NAMES = Object.keys(SYNTHESIZED_TOOL_ROUTES);
+});
+
+// src/cli/doctor-hindsight-shim-contract.ts
+function classifySynthesizedToolRoute(spec, toolName) {
+  const missing = missingRoutesForTool(spec, toolName);
+  if (missing.length === 0)
+    return null;
+  const routeList = missing.map((r) => `${r.method.toUpperCase()} ${r.path}`).join(", ");
+  return {
+    name: `${SHIM_CONTRACT_CHECK_PREFIX}: ${toolName}`,
+    status: "fail",
+    detail: `the live engine's /openapi.json no longer declares [${routeList}] \u2014 ` + `the REST route(s) '${toolName}' is synthesized over. Every call to ` + `this tool will now be loud-rejected by the shim's contract preflight ` + `(ShimContractPin.preflight in hindsight-mcp-shim.ts) rather than ` + `silently returning nothing, but the tool is effectively dead until ` + `this is fixed.`,
+    fix: "If the engine renamed/moved the route, update SYNTHESIZED_TOOL_ROUTES " + "(src/memory/hindsight-shim-contract.ts) and the corresponding " + "DirectiveAdmin/KnowledgeAdmin call to match. If the engine now " + "registers this capability as a real MCP tool, retire the synthesis " + "instead \u2014 see the retirement seam in withSynthesizedTools " + "(src/cli/hindsight-mcp-shim.ts)."
+  };
+}
+function classifyShimContractVersion(spec) {
+  const name = `${SHIM_CONTRACT_CHECK_PREFIX}: version`;
+  const live = spec.info?.version;
+  if (typeof live !== "string" || live.length === 0) {
+    return {
+      name,
+      status: "warn",
+      detail: "/openapi.json has no info.version \u2014 cannot confirm the shim's " + "REST route contract is pinned to a known engine version."
+    };
+  }
+  const cmp = compareApiVersion(live, HINDSIGHT_MIN_API_VERSION);
+  if (cmp === 0) {
+    return {
+      name,
+      status: "ok",
+      detail: `/openapi.json info.version ${live} matches the pinned ${HINDSIGHT_MIN_API_VERSION}`
+    };
+  }
+  if (cmp < 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `/openapi.json info.version ${live} is OLDER than the pinned ` + `${HINDSIGHT_MIN_API_VERSION} \u2014 the REST route contract the five ` + `synthesized tools depend on may not exist on this server.`,
+      fix: "Same remediation as the `hindsight version` check: update the " + "pinned image, or deliberately re-pin HINDSIGHT_MIN_API_VERSION to " + "this older version."
+    };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `/openapi.json info.version ${live} is NEWER than the pinned ` + `${HINDSIGHT_MIN_API_VERSION} \u2014 the engine may have grown a native ` + `MCP tool that makes one of the five synthesized tools obsolete; ` + `re-check the retirement seam (withSynthesizedTools, ` + `hindsight-mcp-shim.ts).`
+  };
+}
+function classifyHindsightShimContract(spec) {
+  const results = [classifyShimContractVersion(spec)];
+  const routeRows = SYNTHESIZED_ROUTE_TOOL_NAMES.map((tool) => classifySynthesizedToolRoute(spec, tool)).filter((r) => r !== null);
+  if (routeRows.length === 0) {
+    results.push({
+      name: `${SHIM_CONTRACT_CHECK_PREFIX}: routes`,
+      status: "ok",
+      detail: `all ${SYNTHESIZED_ROUTE_TOOL_NAMES.length} synthesized tools' REST routes are present in /openapi.json`
+    });
+  } else {
+    results.push(...routeRows);
+  }
+  return results;
+}
+async function runHindsightShimContractCheck(mcpUrl, opts = {}) {
+  const origin = mcpUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "");
+  const spec = await fetchHindsightOpenApi(origin, opts);
+  if (!spec) {
+    return [
+      {
+        name: `${SHIM_CONTRACT_CHECK_PREFIX}: routes`,
+        status: "warn",
+        detail: `the engine is reachable but /openapi.json did not return a usable ` + `spec \u2014 the shim contract guard is INACTIVE: neither this doctor ` + `check nor ShimContractPin's loud call-time preflight (` + `hindsight-mcp-shim.ts) can detect a route rename/removal under the ` + `five synthesized tools (deactivate_directive, reactivate_directive, ` + `search_knowledge_pages, get_knowledge_page, get_knowledge_tree) ` + `right now. Calls degrade to "unknown, proceed" and a route drop ` + `would surface as a bare failed REST call instead of a named refusal.`,
+        fix: "Confirm /openapi.json is served at the engine's origin (FastAPI " + "serves it by default; check for `docs_url`/`openapi_url` disabled " + "in the engine's startup config, or a reverse proxy stripping the " + "route). If OpenAPI docs are deliberately disabled in production, " + "this warning is expected and the route contract is unverifiable " + "by design \u2014 the REST layer's own error handling remains the " + "backstop for the five synthesized tools."
+      }
+    ];
+  }
+  return classifyHindsightShimContract(spec);
+}
+var SHIM_CONTRACT_CHECK_PREFIX = "hindsight shim contract";
+var init_doctor_hindsight_shim_contract = __esm(() => {
+  init_hindsight_repair();
+  init_hindsight_shim_contract();
+  init_hindsight_tools();
+});
+
 // src/cli/doctor-recall-health.ts
-import { closeSync as closeSync13, existsSync as existsSync60, openSync as openSync13, readSync as readSync3, statSync as statSync32 } from "node:fs";
+import { closeSync as closeSync13, existsSync as existsSync60, openSync as openSync13, readSync as readSync3, statSync as statSync33 } from "node:fs";
 import { join as join54 } from "node:path";
 function filterRecentRecallRows(rows, maxAgeMs = RECALL_HEALTH_WINDOW_MAX_AGE_MS, now = Date.now()) {
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0)
@@ -48821,7 +49093,7 @@ function readRecallLogTail(path7, windowRows = RECALL_HEALTH_WINDOW_ROWS) {
   let truncatedHead = false;
   let fd;
   try {
-    const size = statSync32(path7).size;
+    const size = statSync33(path7).size;
     const start = Math.max(0, size - RECALL_HEALTH_MAX_TAIL_BYTES);
     truncatedHead = start > 0;
     const length = size - start;
@@ -49253,7 +49525,7 @@ var init_doctor_observation_scopes = __esm(() => {
 
 // src/hindsight-watch/install-cron.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
-import { chownSync as chownSync8, existsSync as existsSync61, mkdirSync as mkdirSync37, readFileSync as readFileSync51, renameSync as renameSync17, statSync as statSync33, writeFileSync as writeFileSync24 } from "node:fs";
+import { chownSync as chownSync8, existsSync as existsSync61, mkdirSync as mkdirSync37, readFileSync as readFileSync51, renameSync as renameSync17, statSync as statSync34, writeFileSync as writeFileSync24 } from "node:fs";
 import { dirname as dirname24 } from "node:path";
 function renderCron(opts) {
   return `# switchroom hindsight-watch \u2014 model-free memory watchdog.
@@ -49290,7 +49562,7 @@ function ensureLogFile(opts) {
   const isRoot = process.getuid?.() === 0;
   let alreadyOwned = false;
   try {
-    const st = statSync33(path7);
+    const st = statSync34(path7);
     alreadyOwned = st.uid === uid && st.gid === gid;
   } catch {}
   if (isRoot && !alreadyOwned) {
@@ -49554,7 +49826,7 @@ var init_state2 = __esm(() => {
 });
 
 // src/cli/doctor-hindsight-watch.ts
-import { existsSync as existsSync62, statSync as statSync34 } from "node:fs";
+import { existsSync as existsSync62, statSync as statSync35 } from "node:fs";
 function classifyWatchArmed(cronPresent, stateMtimeMs, now) {
   const name = "hindsight-watch armed";
   if (stateMtimeMs === null) {
@@ -49592,7 +49864,7 @@ function classifyWatchArmed(cronPresent, stateMtimeMs, now) {
 function checkHindsightWatchArmed(now = Date.now(), cronPath = CRON_PATH, statePath = defaultStatePath2()) {
   let mtime = null;
   try {
-    mtime = statSync34(statePath).mtimeMs;
+    mtime = statSync35(statePath).mtimeMs;
   } catch {}
   return classifyWatchArmed(existsSync62(cronPath), mtime, now);
 }
@@ -50520,7 +50792,7 @@ import {
   readdirSync as readdirSync24,
   readFileSync as readFileSync53,
   realpathSync as realpathSync5,
-  statSync as statSync35,
+  statSync as statSync36,
   unlinkSync as unlinkSync15
 } from "node:fs";
 import { join as join55, relative as relative3, sep as sep5 } from "node:path";
@@ -50575,7 +50847,7 @@ function guardedCopyFile(src, dest, allowedRoot) {
   }
   let realStat;
   try {
-    realStat = statSync35(real);
+    realStat = statSync36(real);
   } catch {
     return { status: "missing" };
   }
@@ -50622,7 +50894,7 @@ function copyAgentWorkspace(agentName, liveWorkspace, repoWorkspace, skipped, lo
 }
 function dirExists(p) {
   try {
-    return statSync35(p).isDirectory();
+    return statSync36(p).isDirectory();
   } catch {
     return false;
   }
@@ -50676,7 +50948,7 @@ function scanStagedForSecrets(repoPath, git, log) {
     const abs = join55(repoPath, relPath);
     let content;
     try {
-      const st = statSync35(abs);
+      const st = statSync36(abs);
       if (!st.isFile() || st.size > SCAN_MAX_FILE_BYTES)
         continue;
       const buf = readFileSync53(abs);
@@ -50834,7 +51106,7 @@ import {
   readFileSync as readFileSync54,
   renameSync as renameSync19,
   rmSync as rmSync17,
-  statSync as statSync36,
+  statSync as statSync37,
   writeFileSync as writeFileSync26
 } from "node:fs";
 import { dirname as dirname26 } from "node:path";
@@ -50896,7 +51168,7 @@ function ensureLogFile2(opts) {
   const isRoot = process.getuid?.() === 0;
   let alreadyOwned = false;
   try {
-    const st = statSync36(path7);
+    const st = statSync37(path7);
     alreadyOwned = st.uid === uid && st.gid === gid;
   } catch {}
   if (isRoot && !alreadyOwned) {
@@ -50993,7 +51265,7 @@ var CRON_PATH2 = "/etc/cron.d/switchroom-config-sync", CRON_LOG_PATH2 = "/var/lo
 var init_install_cron2 = () => {};
 
 // src/cli/doctor-config-repo.ts
-import { existsSync as existsSync65, readdirSync as readdirSync25, statSync as statSync37 } from "node:fs";
+import { existsSync as existsSync65, readdirSync as readdirSync25, statSync as statSync38 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { homedir as homedir27 } from "node:os";
 import { join as join56 } from "node:path";
@@ -51168,7 +51440,7 @@ function countUntrackedPersonalSkills(repoPath, git) {
       const rel = relPrefix ? `${relPrefix}/${ent}` : ent;
       let st;
       try {
-        st = statSync37(abs);
+        st = statSync38(abs);
       } catch {
         continue;
       }
@@ -51188,7 +51460,7 @@ function countUntrackedPersonalSkills(repoPath, git) {
       const abs = join56(ps, ent);
       let st;
       try {
-        st = statSync37(abs);
+        st = statSync38(abs);
       } catch {
         continue;
       }
@@ -51280,7 +51552,7 @@ function checkConfigRepo(config, now = Date.now()) {
 }
 function safeMtimeMs2(path7) {
   try {
-    return statSync37(path7).mtimeMs;
+    return statSync38(path7).mtimeMs;
   } catch {
     return null;
   }
@@ -52282,7 +52554,7 @@ import {
   constants as fsConstants3,
   existsSync as existsSync67,
   realpathSync as realpathSync6,
-  statSync as statSync38
+  statSync as statSync39
 } from "node:fs";
 import { userInfo, homedir as homedir29 } from "node:os";
 import { join as join59 } from "node:path";
@@ -52300,7 +52572,7 @@ function defaultStatVault(path7) {
   let uid = -1;
   let mode = 0;
   try {
-    const s = statSync38(real);
+    const s = statSync39(real);
     uid = s.uid;
     mode = s.mode & 511;
   } catch {
@@ -63851,7 +64123,7 @@ import {
   mkdirSync as mkdirSync43,
   readFileSync as readFileSync63,
   renameSync as renameSync21,
-  statSync as statSync39,
+  statSync as statSync40,
   writeFileSync as writeFileSync30
 } from "node:fs";
 import { homedir as homedir33 } from "node:os";
@@ -63869,7 +64141,7 @@ function resolveIo(io) {
     }),
     statUid: io.statUid ?? ((p) => {
       try {
-        return statSync39(p).uid;
+        return statSync40(p).uid;
       } catch {
         return;
       }
@@ -63879,7 +64151,7 @@ function resolveIo(io) {
     chown: io.chown ?? ((p, uid, gid) => chownSync10(p, uid, gid)),
     statOwner: io.statOwner ?? ((p) => {
       try {
-        const st = statSync39(p);
+        const st = statSync40(p);
         return { uid: st.uid, gid: st.gid };
       } catch {
         return;
@@ -65179,7 +65451,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
 var init_doctor_credentials_migration = () => {};
 
 // src/cli/doctor-agent-dotfile-ownership.ts
-import { existsSync as existsSync72, lstatSync as lstatSync11, statSync as statSync40 } from "node:fs";
+import { existsSync as existsSync72, lstatSync as lstatSync11, statSync as statSync41 } from "node:fs";
 import { join as join74 } from "node:path";
 function agentDotfileCandidates(agentDir) {
   return [
@@ -65196,7 +65468,7 @@ function runAgentDotfileOwnershipChecks(config, deps = {}) {
   if (agents.length === 0)
     return results;
   const exists = deps.existsSync ?? existsSync72;
-  const scanFs = deps.scanFs ?? { lstatSync: lstatSync11, statSync: statSync40 };
+  const scanFs = deps.scanFs ?? { lstatSync: lstatSync11, statSync: statSync41 };
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
     try {
@@ -65803,7 +66075,7 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync25 } from "node:child_process";
-import { existsSync as existsSync74, statSync as statSync41, readFileSync as readFileSync64 } from "node:fs";
+import { existsSync as existsSync74, statSync as statSync42, readFileSync as readFileSync64 } from "node:fs";
 import { homedir as homedir40 } from "node:os";
 import { join as join78 } from "node:path";
 import { createRequire as createRequire2 } from "node:module";
@@ -65831,7 +66103,7 @@ function defaultStatHost(p) {
   if (!existsSync74(p))
     return null;
   try {
-    const s = statSync41(p, { bigint: true });
+    const s = statSync42(p, { bigint: true });
     return { ino: s.ino, size: Number(s.size) };
   } catch {
     return null;
@@ -66169,7 +66441,7 @@ function probeOrphanVaultTokens(config, opts) {
 }
 function defaultTokenMtimeMs(agent, home2) {
   try {
-    return statSync41(join78(home2, ".switchroom", "agents", agent, ".vault-token")).mtimeMs;
+    return statSync42(join78(home2, ".switchroom", "agents", agent, ".vault-token")).mtimeMs;
   } catch {
     return null;
   }
@@ -66217,7 +66489,7 @@ function probeAutoUnlockBlob(home2) {
       fix: "Run `switchroom vault broker enable-auto-unlock` to seal the blob with the current passphrase + machine-id"
     };
   }
-  const sz = statSync41(blobPath).size;
+  const sz = statSync42(blobPath).size;
   if (sz === 0) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -66383,7 +66655,7 @@ var init_doctor_timezone = __esm(() => {
 });
 
 // src/cli/doctor-disk.ts
-import { closeSync as closeSync14, fstatSync as fstatSync4, openSync as openSync14, readSync as readSync4, statfsSync, statSync as statSync42 } from "node:fs";
+import { closeSync as closeSync14, fstatSync as fstatSync4, openSync as openSync14, readSync as readSync4, statfsSync, statSync as statSync43 } from "node:fs";
 import { dirname as dirname31 } from "node:path";
 function usageFromStatfs(s) {
   const bsize = s.bsize > 0 ? s.bsize : 0;
@@ -66406,7 +66678,7 @@ function fmtBytes(n) {
 }
 function nearestExistingPath(path7, exists = (p) => {
   try {
-    statSync42(p);
+    statSync43(p);
     return true;
   } catch {
     return false;
@@ -66854,7 +67126,7 @@ import {
   mkdirSync as mkdirSync44,
   readFileSync as readFileSync67,
   readdirSync as readdirSync28,
-  statSync as statSync43
+  statSync as statSync44
 } from "node:fs";
 import { dirname as dirname33, join as join81, resolve as resolve41 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
@@ -66881,7 +67153,7 @@ function findInNvm(bin) {
     for (const v of versions) {
       const candidate = join81(nvmRoot, v, "bin", bin);
       try {
-        const s = statSync43(candidate);
+        const s = statSync44(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
           return candidate;
         }
@@ -67541,7 +67813,7 @@ function checkHostCapabilitiesReadable(config, read = readHostCapabilities()) {
   const proven = voice?.gpuPresent === true && voice?.containerToolkit === true;
   let mode;
   try {
-    mode = statSync43(read.path).mode & 511;
+    mode = statSync44(read.path).mode & 511;
   } catch {
     mode = undefined;
   }
@@ -67827,6 +68099,7 @@ async function checkHindsight(config) {
   const versionRow = await checkHindsightVersion(url);
   if (versionRow)
     results.push(versionRow);
+  results.push(...await runHindsightShimContractCheck(url));
   results.push(checkHindsightConsumer(config));
   results.push(checkHindsightEnvKeysAreManaged(config));
   results.push(...checkHindsightContainerHealth());
@@ -69297,6 +69570,7 @@ var init_doctor = __esm(() => {
   init_hindsight_perf_defaults();
   init_memory_key_drift();
   init_doctor_memory();
+  init_doctor_hindsight_shim_contract();
   init_doctor_recall_health();
   init_doctor_hnsw_index();
   init_doctor_observation_scopes();
@@ -69374,7 +69648,7 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync3, chmodSync as chmodSync14, chownSync as chownSync11, constants as fsConstants5, existsSync as existsSync77, mkdirSync as mkdirSync45, readFileSync as readFileSync68, readdirSync as readdirSync29, renameSync as renameSync22, statSync as statSync44, writeFileSync as writeFileSync31 } from "node:fs";
+import { accessSync as accessSync3, chmodSync as chmodSync14, chownSync as chownSync11, constants as fsConstants5, existsSync as existsSync77, mkdirSync as mkdirSync45, readFileSync as readFileSync68, readdirSync as readdirSync29, renameSync as renameSync22, statSync as statSync45, writeFileSync as writeFileSync31 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -69679,7 +69953,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
     try {
       let cfgMode = 420;
       try {
-        cfgMode = statSync44(switchroomConfigPath).mode & 511;
+        cfgMode = statSync45(switchroomConfigPath).mode & 511;
       } catch {}
       writeConfigFileSync(switchroomConfigPath, configText, cfgMode);
       writeOut(source_default.gray(`  ~ litellm: granted read-ACL on per-agent keys (updated ${switchroomConfigPath})
@@ -70291,26 +70565,6 @@ async function probeVaultProvisioning(config, agentNames, home2) {
     needsHindsight
   };
 }
-function parseComposeServiceNames(compose) {
-  const lines = compose.split(`
-`);
-  const names = [];
-  let inServices = false;
-  for (const line of lines) {
-    if (/^services:\s*$/.test(line)) {
-      inServices = true;
-      continue;
-    }
-    if (inServices && /^\S/.test(line))
-      break;
-    if (!inServices)
-      continue;
-    const m = /^ {2}([A-Za-z0-9_.-]+):\s*$/.exec(line);
-    if (m)
-      names.push(m[1]);
-  }
-  return names;
-}
 async function runApplyDryRun(config, options, deps = {}, switchroomConfigPath) {
   const writeOut = deps.writeOut ?? ((s) => process.stdout.write(s));
   const writeErr = deps.writeErr ?? ((s) => process.stderr.write(s));
@@ -70398,6 +70652,9 @@ Dry-run: validating switchroom config (no changes will be written)...
     if (removedServices.length > 0) {
       info.push(`compose: services removed: ${removedServices.join(", ")}.`);
     }
+    if (computed.voiceSidecarDrop) {
+      warnings.push(`compose: ${computed.voiceSidecarDrop.message}`);
+    }
     if (previousImageTag !== null && !composeChanged) {
       info.push(`compose: no change (would be byte-identical to the current file).`);
     }
@@ -70708,7 +70965,7 @@ var init_apply = __esm(() => {
 });
 
 // src/host-control/audit-reader.ts
-import { closeSync as closeSync15, existsSync as existsSync81, openSync as openSync15, readSync as readSync5, statSync as statSync48 } from "node:fs";
+import { closeSync as closeSync15, existsSync as existsSync81, openSync as openSync15, readSync as readSync5, statSync as statSync49 } from "node:fs";
 import { homedir as homedir43 } from "node:os";
 import { join as join87 } from "node:path";
 function defaultAuditLogPath2(home2 = homedir43()) {
@@ -70735,7 +70992,7 @@ function tailBytes(path7, n, strict = false) {
   let fd;
   let size;
   try {
-    size = statSync48(path7).size;
+    size = statSync49(path7).size;
     fd = openSync15(path7, "r");
   } catch (err) {
     if (strict && err.code !== "ENOENT")
@@ -84273,7 +84530,12 @@ var init_server3 = __esm(() => {
         required: ["cron_expr", "prompt"],
         properties: {
           cron_expr: { type: "string" },
-          prompt: { type: "string", minLength: 1, maxLength: 4000 },
+          prompt: {
+            type: "string",
+            minLength: 1,
+            maxLength: 4000,
+            description: "The inbound turn YOU receive when this cron fires \u2014 not a message " + "sent to the user. Phrase it from your future-self's perspective " + `("Time for the daily digest \u2014 pull yesterday's GitHub activity and ` + 'DM the summary to chat 12345"), not as a request to you ("please ' + 'send the digest"). Include any ids/context that future turn will ' + "need, since a Tier-1 fire has no conversation context."
+          },
           secrets: { type: "array", items: { type: "string" } },
           name: { type: "string", pattern: "^[a-z0-9-]{1,40}$" },
           model: {
@@ -85098,6 +85360,9 @@ function classifyOrphanedDbTick(lines, alarmIdx) {
   }
   return verdict ?? "unrecovered";
 }
+function isFloodRejection(line) {
+  return FLOOD_REJECTION_RE.test(line.split(" desc=")[0] ?? line);
+}
 function lineInstantMs(line) {
   const iso = extractTs(line);
   if (iso === null)
@@ -85116,7 +85381,7 @@ function classifyReplyDeliveryEpisode(lines, failIdx) {
   const failMs = lineInstantMs(failLine);
   if (failMs === null)
     return "unrecovered";
-  let ladderEvidence = FLOOD_REJECTION_RE.test(failLine);
+  let ladderEvidence = isFloodRejection(failLine);
   for (let j = failIdx + 1;j < lines.length; j++) {
     const line = lines[j];
     if (!line)
@@ -85124,7 +85389,9 @@ function classifyReplyDeliveryEpisode(lines, failIdx) {
     const ms = lineInstantMs(line);
     if (ms !== null && ms - failMs > REPLY_DELIVERY_RECOVERY_WINDOW_MS)
       break;
-    if (RECOVERY_LADDER_MARKER_RE.test(line))
+    if (GATEWAY_FLOOD_LADDER_RE.test(line))
+      ladderEvidence = true;
+    else if (FUSE_SEND_DEFERRAL_RE.exec(line)?.[1] === chat)
       ladderEvidence = true;
     if (!TG_POST_RICH_LINE_RE.test(line))
       continue;
@@ -85136,7 +85403,7 @@ function classifyReplyDeliveryEpisode(lines, failIdx) {
     if (ms === null)
       continue;
     if (TG_POST_STATUS_RE.exec(line)?.[1] !== "ok") {
-      if (FLOOD_REJECTION_RE.test(line))
+      if (isFloodRejection(line))
         ladderEvidence = true;
       continue;
     }
@@ -85319,7 +85586,7 @@ function scanAgent(agent, turnsText, gatewayText, opts = {}) {
     escalate
   };
 }
-var HANG_MS = 360000, HANG_MAXTOOLS = 2, SILENT_NOOP_FLOOR_TS = 1783900800, GATEWAY_SIGNATURES, GATEWAY_SIGNAL_MEMBERS, GATEWAY_SIGNAL_NAMES, ORPHANED_DB_RECOVERED_RE, ORPHANED_DB_SWEEP_LINE_RE, ORPHANED_DB_ALARM_TARGET_RE, ORPHANED_DB_ALARM_COUNT_RE, ORPHANED_DB_LANE_VETO_RE, TG_POST_RICH_LINE_RE, TG_POST_STATUS_RE, TG_POST_CHAT_RE, TG_POST_THREAD_RE, RECOVERY_LADDER_MARKER_RE, FLOOD_REJECTION_RE, REPLY_DELIVERY_IMMEDIATE_RESEND_MS = 2000, REPLY_DELIVERY_RECOVERY_WINDOW_MS, ISO_TS_RE;
+var HANG_MS = 360000, HANG_MAXTOOLS = 2, SILENT_NOOP_FLOOR_TS = 1783900800, GATEWAY_SIGNATURES, GATEWAY_SIGNAL_MEMBERS, GATEWAY_SIGNAL_NAMES, ORPHANED_DB_RECOVERED_RE, ORPHANED_DB_SWEEP_LINE_RE, ORPHANED_DB_ALARM_TARGET_RE, ORPHANED_DB_ALARM_COUNT_RE, ORPHANED_DB_LANE_VETO_RE, TG_POST_RICH_LINE_RE, TG_POST_STATUS_RE, TG_POST_CHAT_RE, TG_POST_THREAD_RE, GATEWAY_FLOOD_LADDER_RE, FUSE_SEND_DEFERRAL_RE, FLOOD_REJECTION_RE, REPLY_DELIVERY_IMMEDIATE_RESEND_MS = 2000, REPLY_DELIVERY_RECOVERY_WINDOW_MS, ISO_TS_RE;
 var init_detect = __esm(() => {
   init_retry_api_call();
   GATEWAY_SIGNATURES = {
@@ -85346,8 +85613,9 @@ var init_detect = __esm(() => {
   TG_POST_STATUS_RE = /\bstatus=(ok|benign|retry|err)(?![a-z])/;
   TG_POST_CHAT_RE = /\bchat=(-?\d+)\b/;
   TG_POST_THREAD_RE = /\bthread=(\S+)/;
-  RECOVERY_LADDER_MARKER_RE = /429 rate limited|edit-flood-fuse deferred|outbox-sweep: deferred|queued card send failed/;
-  FLOOD_REJECTION_RE = /\berr=telegram_429\b|Too Many Requests|retry after \d/;
+  GATEWAY_FLOOD_LADDER_RE = /429 rate limited|outbox-sweep: deferred/;
+  FUSE_SEND_DEFERRAL_RE = /\bedit-flood-fuse deferred method=sendRichMessage\b[^\n]*\bkey=(?:cs|cer|ce|lr|t):(-?\d+)\b/;
+  FLOOD_REJECTION_RE = /\berr=telegram_429\b|\bcode=429\b/;
   REPLY_DELIVERY_RECOVERY_WINDOW_MS = DEFAULT_MAX_FLOOD_SLEEP_MS;
   ISO_TS_RE = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(Z|[+-]\d{2}:?\d{2})?/;
 });
@@ -93400,7 +93668,7 @@ import { spawn as spawn4 } from "node:child_process";
 // src/vault/broker/server.ts
 init_compose();
 import * as net3 from "node:net";
-import { mkdirSync as mkdirSync29, chmodSync as chmodSync9, chownSync as chownSync6, existsSync as existsSync47, readFileSync as readFileSync40, readdirSync as readdirSync20, statSync as statSync29, unlinkSync as unlinkSync12, writeFileSync as writeFileSync18 } from "node:fs";
+import { mkdirSync as mkdirSync29, chmodSync as chmodSync9, chownSync as chownSync6, existsSync as existsSync47, readFileSync as readFileSync40, readdirSync as readdirSync20, statSync as statSync30, unlinkSync as unlinkSync12, writeFileSync as writeFileSync18 } from "node:fs";
 
 // src/vault/broker/write-token-file.ts
 init_agent_uid();
@@ -93485,6 +93753,66 @@ import { dirname as dirname16, resolve as resolve32, basename as basename8 } fro
 import * as os4 from "node:os";
 import * as path5 from "node:path";
 
+// src/vault/broker/vault-refresh.ts
+init_vault();
+import { statSync as statSync29 } from "node:fs";
+function sameVaultStamp(a, b) {
+  return a.mtimeNs === b.mtimeNs && a.size === b.size && a.ino === b.ino;
+}
+function readVaultStamp(vaultPath) {
+  try {
+    const st = statSync29(vaultPath, { bigint: true });
+    return { mtimeNs: st.mtimeNs, size: st.size, ino: st.ino };
+  } catch {
+    return null;
+  }
+}
+function zeroSecrets(secrets) {
+  for (const [, entry] of Object.entries(secrets)) {
+    try {
+      if (entry.kind === "string" || entry.kind === "binary") {
+        entry.value = "";
+      }
+    } catch {}
+  }
+}
+function refreshVaultIfChanged(state, opts) {
+  const { vaultPath, force = false } = opts;
+  const open = opts.open ?? openVault;
+  const warn = opts.warn ?? ((m) => {
+    process.stderr.write(m);
+  });
+  const secrets = state.secrets;
+  const passphrase = state.passphrase;
+  if (secrets === null || passphrase === null)
+    return state;
+  const known = state.loadedStamp;
+  if (known === null)
+    return state;
+  const current = readVaultStamp(vaultPath);
+  if (current === null)
+    return state;
+  if (!force && sameVaultStamp(current, known))
+    return state;
+  if (!force && state.failedStamp !== null && sameVaultStamp(state.failedStamp, current)) {
+    return state;
+  }
+  opts.beforeOpen?.(vaultPath);
+  let next;
+  try {
+    next = open(passphrase, vaultPath);
+  } catch (err) {
+    const alreadyWarned = state.failedStamp !== null && sameVaultStamp(state.failedStamp, current);
+    if (!alreadyWarned) {
+      warn(`[vault-broker] WARNING: ${vaultPath} changed on disk but ` + `could not be re-opened (${err?.message ?? "unknown error"}) \u2014 ` + `continuing to serve the previously loaded secrets; will retry when ` + `the file changes again
+`);
+    }
+    return { ...state, failedStamp: current };
+  }
+  zeroSecrets(secrets);
+  return { secrets: next, passphrase, loadedStamp: current, failedStamp: null };
+}
+
 // src/vault/grants.ts
 import { createHash as createHash10, randomBytes as randomBytes9 } from "node:crypto";
 
@@ -95883,6 +96211,8 @@ class VaultBroker {
   testOpts;
   secrets = null;
   passphrase = null;
+  vaultStamp = null;
+  failedVaultStamp = null;
   config = null;
   startedAt = Date.now();
   server = null;
@@ -95977,13 +96307,53 @@ class VaultBroker {
   }
   unlockFromPassphrase(passphrase) {
     detectVaultLayoutDrift(this.vaultPath);
+    const stamp = this._readVaultStamp();
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
     this.passphrase = passphrase;
+    this.vaultStamp = stamp;
+    this.failedVaultStamp = null;
     this._setReadinessSentinel(true);
   }
+  _readVaultStamp() {
+    return readVaultStamp(this.vaultPath);
+  }
+  _reloadSecretsIfVaultChanged(force = false) {
+    let next;
+    try {
+      next = refreshVaultIfChanged({
+        secrets: this.secrets,
+        passphrase: this.passphrase,
+        loadedStamp: this.vaultStamp,
+        failedStamp: this.failedVaultStamp
+      }, { vaultPath: this.vaultPath, force, beforeOpen: detectVaultLayoutDrift });
+    } catch (err) {
+      this._failClosedOnVaultDrift(err);
+      return;
+    }
+    this.secrets = next.secrets;
+    this.vaultStamp = next.loadedStamp;
+    this.failedVaultStamp = next.failedStamp;
+  }
+  _failClosedOnVaultDrift(err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[vault-broker] FATAL: ${detail}
+[vault-broker] Refusing to serve secrets from a vault whose on-disk ` + `layout has diverged \u2014 locking. Fix the layout and restart the broker ` + `(\`switchroom apply\`); see docs/operators/state-e-recovery.md.
+`);
+    try {
+      this.auditLogger.write({
+        ts: new Date().toISOString(),
+        op: "lock",
+        caller: `pid:${process.pid}`,
+        pid: process.pid,
+        result: "error:vault-layout-drift"
+      });
+    } catch {}
+    this.lock();
+  }
   reload(config) {
     this.config = config;
+    this._reloadSecretsIfVaultChanged(true);
   }
   _setReadinessSentinel(ready) {
     const p = process.env.SWITCHROOM_VAULT_BROKER_READY_PATH;
@@ -95999,15 +96369,11 @@ class VaultBroker {
   }
   lock() {
     if (this.secrets !== null) {
-      for (const [, entry] of Object.entries(this.secrets)) {
-        try {
-          if (entry.kind === "string" || entry.kind === "binary") {
-            entry.value = "";
-          }
-        } catch {}
-      }
+      zeroSecrets(this.secrets);
       this.secrets = null;
     }
+    this.vaultStamp = null;
+    this.failedVaultStamp = null;
     this.passphrase = null;
     this._setReadinessSentinel(false);
   }
@@ -96327,6 +96693,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", "preflight_access is operator-only")));
         return;
       }
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -96358,6 +96725,7 @@ class VaultBroker {
       return;
     }
     if (req.op === "list") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -96433,6 +96801,7 @@ class VaultBroker {
       return;
     }
     if (req.op === "get") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -96620,10 +96989,24 @@ class VaultBroker {
       return;
     }
     if (req.op === "put") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null || this.passphrase === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
       }
+      if (this.failedVaultStamp !== null) {
+        writeAudit({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:vault-file-unreadable"
+        });
+        socket.write(encodeResponse(errorResponse("INTERNAL", "put refused: the vault file on disk changed and could not be decrypted with the passphrase this broker holds. Writing now would overwrite it with the broker's older in-memory state. Restore the vault file the broker was unlocked with, or restart the broker and unlock it with the current passphrase (reads keep serving the previously loaded secrets meanwhile).")));
+        return;
+      }
       let passphraseAttested = false;
       const requestedPostureAttest = req.attest_via_posture === true;
       if (requestedPostureAttest && req.passphrase !== undefined && req.passphrase !== "") {
@@ -96867,6 +97250,8 @@ class VaultBroker {
         return;
       }
       this.chownVaultToOperator();
+      this.vaultStamp = this._readVaultStamp();
+      this.failedVaultStamp = null;
       this.auditLogger.write({
         ts: new Date().toISOString(),
         op: "put",
@@ -97442,7 +97827,7 @@ class VaultBroker {
     if (!existsSync47(filePath))
       return false;
     try {
-      if (statSync29(filePath).size === 0)
+      if (statSync30(filePath).size === 0)
         return false;
     } catch {
       return false;
@@ -97650,7 +98035,7 @@ init_client();
 init_auto_unlock();
 var import_yaml11 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { readFileSync as readFileSync41, statSync as statSync30 } from "node:fs";
+import { readFileSync as readFileSync41, statSync as statSync31 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
 import { join as join44 } from "node:path";
 
@@ -97686,7 +98071,7 @@ function setVaultBrokerAutoUnlock(configPath, value) {
   doc.setIn(["vault", "broker", "autoUnlock"], value);
   let mode = 420;
   try {
-    mode = statSync30(configPath).mode & 511;
+    mode = statSync31(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, doc.toString(), mode);
 }
@@ -98572,7 +98957,7 @@ import {
   readdirSync as readdirSync21,
   readFileSync as readFileSync44,
   renameSync as renameSync15,
-  statSync as statSync31,
+  statSync as statSync32,
   symlinkSync as symlinkSync4,
   unlinkSync as unlinkSync14,
   writeSync as writeSync7
@@ -98724,7 +99109,7 @@ function backupVault(opts) {
     throw new Error(`vault backup refused: '${fullPath}' already exists ` + `(sub-second collision with another backup). Retry in 1 second, ` + `or check for a concurrent backup process.`);
   }
   renameSync15(tmpPath, fullPath);
-  const stat = statSync31(fullPath);
+  const stat = statSync32(fullPath);
   const sha256 = sha256OfFile(fullPath);
   const row = {
     ts: now.toISOString(),
@@ -107320,7 +107705,7 @@ function registerBuzzCommand(program3) {
 // src/cli/telegram.ts
 init_source();
 init_atomic();
-import { existsSync as existsSync79, readFileSync as readFileSync70, statSync as statSync45 } from "node:fs";
+import { existsSync as existsSync79, readFileSync as readFileSync70, statSync as statSync46 } from "node:fs";
 import { join as join84 } from "node:path";
 
 // src/web/webhook-dispatch.ts
@@ -107785,7 +108170,7 @@ function emitDiffOrWrite(path7, before, after, dryRun) {
   }
   let mode = 420;
   try {
-    mode = statSync45(path7).mode & 511;
+    mode = statSync46(path7).mode & 511;
   } catch {}
   writeConfigFileSync(path7, after, mode);
 }
@@ -108007,7 +108392,7 @@ init_source();
 init_helpers();
 init_atomic();
 init_telegram_yaml();
-import { readFileSync as readFileSync71, statSync as statSync46 } from "node:fs";
+import { readFileSync as readFileSync71, statSync as statSync47 } from "node:fs";
 
 // src/linear/oauth-refresh.ts
 var LINEAR_TOKEN_ENDPOINT = "https://api.linear.app/oauth/token";
@@ -108117,7 +108502,7 @@ async function performLinearRefresh(io) {
 function writeConfigAtomic(path7, after) {
   let mode = 420;
   try {
-    mode = statSync46(path7).mode & 511;
+    mode = statSync47(path7).mode & 511;
   } catch {}
   writeConfigFileSync(path7, after, mode);
 }
@@ -108994,7 +109379,7 @@ init_loader();
 init_hindsight();
 var import_yaml16 = __toESM(require_dist(), 1);
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync80, readFileSync as readFileSync72, statSync as statSync47 } from "node:fs";
+import { existsSync as existsSync80, readFileSync as readFileSync72, statSync as statSync48 } from "node:fs";
 import { join as join85 } from "node:path";
 function persistMemoryConfigUrl(configPath, provider, url) {
   if (!existsSync80(configPath))
@@ -109017,7 +109402,7 @@ function persistMemoryConfigUrl(configPath, provider, url) {
   }
   let mode = 420;
   try {
-    mode = statSync47(configPath).mode & 511;
+    mode = statSync48(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, doc.toString(), mode);
   return true;
@@ -110083,7 +110468,7 @@ init_lifecycle();
 init_manager();
 init_hindsight2();
 import { spawnSync as spawnSync17 } from "node:child_process";
-import { existsSync as existsSync84, readFileSync as readFileSync75, statSync as statSync50 } from "node:fs";
+import { existsSync as existsSync84, readFileSync as readFileSync75, statSync as statSync51 } from "node:fs";
 import { resolve as resolve44, join as join92 } from "node:path";
 
 // src/web/memory-remediation.ts
@@ -110686,7 +111071,7 @@ import {
   mkdirSync as mkdirSync47,
   openSync as openSync16,
   readdirSync as readdirSync31,
-  statSync as statSync49,
+  statSync as statSync50,
   writeFileSync as writeFileSync33
 } from "node:fs";
 import { dirname as dirname35, join as join90, relative as relative4, sep as sep6 } from "node:path";
@@ -110715,7 +111100,7 @@ function resolveStateOwner(dir) {
     return cached;
   let owner = null;
   try {
-    const st = statSync49(dir);
+    const st = statSync50(dir);
     owner = st.uid === 0 && st.gid === 0 ? null : { uid: st.uid, gid: st.gid };
   } catch {
     owner = null;
@@ -111088,7 +111473,7 @@ function readLastTurnAt(agentsDir, name) {
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now2 = Date.now()) {
   try {
     const f = resolve44(agentsDir, name, "telegram", ".bridge-alive");
-    return now2 - statSync50(f).mtimeMs <= maxAgeMs;
+    return now2 - statSync51(f).mtimeMs <= maxAgeMs;
   } catch {
     return false;
   }
@@ -114605,10 +114990,10 @@ init_helpers();
 init_loader();
 
 // src/web/startup-guard.ts
-import { existsSync as existsSync89, readFileSync as readFileSync81, writeFileSync as writeFileSync35, mkdirSync as mkdirSync50, statSync as statSync51, unlinkSync as unlinkSync18 } from "node:fs";
+import { existsSync as existsSync89, readFileSync as readFileSync81, writeFileSync as writeFileSync35, mkdirSync as mkdirSync50, statSync as statSync52, unlinkSync as unlinkSync18 } from "node:fs";
 import { dirname as dirname37 } from "node:path";
 function detectConfigMountFault(configPath, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync51(p));
+  const stat = deps.stat ?? ((p) => statSync52(p));
   let st;
   try {
     st = stat(configPath);
@@ -114749,7 +115134,7 @@ init_embedded_examples();
 init_atomic();
 init_loader();
 init_scaffold();
-import { existsSync as existsSync91, readFileSync as readFileSync82, mkdirSync as mkdirSync51, statSync as statSync52, writeFileSync as writeFileSync36 } from "node:fs";
+import { existsSync as existsSync91, readFileSync as readFileSync82, mkdirSync as mkdirSync51, statSync as statSync53, writeFileSync as writeFileSync36 } from "node:fs";
 import { execFileSync as execFileSync29 } from "node:child_process";
 import { resolve as resolve48, dirname as dirname38 } from "node:path";
 init_state();
@@ -115473,7 +115858,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath, d
 function writeSwitchroomYaml(configPath, text) {
   let mode = 420;
   try {
-    mode = statSync52(configPath).mode & 511;
+    mode = statSync53(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, text, mode);
 }
@@ -116360,7 +116745,7 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync94, mkdirSync as mkdirSync54, readFileSync as readFileSync85, realpathSync as realpathSync8, statSync as statSync54, chownSync as chownSync12 } from "node:fs";
+import { existsSync as existsSync94, mkdirSync as mkdirSync54, readFileSync as readFileSync85, realpathSync as realpathSync8, statSync as statSync55, chownSync as chownSync12 } from "node:fs";
 import { spawnSync as spawnSync20 } from "node:child_process";
 import { join as join98, dirname as dirname41 } from "node:path";
 import { homedir as homedir51 } from "node:os";
@@ -116423,7 +116808,7 @@ init_operator_uid();
 init_atomic();
 
 // src/cli/preflight-mounts.ts
-import { statSync as statSync53 } from "node:fs";
+import { statSync as statSync54 } from "node:fs";
 function parseHostBindSources(composeText) {
   const out = [];
   const FILE_HINT = /\.(ya?ml|db|log|toml|json|token|id)$|\/\.vault-token$|machine-id$|localtime$|vault-auto-unlock$|\/webkite$/;
@@ -116450,7 +116835,7 @@ function parseHostBindSources(composeText) {
   return out;
 }
 function validateBindSources(composeText, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync53(p));
+  const stat = deps.stat ?? ((p) => statSync54(p));
   const sources = parseHostBindSources(composeText);
   const issues = [];
   const seen = new Set;
@@ -116812,7 +117197,7 @@ function defaultPersistPin(configPath) {
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
-    writeConfigFileSync(path7, after, statSync54(path7).mode & 511);
+    writeConfigFileSync(path7, after, statSync55(path7).mode & 511);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
@@ -117371,7 +117756,7 @@ function defaultStatusProbe(composePath) {
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync54(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync55(scriptPath).mtimeMs).toISOString();
       } catch {}
       let dir = dirname41(scriptPath);
       for (let i2 = 0;i2 < 8; i2++) {
@@ -117662,7 +118047,7 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { readFileSync as readFileSync87, chownSync as chownSync13, statSync as statSync57 } from "node:fs";
+import { readFileSync as readFileSync87, chownSync as chownSync13, statSync as statSync58 } from "node:fs";
 import { homedir as homedir53 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
@@ -117672,7 +118057,7 @@ import {
   writeFileSync as writeFileSync38,
   renameSync as renameSync25,
   unlinkSync as unlinkSync19,
-  statSync as statSync55,
+  statSync as statSync56,
   mkdirSync as mkdirSync55
 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
@@ -117829,7 +118214,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
-      mode = statSync55(configPath).mode & 511;
+      mode = statSync56(configPath).mode & 511;
     } catch {}
     if (opts.writeConfig) {
       opts.writeConfig(configPath, next, mode);
@@ -117879,7 +118264,7 @@ init_host_cli_stamp();
 
 // src/cli/host-cli-upgrade.ts
 init_self_update();
-import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync33, statSync as statSync56 } from "node:fs";
+import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync33, statSync as statSync57 } from "node:fs";
 import { basename as basename10, dirname as dirname43, join as join100 } from "node:path";
 init_shipped_assets();
 var HOST_CLI_UPGRADE_SENTINEL = "SWITCHROOM_HOST_CLI_UPGRADE:";
@@ -117916,7 +118301,7 @@ function defaultIo() {
   return {
     isFile: (p) => {
       try {
-        return statSync56(p).isFile();
+        return statSync57(p).isFile();
       } catch {
         return false;
       }
@@ -118881,7 +119266,7 @@ function createRolloutDeps(params) {
       if (after === before)
         return false;
       beginPinPersist(configPath, pin);
-      writeConfigPreservingOwnership(configPath, after, statSync57(configPath).mode & 511);
+      writeConfigPreservingOwnership(configPath, after, statSync58(configPath).mode & 511);
       return true;
     },
     commitPin: () => {
@@ -119403,7 +119788,7 @@ init_merge();
 import {
   existsSync as existsSync97,
   readdirSync as readdirSync34,
-  statSync as statSync58,
+  statSync as statSync59,
   unlinkSync as unlinkSync20
 } from "node:fs";
 import { join as join102 } from "node:path";
@@ -119426,7 +119811,7 @@ function collectSessionJsonl(claudeConfigDir) {
       const full = join102(dir, name);
       let st;
       try {
-        st = statSync58(full);
+        st = statSync59(full);
       } catch {
         continue;
       }
@@ -119550,7 +119935,7 @@ import {
   readdirSync as readdirSync35,
   readFileSync as readFileSync89,
   renameSync as renameSync26,
-  statSync as statSync59,
+  statSync as statSync60,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync39,
   writeSync as writeSync9
@@ -119753,7 +120138,7 @@ function sweepOrphanTmpFiles(stateDir) {
       continue;
     const tmpPath = join103(stateDir, entry);
     try {
-      const stat = statSync59(tmpPath);
+      const stat = statSync60(tmpPath);
       if (stat.mtimeMs < cutoff) {
         unlinkSync21(tmpPath);
       }
@@ -121318,7 +121703,7 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync104, readFileSync as readFileSync93, readdirSync as readdirSync36, statSync as statSync60 } from "node:fs";
+import { existsSync as existsSync104, readFileSync as readFileSync93, readdirSync as readdirSync36, statSync as statSync61 } from "node:fs";
 import { resolve as resolve57, join as join108 } from "node:path";
 import { createHash as createHash20 } from "node:crypto";
 init_merge();
@@ -121357,7 +121742,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
       const transcriptPath = join108(projectPath, "transcript.jsonl");
       if (!existsSync104(transcriptPath))
         continue;
-      const stat3 = statSync60(transcriptPath);
+      const stat3 = statSync61(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
         latest = { path: transcriptPath, mtime: stat3.mtimeMs };
       }
@@ -121644,7 +122029,7 @@ import { execFileSync as execFileSync32 } from "node:child_process";
 import { existsSync as existsSync106 } from "node:fs";
 
 // src/worktree/proc-liveness.ts
-import { readdirSync as readdirSync37, readlinkSync as readlinkSync8, realpathSync as realpathSync9, statSync as statSync61, readFileSync as readFileSync94 } from "node:fs";
+import { readdirSync as readdirSync37, readlinkSync as readlinkSync8, realpathSync as realpathSync9, statSync as statSync62, readFileSync as readFileSync94 } from "node:fs";
 import { join as join109, sep as sep8 } from "node:path";
 function isPidDir(name) {
   return /^\d+$/.test(name);
@@ -121672,7 +122057,7 @@ function cwdIsUnderRootByInode(linkPath, rootId, maxDepth) {
   for (let hop = 0;hop <= maxDepth; hop++) {
     let st;
     try {
-      st = statSync61(linkPath + suffix);
+      st = statSync62(linkPath + suffix);
     } catch {
       return false;
     }
@@ -121693,7 +122078,7 @@ function scanProcForHolders(path10, opts = {}) {
   let rootId;
   try {
     root = realpathSync9(path10);
-    const st = statSync61(root);
+    const st = statSync62(root);
     rootId = { dev: st.dev, ino: st.ino };
   } catch {
     return { state: "unavailable", inaccessible: 0 };
@@ -121916,7 +122301,7 @@ import {
   existsSync as existsSync107,
   readFileSync as readFileSync95,
   readdirSync as readdirSync38,
-  statSync as statSync62,
+  statSync as statSync63,
   renameSync as renameSync27,
   mkdirSync as mkdirSync59,
   rmSync as rmSync21
@@ -122124,7 +122509,7 @@ function defaultNewestTrackedMtimeMs(dir, exec) {
   let newest = 0;
   for (const f of files) {
     try {
-      const m = statSync62(join110(dir, f)).mtimeMs;
+      const m = statSync63(join110(dir, f)).mtimeMs;
       if (m > newest)
         newest = m;
     } catch {}
@@ -122149,7 +122534,7 @@ function planGc(roots, deps = {}, taskTreeRoots = [], taskTreeDirs = []) {
   const exists = deps.existsSync ?? existsSync107;
   const readDir = deps.readDir ?? ((p) => readdirSync38(p));
   const readFile4 = deps.readFile ?? ((p) => readFileSync95(p, "utf8"));
-  const stat3 = deps.stat ?? ((p) => statSync62(p));
+  const stat3 = deps.stat ?? ((p) => statSync63(p));
   const exec = deps.exec ?? execCapture;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
@@ -122526,7 +122911,7 @@ function listTrashEntries(nowMs, deps = {}) {
       const p = join110(stampDir, name);
       let mtimeMs = nowMs;
       try {
-        mtimeMs = statSync62(p).mtimeMs;
+        mtimeMs = statSync63(p).mtimeMs;
       } catch {}
       out.push({ path: p, ageDays: (nowMs - mtimeMs) / 86400000 });
     }
@@ -122879,7 +123264,7 @@ import {
   mkdirSync as mkdirSync60,
   mkdtempSync as mkdtempSync5,
   rmSync as rmSync22,
-  statSync as statSync63,
+  statSync as statSync64,
   writeFileSync as writeFileSync43
 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
@@ -123036,7 +123421,7 @@ function captureCheckout(opts) {
   };
   let st;
   try {
-    st = statSync63(source);
+    st = statSync64(source);
   } catch {
     return { ...base, failure: "missing", error: `No such directory: ${source}` };
   }
@@ -123194,7 +123579,7 @@ function captureCheckout(opts) {
       };
     }
     opts.onBundleWritten?.(bundlePath);
-    const bytes = statSync63(bundlePath).size;
+    const bytes = statSync64(bundlePath).size;
     if (bytes === 0) {
       return {
         ...base,
@@ -124623,6 +125008,7 @@ class KnowledgeAdmin {
 }
 
 // src/cli/hindsight-mcp-shim.ts
+init_hindsight_shim_contract();
 init_hindsight();
 var SHIM_SUPPORTED_PROTOCOL_VERSIONS = [
   "2025-06-18",
@@ -125234,6 +125620,17 @@ class HindsightShim {
     }
     return this.knowledgeAdminCache;
   }
+  contractPinCache = null;
+  get contractPin() {
+    if (!this.contractPinCache) {
+      this.contractPinCache = new ShimContractPin(this.opts.apiBaseUrl ?? this.opts.url.replace(/\/mcp\/?$/, ""), {
+        ...this.opts.fetchImpl ? { fetchImpl: this.opts.fetchImpl } : {},
+        negativeCacheMs: 30000,
+        positiveCacheMs: 5 * 60000
+      });
+    }
+    return this.contractPinCache;
+  }
   async synthesizedCall(name, rawArgs) {
     const fail4 = (text) => ({
       content: [{ type: "text", text }],
@@ -125261,6 +125658,9 @@ class HindsightShim {
     if (!this.opts.bankId) {
       return fail4(`${name} is unavailable: this agent has no HINDSIGHT_BANK_ID, so ` + "there is no bank to pin it to.");
     }
+    const preflight = await this.contractPin.preflight(name);
+    if (!preflight.ok)
+      return fail4(preflight.text);
     try {
       const text = await this.runSynthesized(name, clean3);
       return { content: [{ type: "text", text }], isError: false };
@@ -125425,7 +125825,7 @@ function registerHindsightMcpShimCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync97, statSync as statSync64 } from "node:fs";
+import { readFileSync as readFileSync97, statSync as statSync65 } from "node:fs";
 import { basename as basename15 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -125764,7 +126164,7 @@ async function defaultResolveProvider() {
 }
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
-  const sizeOf = deps.fileSize ?? ((p) => statSync64(p).size);
+  const sizeOf = deps.fileSize ?? ((p) => statSync65(p).size);
   const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync97(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
@@ -126474,7 +126874,7 @@ import {
   readdirSync as readdirSync41,
   readFileSync as readFileSync99,
   renameSync as renameSync29,
-  statSync as statSync65,
+  statSync as statSync66,
   unlinkSync as unlinkSync22,
   writeSync as writeSync10
 } from "node:fs";
@@ -126518,7 +126918,7 @@ function withAgentLock(paths, fn) {
       if (e.code !== "EEXIST")
         throw err;
       try {
-        const age = Date.now() - statSync65(paths.lockPath).mtimeMs;
+        const age = Date.now() - statSync66(paths.lockPath).mtimeMs;
         if (age > 30000) {
           unlinkSync22(paths.lockPath);
           continue;
@@ -126551,7 +126951,7 @@ function alignStagedOwnerToDir(stagingPath, targetDir) {
     const euid = overlayWriterRuntime.geteuid();
     if (euid === undefined)
       return;
-    const dirStat = statSync65(targetDir);
+    const dirStat = statSync66(targetDir);
     if (dirStat.uid === euid)
       return;
     overlayWriterRuntime.chown(stagingPath, dirStat.uid, dirStat.gid);
@@ -127853,7 +128253,7 @@ import {
   realpathSync as realpathSync10,
   renameSync as renameSync31,
   rmSync as rmSync24,
-  statSync as statSync66,
+  statSync as statSync67,
   writeFileSync as writeFileSync49
 } from "node:fs";
 import { tmpdir as tmpdir7, homedir as homedir60 } from "node:os";
@@ -127903,7 +128303,7 @@ function isTarballPath(p) {
 }
 function loadFromDir(dir) {
   const abs = realpathSync10(dir);
-  if (!statSync66(abs).isDirectory()) {
+  if (!statSync67(abs).isDirectory()) {
     fail4(`--from path is not a directory: ${dir}`);
   }
   const files = {};
@@ -128164,7 +128564,7 @@ function registerSkillCommand(program3) {
       if (!existsSync115(fromPath)) {
         fail4(`--from path does not exist: ${opts.from}`);
       }
-      const st = statSync66(fromPath);
+      const st = statSync67(fromPath);
       if (st.isDirectory()) {
         files = loadFromDir(fromPath);
       } else if (isTarballPath(fromPath)) {
@@ -128231,7 +128631,7 @@ import {
   readdirSync as readdirSync44,
   renameSync as renameSync32,
   rmSync as rmSync25,
-  statSync as statSync67,
+  statSync as statSync68,
   utimesSync,
   writeFileSync as writeFileSync50
 } from "node:fs";
@@ -128385,7 +128785,7 @@ function readStdinSync2() {
 }
 function loadFromDir2(dir) {
   const abs = resolve62(dir);
-  if (!statSync67(abs).isDirectory()) {
+  if (!statSync68(abs).isDirectory()) {
     fail5(`--from path is not a directory: ${dir}`);
   }
   const files = {};
@@ -128471,7 +128871,7 @@ function sweepTrash(agentsRoot, agent) {
       continue;
     const entPath = join120(trash, ent.name);
     try {
-      const st = statSync67(entPath);
+      const st = statSync68(entPath);
       if (now2 - st.mtimeMs > TRASH_TTL_MS) {
         rmSync25(entPath, { recursive: true, force: true });
       }
@@ -128597,7 +128997,7 @@ function loadFiles(opts) {
   if (!existsSync116(p)) {
     fail5(`--from path does not exist: ${opts.from}`);
   }
-  const st = statSync67(p);
+  const st = statSync68(p);
   if (st.isDirectory()) {
     return loadFromDir2(p);
   }
@@ -128818,7 +129218,7 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync67(join120(sub, e.name)).size;
+              totalBytes += statSync68(join120(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
             walk2(join120(sub, e.name));
@@ -128992,7 +129392,7 @@ import { join as join125, resolve as resolve63, sep as sep10 } from "node:path";
 import { existsSync as existsSync121, readFileSync as readFileSync109, realpathSync as realpathSync11 } from "node:fs";
 
 // src/self-improve/apply-guard.ts
-import { existsSync as existsSync119, lstatSync as lstatSync17, readFileSync as readFileSync107, statSync as statSync69 } from "node:fs";
+import { existsSync as existsSync119, lstatSync as lstatSync17, readFileSync as readFileSync107, statSync as statSync70 } from "node:fs";
 
 // src/self-improve/config.ts
 function intEnv(name, def) {
@@ -129013,7 +129413,7 @@ function resolveSelfImproveConfig() {
 }
 
 // src/self-improve/eval-gate.ts
-import { existsSync as existsSync117, readFileSync as readFileSync105, readdirSync as readdirSync45, statSync as statSync68 } from "node:fs";
+import { existsSync as existsSync117, readFileSync as readFileSync105, readdirSync as readdirSync45, statSync as statSync69 } from "node:fs";
 import { join as join122 } from "node:path";
 import { spawnSync as spawnSync26 } from "node:child_process";
 function evalsJsonPath(skillDir) {
@@ -129049,7 +129449,7 @@ function aggregateBenchmark(benchmarkDir, repoRoot, pythonBin = process.env.SWIT
 }
 function isBenchmarkDir(dir) {
   try {
-    if (!statSync68(dir).isDirectory())
+    if (!statSync69(dir).isDirectory())
       return false;
   } catch {
     return false;
@@ -129080,7 +129480,7 @@ function resolveBenchmarkDir(baseDir, explicit) {
   }
   if (entries.length === 0)
     return null;
-  entries.sort((a, b) => statSync68(b).mtimeMs - statSync68(a).mtimeMs);
+  entries.sort((a, b) => statSync69(b).mtimeMs - statSync69(a).mtimeMs);
   return entries[0];
 }
 var CANDIDATE_CONFIGS = ["with_skill", "candidate", "new_skill", "after"];
@@ -129779,7 +130179,7 @@ function registerSelfImproveBenchCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml26 = __toESM(require_dist(), 1);
-import { existsSync as existsSync122, readdirSync as readdirSync47, readFileSync as readFileSync110, statSync as statSync70 } from "node:fs";
+import { existsSync as existsSync122, readdirSync as readdirSync47, readFileSync as readFileSync110, statSync as statSync71 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
 import { join as join127, resolve as resolve64 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -129830,7 +130230,7 @@ function readSkillFrontmatter(skillDir) {
 function statSkillMd(skillDir) {
   const mdPath = join127(skillDir, "SKILL.md");
   try {
-    const st = statSync70(mdPath);
+    const st = statSync71(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
   } catch {
     return null;
@@ -129854,7 +130254,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
       continue;
     const dirPath = join127(skillsDir, ent);
     try {
-      if (!statSync70(dirPath).isDirectory())
+      if (!statSync71(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -129894,7 +130294,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     const dirPath = join127(sharedRoot, ent);
     try {
-      if (!statSync70(dirPath).isDirectory())
+      if (!statSync71(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -129930,7 +130330,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
       continue;
     const dirPath = join127(bundledRoot, ent);
     try {
-      if (!statSync70(dirPath).isDirectory())
+      if (!statSync71(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -130079,7 +130479,7 @@ import {
   mkdirSync as mkdirSync71,
   readdirSync as readdirSync48,
   writeFileSync as writeFileSync53,
-  statSync as statSync71,
+  statSync as statSync72,
   lstatSync as lstatSync18,
   realpathSync as realpathSync12,
   copyFileSync as copyFileSync16
@@ -130600,7 +131000,7 @@ function doStatus() {
           continue;
         const sockPath = join128(dir, name, "sock");
         if (existsSync124(sockPath)) {
-          const st = statSync71(sockPath);
+          const st = statSync72(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
           }
@@ -131501,7 +131901,7 @@ init_install_cron();
 
 // src/hindsight-watch/probe.ts
 import { spawnSync as spawnSync32 } from "node:child_process";
-import { readFileSync as readFileSync115, readdirSync as readdirSync52, statSync as statSync73 } from "node:fs";
+import { readFileSync as readFileSync115, readdirSync as readdirSync52, statSync as statSync74 } from "node:fs";
 import { homedir as homedir70 } from "node:os";
 import { resolve as resolve66 } from "node:path";
 
@@ -131629,7 +132029,7 @@ function readLlmSignals(series) {
 }
 
 // src/hindsight-watch/recall-log.ts
-import { closeSync as closeSync26, existsSync as existsSync129, openSync as openSync26, readdirSync as readdirSync51, readSync as readSync7, statSync as statSync72 } from "node:fs";
+import { closeSync as closeSync26, existsSync as existsSync129, openSync as openSync26, readdirSync as readdirSync51, readSync as readSync7, statSync as statSync73 } from "node:fs";
 import { join as join132 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
@@ -131644,7 +132044,7 @@ function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
   let truncatedHead = false;
   let fd;
   try {
-    const size = statSync72(path10).size;
+    const size = statSync73(path10).size;
     const start = Math.max(0, size - RECALL_MAX_TAIL_BYTES);
     truncatedHead = start > 0;
     const length = size - start;
@@ -131892,7 +132292,7 @@ function readDropCount(hindsightDir) {
   const path10 = resolve66(hindsightDir, "pending-drops.json");
   let parsed;
   try {
-    if (statSync73(path10).size > DROPS_LEDGER_MAX_BYTES)
+    if (statSync74(path10).size > DROPS_LEDGER_MAX_BYTES)
       return 0;
     parsed = JSON.parse(readFileSync115(path10, "utf8"));
   } catch {