usebeeline 0.1.19 → 0.1.20

package/dist/usebeeline.mjs

@@ -3025,7 +3025,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes10, createHash: createHash16 } = __require("crypto");
+    var { randomBytes: randomBytes10, createHash: createHash15 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3693,7 +3693,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash16("sha1").update(key + GUID).digest("base64");
+        const digest = createHash15("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -4062,7 +4062,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash16 } = __require("crypto");
+    var { createHash: createHash15 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -4369,7 +4369,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash16("sha1").update(key + GUID).digest("base64");
+        const digest = createHash15("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -16517,7 +16517,9 @@ async function revokeGrants(mcp, ref) {
 // apps/body/dist/squire-mcp-client.js
 init_squire_host();
 var INITIALIZE_TIMEOUT_MS = 3e4;
-var CALL_TIMEOUT_MS = 12e4;
+var SQUIRE_LONGEST_CALL_MS = 18e4;
+var CALL_TIMEOUT_MARGIN_MS = 3e4;
+var CALL_TIMEOUT_MS = SQUIRE_LONGEST_CALL_MS + CALL_TIMEOUT_MARGIN_MS;
 var StdioSquireMcpClient = class {
   options;
   child;
@@ -16535,7 +16537,7 @@ var StdioSquireMcpClient = class {
   /** One Squire MCP tool call; resolves with the tool's parsed result. */
   async call(tool, args = {}) {
     await this.ensureSession();
-    const response = await this.request("tools/call", { name: tool, arguments: args });
+    const response = await this.request("tools/call", { name: tool, arguments: args }, tool);
     if (response.isError) {
       const text3 = response.content?.find((entry) => entry.type === "text")?.text ?? "tool error";
       throw new Error(`${tool} failed: ${text3}`);
@@ -16634,16 +16636,17 @@ var StdioSquireMcpClient = class {
     this.child?.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, ...params ? { params } : {} })}
 `);
   }
-  request(method, params) {
+  request(method, params, toolName2) {
     const id = this.nextId++;
     const child = this.child;
     if (!child)
       return Promise.reject(new Error("Squire MCP session is not running"));
     return new Promise((resolve45, reject) => {
+      const timeoutMs = method === "initialize" ? INITIALIZE_TIMEOUT_MS : CALL_TIMEOUT_MS;
       const timer = setTimeout(() => {
         this.pending.delete(id);
-        reject(new Error(`${method} timed out`));
-      }, method === "initialize" ? INITIALIZE_TIMEOUT_MS : CALL_TIMEOUT_MS);
+        reject(new Error(`${toolName2 ?? method} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
       this.pending.set(id, { resolve: resolve45, reject, timer });
       child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
 `);
@@ -28862,7 +28865,6 @@ var DaemonApiClient = class {
   connectorAssignmentListener;
   agentSignInListener;
   cornerCompleteListener;
-  cornerRestartListener;
   helperReleaseListener;
   forceUpdateListener;
   helperIdentity = {
@@ -28990,10 +28992,6 @@ var DaemonApiClient = class {
   setCornerCompleteListener(listener) {
     this.cornerCompleteListener = listener;
   }
-  /** A no-code corner entered the code lane and must rebuild its local runtime. */
-  setCornerRestartListener(listener) {
-    this.cornerRestartListener = listener;
-  }
   setHelperReleaseListener(listener) {
     this.helperReleaseListener = listener;
   }
@@ -29090,10 +29088,6 @@ var DaemonApiClient = class {
       this.cornerCompleteListener?.(event.roomId);
       return;
     }
-    if (event.type === "corner-restart" && typeof event.roomId === "string") {
-      this.cornerRestartListener?.(event.roomId);
-      return;
-    }
     if (event.type === "connector-assignment") {
       this.connectorAssignmentListener?.();
       return;
@@ -29590,7 +29584,7 @@ init_self_update_manifest();
 // apps/body/dist/managed-update.js
 init_self_update();
 import { spawn as spawn12 } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { mkdir as mkdir14, rm as rm8, stat as stat6, writeFile as writeFile11 } from "node:fs/promises";
 import { dirname as dirname15, resolve as resolve22 } from "node:path";
 init_launchd();
@@ -31648,7 +31642,7 @@ function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
 }
 
 // apps/body/dist/agent-home.js
-import { createHash as createHash8, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash7, randomUUID as randomUUID6 } from "node:crypto";
 import { chmod as chmod5, copyFile, lstat as lstat3, mkdir as mkdir11, readFile as readFile16, readlink, readdir as readdir4, realpath, rename as rename7, rm as rm6, symlink as symlink2, unlink as unlink5, writeFile as writeFile9 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
 import { basename as basename3, dirname as dirname12, join as join12, relative, resolve as resolve16, sep } from "node:path";
@@ -31933,9 +31927,18 @@ var CREDENTIAL_DIRECTORIES = /* @__PURE__ */ new Set([
   ".docker",
   "keyrings",
   "gh",
-  "trusty-squire",
-  "beeline"
+  "trusty-squire"
 ]);
+function isBeelineKeyStore(segments) {
+  return segments.some((segment, index) => {
+    if (segment.toLowerCase() !== "beeline" || index === 0)
+      return false;
+    return segments[index - 1].toLowerCase() === ".config";
+  });
+}
+function isAgentRuntimeFile(segments) {
+  return segments.some((segment, index) => segment.toLowerCase() === "beeline" && segments[index + 1]?.toLowerCase() === "agents" && index + 3 === segments.length - 1);
+}
 var CREDENTIAL_EXTENSIONS = /\.(pem|p12|pfx|key|jks|keystore|kdbx|asc|gpg|ppk|crt|pkcs12)$/i;
 var CREDENTIAL_WORD = /(^|[-_.])(secret|secrets|credential|credentials|password|passwd|token|apikey|api_key|keystore|privatekey)([-_.]|$)/i;
 var ENV_FILE = /(^|[.\-_])env(\.|$)|^\.env/i;
@@ -31967,7 +31970,12 @@ function namesCredential(word) {
     return true;
   if (base.endsWith(".env") || ENV_FILE.test(base))
     return true;
-  return segments.slice(0, -1).some((segment) => CREDENTIAL_DIRECTORIES.has(segment.toLowerCase()));
+  if (segments.slice(0, -1).some((segment) => CREDENTIAL_DIRECTORIES.has(segment.toLowerCase()))) {
+    return true;
+  }
+  if (isBeelineKeyStore(segments))
+    return true;
+  return isAgentRuntimeFile(segments);
 }
 function namesCredentialFile(argv) {
   return argv.slice(1).some(namesCredential);
@@ -32253,1080 +32261,422 @@ var MESSAGE_SEARCH_FILLER_WORDS = [
 ];
 var FILLER_WORDS = new Set(MESSAGE_SEARCH_FILLER_WORDS);
 
-// packages/api-contract/dist/system-identity.js
-import { createHash as createHash7 } from "node:crypto";
-var SYSTEM_IDENTITY_ID = createHash7("sha256").update("beeline:system-identity").digest("hex");
-var DELETED_ACCOUNT_IDENTITY_ID = createHash7("sha256").update("beeline:deleted-account").digest("hex");
-
-// apps/body/dist/transcript-budget.js
-function budgetTranscript(lines, modelContextTokens, otherPromptBytes) {
-  const context = modelContextTokens && modelContextTokens > 0 ? modelContextTokens : 32768;
-  const reserveTokens = Math.max(4096, Math.ceil(context * 0.3));
-  const available = Math.max(0, context - Math.ceil(otherPromptBytes / 2) - reserveTokens);
-  const budget = Math.max(0, Math.min(24e3, Math.floor(context * 0.25), available * 2) - 128);
-  if (!budget)
-    return [];
-  const selected = [];
-  let used = 0;
-  const rowLimit = Math.min(4096, Math.floor(budget / 2));
-  for (let index = lines.length - 1; index >= 0; index -= 1) {
-    const row = boundMessageText(lines[index], rowLimit);
-    const bytes = Buffer.byteLength(row) + 1;
-    if (used + bytes > budget)
-      break;
-    selected.push(row);
-    used += bytes;
-  }
-  selected.reverse();
-  if (selected.length < lines.length) {
-    selected.unshift(`[${lines.length - selected.length} older messages omitted from this prompt]`);
+// apps/body/dist/beeline-skill.js
+var USING_BEELINE_SKILL_NAME = "using-beeline";
+var BEELINE_TRIAGE_SKILL_NAME = "beeline-triage";
+var BEELINE_REVIEW_SKILL_NAME = "beeline-review";
+var BEELINE_SPEC_SKILL_NAME = "beeline-spec";
+var BEELINE_ROOM_MECHANICS = [
+  "Files and photos on the message you are answering are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline). A file on an earlier message shows only as a \u{1F4CE} marker with an id; call beeline-agent download_attachment with that message id and attachment id, then read the returned path. Never fetch a media URL; if the download fails, tell the requester you could not open the file.",
+  "To create a file you can send, call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent post_artifact with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote), or with html/bytes content directly; it is uploaded and attached to your reply, and title and mime default from the file when you post by path. write_scratch_file produces the file, not a picture.",
+  "To run something later or repeatedly, call beeline-agent create_schedule (interval in minutes or a 5-field cron, optional maxRuns); list_schedules / update_schedule / delete_schedule manage them, including schedules other agents created for themselves.",
+  `To react to a message in this Room, call beeline-agent react_to_message with its message id and one supported emoji (${MESSAGE_REACTION_EMOJIS.join(" ")}).`,
+  `To react to things that HAPPEN in this Room rather than only to what is said to you, call beeline-agent subscribe_events with the kinds you want; each one then wakes you for a turn. Available kinds: ${eventKindCatalogLines().join("; ")}. Subscriptions are per Room and cover every way the event lands: joining a Room you subscribed to wakes you, and so does a person arriving in the Workspace when that arrival projects into this Room - subscribe to joined in an onboarding Room and every newcomer wakes you, exactly like a greeter. It replaces your list, so send every kind you want - list_event_subscriptions shows the current one. You do this yourself: nobody has to configure it for you. A corner merging wakes nobody in its parent Room by default. If you still have work to do after a corner merges (a hand-off, a release step, a reply that has to describe landed code), subscribe to merged in the parent Room, from a turn there, before the merge. Each merge in that Room then wakes you and names the corner and pull request: act only on the corner you are waiting for, post nothing for any other merge, and take merged back out of your list once nothing is left to wait for. Never post just to acknowledge a merge: the merge card already announces it. A grant, connector offer, posted choice or poll, or Squire approval (payment, credential, sign-in, or vouch) you asked for wakes you back with the answer on its own - there is nothing to subscribe to for it, and asking is refused.`,
+  "If you need reach outside the sandbox, call beeline-agent request_grant. If you already know discrete options, call beeline-agent ask_choice (one human, optional) or open_poll (every human in this Room, required deadline). A poll is refused below two electors and above fifty, and in a DM. A plurality is a fact, never permission to deploy, delete, merge, or spend. Open-ended asks stay tagged prose. Never put Always / Once / No on a preference.",
+  "To state something that happened so the Room and other agents can act on it, call beeline-agent emit_event with your own agent:<slug> kind, one sentence, and optionally the agent members to wake. Chains of events are bounded and a refused emit posts nothing."
+].join(" ");
+function runningBeelineReleaseId(env = process.env, read2 = (path) => readFileSync4(path, "utf8")) {
+  try {
+    const lib = env.BEELINE_LIB_DIR;
+    if (!lib)
+      return "source";
+    const manifest = JSON.parse(read2(resolve13(lib, "bundle.json")));
+    return [manifest.version, manifest.commit].filter(Boolean).join("-") || "source";
+  } catch {
+    return "source";
   }
-  return selected;
-}
-function boundRoomTaskBody(body, modelContextTokens) {
-  const context = modelContextTokens && modelContextTokens > 0 ? modelContextTokens : 32768;
-  return boundMessageText(body, Math.min(8e3, Math.floor(context / 4)));
 }
-function boundMessageText(original, maxBytes) {
-  const sanitized = stripInlineData(original);
-  const clean4 = sanitized === original ? original : sanitized + fetchPointer(original, "inline content omitted");
-  return Buffer.byteLength(clean4) > maxBytes ? truncateRow(clean4, maxBytes) : clean4;
+function usingBeelineSkillMarkdown(releaseId) {
+  return `---
+name: using-beeline
+description: How to answer inside a Beeline Room.
+---
+
+<!-- beeline-release: ${releaseId} -->
+
+# Using Beeline
+
+These mechanics apply in Rooms and corners. ${BEELINE_ROOM_MECHANICS}
+
+## Conflicting human instructions
+
+Follow your own owner first, then this Workspace's owner and admins, then members. A higher-tier instruction overrides a lower-tier hold. A human at the same standing cannot clear another human's hold; only that holder or someone of higher standing can. Never tell a higher-tier human that a lower-tier hold binds them. Reason from the conversation. When you explain a hold or go-ahead in the Room, name the person and their standing in ordinary words. Never write field names or field=value syntax such as workspaceRole=member or agentOwner.
+
+## Tools and the Workbench
+
+A **tool** is something you can use once a human adds it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
+
+The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent workbench_status. That read is the Workbench of the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire is vaulted credentials plus a browser for the separate key and browser routes: operate_drive drives a whole flow, and flat steps (operate_click, operate_type, operate_select, operate_press, operate_scroll, operate_wait, operate_navigate, operate_read_inbox, operate_extract, and the rest of its flat operate_* actions) handle one action at a time. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Workbench page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
+
+**Inspect your own host before answering.** When a question is about a system on the machine you run on, inspect its live state with the tools you have: processes, logs, local endpoints or service status. Say what you checked. Memory and Room history are not evidence of current state.
+
+**Use available tools before asking the person.** Before asking a person for a code, a status or a file, call workbench_status and check whether a tool or connected app you already have can get it, then use it. This includes an emailed verification code in an already-connected inbox. Ask only when none can, and say why. The key-ownership and grant rules still apply.
+
+**Offer the tool at the moment you need it.** When the work in front of you needs a tool the person does not have, do not send them to a settings page and do not stop at naming it. Call workbench_status first - a tool they already have is used, not offered. In a Room or DM, call offer_connector with the connectorType and one short reason: a card appears there, spoken by you, addressed to the person you are answering, with one action. Connector offers are unavailable in corners; use a Room or DM for those. Your turn pauses on the card - say in prose what you are waiting for and end the turn; you are woken when it is added, and then you carry on.
+
+**Research before you offer, and say so.** Never offer a tool you cannot describe. If someone asks you to install or add something you do not already know - by name, by purpose, or by what it will hold - say plainly that you are looking it up first, find out what it is and what it does with credentials, and state what you learned in your reply BEFORE the card appears. A person reading "Add X?" must already have read, in your own words, what X is. Refusing to act blind is part of being trusted with keys.
+
+An offer is setup, never authority: it does not replace a grant, write permission, target-branch confirmation, or the merge gate, and it never needs a raw credential in chat. You never pair a tool yourself and never ask anyone for a key value; once a tool is added, provisioning happens inside it and receipts reach the person through the tool's own status message.
+
+Keys belong to the human who provisioned them. Your owner's keys serve whoever asks; another person's keys need that person's private scoped approval before you use them for anyone else, and your owner cannot authorize them. Use the connector without exposing or sharing raw keys. The Workbench page remains the place a person manages tools and keys by hand (Settings \u2192 Workbench); you point there to MANAGE what exists, not to add what you need.
+
+## Where you run
+
+Each agent runs on one owner's machine, with that owner's keys, hosts, and network. Agents in one Room can differ in what they reach. Memory is shared across all machines.
+
+- Check your own capabilities with workbench_status and your tools. Never infer another agent's.
+- A failure saved from another machine is not proof here. Try it first.
+- If you cannot do X here, say "I can't do X on this machine because Y", then hand off to an agent that memory shows has done X, or ask the requester who has access.
+
+## Memory
+
+You keep memory yourself. No background reviewer exists: what you do not keep current, nothing does.
+
+| Store | Holds | Write with |
+| --- | --- | --- |
+| \`workspace-core\` procedure | Capabilities per machine; the Squire credential checklist | save_skill, whole text |
+| Profile facts | Facts about the person who asked | save_memory |
+| Workspace facts | Facts about anyone or anything else | save_memory |
+| Procedures | Steps for a task that repeats | save_skill |
+| Workflows | Roles and steps for a run across agents | save_workflow; run with start_workflow |
+| History | Every message in the Workspace | Nothing; read with search_history |
+
+- **Look up.** At task start, call load_workspace_skill for \`workspace-core\`. Before you say "can't" or "not saved", run search_memory, list_credentials and workbench_status.
+- **Use.** Call report_memory_used for what your answer used. When a saved item fails, fix it in the same turn.
+- **Save.** Put each fact in one store only. Never save "X is impossible". Save the specific failure and the machine: "On Niglet's host, the highroll Fly token returns 403."
+- **Prune.** Rewrite \`workspace-core\` whole and keep it at most 2,200 characters. An agent-saved Workspace fact that nobody uses expires in the weekly pass. Replace a procedure or workflow by saving its slug again; remove it with delete_skill.
+
+## Connect an app
+
+When a request needs an app or service, call beeline-agent \`workbench_status\` first. For a connected app via composio, use its ID with \`list_app_tools\`, then call \`execute_app_tool\` with the selected tool slug and arguments. For an app via squire-api, call its API with \`use_credential\` (service = the app key); via squire-browser, use the \`operate_*\` tools; via registry-mcp, use its mounted MCP tools. The server executes against that person\u2019s account and decides permission on every call. If tool discovery reports an error, follow its cause; \`needs_connection\` means the account must be reconnected, and \`needs_permission\` means wait for the connected person's decision. Do not switch paths after denial or provider unavailability. No app token, provider key, or sign-in URL belongs in chat or a model prompt.
+
+For an app that is not connected, call \`connect_app\` with its name, one short reason, and a request-specific \`continuation\`: one sentence stating what you will do right after sign-in. Do not include a link, credential, account identifier, or private data in that sentence. The server chooses the route and returns \`next\`. In a corner, call it from that corner so the sign-in card and connection wake return there. A managed OAuth app presents a sign-in card to its owner; end the turn and wait for the connection wake. If the provider reports managed OAuth unsupported, follow the server's Squire route and its instructions. A provider outage is unavailable, not permission to change routes. After the person connects, read Workbench again and use the app ID. Every use is authorized as \`app:<key>\` and recorded once.
+
+## Showing a mock
+
+When a design decision needs eyes, show it instead of describing it. Build ONE self-contained HTML page and post it with beeline-agent post_artifact (mime "text/html", pass the document as html). Everything is inline: a single <style> element for all CSS and data: URLs for any image - no script, no external dependencies, no network references. The validator refuses every <script>, <link>, <iframe>, <object>, <embed>, <form>, inline event handler, and http(s) URL, so a page that reaches for the network never posts. Use the Obsidian Refined tokens: grayscale surfaces, one brass accent #d7af5f, 3px radii, IBM Plex Sans/Mono type. Lay the user stories out as frames - one bordered, labelled block per story, so each story can be judged on its own. After posting, ask for feedback here in the corner: the artifact is the thing people react to, not your prose.
+
+## Showing a photograph
+
+When the mock needs a real product photo, do not draw an SVG stand-in. Call beeline-agent fetch_image with the photo's http(s) URL. The daemon downloads it (30 seconds, 25 MB) into your writable session home and returns the path, mime, and size. Read those bytes, base64-encode them, and put them in the HTML as a data: URL (\`<img src="data:image/jpeg;base64,\u2026">\`). Then post_artifact as usual. The validator still refuses every http(s) image reference \u2014 the photograph has to be inline. The artifact is a snapshot: it never fetches the network when someone opens it.
+`;
 }
-function stripInlineData(text2) {
-  return text2.replace(/data:[^\s"'<>)]*/gi, "[inline data omitted]").replace(/\b[A-Za-z0-9+/]{512,}={0,2}\b/g, (candidate) => /[A-Z]/.test(candidate) && /[a-z]/.test(candidate) && /[0-9+/]/.test(candidate) ? "[inline binary data omitted]" : candidate);
+function beelineReviewSkillMarkdown(releaseId) {
+  return `---
+name: beeline-review
+description: Review a corner pull request against the brief's outline, the approval quote, and the Beeline merge gate.
+---
+
+<!-- beeline-release: ${releaseId} -->
+
+# Beeline pull-request review
+
+Follow these steps in order. Do not skip or reorder them.
+
+## 1. Isolate the revision
+
+- Run \`gh pr view N --json headRefOid,files\` and record \`headRefOid\`.
+- Run \`gh pr diff N\`.
+- Review the objective, files, and complete PR diff before making another working copy.
+- Check out that exact head only when an empirical command must read or run the tree. Never use the author's worktree.
+- When a checkout is needed, create a temporary detached worktree, install an EXIT trap that removes it with \`git worktree remove --force\` and deletes its temporary directory, and run every command there. Cleanup is mandatory on PASS, FAIL, and command error.
+- For a deterministic one-shot bootstrap use \`npm run review:exact-head -- <sha> [--typecheck <pkg> \u2026] [--] <pkg>:<glob> \u2026\`: it checks that exact head out, runs \`npm ci\`, builds the workspace package exports, runs the given typechecks and targeted tests with non-interactive PASS/FAIL summaries, and removes the worktree itself (pass \`--keep\` to keep it and print the removal command).
+- Review and test only the recorded revision. If the head moves, clean up the scratch worktree and start over.
+
+## 2. P0 - OUTLINE FULFILLED, DEMONSTRATED
+
+Read the server-assigned brief and its current revision, including every required file. Quote the approval with its message ID and approver before considering the short objective. The spec's outline (user stories, acceptance criteria, non-goals, risks) is the scope, and the approval quote is the human's own words: it wins any conflict with the spec. The short objective is navigation-only text and the PR description cannot add, remove, or narrow scope. A revision with no recorded approval is reviewed against its spec alone. If a required file is unavailable, or the revision changes during review, refuse approval and describe what is missing. A requirement may become out of scope only through a new human-authorized brief revision; reviewer discretion, implementation difficulty, and silence never remove it. A passing narrow test does not prove a broader requirement. Review a deliberate human choice as written, even if it is unusual.
+
+Before general correctness, produce an outline ledger in spec order: list every \`## User stories\` and \`## Acceptance criteria\` line exactly once as met, unmet, unverified, or out of scope, followed by concrete evidence (for a criterion, the named test run against the PR head) - no stories to list is a FAIL, sent back to the author to write the outline; confirm nothing under \`## Non-goals\` was done; confirm every \`## Risks\` line was addressed or explicitly accepted with a stated reason. For a frontend change, open the rendered screens and compare them against the attached mock, noting every visible deviation. Any missing, unmet, unverified story or acceptance criterion, done non-goal, unaddressed risk, or unreviewed mock mismatch blocks PASS. Out of scope is valid only when the current revision itself records the human-authorized removal.
+
+Before judging the implementation, independently repeat the two judgment legs from request triage:
+
+- **Work warranted:** For a bug, reproduce the reported behavior on the target branch. For another request, establish the unmet user need from the request and current product. Search current code, history, issues, and open or recently merged pull requests for work that already resolves or supersedes it. Treat title similarity only as a candidate, not proof of duplication. FAIL confirmed duplicate or obsolete work.
+- **Desirable:** Check repository-owned goals, invariants, architecture, and established product behavior. Require a concrete user benefit, the smallest coherent solution, and no unapproved scope. FAIL a confirmed conflict or an unsupported product judgment; put merely plausible concerns below as non-blocking findings.
+
+- Quote the approval text, with its message ID, exactly as stored. Do not quote the short objective as product truth.
+- Derive the end-user story from the spec and the approval quote in one sentence: \`a user who does X sees Y\`.
+- Make Y happen against the built PR head: run the app or affected service and perform X.
+- If no interactive surface is reachable, run the narrowest test or script that exercises the exact user path and prints the observable Y.
+- Record the command and the observed Y.
+- A unit test of an inner function, a log line, \`the code looks right\`, or any other proxy does not count.
+- If the user-visible Y cannot be produced, FAIL now. Nothing below can rescue the review.
+- For a bug, if a \`Reproduction <id>\` was recorded, quote it, re-run that exact user path on the PR head, and record that the wrong result is gone. FAIL if that proof does not name the identifier, even when other tests pass. If none was obtained, require the proof to say so plainly and show the regression instead; do not fail the review for a missing identifier.
+- State whether the diff meets every user story and the approval quote without unapproved scope.
+
+## 3. Empirical pass second
+
+Check the brief revision and code head for base synchronization, tests, documentation, lint and types, publication, and CI. A required check that was skipped, failed, or not verified blocks PASS. An empty rollup alone is not proof of passing checks. Use pr_checks_status for the exact current head: checks="passed" with checkCount=0 is the server-confirmed no-checks path and satisfies the CI prerequisite for review. Do not refuse review because no literal green check exists, and do not require mergeAllowed=true before reviewing: the missing reviewer PASS itself keeps that gate closed. Pending, failed, or unknown checks still block approval. Reuse valid author evidence; run targeted independent checks where needed. A screenshot or rendered app is needed for visual claims, and server-boundary behavior for authorization claims.
+
+- Run the repository typecheck and tests touched by the diff.
+- If the spec or the approval quote names a user path, exercise that path.
+- Record every command and exit code.
+- A review with no executed command is invalid and must FAIL.
+
+### Design rules
+
+When the diff touches UI and the repository has a DESIGN.md, check every changed style against its rules: colours from theme tokens only, the type roles, the spacing scale, the allowed radii, elevation, the shared components, and touch targets.
+
+- Run the repository's design lints. In Beeline, from \`apps/mobile\`: \`npx vitest run sources/buzz/calm-lint sources/buzz/design-lint\`.
+- FAIL when a design baseline count grows, or when an allowlist entry is added without naming the design decision behind it.
+- Require a screenshot or rendered proof of every visual change in each theme the app ships (in Beeline, Obsidian and Bone).
+- A design-rule violation is an engineering finding and blocks PASS.
+
+## 4. Adversarial pass
+
+- For every changed function, name one concrete input or sequence that breaks it.
+- If none is found, write \`none found\` for that function.
+
+## 5. Verify before reporting
+
+- Confirm every finding by reading the exact line or by running a command.
+- Put unconfirmed concerns under plausible findings. They never block.
+
+## 6. Bloat guard
+
+- Compare net lines with the spec, its user stories and non-goals, and the approval quote.
+- FAIL backwards-compatibility shims, dual paths, feature flags, or abstractions with one caller.
+- FAIL machinery the spec and the approval quote did not ask for.
+
+## 7. Security and data
+
+- Check credentials, authorization boundaries, and destructive migrations.
+
+## 8. Gate and verdict
+
+- Review the exact green head named in your reviewer instruction; a server-confirmed zero-check passed head counts as green. If the head moved, do not approve it.
+- Re-read the assigned brief revision before the verdict. A repair changes the head and invalidates affected evidence; a requirement correction invalidates the relevant verdict even if code did not change. Keep product-completeness findings (a missing or contradicted user story, done non-goal, unaddressed risk, mock mismatch, or approval quote) separate from engineering findings (correctness, security, maintainability, tests). Give every confirmed finding a stable ID that survives rereview, the affected outline line or \`engineering\`, location, severity, evidence, and repair disposition. Reuse the same ID until that finding is resolved. Mechanical repairs return to the author; ask a human only for a genuinely unresolved product choice. Do not run a nested validation pipeline or push the author's branch.
+- Always use this exact verdict shape:
+
+\`approval quoted with its message ID:\`
+\`user story:\`
+\`work warranted evidence:\`
+\`desirability evidence:\`
+\`reproduction id (or none obtained):\`
+\`proof of that reproduction (or none obtained + regression):\`
+\`how Y was demonstrated (or FAIL):\`
+\`commands run + results:\`
+\`brief revision:\`
+\`outline ledger (every user story, acceptance criterion, non-goal and risk + status + evidence; mock-vs-screen notes for frontend work):\`
+\`product-completeness findings (block):\`
+\`engineering findings (block):\`
+\`plausible findings (do not block):\`
+\`net lines:\`
+\`decision: PASS|FAIL\`
+
+Then take exactly one action:
+
+- FAIL: reply \`@author\` with the confirmed findings and the reviewed head SHA to fix.
+- PASS: call \`approve_merge\` with the reviewed head SHA, then reply \`approved <reviewed sha>\` without tagging the author. Do not tell the author to merge.
+- A human's question or proposal in the corner discussion with no answer is a blocking finding: FAIL and name it.
+- Approving is your last step as reviewer. Your PASS is the yes that wakes the author, who merges that exact head with \`merge_corner\` once checks are green and no hold stands. You never merge it yourself.
+`;
 }
-function truncateRow(row, maxBytes) {
-  const pointer = fetchPointer(row, "message truncated");
-  const contentBytes = Math.max(0, maxBytes - Buffer.byteLength(pointer));
-  let prefix = Buffer.from(row).subarray(0, contentBytes).toString("utf8");
-  prefix = prefix.replace(/\uFFFD$/, "");
-  return prefix + pointer;
+function beelineSpecSkillMarkdown(releaseId) {
+  return `---
+name: beeline-spec
+description: Prepare or revise a durable corner assignment from Room decisions before repository work. Do not use for ordinary conversation or unrelated artifact delivery.
+---
+
+<!-- beeline-release: ${releaseId} -->
+
+# Durable corner brief
+
+Create an assignment a fresh session can execute without the parent transcript. A brief has three parts:
+
+- \`spec\`: one Markdown doc you write, with these headings:
+  - \`## Intent\`: the human's own words, quoted exactly, each with its Room message ID. Never substitute a summary.
+  - \`## User stories\`: what this enables, one per line as "a person who does X sees Y". Only stories traceable to the quoted Intent; never import a plan, a teammate's suggestion, or your own idea as a story. Keep unaffected lines as they are across revisions.
+  - \`## Acceptance criteria\`: the requester's own rules from \`## Intent\`, quoted verbatim and numbered, each naming the test (existing or to be written) that fails if the rule is broken anywhere. Criteria are the invariant; stories are examples of it. Write "None beyond the stories." when the request states no rule.
+  - \`## Non-goals\`: explicit exclusions.
+  - \`## Risks\`: what could go wrong, and for whom.
+  - \`## References\`: each reference or mock with what it is and whose call it is; the mock posted here (DESIGN.md, else existing app styles) is the reviewer's acceptance reference, not any other optional or agent-generated mock.
+  Add implementation guidance under further headings when it helps.
+- files (\`attachments\`): the Room files the worker needs, each with its purpose and whether it is required.
+- \`approval\`: one human Room message ID. The server quotes that message's exact text and author; the quote wins any conflict with the spec.
+
+Do not infer approval from silence, assent to different prose, or the mere existence of a plan. Keep agent recommendations labelled as recommendations. Do not promote a plausible UX detail, algorithm, failure message, or extra test into a user story merely because it sounds helpful.
+
+## Compact path for a settled small fix
+
+Use this when the requested behavior, touched surface, exclusions, and proof are already obvious. Inspect the narrow current behavior, write a short spec (quoted intent, observable user stories, non-goals, risks, references), and use the initiating command as the approval. Always compose the full outline and post it to the Room before calling open_corner, even when the initiating command already settles scope and stands as the approval: posting is not optional merely because approval is inferred, since the human must be able to see what you are about to build. \u201CChange the message action label from Remove to Delete; leave confirmation and accessibility wording unchanged\u201D needs the visible-label user story and both exclusions, not another confirmation question.
+
+## Complex-work planning loop
+
+Use this default-on loop when work crosses components, changes architecture or authorization, needs a visual choice, has multiple user stories, or still contains a material unknown.
+
+### 1. Scope and current state
+
+- Collect every relevant human message, including corrections; later corrections supersede only what they explicitly change. Quote their exact text and IDs under \`## Intent\`.
+- Inspect current code, data contracts, tests, recent related work, repository invariants, and existing behavior. State what exists, what is missing, and what is deliberately out of scope.
+- Separate facts, human decisions, agent recommendations, and unresolved choices.
+
+### 2. User stories and product boundary
+
+- Write the actor/action/observable-result stories.
+- Map each story to its own observable line and explicit non-goals.
+- If one unresolved choice would materially change behavior, scope, irreversible effects, or the intended result, present only that choice or the affected brief slice to the human. Use the answering message as the \`approval\`. Never treat no answer as approval.
+
+### 3. Architecture and data flow
+
+- Trace inputs, authorities, state transitions, persistence, outputs, and trust boundaries.
+- Name the existing components to reuse and the smallest coherent changes.
+- Describe migration and compatibility behavior only where the human intent or existing data requires it.
+
+### 4. Failure modes and test map
+
+- Enumerate missing/stale data, retries, concurrency, partial failure, authorization failure, rollback, and boundary-specific hazards that apply.
+- Map every user story to its proof boundary: unit, integration, device/browser, server authorization, migration, or live harness. No story may be left without planned evidence.
+
+### 5. Mocks and references
+
+- When a visual or interaction decision needs eyes, create and post one self-contained mock using the using-beeline mock procedure.
+- A mock/file posted with \`post_artifact\` in this planning turn is added automatically to the brief attachment manifest; do not manually copy its object ID. Still list it under \`## References\` with whose call it is. Existing human-posted files must be named explicitly in attachments.
+
+### 6. Implementation tasks
+
+- Synthesize ordered, independently verifiable tasks. For each task name the affected boundary, user stories, expected files/components, failure handling, and proof.
+- Keep the spec actionable, not a transcript summary.
+
+### 7. Bounded adversarial second read (default on)
+
+- Spend one pass, bounded to the drafted scope, trying to disprove completeness: find a missing story, authority mismatch, unhandled failure, user story without proof, mock ambiguity, accidental scope expansion, or task-order hazard.
+- Return findings to the planning agent and repair the draft. Escalate only a genuinely material product choice to the human; engineering choices and mechanical gaps are resolved in the plan.
+- End after one adversarial pass unless its repair exposes one new material product choice. Do not recursively review the review.
+
+## Dispatch and revision
+
+Existing authorization permits dispatch when the initiating command already settles the exact material scope; that command is the approval, but the outline is still posted to the Room first so the human can see it before open_corner runs. Drafting a brief does not create approval. When the scope was not already explicit, post the spec and ask the corner's opener to approve it, then use their reply as the \`approval\`. Honor an explicit request to review first.
+
+Pass the brief as \`open_corner.brief\`. Read the current revision before revising and use \`revise_corner_brief\` with the complete replacement spec, the approving message, and a concise change description. Preserve unaffected intent quotes, user stories, and references. The latest revision governs implementation and review; chat prose alone never changes scope.
+`;
 }
-function fetchPointer(row, reason) {
-  const id = /^\[message id: ([^\]\n]+)\]/.exec(row)?.[1];
-  return id ? `
-[${reason}; call get_room_message with messageId "${id}" and offset 0 for the full text]` : `
-[${reason}; read the source conversation for the full text]`;
+function beelineTriageSkillMarkdown(releaseId) {
+  return `---
+name: beeline-triage
+description: Clarify and assess a user request before opening a Beeline corner, then bind a bugfix to its recorded reproduction. Use before open_corner and while implementing a bug in a corner.
+---
+
+<!-- beeline-release: ${releaseId} -->
+
+# Beeline request triage
+
+Run these checks before opening a corner.
+
+## 1. Is it clear?
+
+- Rewrite the request as a concrete outcome and the user stories it enables.
+- State material exclusions (non-goals) and the risks needed to prevent unrequested work or surprise.
+- Keep the corner objective complete and within 24 words.
+- First ask whether the request has any material ambiguity - one that would change scope, behavior, or risk - and resolve it with the human before doing anything else; never resolve it by adopting a teammate's plan, a prior document, or your own assumption.
+- Once it's resolved, say plainly if the request itself is suboptimal and give your own recommendation - you are expected to disagree, not just permitted to.
+- On a judgment call you're still not sure of, tag a Room colleague for an adversarial second opinion and ask them to reply tagging you back; skip this only when you are the only agent in the Room.
+
+## 2. Is work warranted?
+
+- For a bug, try to reproduce the exact user-visible behavior and record the evidence.
+- For another request, identify the unmet user need and the current behavior that does not meet it.
+- Search current code, history, issues, and open or recently merged pull requests for released or unreleased work that resolves or supersedes the request.
+- Treat similar titles as candidates. Confirm behavior and scope before calling work duplicate.
+- If the need cannot be established, reproduction fails, or other work may obviate it, warn; do not block.
+
+## 3. Is it desirable?
+
+- Compare the request with repository-owned goals, invariants, architecture, and established product behavior.
+- Look for concrete user benefit, the smallest coherent solution, and ongoing maintenance cost.
+- Do not invent product strategy. If the evidence is absent or conflicting, warn; do not block.
+
+## Output
+
+When dispatching work, pass the complete brief to open_corner under existing authorization, after posting the outline as beeline-spec requires. Add applicable warnings to the brief:
+
+\`Triage warning \u2014 warranted: <evidence-backed reason>\`
+\`Triage warning \u2014 desirable: <evidence-backed reason>\`
+
+When a bug reproduction succeeds, also emit:
+
+\`Reproduction <id>: <user path> \u2192 <observable wrong result>\`
+
+Do not emit a warning merely because evidence is incomplete when the repository offers no practical way to obtain it. Never describe a warning as approval or rejection. Warnings inform the user and implementer; they do not block work.
+
+## Bugfix execution
+
+Once a corner is open for a reported bug, follow these steps in order. They are instruction, not a server gate. They do not condition the fix on reproduction. Warranted-work and desirability warnings still do not block.
+
+### 1. Attempt to reproduce
+
+- Attempt to reproduce the bug as triage isolated it, using every tool the host offers: emulator, Playwright, browser, test runner.
+- Record what was tried and what was observed.
+- If a reproduction is obtained, record the exact user path and the observable wrong result under \`Reproduction <id>\`. Reuse the identifier triage emitted when it recorded one.
+- If reproduction fails, warn and continue exactly as triage already does. Never stop. Never condition the fix on reproduction.
+
+### 2. Narrow fix
+
+- Narrow the fix to the reported behavior.
+- When a reproduction exists, change only what removes that recorded reproduction.
+- Nearby improvements stay out of scope.
+
+### 3. Proof matching triage
+
+- When a reproduction exists, re-run it, cite the same identifier, and show it now passing, plus the regression that would fail if the bug returned.
+- When none was obtained, state that plainly and show the regression instead.
+- Name the identifier in the pull request when one exists so the reviewer can check that proof, not merely that some test exists.
+`;
 }
 
-// apps/body/dist/prompt-assembly.js
-function renderReplyContext(message) {
-  if (!message.replyToMessageId)
-    return "";
-  const author = message.replyToAuthorName ?? message.replyToAuthorId ?? "unknown author";
-  return [
-    `Reply to message ${message.replyToMessageId} by ${JSON.stringify(author)}:`,
-    ...message.replyToExcerpt !== void 0 ? [`> ${JSON.stringify(boundReplyExcerpt(message.replyToExcerpt))}`] : []
-  ].join("\n");
+// apps/body/dist/external-mcp-capabilities.js
+var SQUIRE_MCP_VERSION = "latest";
+var SQUIRE_MCP_PACKAGE = `@trusty-squire/mcp@${SQUIRE_MCP_VERSION}`;
+function isTrustySquireMcpLaunch(command, args = []) {
+  return [command, ...args].some((value) => {
+    const normalized = value.trim().replace(/\\/g, "/").toLowerCase();
+    return /(^|[\s/="'\[,])@trusty-squire\/mcp(?:@[^\s/"'\],}]+)?(?=$|[\s/"'\],}])/i.test(normalized) || /(^|\/)trusty-squire(?:-mcp)?(?:\.[a-z0-9]+)?$/i.test(normalized);
+  });
 }
-var PROMPT_SURFACES = [
-  "room",
-  "dm",
-  "code-corner",
-  "review-corner",
-  "no-code-corner"
-];
-var CORNERS = [
-  "code-corner",
-  "review-corner",
-  "no-code-corner"
+var SQUIRE_GOVERNED_TOOLS = [
+  "use_credential",
+  "grant_app_access",
+  "revoke_app_access"
 ];
-var EVERYWHERE = PROMPT_SURFACES;
-var VALIDATION_STAGE_OWNERSHIP = `Validation stages (merge effect: none for every stage):
-Stage | Recorder | Server checks
---- | --- | ---
-intent, base, tests, docs, lint_types, publication, final_authorization | implementer | current revision/head
-review | configured reviewer records the review stage | current revision/head and reviewer identity
-ci | implementer | current revision/head; passed requires passing checks
-The server merge gate is the authority: pr_checks_status reports mergeAllowed true for the current head; merge_corner merges that head. final_authorization grants nothing; do not wait for mergeAllowed.`;
-function cornerHasRepositoryWork(brief) {
-  if (!brief)
-    return true;
-  if (brief.repositoryWork !== void 0)
-    return brief.repositoryWork;
-  const nonGoalsSections = [
-    ...brief.spec.matchAll(/^## (?:Non-goals|Not doing)\s*\n([\s\S]*?)(?=^## |$(?![\s\S]))/gim)
-  ].map((match) => match[1] ?? "");
-  const prohibition = /^(?:repository edits?|repository changes?|pull requests?|(?:edit|modify|change) (?:the )?(?:repository|repo|code)|push(?:es)?|commit(?:s)?)[.!;]*$/i;
-  for (const nonGoals of nonGoalsSections) {
-    for (const line of nonGoals.split("\n")) {
-      const bullet = /^\s*[-*]\s+/.test(line);
-      const clause = line.trim().replace(/^[-*]\s+/, "");
-      const negative = /^(?:no|never|do not|forbid(?:s|den)?)\s+/i;
-      if (!bullet && !negative.test(clause))
-        continue;
-      const items = clause.replace(negative, "").split(/,\s*|\s+(?:and|or)\s+/i);
-      if (items.some((item) => prohibition.test(item.trim())))
-        return false;
-    }
+var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
+
+// apps/body/dist/host-mcp-route.js
+import { join as join11, resolve as resolve14 } from "node:path";
+var import_yaml = __toESM(require_dist(), 1);
+init_squire_host();
+function grantedMcpServerNames(grants) {
+  const names = /* @__PURE__ */ new Set();
+  for (const grant of grants ?? []) {
+    if (grant.kind !== "mcp")
+      continue;
+    const name = grant.target.trim();
+    if (name)
+      names.add(name);
   }
-  const assigned = brief.spec.match(/^## Assigned files\s*\n([\s\S]*?)(?=^## |$(?![\s\S]))/mi)?.[1];
-  if (assigned !== void 0 && (!assigned.trim() || /^(?:\s*[-*]?\s*)(?:\(?none\)?|no assigned files)\b/i.test(assigned)))
-    return false;
-  return true;
-}
-var CORNER_RUNTIME_AUTHOR_CONTRACT = `The current brief's spec \u2014 stories, criteria, non-goals, risks \u2014 defines scope and done. The human approval quote wins any conflict. The short objective is navigation-only, never scope.
-Meet every story; respect every non-goal and risk.
-Before any code or build action, the brief must hold this ask's outline; opening and prompting inside it is not that outline. When it has none or the ask changed, read the revision and write it with revise_corner_brief first; chat never revises it.
-Follow the beeline-triage skill's bugfix execution contract when the spec or its approval quote reports a defect.
-Reproduce as triage isolated it with available emulator, Playwright, browser and test runner. Record attempts and observations. If a reproduction is obtained, record it under Reproduction <id>, reusing triage's identifier when it recorded one. If reproduction fails, warn and continue; never stop and never condition the fix on reproduction.
-Fix only the spec and approval quote. With a reproduction, change only what removes it and meets its user stories.
-Deliver files with post_artifact; answer plain chat questions directly.
-No unrequested features, flags, compatibility shims or refactors.`;
-var CORNER_AUTHOR_CONTRACT = `The current brief's spec \u2014 stories, criteria, non-goals, risks \u2014 defines scope and done. The human approval quote wins any conflict. The short objective is navigation-only, never scope.
-Meet every story; respect every non-goal and risk. Use its file manifest. Use record_validation_stage for this revision and head. Do not call a missing stage passed.
-${VALIDATION_STAGE_OWNERSHIP}
-Before any code or build action, the brief must hold this ask's outline; opening and prompting inside it is not that outline. When it has none or the ask changed, read the revision and write it with revise_corner_brief first; chat never revises it.
-Follow the beeline-triage skill's bugfix execution contract when the spec or its approval quote reports a defect.
-Reproduce as triage isolated it with available emulator, Playwright, browser and test runner. Record attempts and observations. If a reproduction is obtained, record it under Reproduction <id>, reusing triage's identifier when it recorded one. If reproduction fails, warn and continue; never stop and never condition the fix on reproduction.
-Fix only the spec and approval quote. With a reproduction, change only what removes it and meets its user stories.
-Only when the brief calls for repository changes, follow the PR procedure below. Otherwise do not commit, push or open a PR; deliver with post_artifact.
-Before the PR, demonstrate Y: run the built app or affected service and perform X. If no interactive surface is reachable, run the narrowest test or script exercising the exact user path and printing Y. An inner-function unit test, log line or code read is not a demonstration.
-The PR body MUST have ## Reproduced and ## Demonstrated. Cite Reproduction <id> in both, with steps, the wrong result and the now-passing result. In ## Demonstrated, when none was obtained, state that plainly ("not obtained") and show the regression; for feature work say "not a defect report".
-No unrequested features, flags, compatibility shims or refactors.`;
-var CORNER_REVIEWER_SESSION_INSTRUCTION = "You are this Room's configured reviewer. The active turn prompt names the latest stable green PR head. Review and approve only that exact head; if no stable green head is named, end the turn without a verdict. Never merge yourself.";
-var CORNER_REVIEWER_UNSTABLE_HEAD_INSTRUCTION = "There is no stable green PR head for this active reviewer turn. Do not review or call approve_merge. End this turn without a verdict; the next green transition will wake you.";
-var CORNER_DELIVERY_NUDGE = "Only when the brief calls for repository changes, inspect the repository state and finish delivering the work unless a human hold stands: commit and push the intended changes and open the pull request if one does not exist. Decide yourself whether any remaining dirty work belongs to the brief; do not discard it merely to make the worktree clean. The pull request body must carry ## Reproduced and ## Demonstrated; if they are missing, add them before ending the turn. Otherwise do not commit, push or open a PR; deliver with post_artifact.";
-var CORNER_LAND_RULE = "Then, if a human's question or proposal in the corner has no answer, name it and do not merge; otherwise call merge_corner.";
-var CORNER_YOLO_MERGE_NUDGE = `Yolo is on. Call pr_checks_status now. If checks="failed", fix the failure and push. If checks="unknown", reply in this corner with the tool reason and stop instead of retrying. Otherwise stop: a reviewer's PASS wakes you to merge with merge_corner. Never merge it any other way.`;
-var UPGRADE_INTENT_RULE = "Call this on your own judgment when the work in this corner needs the repository; nobody has to ask. Call it while answering a human message in this corner, then write the brief in the restarted code session.";
-var CORNER_PLACEHOLDER_BRIEF_RULE = "This brief is the placeholder the upgrade wrote from the request. Read the code, write the real spec with revise_corner_brief, then post it in this corner and ask the corner's opener to approve it before editing. This is best effort: if the opener is away or the request was already explicit, use your judgment and proceed. When the opener replies, record their reply as the approval in the next revision.";
-function isPlaceholderCornerBrief(brief) {
-  return brief.revision === 1 && brief.authorId === SYSTEM_IDENTITY_ID;
+  return [...names];
 }
-var handle = (value) => value.replace(/^@/, "");
-function cornerMergeInstruction(yoloMode, reviewerHandle) {
-  if (!reviewerHandle)
-    return "Once the pull request exists, reply with its full URL and end the turn; do not check or wait for CI. This Room has no configured reviewer, so the merge gate never opens for you: never merge; a person merges it.";
-  const reviewer = `the reviewer (${handle(reviewerHandle)})`;
-  return yoloMode ? `Once the pull request exists, reply with its full URL and end the turn; do not tag ${reviewer}, check, or wait for CI. Green checks wake ${reviewer}; its PASS wakes you to merge. ${CORNER_LAND_RULE} You are also woken to fix failing checks, requested changes, or a refused merge; a fixed head needs green checks and a fresh PASS.` : `Once the pull request exists, reply with its full URL and end the turn; do not tag ${reviewer}, check, or wait for CI. Yolo is off, so the merge gate stays closed for you: never merge; a person merges it after ${reviewer} approves.`;
+function ungatedHostServers(hostServers, granted) {
+  const allowed = new Set(granted);
+  return hostServers.filter((name) => !allowed.has(name));
 }
-function cornerReviewerInstruction(input) {
-  if (!input.isReviewer || input.openedByAgent)
-    return void 0;
-  const author = input.authorHandle ? handle(input.authorHandle) : "author";
-  const number = input.pullRequestNumber ?? "N";
-  const headSha = input.headSha ?? "<head sha>";
-  return `Checks are green on PR #${number} at ${headSha}${input.briefRevision ? ` with assigned brief revision ${input.briefRevision}` : ""}. Review it now with the beeline-review skill against that exact head and current assigned brief. FAIL: call record_validation_stage with stage "review", status "failed", and headSha ${headSha}, then reply \`@${author}\` with the confirmed findings and the reviewed head ${headSha} to fix. PASS: call the approve_merge tool for ${headSha}${input.briefRevision ? ` with briefRevision=${input.briefRevision}` : ""}, then reply \`approved ${headSha}\` without tagging ${author}: your PASS wakes the author to merge, so a tag adds nothing. A human's question or proposal in the corner discussion with no answer is a FAIL finding; name it. Never merge yourself or tell the author to merge. Never say you are holding or waiting for checks.`;
+async function claimGrantedHostRoutes(result) {
+  if (!result || typeof result !== "object" || !("grants" in result))
+    return [];
+  const grants = result.grants;
+  if (!Array.isArray(grants))
+    return [];
+  return grantedMcpServerNames(grants.flatMap((entry) => {
+    if (!entry || typeof entry !== "object")
+      return [];
+    const grant = entry;
+    return grant.kind === "mcp" && typeof grant.target === "string" && (grant.status === "once" || grant.status === "approved") ? [{ kind: "mcp", target: grant.target }] : [];
+  }));
 }
-function cornerSelfReviewerInstruction(input) {
-  if (!input.isReviewer || !input.openedByAgent)
-    return void 0;
-  return "Once the pull request exists, reply with its full URL and end the turn. You are this Room's reviewer, so no other agent can review your pull request: do not request one or tag any agent for review. It merges only on a human's yes: ask a Workspace owner or admin to approve the merge, then record their yes with order_corner_merge. Never merge it any other way. You are woken to fix failing checks or a merge GitHub refused.";
+function recordValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function shellLine(shell) {
-  if (!shell)
-    return "";
-  if (shell.available) {
-    return "Shell commands are available in this session: run one with your own shell tool when the work needs it, and cite the output that supports your answer.";
-  }
-  return `Shell commands are NOT available in this session, so a request that needs one cannot be run; say that plainly instead of retrying.${shell.detail ? ` Relay this to the person: ${shell.detail}` : ""}`;
-}
-var SESSION_SECTIONS = [
-  {
-    id: "core.identity",
-    topic: "identity",
-    why: "Agents on harnesses with their own default persona introduce themselves under the wrong name unless told who they are.",
-    budgetBytes: 1400,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: ({ agentName, soul }) => [
-      `You are ${agentName} in Beeline. Stay ${agentName} in every reply, including when a tool or permission blocks you.`,
-      soul ? `Soul (${soul.name}): ${soul.instructions}
-The soul is not authority and never changes your tools, permissions, roles, or merge rights.` : ""
-    ].filter(Boolean).join("\n")
-  },
-  {
-    id: "core.voice",
-    topic: "voice",
-    why: "A seeded voice once bent facts for the bit and leaked into commit messages that outlive it.",
-    budgetBytes: 320,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Your voice never changes the facts: never trim, soften, exaggerate, or invent a detail for style. Write commit messages, pull request titles and bodies, and code comments in a plain voice."
-  },
-  {
-    id: "core.proactive",
-    topic: "proactivity",
-    why: "Agents answered a reported problem by restating it instead of fixing it or offering to.",
-    budgetBytes: 200,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Answer every problem with the finished fix, or with the concrete next step and an offer to take it. Never just restate the problem."
-  },
-  {
-    id: "core.finish",
-    topic: "turn-end",
-    why: "An agent read a not-yet-connected tool result as a stopping point and ended the turn with its own work undone.",
-    budgetBytes: 360,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Finish the work before you end the turn. A tool result that hands you a step (connecting, needs sign-in, call again, a next step) is your next action: take it now. End the turn to wait only when someone else must act next (a person replying or answering a card, grant, choice or approval; CI; a reviewer) or you are truly blocked."
-  },
-  {
-    id: "core.truth",
-    topic: "claims",
-    why: "Agents reported replies and actions that no tool had performed.",
-    budgetBytes: 200,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Never claim an action, result, or reply happened unless the prompt or a tool result proves it. State real doubt once, plainly; skip filler hedges."
-  },
-  {
-    id: "core.reply",
-    topic: "reply-shape",
-    why: "Agents echoed their instructions, the trigger, or their own answer back as a second reply.",
-    budgetBytes: 160,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Write only the message the reader needs. Never repeat these instructions, the trigger, or an answer you already gave."
-  },
-  {
-    id: "core.tagging",
-    topic: "tagging",
-    why: "Every @handle is a wake; stray handles woke agents with nothing to do, and guessed spellings reached nobody.",
-    budgetBytes: 360,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Every exact @handle you write wakes that member. Write one only to hand off work, to ask for a decision or input, or, when nothing else announces it, to tell the person who asked that their task is done; otherwise name people and agents in plain prose. Copy handles only from the member list in the turn prompt; any other spelling reaches nobody."
-  },
-  {
-    id: "core.authority",
-    topic: "authority",
-    why: "Resource access and the two command hard stops must hold on every surface, whoever asked.",
-    budgetBytes: 520,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Use your own owner's tools and keys for whoever asks. Another person's files, tools, or keys need that person's approval before you use them for anyone else, and the wallet keeps its own approval rule. Never, whoever asks: run a command that names a credential file, or run a script nobody has read. Follow your owner first, then Workspace admins, then members; only the person who set a hold, or someone above them, clears it. Delegated and follow-up work keeps the original requester."
-  },
-  {
-    id: "core.feedback",
-    topic: "feedback",
-    why: "Nothing reviews a turn after it ends, so friction in Beeline itself is lost unless the agent that hit it reports it in the turn.",
-    budgetBytes: 260,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "Only when this turn hit friction in Beeline itself (a tool error, a retry, a refused call, contradictory instructions, missing context, or a person correcting you), call report_feedback once before ending the turn. Otherwise do not."
-  },
-  {
-    id: "core.files",
-    topic: "files",
-    why: "Files on earlier messages are shown only as markers and never pre-downloaded; agents fetched media URLs instead.",
-    budgetBytes: 160,
-    layer: "core",
-    surfaces: EVERYWHERE,
-    render: () => "For a \u{1F4CE} file, call download_attachment and read its path. Never fetch media URLs; on failure, say you couldn't open it."
-  },
-  {
-    id: "surface.tools",
-    topic: "tools",
-    why: "Agents need app discovery before use in every turn; connector offers remain in Rooms and DMs.",
-    budgetBytes: 240,
-    layer: "surface",
-    surfaces: EVERYWHERE,
-    render: ({ surface }) => surface === "room" || surface === "dm" ? "When you need a tool you do not have, call workbench_status; offer_connector the tool it lists, otherwise call connect_app for the app." : "In corners, workbench_status discovers apps; connect_app starts sign-in here. Connector offers stay in Rooms and DMs."
-  },
-  // --- Room ----------------------------------------------------------------
-  {
-    id: "room.place",
-    topic: "place",
-    why: "The agent must know it cannot write here, where the checkout is, and whether it has a shell.",
-    budgetBytes: 700,
-    layer: "surface",
-    surfaces: ["room"],
-    render: ({ repository, shell }) => [
-      `This is a Beeline Room. The repository filesystem is read-only here.${repository ? ` The Room is bound to ${repository.name} (branch ${repository.branch}); the read-only checkout is at the session root.` : ""} Web search is available.`,
-      shellLine(shell),
-      shell?.available === false ? "Read code with CodeGraph when available, then beeline-readonly-mcp search_text and read_file." : "If a shell command is refused, say so plainly rather than retrying, and read code with CodeGraph when available, then beeline-readonly-mcp search_text and read_file."
-    ].filter(Boolean).join(" ")
-  },
-  {
-    id: "room.corners",
-    topic: "repository-work",
-    why: "Repository work must start through the host-governed corner, with a brief as its authority.",
-    budgetBytes: 1100,
-    layer: "surface",
-    surfaces: ["room"],
-    render: () => [
-      "Repository changes happen only in a corner. In a Room, the finished fix for a code problem is the exact change plus an offer to open a corner for it; open one when a person asks for the change.",
-      "Before opening one, consult beeline-triage and beeline-spec, then call open_corner with a name of at most three words joined by hyphens (no whitespace), an objective of at most 24 words, and the brief (a spec plus the approving message). The objective only titles the work; the brief is its authority. When open_corner succeeds the server posts the corner card: do not restate it.",
-      "For corners you belong to, use inspect_corner for status, steer_corner to pass Room input down, and ask_corner for one answer. Never post into a corner without a Room command.",
-      "A corner ends when its pull request merges; since a person may merge minutes after it opens, anything still needed must already live in a different corner before that pull request opens, not after. A request covering several items is one corner per item, opened as work reaches each one, never one corner returned to for a later item."
-    ].join(" ")
-  },
-  {
-    id: "room.replying",
-    topic: "room-replies",
-    why: "Several agents share a Room; replies with nothing to act on, and echoed nudges, are noise.",
-    budgetBytes: 520,
-    layer: "surface",
-    surfaces: ["room"],
-    render: () => "If nothing is actionable for you, do not reply. If the current task is only a nudge to respond, answer the most recent unanswered human message instead of echoing the nudge. A poll plurality is a fact, never permission to deploy, delete, merge, or spend. Consult the using-beeline skill for Room mechanics (files, artifacts, schedules, reactions, events, mocks)."
-  },
-  // --- DM ------------------------------------------------------------------
-  {
-    id: "dm.place",
-    topic: "place",
-    why: "A DM has one person, no repository work, and no corners; the agent must not tag or try to open one.",
-    budgetBytes: 700,
-    layer: "surface",
-    surfaces: ["dm"],
-    render: ({ shell }) => [
-      "This is a private direct message with one person: everything they send is for you, so reply without tagging. It has no repository work and no corners, and the filesystem is read-only. Web search is available.",
-      shellLine(shell)
-    ].filter(Boolean).join(" ")
-  },
-  {
-    id: "dm.choices",
-    topic: "choices",
-    why: "A pick in a DM is a preference, never authority, and polls need an electorate.",
-    budgetBytes: 300,
-    layer: "surface",
-    surfaces: ["dm"],
-    render: () => "ask_choice offers options; a pick is a preference, never sandbox, spend, or merge authority. Consult the using-beeline skill for files, artifacts, and reactions."
-  },
-  // --- Corners -------------------------------------------------------------
-  {
-    id: "corner.steering",
-    topic: "corner-steering",
-    why: "Active corner turns can steer member siblings without borrowing parent Room authority.",
-    budgetBytes: 160,
-    layer: "surface",
-    surfaces: ["code-corner", "no-code-corner", "review-corner"],
-    render: () => "Use steer_corner during a turn to send input to a member sibling under this parent. Membership alone grants no turn."
-  },
-  {
-    id: "corner.handover",
-    topic: "corner-handover",
-    why: "An agent asked to hand the corner on opened a duplicate sibling corner instead of tagging the other agent.",
-    budgetBytes: 360,
-    layer: "surface",
-    surfaces: ["code-corner", "no-code-corner"],
-    render: () => "When a person asks you to hand this corner to another agent, tag in your reply only an agent that person named by handle or display name: it moves the implementer role here. A tag for any other reason does not move the role. Do not open a second corner for a hand-over."
-  },
-  {
-    id: "corner.worktree",
-    topic: "place",
-    why: "The agent must know its branch and target; only a code-corner author is told to push and open the pull request.",
-    budgetBytes: 900,
-    layer: "surface",
-    surfaces: ["code-corner", "review-corner"],
-    render: ({ worktree, surface, githubCli, brief }) => [
-      `You are in an isolated git worktree on ${worktree?.featureBranch ?? "the feature branch"}, targeting ${worktree?.targetBranch ?? "the target branch"}.`,
-      surface !== "code-corner" || !cornerHasRepositoryWork(brief) ? "" : githubCli === "rest" ? `Only when the brief calls for repository changes: commit and push only ${worktree?.featureBranch}; never force-push or write to ${worktree?.targetBranch}. Before pushing, run \`git ls-remote --exit-code origin ${worktree?.featureBranch}\`. Exit code 0: rebase on origin/${worktree?.featureBranch}; resolve conflicts autonomously, realigning to that remote branch and redoing the work if needed, then rerun affected tests. Exit code 2: the branch is absent; skip rebase for the first push. Any other non-zero exit is a lookup failure: stop and retry; do not skip rebase or push. Open it with \`gh pr create\` and read it with \`gh pr view\`; this host has no gh, so the Beeline launcher answers both over the GitHub REST API with the app token.` : `Only when the brief calls for repository changes: commit and push only ${worktree?.featureBranch}; never force-push or write to ${worktree?.targetBranch}. Before pushing, run \`git ls-remote --exit-code origin ${worktree?.featureBranch}\`. Exit code 0: rebase on origin/${worktree?.featureBranch}; resolve conflicts autonomously, realigning to that remote branch and redoing the work if needed, then rerun affected tests. Exit code 2: the branch is absent; skip rebase for the first push. Any other non-zero exit is a lookup failure: stop and retry; do not skip rebase or push. Open the pull request with gh.`
-    ].filter(Boolean).join("\n")
-  },
-  {
-    id: "corner.android",
-    topic: "android",
-    why: "An agent under its isolated $HOME concluded the host had no emulator, and agents on the shared adb server drove each other's emulators.",
-    budgetBytes: 380,
-    layer: "surface",
-    surfaces: ["code-corner"],
-    when: ({ android }) => Boolean(android),
-    render: ({ android }) => `Android: adb and emulator are on PATH; the SDK is $ANDROID_HOME, AVDs are in $ANDROID_AVD_HOME, and /dev/kvm works. Your adb server sees only your own emulator. Boot it with \`emulator -avd <name> -port ${android?.emulatorPort} -read-only -no-window -no-snapshot -gpu swiftshader_indirect\`; it reaches host services at 10.0.2.2.`
-  },
-  {
-    id: "corner.prepare",
-    topic: "corner-prepare",
-    why: "Only a checkout that defines the command can run it; another repository fails on its first step.",
-    budgetBytes: 60,
-    layer: "surface",
-    surfaces: ["code-corner"],
-    when: ({ brief, cornerPrepareScript }) => cornerHasRepositoryWork(brief) && cornerPrepareScript === true,
-    render: () => "Run npm run corner:prepare first."
-  },
-  {
-    id: "corner.contract",
-    topic: "author-contract",
-    why: "The reviewer enforces this contract; an author that never saw it fails review.",
-    budgetBytes: 2600,
-    layer: "surface",
-    surfaces: ["code-corner"],
-    render: ({ brief }) => cornerHasRepositoryWork(brief) ? CORNER_AUTHOR_CONTRACT : CORNER_RUNTIME_AUTHOR_CONTRACT
-  },
-  {
-    id: "corner.merge",
-    topic: "merge",
-    why: 'Exactly one rule may say who merges and when; two rules here once said both "merge" and "never merge".',
-    budgetBytes: 520,
-    layer: "surface",
-    surfaces: ["code-corner"],
-    when: ({ brief }) => cornerHasRepositoryWork(brief),
-    render: ({ yoloMode, reviewerHandle, selfReviewer }) => (selfReviewer ? cornerSelfReviewerInstruction({ isReviewer: true, openedByAgent: true }) : cornerMergeInstruction(Boolean(yoloMode), reviewerHandle)) + " Never merge any other pull request."
-  },
-  {
-    id: "corner.checks",
-    topic: "checks-turns",
-    why: "Server check notes were restated as replies, and agents scheduled polls of a gate that wakes them itself.",
-    budgetBytes: 900,
-    layer: "surface",
-    surfaces: ["code-corner"],
-    when: ({ brief }) => cornerHasRepositoryWork(brief),
-    render: () => "When asked whether the reviewer was woken, call pr_checks_status and report reviewerWake; do not invent a cause. Never schedule polls of pr_checks_status or the merge gate; the server wakes you when it changes."
-  },
-  {
-    id: "corner.review",
-    topic: "merge",
-    why: "The reviewer approves one exact green head and never merges.",
-    budgetBytes: 400,
-    layer: "surface",
-    surfaces: ["review-corner"],
-    render: () => `${CORNER_REVIEWER_SESSION_INSTRUCTION} Report findings to the author; never edit or push the author's branch.`
-  },
-  {
-    id: "corner.no-code",
-    topic: "place",
-    why: "A no-code corner has no repository; the agent delivers files, not commits.",
-    budgetBytes: 1e3,
-    layer: "surface",
-    surfaces: ["no-code-corner"],
-    render: ({ agentMayUpgradeCorner }) => [
-      "This is a no-code corner with no repository checkout and no GitHub workflow. Work in this corner's writable workspace: create files with write_scratch_file or your own tools, then send them with post_artifact.",
-      agentMayUpgradeCorner ? `Do not initialize a repository, create a branch, commit, push, open a pull request, or wait for GitHub checks. The one exception is beeline-agent upgrade_corner_to_code. ${UPGRADE_INTENT_RULE} That one-way upgrade restarts this same corner with a feature branch and writable checkout, keeps its discussion, and re-delivers that same request in the code session, so end this turn immediately once it succeeds and do not edit this workspace.` : "Do not initialize a repository, create a branch, commit, push, open a pull request, or wait for GitHub checks."
-    ].join("\n")
-  },
-  {
-    id: "corner.no-code-reply",
-    topic: "reply-target",
-    why: "Every turn was told to end with a one-line summary of files it posted, so answers were followed by a restatement of themselves.",
-    budgetBytes: 260,
-    layer: "surface",
-    surfaces: ["no-code-corner"],
-    render: ({ requesterHandle }) => `${requesterHandle ? `Tag @${handle(requesterHandle)} once, when the deliverable is posted or you need their input. ` : ""}When you posted files, name them in one line; never restate your answer. Only a human closes this corner.`
-  }
-];
-function applicable(sections, context) {
-  return sections.filter((section) => section.surfaces.includes(context.surface) && (section.when?.(context) ?? true)).map((section) => ({ section, text: section.render(context).trim() })).filter((entry) => entry.text);
-}
-function sessionSections(context) {
-  return applicable(SESSION_SECTIONS, context);
-}
-function assembleSessionPrompt(context) {
-  const entries = sessionSections(context);
-  const systemPrompt = entries.map((entry) => entry.text).join("\n\n");
-  return {
-    systemPrompt,
-    turnPrefix: harnessHonorsSessionSystemPrompt(context.agentCommand) ? "" : systemPrompt,
-    report: entries.map(({ section, text: text2 }) => ({
-      id: section.id,
-      bytes: Buffer.byteLength(text2)
-    }))
-  };
-}
-function renderAssignedCornerBrief(brief) {
-  const approval = brief.approval ? `Approved by ${brief.approval.approverName}, message ${brief.approval.sourceMessageId}: ${brief.approval.text}` : "This revision predates recorded approvals.";
-  return `Brief revision ${brief.revision}:
-${brief.spec}
-
-${approval}`;
-}
-function roomMentionDirectory(roster, selfId) {
-  const rows = [];
-  let selfHandle;
-  for (const member of roster.members) {
-    if (member.identityId === selfId) {
-      selfHandle = member.handle?.trim().replace(/^@/, "");
-      continue;
-    }
-    const memberHandle = member.handle?.trim().replace(/^@/, "");
-    if (!memberHandle)
-      continue;
-    const name = member.name?.trim() ?? "";
-    const kind = member.kind === "agent" ? "agent" : "person";
-    rows.push(`- @${memberHandle}${name && name !== memberHandle ? ` \u2014 ${name}` : ""} (${kind})`);
-  }
-  if (selfHandle)
-    rows.push(`You are @${selfHandle}, a member of this Room; you are not listed above.`);
-  if (!rows.length)
-    return "";
-  return ["Members (exact tag spellings):", ...rows].join("\n");
-}
-var ROOMS = ["room", "dm"];
-var TURN_SECTIONS = [
-  {
-    id: "turn.session",
-    topic: "session-delivery",
-    why: "Codex, Pi, and Grok drop the ACP session prompt; without this they never saw the corner rules.",
-    budgetBytes: 16e3,
-    layer: "turn",
-    surfaces: EVERYWHERE,
-    render: ({ sessionPrefix }) => sessionPrefix ?? ""
-  },
-  {
-    id: "turn.checks",
-    topic: "checks-turns",
-    why: "Only CI or merge-gate wakes suppress ordinary reporting; user schedules must deliver their task results.",
-    budgetBytes: 350,
-    layer: "turn",
-    surfaces: ["code-corner"],
-    when: ({ task }) => task.commandReason !== "schedule" && (["corner_check", "corner_merge_refused", "corner_merge_conflict"].includes(task.commandReason ?? "") || ["check-passed", "check-failed"].includes(task.outsideEvent?.kind ?? "")),
-    render: () => 'This is a checks turn about CI or the merge gate. On it, say nothing unless you push a fix or report checks="unknown", and then use one short line. Never restate server check or merge notes.'
-  },
-  {
-    id: "turn.land",
-    topic: "land-turn",
-    why: "A reviewer's PASS hands the merge to the implementer, who must not merge over an unanswered human question.",
-    budgetBytes: 300,
-    layer: "turn",
-    surfaces: ["code-corner"],
-    when: ({ task }) => task.commandReason === "corner_land",
-    render: () => `The reviewer approved this pull request's current head. ${CORNER_LAND_RULE}`
-  },
-  {
-    id: "turn.objective",
-    topic: "objective",
-    why: "The objective locates the work but must never be mistaken for its authority.",
-    budgetBytes: 600,
-    layer: "turn",
-    surfaces: CORNERS,
-    render: ({ objective }) => objective ? `Corner objective (navigation only, not product authority): ${objective}` : ""
-  },
-  {
-    id: "turn.rename",
-    topic: "corner-rename",
-    why: "A generated corner name says nothing about the work; only the server knows the name is still generated, so the ask rides only on those turns.",
-    budgetBytes: 600,
-    layer: "turn",
-    surfaces: CORNERS,
-    render: ({ generatedTitle, brief }) => generatedTitle ? `This human-opened corner still has its generated name, "${generatedTitle}". If the newest human message states the work, call rename_corner once before you reply with a name of at most three words joined by hyphens (no whitespace) and a short objective${brief ? "" : ", plus a brief grounded in that message with brief.approval.sourceMessageId set to the human message id"}. A bare mention does not state the work; leave the name until a message does.` : ""
-  },
-  {
-    id: "turn.brief",
-    topic: "brief",
-    why: "The brief is the product authority for corner work; a corner without one says so once.",
-    budgetBytes: 24e3,
-    layer: "turn",
-    surfaces: CORNERS,
-    render: ({ brief, surface }) => brief ? `${renderAssignedCornerBrief(brief.brief)}${cornerHasRepositoryWork(brief.brief) ? `
-
-Assigned files:
-${brief.fileLines.join("\n") || "(none)"}` : brief.fileLines.length ? `
-
-Brief attachments:
-${brief.fileLines.join("\n")}` : ""}${brief.missingRequiredFile ? "\nRequired assignment files are unavailable. Pause work that depends on them and report the missing file precisely." : ""}${surface === "code-corner" && isPlaceholderCornerBrief(brief.brief) ? `
-
-${CORNER_PLACEHOLDER_BRIEF_RULE}` : ""}` : "No assigned brief: the human messages in this corner are the authority; skip steps that need a brief revision."
-  },
-  {
-    id: "turn.checkout",
-    topic: "checkout",
-    why: "A Room checkout is refreshed per turn; the agent must know which commit it reads.",
-    budgetBytes: 200,
-    layer: "turn",
-    surfaces: ROOMS,
-    render: ({ checkout }) => checkout ? `Repository checkout: origin/${checkout.branch} at commit ${checkout.commit}, refreshed for this turn.` : ""
-  },
-  {
-    id: "turn.transcript",
-    topic: "transcript",
-    why: "The conversation so far, with rows this session already saw left out.",
-    budgetBytes: 2e5,
-    layer: "turn",
-    surfaces: EVERYWHERE,
-    render: ({ transcript, surface }) => {
-      if (!transcript?.lines.length)
-        return "";
-      const place = ROOMS.includes(surface) ? "Room" : "corner";
-      return `${transcript.sinceLastTurn ? `New in the ${place} since your last turn:` : `${place === "Room" ? "Room conversation" : "Corner transcript"}:`}
-${transcript.lines.join("\n")}`;
-    }
-  },
-  {
-    id: "turn.resume",
-    topic: "resume",
-    why: "A card answer resumes a paused turn; the agent must know which question was answered.",
-    budgetBytes: 600,
-    layer: "turn",
-    surfaces: ROOMS,
-    render: ({ resume }) => resume ?? ""
-  },
-  {
-    id: "turn.members",
-    topic: "members",
-    why: "Handle spellings change; only the live roster is a safe source.",
-    budgetBytes: 4e3,
-    layer: "turn",
-    surfaces: EVERYWHERE,
-    render: ({ members }) => members ?? ""
-  },
-  {
-    id: "turn.memory",
-    topic: "memory",
-    why: "Keyword-matched institutional memory, compiled and capped by the server.",
-    budgetBytes: 1e3,
-    layer: "turn",
-    surfaces: EVERYWHERE,
-    render: ({ memory }) => memory ?? ""
-  },
-  {
-    id: "turn.corners",
-    topic: "corners",
-    why: "Room and corner agents need exact member corner ids for supported relay actions.",
-    budgetBytes: 8e3,
-    layer: "turn",
-    surfaces: ["room", "code-corner", "no-code-corner", "review-corner"],
-    render: ({ surface, corners, closedCorners }) => [
-      corners?.length ? `Current corners you belong to (use the exact cornerId with ${surface === "room" ? "inspect_corner, steer_corner, or ask_corner" : "steer_corner for a sibling under this parent Room"}):
-${JSON.stringify(corners)}` : "",
-      surface === "room" && closedCorners?.length ? `Corners you belong to closed in the last 24 hours (merge commit is unavailable when absent):
-${closedCorners.map((corner) => `- ${corner.name ?? corner.cornerId} (${corner.cornerId}): PR ${corner.pullRequestNumber ? `#${corner.pullRequestNumber}` : "unavailable"}, merge commit ${corner.mergeCommitSha ?? "unavailable"}`).join("\n")}` : ""
-    ].filter(Boolean).join("\n\n")
-  },
-  {
-    id: "turn.reviewer-target",
-    topic: "reviewer-target",
-    why: "The reviewer must review the head that is green now, not one named in an older message.",
-    budgetBytes: 1200,
-    layer: "turn",
-    surfaces: ["review-corner"],
-    render: ({ reviewerTarget }) => reviewerTarget ?? ""
-  },
-  {
-    id: "turn.task",
-    topic: "task",
-    why: "The message this turn answers, said once and last.",
-    budgetBytes: 64e3,
-    layer: "turn",
-    surfaces: EVERYWHERE,
-    render: ({ task, surface }) => ROOMS.includes(surface) ? [
-      `Current task from ${task.fromName ?? "a Room member"}:`,
-      task.cornerAskId ? `Corner ask id: ${task.cornerAskId}. Use get_corner_ask to retrieve its status and answer.` : "",
-      task.body,
-      renderReplyContext(task.reply ?? {})
-    ].filter(Boolean).join("\n\n") : [
-      ...task.reactionTargetId ? [`Reaction target message id: ${task.reactionTargetId}`] : [],
-      `Newest message:
-${task.body}`,
-      ...task.reply?.replyToMessageId ? [renderReplyContext(task.reply)] : [],
-      ...task.attachmentLines ?? []
-    ].join("\n")
-  }
-];
-function assembleTurnPrompt(context) {
-  if (context.task.outsideEvent?.kind?.startsWith("webhook:")) {
-    context = { ...context, task: { ...context.task, body: quoteOutsideData(context.task.outsideEvent.kind, context.task.outsideEvent.payload) } };
-  }
-  const boundedContext = ROOMS.includes(context.surface) ? {
-    ...context,
-    task: {
-      ...context.task,
-      body: boundRoomTaskBody(context.task.body, context.modelContextTokens)
-    }
-  } : context;
-  const withoutTranscript = applicable(TURN_SECTIONS, {
-    ...boundedContext,
-    transcript: void 0
-  });
-  const otherBytes = withoutTranscript.reduce((sum, entry) => sum + Buffer.byteLength(entry.text) + 2, 0);
-  const lines = budgetTranscript(boundedContext.transcript?.lines ?? [], boundedContext.modelContextTokens, otherBytes);
-  const entries = applicable(TURN_SECTIONS, {
-    ...boundedContext,
-    transcript: boundedContext.transcript ? { ...boundedContext.transcript, lines } : void 0
-  });
-  return {
-    text: entries.map((entry) => entry.text).join("\n\n"),
-    report: entries.map(({ section, text: text2 }) => ({
-      id: section.id,
-      bytes: Buffer.byteLength(text2)
-    }))
-  };
-}
-
-// apps/body/dist/beeline-skill.js
-var USING_BEELINE_SKILL_NAME = "using-beeline";
-var BEELINE_TRIAGE_SKILL_NAME = "beeline-triage";
-var BEELINE_REVIEW_SKILL_NAME = "beeline-review";
-var BEELINE_SPEC_SKILL_NAME = "beeline-spec";
-var BEELINE_ROOM_MECHANICS = [
-  "Files and photos on the message you are answering are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline). A file on an earlier message shows only as a \u{1F4CE} marker with an id; call beeline-agent download_attachment with that message id and attachment id, then read the returned path. Never fetch a media URL; if the download fails, tell the requester you could not open the file.",
-  "To create a file you can send, call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent post_artifact with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote), or with html/bytes content directly; it is uploaded and attached to your reply, and title and mime default from the file when you post by path. write_scratch_file produces the file, not a picture.",
-  "To run something later or repeatedly, call beeline-agent create_schedule (interval in minutes or a 5-field cron, optional maxRuns); list_schedules / update_schedule / delete_schedule manage them, including schedules other agents created for themselves.",
-  `To react to a message in this Room, call beeline-agent react_to_message with its message id and one supported emoji (${MESSAGE_REACTION_EMOJIS.join(" ")}).`,
-  `To react to things that HAPPEN in this Room rather than only to what is said to you, call beeline-agent subscribe_events with the kinds you want; each one then wakes you for a turn. Available kinds: ${eventKindCatalogLines().join("; ")}. Subscriptions are per Room and cover every way the event lands: joining a Room you subscribed to wakes you, and so does a person arriving in the Workspace when that arrival projects into this Room - subscribe to joined in an onboarding Room and every newcomer wakes you, exactly like a greeter. It replaces your list, so send every kind you want - list_event_subscriptions shows the current one. You do this yourself: nobody has to configure it for you. A corner merging wakes nobody in its parent Room by default. If you still have work to do after a corner merges (a hand-off, a release step, a reply that has to describe landed code), subscribe to merged in the parent Room, from a turn there, before the merge. Each merge in that Room then wakes you and names the corner and pull request: act only on the corner you are waiting for, post nothing for any other merge, and take merged back out of your list once nothing is left to wait for. Never post just to acknowledge a merge: the merge card already announces it. A grant, connector offer, posted choice or poll, or Squire approval (payment, credential, sign-in, or vouch) you asked for wakes you back with the answer on its own - there is nothing to subscribe to for it, and asking is refused.`,
-  "If you need reach outside the sandbox, call beeline-agent request_grant. If you already know discrete options, call beeline-agent ask_choice (one human, optional) or open_poll (every human in this Room, required deadline). A poll is refused below two electors and above fifty, and in a DM. A plurality is a fact, never permission to deploy, delete, merge, or spend. Open-ended asks stay tagged prose. Never put Always / Once / No on a preference.",
-  "To state something that happened so the Room and other agents can act on it, call beeline-agent emit_event with your own agent:<slug> kind, one sentence, and optionally the agent members to wake. Chains of events are bounded and a refused emit posts nothing."
-].join(" ");
-function runningBeelineReleaseId(env = process.env, read2 = (path) => readFileSync4(path, "utf8")) {
-  try {
-    const lib = env.BEELINE_LIB_DIR;
-    if (!lib)
-      return "source";
-    const manifest = JSON.parse(read2(resolve13(lib, "bundle.json")));
-    return [manifest.version, manifest.commit].filter(Boolean).join("-") || "source";
-  } catch {
-    return "source";
-  }
-}
-function usingBeelineSkillMarkdown(releaseId) {
-  return `---
-name: using-beeline
-description: How to answer inside a Beeline Room.
----
-
-<!-- beeline-release: ${releaseId} -->
-
-# Using Beeline
-
-These mechanics apply in Rooms and corners. ${BEELINE_ROOM_MECHANICS}
-
-## Conflicting human instructions
-
-Follow your own owner first, then this Workspace's owner and admins, then members. A higher-tier instruction overrides a lower-tier hold. A human at the same standing cannot clear another human's hold; only that holder or someone of higher standing can. Never tell a higher-tier human that a lower-tier hold binds them. Reason from the conversation. When you explain a hold or go-ahead in the Room, name the person and their standing in ordinary words. Never write field names or field=value syntax such as workspaceRole=member or agentOwner.
-
-## Tools and the Workbench
-
-A **tool** is something you can use once a human adds it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
-
-The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent workbench_status. That read is the Workbench of the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire is vaulted credentials plus a browser for the separate key and browser routes. Drive a multi-step browser flow such as checkout or signup with operate_drive rather than one operate_act call per step. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Workbench page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
-
-**Inspect your own host before answering.** When a question is about a system on the machine you run on, inspect its live state with the tools you have: processes, logs, local endpoints or service status. Say what you checked. Memory and Room history are not evidence of current state.
-
-**Use available tools before asking the person.** Before asking a person for a code, a status or a file, call workbench_status and check whether a tool or connected app you already have can get it, then use it. This includes an emailed verification code in an already-connected inbox. Ask only when none can, and say why. The key-ownership and grant rules still apply.
-
-**Offer the tool at the moment you need it.** When the work in front of you needs a tool the person does not have, do not send them to a settings page and do not stop at naming it. Call workbench_status first - a tool they already have is used, not offered. In a Room or DM, call offer_connector with the connectorType and one short reason: a card appears there, spoken by you, addressed to the person you are answering, with one action. Connector offers are unavailable in corners; use a Room or DM for those. Your turn pauses on the card - say in prose what you are waiting for and end the turn; you are woken when it is added, and then you carry on.
-
-**Research before you offer, and say so.** Never offer a tool you cannot describe. If someone asks you to install or add something you do not already know - by name, by purpose, or by what it will hold - say plainly that you are looking it up first, find out what it is and what it does with credentials, and state what you learned in your reply BEFORE the card appears. A person reading "Add X?" must already have read, in your own words, what X is. Refusing to act blind is part of being trusted with keys.
-
-An offer is setup, never authority: it does not replace a grant, write permission, target-branch confirmation, or the merge gate, and it never needs a raw credential in chat. You never pair a tool yourself and never ask anyone for a key value; once a tool is added, provisioning happens inside it and receipts reach the person through the tool's own status message.
-
-Keys belong to the human who provisioned them. Your owner's keys serve whoever asks; another person's keys need that person's private scoped approval before you use them for anyone else, and your owner cannot authorize them. Use the connector without exposing or sharing raw keys. The Workbench page remains the place a person manages tools and keys by hand (Settings \u2192 Workbench); you point there to MANAGE what exists, not to add what you need.
-
-## Connect an app
-
-When a request needs an app or service, call beeline-agent \`workbench_status\` first. For a connected app via composio, use its ID with \`list_app_tools\`, then call \`execute_app_tool\` with the selected tool slug and arguments. For an app via squire-api, call its API with \`use_credential\` (service = the app key); via squire-browser, use the \`operate_*\` tools; via registry-mcp, use its mounted MCP tools. The server executes against that person\u2019s account and decides permission on every call. If tool discovery reports an error, follow its cause; \`needs_connection\` means the account must be reconnected, and \`needs_permission\` means wait for the connected person's decision. Do not switch paths after denial or provider unavailability. No app token, provider key, or sign-in URL belongs in chat or a model prompt.
-
-For an app that is not connected, call \`connect_app\` with its name, one short reason, and a request-specific \`continuation\`: one sentence stating what you will do right after sign-in. Do not include a link, credential, account identifier, or private data in that sentence. The server chooses the route and returns \`next\`. In a corner, call it from that corner so the sign-in card and connection wake return there. A managed OAuth app presents a sign-in card to its owner; end the turn and wait for the connection wake. If the provider reports managed OAuth unsupported, follow the server's Squire route and its instructions. A provider outage is unavailable, not permission to change routes. After the person connects, read Workbench again and use the app ID. Every use is authorized as \`app:<key>\` and recorded once.
-
-## Showing a mock
-
-When a design decision needs eyes, show it instead of describing it. Build ONE self-contained HTML page and post it with beeline-agent post_artifact (mime "text/html", pass the document as html). Everything is inline: a single <style> element for all CSS and data: URLs for any image - no script, no external dependencies, no network references. The validator refuses every <script>, <link>, <iframe>, <object>, <embed>, <form>, inline event handler, and http(s) URL, so a page that reaches for the network never posts. Use the Obsidian Refined tokens: grayscale surfaces, one brass accent #d7af5f, 3px radii, IBM Plex Sans/Mono type. Lay the user stories out as frames - one bordered, labelled block per story, so each story can be judged on its own. After posting, ask for feedback here in the corner: the artifact is the thing people react to, not your prose.
-
-## Showing a photograph
-
-When the mock needs a real product photo, do not draw an SVG stand-in. Call beeline-agent fetch_image with the photo's http(s) URL. The daemon downloads it (30 seconds, 25 MB) into your writable session home and returns the path, mime, and size. Read those bytes, base64-encode them, and put them in the HTML as a data: URL (\`<img src="data:image/jpeg;base64,\u2026">\`). Then post_artifact as usual. The validator still refuses every http(s) image reference \u2014 the photograph has to be inline. The artifact is a snapshot: it never fetches the network when someone opens it.
-`;
-}
-function beelineReviewSkillMarkdown(releaseId) {
-  return `---
-name: beeline-review
-description: Review a corner pull request against the brief's outline, the approval quote, and the Beeline merge gate.
----
-
-<!-- beeline-release: ${releaseId} -->
-
-# Beeline pull-request review
-
-Follow these steps in order. Do not skip or reorder them.
-
-## 1. Isolate the revision
-
-- Run \`gh pr view N --json headRefOid,files\` and record \`headRefOid\`.
-- Run \`gh pr diff N\`.
-- Review the objective, files, and complete PR diff before making another working copy.
-- Check out that exact head only when an empirical command must read or run the tree. Never use the author's worktree.
-- When a checkout is needed, create a temporary detached worktree, install an EXIT trap that removes it with \`git worktree remove --force\` and deletes its temporary directory, and run every command there. Cleanup is mandatory on PASS, FAIL, and command error.
-- For a deterministic one-shot bootstrap use \`npm run review:exact-head -- <sha> [--typecheck <pkg> \u2026] [--] <pkg>:<glob> \u2026\`: it checks that exact head out, runs \`npm ci\`, builds the workspace package exports, runs the given typechecks and targeted tests with non-interactive PASS/FAIL summaries, and removes the worktree itself (pass \`--keep\` to keep it and print the removal command).
-- Review and test only the recorded revision. If the head moves, clean up the scratch worktree and start over.
-
-## 2. P0 - OUTLINE FULFILLED, DEMONSTRATED
-
-Read the server-assigned brief and its current revision, including every required file. Quote the approval with its message ID and approver before considering the short objective. The spec's outline (user stories, acceptance criteria, non-goals, risks) is the scope, and the approval quote is the human's own words: it wins any conflict with the spec. The short objective is navigation-only text and the PR description cannot add, remove, or narrow scope. A revision with no recorded approval is reviewed against its spec alone. If a required file is unavailable, or the revision changes during review, refuse approval and describe what is missing. A requirement may become out of scope only through a new human-authorized brief revision; reviewer discretion, implementation difficulty, and silence never remove it. A passing narrow test does not prove a broader requirement. Review a deliberate human choice as written, even if it is unusual.
-
-Before general correctness, produce an outline ledger in spec order: list every \`## User stories\` and \`## Acceptance criteria\` line exactly once as met, unmet, unverified, or out of scope, followed by concrete evidence (for a criterion, the named test run against the PR head) - no stories to list is a FAIL, sent back to the author to write the outline; confirm nothing under \`## Non-goals\` was done; confirm every \`## Risks\` line was addressed or explicitly accepted with a stated reason. For a frontend change, open the rendered screens and compare them against the attached mock, noting every visible deviation. Any missing, unmet, unverified story or acceptance criterion, done non-goal, unaddressed risk, or unreviewed mock mismatch blocks PASS. Out of scope is valid only when the current revision itself records the human-authorized removal.
-
-Before judging the implementation, independently repeat the two judgment legs from request triage:
-
-- **Work warranted:** For a bug, reproduce the reported behavior on the target branch. For another request, establish the unmet user need from the request and current product. Search current code, history, issues, and open or recently merged pull requests for work that already resolves or supersedes it. Treat title similarity only as a candidate, not proof of duplication. FAIL confirmed duplicate or obsolete work.
-- **Desirable:** Check repository-owned goals, invariants, architecture, and established product behavior. Require a concrete user benefit, the smallest coherent solution, and no unapproved scope. FAIL a confirmed conflict or an unsupported product judgment; put merely plausible concerns below as non-blocking findings.
-
-- Quote the approval text, with its message ID, exactly as stored. Do not quote the short objective as product truth.
-- Derive the end-user story from the spec and the approval quote in one sentence: \`a user who does X sees Y\`.
-- Make Y happen against the built PR head: run the app or affected service and perform X.
-- If no interactive surface is reachable, run the narrowest test or script that exercises the exact user path and prints the observable Y.
-- Record the command and the observed Y.
-- A unit test of an inner function, a log line, \`the code looks right\`, or any other proxy does not count.
-- If the user-visible Y cannot be produced, FAIL now. Nothing below can rescue the review.
-- For a bug, if a \`Reproduction <id>\` was recorded, quote it, re-run that exact user path on the PR head, and record that the wrong result is gone. FAIL if that proof does not name the identifier, even when other tests pass. If none was obtained, require the proof to say so plainly and show the regression instead; do not fail the review for a missing identifier.
-- State whether the diff meets every user story and the approval quote without unapproved scope.
-
-## 3. Empirical pass second
-
-Build one visible validation record for the brief revision and code head. Assess intent, base synchronization, independent review, tests, documentation, lint and types, publication, CI, and final Beeline authorization. Each applicable stage is pending, running, passed, failed, skipped, or not applicable, with a reason for the last two. A required skipped, failed, or unverified stage blocks PASS. An empty rollup alone is not proof of passing checks. Use pr_checks_status for the exact current head: checks="passed" with checkCount=0 is the server-confirmed no-checks path and satisfies the CI prerequisite for review. Do not refuse review because no literal green check exists, and do not require mergeAllowed=true before reviewing: the missing reviewer PASS itself keeps that gate closed. Pending, failed, or unknown checks still block approval. Reuse valid author evidence; run targeted independent checks where needed. A screenshot or rendered app is needed for visual claims, and server-boundary behavior for authorization claims.
-Use record_validation_stage for each assessed stage, naming the current brief revision and exact PR head.
-${VALIDATION_STAGE_OWNERSHIP}
-The record informs the verdict but never replaces approve_merge or pr_checks_status.
-
-- Run the repository typecheck and tests touched by the diff.
-- If the spec or the approval quote names a user path, exercise that path.
-- Record every command and exit code.
-- A review with no executed command is invalid and must FAIL.
-
-### Design rules
-
-When the diff touches UI and the repository has a DESIGN.md, check every changed style against its rules: colours from theme tokens only, the type roles, the spacing scale, the allowed radii, elevation, the shared components, and touch targets.
-
-- Run the repository's design lints. In Beeline, from \`apps/mobile\`: \`npx vitest run sources/buzz/calm-lint sources/buzz/design-lint\`.
-- FAIL when a design baseline count grows, or when an allowlist entry is added without naming the design decision behind it.
-- Require a screenshot or rendered proof of every visual change in each theme the app ships (in Beeline, Obsidian and Bone).
-- A design-rule violation is an engineering finding and blocks PASS.
-
-## 4. Adversarial pass
-
-- For every changed function, name one concrete input or sequence that breaks it.
-- If none is found, write \`none found\` for that function.
-
-## 5. Verify before reporting
-
-- Confirm every finding by reading the exact line or by running a command.
-- Put unconfirmed concerns under plausible findings. They never block.
-
-## 6. Bloat guard
-
-- Compare net lines with the spec, its user stories and non-goals, and the approval quote.
-- FAIL backwards-compatibility shims, dual paths, feature flags, or abstractions with one caller.
-- FAIL machinery the spec and the approval quote did not ask for.
-
-## 7. Security and data
-
-- Check credentials, authorization boundaries, and destructive migrations.
-
-## 8. Gate and verdict
-
-- Review the exact green head named in your reviewer instruction; a server-confirmed zero-check passed head counts as green. If the head moved, do not approve it.
-- Re-read the assigned brief revision before the verdict. A repair changes the head and invalidates affected evidence; a requirement correction invalidates the relevant verdict even if code did not change. Keep product-completeness findings (a missing or contradicted user story, done non-goal, unaddressed risk, mock mismatch, or approval quote) separate from engineering findings (correctness, security, maintainability, tests). Give every confirmed finding a stable ID that survives rereview, the affected outline line or \`engineering\`, location, severity, evidence, and repair disposition. Reuse the same ID until that finding is resolved. Mechanical repairs return to the author; ask a human only for a genuinely unresolved product choice. Do not run a nested validation pipeline or push the author's branch.
-- Always use this exact verdict shape:
-
-\`approval quoted with its message ID:\`
-\`user story:\`
-\`work warranted evidence:\`
-\`desirability evidence:\`
-\`reproduction id (or none obtained):\`
-\`proof of that reproduction (or none obtained + regression):\`
-\`how Y was demonstrated (or FAIL):\`
-\`commands run + results:\`
-\`brief revision:\`
-\`outline ledger (every user story, acceptance criterion, non-goal and risk + status + evidence; mock-vs-screen notes for frontend work):\`
-\`validation stages and evidence:\`
-\`product-completeness findings (block):\`
-\`engineering findings (block):\`
-\`plausible findings (do not block):\`
-\`net lines:\`
-\`decision: PASS|FAIL\`
-
-Then take exactly one action:
-
-- FAIL: call \`record_validation_stage\` with stage \`review\`, status \`failed\`, and the reviewed head SHA, then reply \`@author\` with the confirmed findings and that reviewed head SHA to fix. The recorded review stage is how an implementer who has already fixed the findings can tell whether the review is stale.
-- PASS: call \`approve_merge\` with the reviewed head SHA and assigned briefRevision (omit the revision only for a legacy corner without a brief), then reply \`approved <reviewed sha>\` without tagging the author. Do not tell the author to merge.
-- A human's question or proposal in the corner discussion with no answer is a blocking finding: FAIL and name it.
-- Approving is your last step as reviewer. Your PASS wakes the author, who merges that exact head with \`merge_corner\` once checks are green, the worker's yolo is on, and no human hold stands. You never merge it yourself.
-`;
-}
-function beelineSpecSkillMarkdown(releaseId) {
-  return `---
-name: beeline-spec
-description: Prepare or revise a durable corner assignment from Room decisions before repository work. Do not use for ordinary conversation or unrelated artifact delivery.
----
-
-<!-- beeline-release: ${releaseId} -->
-
-# Durable corner brief
-
-Create an assignment a fresh session can execute without the parent transcript. A brief has three parts:
-
-- \`spec\`: one Markdown doc you write, with these headings:
-  - \`## Intent\`: the human's own words, quoted exactly, each with its Room message ID. Never substitute a summary.
-  - \`## User stories\`: what this enables, one per line as "a person who does X sees Y". Only stories traceable to the quoted Intent; never import a plan, a teammate's suggestion, or your own idea as a story. Keep unaffected lines as they are across revisions.
-  - \`## Acceptance criteria\`: the requester's own rules from \`## Intent\`, quoted verbatim and numbered, each naming the test (existing or to be written) that fails if the rule is broken anywhere. Criteria are the invariant; stories are examples of it. Write "None beyond the stories." when the request states no rule.
-  - \`## Non-goals\`: explicit exclusions.
-  - \`## Risks\`: what could go wrong, and for whom.
-  - \`## References\`: each reference or mock with what it is and whose call it is; the mock posted here (DESIGN.md, else existing app styles) is the reviewer's acceptance reference, not any other optional or agent-generated mock.
-  Add implementation guidance under further headings when it helps.
-- files (\`attachments\`): the Room files the worker needs, each with its purpose and whether it is required.
-- \`approval\`: one human Room message ID. The server quotes that message's exact text and author; the quote wins any conflict with the spec.
-
-Do not infer approval from silence, assent to different prose, or the mere existence of a plan. Keep agent recommendations labelled as recommendations. Do not promote a plausible UX detail, algorithm, failure message, or extra test into a user story merely because it sounds helpful.
-
-## Compact path for a settled small fix
-
-Use this when the requested behavior, touched surface, exclusions, and proof are already obvious. Inspect the narrow current behavior, write a short spec (quoted intent, observable user stories, non-goals, risks, references), and use the initiating command as the approval. Always compose the full outline and post it to the Room before calling open_corner, even when the initiating command already settles scope and stands as the approval: posting is not optional merely because approval is inferred, since the human must be able to see what you are about to build. \u201CChange the message action label from Remove to Delete; leave confirmation and accessibility wording unchanged\u201D needs the visible-label user story and both exclusions, not another confirmation question.
-
-## Complex-work planning loop
-
-Use this default-on loop when work crosses components, changes architecture or authorization, needs a visual choice, has multiple user stories, or still contains a material unknown.
-
-### 1. Scope and current state
-
-- Collect every relevant human message, including corrections; later corrections supersede only what they explicitly change. Quote their exact text and IDs under \`## Intent\`.
-- Inspect current code, data contracts, tests, recent related work, repository invariants, and existing behavior. State what exists, what is missing, and what is deliberately out of scope.
-- Separate facts, human decisions, agent recommendations, and unresolved choices.
-
-### 2. User stories and product boundary
-
-- Write the actor/action/observable-result stories.
-- Map each story to its own observable line and explicit non-goals.
-- If one unresolved choice would materially change behavior, scope, irreversible effects, or the intended result, present only that choice or the affected brief slice to the human. Use the answering message as the \`approval\`. Never treat no answer as approval.
-
-### 3. Architecture and data flow
-
-- Trace inputs, authorities, state transitions, persistence, outputs, and trust boundaries.
-- Name the existing components to reuse and the smallest coherent changes.
-- Describe migration and compatibility behavior only where the human intent or existing data requires it.
-
-### 4. Failure modes and test map
-
-- Enumerate missing/stale data, retries, concurrency, partial failure, authorization failure, rollback, and boundary-specific hazards that apply.
-- Map every user story to its proof boundary: unit, integration, device/browser, server authorization, migration, or live harness. No story may be left without planned evidence.
-
-### 5. Mocks and references
-
-- When a visual or interaction decision needs eyes, create and post one self-contained mock using the using-beeline mock procedure.
-- A mock/file posted with \`post_artifact\` in this planning turn is added automatically to the brief attachment manifest; do not manually copy its object ID. Still list it under \`## References\` with whose call it is. Existing human-posted files must be named explicitly in attachments.
-
-### 6. Implementation tasks
-
-- Synthesize ordered, independently verifiable tasks. For each task name the affected boundary, user stories, expected files/components, failure handling, and proof.
-- Keep the spec actionable, not a transcript summary.
-
-### 7. Bounded adversarial second read (default on)
-
-- Spend one pass, bounded to the drafted scope, trying to disprove completeness: find a missing story, authority mismatch, unhandled failure, user story without proof, mock ambiguity, accidental scope expansion, or task-order hazard.
-- Return findings to the planning agent and repair the draft. Escalate only a genuinely material product choice to the human; engineering choices and mechanical gaps are resolved in the plan.
-- End after one adversarial pass unless its repair exposes one new material product choice. Do not recursively review the review.
-
-## Dispatch and revision
-
-Existing authorization permits dispatch when the initiating command already settles the exact material scope; that command is the approval, but the outline is still posted to the Room first so the human can see it before open_corner runs. Drafting a brief does not create approval. When the scope was not already explicit, post the spec and ask the corner's opener to approve it, then use their reply as the \`approval\`. Honor an explicit request to review first.
-
-Pass the brief as \`open_corner.brief\`. Read the current revision before revising and use \`revise_corner_brief\` with the complete replacement spec, the approving message, and a concise change description. Preserve unaffected intent quotes, user stories, and references. The latest revision governs implementation and review; chat prose alone never changes scope.
-`;
-}
-function beelineTriageSkillMarkdown(releaseId) {
-  return `---
-name: beeline-triage
-description: Clarify and assess a user request before opening a Beeline corner, then bind a bugfix to its recorded reproduction. Use before open_corner and while implementing a bug in a corner.
----
-
-<!-- beeline-release: ${releaseId} -->
-
-# Beeline request triage
-
-Run these checks before opening a corner.
-
-## 1. Is it clear?
-
-- Rewrite the request as a concrete outcome and the user stories it enables.
-- State material exclusions (non-goals) and the risks needed to prevent unrequested work or surprise.
-- Keep the corner objective complete and within 24 words.
-- First ask whether the request has any material ambiguity - one that would change scope, behavior, or risk - and resolve it with the human before doing anything else; never resolve it by adopting a teammate's plan, a prior document, or your own assumption.
-- Once it's resolved, say plainly if the request itself is suboptimal and give your own recommendation - you are expected to disagree, not just permitted to.
-- On a judgment call you're still not sure of, tag a Room colleague for an adversarial second opinion and ask them to reply tagging you back; skip this only when you are the only agent in the Room.
-
-## 2. Is work warranted?
-
-- For a bug, try to reproduce the exact user-visible behavior and record the evidence.
-- For another request, identify the unmet user need and the current behavior that does not meet it.
-- Search current code, history, issues, and open or recently merged pull requests for released or unreleased work that resolves or supersedes the request.
-- Treat similar titles as candidates. Confirm behavior and scope before calling work duplicate.
-- If the need cannot be established, reproduction fails, or other work may obviate it, warn; do not block.
-
-## 3. Is it desirable?
-
-- Compare the request with repository-owned goals, invariants, architecture, and established product behavior.
-- Look for concrete user benefit, the smallest coherent solution, and ongoing maintenance cost.
-- Do not invent product strategy. If the evidence is absent or conflicting, warn; do not block.
-
-## Output
-
-When dispatching work, pass the complete brief to open_corner under existing authorization, after posting the outline as beeline-spec requires. Add applicable warnings to the brief:
-
-\`Triage warning \u2014 warranted: <evidence-backed reason>\`
-\`Triage warning \u2014 desirable: <evidence-backed reason>\`
-
-When a bug reproduction succeeds, also emit:
-
-\`Reproduction <id>: <user path> \u2192 <observable wrong result>\`
-
-Do not emit a warning merely because evidence is incomplete when the repository offers no practical way to obtain it. Never describe a warning as approval or rejection. Warnings inform the user and implementer; they do not block work.
-
-## Bugfix execution
-
-Once a corner is open for a reported bug, follow these steps in order. They are instruction, not a server gate. They do not condition the fix on reproduction. Warranted-work and desirability warnings still do not block.
-
-### 1. Attempt to reproduce
-
-- Attempt to reproduce the bug as triage isolated it, using every tool the host offers: emulator, Playwright, browser, test runner.
-- Record what was tried and what was observed.
-- If a reproduction is obtained, record the exact user path and the observable wrong result under \`Reproduction <id>\`. Reuse the identifier triage emitted when it recorded one.
-- If reproduction fails, warn and continue exactly as triage already does. Never stop. Never condition the fix on reproduction.
-
-### 2. Narrow fix
-
-- Narrow the fix to the reported behavior.
-- When a reproduction exists, change only what removes that recorded reproduction.
-- Nearby improvements stay out of scope.
-
-### 3. Proof matching triage
-
-- When a reproduction exists, re-run it, cite the same identifier, and show it now passing, plus the regression that would fail if the bug returned.
-- When none was obtained, state that plainly and show the regression instead.
-- Name the identifier in the pull request when one exists so the reviewer can check that proof, not merely that some test exists.
-`;
-}
-
-// apps/body/dist/external-mcp-capabilities.js
-var SQUIRE_MCP_VERSION = "latest";
-var SQUIRE_MCP_PACKAGE = `@trusty-squire/mcp@${SQUIRE_MCP_VERSION}`;
-function isTrustySquireMcpLaunch(command, args = []) {
-  return [command, ...args].some((value) => {
-    const normalized = value.trim().replace(/\\/g, "/").toLowerCase();
-    return /(^|[\s/="'\[,])@trusty-squire\/mcp(?:@[^\s/"'\],}]+)?(?=$|[\s/"'\],}])/i.test(normalized) || /(^|\/)trusty-squire(?:-mcp)?(?:\.[a-z0-9]+)?$/i.test(normalized);
-  });
-}
-var SQUIRE_GOVERNED_TOOLS = [
-  "use_credential",
-  "grant_app_access",
-  "revoke_app_access"
-];
-var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
-
-// apps/body/dist/host-mcp-route.js
-import { join as join11, resolve as resolve14 } from "node:path";
-var import_yaml = __toESM(require_dist(), 1);
-init_squire_host();
-function grantedMcpServerNames(grants) {
-  const names = /* @__PURE__ */ new Set();
-  for (const grant of grants ?? []) {
-    if (grant.kind !== "mcp")
-      continue;
-    const name = grant.target.trim();
-    if (name)
-      names.add(name);
-  }
-  return [...names];
-}
-function ungatedHostServers(hostServers, granted) {
-  const allowed = new Set(granted);
-  return hostServers.filter((name) => !allowed.has(name));
-}
-async function claimGrantedHostRoutes(result) {
-  if (!result || typeof result !== "object" || !("grants" in result))
-    return [];
-  const grants = result.grants;
-  if (!Array.isArray(grants))
-    return [];
-  return grantedMcpServerNames(grants.flatMap((entry) => {
-    if (!entry || typeof entry !== "object")
-      return [];
-    const grant = entry;
-    return grant.kind === "mcp" && typeof grant.target === "string" && (grant.status === "once" || grant.status === "approved") ? [{ kind: "mcp", target: grant.target }] : [];
-  }));
-}
-function recordValue(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function stringArray(value) {
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : [];
+function stringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : [];
 }
 function isSquireDeclaration(name, declaration) {
   if (isCodeOwnedHostMcpName(name))
@@ -34896,7 +34246,7 @@ async function materializedSkillManifest(target) {
   return lines.sort().join("\n");
 }
 function sha2563(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 async function resolveSharedSkillSources(operatorHome, names) {
   if (names.length > 0)
@@ -35076,7 +34426,7 @@ async function writeIsolatedHarnessFile(path, content) {
   }
 }
 function roomSessionTmpDir(root, base = "/tmp") {
-  const hash = createHash8("sha256").update(resolve16(root)).digest("hex").slice(0, 12);
+  const hash = createHash7("sha256").update(resolve16(root)).digest("hex").slice(0, 12);
   return join12(base, `beeline-${hash}`);
 }
 function roomAgentHomeEnv(root) {
@@ -36553,7 +35903,7 @@ var DEFAULT_UPDATE_INTERVAL_MS = 3e4;
 var UPDATE_DRAIN_DEADLINE_MS = UPDATE_CONVERGENCE_SLO_MS - 15e4;
 var MAX_HOST_RESTART_STAGGER_MS = 15e3;
 function managedRestartStaggerMs(agentId, desiredRelease, drainDeadlineAt, now2 = Date.now()) {
-  const digest = createHash9("sha256").update(agentId).update("\0").update(desiredRelease).digest();
+  const digest = createHash8("sha256").update(agentId).update("\0").update(desiredRelease).digest();
   const spread = digest.readUInt32BE(0) % (MAX_HOST_RESTART_STAGGER_MS + 1);
   return Math.min(spread, Math.max(0, drainDeadlineAt - now2));
 }
@@ -37442,7 +36792,7 @@ async function runStartCommand(args, interactiveUi, dependencyOverrides = {}) {
 
 // apps/body/dist/connect-command.js
 import { spawn as spawn13 } from "node:child_process";
-import { createHash as createHash10, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID7 } from "node:crypto";
 import { chmod as chmod7, mkdir as mkdir16, readFile as readFile20, unlink as unlink7, writeFile as writeFile13 } from "node:fs/promises";
 import { homedir as homedir15, hostname } from "node:os";
 import { dirname as dirname19, resolve as resolve26 } from "node:path";
@@ -38512,7 +37862,7 @@ async function readMachineId(env = process.env) {
       await writeFile13(machineIdPath, `${machineId}
 `, { mode: 384 });
     } catch {
-      machineId = createHash10("sha256").update(machineName).digest("hex").slice(0, 36);
+      machineId = createHash9("sha256").update(machineName).digest("hex").slice(0, 36);
     }
   }
   return { machineId, machineName };
@@ -38521,7 +37871,7 @@ function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl, machine
   const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
   if (!normalizedPairingCode)
     throw new Error("invalid pairing code");
-  const avatarSeed = createHash10("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
+  const avatarSeed = createHash9("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
   return jsonRequest(`${baseUrl}/auth/agent/connect`, {
     pairing_code: normalizedPairingCode,
     harness: selection.harness,
@@ -38992,13 +38342,13 @@ async function applyRuntimeModelPreflight(config, agent, selection, validate = v
 }
 
 // apps/body/dist/model-catalog-sync.js
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { readFile as readFile21, writeFile as writeFile14 } from "node:fs/promises";
 import { resolve as resolve27 } from "node:path";
 var MODEL_CATALOG_PROBE_TIMEOUT_MS = 3e4;
 var MODEL_CATALOG_HASH_FILE = "model-catalog.sha256";
 function modelCatalogHash(options, selection, startupUnavailable) {
-  return createHash11("sha256").update(JSON.stringify({
+  return createHash10("sha256").update(JSON.stringify({
     options,
     selection: selection ?? null,
     startupUnavailable: startupUnavailable ?? null
@@ -39629,7 +38979,7 @@ function describe2(error) {
 
 // apps/body/dist/room-runtime.js
 import { execFile as execFile13 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3 } from "node:fs";
 import { mkdir as mkdir27, readdir as readdir9, realpath as realpath2, rm as rm15 } from "node:fs/promises";
 import { dirname as dirname27, relative as relative3, resolve as resolve38, sep as sep2 } from "node:path";
@@ -39637,7 +38987,7 @@ import { promisify as promisify8 } from "node:util";
 
 // apps/body/dist/grant-runner.js
 import { execFile as execFile8 } from "node:child_process";
-import { createHash as createHash12, randomBytes as randomBytes9, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash11, randomBytes as randomBytes9, randomUUID as randomUUID9 } from "node:crypto";
 import { chmod as chmod8, mkdir as mkdir17, readFile as readFile22, readdir as readdir6, rename as rename9, rm as rm11, rmdir, stat as stat7, writeFile as writeFile15 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
 import { dirname as dirname21, resolve as resolve28 } from "node:path";
@@ -39902,7 +39252,7 @@ ${ROOM_WRITE_REFUSED_NOTE}` : outcome.output, secrets), cap);
     if (!script || script.path !== argument.path) {
       throw new Error(`${argument.path} is a script no human has read: this grant was approved without it. Ask with request_grant kind=command so the card carries what the command runs.`);
     }
-    if (createHash12("sha256").update(bytes).digest("hex") !== script.sha256) {
+    if (createHash11("sha256").update(bytes).digest("hex") !== script.sha256) {
       throw new Error(`${argument.path} changed after it was approved, so the approval no longer covers it. Ask with request_grant kind=command again so a human reads what runs now.`);
     }
   }
@@ -40492,7 +39842,7 @@ async function runServerCommandIntake(options) {
 
 // apps/body/dist/monolith-corner-turn.js
 import { execFile as execFile12 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { existsSync as existsSync9 } from "node:fs";
 import { mkdir as mkdir26, readFile as readFile30, writeFile as writeFile20 } from "node:fs/promises";
 import { homedir as homedir18, hostname as hostname3 } from "node:os";
@@ -41606,361 +40956,1038 @@ function shellPayload(toolCall) {
   const rawInput = toolCall?.rawInput;
   if (typeof rawInput === "string")
     return true;
-  if (!rawInput || typeof rawInput !== "object" || Array.isArray(rawInput))
+  if (!rawInput || typeof rawInput !== "object" || Array.isArray(rawInput))
+    return false;
+  const record5 = rawInput;
+  return typeof record5.command === "string" || typeof record5.cmd === "string";
+}
+var ROOM_MOUNTED_MCP_SERVERS = [
+  READ_ONLY_MCP_SERVER_NAME,
+  BEELINE_AGENT_MCP_SERVER_NAME
+];
+var DISPATCHER_TOOL_NAME_KEYS = ["tool_name", "toolName"];
+var DISPATCHER_TOOL_INPUT_KEYS = ["tool_input", "toolInput"];
+var TOOL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+function permissionRecord(rawInput) {
+  return rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput : void 0;
+}
+function dispatchedPayloadIsShell(record5) {
+  if (!record5)
+    return false;
+  return DISPATCHER_TOOL_INPUT_KEYS.some((key) => key in record5 && shellPayload({ rawInput: record5[key] }));
+}
+function toolIdentityCandidates(toolCall) {
+  const candidates = [];
+  const add = (value) => {
+    if (typeof value === "string" && value.trim())
+      candidates.push(value.trim());
+  };
+  add(toolCall?.title);
+  const record5 = permissionRecord(toolCall?.rawInput);
+  for (const key of DISPATCHER_TOOL_NAME_KEYS)
+    add(record5?.[key]);
+  return candidates;
+}
+function normalizedServerName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+}
+function resolveMountedMcpToolCall(request, mountedServers) {
+  const toolCall = request.toolCall;
+  if (shellPayload(toolCall))
+    return void 0;
+  const record5 = permissionRecord(toolCall?.rawInput);
+  if (dispatchedPayloadIsShell(record5))
+    return void 0;
+  const candidates = toolIdentityCandidates(toolCall);
+  for (const server of mountedServers) {
+    const spellings = /* @__PURE__ */ new Set([server.toLowerCase(), normalizedServerName(server)]);
+    for (const candidate of candidates) {
+      const lowered = candidate.toLowerCase();
+      for (const spelling of spellings) {
+        for (const separator of TOOL_NAME_SEPARATORS) {
+          const prefix = `${spelling}${separator}`;
+          if (!lowered.startsWith(prefix))
+            continue;
+          const tool = candidate.slice(prefix.length).trim();
+          if (TOOL_NAME_PATTERN.test(tool))
+            return { server, tool };
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function isReadOnlyMcpPermissionRequest(request) {
+  const toolCall = request.toolCall;
+  const title = toolCall?.title?.trim() ?? "";
+  const rawInput = toolCall?.rawInput;
+  const mcpCall = Boolean(rawInput) && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput : void 0;
+  if (mcpCall?.server === READ_ONLY_MCP_SERVER_NAME && typeof mcpCall.tool === "string" && READ_ONLY_TOOL_SET.has(mcpCall.tool)) {
+    return true;
+  }
+  if (shellPayload(toolCall))
+    return false;
+  if (READ_ONLY_PERMISSION_TITLES.has(title))
+    return true;
+  if (READ_ONLY_SERVER_TITLE_PREFIXES.some((prefix) => title.startsWith(prefix))) {
+    for (const tool of READ_ONLY_TOOL_NAMES) {
+      if (title === tool || title.endsWith(`(${tool})`) || TOOL_NAME_SEPARATORS.some((separator) => title.endsWith(`${separator}${tool}`))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function isMountedMcpToolPermissionRequest(request, mountedServers = ROOM_MOUNTED_MCP_SERVERS) {
+  const toolCall = request.toolCall;
+  const rawInput = toolCall?.rawInput;
+  if (dispatchedPayloadIsShell(permissionRecord(rawInput)))
+    return false;
+  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
+    const call = rawInput;
+    if (typeof call.server === "string" && typeof call.tool === "string")
+      return true;
+  }
+  if (shellPayload(toolCall))
+    return false;
+  const title = toolCall?.title?.trim() ?? "";
+  if (/^mcp__[^_].*__[^_]/.test(title))
+    return true;
+  if (/^mcp\.[^.]+\.[^.]/.test(title))
+    return true;
+  if (resolveMountedMcpToolCall(request, mountedServers))
+    return true;
+  return isReadOnlyMcpPermissionRequest(request) || isBeelineAgentMcpPermissionRequest(request);
+}
+var AGENT_SURFACE_TOOL_NAMES = [
+  "get_avatar",
+  "set_avatar",
+  "open_corner",
+  "pr_checks_status",
+  "post_artifact",
+  "write_scratch_file",
+  "fetch_image",
+  "connect_app"
+];
+function isHostMcpPermissionRequest(request, hostServers = CODE_OWNED_HOST_MCP_NAMES) {
+  const rawInput = request.toolCall?.rawInput;
+  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
+    const server = rawInput.server;
+    if (typeof server === "string" && isHostMcpIdentity(server, hostServers))
+      return true;
+  }
+  return toolIdentityCandidates(request.toolCall).some((candidate) => isHostMcpIdentity(candidate, hostServers));
+}
+function isBeelineAgentMcpPermissionRequest(request) {
+  const toolCall = request.toolCall;
+  const title = toolCall?.title?.trim() ?? "";
+  const rawInput = toolCall?.rawInput;
+  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
+    const call = rawInput;
+    if (call.server === BEELINE_AGENT_MCP_SERVER_NAME && typeof call.tool === "string" && AGENT_SURFACE_TOOL_NAMES.includes(call.tool)) {
+      return true;
+    }
+  }
+  if (shellPayload(toolCall))
+    return false;
+  const normalized = BEELINE_AGENT_MCP_SERVER_NAME.replaceAll("-", "_");
+  return AGENT_SURFACE_TOOL_NAMES.flatMap((tool) => [
+    `mcp__${BEELINE_AGENT_MCP_SERVER_NAME}__${tool}`,
+    `mcp__${normalized}__${tool}`,
+    `mcp.${BEELINE_AGENT_MCP_SERVER_NAME}.${tool}`
+  ]).includes(title);
+}
+function isMcpShapedPermissionRequest(request, hostServers = CODE_OWNED_HOST_MCP_NAMES) {
+  if (isHostMcpPermissionRequest(request, hostServers))
+    return true;
+  const record5 = permissionRecord(request.toolCall?.rawInput);
+  if (typeof record5?.server === "string")
+    return true;
+  if (DISPATCHER_TOOL_NAME_KEYS.some((key) => typeof record5?.[key] === "string"))
+    return true;
+  const title = request.toolCall?.title?.trim() ?? "";
+  return /^mcp__[^_].*__[^_]/.test(title) || /^mcp\.[^.]+\.[^.]/.test(title);
+}
+
+// apps/body/dist/room-session.js
+var ReadOnlyToolsUnavailableError = class extends Error {
+  name = "ReadOnlyToolsUnavailableError";
+};
+function beelineAgentMcpServer(config, api, context) {
+  if (!config.readonlyMcpCommand) {
+    throw new ReadOnlyToolsUnavailableError("agent tools unavailable: the Beeline MCP command is required");
+  }
+  const connection = api.connection();
+  return {
+    name: BEELINE_AGENT_MCP_SERVER_NAME,
+    command: config.readonlyMcpCommand,
+    args: [...config.readonlyMcpArgs ?? []],
+    env: [
+      { name: "BEELINE_MCP_SURFACE", value: "agent" },
+      ...context.turnContextPath ? [{ name: "BEELINE_TURN_CONTEXT_FILE", value: context.turnContextPath }] : [],
+      ...context.directMessage ? [{ name: "BEELINE_AGENT_DM", value: "1" }] : [],
+      ...context.squireRelay ? [
+        { name: "BEELINE_SQUIRE_RELAY_URL", value: context.squireRelay.url },
+        { name: "BEELINE_SQUIRE_RELAY_TOKEN", value: context.squireRelay.token }
+      ] : [],
+      { name: "BEELINE_DAEMON_BASE_URL", value: connection.baseUrl },
+      { name: "BEELINE_DAEMON_TOKEN", value: connection.daemonToken },
+      { name: "BEELINE_HELPER_VERSION", value: connection.helperVersion },
+      { name: "BEELINE_DAEMON_AGENT_ID", value: connection.agentId },
+      { name: "BEELINE_OPERATOR_HOME", value: config.operatorHome ?? homedir16() },
+      { name: "BEELINE_DAEMON_ROOM_ID", value: context.roomId },
+      { name: "BEELINE_DAEMON_WORKSPACE_ID", value: context.workspaceId },
+      ...context.cornerId ? [{ name: "BEELINE_DAEMON_CORNER_ID", value: context.cornerId }] : [],
+      ...context.agentMayCloseCorner ? [{ name: "BEELINE_CORNER_AGENT_CLOSE", value: "1" }] : [],
+      ...context.reviewer ? [{ name: "BEELINE_CORNER_REVIEWER", value: "1" }] : [],
+      ...context.cornerId && context.repositoryBacked ? [{ name: "BEELINE_CORNER_REPOSITORY", value: "1" }] : [],
+      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : [],
+      ...context.attachScratchRoot ? [{ name: "BEELINE_ATTACH_SCRATCH_ROOT", value: context.attachScratchRoot }] : [],
+      ...context.grantRunner ? [
+        { name: "BEELINE_GRANT_RUNNER_URL", value: context.grantRunner.url },
+        { name: "BEELINE_GRANT_RUNNER_TOKEN", value: context.grantRunner.token }
+      ] : []
+    ]
+  };
+}
+function readOnlyMcpServer(config, cwd, agentMemoryDir) {
+  if (!config.readonlyMcpCommand) {
+    throw new ReadOnlyToolsUnavailableError("read-only tools unavailable: beeline-readonly-mcp is required for Room sessions");
+  }
+  const skillDir = agentSkillDir(config.agentKind);
+  return {
+    name: READ_ONLY_MCP_SERVER_NAME,
+    command: config.readonlyMcpCommand,
+    args: [...config.readonlyMcpArgs ?? []],
+    env: [
+      { name: "BEELINE_READONLY_ROOT", value: resolve32(cwd) },
+      ...config.agentHomeRoot ? [
+        {
+          name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
+          value: resolve32(config.agentHomeRoot, skillDir, "skills")
+        }
+      ] : [],
+      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve32(agentMemoryDir) }] : []
+    ]
+  };
+}
+
+// apps/body/dist/institutional-context.js
+import { performance as performance2 } from "node:perf_hooks";
+var INSTITUTIONAL_CONTEXT_TIMEOUT_MS = 500;
+var INSTITUTIONAL_MEMORY_LIVE_FLAG = "BEELINE_INSTITUTIONAL_MEMORY_ENABLED";
+function institutionalMemoryFlagEnabled(env, flag) {
+  return env[flag] !== "false";
+}
+var EMPTY_INSTITUTIONAL_CONTEXT = {
+  snapshotRevision: 0,
+  text: "",
+  itemIds: [],
+  totalBytes: 0,
+  omitted: {}
+};
+var INSTITUTIONAL_CONTEXT_MISSED_TEXT = "institutional memory did not load this turn; use search_memory before concluding anything is not stored.";
+function startInstitutionalContextFetch(api, roomId, enabled = institutionalMemoryFlagEnabled(process.env, INSTITUTIONAL_MEMORY_LIVE_FLAG), now2 = () => performance2.now()) {
+  const startedAt = now2();
+  const promise = enabled ? api.execute("getInstitutionalContext", { roomId }) : Promise.resolve(EMPTY_INSTITUTIONAL_CONTEXT);
+  promise.catch(() => {
+  });
+  return { promise, startedAt };
+}
+async function awaitInstitutionalContext(fetch2, log2 = console.warn, budgetMs = INSTITUTIONAL_CONTEXT_TIMEOUT_MS, now2 = () => performance2.now()) {
+  const remainingMs = budgetMs - (now2() - fetch2.startedAt);
+  let timer;
+  try {
+    const snapshot = await Promise.race([
+      fetch2.promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("institutional context timed out")), Math.max(0, remainingMs));
+        timer.unref?.();
+      })
+    ]);
+    return { ...snapshot, outcome: snapshot.text !== "" ? "served" : "empty" };
+  } catch (error) {
+    log2(`institutional context unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return {
+      ...EMPTY_INSTITUTIONAL_CONTEXT,
+      text: INSTITUTIONAL_CONTEXT_MISSED_TEXT,
+      outcome: "timed-out"
+    };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+
+// apps/body/dist/codegraph.js
+import { execFile as execFile11 } from "node:child_process";
+import { access as access3, appendFile, mkdir as mkdir21, readFile as readFile28 } from "node:fs/promises";
+import { dirname as dirname23, isAbsolute as isAbsolute3, resolve as resolve33 } from "node:path";
+import { promisify as promisify6 } from "node:util";
+var execFileAsync6 = promisify6(execFile11);
+var CODEGRAPH_MCP_SERVER_NAME = "codegraph";
+var CODEGRAPH_INDEX_PATH = ".codegraph/codegraph.db";
+var CODEGRAPH_PREPARE_TIMEOUT_MS = 12e4;
+function codegraphIndexDirectory(cwd) {
+  return resolve33(cwd, dirname23(CODEGRAPH_INDEX_PATH));
+}
+function codegraphMcpServer(config, cwd, options) {
+  if (!config.codegraphCommand)
+    return void 0;
+  return {
+    name: CODEGRAPH_MCP_SERVER_NAME,
+    command: config.codegraphCommand,
+    args: ["serve", "--mcp", "--path", resolve33(cwd), ...options.readonly ? ["--no-watch"] : []],
+    env: [
+      { name: "CODEGRAPH_TELEMETRY", value: "0" },
+      // One MCP child per harness session is easier to contain than a daemon
+      // that can outlive the Room/corner whose index and permissions it used.
+      { name: "CODEGRAPH_NO_DAEMON", value: "1" }
+    ]
+  };
+}
+function codegraphFingerprintServers(config, servers, mounted = Boolean(config.codegraphCommand)) {
+  return config.codegraphCommand && mounted ? [...servers, CODEGRAPH_MCP_SERVER_NAME] : [...servers];
+}
+async function isGitWorktree(cwd) {
+  try {
+    const { stdout: stdout6 } = await execFileAsync6("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      timeout: 1e4
+    });
+    return resolve33(stdout6.trim()) === resolve33(cwd);
+  } catch {
+    return false;
+  }
+}
+async function excludeIndexFromGitStatus(cwd) {
+  try {
+    const { stdout: stdout6 } = await execFileAsync6("git", ["rev-parse", "--git-path", "info/exclude"], {
+      cwd,
+      timeout: 1e4
+    });
+    const gitPath = stdout6.trim();
+    if (!gitPath)
+      return;
+    const path = isAbsolute3(gitPath) ? gitPath : resolve33(cwd, gitPath);
+    await mkdir21(dirname23(path), { recursive: true });
+    const existing = await readFile28(path, "utf8").catch(() => "");
+    if (existing.split("\n").includes(".codegraph/"))
+      return;
+    await appendFile(path, `${existing && !existing.endsWith("\n") ? "\n" : ""}.codegraph/
+`);
+  } catch {
+  }
+}
+async function prepareCodegraphIndex(config, cwd) {
+  const command = config.codegraphCommand;
+  if (!command || !await isGitWorktree(cwd))
+    return false;
+  await excludeIndexFromGitStatus(cwd);
+  const indexPath = resolve33(cwd, CODEGRAPH_INDEX_PATH);
+  const indexed = await access3(indexPath).then(() => true, () => false);
+  const args = indexed ? ["sync", "--quiet", cwd] : ["init", "--yes", cwd];
+  try {
+    await execFileAsync6(command, args, {
+      cwd,
+      env: { ...process.env, CODEGRAPH_TELEMETRY: "0", CODEGRAPH_NO_DAEMON: "1" },
+      timeout: CODEGRAPH_PREPARE_TIMEOUT_MS,
+      maxBuffer: 4 * 1024 * 1024
+    });
+    return true;
+  } catch (error) {
+    console.warn(`[body] CodeGraph ${args[0]} failed for ${cwd}; continuing with Beeline read tools:`, error);
     return false;
-  const record5 = rawInput;
-  return typeof record5.command === "string" || typeof record5.cmd === "string";
+  }
 }
-var ROOM_MOUNTED_MCP_SERVERS = [
-  READ_ONLY_MCP_SERVER_NAME,
-  BEELINE_AGENT_MCP_SERVER_NAME
-];
-var DISPATCHER_TOOL_NAME_KEYS = ["tool_name", "toolName"];
-var DISPATCHER_TOOL_INPUT_KEYS = ["tool_input", "toolInput"];
-var TOOL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
-function permissionRecord(rawInput) {
-  return rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput : void 0;
+
+// apps/body/dist/monolith-room-turn.js
+import { mkdir as mkdir23, writeFile as writeFile18 } from "node:fs/promises";
+import { homedir as homedir17, hostname as hostname2 } from "node:os";
+import { dirname as dirname24, join as join18 } from "node:path";
+
+// packages/api-contract/dist/scheduled-prompts.js
+var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
+var SCHEDULE_RAN_VERB = "ran a schedule for";
+
+// apps/body/dist/transcript-budget.js
+function budgetTranscript(lines, modelContextTokens, otherPromptBytes) {
+  const context = modelContextTokens && modelContextTokens > 0 ? modelContextTokens : 32768;
+  const reserveTokens = Math.max(4096, Math.ceil(context * 0.3));
+  const available = Math.max(0, context - Math.ceil(otherPromptBytes / 2) - reserveTokens);
+  const budget = Math.max(0, Math.min(24e3, Math.floor(context * 0.25), available * 2) - 128);
+  if (!budget)
+    return [];
+  const selected = [];
+  let used = 0;
+  const rowLimit = Math.min(4096, Math.floor(budget / 2));
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const row = boundMessageText(lines[index], rowLimit);
+    const bytes = Buffer.byteLength(row) + 1;
+    if (used + bytes > budget)
+      break;
+    selected.push(row);
+    used += bytes;
+  }
+  selected.reverse();
+  if (selected.length < lines.length) {
+    selected.unshift(`[${lines.length - selected.length} older messages omitted from this prompt]`);
+  }
+  return selected;
 }
-function dispatchedPayloadIsShell(record5) {
-  if (!record5)
-    return false;
-  return DISPATCHER_TOOL_INPUT_KEYS.some((key) => key in record5 && shellPayload({ rawInput: record5[key] }));
+function boundRoomTaskBody(body, modelContextTokens) {
+  const context = modelContextTokens && modelContextTokens > 0 ? modelContextTokens : 32768;
+  return boundMessageText(body, Math.min(8e3, Math.floor(context / 4)));
 }
-function toolIdentityCandidates(toolCall) {
-  const candidates = [];
-  const add = (value) => {
-    if (typeof value === "string" && value.trim())
-      candidates.push(value.trim());
-  };
-  add(toolCall?.title);
-  const record5 = permissionRecord(toolCall?.rawInput);
-  for (const key of DISPATCHER_TOOL_NAME_KEYS)
-    add(record5?.[key]);
-  return candidates;
+function boundMessageText(original, maxBytes) {
+  const sanitized = stripInlineData(original);
+  const clean4 = sanitized === original ? original : sanitized + fetchPointer(original, "inline content omitted");
+  return Buffer.byteLength(clean4) > maxBytes ? truncateRow(clean4, maxBytes) : clean4;
 }
-function normalizedServerName(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+function stripInlineData(text2) {
+  return text2.replace(/data:[^\s"'<>)]*/gi, "[inline data omitted]").replace(/\b[A-Za-z0-9+/]{512,}={0,2}\b/g, (candidate) => /[A-Z]/.test(candidate) && /[a-z]/.test(candidate) && /[0-9+/]/.test(candidate) ? "[inline binary data omitted]" : candidate);
 }
-function resolveMountedMcpToolCall(request, mountedServers) {
-  const toolCall = request.toolCall;
-  if (shellPayload(toolCall))
-    return void 0;
-  const record5 = permissionRecord(toolCall?.rawInput);
-  if (dispatchedPayloadIsShell(record5))
-    return void 0;
-  const candidates = toolIdentityCandidates(toolCall);
-  for (const server of mountedServers) {
-    const spellings = /* @__PURE__ */ new Set([server.toLowerCase(), normalizedServerName(server)]);
-    for (const candidate of candidates) {
-      const lowered = candidate.toLowerCase();
-      for (const spelling of spellings) {
-        for (const separator of TOOL_NAME_SEPARATORS) {
-          const prefix = `${spelling}${separator}`;
-          if (!lowered.startsWith(prefix))
-            continue;
-          const tool = candidate.slice(prefix.length).trim();
-          if (TOOL_NAME_PATTERN.test(tool))
-            return { server, tool };
-        }
-      }
-    }
-  }
-  return void 0;
+function truncateRow(row, maxBytes) {
+  const pointer = fetchPointer(row, "message truncated");
+  const contentBytes = Math.max(0, maxBytes - Buffer.byteLength(pointer));
+  let prefix = Buffer.from(row).subarray(0, contentBytes).toString("utf8");
+  prefix = prefix.replace(/\uFFFD$/, "");
+  return prefix + pointer;
 }
-function isReadOnlyMcpPermissionRequest(request) {
-  const toolCall = request.toolCall;
-  const title = toolCall?.title?.trim() ?? "";
-  const rawInput = toolCall?.rawInput;
-  const mcpCall = Boolean(rawInput) && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput : void 0;
-  if (mcpCall?.server === READ_ONLY_MCP_SERVER_NAME && typeof mcpCall.tool === "string" && READ_ONLY_TOOL_SET.has(mcpCall.tool)) {
-    return true;
-  }
-  if (shellPayload(toolCall))
-    return false;
-  if (READ_ONLY_PERMISSION_TITLES.has(title))
-    return true;
-  if (READ_ONLY_SERVER_TITLE_PREFIXES.some((prefix) => title.startsWith(prefix))) {
-    for (const tool of READ_ONLY_TOOL_NAMES) {
-      if (title === tool || title.endsWith(`(${tool})`) || TOOL_NAME_SEPARATORS.some((separator) => title.endsWith(`${separator}${tool}`))) {
-        return true;
-      }
-    }
-  }
-  return false;
+function fetchPointer(row, reason) {
+  const id = /^\[message id: ([^\]\n]+)\]/.exec(row)?.[1];
+  return id ? `
+[${reason}; call get_room_message with messageId "${id}" and offset 0 for the full text]` : `
+[${reason}; read the source conversation for the full text]`;
 }
-function isMountedMcpToolPermissionRequest(request, mountedServers = ROOM_MOUNTED_MCP_SERVERS) {
-  const toolCall = request.toolCall;
-  const rawInput = toolCall?.rawInput;
-  if (dispatchedPayloadIsShell(permissionRecord(rawInput)))
+
+// apps/body/dist/prompt-assembly.js
+function renderReplyContext(message) {
+  if (!message.replyToMessageId)
+    return "";
+  const author = message.replyToAuthorName ?? message.replyToAuthorId ?? "unknown author";
+  return [
+    `Reply to message ${message.replyToMessageId} by ${JSON.stringify(author)}:`,
+    ...message.replyToExcerpt !== void 0 ? [`> ${JSON.stringify(boundReplyExcerpt(message.replyToExcerpt))}`] : []
+  ].join("\n");
+}
+var PROMPT_SURFACES = [
+  "room",
+  "dm",
+  "code-corner",
+  "repo-less-corner"
+];
+var CORNERS = ["code-corner", "repo-less-corner"];
+var EVERYWHERE = PROMPT_SURFACES;
+function cornerHasRepositoryWork(brief) {
+  if (!brief)
     return false;
-  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
-    const call = rawInput;
-    if (typeof call.server === "string" && typeof call.tool === "string")
-      return true;
+  if (brief.repositoryWork !== void 0)
+    return brief.repositoryWork;
+  const nonGoalsSections = [
+    ...brief.spec.matchAll(/^## (?:Non-goals|Not doing)\s*\n([\s\S]*?)(?=^## |$(?![\s\S]))/gim)
+  ].map((match) => match[1] ?? "");
+  const prohibition = /^(?:repository edits?|repository changes?|pull requests?|(?:edit|modify|change) (?:the )?(?:repository|repo|code)|push(?:es)?|commit(?:s)?)[.!;]*$/i;
+  for (const nonGoals of nonGoalsSections) {
+    for (const line of nonGoals.split("\n")) {
+      const bullet = /^\s*[-*]\s+/.test(line);
+      const clause = line.trim().replace(/^[-*]\s+/, "");
+      const negative = /^(?:no|never|do not|forbid(?:s|den)?)\s+/i;
+      if (!bullet && !negative.test(clause))
+        continue;
+      const items = clause.replace(negative, "").split(/,\s*|\s+(?:and|or)\s+/i);
+      if (items.some((item) => prohibition.test(item.trim())))
+        return false;
+    }
   }
-  if (shellPayload(toolCall))
+  const assigned = brief.spec.match(/^## Assigned files\s*\n([\s\S]*?)(?=^## |$(?![\s\S]))/mi)?.[1];
+  if (assigned !== void 0 && (!assigned.trim() || /^(?:\s*[-*]?\s*)(?:\(?none\)?|no assigned files)\b/i.test(assigned)))
     return false;
-  const title = toolCall?.title?.trim() ?? "";
-  if (/^mcp__[^_].*__[^_]/.test(title))
-    return true;
-  if (/^mcp\.[^.]+\.[^.]/.test(title))
-    return true;
-  if (resolveMountedMcpToolCall(request, mountedServers))
-    return true;
-  return isReadOnlyMcpPermissionRequest(request) || isBeelineAgentMcpPermissionRequest(request);
+  return true;
 }
-var AGENT_SURFACE_TOOL_NAMES = [
-  "get_avatar",
-  "set_avatar",
-  "open_corner",
-  "pr_checks_status",
-  "post_artifact",
-  "write_scratch_file",
-  "fetch_image",
-  "connect_app"
-];
-function isHostMcpPermissionRequest(request, hostServers = CODE_OWNED_HOST_MCP_NAMES) {
-  const rawInput = request.toolCall?.rawInput;
-  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
-    const server = rawInput.server;
-    if (typeof server === "string" && isHostMcpIdentity(server, hostServers))
-      return true;
+var CORNER_RUNTIME_AUTHOR_CONTRACT = `The current brief's spec \u2014 stories, criteria, non-goals, risks \u2014 defines scope and done. The human approval quote wins any conflict. The short objective is navigation-only, never scope.
+Meet every story; respect every non-goal and risk.
+Before any code or build action, the brief must hold this ask's outline; opening and prompting inside it is not that outline. When it has none or the ask changed, read the revision and write it with revise_corner_brief first; chat never revises it.
+Follow the beeline-triage skill's bugfix execution contract when the spec or its approval quote reports a defect.
+Reproduce as triage isolated it with available emulator, Playwright, browser and test runner. Record attempts and observations. If a reproduction is obtained, record it under Reproduction <id>, reusing triage's identifier when it recorded one. If reproduction fails, warn and continue; never stop and never condition the fix on reproduction.
+Fix only the spec and approval quote. With a reproduction, change only what removes it and meets its user stories.
+Deliver files with post_artifact; answer plain chat questions directly.
+No unrequested features, flags, compatibility shims or refactors.`;
+var CORNER_AUTHOR_CONTRACT = `The current brief's spec \u2014 stories, criteria, non-goals, risks \u2014 defines scope and done. The human approval quote wins any conflict. The short objective is navigation-only, never scope.
+Meet every story; respect every non-goal and risk. Use its file manifest.
+Before any code or build action, the brief must hold this ask's outline; opening and prompting inside it is not that outline. When it has none or the ask changed, read the revision and write it with revise_corner_brief first; chat never revises it.
+Follow the beeline-triage skill's bugfix execution contract when the spec or its approval quote reports a defect.
+Reproduce as triage isolated it with available emulator, Playwright, browser and test runner. Record attempts and observations. If a reproduction is obtained, record it under Reproduction <id>, reusing triage's identifier when it recorded one. If reproduction fails, warn and continue; never stop and never condition the fix on reproduction.
+Fix only the spec and approval quote. With a reproduction, change only what removes it and meets its user stories.
+Only when the brief calls for repository changes, follow the PR procedure below. Otherwise do not commit, push or open a PR; deliver with post_artifact.
+Before the PR, demonstrate Y: run the built app or affected service and perform X. If no interactive surface is reachable, run the narrowest test or script exercising the exact user path and printing Y. An inner-function unit test, log line or code read is not a demonstration.
+The PR body MUST have ## Reproduced and ## Demonstrated. Cite Reproduction <id> in both, with steps, the wrong result and the now-passing result. In ## Demonstrated, when none was obtained, state that plainly ("not obtained") and show the regression; for feature work say "not a defect report".
+No unrequested features, flags, compatibility shims or refactors.`;
+var CORNER_REVIEWER_SESSION_INSTRUCTION = "You are this Room's configured reviewer. A review turn prompt names the latest stable green PR head. Review and approve only that exact head; if no stable green head is named, end the turn without a verdict. Never merge a pull request you review.";
+var CORNER_REVIEWER_UNSTABLE_HEAD_INSTRUCTION = "There is no stable green PR head for this active reviewer turn. Do not review or call approve_merge. End this turn without a verdict; the next green transition will wake you.";
+var CORNER_DELIVERY_NUDGE = "Only when you write code in this corner and the brief calls for repository changes, inspect the repository state and finish delivering the work unless a human hold stands: commit and push the intended changes and open the pull request if one does not exist. Decide yourself whether any remaining dirty work belongs to the brief; do not discard it merely to make the worktree clean. The pull request body must carry ## Reproduced and ## Demonstrated; if they are missing, add them before ending the turn. Otherwise do not commit, push or open a PR; deliver with post_artifact.";
+var CORNER_LAND_RULE = "Then, if a human's question or proposal in the corner has no answer, name it and do not merge; otherwise call merge_corner.";
+var CORNER_CHECKS_NUDGE = `Call pr_checks_status now. If checks="failed" and you write code in this corner, fix the failure and push. If checks="unknown", reply in this corner with the tool reason and stop instead of retrying. Otherwise stop: a reviewer's PASS wakes you to merge with merge_corner. Never merge it any other way.`;
+var handle = (value) => value.replace(/^@/, "");
+function cornerMergeInstruction(reviewerHandle) {
+  if (!reviewerHandle)
+    return "Once the pull request exists, reply with its full URL and end the turn; do not check or wait for CI. This Room has no configured reviewer, so it merges only on a person's yes: ask a Workspace owner or admin to approve the merge, then record their yes with order_corner_merge. You are woken to fix failing checks or a merge GitHub refused.";
+  const reviewer = `the reviewer (${handle(reviewerHandle)})`;
+  return `Once the pull request exists, reply with its full URL and end the turn; do not tag ${reviewer}, check, or wait for CI. Green checks wake ${reviewer}; its PASS wakes you to merge. ${CORNER_LAND_RULE} You are also woken to fix failing checks, requested changes, or a refused merge; a fixed head needs green checks and a fresh yes.`;
+}
+function cornerReviewerInstruction(input) {
+  if (!input.isReviewer)
+    return void 0;
+  const author = input.authorHandle ? handle(input.authorHandle) : void 0;
+  const number = input.pullRequestNumber ?? "N";
+  const headSha = input.headSha ?? "<head sha>";
+  return `Checks are green on PR #${number} at ${headSha}${input.briefRevision ? ` with assigned brief revision ${input.briefRevision}` : ""}. Review it now with the beeline-review skill against that exact head and current assigned brief. FAIL: ${author ? `reply \`@${author}\`` : "tag the agent that wrote this head"} with the confirmed findings and the reviewed head ${headSha} to fix. PASS: call the approve_merge tool for ${headSha}, then reply \`approved ${headSha}\` without tagging ${author ?? "the author"}: your PASS wakes the author to merge, so a tag adds nothing. A human's question or proposal in the corner discussion with no answer is a FAIL finding; name it. Never merge yourself or tell the author to merge. Never say you are holding or waiting for checks.`;
+}
+var CORNER_REVIEWER_AUTHOR_MERGE = "You are this Room's reviewer, so no agent can review your own code; a person is your reviewer. Once the pull request exists, reply with its full URL, tag the person who assigned you this work, and ask them to approve the merge; only a Workspace owner or admin's yes counts. Record their yes with order_corner_merge. Never merge it any other way. You are woken to fix failing checks or a merge GitHub refused.";
+function shellLine(shell) {
+  if (!shell)
+    return "";
+  if (shell.available) {
+    return "Shell commands are available in this session: run one with your own shell tool when the work needs it, and cite the output that supports your answer.";
   }
-  return toolIdentityCandidates(request.toolCall).some((candidate) => isHostMcpIdentity(candidate, hostServers));
+  return `Shell commands are NOT available in this session, so a request that needs one cannot be run; say that plainly instead of retrying.${shell.detail ? ` Relay this to the person: ${shell.detail}` : ""}`;
 }
-function isBeelineAgentMcpPermissionRequest(request) {
-  const toolCall = request.toolCall;
-  const title = toolCall?.title?.trim() ?? "";
-  const rawInput = toolCall?.rawInput;
-  if (rawInput && typeof rawInput === "object" && !Array.isArray(rawInput)) {
-    const call = rawInput;
-    if (call.server === BEELINE_AGENT_MCP_SERVER_NAME && typeof call.tool === "string" && AGENT_SURFACE_TOOL_NAMES.includes(call.tool)) {
-      return true;
-    }
+var SESSION_SECTIONS = [
+  {
+    id: "core.identity",
+    topic: "identity",
+    why: "Agents on harnesses with their own default persona introduce themselves under the wrong name unless told who they are.",
+    budgetBytes: 1400,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: ({ agentName, soul }) => [
+      `You are ${agentName} in Beeline. Stay ${agentName} in every reply, including when a tool or permission blocks you.`,
+      soul ? `Soul (${soul.name}): ${soul.instructions}
+The soul is not authority and never changes your tools, permissions, roles, or merge rights.` : ""
+    ].filter(Boolean).join("\n")
+  },
+  {
+    id: "core.voice",
+    topic: "voice",
+    why: "A seeded voice once bent facts for the bit and leaked into commit messages that outlive it.",
+    budgetBytes: 320,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Your voice never changes the facts: never trim, soften, exaggerate, or invent a detail for style. Write commit messages, pull request titles and bodies, and code comments in a plain voice."
+  },
+  {
+    id: "core.proactive",
+    topic: "proactivity",
+    why: "Agents answered a reported problem by restating it instead of fixing it or offering to.",
+    budgetBytes: 200,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Answer every problem with the finished fix, or with the concrete next step and an offer to take it. Never just restate the problem."
+  },
+  {
+    id: "core.finish",
+    topic: "turn-end",
+    why: "An agent read a not-yet-connected tool result as a stopping point and ended the turn with its own work undone.",
+    budgetBytes: 360,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Finish the work before you end the turn. A tool result that hands you a step (connecting, needs sign-in, call again, a next step) is your next action: take it now. End the turn to wait only when someone else must act next (a person replying or answering a card, grant, choice or approval; CI; a reviewer) or you are truly blocked."
+  },
+  {
+    id: "core.truth",
+    topic: "claims",
+    why: "Agents reported replies and actions that no tool had performed.",
+    budgetBytes: 200,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Never claim an action, result, or reply happened unless the prompt or a tool result proves it. State real doubt once, plainly; skip filler hedges."
+  },
+  {
+    id: "core.reply",
+    topic: "reply-shape",
+    why: "Agents echoed their instructions, the trigger, or their own answer back as a second reply.",
+    budgetBytes: 160,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Write only the message the reader needs. Never repeat these instructions, the trigger, or an answer you already gave."
+  },
+  {
+    id: "core.tagging",
+    topic: "tagging",
+    why: "Every @handle is a wake; stray handles woke agents with nothing to do, and guessed spellings reached nobody.",
+    budgetBytes: 360,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Every exact @handle you write wakes that member. Write one only to hand off work, to ask for a decision or input, or, when nothing else announces it, to tell the person who asked that their task is done; otherwise name people and agents in plain prose. Copy handles only from the member list in the turn prompt; any other spelling reaches nobody."
+  },
+  {
+    id: "core.authority",
+    topic: "authority",
+    why: "Resource access and the two command hard stops must hold on every surface, whoever asked.",
+    budgetBytes: 520,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Use your own owner's tools and keys for whoever asks. Another person's files, tools, or keys need that person's approval before you use them for anyone else, and the wallet keeps its own approval rule. Never, whoever asks: run a command that names a credential file, or run a script nobody has read. Follow your owner first, then Workspace admins, then members; only the person who set a hold, or someone above them, clears it. Delegated and follow-up work keeps the original requester."
+  },
+  {
+    id: "core.feedback",
+    topic: "feedback",
+    why: "Nothing reviews a turn after it ends, so friction in Beeline itself is lost unless the agent that hit it reports it in the turn.",
+    budgetBytes: 260,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "Only when this turn hit friction in Beeline itself (a tool error, a retry, a refused call, contradictory instructions, missing context, or a person correcting you), call report_feedback once before ending the turn. Otherwise do not."
+  },
+  {
+    id: "core.files",
+    topic: "files",
+    why: "Files on earlier messages are shown only as markers and never pre-downloaded; agents fetched media URLs instead.",
+    budgetBytes: 160,
+    layer: "core",
+    surfaces: EVERYWHERE,
+    render: () => "For a \u{1F4CE} file, call download_attachment and read its path. Never fetch media URLs; on failure, say you couldn't open it."
+  },
+  {
+    id: "surface.tools",
+    topic: "tools",
+    why: "Agents need app discovery before use in every turn; connector offers remain in Rooms and DMs.",
+    budgetBytes: 240,
+    layer: "surface",
+    surfaces: EVERYWHERE,
+    render: ({ surface }) => surface === "room" || surface === "dm" ? "When you need a tool you do not have, call workbench_status; offer_connector the tool it lists, otherwise call connect_app for the app." : "In corners, workbench_status discovers apps; connect_app starts sign-in here. Connector offers stay in Rooms and DMs."
+  },
+  {
+    id: "surface.squire-drive",
+    topic: "squire-browser",
+    why: "Agents rarely called operate_drive and instead hand-drove checkouts/signups one flat step at a time, including after a drive handback (ts-drive-adoption-scout).",
+    budgetBytes: 420,
+    layer: "surface",
+    surfaces: EVERYWHERE,
+    render: () => "For a multi-step browser goal (signup, checkout, provisioning), start with Trusty Squire operate_drive {url, goal, facts} rather than individual steps. On a low_confidence or needs_value handback, answer it from the offered options or take one flat step (operate_click, operate_type, operate_select, \u2026), then resume operate_drive on that same session instead of finishing the task by hand."
+  },
+  // --- Room ----------------------------------------------------------------
+  {
+    id: "room.place",
+    topic: "place",
+    why: "The agent must know it cannot write here, where the checkout is, and whether it has a shell.",
+    budgetBytes: 700,
+    layer: "surface",
+    surfaces: ["room"],
+    render: ({ repository, shell }) => [
+      `This is a Beeline Room. The repository filesystem is read-only here.${repository ? ` The Room is bound to ${repository.name} (branch ${repository.branch}); the read-only checkout is at the session root.` : ""} Web search is available.`,
+      shellLine(shell),
+      shell?.available === false ? "Read code with CodeGraph when available, then beeline-readonly-mcp search_text and read_file." : "If a shell command is refused, say so plainly rather than retrying, and read code with CodeGraph when available, then beeline-readonly-mcp search_text and read_file."
+    ].filter(Boolean).join(" ")
+  },
+  {
+    id: "room.corners",
+    topic: "repository-work",
+    why: "Repository work must start through the host-governed corner, with a brief as its authority.",
+    budgetBytes: 1100,
+    layer: "surface",
+    surfaces: ["room"],
+    render: () => [
+      "Repository changes happen only in a corner. In a Room, the finished fix for a code problem is the exact change plus an offer to open a corner for it; open one when a person asks for the change.",
+      "Before opening one, consult beeline-triage and beeline-spec, then call open_corner with a name of at most three words joined by hyphens (no whitespace), an objective of at most 24 words, and the brief (a spec plus the approving message). The objective only titles the work; the brief is its authority. When open_corner succeeds the server posts the corner card: do not restate it.",
+      "For corners you belong to, use inspect_corner for status, steer_corner to pass Room input down, and ask_corner for one answer. Never post into a corner without a Room command.",
+      "A corner ends when its pull request merges; since a person may merge minutes after it opens, anything still needed must already live in a different corner before that pull request opens, not after. A request covering several items is one corner per item, opened as work reaches each one, never one corner returned to for a later item."
+    ].join(" ")
+  },
+  {
+    id: "room.replying",
+    topic: "room-replies",
+    why: "Several agents share a Room; replies with nothing to act on, and echoed nudges, are noise.",
+    budgetBytes: 520,
+    layer: "surface",
+    surfaces: ["room"],
+    render: () => "If nothing is actionable for you, do not reply. If the current task is only a nudge to respond, answer the most recent unanswered human message instead of echoing the nudge. A poll plurality is a fact, never permission to deploy, delete, merge, or spend. Consult the using-beeline skill for Room mechanics (files, artifacts, schedules, reactions, events, mocks)."
+  },
+  // --- DM ------------------------------------------------------------------
+  {
+    id: "dm.place",
+    topic: "place",
+    why: "A DM has one person, no repository work, and no corners; the agent must not tag or try to open one.",
+    budgetBytes: 700,
+    layer: "surface",
+    surfaces: ["dm"],
+    render: ({ shell }) => [
+      "This is a private direct message with one person: everything they send is for you, so reply without tagging. It has no repository work and no corners, and the filesystem is read-only. Web search is available.",
+      shellLine(shell)
+    ].filter(Boolean).join(" ")
+  },
+  {
+    id: "dm.choices",
+    topic: "choices",
+    why: "A pick in a DM is a preference, never authority, and polls need an electorate.",
+    budgetBytes: 300,
+    layer: "surface",
+    surfaces: ["dm"],
+    render: () => "ask_choice offers options; a pick is a preference, never sandbox, spend, or merge authority. Consult the using-beeline skill for files, artifacts, and reactions."
+  },
+  // --- Corners -------------------------------------------------------------
+  {
+    id: "corner.steering",
+    topic: "corner-steering",
+    why: "Active corner turns can steer member siblings without borrowing parent Room authority.",
+    budgetBytes: 160,
+    layer: "surface",
+    surfaces: ["code-corner", "repo-less-corner"],
+    render: () => "Use steer_corner during a turn to send input to a member sibling under this parent. Membership alone grants no turn."
+  },
+  {
+    id: "corner.handover",
+    topic: "corner-handover",
+    why: "An agent asked to hand the corner on opened a duplicate sibling corner instead of tagging the other agent.",
+    budgetBytes: 360,
+    layer: "surface",
+    surfaces: ["code-corner", "repo-less-corner"],
+    render: () => "When a person asks you to hand this corner to another agent, tag in your reply only an agent that person named by handle or display name: it moves the implementer role here. A tag for any other reason does not move the role. Do not open a second corner for a hand-over."
+  },
+  {
+    id: "corner.worktree",
+    topic: "place",
+    why: "Every agent in a code corner must know its branch and target, whether or not it writes code.",
+    budgetBytes: 200,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    render: ({ worktree }) => `You are in an isolated git worktree on ${worktree?.featureBranch ?? "the feature branch"}, targeting ${worktree?.targetBranch ?? "the target branch"}.`
+  },
+  {
+    id: "corner.android",
+    topic: "android",
+    why: "An agent under its isolated $HOME concluded the host had no emulator, and agents on the shared adb server drove each other's emulators.",
+    budgetBytes: 380,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ android }) => Boolean(android),
+    render: ({ android }) => `Android: adb and emulator are on PATH; the SDK is $ANDROID_HOME, AVDs are in $ANDROID_AVD_HOME, and /dev/kvm works. Your adb server sees only your own emulator. Boot it with \`emulator -avd <name> -port ${android?.emulatorPort} -read-only -no-window -no-snapshot -gpu swiftshader_indirect\`; it reaches host services at 10.0.2.2.`
+  },
+  {
+    id: "corner.implementer",
+    topic: "implementer-condition",
+    why: "A reviewer that opened its corner was given push steps and pushed a fix (PR #2224); only the agent knows whether it was told to write code, so the author rules are conditional.",
+    budgetBytes: 400,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    render: ({ reviewer }) => `Implementer rules: the rules below${reviewer ? ", up to the reviewer rules," : ""} apply only when the brief or a person in this corner told you to write code or do this corner's work. A hand-over of the work to another agent ends that. Otherwise do not commit, push, or open a pull request.`
+  },
+  {
+    id: "corner.prepare",
+    topic: "corner-prepare",
+    why: "Only a checkout that defines the command can run it; another repository fails on its first step.",
+    budgetBytes: 60,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ brief, cornerPrepareScript }) => cornerHasRepositoryWork(brief) && cornerPrepareScript === true,
+    render: () => "Run npm run corner:prepare first."
+  },
+  {
+    id: "corner.push",
+    topic: "push",
+    why: "The author must push only its own branch and rebase before each push, or it overwrites or loses work.",
+    budgetBytes: 800,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ brief }) => cornerHasRepositoryWork(brief),
+    render: ({ worktree, githubCli }) => githubCli === "rest" ? `Only when the brief calls for repository changes: commit and push only ${worktree?.featureBranch}; never force-push or write to ${worktree?.targetBranch}. Before pushing, run \`git ls-remote --exit-code origin ${worktree?.featureBranch}\`. Exit code 0: rebase on origin/${worktree?.featureBranch}; resolve conflicts autonomously, realigning to that remote branch and redoing the work if needed, then rerun affected tests. Exit code 2: the branch is absent; skip rebase for the first push. Any other non-zero exit is a lookup failure: stop and retry; do not skip rebase or push. Open it with \`gh pr create\` and read it with \`gh pr view\`; this host has no gh, so the Beeline launcher answers both over the GitHub REST API with the app token.` : `Only when the brief calls for repository changes: commit and push only ${worktree?.featureBranch}; never force-push or write to ${worktree?.targetBranch}. Before pushing, run \`git ls-remote --exit-code origin ${worktree?.featureBranch}\`. Exit code 0: rebase on origin/${worktree?.featureBranch}; resolve conflicts autonomously, realigning to that remote branch and redoing the work if needed, then rerun affected tests. Exit code 2: the branch is absent; skip rebase for the first push. Any other non-zero exit is a lookup failure: stop and retry; do not skip rebase or push. Open the pull request with gh.`
+  },
+  {
+    id: "corner.contract",
+    topic: "author-contract",
+    why: "The reviewer enforces this contract; an author that never saw it fails review.",
+    budgetBytes: 2600,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    render: ({ brief }) => cornerHasRepositoryWork(brief) ? CORNER_AUTHOR_CONTRACT : CORNER_RUNTIME_AUTHOR_CONTRACT
+  },
+  {
+    id: "corner.checks",
+    topic: "checks-turns",
+    why: "Server check notes were restated as replies, and agents scheduled polls of a gate that wakes them itself.",
+    budgetBytes: 900,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ brief }) => cornerHasRepositoryWork(brief),
+    render: () => "When asked whether the reviewer was woken, call pr_checks_status and report reviewerWake; do not invent a cause. Never schedule polls of pr_checks_status or the merge gate; the server wakes you when it changes."
+  },
+  {
+    id: "corner.merge",
+    topic: "merge",
+    why: 'Exactly one rule may say who merges and when; two rules here once said both "merge" and "never merge".',
+    budgetBytes: 520,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ brief }) => cornerHasRepositoryWork(brief),
+    render: ({ reviewerHandle, reviewer }) => (reviewer ? CORNER_REVIEWER_AUTHOR_MERGE : cornerMergeInstruction(reviewerHandle)) + " Never merge any other pull request."
+  },
+  {
+    id: "corner.review",
+    topic: "review",
+    why: "The reviewer approves one exact green head, never merges it, and returns defects instead of pushing them.",
+    budgetBytes: 450,
+    layer: "surface",
+    surfaces: ["code-corner"],
+    when: ({ reviewer }) => reviewer === true,
+    render: () => `Reviewer rules: ${CORNER_REVIEWER_SESSION_INSTRUCTION} Report findings to the author; never edit or push another agent's branch.`
+  },
+  {
+    id: "corner.repo-less",
+    topic: "place",
+    why: "A repo-less corner has no repository; the agent delivers files, not commits.",
+    budgetBytes: 1e3,
+    layer: "surface",
+    surfaces: ["repo-less-corner"],
+    render: () => [
+      "This is a repo-less corner with no repository checkout and no GitHub workflow. Work in this corner's writable workspace: create files with write_scratch_file or your own tools, then send them with post_artifact.",
+      "Do not initialize a repository, create a branch, commit, push, open a pull request, or wait for GitHub checks."
+    ].join("\n")
+  },
+  {
+    id: "corner.repo-less-reply",
+    topic: "reply-target",
+    why: "Every turn was told to end with a one-line summary of files it posted, so answers were followed by a restatement of themselves.",
+    budgetBytes: 260,
+    layer: "surface",
+    surfaces: ["repo-less-corner"],
+    render: ({ requesterHandle }) => `${requesterHandle ? `Tag @${handle(requesterHandle)} once, when the deliverable is posted or you need their input. ` : ""}When you posted files, name them in one line; never restate your answer. Only a human closes this corner.`
   }
-  if (shellPayload(toolCall))
-    return false;
-  const normalized = BEELINE_AGENT_MCP_SERVER_NAME.replaceAll("-", "_");
-  return AGENT_SURFACE_TOOL_NAMES.flatMap((tool) => [
-    `mcp__${BEELINE_AGENT_MCP_SERVER_NAME}__${tool}`,
-    `mcp__${normalized}__${tool}`,
-    `mcp.${BEELINE_AGENT_MCP_SERVER_NAME}.${tool}`
-  ]).includes(title);
-}
-function isMcpShapedPermissionRequest(request, hostServers = CODE_OWNED_HOST_MCP_NAMES) {
-  if (isHostMcpPermissionRequest(request, hostServers))
-    return true;
-  const record5 = permissionRecord(request.toolCall?.rawInput);
-  if (typeof record5?.server === "string")
-    return true;
-  if (DISPATCHER_TOOL_NAME_KEYS.some((key) => typeof record5?.[key] === "string"))
-    return true;
-  const title = request.toolCall?.title?.trim() ?? "";
-  return /^mcp__[^_].*__[^_]/.test(title) || /^mcp\.[^.]+\.[^.]/.test(title);
+];
+function applicable(sections, context) {
+  return sections.filter((section) => section.surfaces.includes(context.surface) && (section.when?.(context) ?? true)).map((section) => ({ section, text: section.render(context).trim() })).filter((entry) => entry.text);
 }
-
-// apps/body/dist/room-session.js
-var ReadOnlyToolsUnavailableError = class extends Error {
-  name = "ReadOnlyToolsUnavailableError";
-};
-function beelineAgentMcpServer(config, api, context) {
-  if (!config.readonlyMcpCommand) {
-    throw new ReadOnlyToolsUnavailableError("agent tools unavailable: the Beeline MCP command is required");
-  }
-  const connection = api.connection();
-  return {
-    name: BEELINE_AGENT_MCP_SERVER_NAME,
-    command: config.readonlyMcpCommand,
-    args: [...config.readonlyMcpArgs ?? []],
-    env: [
-      { name: "BEELINE_MCP_SURFACE", value: "agent" },
-      ...context.turnContextPath ? [{ name: "BEELINE_TURN_CONTEXT_FILE", value: context.turnContextPath }] : [],
-      ...context.directMessage ? [{ name: "BEELINE_AGENT_DM", value: "1" }] : [],
-      ...context.squireRelay ? [
-        { name: "BEELINE_SQUIRE_RELAY_URL", value: context.squireRelay.url },
-        { name: "BEELINE_SQUIRE_RELAY_TOKEN", value: context.squireRelay.token }
-      ] : [],
-      { name: "BEELINE_DAEMON_BASE_URL", value: connection.baseUrl },
-      { name: "BEELINE_DAEMON_TOKEN", value: connection.daemonToken },
-      { name: "BEELINE_HELPER_VERSION", value: connection.helperVersion },
-      { name: "BEELINE_DAEMON_AGENT_ID", value: connection.agentId },
-      { name: "BEELINE_OPERATOR_HOME", value: config.operatorHome ?? homedir16() },
-      { name: "BEELINE_DAEMON_ROOM_ID", value: context.roomId },
-      { name: "BEELINE_DAEMON_WORKSPACE_ID", value: context.workspaceId },
-      ...context.cornerId ? [{ name: "BEELINE_DAEMON_CORNER_ID", value: context.cornerId }] : [],
-      ...context.agentMayCloseCorner ? [{ name: "BEELINE_CORNER_AGENT_CLOSE", value: "1" }] : [],
-      ...context.agentMayUpgradeCorner ? [{ name: "BEELINE_CORNER_CAN_UPGRADE", value: "1" }] : [],
-      ...context.reviewer ? [{ name: "BEELINE_CORNER_REVIEWER", value: "1" }] : [],
-      ...context.cornerId && context.lane ? [{ name: "BEELINE_CORNER_LANE", value: context.lane }] : [],
-      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : [],
-      ...context.attachScratchRoot ? [{ name: "BEELINE_ATTACH_SCRATCH_ROOT", value: context.attachScratchRoot }] : [],
-      ...context.grantRunner ? [
-        { name: "BEELINE_GRANT_RUNNER_URL", value: context.grantRunner.url },
-        { name: "BEELINE_GRANT_RUNNER_TOKEN", value: context.grantRunner.token }
-      ] : []
-    ]
-  };
+function sessionSections(context) {
+  return applicable(SESSION_SECTIONS, context);
 }
-function readOnlyMcpServer(config, cwd, agentMemoryDir) {
-  if (!config.readonlyMcpCommand) {
-    throw new ReadOnlyToolsUnavailableError("read-only tools unavailable: beeline-readonly-mcp is required for Room sessions");
-  }
-  const skillDir = agentSkillDir(config.agentKind);
+function assembleSessionPrompt(context) {
+  const entries = sessionSections(context);
+  const systemPrompt = entries.map((entry) => entry.text).join("\n\n");
   return {
-    name: READ_ONLY_MCP_SERVER_NAME,
-    command: config.readonlyMcpCommand,
-    args: [...config.readonlyMcpArgs ?? []],
-    env: [
-      { name: "BEELINE_READONLY_ROOT", value: resolve32(cwd) },
-      ...config.agentHomeRoot ? [
-        {
-          name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
-          value: resolve32(config.agentHomeRoot, skillDir, "skills")
-        }
-      ] : [],
-      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve32(agentMemoryDir) }] : []
-    ]
+    systemPrompt,
+    turnPrefix: harnessHonorsSessionSystemPrompt(context.agentCommand) ? "" : systemPrompt,
+    report: entries.map(({ section, text: text2 }) => ({
+      id: section.id,
+      bytes: Buffer.byteLength(text2)
+    }))
   };
 }
+function renderAssignedCornerBrief(brief) {
+  const approval = brief.approval ? `Approved by ${brief.approval.approverName}, message ${brief.approval.sourceMessageId}: ${brief.approval.text}` : "This revision predates recorded approvals.";
+  return `Brief revision ${brief.revision}:
+${brief.spec}
 
-// apps/body/dist/institutional-context.js
-import { performance as performance2 } from "node:perf_hooks";
-var INSTITUTIONAL_CONTEXT_TIMEOUT_MS = 500;
-var INSTITUTIONAL_MEMORY_LIVE_FLAG = "BEELINE_INSTITUTIONAL_MEMORY_ENABLED";
-function institutionalMemoryFlagEnabled(env, flag) {
-  return env[flag] !== "false";
-}
-var EMPTY_INSTITUTIONAL_CONTEXT = {
-  snapshotRevision: 0,
-  text: "",
-  itemIds: [],
-  totalBytes: 0,
-  omitted: {}
-};
-var INSTITUTIONAL_CONTEXT_MISSED_TEXT = "institutional memory did not load this turn; use search_memory before concluding anything is not stored.";
-function startInstitutionalContextFetch(api, roomId, enabled = institutionalMemoryFlagEnabled(process.env, INSTITUTIONAL_MEMORY_LIVE_FLAG), now2 = () => performance2.now()) {
-  const startedAt = now2();
-  const promise = enabled ? api.execute("getInstitutionalContext", { roomId }) : Promise.resolve(EMPTY_INSTITUTIONAL_CONTEXT);
-  promise.catch(() => {
-  });
-  return { promise, startedAt };
+${approval}`;
 }
-async function awaitInstitutionalContext(fetch2, log2 = console.warn, budgetMs = INSTITUTIONAL_CONTEXT_TIMEOUT_MS, now2 = () => performance2.now()) {
-  const remainingMs = budgetMs - (now2() - fetch2.startedAt);
-  let timer;
-  try {
-    const snapshot = await Promise.race([
-      fetch2.promise,
-      new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error("institutional context timed out")), Math.max(0, remainingMs));
-        timer.unref?.();
-      })
-    ]);
-    return { ...snapshot, outcome: snapshot.text !== "" ? "served" : "empty" };
-  } catch (error) {
-    log2(`institutional context unavailable: ${error instanceof Error ? error.message : String(error)}`);
-    return {
-      ...EMPTY_INSTITUTIONAL_CONTEXT,
-      text: INSTITUTIONAL_CONTEXT_MISSED_TEXT,
-      outcome: "timed-out"
-    };
-  } finally {
-    if (timer)
-      clearTimeout(timer);
+function roomMentionDirectory(roster, selfId) {
+  const rows = [];
+  let selfHandle;
+  for (const member of roster.members) {
+    if (member.identityId === selfId) {
+      selfHandle = member.handle?.trim().replace(/^@/, "");
+      continue;
+    }
+    const memberHandle = member.handle?.trim().replace(/^@/, "");
+    if (!memberHandle)
+      continue;
+    const name = member.name?.trim() ?? "";
+    const kind = member.kind === "agent" ? "agent" : "person";
+    rows.push(`- @${memberHandle}${name && name !== memberHandle ? ` \u2014 ${name}` : ""} (${kind})`);
   }
+  if (selfHandle)
+    rows.push(`You are @${selfHandle}, a member of this Room; you are not listed above.`);
+  if (!rows.length)
+    return "";
+  return ["Members (exact tag spellings):", ...rows].join("\n");
 }
+var ROOMS = ["room", "dm"];
+var TURN_SECTIONS = [
+  {
+    id: "turn.session",
+    topic: "session-delivery",
+    why: "Codex, Pi, and Grok drop the ACP session prompt; without this they never saw the corner rules.",
+    budgetBytes: 16e3,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    render: ({ sessionPrefix }) => sessionPrefix ?? ""
+  },
+  {
+    id: "turn.checks",
+    topic: "checks-turns",
+    why: "Only CI or merge-gate wakes suppress ordinary reporting; user schedules must deliver their task results.",
+    budgetBytes: 350,
+    layer: "turn",
+    surfaces: ["code-corner"],
+    // A reviewer's green-checks wake is a review turn, not a fix turn.
+    when: ({ task, reviewerTarget }) => !reviewerTarget && task.commandReason !== "schedule" && (["corner_check", "corner_merge_refused", "corner_merge_conflict"].includes(task.commandReason ?? "") || ["check-passed", "check-failed"].includes(task.outsideEvent?.kind ?? "")),
+    render: () => 'This is a checks turn about CI or the merge gate. On it, say nothing unless you push a fix or report checks="unknown", and then use one short line. Never restate server check or merge notes.'
+  },
+  {
+    id: "turn.land",
+    topic: "land-turn",
+    why: "A reviewer's PASS hands the merge to the implementer, who must not merge over an unanswered human question.",
+    budgetBytes: 300,
+    layer: "turn",
+    surfaces: ["code-corner"],
+    when: ({ task }) => task.commandReason === "corner_land",
+    render: () => `The reviewer approved this pull request's current head. ${CORNER_LAND_RULE}`
+  },
+  {
+    id: "turn.objective",
+    topic: "objective",
+    why: "The objective locates the work but must never be mistaken for its authority.",
+    budgetBytes: 600,
+    layer: "turn",
+    surfaces: CORNERS,
+    render: ({ objective }) => objective ? `Corner objective (navigation only, not product authority): ${objective}` : ""
+  },
+  {
+    id: "turn.rename",
+    topic: "corner-rename",
+    why: "A generated corner name says nothing about the work; only the server knows the name is still generated, so the ask rides only on those turns.",
+    budgetBytes: 600,
+    layer: "turn",
+    surfaces: CORNERS,
+    render: ({ generatedTitle, brief }) => generatedTitle ? `This human-opened corner still has its generated name, "${generatedTitle}". If the newest human message states the work, call rename_corner once before you reply with a name of at most three words joined by hyphens (no whitespace) and a short objective${brief ? "" : ", plus a brief grounded in that message with brief.approval.sourceMessageId set to the human message id"}. A bare mention does not state the work; leave the name until a message does.` : ""
+  },
+  {
+    id: "turn.brief",
+    topic: "brief",
+    why: "The brief is the product authority for corner work; a corner without one says so once.",
+    budgetBytes: 24e3,
+    layer: "turn",
+    surfaces: CORNERS,
+    render: ({ brief, surface, generatedTitle }) => brief ? `${renderAssignedCornerBrief(brief.brief)}${cornerHasRepositoryWork(brief.brief) ? `
 
-// apps/body/dist/codegraph.js
-import { execFile as execFile11 } from "node:child_process";
-import { access as access3, appendFile, mkdir as mkdir21, readFile as readFile28 } from "node:fs/promises";
-import { dirname as dirname23, isAbsolute as isAbsolute3, resolve as resolve33 } from "node:path";
-import { promisify as promisify6 } from "node:util";
-var execFileAsync6 = promisify6(execFile11);
-var CODEGRAPH_MCP_SERVER_NAME = "codegraph";
-var CODEGRAPH_INDEX_PATH = ".codegraph/codegraph.db";
-var CODEGRAPH_PREPARE_TIMEOUT_MS = 12e4;
-function codegraphIndexDirectory(cwd) {
-  return resolve33(cwd, dirname23(CODEGRAPH_INDEX_PATH));
-}
-function codegraphMcpServer(config, cwd, options) {
-  if (!config.codegraphCommand)
-    return void 0;
-  return {
-    name: CODEGRAPH_MCP_SERVER_NAME,
-    command: config.codegraphCommand,
-    args: ["serve", "--mcp", "--path", resolve33(cwd), ...options.readonly ? ["--no-watch"] : []],
-    env: [
-      { name: "CODEGRAPH_TELEMETRY", value: "0" },
-      // One MCP child per harness session is easier to contain than a daemon
-      // that can outlive the Room/corner whose index and permissions it used.
-      { name: "CODEGRAPH_NO_DAEMON", value: "1" }
-    ]
-  };
-}
-function codegraphFingerprintServers(config, servers, mounted = Boolean(config.codegraphCommand)) {
-  return config.codegraphCommand && mounted ? [...servers, CODEGRAPH_MCP_SERVER_NAME] : [...servers];
-}
-async function isGitWorktree(cwd) {
-  try {
-    const { stdout: stdout6 } = await execFileAsync6("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      timeout: 1e4
-    });
-    return resolve33(stdout6.trim()) === resolve33(cwd);
-  } catch {
-    return false;
-  }
-}
-async function excludeIndexFromGitStatus(cwd) {
-  try {
-    const { stdout: stdout6 } = await execFileAsync6("git", ["rev-parse", "--git-path", "info/exclude"], {
-      cwd,
-      timeout: 1e4
-    });
-    const gitPath = stdout6.trim();
-    if (!gitPath)
-      return;
-    const path = isAbsolute3(gitPath) ? gitPath : resolve33(cwd, gitPath);
-    await mkdir21(dirname23(path), { recursive: true });
-    const existing = await readFile28(path, "utf8").catch(() => "");
-    if (existing.split("\n").includes(".codegraph/"))
-      return;
-    await appendFile(path, `${existing && !existing.endsWith("\n") ? "\n" : ""}.codegraph/
-`);
-  } catch {
+Assigned files:
+${brief.fileLines.join("\n") || "(none)"}` : brief.fileLines.length ? `
+
+Brief attachments:
+${brief.fileLines.join("\n")}` : ""}${brief.missingRequiredFile ? "\nRequired assignment files are unavailable. Pause work that depends on them and report the missing file precisely." : ""}` : surface === "code-corner" ? `No assigned brief yet. Before any code, write the first brief from the newest human request with ${generatedTitle ? "rename_corner" : "revise_corner_brief at expectedRevision 0"}.` : "No assigned brief: the human messages in this corner are the authority; skip steps that need a brief revision."
+  },
+  {
+    id: "turn.checkout",
+    topic: "checkout",
+    why: "A Room checkout is refreshed per turn; the agent must know which commit it reads.",
+    budgetBytes: 200,
+    layer: "turn",
+    surfaces: ROOMS,
+    render: ({ checkout }) => checkout ? `Repository checkout: origin/${checkout.branch} at commit ${checkout.commit}, refreshed for this turn.` : ""
+  },
+  {
+    id: "turn.transcript",
+    topic: "transcript",
+    why: "The conversation so far, with rows this session already saw left out.",
+    budgetBytes: 2e5,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    render: ({ transcript, surface }) => {
+      if (!transcript?.lines.length)
+        return "";
+      const place = ROOMS.includes(surface) ? "Room" : "corner";
+      return `${transcript.sinceLastTurn ? `New in the ${place} since your last turn:` : `${place === "Room" ? "Room conversation" : "Corner transcript"}:`}
+${transcript.lines.join("\n")}`;
+    }
+  },
+  {
+    id: "turn.resume",
+    topic: "resume",
+    why: "A card answer resumes a paused turn; the agent must know which question was answered.",
+    budgetBytes: 600,
+    layer: "turn",
+    surfaces: ROOMS,
+    render: ({ resume }) => resume ?? ""
+  },
+  {
+    id: "turn.members",
+    topic: "members",
+    why: "Handle spellings change; only the live roster is a safe source.",
+    budgetBytes: 4e3,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    render: ({ members }) => members ?? ""
+  },
+  {
+    id: "turn.memory",
+    topic: "memory",
+    why: "Keyword-matched institutional memory, compiled and capped by the server.",
+    budgetBytes: 1e3,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    render: ({ memory }) => memory ?? ""
+  },
+  {
+    id: "turn.corners",
+    topic: "corners",
+    why: "Room and corner agents need exact member corner ids for supported relay actions.",
+    budgetBytes: 8e3,
+    layer: "turn",
+    surfaces: ["room", "code-corner", "repo-less-corner"],
+    render: ({ surface, corners, closedCorners }) => [
+      corners?.length ? `Current corners you belong to (use the exact cornerId with ${surface === "room" ? "inspect_corner, steer_corner, or ask_corner" : "steer_corner for a sibling under this parent Room"}):
+${JSON.stringify(corners)}` : "",
+      surface === "room" && closedCorners?.length ? `Corners you belong to closed in the last 24 hours (merge commit is unavailable when absent):
+${closedCorners.map((corner) => `- ${corner.name ?? corner.cornerId} (${corner.cornerId}): PR ${corner.pullRequestNumber ? `#${corner.pullRequestNumber}` : "unavailable"}, merge commit ${corner.mergeCommitSha ?? "unavailable"}`).join("\n")}` : ""
+    ].filter(Boolean).join("\n\n")
+  },
+  {
+    id: "turn.reviewer-target",
+    topic: "reviewer-target",
+    why: "The reviewer must review the head that is green now, not one named in an older message.",
+    budgetBytes: 1200,
+    layer: "turn",
+    surfaces: ["code-corner"],
+    render: ({ reviewerTarget }) => reviewerTarget ?? ""
+  },
+  {
+    id: "turn.task",
+    topic: "task",
+    why: "The message this turn answers, said once and last.",
+    budgetBytes: 64e3,
+    layer: "turn",
+    surfaces: EVERYWHERE,
+    render: ({ task, surface }) => ROOMS.includes(surface) ? [
+      `Current task from ${task.fromName ?? "a Room member"}:`,
+      task.cornerAskId ? `Corner ask id: ${task.cornerAskId}. Use get_corner_ask to retrieve its status and answer.` : "",
+      task.body,
+      renderReplyContext(task.reply ?? {})
+    ].filter(Boolean).join("\n\n") : [
+      ...task.reactionTargetId ? [`Reaction target message id: ${task.reactionTargetId}`] : [],
+      `Newest message:
+${task.body}`,
+      ...task.reply?.replyToMessageId ? [renderReplyContext(task.reply)] : [],
+      ...task.attachmentLines ?? []
+    ].join("\n")
   }
-}
-async function prepareCodegraphIndex(config, cwd) {
-  const command = config.codegraphCommand;
-  if (!command || !await isGitWorktree(cwd))
-    return false;
-  await excludeIndexFromGitStatus(cwd);
-  const indexPath = resolve33(cwd, CODEGRAPH_INDEX_PATH);
-  const indexed = await access3(indexPath).then(() => true, () => false);
-  const args = indexed ? ["sync", "--quiet", cwd] : ["init", "--yes", cwd];
-  try {
-    await execFileAsync6(command, args, {
-      cwd,
-      env: { ...process.env, CODEGRAPH_TELEMETRY: "0", CODEGRAPH_NO_DAEMON: "1" },
-      timeout: CODEGRAPH_PREPARE_TIMEOUT_MS,
-      maxBuffer: 4 * 1024 * 1024
-    });
-    return true;
-  } catch (error) {
-    console.warn(`[body] CodeGraph ${args[0]} failed for ${cwd}; continuing with Beeline read tools:`, error);
-    return false;
+];
+function assembleTurnPrompt(context) {
+  if (context.task.outsideEvent?.kind?.startsWith("webhook:")) {
+    context = { ...context, task: { ...context.task, body: quoteOutsideData(context.task.outsideEvent.kind, context.task.outsideEvent.payload) } };
   }
+  const boundedContext = ROOMS.includes(context.surface) ? {
+    ...context,
+    task: {
+      ...context.task,
+      body: boundRoomTaskBody(context.task.body, context.modelContextTokens)
+    }
+  } : context;
+  const withoutTranscript = applicable(TURN_SECTIONS, {
+    ...boundedContext,
+    transcript: void 0
+  });
+  const otherBytes = withoutTranscript.reduce((sum, entry) => sum + Buffer.byteLength(entry.text) + 2, 0);
+  const lines = budgetTranscript(boundedContext.transcript?.lines ?? [], boundedContext.modelContextTokens, otherBytes);
+  const entries = applicable(TURN_SECTIONS, {
+    ...boundedContext,
+    transcript: boundedContext.transcript ? { ...boundedContext.transcript, lines } : void 0
+  });
+  return {
+    text: entries.map((entry) => entry.text).join("\n\n"),
+    report: entries.map(({ section, text: text2 }) => ({
+      id: section.id,
+      bytes: Buffer.byteLength(text2)
+    }))
+  };
 }
 
-// apps/body/dist/monolith-room-turn.js
-import { mkdir as mkdir23, writeFile as writeFile18 } from "node:fs/promises";
-import { homedir as homedir17, hostname as hostname2 } from "node:os";
-import { dirname as dirname24, join as join18 } from "node:path";
-
-// packages/api-contract/dist/scheduled-prompts.js
-var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
-var SCHEDULE_RAN_VERB = "ran a schedule for";
-
 // apps/body/dist/turn-trace.js
 import { appendFile as appendFile2, mkdir as mkdir22, readdir as readdir7, rm as rm13 } from "node:fs/promises";
 import { resolve as resolve34 } from "node:path";
@@ -44082,7 +44109,7 @@ if (!refusal) {
 }
 
 // apps/body/dist/warm-node-modules.js
-import { createHash as createHash13, randomUUID as randomUUID11 } from "node:crypto";
+import { createHash as createHash12, randomUUID as randomUUID11 } from "node:crypto";
 import { constants as fsConstants3 } from "node:fs";
 import { chmod as chmod10, copyFile as copyFile2, link, lstat as lstat4, mkdir as mkdir25, readdir as readdir8, readFile as readFile29, readlink as readlink2, rename as rename10, rm as rm14, stat as stat8, symlink as symlink3, utimes } from "node:fs/promises";
 import { dirname as dirname25, join as join19, resolve as resolve36 } from "node:path";
@@ -44127,7 +44154,7 @@ async function readWarmPlan(worktreePath) {
   const unsafe = trees.find((tree) => !isContainedTreePath(tree));
   if (unsafe)
     return { failure: "unsafe-lockfile", detail: unsafe };
-  const key = createHash13("sha256").update(`${STORE_FORMAT}\0${process.platform}\0${process.arch}\0${process.versions.modules}\0`).update(lockfile).digest("hex").slice(0, 32);
+  const key = createHash12("sha256").update(`${STORE_FORMAT}\0${process.platform}\0${process.arch}\0${process.versions.modules}\0`).update(lockfile).digest("hex").slice(0, 32);
   return { key, trees };
 }
 function nodeModulesTreePaths(packages) {
@@ -44380,9 +44407,13 @@ var execFileAsync7 = promisify7(execFile12);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
 var TOOL_OUTPUT_MAX_BYTES = 3200;
 var TOOL_PATH_LIMIT = 12;
+var GITHUB_OUTAGE_WAIT_MS = 12e4;
 function isCornerChecksTurn(trigger, restates) {
   return Boolean(restates) || /\b(?:passed|failed) a check\b/i.test(trigger);
 }
+function isCornerReviewTurn(reviewer, trigger) {
+  return reviewer && /\bpassed a check\b/i.test(trigger);
+}
 async function cornerUndeliveredRepositoryState(worktreePath, featureBranch, targetBranch) {
   try {
     const [{ stdout: status }, ahead] = await Promise.all([
@@ -44541,11 +44572,8 @@ function toolArguments(call) {
   const input = serialized(call.rawInput);
   return input ? { input: clampBytes(redactToolDetail(input), TOOL_ARGUMENT_MAX_BYTES) } : {};
 }
-function spentAuthorityOnLaneUpgrade(call) {
-  return /(?:^|[._:/-])upgrade_corner_to_code$/i.test(call.title ?? "") && isCompletedToolCall(call);
-}
 function toolCallKey(call, index) {
-  return call.id ? `id-${createHash14("sha256").update(call.id).digest("hex")}` : `tool-${index}`;
+  return call.id ? `id-${createHash13("sha256").update(call.id).digest("hex")}` : `tool-${index}`;
 }
 function toolCallSettled(call) {
   if (call.resultReceived)
@@ -44627,9 +44655,10 @@ var MonolithCornerTurnLoop = class {
   modelTakesImages;
   /** The one provider re-pinned after an empty completion, until the session ends. */
   pinnedProviderOverride;
-  /** The worker's yolo mode baked into the current session. */
-  yoloMode = false;
-  /** Identity-only reviewer context; the exact PR head is refreshed inside each active turn. */
+  /**
+   * Identity-only reviewer context, set when this agent holds the Room's
+   * reviewer post; the exact PR head is refreshed inside each review turn.
+   */
   reviewerInstructionInput;
   /** The role-specific second-chance instruction for this session. */
   /** Repository state already given a delivery reminder, until that state changes. */
@@ -44915,17 +44944,13 @@ var MonolithCornerTurnLoop = class {
     ]);
     const { hostRoutes: grantedHostRoutes, devices: grantedDevices } = grants;
     const self = roster.members.find((member) => member.identityId === this.agent.publicKey);
-    this.yoloMode = configuration.yoloMode;
     const opener = this.options.openedBy ? roster.members.find((member) => member.identityId === this.options.openedBy) : void 0;
-    const reviewerInput = {
-      isReviewer: configuration.isReviewer === true,
-      authorHandle: opener?.handle,
-      openedByAgent: !this.options.openedBy || this.options.openedBy === this.agent.publicKey
-    };
-    const reviewerInstruction = cornerReviewerInstruction(reviewerInput) ? CORNER_REVIEWER_SESSION_INSTRUCTION : void 0;
-    this.reviewerInstructionInput = reviewerInstruction ? reviewerInput : void 0;
-    const selfReviewerInstruction = cornerSelfReviewerInstruction(reviewerInput);
-    this.sessionSurface = !this.options.repository ? "no-code-corner" : reviewerInstruction ? "review-corner" : "code-corner";
+    const reviewer = Boolean(this.options.repository) && configuration.isReviewer === true;
+    this.reviewerInstructionInput = reviewer ? {
+      isReviewer: true,
+      ...opener?.handle && opener.identityId !== this.agent.publicKey ? { authorHandle: opener.handle } : {}
+    } : void 0;
+    this.sessionSurface = this.options.repository ? "code-corner" : "repo-less-corner";
     this.repositoryWork = cornerHasRepositoryWork(restored.brief);
     const cornerPrepareScript = await hasCornerPrepareScript(this.options.worktreePath);
     this.sessionPromptContext = {
@@ -44933,8 +44958,7 @@ var MonolithCornerTurnLoop = class {
       surface: this.sessionSurface,
       agentName: self?.name ?? this.agent.name,
       ...configuration.reviewerHandle ? { reviewerHandle: configuration.reviewerHandle } : {},
-      selfReviewer: Boolean(selfReviewerInstruction),
-      yoloMode: configuration.yoloMode,
+      reviewer,
       cornerPrepareScript
     };
     await mkdir26(this.options.worktreePath, { recursive: true });
@@ -44964,7 +44988,7 @@ var MonolithCornerTurnLoop = class {
       root: this.options.config.agentHomeRoot,
       squireScope,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      isReviewer: Boolean(reviewerInstruction),
+      isReviewer: reviewer,
       grantedHostRoutes: mountedHostRoutes,
       extraHostRoutes: registryHostDeclarations,
       resourceAuthFile,
@@ -45150,9 +45174,8 @@ var MonolithCornerTurnLoop = class {
         workspaceId: this.options.workspaceId,
         cornerId: this.options.cornerId,
         agentMayCloseCorner: Boolean(repository),
-        agentMayUpgradeCorner: this.options.agentMayUpgradeCorner,
-        reviewer: Boolean(reviewerInstruction),
-        lane: this.options.lane ?? (repository ? "code" : "no_code"),
+        reviewer,
+        repositoryBacked: Boolean(repository),
         attachRoot: this.options.worktreePath,
         // The whole per-session overlay, not an enumerated subset: see
         // `monolith-room-turn.ts`'s matching comment.
@@ -45190,7 +45213,6 @@ var MonolithCornerTurnLoop = class {
         }
       } : {},
       ...this.options.requesterHandle ? { requesterHandle: this.options.requesterHandle } : {},
-      ...this.options.agentMayUpgradeCorner ? { agentMayUpgradeCorner: true } : {},
       ...agentEnv.BEELINE_ANDROID_EMULATOR_PORT ? { android: { emulatorPort: agentEnv.BEELINE_ANDROID_EMULATOR_PORT } } : {}
     });
     this.turnSessionPrefix = session.turnPrefix;
@@ -45301,24 +45323,6 @@ var MonolithCornerTurnLoop = class {
   servingProviders() {
     return this.pinnedProviderOverride ? [this.pinnedProviderOverride] : this.pinnedProviders;
   }
-  /**
-   * Did this corner's lane already move under the running turn?
-   *
-   * The upgrade is a server fact, and only the server can say it happened: a
-   * harness that reports no tool calls at all (`cursor-acp-bridge.ts` emits
-   * message chunks only) would otherwise finish its turn believing it still
-   * owns write authority the upgrade has already spent. One bounded read, and
-   * only where an upgrade is possible — the tool is mounted nowhere else.
-   */
-  async laneUpgradeCommitted() {
-    if (this.options.lane !== "no_code" || !this.options.agentMayUpgradeCorner)
-      return false;
-    const state = await this.options.api.execute("getCornerRestoreState", { cornerId: this.options.cornerId }).catch((error) => {
-      console.error(`[thin-core] corner ${this.options.cornerId} lane read failed:`, error);
-      return void 0;
-    });
-    return Boolean(state?.lane && state.lane !== "no_code");
-  }
   /** Why a turn carried no answer text, or undefined when it did. */
   async explainEmpty(result) {
     if (durableReplyText(result.agentText))
@@ -45412,7 +45416,6 @@ var MonolithCornerTurnLoop = class {
       await trace.finish(outcome, reason);
     };
     let deliberateNoReply = false;
-    let laneUpgraded = false;
     try {
       await withTurnReceiptHeartbeat(api, {
         agentId: this.agent.publicKey,
@@ -45431,6 +45434,7 @@ var MonolithCornerTurnLoop = class {
           this.turnMetrics = {};
           this.turnUsage = new TurnUsageAccumulator();
           await this.syncBranch();
+          const reviewTurn = isCornerReviewTurn(Boolean(this.reviewerInstructionInput), trigger);
           const [conversation, roster, restored, activeReviewerInstruction, institutionalContext, memberCorners] = await trace.measure("context-fetch", () => Promise.all([
             api.execute("getRoomConversation", {
               roomId: cornerId,
@@ -45439,7 +45443,7 @@ var MonolithCornerTurnLoop = class {
             }),
             this.roster(),
             api.execute("getCornerRestoreState", { cornerId }),
-            this.activeReviewerInstruction(),
+            reviewTurn ? this.activeReviewerInstruction() : void 0,
             awaitInstitutionalContext(institutionalContextFetch, (message) => console.warn(`[thin-core] corner ${cornerId}: ${message}`)),
             api.execute("listRoomCorners", { roomId: this.options.parentRoomId })
           ]));
@@ -45464,7 +45468,7 @@ var MonolithCornerTurnLoop = class {
             const briefDelivered = this.attachmentDir && briefAttachments.length ? await deliverAttachments(briefAttachments, join20(this.attachmentDir, requestId.replace(/[^\w-]/g, "_"), "brief", String(assignedBrief.revision)), this.options.fetchImpl) : [];
             briefFileLines = await Promise.all((assignedBrief?.attachments ?? []).map(async (file, index) => {
               const entry = briefDelivered.find((item) => item.attachment === briefAttachments[index]);
-              const verified = entry?.path && createHash14("sha256").update(await readFile30(entry.path)).digest("hex") === file.sha256;
+              const verified = entry?.path && createHash13("sha256").update(await readFile30(entry.path)).digest("hex") === file.sha256;
               return `- ${file.title} (${file.purpose}; ${file.required ? "required" : "optional"}; sha256 ${file.sha256}): ${verified ? entry.path : "UNAVAILABLE OR CONTENT MISMATCH"}`;
             }));
             missingRequiredBriefFile = (assignedBrief?.attachments ?? []).some((file, index) => file.required && briefFileLines[index]?.includes("UNAVAILABLE OR CONTENT MISMATCH"));
@@ -45580,8 +45584,6 @@ var MonolithCornerTurnLoop = class {
           let activityAttempt = 0;
           const publishToolCalls = (calls, settledOnly, exceptKey) => {
             calls.forEach((call, index) => {
-              if (spentAuthorityOnLaneUpgrade(call))
-                return;
               const key = `${activityAttempt}:${toolCallKey(call, index)}`;
               if (settledOnly && !observedToolCalls.has(key)) {
                 observedToolCalls.add(key);
@@ -45732,12 +45734,6 @@ ${continuation}` : assembled;
           };
           let result = await runPrompt();
           trace.promptSettled();
-          laneUpgraded = await this.laneUpgradeCommitted();
-          if (laneUpgraded) {
-            console.log(`[thin-core] corner ${cornerId} turn ${requestId} upgraded to the code lane`);
-            await stream.retract();
-            return;
-          }
           const grantedDevice = approvedDeviceGrant(result.toolCalls);
           if (grantedDevice) {
             await flushToolCalls(result.toolCalls, "");
@@ -45778,19 +45774,19 @@ ${continuation}` : assembled;
           let refreshedReviewerInstruction;
           let reviewerSecondPass = false;
           let reviewerTargetChanged = false;
-          if (!explained && checksTurn && this.reviewerInstructionInput) {
+          if (!explained && reviewTurn) {
             await this.syncBranch();
             refreshedReviewerInstruction = await this.activeReviewerInstruction();
             reviewerTargetChanged = refreshedReviewerInstruction !== activeReviewerInstruction;
-            reviewerSecondPass = reviewerTargetChanged || !result.toolCalls.some((call) => /(?:^|[._:/-])(?:approve_merge|record_validation_stage)$/i.test(call.title ?? "") && isCompletedToolCall(call));
+            reviewerSecondPass = reviewerTargetChanged || !result.toolCalls.some((call) => /(?:^|[._:/-])approve_merge$/i.test(call.title ?? "") && isCompletedToolCall(call));
           }
           let replyBeforeNudge = "";
-          if (!explained && (needsDeliveryNudge || checksTurn && (this.reviewerInstructionInput ? reviewerSecondPass : repositoryWork && !repositoryHeld && this.yoloMode && !result.toolCalls.some((call) => /(?:^|[._:/-])pr_checks_status$/i.test(call.title ?? "") && isCompletedToolCall(call))))) {
+          if (!explained && (needsDeliveryNudge || checksTurn && (reviewTurn ? reviewerSecondPass : repositoryWork && !repositoryHeld && !result.toolCalls.some((call) => /(?:^|[._:/-])pr_checks_status$/i.test(call.title ?? "") && isCompletedToolCall(call))))) {
             if (needsDeliveryNudge)
               this.lastDeliveryNudgeState = deliveryState;
             await flushToolCalls(result.toolCalls, "");
             replyBeforeNudge = durableReplyText(stream.remainderOf(result.agentText));
-            result = await runPrompt(this.reviewerInstructionInput ? refreshedReviewerInstruction ?? CORNER_REVIEWER_SESSION_INSTRUCTION : checksTurn ? CORNER_YOLO_MERGE_NUDGE : CORNER_DELIVERY_NUDGE);
+            result = await runPrompt(reviewTurn ? refreshedReviewerInstruction ?? CORNER_REVIEWER_SESSION_INSTRUCTION : checksTurn ? CORNER_CHECKS_NUDGE : CORNER_DELIVERY_NUDGE);
             trace.promptSettled();
             explained = await this.explainEmpty(result);
           }
@@ -45836,10 +45832,6 @@ ${continuation}` : assembled;
         console.warn(`[thin-core] corner ${cornerId} turn ${requestId} dropped: the server revoked its output authority`);
         this.stopTurn(requestId);
       });
-      if (laneUpgraded) {
-        void finishTrace("complete").catch(() => void 0);
-        return;
-      }
       startTraceStats();
       await api.execute("postAgentTurnReceipt", {
         agentId: this.agent.publicKey,
@@ -45858,12 +45850,6 @@ ${continuation}` : assembled;
         void finishTrace("cancelled").catch(() => void 0);
         return;
       }
-      laneUpgraded ||= await this.laneUpgradeCommitted();
-      if (laneUpgraded) {
-        console.log(`[thin-core] corner ${cornerId} turn ${requestId} ended after its lane upgrade:`, error);
-        void finishTrace("complete").catch(() => void 0);
-        return;
-      }
       const reason = distillTurnFailureReason(error);
       startTraceStats();
       await api.execute("postAgentTurnReceipt", {
@@ -45942,16 +45928,19 @@ ${continuation}` : assembled;
     if (!repository)
       return;
     let token;
-    for (let attempt = 0; attempt < 3; attempt += 1) {
+    const outageDeadline = Date.now() + GITHUB_OUTAGE_WAIT_MS;
+    for (let attempt = 0; ; attempt += 1) {
       try {
         token = (await this.options.api.execute("getRoomGitHubToken", {
           roomId: this.options.parentRoomId
         })).token;
         break;
       } catch (error) {
-        if (attempt === 2)
+        const outage = error instanceof DaemonApiError && error.status === 502;
+        const delay = outage ? Math.min(2e3 * 2 ** attempt, 3e4) : 250 * (attempt + 1);
+        if ((outage ? Date.now() + delay > outageDeadline : attempt === 2) || this.forcedStop || this.currentTurn && this.stoppedTurns.has(this.currentTurn.requestId))
           throw error;
-        await new Promise((resolve45) => setTimeout(resolve45, 250 * (attempt + 1)));
+        await new Promise((resolve45) => setTimeout(resolve45, delay));
       }
     }
     if (!token)
@@ -46029,10 +46018,6 @@ ${continuation}` : assembled;
           return false;
         this.reconcileCloseRequested = false;
         const state = await api.execute("getCornerRestoreState", { cornerId });
-        if (this.options.lane === "no_code" && state.lane !== "no_code") {
-          this.options.onLaneChanged?.();
-          return true;
-        }
         if (!state.closeRequested)
           return false;
         await this.harvest;
@@ -46562,7 +46547,7 @@ function cornerStartConfigKey(repository, objective) {
 }
 function cornerRepositoryCacheDir(supervisorRoot, remote) {
   const normalizedRemote = roomCheckoutRemote(remote);
-  const repositoryHash = createHash15("sha256").update(normalizedRemote).digest("hex").slice(0, 24);
+  const repositoryHash = createHash14("sha256").update(normalizedRemote).digest("hex").slice(0, 24);
   return resolve38(supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
 }
 function isStandingCornerStartFault(error) {
@@ -46737,6 +46722,7 @@ async function removeCornerWorktreeAndBranches(worktree, options = {}) {
     if (head === localRef) {
       throw new Error(`refusing to delete repository HEAD ${localRef}`);
     }
+    await assertLocalBranchPublished(worktree);
   }
   if (!preserveRemoteBranch) {
     await deleteExactRemoteBranch(worktree.gitCommonDir, remoteRef, worktree.token);
@@ -46757,26 +46743,38 @@ async function assertCornerWorktreePublished(worktree) {
   const originalHead = (await execFileAsync8("git", ["-C", worktree.path, "rev-parse", "--verify", "HEAD"])).stdout.trim();
   if (await status())
     throw new Error(`corner ${worktree.cornerId} has unpushed working-tree work`);
-  let published = await originContains(worktree.gitCommonDir, originalHead);
+  await assertPublishedOnOrigin(worktree.gitCommonDir, originalHead, worktree.cornerId, worktree.token);
+  const settledHead = (await execFileAsync8("git", ["-C", worktree.path, "rev-parse", "--verify", "HEAD"])).stdout.trim();
+  if (settledHead !== originalHead || await status()) {
+    throw new Error(`corner ${worktree.cornerId} changed during cleanup`);
+  }
+}
+async function assertLocalBranchPublished(worktree) {
+  const head = (await execFileAsync8("git", [
+    `--git-dir=${worktree.gitCommonDir}`,
+    "rev-parse",
+    "--verify",
+    `refs/heads/${worktree.branch}`
+  ])).stdout.trim();
+  await assertPublishedOnOrigin(worktree.gitCommonDir, head, worktree.cornerId, worktree.token);
+}
+async function assertPublishedOnOrigin(gitCommonDir, head, cornerId, token) {
+  let published = await originContains(gitCommonDir, head);
   if (!published) {
     await execFileAsync8("git", [
-      `--git-dir=${worktree.gitCommonDir}`,
+      `--git-dir=${gitCommonDir}`,
       "fetch",
       "--prune",
       "origin",
       "+refs/heads/*:refs/remotes/origin/*"
-    ], { env: githubGitEnv(worktree.token), maxBuffer: 4 * 1024 * 1024 });
-    published = await originContains(worktree.gitCommonDir, originalHead);
+    ], { env: githubGitEnv(token), maxBuffer: 4 * 1024 * 1024 });
+    published = await originContains(gitCommonDir, head);
   }
   if (!published)
-    throw new Error(`corner ${worktree.cornerId} has unpushed commits`);
-  const settledHead = (await execFileAsync8("git", ["-C", worktree.path, "rev-parse", "--verify", "HEAD"])).stdout.trim();
-  if (settledHead !== originalHead || await status()) {
-    throw new Error(`corner ${worktree.cornerId} changed during cleanup`);
-  }
+    throw new Error(`corner ${cornerId} has unpushed commits`);
 }
-function hasUnpushedCommits(error) {
-  return error instanceof Error && / has unpushed commits$/.test(error.message);
+function hasUnpublishedWork(error) {
+  return error instanceof Error && / has unpushed (?:commits|working-tree work)$/.test(error.message);
 }
 async function originContains(gitCommonDir, head) {
   const result = await execFileAsync8("git", [
@@ -46883,8 +46881,11 @@ var RoomRuntimeCoordinator = class {
     this.connectorUsage = new ConnectorUsageRecorder();
     this.options.daemonApi.setRoomsChangedListener?.((event) => {
       if (event?.repositoryChanged) {
-        if (event.roomId)
+        if (event.roomId) {
           this.invalidateParentRepository(event.roomId);
+          void this.refreshRoomCorners(event.roomId);
+          return;
+        }
         this.wakeDiscovery();
         return;
       }
@@ -46898,9 +46899,6 @@ var RoomRuntimeCoordinator = class {
     this.options.daemonApi.setCornerCompleteListener?.((roomId) => {
       void this.applyCornerComplete(roomId).catch((error) => console.error("[thin-core] live corner-complete apply failed", error));
     });
-    this.options.daemonApi.setCornerRestartListener?.((roomId) => {
-      void this.applyCornerRestart(roomId).catch((error) => console.error("[thin-core] live corner-restart apply failed", error));
-    });
     this.options.daemonApi.setConfigChangedListener?.(() => {
       void this.scheduler.suspendIdle().catch((error) => console.error("[body] config-change session restart failed", error));
       void Promise.resolve(this.options.onConfigChanged?.()).catch((error) => console.error("[body] config-change catalog refresh failed", error));
@@ -47218,27 +47216,14 @@ var RoomRuntimeCoordinator = class {
   async applyCornerComplete(cornerId) {
     this.running.get(cornerId)?.body.requestClose?.();
   }
-  /** Retire the scratch runtime. Ordinary desired-state reconciliation starts
-   * the same corner id again and re-reads its now-code lane. */
-  async applyCornerRestart(cornerId) {
-    if (this.stopped)
-      return;
-    const running = this.running.get(cornerId);
-    if (!running) {
-      this.wakeDiscovery();
-      return;
-    }
-    await this.stopRunning(cornerId, running, true);
-    this.wakeDiscovery();
-  }
-  async stopRunning(channelId, running, preserveScratch = false) {
+  async stopRunning(channelId, running) {
     this.deferredRepositoryRestarts.delete(channelId);
     running.controller.abort();
     await running.promise.catch(() => void 0);
     try {
       if (running.worktree)
         await this.reapCornerWorktree(running.worktree);
-      else if (running.scratch && !preserveScratch)
+      else if (running.scratch)
         await this.reapCornerScratch(running.scratch);
     } catch (error) {
       console.error(`[thin-core] corner ${channelId} cleanup failed; will retry:`, error);
@@ -47353,7 +47338,7 @@ var RoomRuntimeCoordinator = class {
       return this.roomRoot(roomId);
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
-    const checkoutId = createHash15("sha256").update(`${roomId}\0${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
+    const checkoutId = createHash14("sha256").update(`${roomId}\0${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
     const path = resolve38(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
     await mkdir27(dirname27(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.parentRepositoryToken(roomId) : void 0;
@@ -47432,12 +47417,9 @@ var RoomRuntimeCoordinator = class {
       if (repository.resolution === "repository" && (!repository.remote || !repository.key)) {
         throw new Error("corner parent Room has an incomplete repository binding");
       }
-      if (!objective)
+      if (!objective && restore.kind !== "human")
         throw new Error("corner has no authoritative objective fact");
-      const repositoryBacked = repository.resolution === "repository" && restore.lane !== "no_code";
-      const scratchPath = resolve38(this.roomRoot(corner.cornerId), "scratch");
-      if (repositoryBacked && existsSync10(scratchPath) && !restore.featureBranch)
-        throw new Error("promoted corner has no server-assigned feature branch");
+      const repositoryBacked = repository.resolution === "repository";
       const targetBranch = repositoryBacked ? repository.targetBranch || "main" : void 0;
       const featureBranch = repositoryBacked ? restore.featureBranch ?? `feature/corner-${corner.cornerId.replaceAll("-", "").slice(0, 12)}` : void 0;
       const granted = repositoryBacked ? await this.cornerRepositoryToken(corner.parentRoomId) : void 0;
@@ -47448,8 +47430,6 @@ var RoomRuntimeCoordinator = class {
         featureBranch,
         token: granted.token
       }) : void 0;
-      if (worktree && existsSync10(scratchPath))
-        await this.reapCornerScratch({ path: scratchPath, cornerId: corner.cornerId });
       const workspacePath = worktree?.path ?? resolve38(this.roomRoot(corner.cornerId), "scratch");
       if (!worktree)
         await mkdir27(workspacePath, { recursive: true, mode: 448 });
@@ -47473,8 +47453,6 @@ var RoomRuntimeCoordinator = class {
         ...corner.openedBy ? { openedBy: corner.openedBy } : {},
         objective,
         worktreePath: workspacePath,
-        lane: restore.lane,
-        agentMayUpgradeCorner: repository.resolution === "repository" && restore.lane === "no_code",
         ...restore.requesterHandle ? { requesterHandle: restore.requesterHandle } : {},
         ...worktree ? {
           repository: {
@@ -47499,7 +47477,6 @@ var RoomRuntimeCoordinator = class {
           parentRoomId: corner.parentRoomId,
           token: ""
         }) : this.reapCornerScratch({ path: workspacePath, cornerId: corner.cornerId }),
-        onLaneChanged: () => void this.applyCornerRestart(corner.cornerId).catch((error) => console.error("[thin-core] corner lane-change restart failed", error)),
         onRestartRequested: () => this.requestLifecycleRestart(),
         canStartTurn: () => !this.restartRequested,
         supervisor: this.supervisor
@@ -47536,7 +47513,7 @@ var RoomRuntimeCoordinator = class {
       });
       this.standingCornerStartFaults.delete(corner.cornerId);
       this.reportedCornerStartFailures.delete(corner.cornerId);
-      console.log(worktree ? `[thin-core] serving corner ${corner.cornerId} on ${featureBranch} at ${workspacePath}` : `[thin-core] serving no-code corner ${corner.cornerId} at ${workspacePath}`);
+      console.log(worktree ? `[thin-core] serving corner ${corner.cornerId} on ${featureBranch} at ${workspacePath}` : `[thin-core] serving repo-less corner ${corner.cornerId} at ${workspacePath}`);
     } catch (error) {
       this.surfaceHealth.degraded(corner.cornerId, "corner failed to start");
       console.error(`[thin-core] failed to start corner ${corner.cornerId}:`, error);
@@ -47613,6 +47590,61 @@ var RoomRuntimeCoordinator = class {
     this.tokenCache.delete(roomId);
     this.tokenFlights.delete(roomId);
   }
+  /**
+   * A repository-change event names its own Room, so only that Room's
+   * corners need a fresh listing; re-listing every Room's corners for one
+   * Room's push would repeat that read for every other Room on each push.
+   * Only new or newly-unarchived corners are started here - removals and
+   * archived-corner cleanup stay on the regular reconcile pass. The named
+   * Room itself is restarted the same way a full reconcile would, so a
+   * running Room picks up the change (a new GitHub installation, a token) too.
+   */
+  async refreshRoomCorners(roomId) {
+    if (this.stopped)
+      return;
+    try {
+      await this.restartRunningRoomForRepositoryChange(roomId);
+      if (this.stopped)
+        return;
+      const result = await this.options.daemonApi.execute("listRoomCorners", { roomId });
+      for (const corner of result.corners) {
+        this.monolithCornerParents.set(corner.cornerId, roomId);
+        if (corner.archived)
+          continue;
+        this.surfaceHealth.discover(corner.cornerId, "corner");
+        this.roomRemovalConfirmations.delete(corner.cornerId);
+        if (this.running.has(corner.cornerId) || this.startingCorners.has(corner.cornerId))
+          continue;
+        await this.watchCorner({
+          cornerId: corner.cornerId,
+          parentRoomId: roomId,
+          ...corner.createdBy ? { openedBy: corner.createdBy } : {}
+        });
+      }
+    } catch (error) {
+      console.error(`[thin-core] scoped corner refresh failed for Room ${roomId}:`, error);
+      this.wakeDiscovery();
+    }
+  }
+  /**
+   * Same stop/restart (or, mid-turn, defer-to-`notePoll`) a full reconcile
+   * applies to a Room whose `repositoryRevision` changed, for the one Room a
+   * live repository-change event names. A no-op when that id names nothing
+   * currently running - e.g. a Room whose corners changed but is not itself
+   * being served, or a corner id, which this event never actually names.
+   */
+  async restartRunningRoomForRepositoryChange(roomId) {
+    const running = this.running.get(roomId);
+    if (!running)
+      return;
+    if (running.body.isBusy()) {
+      this.deferredRepositoryRestarts.add(roomId);
+      return;
+    }
+    await this.stopRunning(roomId, running);
+    if (!this.stopped)
+      await this.startRoom(roomId);
+  }
   async parentRepositoryState(roomId) {
     const cached = this.repositoryStateCache.get(roomId);
     if (cached && cached.until > this.now())
@@ -47729,9 +47761,9 @@ var RoomRuntimeCoordinator = class {
       try {
         await this.reapCornerWorktree(worktree);
       } catch (error) {
-        if (hasUnpushedCommits(error)) {
+        if (hasUnpublishedWork(error)) {
           this.archiveCleanupAbandoned.add(cornerId);
-          console.error(`[thin-core] corner ${cornerId} branch cleanup abandoned; unpushed commits kept:`, error);
+          console.error(`[thin-core] corner ${cornerId} branch cleanup abandoned; unpublished work kept:`, error);
           continue;
         }
         this.deferArchiveCleanup(cornerId);