usebeeline 0.1.3 → 0.1.4

package/dist/usebeeline.mjs

@@ -9711,7 +9711,7 @@ var init_squire_host = __esm({
 
 // apps/body/dist/systemd.js
 import { execFile as execFile2 } from "node:child_process";
-import { mkdir as mkdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir2, readFile as readFile3, rename as rename2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname3, resolve as resolve3 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -9740,6 +9740,7 @@ CPUWeight=1000
 IOWeight=1000
 Nice=-5
 OOMScoreAdjust=-1000
+OOMPolicy=continue
 TimeoutStartSec=90s
 TimeoutStopSec=90s
 KillMode=control-group
@@ -9812,6 +9813,26 @@ async function convergeTrustySquireBrokerService(options) {
     return false;
   }
 }
+async function convergeAgentServiceUnit(options) {
+  const env = options.env ?? process.env;
+  try {
+    assertCanonicalInstalledLauncher(env, resolve3(options.libDir, "lib", "beeline", "beeline-cli.mjs"));
+    const path = systemdUserUnitPath(env);
+    const content = agentServiceUnit();
+    const existing = await readFile3(path, "utf8").catch(() => "");
+    if (existing === content)
+      return false;
+    await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+    await writeFile2(path, content, { mode: 384 });
+    const run2 = options.run ?? runSystemctl;
+    await run2(["daemon-reload"]);
+    options.log?.("[beeline] agent systemd unit updated; it applies on the next daemon restart");
+    return true;
+  } catch (error) {
+    options.log?.(`[beeline] agent systemd unit not converged: ${error instanceof Error ? error.message : String(error)}`);
+    return false;
+  }
+}
 async function installAgentService(publicKey, options = {}) {
   if (!/^[0-9a-f]{64}$/i.test(publicKey))
     throw new Error("agent public key must be 64 hex");
@@ -9844,6 +9865,23 @@ async function installAgentService(publicKey, options = {}) {
   } while (Date.now() < deadline);
   throw new Error(`systemd did not replace ${service}'s MainPID before the restart deadline`);
 }
+async function rewriteAgentServiceUnit(options) {
+  const env = options.env ?? process.env;
+  assertCanonicalInstalledLauncher(env, options.invocationPath);
+  const path = systemdUserUnitPath(env);
+  const content = agentServiceUnit();
+  const run2 = options.run ?? runSystemctl;
+  return options.lock(async () => {
+    if (await readFile3(path, "utf8").catch(() => "") === content)
+      return false;
+    await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+    const staged = `${path}.${process.pid}.tmp`;
+    await writeFile2(staged, content, { mode: 384 });
+    await rename2(staged, path);
+    await run2(["daemon-reload"]);
+    return true;
+  });
+}
 async function serviceStatus(run2, service) {
   const status = await run2([
     "show",
@@ -9947,8 +9985,10 @@ async function notify(fields) {
 async function extendSystemdStartTimeout(ms) {
   await notify([`EXTEND_TIMEOUT_USEC=${Math.max(0, Math.round(ms)) * 1e3}`]).catch(() => void 0);
 }
-function startLocalWatchdog(notifier, status, intervalMs = 6e4) {
-  const timer = setInterval(() => void notifier.progress(status()), intervalMs);
+function startLocalWatchdog(notifier, status, intervalMs = 6e4, env = process.env) {
+  if (!env.WATCHDOG_USEC)
+    return () => void 0;
+  const timer = setInterval(() => void notifier.progress(status()).catch((error) => console.error("[thin-core] watchdog notification failed:", error)), intervalMs);
   timer.unref?.();
   return () => clearInterval(timer);
 }
@@ -9990,7 +10030,7 @@ var init_systemd = __esm({
 // apps/body/dist/launchd.js
 import { execFile as execFile3 } from "node:child_process";
 import { realpathSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile4, readdir as readdir2, rename as rename2, rm, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile4, readdir as readdir2, rename as rename3, rm, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname4, resolve as resolve4 } from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
@@ -10158,7 +10198,7 @@ async function writeManagedFile(path, content, mode) {
   const pending = `${path}.${process.pid}.pending`;
   await writeFile3(pending, content, { mode });
   await chmod2(pending, mode);
-  await rename2(pending, path);
+  await rename3(pending, path);
   return true;
 }
 function launchctlFailureText(error) {
@@ -10409,7 +10449,7 @@ __export(self_update_exports, {
 });
 import { createHash } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { access, chmod as chmod3, lstat, mkdir as mkdir4, open, readFile as readFile5, rename as rename3, rm as rm2, symlink, writeFile as writeFile4 } from "node:fs/promises";
+import { access, chmod as chmod3, lstat, mkdir as mkdir4, open, readFile as readFile5, rename as rename4, rm as rm2, symlink, writeFile as writeFile4 } from "node:fs/promises";
 import { spawn as spawn4 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { dirname as dirname5, join as join3, resolve as resolve5 } from "node:path";
@@ -10712,7 +10752,7 @@ async function replaceFile(path, contents, mode) {
   const temp = `${path}.new-${process.pid}`;
   await writeFile4(temp, contents, { mode });
   await chmod3(temp, mode);
-  await rename3(temp, path);
+  await rename4(temp, path);
 }
 async function activateRelease(layout, releaseId) {
   const releaseDir = join3(layout.releasesRoot, releaseId);
@@ -10728,10 +10768,10 @@ async function activateRelease(layout, releaseId) {
     try {
       await access(legacyDir, fsConstants2.F_OK);
       previousReleaseId = `${legacyId}-${Date.now()}`;
-      await rename3(layout.libDir, join3(layout.releasesRoot, previousReleaseId));
+      await rename4(layout.libDir, join3(layout.releasesRoot, previousReleaseId));
       await normalizeLegacyBundleShape(join3(layout.releasesRoot, previousReleaseId));
     } catch {
-      await rename3(layout.libDir, legacyDir);
+      await rename4(layout.libDir, legacyDir);
       await normalizeLegacyBundleShape(legacyDir);
       previousReleaseId = legacyId;
     }
@@ -10739,7 +10779,7 @@ async function activateRelease(layout, releaseId) {
   const tempLink = `${layout.libDir}.new-${process.pid}`;
   await rm2(tempLink, { force: true });
   await symlink(join3("beeline-releases", releaseId), tempLink);
-  await rename3(tempLink, layout.libDir);
+  await rename4(tempLink, layout.libDir);
   await fsyncDir(dirname5(layout.libDir));
   await writeBinForwarders(layout, releaseDir);
   return { previousReleaseId };
@@ -10764,7 +10804,7 @@ async function normalizeLegacyBundleShape(bundleDir) {
       continue;
     } catch {
     }
-    await rename3(join3(bundleDir, name), join3(innerLib, name)).catch(() => void 0);
+    await rename4(join3(bundleDir, name), join3(innerLib, name)).catch(() => void 0);
   }
 }
 async function writeBinForwarders(layout, activeBundleRoot) {
@@ -10815,7 +10855,7 @@ async function rollbackToPreviousRelease(layout, previousReleaseId) {
   const tempLink = `${layout.libDir}.rollback-${process.pid}`;
   await rm2(tempLink, { force: true });
   await symlink(join3("beeline-releases", previousReleaseId), tempLink);
-  await rename3(tempLink, layout.libDir);
+  await rename4(tempLink, layout.libDir);
   await fsyncDir(dirname5(layout.libDir));
 }
 function updateAttemptPath(layout) {
@@ -10838,7 +10878,7 @@ async function writeUpdateAttempt(layout, record6) {
   const staged = `${path}.${process.pid}.tmp`;
   await writeFile4(staged, `${JSON.stringify(record6, null, 2)}
 `, { mode: 384 });
-  await rename3(staged, path);
+  await rename4(staged, path);
 }
 async function replaceUpdateAttempt(layout, record6) {
   await writeUpdateAttempt(layout, record6);
@@ -10925,7 +10965,6 @@ var init_self_update = __esm({
       fetchImpl;
       log;
       stageOnly;
-      timer;
       nextCheckAllowedAt = 0;
       disposed = false;
       applying = false;
@@ -10942,9 +10981,7 @@ var init_self_update = __esm({
         };
         this.options = {
           layout: options.layout,
-          tickMs: options.tickMs ?? numberEnv2("BEELINE_UPDATE_TICK_MS", 6e4),
           checkIntervalMs: options.checkIntervalMs ?? numberEnv2("BEELINE_UPDATE_INTERVAL_MS", 6 * 60 * 6e4),
-          initialDelayMs: options.initialDelayMs ?? numberEnv2("BEELINE_UPDATE_INITIAL_DELAY_MS", 2 * 6e4),
           idleTimeoutMs: options.idleTimeoutMs ?? numberEnv2("BEELINE_UPDATE_IDLE_TIMEOUT_MS", 30 * 6e4),
           idlePollMs: options.idlePollMs ?? 5e3,
           env,
@@ -10956,20 +10993,8 @@ var init_self_update = __esm({
         this.log = options.logger ?? ((line) => console.log(line));
         this.stageOnly = options.stageOnly ?? false;
       }
-      start() {
-        if (this.timer || this.disposed)
-          return;
-        this.nextCheckAllowedAt = this.options.now() + this.options.initialDelayMs;
-        this.timer = setInterval(() => {
-          void this.tick();
-        }, this.options.tickMs);
-        this.timer.unref?.();
-      }
       dispose() {
         this.disposed = true;
-        if (this.timer)
-          clearInterval(this.timer);
-        this.timer = void 0;
       }
       busy() {
         return !this.isIdle();
@@ -11087,6 +11112,11 @@ var init_self_update = __esm({
             env: this.options.env,
             log: this.log
           });
+          await convergeAgentServiceUnit({
+            libDir: this.options.layout.libDir,
+            env: this.options.env,
+            log: this.log
+          });
         } else if (process.platform === "darwin" && this.options.env.BEELINE_LAUNCHD_USER !== "0") {
           await convergeLaunchdTrustySquireBrokerService({
             libDir: this.options.layout.libDir,
@@ -11251,7 +11281,7 @@ var init_cursor_models = __esm({
 // apps/body/dist/cursor-acp-bridge.js
 import { spawn as spawn6 } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
-import { chmod as chmod4, lstat as lstat2, mkdir as mkdir6, rename as rename4, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
+import { chmod as chmod4, lstat as lstat2, mkdir as mkdir6, rename as rename5, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
 import { createRequire as createRequire3 } from "node:module";
 import { createInterface as createInterface3 } from "node:readline";
 import { basename, dirname as dirname7, resolve as resolvePath } from "node:path";
@@ -11324,7 +11354,7 @@ async function writeIsolatedCursorFile(path, content) {
   try {
     await writeFile5(temporary, content, { mode: 384, flag: "wx" });
     await chmod4(temporary, 384);
-    await rename4(temporary, path);
+    await rename5(temporary, path);
   } finally {
     await unlink3(temporary).catch(() => void 0);
   }
@@ -26668,6 +26698,11 @@ var ARTIFACT_EXTENSIONS_BY_MIME = {
   "application/json": [".json"],
   "text/csv": [".csv"],
   "application/zip": [".zip"],
+  "video/mp4": [".mp4", ".m4v"],
+  "video/quicktime": [".mov"],
+  "video/webm": [".webm"],
+  "audio/mpeg": [".mp3"],
+  "audio/wav": [".wav"],
   "application/octet-stream": []
 };
 var ARTIFACT_MIME_BY_EXTENSION = Object.fromEntries(Object.entries(ARTIFACT_EXTENSIONS_BY_MIME).flatMap(([mime, extensions]) => extensions.map((extension2) => [extension2, mime])));
@@ -27787,6 +27822,72 @@ function matchProfile(agentCommand) {
   return void 0;
 }
 
+// apps/body/dist/oom-kill.js
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+var CGROUP_V2_ROOT = "/sys/fs/cgroup";
+function parseOomKillCount(contents) {
+  for (const line of contents.split("\n")) {
+    const [key, raw] = line.trim().split(/\s+/, 2);
+    if (key !== "oom_kill")
+      continue;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value >= 0 ? value : null;
+  }
+  return null;
+}
+function unifiedCgroupPath(procSelfCgroup) {
+  const line = procSelfCgroup.split("\n").map((value) => value.trim()).find((value) => value.startsWith("0::"));
+  const path = line?.slice(3).trim();
+  return path && path.startsWith("/") ? path : null;
+}
+function cgroupOomKillProbe(options = {}) {
+  const readProc = options.procSelfCgroup ?? (() => readFile9("/proc/self/cgroup", "utf8"));
+  const root = options.cgroupRoot ?? CGROUP_V2_ROOT;
+  let directory;
+  return {
+    async read() {
+      try {
+        if (directory === void 0) {
+          const path = unifiedCgroupPath(await readProc());
+          directory = path ? join5(root, path) : null;
+        }
+        if (!directory)
+          return null;
+        return parseOomKillCount(await readFile9(join5(directory, "memory.events"), "utf8"));
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+var OomKillTracker = class {
+  probe;
+  #last = null;
+  #banked = 0;
+  constructor(probe) {
+    this.probe = probe;
+  }
+  /** Record the current count so the next kill is measured against it. */
+  async prime() {
+    const current = await this.probe.read();
+    if (current !== null)
+      this.#last = current;
+  }
+  async consume() {
+    const current = await this.probe.read();
+    if (current === null)
+      return false;
+    if (this.#last !== null && current > this.#last)
+      this.#banked += current - this.#last;
+    this.#last = current;
+    if (this.#banked === 0)
+      return false;
+    this.#banked -= 1;
+    return true;
+  }
+};
+
 // apps/body/dist/acp.js
 var STDERR_TAIL_MAX_CHARS2 = 2e3;
 function braceDelta(line) {
@@ -28122,6 +28223,9 @@ var AcpClient = class extends EventEmitter {
   permissionHandler;
   permissionAllowlist;
   commandsHandler;
+  oomKills;
+  /** A deliberate stop owns its SIGKILL; that exit is never labelled OOM. */
+  stopping = false;
   constructor(opts) {
     super();
     const command = opts.agentCommand ?? opts.agentBinary;
@@ -28139,10 +28243,13 @@ var AcpClient = class extends EventEmitter {
     this.permissionHandler = opts.permissionHandler;
     this.permissionAllowlist = opts.permissionAllowlist;
     this.commandsHandler = opts.onCommands;
+    this.oomKills = opts.oomKills ?? new OomKillTracker(cgroupOomKillProbe());
   }
   async start(timeoutMs = 6e4) {
     if (this.alive)
       return;
+    await this.oomKills.prime().catch(() => void 0);
+    this.stopping = false;
     this.child = await withAdapterInstallLock(() => spawn10(this.agentCommand, this.agentArgs, {
       // agentEnv is the child's whole environment: buildAgentEnv's allowlist is
       // a real boundary, not a decorative one layered over a full inherit.
@@ -28164,19 +28271,7 @@ var AcpClient = class extends EventEmitter {
     this.child.stdout.setEncoding("utf8");
     this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.on("exit", (code, signal) => {
-      this.alive = false;
-      const meaningful = flattenHarnessCause(this.stderrTail);
-      const stderrSuffix = meaningful ? `: ${meaningful}` : "";
-      for (const [, p] of this.pending) {
-        this.clearTimer(p);
-        p.reject(new Error(`ACP agent ${this.agentLabel} exited code=${code} signal=${signal}${stderrSuffix}`));
-      }
-      this.pending.clear();
-      this.activeRunIds.clear();
-      this.activePromptSessions.clear();
-      this.toolCallMetadata.clear();
-      this.sessionCommands.clear();
-      this.emit("exit", { code, signal });
+      void this.handleChildExit(code, signal);
     });
     this.child.on("error", (err) => {
       this.alive = false;
@@ -28202,12 +28297,36 @@ var AcpClient = class extends EventEmitter {
     if (!isPiAcpHarness(this.agentLabel))
       this.notify("notifications/initialized", {});
   }
+  /**
+   * One child exit: reject every in-flight request so the turn fails and is
+   * reported instead of hanging, then publish the exit. A SIGKILL is checked
+   * against the daemon cgroup's OOM counter so the rejection can name the real
+   * cause instead of a bare signal.
+   */
+  async handleChildExit(code, signal) {
+    this.alive = false;
+    const oomKilled = signal === "SIGKILL" && !this.stopping && await this.oomKills.consume().catch(() => false);
+    const exitText = oomKilled ? `ACP agent ${this.agentLabel} was killed by the kernel OOM killer (signal=SIGKILL)` : `ACP agent ${this.agentLabel} exited code=${code} signal=${signal}`;
+    const meaningful = flattenHarnessCause(this.stderrTail);
+    const stderrSuffix = meaningful ? `: ${meaningful}` : "";
+    for (const [, p] of this.pending) {
+      this.clearTimer(p);
+      p.reject(new Error(`${exitText}${stderrSuffix}`));
+    }
+    this.pending.clear();
+    this.activeRunIds.clear();
+    this.activePromptSessions.clear();
+    this.toolCallMetadata.clear();
+    this.sessionCommands.clear();
+    this.emit("exit", { code, signal });
+  }
   async stop() {
     if (!this.alive)
       return;
     const child = this.child;
     if (!child)
       return;
+    this.stopping = true;
     try {
       if (this.child?.stdin.writable) {
         this.notify("shutdown", {});
@@ -28852,7 +28971,7 @@ async function applyRuntimeModelPreflight(config, agent, selection, validate = v
 
 // apps/body/dist/model-catalog-sync.js
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
+import { readFile as readFile10, writeFile as writeFile6 } from "node:fs/promises";
 import { resolve as resolve11 } from "node:path";
 var MODEL_CATALOG_PROBE_TIMEOUT_MS = 3e4;
 var MODEL_CATALOG_HASH_FILE = "model-catalog.sha256";
@@ -28890,7 +29009,7 @@ async function syncAgentModelCatalog(input) {
     const { catalog } = await withTimeout(fetchCatalog(input.agent, input.agentEnv, input.startupUnavailable ? void 0 : selection), input.timeoutMs ?? MODEL_CATALOG_PROBE_TIMEOUT_MS, "model catalog probe");
     const effectiveCatalog = input.startupUnavailable ? catalog : withEffectiveCurrentValues(catalog, selection);
     const hash = modelCatalogHash(effectiveCatalog, selection, input.startupUnavailable);
-    const previous = await readFile9(hashPath, "utf8").catch(() => "");
+    const previous = await readFile10(hashPath, "utf8").catch(() => "");
     if (!input.force && previous.trim() === hash)
       return "unchanged";
     await input.api.execute("postAgentModelCatalog", {
@@ -28917,7 +29036,7 @@ import { execFile as execFile6 } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { rm as rm4 } from "node:fs/promises";
 import { tmpdir as tmpdir2, userInfo } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var COMMAND_TIMEOUT_MS = 2 * 6e4;
 var OUTPUT_LIMIT = 32 * 1024;
 var LOGIN_URL = /https:\/\/login\.tailscale\.com\/[A-Za-z0-9_/-]+/u;
@@ -29004,7 +29123,7 @@ async function ensureInstalled(run2, onProgress, platform) {
       }
     };
   }
-  const script = join5(tmpdir2(), `beeline-tailscale-install-${process.pid}-${randomUUID4()}.sh`);
+  const script = join6(tmpdir2(), `beeline-tailscale-install-${process.pid}-${randomUUID4()}.sh`);
   const steps2 = [
     step2("Tailscale installed", "running", {
       command: "curl -fsSL https://tailscale.com/install.sh"
@@ -29127,7 +29246,7 @@ import { createRequire as createRequire4 } from "node:module";
 import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync, writeFileSync } from "node:fs";
 import { createConnection as createConnection3, createServer as createServer2, isIPv4, isIPv6 } from "node:net";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname9, join as join6 } from "node:path";
+import { dirname as dirname9, join as join7 } from "node:path";
 import { createInterface as createInterface5 } from "node:readline";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -29262,12 +29381,12 @@ async function assertNotOwnMachine(url, remoteIsOwnMachine, resolveHost) {
   return url;
 }
 function registryMcpStateRoot(home = homedir10()) {
-  return join6(home, ".beeline", "registry-mcp");
+  return join7(home, ".beeline", "registry-mcp");
 }
 function registryMcpStatePath(connectorId, home = homedir10()) {
   if (!/^[0-9a-f-]{20,}$/i.test(connectorId))
     throw new Error("Registry connector id is invalid");
-  return join6(registryMcpStateRoot(home), `${connectorId}.json`);
+  return join7(registryMcpStateRoot(home), `${connectorId}.json`);
 }
 function readState(path) {
   try {
@@ -29653,7 +29772,7 @@ function jsonRpcToolName(line) {
   }
 }
 function brokerSocketPath(home = homedir10()) {
-  return join6(home, ".beeline", "registry-mcp-broker", `${process.pid}.sock`);
+  return join7(home, ".beeline", "registry-mcp-broker", `${process.pid}.sock`);
 }
 var RegistryMcpHostBroker = class {
   home;
@@ -30218,13 +30337,13 @@ function describe(error) {
 }
 
 // apps/body/dist/institutional-memory-shadow-worker.js
-import { mkdtemp as mkdtemp2, readFile as readFile10, rm as rm5 } from "node:fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile11, rm as rm5 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join8, resolve as resolve12 } from "node:path";
+import { join as join9, resolve as resolve12 } from "node:path";
 
 // apps/body/dist/attachment-delivery.js
 import { mkdir as mkdir7, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename4, extname, join as join7 } from "node:path";
+import { basename as basename4, extname, join as join8 } from "node:path";
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var EXPIRED_REASON = "expired: these attachment bytes are past their retention window";
 var FETCH_TIMEOUT_MS = 3e4;
@@ -30283,7 +30402,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
         return { attachment, reason: EXPIRED_REASON };
       if (!fetched.ok)
         throw new Error(`HTTP ${fetched.status}`);
-      const path = join7(dir, safeFileName(attachment, index, taken));
+      const path = join8(dir, safeFileName(attachment, index, taken));
       await writeFile7(path, fetched.bytes);
       const bytes = fetched.bytes;
       const mimeType = attachment.mimeType ?? fetched.mimeType;
@@ -30422,7 +30541,7 @@ async function readInstitutionalMemoryAttachments(job, dir, acceptsImages, fetch
   for (const message of job.messages) {
     if (!message.attachments?.length)
       continue;
-    const delivered = await deliverAttachments(message.attachments, join8(dir, message.id), fetchImpl);
+    const delivered = await deliverAttachments(message.attachments, join9(dir, message.id), fetchImpl);
     for (const entry of delivered) {
       const { attachment } = entry;
       const mimeType = attachment.mimeType ?? entry.image?.mimeType;
@@ -30447,7 +30566,7 @@ async function readInstitutionalMemoryAttachments(job, dir, acceptsImages, fetch
           evidence.push({ ...base, notRead: "the attachment text budget is used up" });
           continue;
         }
-        const text2 = clipText(await readFile10(entry.path, "utf8"), textBudget);
+        const text2 = clipText(await readFile11(entry.path, "utf8"), textBudget);
         textBudget -= Buffer.byteLength(text2, "utf8");
         evidence.push({ ...base, text: text2 });
       } else {
@@ -30561,7 +30680,7 @@ async function extractInstitutionalMemoryShadowJob(job, options, signal) {
     if (options.modelSelection) {
       await applyAgentModelSelection(client, opened.sessionId, parseAdvertisedConfigOptions(opened.raw, options.modelSelection.model), options.modelSelection);
     }
-    const attachments = await readInstitutionalMemoryAttachments(job, join8(scratch, "attachments"), client.canPromptWithImages(), options.fetch);
+    const attachments = await readInstitutionalMemoryAttachments(job, join9(scratch, "attachments"), client.canPromptWithImages(), options.fetch);
     prompt = institutionalMemoryExtractionPrompt(job, attachments.evidence);
     const result = await client.sessionPrompt(opened.sessionId, promptWithImages(prompt, attachments.images));
     const proposal = parseExtractionText(result.agentText, job.triggerKind);
@@ -30704,9 +30823,9 @@ function helperVersionHeader(value) {
 
 // apps/body/dist/host-read-budget.js
 import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
-import { mkdir as mkdir8, open as open3, readFile as readFile11, readdir as readdir3, stat as stat5, unlink as unlink4, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir8, open as open3, readFile as readFile12, readdir as readdir3, stat as stat5, unlink as unlink4, writeFile as writeFile8 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 var READ_SLOTS = 6;
 var BACKGROUND_SLOTS = 4;
 var MAX_WAITERS = 256;
@@ -30737,7 +30856,7 @@ var HostReadBudget = class {
     const uid = process.getuid?.() ?? "unknown";
     const origin = new URL(baseUrl).origin;
     const key = createHash5("sha256").update(origin).digest("hex").slice(0, 16);
-    this.directory = join9(root, `beeline-read-budget-${uid}-${key}`);
+    this.directory = join10(root, `beeline-read-budget-${uid}-${key}`);
   }
   metrics() {
     return { waiting: this.waiting, active: this.active, totalWaitMs: this.totalWaitMs };
@@ -30745,7 +30864,7 @@ var HostReadBudget = class {
   async acquire(priority, deadlineAt) {
     await mkdir8(this.directory, { recursive: true, mode: 448 });
     const ticket = `wait-${priority === "urgent" ? "0" : "1"}-${String(Date.now()).padStart(13, "0")}-${randomUUID5()}`;
-    const ticketPath = join9(this.directory, ticket);
+    const ticketPath = join10(this.directory, ticket);
     const tickets = (await readdir3(this.directory)).filter((name) => name.startsWith("wait-"));
     if (tickets.length >= MAX_WAITERS)
       throw new ReadBudgetFullError();
@@ -30757,14 +30876,14 @@ var HostReadBudget = class {
         const queue = (await readdir3(this.directory)).filter((name) => name.startsWith("wait-")).sort();
         for (const name of queue.slice(0, READ_SLOTS)) {
           if (name !== ticket)
-            await this.reapStaleTicket(join9(this.directory, name));
+            await this.reapStaleTicket(join10(this.directory, name));
         }
         const liveQueue = (await readdir3(this.directory)).filter((name) => name.startsWith("wait-")).sort();
         const rank = liveQueue.indexOf(ticket);
         const available = priority === "urgent" ? READ_SLOTS : BACKGROUND_SLOTS;
         if (rank >= 0 && rank < available) {
           for (let slot = 0; slot < available; slot += 1) {
-            const slotPath = join9(this.directory, `slot-${slot}`);
+            const slotPath = join10(this.directory, `slot-${slot}`);
             try {
               const handle2 = await open3(slotPath, "wx", 384);
               try {
@@ -30814,7 +30933,7 @@ var HostReadBudget = class {
     const details = await stat5(path).catch(() => void 0);
     if (!details || Date.now() - details.mtimeMs < 2e3)
       return;
-    const owner = await readFile11(path, "utf8").then((value) => {
+    const owner = await readFile12(path, "utf8").then((value) => {
       try {
         return JSON.parse(value);
       } catch {
@@ -30829,13 +30948,13 @@ var HostReadBudget = class {
     const details = await stat5(path).catch(() => void 0);
     if (!details || Date.now() - details.mtimeMs < 2e3)
       return;
-    const pid = Number(await readFile11(path, "utf8").catch(() => "0"));
+    const pid = Number(await readFile12(path, "utf8").catch(() => "0"));
     if (pid > 0 && ownerAlive(pid) && Date.now() - details.mtimeMs < STALE_SLOT_MS)
       return;
     await unlink4(path).catch(() => void 0);
   }
   async takeRateToken(deadlineAt) {
-    const lock = join9(this.directory, "rate.lock");
+    const lock = join10(this.directory, "rate.lock");
     let handle2;
     try {
       handle2 = await open3(lock, "wx", 384);
@@ -30846,8 +30965,8 @@ var HostReadBudget = class {
       return false;
     }
     try {
-      const path = join9(this.directory, "next-admission");
-      const next = Number(await readFile11(path, "utf8").catch(() => "0")) || 0;
+      const path = join10(this.directory, "next-admission");
+      const next = Number(await readFile12(path, "utf8").catch(() => "0")) || 0;
       const now2 = Date.now();
       if (next > now2 || now2 >= deadlineAt)
         return false;
@@ -30860,6 +30979,251 @@ var HostReadBudget = class {
   }
 };
 
+// apps/body/dist/live-link.js
+var LIVE_LINK_TIMING = Object.freeze({
+  handshakeTimeoutMs: 3e4,
+  pongTimeoutMs: 15e3,
+  backoffBaseMs: 1e3,
+  backoffMaxMs: 3e4,
+  stableSocketMs: 3e4,
+  stableCloseJitterMs: 1e4,
+  keepAliveDelayMs: 5 * 6e4
+});
+var NETWORK_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EPIPE",
+  "ECONNABORTED"
+]);
+function isNetworkFailure(error) {
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (value) => {
+    if (!value || typeof value !== "object" || seen.has(value))
+      return false;
+    seen.add(value);
+    const code = value.code;
+    if (typeof code === "string" && (NETWORK_ERROR_CODES.has(code) || code.startsWith("UND_ERR_")))
+      return true;
+    if (value instanceof AggregateError && value.errors.length > 0 && value.errors.every(visit))
+      return true;
+    return visit(value.cause);
+  };
+  return visit(error);
+}
+function retryAfterMs(value) {
+  if (!value)
+    return void 0;
+  const seconds = Number(value);
+  const delay = Number.isFinite(seconds) && seconds >= 0 ? seconds * 1e3 : Date.parse(value) - Date.now();
+  return Number.isFinite(delay) && delay >= 0 ? Math.min(delay, 6e4) : void 0;
+}
+var LiveLink = class {
+  options;
+  #state = "disconnected";
+  #socket;
+  #openedAt;
+  #failedConnects = 0;
+  #retryAfterMs = 0;
+  #reconnect;
+  #pongDeadline;
+  #wanted = false;
+  #updateAnnounced = false;
+  #reconnects = 0;
+  #openListeners = /* @__PURE__ */ new Set();
+  #timing;
+  #random;
+  #now;
+  constructor(options) {
+    this.options = options;
+    this.#timing = { ...LIVE_LINK_TIMING, ...options.timing };
+    this.#random = options.random ?? Math.random;
+    this.#now = options.now ?? Date.now;
+  }
+  get state() {
+    return this.#state;
+  }
+  get reconnects() {
+    return this.#reconnects;
+  }
+  /** A suspect socket is still open for writes until its pong deadline. */
+  isOpen() {
+    return this.#state === "open" || this.#state === "suspect";
+  }
+  /** Called on every open, after the link's own open handling. */
+  onOpen(listener) {
+    this.#openListeners.add(listener);
+    return () => this.#openListeners.delete(listener);
+  }
+  start() {
+    if (this.#state === "update-required")
+      return;
+    this.#wanted = true;
+    if (!this.#socket && !this.#reconnect)
+      this.#connect();
+  }
+  stop() {
+    this.#wanted = false;
+    this.#clearTimers();
+    const socket = this.#socket;
+    this.#socket = void 0;
+    if (this.#state !== "update-required")
+      this.#state = "disconnected";
+    socket?.close();
+  }
+  send(data) {
+    if (!this.isOpen() || this.#socket?.readyState !== wrapper_default.OPEN)
+      return false;
+    this.#socket.send(data);
+    return true;
+  }
+  /**
+   * Something suggests the socket may be dead (a network-class HTTP failure,
+   * an admitted fetch past its deadline, a failed reconcile). Ask the socket
+   * itself: one ping, and no pong within the deadline drops it. A socket that
+   * is not open is already on its way to a new one.
+   */
+  suspect() {
+    const socket = this.#socket;
+    if (this.#state !== "open" || !socket)
+      return;
+    this.#state = "suspect";
+    try {
+      socket.ping?.();
+    } catch {
+    }
+    this.#pongDeadline = setTimeout(() => {
+      this.#pongDeadline = void 0;
+      if (this.#socket === socket && this.#state === "suspect")
+        socket.terminate();
+    }, this.#timing.pongTimeoutMs);
+    this.#pongDeadline.unref?.();
+  }
+  /** The server requires a newer helper: stop for good and say so once. */
+  requireUpdate(minVersion) {
+    this.#markUpdateRequired();
+    if (this.#updateAnnounced)
+      return;
+    this.#updateAnnounced = true;
+    this.options.onUpdateRequired(minVersion);
+  }
+  #markUpdateRequired() {
+    this.#state = "update-required";
+    this.#clearTimers();
+    const socket = this.#socket;
+    this.#socket = void 0;
+    socket?.close();
+  }
+  #clearTimers() {
+    clearTimeout(this.#reconnect);
+    this.#reconnect = void 0;
+    clearTimeout(this.#pongDeadline);
+    this.#pongDeadline = void 0;
+  }
+  #connect() {
+    const socket = this.options.factory(this.options.url(), this.options.protocols(), {
+      handshakeTimeout: this.#timing.handshakeTimeoutMs
+    });
+    this.#socket = socket;
+    this.#state = "connecting";
+    this.#openedAt = void 0;
+    socket.on?.("upgrade", (response) => {
+      response.socket?.setKeepAlive?.(true, this.#timing.keepAliveDelayMs);
+    });
+    socket.on?.("unexpected-response", (_request, response) => {
+      if (response.statusCode !== 426) {
+        this.#retryAfterMs = retryAfterMs(headerValue(response.headers?.["retry-after"])) ?? 0;
+        socket.terminate();
+        return;
+      }
+      this.#state = "update-required";
+      this.#clearTimers();
+      let body = "";
+      response.on("data", (chunk) => {
+        if (body.length < 1024)
+          body += chunk.toString("utf8").slice(0, 1024 - body.length);
+      });
+      response.on("end", () => {
+        try {
+          const refusal = JSON.parse(body);
+          if (refusal.error === "update_required" && typeof refusal.minVersion === "string")
+            this.requireUpdate(refusal.minVersion);
+        } catch {
+        }
+      });
+      response.on("close", () => socket.terminate());
+    });
+    socket.on?.("pong", () => {
+      if (this.#socket !== socket || this.#state !== "suspect")
+        return;
+      clearTimeout(this.#pongDeadline);
+      this.#pongDeadline = void 0;
+      this.#state = "open";
+    });
+    socket.onopen = () => {
+      if (this.#socket !== socket)
+        return;
+      this.#state = "open";
+      this.#openedAt = this.#now();
+      this.options.onOpen();
+      for (const listener of [...this.#openListeners]) {
+        try {
+          listener();
+        } catch (error) {
+          console.error("[live-link] open listener failed", error);
+        }
+      }
+    };
+    socket.onmessage = (message) => {
+      if (this.#socket === socket)
+        this.options.onMessage(String(message.data));
+    };
+    socket.onerror = () => void 0;
+    socket.onclose = () => {
+      if (this.#socket !== socket)
+        return;
+      this.#socket = void 0;
+      clearTimeout(this.#pongDeadline);
+      this.#pongDeadline = void 0;
+      const openedAt = this.#openedAt;
+      this.#openedAt = void 0;
+      if (this.#state !== "update-required")
+        this.#state = "disconnected";
+      this.options.onClose();
+      if (this.#state === "update-required" || !this.#wanted)
+        return;
+      this.#scheduleReconnect(openedAt);
+    };
+  }
+  #scheduleReconnect(openedAt) {
+    let delay;
+    if (openedAt !== void 0 && this.#now() - openedAt >= this.#timing.stableSocketMs) {
+      this.#failedConnects = 0;
+      delay = this.#random() * this.#timing.stableCloseJitterMs;
+    } else {
+      const ceiling = Math.min(this.#timing.backoffMaxMs, this.#timing.backoffBaseMs * 2 ** this.#failedConnects);
+      this.#failedConnects += 1;
+      delay = this.#random() * ceiling;
+    }
+    delay = Math.floor(Math.max(delay, this.#retryAfterMs));
+    this.#retryAfterMs = 0;
+    this.#reconnects += 1;
+    this.#reconnect = setTimeout(() => {
+      this.#reconnect = void 0;
+      if (this.#wanted && !this.#socket && this.#state !== "update-required")
+        this.#connect();
+    }, delay);
+    this.#reconnect.unref?.();
+  }
+};
+function headerValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+
 // apps/body/dist/daemon-api-client.js
 init_runtime();
 var DaemonApiError = class extends Error {
@@ -30908,32 +31272,19 @@ async function responseError(response) {
   }
   return new DaemonApiError(`monolith daemon request failed (${response.status}: ${code})`, response.status, response.status === 408 || response.status === 429 || response.status >= 500, code, retryAfterMs(response.headers.get("retry-after")), minVersion);
 }
-function retryAfterMs(value) {
-  if (!value)
-    return void 0;
-  const seconds = Number(value);
-  const delay = Number.isFinite(seconds) && seconds >= 0 ? seconds * 1e3 : Date.parse(value) - Date.now();
-  return Number.isFinite(delay) && delay >= 0 ? Math.min(delay, 6e4) : void 0;
-}
 var REQUEST_DEADLINE_MS = 3e4;
-var STABLE_SOCKET_MS = 3e4;
 var DaemonApiClient = class {
   baseUrl;
   daemonToken;
   agentId;
   fetchImpl;
-  webSocketFactory;
   presenceLifecycleId = randomUUID6();
-  liveSocket;
-  liveReconnect;
-  liveReconnectDelayMs = 1e3;
-  liveOpenedAt = 0;
+  /** The one live socket; it reconnects by itself for as long as it is wanted. */
+  link;
   inFlight = 0;
   requestCount = 0;
   timeoutCount = 0;
-  reconnectCount = 0;
   subscriptionCount = 0;
-  discoveryWakeSupported = false;
   readBudget;
   liveRooms = /* @__PURE__ */ new Map();
   roomsChangedListener;
@@ -30944,17 +31295,28 @@ var DaemonApiClient = class {
   cornerRestartListener;
   helperReleaseListener;
   forceUpdateListener;
-  forceUpdatePending = false;
   helperIdentity = {
     releaseVersion: "v0.0.0"
   };
-  constructor(baseUrl, daemonToken, agentId, fetchImpl = fetch, webSocketFactory = (url, protocols) => new wrapper_default(url, protocols), readBudget) {
+  constructor(baseUrl, daemonToken, agentId, fetchImpl = fetch, webSocketFactory = (url, protocols, options) => new wrapper_default(url, protocols, options), readBudget, linkTiming) {
     this.baseUrl = baseUrl;
     this.daemonToken = daemonToken;
     this.agentId = agentId;
     this.fetchImpl = fetchImpl;
-    this.webSocketFactory = webSocketFactory;
     this.readBudget = readBudget ?? (fetchImpl === fetch ? new HostReadBudget(baseUrl) : void 0);
+    this.link = new LiveLink({
+      url: () => this.liveUrl(),
+      protocols: () => [`bearer.${this.daemonToken}`],
+      factory: webSocketFactory,
+      onOpen: () => this.liveOpened(),
+      onMessage: (data) => this.liveMessage(data),
+      onClose: () => {
+        for (const room of this.liveRooms.values())
+          room.onState?.(false);
+      },
+      onUpdateRequired: (minVersion) => this.forceUpdateListener?.(minVersion),
+      ...linkTiming ? { timing: linkTiming } : {}
+    });
   }
   /** Connection material for the daemon-owned MCP proxy and corner credentials. */
   connection() {
@@ -30980,24 +31342,15 @@ var DaemonApiClient = class {
       inFlight: this.inFlight,
       requests: this.requestCount,
       timeouts: this.timeoutCount,
-      reconnects: this.reconnectCount,
+      reconnects: this.link.reconnects,
       subscriptionsSent: this.subscriptionCount,
       readQueueDepth: budget?.waiting ?? 0,
       readQueueWaitMs: budget?.totalWaitMs ?? 0
     };
   }
-  /** A new server can wake discovery after its DB listener recovers. */
-  supportsDiscoveryWake() {
-    return this.discoveryWakeSupported;
-  }
-  requestForceUpdate(minVersion) {
-    if (this.forceUpdatePending)
-      return;
-    this.forceUpdatePending = true;
-    clearTimeout(this.liveReconnect);
-    this.liveReconnect = void 0;
-    this.forceUpdateListener?.(minVersion);
-    this.liveSocket?.close();
+  /** Called on every live socket open, after resubscription and the wakes. */
+  onLiveOpen(listener) {
+    return this.link.onOpen(listener);
   }
   /** Add one Room to this agent's shared live socket. */
   liveSubscribe(roomId, cursor3, onItems, onState, presence, onCommands) {
@@ -31020,18 +31373,12 @@ var DaemonApiClient = class {
       });
     }
     this.ensureLiveSocket();
-    if (this.liveSocket?.readyState === wrapper_default.OPEN)
-      this.sendLiveSubscription(roomId);
+    this.sendLiveSubscription(roomId);
     return () => {
       this.liveRooms.delete(roomId);
-      if (this.liveSocket?.readyState === wrapper_default.OPEN) {
-        this.liveSocket.send(JSON.stringify({ type: "unsubscribe", roomId }));
-      }
-      if (!this.liveRooms.size && !this.roomsChangedListener) {
-        clearTimeout(this.liveReconnect);
-        this.liveSocket?.close();
-        this.liveSocket = void 0;
-      }
+      this.link.send(JSON.stringify({ type: "unsubscribe", roomId }));
+      if (!this.liveRooms.size && !this.roomsChangedListener)
+        this.link.stop();
     };
   }
   /** Register the one listener invoked when the server reports this agent's
@@ -31072,17 +31419,9 @@ var DaemonApiClient = class {
     if (room && cursor3)
       room.cursor = cursor3;
   }
-  /** Retry an uncertain discovery read through socket reconnect backoff. */
-  reconnectLive() {
-    this.liveSocket?.close();
-  }
   /** Release the long-lived socket when the helper itself is shutting down. */
   closeLive() {
-    clearTimeout(this.liveReconnect);
-    this.liveReconnect = void 0;
-    const socket = this.liveSocket;
-    this.liveSocket = void 0;
-    socket?.close();
+    this.link.stop();
   }
   async execute(name, input) {
     const candidate = input;
@@ -31116,7 +31455,7 @@ var DaemonApiClient = class {
       if (!response.ok) {
         const error = await responseError(response);
         if (error.status === 426 && error.code === "update_required" && error.minVersion)
-          this.requestForceUpdate(error.minVersion);
+          this.link.requireUpdate(error.minVersion);
         throw error;
       }
       output = await response.json();
@@ -31126,8 +31465,12 @@ var DaemonApiClient = class {
       }
       if (controller.signal.aborted) {
         this.timeoutCount += 1;
+        if (admitted)
+          this.link.suspect();
         throw new DaemonApiError(`monolith daemon ${String(name)} timed out`, 408, true, "deadline_exceeded");
       }
+      if (isNetworkFailure(error))
+        this.link.suspect();
       throw error;
     } finally {
       clearTimeout(deadline);
@@ -31138,171 +31481,121 @@ var DaemonApiClient = class {
     return output;
   }
   ensureLiveSocket() {
-    if (this.forceUpdatePending || this.liveSocket || !this.liveRooms.size && !this.roomsChangedListener)
-      return;
+    if (this.liveRooms.size || this.roomsChangedListener)
+      this.link.start();
+  }
+  liveUrl() {
     const liveUrl = new URL("/v1/phone/live", this.baseUrl);
     liveUrl.protocol = liveUrl.protocol === "https:" ? "wss:" : "ws:";
     liveUrl.searchParams.set("helperVersion", this.helperIdentity.releaseVersion);
     if (this.helperIdentity.sourceSha)
       liveUrl.searchParams.set("sourceSha", this.helperIdentity.sourceSha);
-    const socket = this.webSocketFactory(liveUrl.toString(), [
-      `bearer.${this.daemonToken}`
-    ]);
-    this.liveSocket = socket;
-    socket.on?.("unexpected-response", (_request, response) => {
-      if (response.statusCode !== 426)
-        return;
-      this.forceUpdatePending = true;
-      clearTimeout(this.liveReconnect);
-      this.liveReconnect = void 0;
-      let body = "";
-      response.on("data", (chunk) => {
-        if (body.length < 1024)
-          body += chunk.toString("utf8").slice(0, 1024 - body.length);
-      });
-      response.on("end", () => {
-        try {
-          const refusal = JSON.parse(body);
-          if (refusal.error === "update_required" && typeof refusal.minVersion === "string")
-            this.forceUpdateListener?.(refusal.minVersion);
-        } catch {
-        }
-      });
-    });
-    socket.onopen = () => {
-      this.liveOpenedAt = Date.now();
-      this.discoveryWakeSupported = false;
-      for (const roomId of this.liveRooms.keys())
-        this.sendLiveSubscription(roomId);
+    return liveUrl.toString();
+  }
+  liveOpened() {
+    for (const roomId of this.liveRooms.keys())
+      this.sendLiveSubscription(roomId);
+    this.roomsChangedListener?.();
+    this.connectorAssignmentListener?.();
+    this.memoryJobListener?.();
+  }
+  liveMessage(data) {
+    let value;
+    try {
+      value = JSON.parse(data);
+    } catch {
+      return;
+    }
+    if (!value || typeof value !== "object")
+      return;
+    const event = value;
+    if (event.type === "force-update" && typeof event.minVersion === "string") {
+      this.link.requireUpdate(event.minVersion);
+      return;
+    }
+    if (event.type === "helper-release" && typeof event.version === "string" && typeof event.sha === "string") {
+      this.helperReleaseListener?.({ version: event.version, sha: event.sha });
+      return;
+    }
+    if (event.type === "rooms-changed") {
+      this.roomsChangedListener?.(membershipChange(event));
+      return;
+    }
+    if (event.type === "discovery-wake" && (event.reason === "listener-resync" || event.reason === "database-recovered")) {
       this.roomsChangedListener?.();
+      return;
+    }
+    if (event.type === "corner-complete" && typeof event.roomId === "string") {
+      this.cornerCompleteListener?.(event.roomId);
+      return;
+    }
+    if (event.type === "corner-restart" && typeof event.roomId === "string") {
+      this.cornerRestartListener?.(event.roomId);
+      return;
+    }
+    if (event.type === "connector-assignment") {
       this.connectorAssignmentListener?.();
+      return;
+    }
+    if (event.type === "memory-job") {
       this.memoryJobListener?.();
-    };
-    socket.onmessage = (message) => {
-      let value;
-      try {
-        value = JSON.parse(String(message.data));
-      } catch {
-        return;
-      }
-      if (!value || typeof value !== "object")
-        return;
-      const event = value;
-      if (event.type === "force-update" && typeof event.minVersion === "string") {
-        this.requestForceUpdate(event.minVersion);
-        return;
-      }
-      if (event.type === "hello" && event.protocolMin === 1 && event.protocolMax === 1) {
-        const capabilities = event.capabilities;
-        if (capabilities?.discoveryWake === true)
-          this.discoveryWakeSupported = true;
-        return;
-      }
-      if (event.type === "helper-release" && typeof event.version === "string" && typeof event.sha === "string") {
-        this.helperReleaseListener?.({ version: event.version, sha: event.sha });
-        return;
-      }
-      if (event.type === "rooms-changed") {
-        this.roomsChangedListener?.(membershipChange(event));
-        return;
-      }
-      if (event.type === "discovery-wake" && (event.reason === "listener-resync" || event.reason === "database-recovered")) {
-        this.roomsChangedListener?.();
-        return;
-      }
-      if (event.type === "corner-complete" && typeof event.roomId === "string") {
-        this.cornerCompleteListener?.(event.roomId);
-        return;
-      }
-      if (event.type === "corner-restart" && typeof event.roomId === "string") {
-        this.cornerRestartListener?.(event.roomId);
-        return;
-      }
-      if (event.type === "connector-assignment") {
-        this.connectorAssignmentListener?.();
-        return;
-      }
-      if (event.type === "memory-job") {
-        this.memoryJobListener?.();
-        return;
-      }
-      if (event.type === "config-changed") {
-        this.configChangedListener?.();
-        return;
-      }
-      if (event.type === "subscribed" && typeof event.roomId === "string") {
-        const capabilities = event.capabilities;
-        if (capabilities?.discoveryWake === true)
-          this.discoveryWakeSupported = true;
-        this.liveRooms.get(event.roomId)?.onState?.(true, {
-          pushIntake: capabilities?.pushIntake === true,
-          connectionPresence: capabilities?.connectionPresence === true
-        });
-        return;
-      }
-      if (event.type === "commands" && typeof event.roomId === "string" && event.commandProtocol === 1 && Array.isArray(event.commands)) {
-        const room2 = this.liveRooms.get(event.roomId);
-        if (!room2)
-          return;
-        const commands = event.commands.filter((command) => {
-          if (!isAgentCommand(command) || command.roomId !== event.roomId || command.agentId !== this.agentId || room2.pushedCommandIds.has(command.id))
-            return false;
-          room2.pushedCommandIds.add(command.id);
-          return true;
-        });
-        while (room2.pushedCommandIds.size > 1e4)
-          room2.pushedCommandIds.delete(room2.pushedCommandIds.values().next().value);
-        if (commands.length)
-          room2.onCommands?.(commands);
-        return;
-      }
-      if (event.type !== "inbox" || typeof event.roomId !== "string" || !Array.isArray(event.items))
-        return;
-      const room = this.liveRooms.get(event.roomId);
-      if (!room)
+      return;
+    }
+    if (event.type === "config-changed") {
+      this.configChangedListener?.();
+      return;
+    }
+    if (event.type === "subscribed" && typeof event.roomId === "string") {
+      const capabilities = event.capabilities;
+      this.liveRooms.get(event.roomId)?.onState?.(true, {
+        pushIntake: capabilities?.pushIntake === true,
+        connectionPresence: capabilities?.connectionPresence === true
+      });
+      return;
+    }
+    if (event.type === "commands" && typeof event.roomId === "string" && event.commandProtocol === 1 && Array.isArray(event.commands)) {
+      const room2 = this.liveRooms.get(event.roomId);
+      if (!room2)
         return;
-      const items = [];
-      for (const candidate of event.items) {
-        if (!candidate || typeof candidate !== "object")
-          continue;
-        const id = candidate.id;
-        if (typeof id === "string") {
-          if (!room.pushedIds.has(id))
-            items.push(candidate);
-          room.pushedIds.add(id);
-        }
+      const commands = event.commands.filter((command) => {
+        if (!isAgentCommand(command) || command.roomId !== event.roomId || command.agentId !== this.agentId || room2.pushedCommandIds.has(command.id))
+          return false;
+        room2.pushedCommandIds.add(command.id);
+        return true;
+      });
+      while (room2.pushedCommandIds.size > 1e4)
+        room2.pushedCommandIds.delete(room2.pushedCommandIds.values().next().value);
+      if (commands.length)
+        room2.onCommands?.(commands);
+      return;
+    }
+    if (event.type !== "inbox" || typeof event.roomId !== "string" || !Array.isArray(event.items))
+      return;
+    const room = this.liveRooms.get(event.roomId);
+    if (!room)
+      return;
+    const items = [];
+    for (const candidate of event.items) {
+      if (!candidate || typeof candidate !== "object")
+        continue;
+      const id = candidate.id;
+      if (typeof id === "string") {
+        if (!room.pushedIds.has(id))
+          items.push(candidate);
+        room.pushedIds.add(id);
       }
-      while (room.pushedIds.size > 1e4)
-        room.pushedIds.delete(room.pushedIds.values().next().value);
-      if (items.length)
-        room.onItems?.(items, typeof event.cursor === "string" ? event.cursor : void 0);
-    };
-    const reconnect = () => {
-      if (this.liveSocket !== socket)
-        return;
-      this.liveSocket = void 0;
-      this.discoveryWakeSupported = false;
-      for (const room of this.liveRooms.values())
-        room.onState?.(false);
-      if (this.forceUpdatePending)
-        return;
-      if (!this.liveRooms.size && !this.roomsChangedListener)
-        return;
-      const delay = this.liveReconnectDelayMs;
-      this.liveReconnectDelayMs = Date.now() - this.liveOpenedAt >= STABLE_SOCKET_MS ? 1e3 : Math.min(delay * 2, 3e4);
-      this.reconnectCount += 1;
-      this.liveReconnect = setTimeout(() => this.ensureLiveSocket(), Math.floor(Math.random() * delay));
-      this.liveReconnect.unref?.();
-    };
-    socket.onerror = () => void 0;
-    socket.onclose = reconnect;
+    }
+    while (room.pushedIds.size > 1e4)
+      room.pushedIds.delete(room.pushedIds.values().next().value);
+    if (items.length)
+      room.onItems?.(items, typeof event.cursor === "string" ? event.cursor : void 0);
   }
   sendLiveSubscription(roomId) {
     const room = this.liveRooms.get(roomId);
-    if (!room || this.liveSocket?.readyState !== wrapper_default.OPEN)
+    if (!room || !this.link.isOpen())
       return;
     this.subscriptionCount += 1;
-    this.liveSocket.send(JSON.stringify({
+    this.link.send(JSON.stringify({
       type: "subscribe",
       roomId,
       lifecycleId: this.presenceLifecycleId,
@@ -31363,7 +31656,7 @@ import { promisify as promisify8 } from "node:util";
 // apps/body/dist/grant-runner.js
 import { execFile as execFile8 } from "node:child_process";
 import { createHash as createHash6, randomBytes as randomBytes7, randomUUID as randomUUID7 } from "node:crypto";
-import { chmod as chmod6, mkdir as mkdir10, readFile as readFile13, readdir as readdir4, rename as rename5, rm as rm6, rmdir, stat as stat6, writeFile as writeFile10 } from "node:fs/promises";
+import { chmod as chmod6, mkdir as mkdir10, readFile as readFile14, readdir as readdir4, rename as rename6, rm as rm6, rmdir, stat as stat6, writeFile as writeFile10 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
 import { dirname as dirname12, resolve as resolve16 } from "node:path";
 
@@ -32058,7 +32351,7 @@ async function ensureBwrapSandbox(options = {}) {
 }
 
 // apps/body/dist/provider-key-store.js
-import { chmod as chmod5, mkdir as mkdir9, readFile as readFile12, writeFile as writeFile9 } from "node:fs/promises";
+import { chmod as chmod5, mkdir as mkdir9, readFile as readFile13, writeFile as writeFile9 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
 import { dirname as dirname11, resolve as resolve15 } from "node:path";
 var PROVIDER_KEY_ENV_VARS = {
@@ -32075,7 +32368,7 @@ function providerKeyStorePath(env = process.env) {
 }
 async function readProviderKeyStore(env = process.env) {
   const path = providerKeyStorePath(env);
-  const raw = await readFile12(path, "utf8").catch(() => void 0);
+  const raw = await readFile13(path, "utf8").catch(() => void 0);
   if (!raw)
     return {};
   try {
@@ -32127,7 +32420,7 @@ function operatorSecretsPath(env = process.env) {
   return resolve16(dirname12(providerKeyStorePath(env)), "secrets.json");
 }
 async function readOperatorSecrets(env = process.env) {
-  const raw = await readFile13(operatorSecretsPath(env), "utf8").catch(() => void 0);
+  const raw = await readFile14(operatorSecretsPath(env), "utf8").catch(() => void 0);
   if (!raw)
     return {};
   try {
@@ -32339,7 +32632,7 @@ ${ROOM_WRITE_REFUSED_NOTE}` : outcome.output, secrets), cap);
       return;
     let bytes;
     for (const candidate of candidates) {
-      bytes = await readFile13(candidate).catch(() => void 0);
+      bytes = await readFile14(candidate).catch(() => void 0);
       if (bytes)
         break;
     }
@@ -32541,10 +32834,10 @@ function captureConnectionUsage(recorder, turn, calls) {
 }
 
 // apps/body/dist/turn-usage.js
-import { readFile as readFile15 } from "node:fs/promises";
+import { readFile as readFile16 } from "node:fs/promises";
 
 // apps/body/dist/pi-turn-record.js
-import { readdir as readdir5, readFile as readFile14 } from "node:fs/promises";
+import { readdir as readdir5, readFile as readFile15 } from "node:fs/promises";
 import { resolve as resolve17 } from "node:path";
 function summarizeProviderError(errorMessage2) {
   const trimmed = errorMessage2.trim();
@@ -32572,7 +32865,7 @@ async function piSessionFilePath(agentEnv, sessionId) {
 }
 async function sessionFileFromMap(home, sessionId) {
   try {
-    const raw = await readFile14(resolve17(home, ".pi", "pi-acp", "session-map.json"), "utf8");
+    const raw = await readFile15(resolve17(home, ".pi", "pi-acp", "session-map.json"), "utf8");
     const map = JSON.parse(raw);
     const file = map.sessions?.[sessionId]?.sessionFile;
     return typeof file === "string" && file ? file : void 0;
@@ -32614,7 +32907,7 @@ async function readPiTurnRecord(input) {
     return void 0;
   let raw;
   try {
-    raw = await readFile14(file, "utf8");
+    raw = await readFile15(file, "utf8");
   } catch {
     return void 0;
   }
@@ -32675,7 +32968,7 @@ async function readHarnessTurnUsage(input) {
     return void 0;
   let raw;
   try {
-    raw = await readFile15(file, "utf8");
+    raw = await readFile16(file, "utf8");
   } catch {
     return void 0;
   }
@@ -32717,13 +33010,13 @@ import { randomUUID as randomUUID8 } from "node:crypto";
 import { mkdir as mkdir11, writeFile as writeFile11 } from "node:fs/promises";
 import { writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname13, join as join10 } from "node:path";
+import { dirname as dirname13, join as join11 } from "node:path";
 var CommandExecutionContext = class {
   generationId = randomUUID8();
   path;
   current;
   constructor(root) {
-    this.path = join10(root ?? tmpdir5(), `beeline-command-${this.generationId}.json`);
+    this.path = join11(root ?? tmpdir5(), `beeline-command-${this.generationId}.json`);
   }
   async enter(command) {
     this.current = command;
@@ -32831,6 +33124,7 @@ async function runServerCommandIntake(options) {
       requestReconciliation();
     hasSubscribed = true;
   }, options.presence, notify2);
+  let failed = false;
   try {
     while (!signal?.aborted) {
       if (reconciliationError)
@@ -32908,22 +33202,36 @@ async function runServerCommandIntake(options) {
       if (reconcile)
         requestReconciliation();
     }
+  } catch (error) {
+    failed = true;
+    throw error;
   } finally {
     stopped = true;
     off?.();
     options.onWake?.(void 0);
-    if (context.current)
-      options.stop(context.current.turnRequestId);
-    await busy;
+    const current = context.current;
+    const stopCurrent = () => {
+      if (current)
+        options.stop(current.turnRequestId);
+    };
+    if (!failed || signal?.aborted)
+      stopCurrent();
+    else
+      signal?.addEventListener("abort", stopCurrent, { once: true });
+    try {
+      await busy;
+    } finally {
+      signal?.removeEventListener("abort", stopCurrent);
+    }
   }
 }
 
 // apps/body/dist/monolith-corner-turn.js
 import { execFile as execFile11 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { mkdir as mkdir20, readFile as readFile21, writeFile as writeFile16 } from "node:fs/promises";
+import { mkdir as mkdir20, readFile as readFile22, writeFile as writeFile16 } from "node:fs/promises";
 import { homedir as homedir15, hostname as hostname2 } from "node:os";
-import { dirname as dirname18, join as join16, resolve as resolve28 } from "node:path";
+import { dirname as dirname18, join as join17, resolve as resolve28 } from "node:path";
 import { promisify as promisify7 } from "node:util";
 
 // apps/body/dist/agent-home.js
@@ -33726,9 +34034,9 @@ function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
 
 // apps/body/dist/agent-home.js
 import { createHash as createHash7, randomUUID as randomUUID9 } from "node:crypto";
-import { chmod as chmod7, copyFile, lstat as lstat3, mkdir as mkdir13, readFile as readFile17, readlink, readdir as readdir6, realpath, rename as rename6, rm as rm7, symlink as symlink2, unlink as unlink5, writeFile as writeFile13 } from "node:fs/promises";
+import { chmod as chmod7, copyFile, lstat as lstat3, mkdir as mkdir13, readFile as readFile18, readlink, readdir as readdir6, realpath, rename as rename7, rm as rm7, symlink as symlink2, unlink as unlink5, writeFile as writeFile13 } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
-import { basename as basename6, dirname as dirname14, join as join12, relative as relative2, resolve as resolve21, sep } from "node:path";
+import { basename as basename6, dirname as dirname14, join as join13, relative as relative2, resolve as resolve21, sep } from "node:path";
 
 // apps/body/dist/draw-avatar-skill.js
 var DRAW_AVATAR_SKILL_NAME = "draw-avatar";
@@ -33852,14 +34160,235 @@ function isAgentPairingCode(value) {
 // packages/api-contract/dist/phone.js
 init_agent_access();
 
+// packages/api-contract/dist/message-search.js
+var MESSAGE_SEARCH_FILLER_WORDS = [
+  // Articles and determiners
+  "a",
+  "an",
+  "the",
+  "this",
+  "that",
+  "these",
+  "those",
+  "some",
+  "any",
+  "each",
+  "every",
+  "all",
+  "both",
+  "either",
+  "neither",
+  "much",
+  "many",
+  "more",
+  "most",
+  "such",
+  "other",
+  "another",
+  "own",
+  "same",
+  "no",
+  "not",
+  "only",
+  "very",
+  // Pronouns
+  "i",
+  "me",
+  "my",
+  "mine",
+  "myself",
+  "you",
+  "your",
+  "yours",
+  "yourself",
+  "he",
+  "him",
+  "his",
+  "himself",
+  "she",
+  "her",
+  "hers",
+  "herself",
+  "it",
+  "its",
+  "itself",
+  "we",
+  "us",
+  "our",
+  "ours",
+  "ourselves",
+  "they",
+  "them",
+  "their",
+  "theirs",
+  "themselves",
+  "who",
+  "whom",
+  "whose",
+  "which",
+  "what",
+  "someone",
+  "something",
+  "anyone",
+  "anything",
+  "everyone",
+  "everything",
+  // Auxiliaries
+  "am",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "have",
+  "has",
+  "had",
+  "having",
+  "do",
+  "does",
+  "did",
+  "doing",
+  "done",
+  "will",
+  "would",
+  "shall",
+  "should",
+  "can",
+  "could",
+  "might",
+  "must",
+  "get",
+  "gets",
+  "got",
+  // Contraction pieces
+  "s",
+  "t",
+  "d",
+  "ll",
+  "m",
+  "re",
+  "ve",
+  "don",
+  "doesn",
+  "didn",
+  "isn",
+  "aren",
+  "wasn",
+  "weren",
+  "haven",
+  "hasn",
+  "hadn",
+  "won",
+  "wouldn",
+  "couldn",
+  "shouldn",
+  "cannot",
+  // Conjunctions
+  "and",
+  "or",
+  "but",
+  "nor",
+  "so",
+  "yet",
+  "if",
+  "then",
+  "than",
+  "because",
+  "as",
+  "while",
+  "though",
+  "although",
+  "unless",
+  "until",
+  "whether",
+  "also",
+  // Prepositions
+  "of",
+  "to",
+  "in",
+  "on",
+  "at",
+  "by",
+  "for",
+  "with",
+  "from",
+  "into",
+  "onto",
+  "about",
+  "above",
+  "below",
+  "over",
+  "under",
+  "after",
+  "before",
+  "between",
+  "through",
+  "during",
+  "without",
+  "within",
+  "again",
+  "against",
+  "upon",
+  "via",
+  "per",
+  "around",
+  // Adverbs
+  "here",
+  "there",
+  "where",
+  "when",
+  "why",
+  "how",
+  "now",
+  "just",
+  "too",
+  "still",
+  "even",
+  "ever",
+  "never",
+  "always",
+  "really",
+  "maybe",
+  "already",
+  "soon",
+  // Chat filler
+  "ok",
+  "okay",
+  "yes",
+  "yeah",
+  "yep",
+  "yup",
+  "nope",
+  "hi",
+  "hey",
+  "hello",
+  "thanks",
+  "thank",
+  "thx",
+  "please",
+  "pls",
+  "like",
+  "gonna",
+  "wanna",
+  "kinda",
+  "lol",
+  "oh",
+  "ah",
+  "um",
+  "uh",
+  "hmm",
+  "oops",
+  "anyway"
+];
+var FILLER_WORDS = new Set(MESSAGE_SEARCH_FILLER_WORDS);
+
 // apps/body/dist/beeline-skill.js
 var USING_BEELINE_SKILL_NAME = "using-beeline";
 var BEELINE_TRIAGE_SKILL_NAME = "beeline-triage";
 var BEELINE_REVIEW_SKILL_NAME = "beeline-review";
 var BEELINE_SPEC_SKILL_NAME = "beeline-spec";
-function isConfiguredReviewer(agentHandle, reviewerHandle) {
-  return Boolean(agentHandle && reviewerHandle && agentHandle.replace(/^@/, "") === reviewerHandle.replace(/^@/, ""));
-}
 var BEELINE_ROOM_MECHANICS = [
   "Files and photos people share are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline); never fetch the reference URL.",
   "To create a file you can send, call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent post_artifact with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote), or with html/bytes content directly; it is uploaded and attached to your reply, and title and mime default from the file when you post by path. write_scratch_file produces the file, not a picture. To put a real photograph in an artifact, call beeline-agent fetch_image with the photo URL; it writes the bytes to your session scratch and returns the path, mime, and size \u2014 read them, base64-encode, and embed as a data: URL. The validator still refuses every http(s) image reference, and drawing an SVG stand-in is not a photograph.",
@@ -34024,7 +34553,7 @@ Only the author may report final_authorization as passed, after pr_checks_status
 
 Then take exactly one action:
 
-- FAIL: reply \`@author\` with the confirmed findings to fix.
+- FAIL: call \`record_validation_stage\` with stage \`review\`, status \`failed\`, and the reviewed head SHA, then reply \`@author\` with the confirmed findings and that reviewed head SHA to fix. The recorded review stage is how an implementer who has already fixed the findings can tell whether the review is stale.
 - PASS: call \`approve_merge\` with the reviewed head SHA and assigned briefRevision (omit the revision only for a legacy corner without a brief), then reply \`approved <reviewed sha>\` without tagging the author. Do not tell the author to merge.
 - Approving is your last step as reviewer. The server squash-merges that exact head once checks are green, the worker's yolo is on, and no human hold stands. Neither you nor the author merges it.
 `;
@@ -34194,7 +34723,7 @@ var SQUIRE_GOVERNED_TOOLS = [
 var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
 
 // apps/body/dist/host-mcp-route.js
-import { join as join11, resolve as resolve19 } from "node:path";
+import { join as join12, resolve as resolve19 } from "node:path";
 var import_yaml = __toESM(require_dist(), 1);
 init_squire_host();
 function grantedMcpServerNames(grants) {
@@ -34249,7 +34778,7 @@ function grantedSquireHostRouteNames(granted, declarations = {}) {
   });
 }
 function hostRouteEnv(hostHome) {
-  return { XDG_CONFIG_HOME: join11(resolve19(hostHome), ".config") };
+  return { XDG_CONFIG_HOME: join12(resolve19(hostHome), ".config") };
 }
 function rewriteHostMcpDeclaration(name, declaration, hostHome, resourceAuthFile, squireScope) {
   const next = { ...declaration };
@@ -34368,7 +34897,7 @@ function mergeGooseHostRoutes(existing, routes) {
 init_squire_host();
 
 // apps/body/dist/openrouter-routing.js
-import { mkdir as mkdir12, readFile as readFile16, writeFile as writeFile12 } from "node:fs/promises";
+import { mkdir as mkdir12, readFile as readFile17, writeFile as writeFile12 } from "node:fs/promises";
 import { resolve as resolve20 } from "node:path";
 var OPENROUTER_ENDPOINTS_BASE_URL = "https://openrouter.ai/api/v1/models";
 var OPENROUTER_COMPLETIONS_URL = "https://openrouter.ai/api/v1/chat/completions";
@@ -34496,7 +35025,7 @@ function cachePath(cacheDir, model) {
 }
 async function readCache(cacheDir, model) {
   try {
-    const parsed = JSON.parse(await readFile16(cachePath(cacheDir, model), "utf8"));
+    const parsed = JSON.parse(await readFile17(cachePath(cacheDir, model), "utf8"));
     if (!parsed || typeof parsed !== "object")
       return void 0;
     const cached = parsed;
@@ -34539,7 +35068,7 @@ function probeCachePath(cacheDir, model) {
 }
 async function readProbeCache(cacheDir, model) {
   try {
-    const parsed = JSON.parse(await readFile16(probeCachePath(cacheDir, model), "utf8"));
+    const parsed = JSON.parse(await readFile17(probeCachePath(cacheDir, model), "utf8"));
     if (!parsed || typeof parsed !== "object")
       return void 0;
     const cached = parsed;
@@ -35090,10 +35619,10 @@ function claudeLoginExpiresAt(text2) {
   }
 }
 async function hasNewerDetachedClaudeLogin(detached, source) {
-  const detachedExpiresAt = claudeLoginExpiresAt(await readFile17(detached, "utf8"));
+  const detachedExpiresAt = claudeLoginExpiresAt(await readFile18(detached, "utf8"));
   if (detachedExpiresAt === void 0)
     return false;
-  const sourceExpiresAt = claudeLoginExpiresAt(await readFile17(source, "utf8"));
+  const sourceExpiresAt = claudeLoginExpiresAt(await readFile18(source, "utf8"));
   return sourceExpiresAt !== void 0 && detachedExpiresAt > sourceExpiresAt;
 }
 async function repairRoomAgentCredentialLinks(input) {
@@ -35120,7 +35649,7 @@ async function repairRoomAgentCredentialLinks(input) {
         continue;
       }
       const quarantine = `${target}.beeline-quarantine-${Date.now()}-${randomUUID9()}`;
-      await rename6(target, quarantine);
+      await rename7(target, quarantine);
     }
     await symlink2(source, target);
   }
@@ -35600,7 +36129,7 @@ async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, op
     const existing = await lstat3(target).catch(() => void 0);
     if (existing)
       await rm7(target, { recursive: existing.isDirectory(), force: true });
-    await rename6(staged, target);
+    await rename7(staged, target);
   } finally {
     await rm7(staged, { recursive: true, force: true });
   }
@@ -35621,8 +36150,8 @@ async function planManagedSkills(managedSkills, sharedSkills, optionalShares) {
     try {
       const tree = [];
       await walkSafeSkillTree(shared.source, shared.source, {
-        directory: async (rel) => void tree.push(`d ${join12(shared.name, rel)}`),
-        file: async (rel, realPath) => void tree.push(`f ${join12(shared.name, rel)} ${sha2563(await readFile17(realPath))}`)
+        directory: async (rel) => void tree.push(`d ${join13(shared.name, rel)}`),
+        file: async (rel, realPath) => void tree.push(`f ${join13(shared.name, rel)} ${sha2563(await readFile18(realPath))}`)
       });
       entries.push({ kind: "shared", name: shared.name, source: shared.source });
       lines.push(...tree);
@@ -35642,7 +36171,7 @@ async function materializedSkillManifest(target) {
   const visit = async (directory, prefix) => {
     for (const entry of await readdir6(directory)) {
       const path = resolve21(directory, entry);
-      const rel = prefix ? join12(prefix, entry) : entry;
+      const rel = prefix ? join13(prefix, entry) : entry;
       const entryStats = await lstat3(path);
       if (entryStats.isSymbolicLink())
         return false;
@@ -35654,7 +36183,7 @@ async function materializedSkillManifest(target) {
       }
       if (!entryStats.isFile() || entryStats.nlink !== 1)
         return false;
-      lines.push(`f ${rel} ${sha2563(await readFile17(path))}`);
+      lines.push(`f ${rel} ${sha2563(await readFile18(path))}`);
     }
     return true;
   };
@@ -35810,7 +36339,7 @@ async function walkSafeSkillTree(source, sourceRoot, visitor, rel = "") {
     for (const entry of await readdir6(resolvedSource)) {
       if (entry === "." || entry === "..")
         throw new Error("invalid shared skill entry");
-      await walkSafeSkillTree(resolve21(source, entry), sourceRoot, visitor, rel ? join12(rel, entry) : entry);
+      await walkSafeSkillTree(resolve21(source, entry), sourceRoot, visitor, rel ? join13(rel, entry) : entry);
     }
     return;
   }
@@ -35841,7 +36370,7 @@ async function writeIsolatedHarnessFile(path, content) {
   try {
     await writeFile13(temporary, content, { mode: 384, flag: "wx" });
     await chmod7(temporary, 384);
-    await rename6(temporary, path);
+    await rename7(temporary, path);
   } finally {
     await unlink5(temporary).catch(() => void 0);
   }
@@ -36832,7 +37361,7 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
 
 // apps/body/dist/codegraph.js
 import { execFile as execFile10 } from "node:child_process";
-import { access as access2, appendFile, mkdir as mkdir15, readFile as readFile18 } from "node:fs/promises";
+import { access as access2, appendFile, mkdir as mkdir15, readFile as readFile19 } from "node:fs/promises";
 import { dirname as dirname15, isAbsolute as isAbsolute3, resolve as resolve24 } from "node:path";
 import { promisify as promisify6 } from "node:util";
 var execFileAsync6 = promisify6(execFile10);
@@ -36882,7 +37411,7 @@ async function excludeIndexFromGitStatus(cwd) {
       return;
     const path = isAbsolute3(gitPath) ? gitPath : resolve24(cwd, gitPath);
     await mkdir15(dirname15(path), { recursive: true });
-    const existing = await readFile18(path, "utf8").catch(() => "");
+    const existing = await readFile19(path, "utf8").catch(() => "");
     if (existing.split("\n").includes(".codegraph/"))
       return;
     await appendFile(path, `${existing && !existing.endsWith("\n") ? "\n" : ""}.codegraph/
@@ -36918,20 +37447,20 @@ init_cursor_acp_bridge();
 // apps/body/dist/monolith-room-turn.js
 import { mkdir as mkdir17, writeFile as writeFile14 } from "node:fs/promises";
 import { homedir as homedir14, hostname } from "node:os";
-import { dirname as dirname16, join as join14 } from "node:path";
+import { dirname as dirname16, join as join15 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
 var SCHEDULE_RAN_VERB = "ran a schedule for";
 
 // apps/body/dist/model-context-window.js
-import { readFile as readFile19 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { readFile as readFile20 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 async function modelContextWindowTokens(model, piHome) {
   if (!model || !piHome)
     return void 0;
   try {
-    const catalog = JSON.parse(await readFile19(join13(piHome, "models.json"), "utf8"));
+    const catalog = JSON.parse(await readFile20(join14(piHome, "models.json"), "utf8"));
     const parts = model.split("/");
     const preferredProvider = parts.length > 2 ? parts.shift() : void 0;
     const modelId = parts.join("/");
@@ -37082,7 +37611,7 @@ var CORNERS = [
 ];
 var EVERYWHERE = PROMPT_SURFACES;
 var CORNER_AUTHOR_CONTRACT = `The current brief's spec is the scope and its checklist says what done means. Its approval quote is the human's own words and wins any conflict with the spec. The short objective is navigation-only text and cannot add, remove, or narrow a requirement.
-Complete every checklist item in the current spec and use the brief's file manifest. Record relevant validation stages with record_validation_stage against the current revision and head, citing actual commands or observed behavior. Do not call a missing stage passed.
+Complete every checklist item in the current spec and use the brief's file manifest. Record your stages with record_validation_stage for this revision and head: intent, base, tests, docs, lint_types, publication, ci, final_authorization; the configured reviewer records review. Do not call a missing stage passed.
 When a human correction changes the assignment, read the latest revision and use revise_corner_brief with the complete updated brief and a change description before doing dependent work. A chat reply does not revise the assignment.
 Before any code, write its end-user story in one sentence: "a person who does X sees Y".
 Follow the beeline-triage skill's bugfix execution contract when the spec or its approval quote reports a defect.
@@ -37113,15 +37642,15 @@ function cornerMergeInstruction(yoloMode, reviewerHandle) {
   return yoloMode ? `Once the pull request exists, reply with its full URL and end the turn; do not tag ${reviewer}, check, or wait for CI. Green checks wake ${reviewer}; after its PASS the server merges the pull request itself. Never merge it yourself. You are woken only to fix failing checks, requested changes, or a merge GitHub refused; push the fix, and the new head needs green checks and a fresh PASS.` : `Once the pull request exists, reply with its full URL and end the turn; do not tag ${reviewer}, check, or wait for CI. Yolo is off, so the merge gate stays closed for you: never merge; a person merges it after ${reviewer} approves.`;
 }
 function cornerReviewerInstruction(input) {
-  if (!input.reviewerHandle || !input.agentHandle || input.openedByAgent || handle(input.agentHandle) !== handle(input.reviewerHandle))
+  if (!input.isReviewer || input.openedByAgent)
     return void 0;
   const author = input.authorHandle ? handle(input.authorHandle) : "author";
   const number = input.pullRequestNumber ?? "N";
   const headSha = input.headSha ?? "<head sha>";
-  return `Checks are green on PR #${number} at ${headSha}${input.briefRevision ? ` with assigned brief revision ${input.briefRevision}` : ""}. Review it now with the beeline-review skill against that exact head and current assigned brief. FAIL: reply \`@${author}\` with the confirmed findings to fix. PASS: call the approve_merge tool for ${headSha}${input.briefRevision ? ` with briefRevision=${input.briefRevision}` : ""}, then reply \`approved ${headSha}\` without tagging ${author}: the server merges it, and a tag would wake the author for nothing. Never merge yourself or tell the author to merge. Never say you are holding or waiting for checks.`;
+  return `Checks are green on PR #${number} at ${headSha}${input.briefRevision ? ` with assigned brief revision ${input.briefRevision}` : ""}. Review it now with the beeline-review skill against that exact head and current assigned brief. FAIL: call record_validation_stage with stage "review", status "failed", and headSha ${headSha}, then reply \`@${author}\` with the confirmed findings and the reviewed head ${headSha} to fix. PASS: call the approve_merge tool for ${headSha}${input.briefRevision ? ` with briefRevision=${input.briefRevision}` : ""}, then reply \`approved ${headSha}\` without tagging ${author}: the server merges it, and a tag would wake the author for nothing. Never merge yourself or tell the author to merge. Never say you are holding or waiting for checks.`;
 }
 function cornerSelfReviewerInstruction(input) {
-  if (!input.reviewerHandle || !input.agentHandle || !input.openedByAgent || handle(input.agentHandle) !== handle(input.reviewerHandle))
+  if (!input.isReviewer || !input.openedByAgent)
     return void 0;
   return "Once the pull request exists, reply with its full URL and end the turn. You are this Room's reviewer, so your own pull request needs no review: do not request one or tag any agent for review. The server merges it once checks are green, yolo is on, and no human hold stands; never merge it yourself. You are woken only to fix failing checks or a merge GitHub refused.";
 }
@@ -37324,11 +37853,7 @@ The soul is not authority and never changes your tools, permissions, roles, or m
     budgetBytes: 520,
     layer: "surface",
     surfaces: ["code-corner"],
-    render: ({ yoloMode, reviewerHandle, selfReviewer }) => (selfReviewer ? cornerSelfReviewerInstruction({
-      reviewerHandle,
-      agentHandle: reviewerHandle,
-      openedByAgent: true
-    }) : cornerMergeInstruction(Boolean(yoloMode), reviewerHandle)) + " Never merge any other pull request."
+    render: ({ yoloMode, reviewerHandle, selfReviewer }) => (selfReviewer ? cornerSelfReviewerInstruction({ isReviewer: true, openedByAgent: true }) : cornerMergeInstruction(Boolean(yoloMode), reviewerHandle)) + " Never merge any other pull request."
   },
   {
     id: "corner.checks",
@@ -38228,7 +38753,7 @@ var MonolithRoomTurnLoop = class {
     const cached = this.deliveredAttachments.get(item.id);
     if (cached)
       return cached;
-    const delivered = await deliverAttachments(item.attachments, join14(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
+    const delivered = await deliverAttachments(item.attachments, join15(this.attachmentDir, item.id.replace(/[^\w-]/g, "_")), this.options.fetchImpl);
     this.deliveredAttachments.set(item.id, withoutImageData(delivered));
     return delivered;
   }
@@ -38415,7 +38940,7 @@ var MonolithRoomTurnLoop = class {
       root: this.options.config.agentHomeRoot,
       squireScope,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      isReviewer: isConfiguredReviewer(self?.handle, configuration.reviewerHandle),
+      isReviewer: configuration.isReviewer === true,
       grantedHostRoutes: mountedHostRoutes,
       extraHostRoutes: registryHostDeclarations,
       resourceAuthFile,
@@ -38444,7 +38969,7 @@ var MonolithRoomTurnLoop = class {
       args: this.options.config.agentArgs ?? []
     }, selection);
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join14(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join15(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     this.sessionStateDirs = stateDirs;
     const homeStateDirs = harnessHomeStateDirs(harnessLabel, agentEnv.HOME ?? operatorHome);
@@ -38693,7 +39218,6 @@ var MonolithRoomTurnLoop = class {
     };
     this.activeTurn = active;
     active.promise = this.prompt(active).catch((error) => {
-      this.options.health.failure(1e3);
       console.error(`[thin-core] monolith Room ${this.options.roomId} turn failed:`, error);
     }).finally(() => {
       if (this.activeTurn === active) {
@@ -39076,56 +39600,60 @@ var MonolithRoomTurnLoop = class {
     }
   }
   async run() {
-    const { api, roomId, signal } = this.options;
+    const { api, roomId, signal, supervisor } = this.options;
+    const intake = (progress) => runServerCommandIntake({
+      api,
+      roomId,
+      agentId: this.agent.publicKey,
+      context: this.commandContext,
+      signal,
+      pollMs: this.options.pollMs,
+      presence: {
+        ...this.options.config.daemonReleaseVersion ? { releaseVersion: this.options.config.daemonReleaseVersion } : {},
+        ...this.options.config.daemonSourceSha ? { sourceSha: this.options.config.daemonSourceSha } : {},
+        available: !this.options.config.modelUnavailable
+      },
+      onWake: (wake) => {
+        this.wakeIntake = wake;
+      },
+      onPoll: () => {
+        progress();
+        this.options.health.poll();
+      },
+      onSubscriptionState: this.options.onSubscriptionState,
+      onError: (error) => {
+        this.options.onIntakeError?.(error);
+        console.error("[thin-core] Room command failed", error);
+      },
+      // Marks this loop busy the instant it attempts to claim a real
+      // turn, before the claim's own network round trip and before
+      // context.enter()'s own file I/O - closing the window where
+      // RoomRuntimeCoordinator.reconcile's repository-revision restart
+      // could see a claiming-but-not-yet-`busy` Room as idle and stop it,
+      // cancelling a turn that had already begun (or was about to) (C112).
+      onClaiming: () => {
+        this.busy = true;
+      },
+      onClaimFailed: () => {
+        this.busy = false;
+      },
+      onEnter: (command) => this.squireRelay.activate(command, this.commandContext.generationId),
+      onLeave: (command) => this.squireRelay.deactivate(command.turnRequestId, this.pausedOnGrantRequestId),
+      stop: (requestId) => this.stopTurn(requestId),
+      restart: () => this.options.onRestartRequested?.(),
+      canStartTurn: this.options.canStartTurn,
+      run: async (command) => {
+        const item = {
+          ...command.source,
+          id: command.turnRequestId,
+          body: command.action === "resume" ? `Resume the paused turn. The server supplied this answer: ${command.source.body}` : command.source.body
+        };
+        this.startPrompt(item);
+        await this.activeTurn?.promise;
+      }
+    });
     try {
-      await runServerCommandIntake({
-        api,
-        roomId,
-        agentId: this.agent.publicKey,
-        context: this.commandContext,
-        signal,
-        pollMs: this.options.pollMs,
-        presence: {
-          ...this.options.config.daemonReleaseVersion ? { releaseVersion: this.options.config.daemonReleaseVersion } : {},
-          ...this.options.config.daemonSourceSha ? { sourceSha: this.options.config.daemonSourceSha } : {},
-          available: !this.options.config.modelUnavailable
-        },
-        onWake: (wake) => {
-          this.wakeIntake = wake;
-        },
-        onPoll: () => this.options.health.poll(),
-        onSubscriptionState: this.options.onSubscriptionState,
-        onError: (error) => {
-          this.options.onIntakeError?.(error);
-          console.error("[thin-core] Room command failed", error);
-        },
-        // Marks this loop busy the instant it attempts to claim a real
-        // turn, before the claim's own network round trip and before
-        // context.enter()'s own file I/O - closing the window where
-        // RoomRuntimeCoordinator.reconcile's repository-revision restart
-        // could see a claiming-but-not-yet-`busy` Room as idle and stop it,
-        // cancelling a turn that had already begun (or was about to) (C112).
-        onClaiming: () => {
-          this.busy = true;
-        },
-        onClaimFailed: () => {
-          this.busy = false;
-        },
-        onEnter: (command) => this.squireRelay.activate(command, this.commandContext.generationId),
-        onLeave: (command) => this.squireRelay.deactivate(command.turnRequestId, this.pausedOnGrantRequestId),
-        stop: (requestId) => this.stopTurn(requestId),
-        restart: () => this.options.onRestartRequested?.(),
-        canStartTurn: this.options.canStartTurn,
-        run: async (command) => {
-          const item = {
-            ...command.source,
-            id: command.turnRequestId,
-            body: command.action === "resume" ? `Resume the paused turn. The server supplied this answer: ${command.source.body}` : command.source.body
-          };
-          this.startPrompt(item);
-          await this.activeTurn?.promise;
-        }
-      });
+      await (supervisor ? supervisor.supervise(`Room ${roomId}`, signal, intake) : intake(() => void 0));
     } finally {
       this.squireRelay.close();
       this.options.grantRunner?.unregister(roomId);
@@ -39311,8 +39839,8 @@ process.exit(result.status ?? 1);
 // apps/body/dist/warm-node-modules.js
 import { createHash as createHash9, randomUUID as randomUUID10 } from "node:crypto";
 import { constants as fsConstants3 } from "node:fs";
-import { chmod as chmod9, copyFile as copyFile2, link, lstat as lstat4, mkdir as mkdir19, readdir as readdir8, readFile as readFile20, readlink as readlink2, rename as rename7, rm as rm9, stat as stat7, symlink as symlink3, utimes } from "node:fs/promises";
-import { dirname as dirname17, join as join15, resolve as resolve27 } from "node:path";
+import { chmod as chmod9, copyFile as copyFile2, link, lstat as lstat4, mkdir as mkdir19, readdir as readdir8, readFile as readFile21, readlink as readlink2, rename as rename8, rm as rm9, stat as stat7, symlink as symlink3, utimes } from "node:fs/promises";
+import { dirname as dirname17, join as join16, resolve as resolve27 } from "node:path";
 var STORE_FORMAT = "v1";
 var STAGING_PREFIX = ".beeline-warm-";
 var STAGING_SWEEP_MS = 24 * 60 * 60 * 1e3;
@@ -39333,7 +39861,7 @@ function isPlanRefusal(value) {
   return "failure" in value;
 }
 async function readWarmPlan(worktreePath) {
-  const lockfile = await readFile20(resolve27(worktreePath, "package-lock.json")).catch(() => void 0);
+  const lockfile = await readFile21(resolve27(worktreePath, "package-lock.json")).catch(() => void 0);
   if (!lockfile)
     return { failure: "no-lockfile" };
   const packages = parseLockfilePackages(lockfile);
@@ -39398,7 +39926,7 @@ async function seedWarmNodeModules(input) {
     for (const tree of plan.trees) {
       const target = resolve27(input.worktreePath, tree);
       await mkdir19(dirname17(target), { recursive: true });
-      await rename7(resolve27(staging, tree), target);
+      await rename8(resolve27(staging, tree), target);
       placed.push(target);
     }
     return { reason: "seeded", key: plan.key };
@@ -39443,7 +39971,7 @@ async function harvestWarmNodeModules(input) {
     if (!await stagedTreeIsPublishable(input.worktreePath, staging, plan.key)) {
       return { reason: "changed", key: plan.key };
     }
-    await rename7(staging, entry);
+    await rename8(staging, entry);
     await pruneWarmStore(input.storeRoot, WARM_STORE_MAX_ENTRIES);
     return { reason: "stored", key: plan.key };
   } catch (error) {
@@ -39458,18 +39986,18 @@ async function stagedTreeIsPublishable(worktreePath, staging, key) {
   const settled = await readWarmPlan(worktreePath);
   if (isPlanRefusal(settled) || settled.key !== key)
     return false;
-  const hidden = join15("node_modules", ".package-lock.json");
+  const hidden = join16("node_modules", ".package-lock.json");
   const [copied, current] = await Promise.all([
-    readFile20(resolve27(staging, hidden)).catch(() => void 0),
-    readFile20(resolve27(worktreePath, hidden)).catch(() => void 0)
+    readFile21(resolve27(staging, hidden)).catch(() => void 0),
+    readFile21(resolve27(worktreePath, hidden)).catch(() => void 0)
   ]);
   if (!copied || !current || !copied.equals(current))
     return false;
   return (await missingInstalledPackages(worktreePath, staging)).length === 0;
 }
 async function missingInstalledPackages(worktreePath, treeRoot = worktreePath) {
-  const wanted = parseLockfilePackages(await readFile20(resolve27(worktreePath, "package-lock.json")).catch(() => void 0));
-  const installed = parseLockfilePackages(await readFile20(resolve27(treeRoot, "node_modules", ".package-lock.json")).catch(() => void 0));
+  const wanted = parseLockfilePackages(await readFile21(resolve27(worktreePath, "package-lock.json")).catch(() => void 0));
+  const installed = parseLockfilePackages(await readFile21(resolve27(treeRoot, "node_modules", ".package-lock.json")).catch(() => void 0));
   if (!wanted)
     return ["package-lock.json is unreadable"];
   if (!installed)
@@ -39496,7 +40024,7 @@ async function missingInstalledPackages(worktreePath, treeRoot = worktreePath) {
   return missing.sort();
 }
 async function isInstalledPackage(path) {
-  return stat7(join15(path, "package.json")).then((info) => info.isFile(), () => false);
+  return stat7(join16(path, "package.json")).then((info) => info.isFile(), () => false);
 }
 var INTEGRITY_READ_CONCURRENCY = 64;
 async function mapWithLimit(values, limit, visit) {
@@ -39530,8 +40058,8 @@ function isContainedTreePath(value) {
 async function cloneTree(source, target, file, topLevel = true) {
   await mkdir19(target, { recursive: true, mode: 493 });
   for (const entry of await readdir8(source, { withFileTypes: true })) {
-    const from = join15(source, entry.name);
-    const to = join15(target, entry.name);
+    const from = join16(source, entry.name);
+    const to = join16(target, entry.name);
     if (entry.isSymbolicLink()) {
       await symlink3(await readlink2(from), to);
       continue;
@@ -39561,13 +40089,13 @@ async function pruneWarmStore(storeRoot, keep) {
   const names = (await readdir8(storeRoot).catch(() => [])).filter((name) => !name.startsWith(STAGING_PREFIX));
   const entries = [];
   for (const name of names) {
-    const info = await lstat4(join15(storeRoot, name)).catch(() => void 0);
+    const info = await lstat4(join16(storeRoot, name)).catch(() => void 0);
     if (info?.isDirectory())
       entries.push({ name, usedAt: info.mtimeMs });
   }
   const dropped = entries.sort((a2, b) => b.usedAt - a2.usedAt || a2.name.localeCompare(b.name)).slice(keep);
   for (const entry of dropped) {
-    await rm9(join15(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
+    await rm9(join16(storeRoot, entry.name), { recursive: true, force: true }).catch(() => void 0);
   }
   return dropped.map((entry) => entry.name);
 }
@@ -39576,7 +40104,7 @@ async function sweepStaleStaging(storeRoot, now2) {
   for (const name of entries) {
     if (!name.startsWith(STAGING_PREFIX))
       continue;
-    const path = join15(storeRoot, name);
+    const path = join16(storeRoot, name);
     const info = await lstat4(path).catch(() => void 0);
     if (!info || now2 - info.mtimeMs < STAGING_SWEEP_MS)
       continue;
@@ -40092,8 +40620,7 @@ var MonolithCornerTurnLoop = class {
     this.yoloMode = configuration.yoloMode;
     const opener = this.options.openedBy ? roster.members.find((member) => member.identityId === this.options.openedBy) : void 0;
     const reviewerInput = {
-      reviewerHandle: configuration.reviewerHandle,
-      agentHandle: self?.handle,
+      isReviewer: configuration.isReviewer === true,
       authorHandle: opener?.handle,
       openedByAgent: !this.options.openedBy || this.options.openedBy === this.agent.publicKey
     };
@@ -40135,7 +40662,7 @@ var MonolithCornerTurnLoop = class {
       root: this.options.config.agentHomeRoot,
       squireScope,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      isReviewer: isConfiguredReviewer(self?.handle, configuration.reviewerHandle),
+      isReviewer: Boolean(reviewerInstruction),
       grantedHostRoutes: mountedHostRoutes,
       extraHostRoutes: registryHostDeclarations,
       resourceAuthFile,
@@ -40193,7 +40720,7 @@ var MonolithCornerTurnLoop = class {
       args: this.options.config.agentArgs ?? []
     }, selection);
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
-    this.attachmentDir = tmpDir ? join16(tmpDir, "beeline-attachments") : void 0;
+    this.attachmentDir = tmpDir ? join17(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     const homeStateDirs = harnessHomeStateDirs(harnessLabel, agentEnv.HOME ?? operatorHome);
     await Promise.all(homeStateDirs.map((dir) => mkdir20(dir, { recursive: true })));
@@ -40594,10 +41121,10 @@ var MonolithCornerTurnLoop = class {
             size: file.size
           }));
           const allAttachments = [...attachments, ...briefAttachments];
-          const delivered = this.attachmentDir && allAttachments.length ? await deliverAttachments(allAttachments, join16(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : [];
+          const delivered = this.attachmentDir && allAttachments.length ? await deliverAttachments(allAttachments, join17(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : [];
           const briefFileLines = await Promise.all((restored.brief?.attachments ?? []).map(async (file, index) => {
             const entry = delivered.find((item) => item.attachment === briefAttachments[index]);
-            const verified = entry?.path && createHash10("sha256").update(await readFile21(entry.path)).digest("hex") === file.sha256;
+            const verified = entry?.path && createHash10("sha256").update(await readFile22(entry.path)).digest("hex") === file.sha256;
             return `- ${file.title} (${file.purpose}; ${file.required ? "required" : "optional"}; sha256 ${file.sha256}): ${verified ? entry.path : "UNAVAILABLE OR CONTENT MISMATCH"}`;
           }));
           const missingRequiredBriefFile = (restored.brief?.attachments ?? []).some((file, index) => file.required && briefFileLines[index]?.includes("UNAVAILABLE OR CONTENT MISMATCH"));
@@ -41037,68 +41564,72 @@ ${deviceGrantResumePrompt(grantedDevice, result.agentText)}`);
     });
   }
   async run() {
-    const { api, cornerId, signal } = this.options;
-    try {
-      await runServerCommandIntake({
-        api,
-        roomId: cornerId,
-        agentId: this.agent.publicKey,
-        context: this.commandContext,
-        signal,
-        pollMs: this.options.pollMs,
-        presence: {
-          ...this.options.config.daemonReleaseVersion ? { releaseVersion: this.options.config.daemonReleaseVersion } : {},
-          ...this.options.config.daemonSourceSha ? { sourceSha: this.options.config.daemonSourceSha } : {},
-          available: !this.options.config.modelUnavailable
-        },
-        onWake: (wake) => {
-          this.wakeIntake = wake;
-        },
-        onPoll: () => this.options.onPoll(),
-        onSubscriptionState: this.options.onSubscriptionState,
-        onError: (error) => {
-          this.options.onIntakeError?.(error);
-          console.error("[thin-core] corner command failed", error);
-        },
-        // See monolith-room-turn.ts (C112): mark busy the instant a claim
-        // attempt starts, before its own network round trip and before
-        // context.enter()'s own file I/O, so a reconcile busy-check landing
-        // anywhere in that window can never see this corner as idle when a
-        // turn was already claimed (or about to be).
-        onClaiming: () => {
-          this.busy = true;
-        },
-        onClaimFailed: () => {
-          this.busy = false;
-        },
-        onEnter: (command) => this.squireRelay.activate(command, this.commandContext.generationId),
-        onLeave: (command) => this.squireRelay.deactivate(command.turnRequestId),
-        stop: (requestId) => this.stopTurn(requestId),
-        restart: () => this.options.onRestartRequested?.(),
-        canStartTurn: this.options.canStartTurn,
-        closed: async () => {
-          if (this.closePushed) {
-            this.closePushed = false;
-            await this.harvest;
-            await this.options.onCloseRequested();
-            return true;
-          }
-          if (!this.reconcileCloseRequested)
-            return false;
-          this.reconcileCloseRequested = false;
-          const state = await api.execute("getCornerRestoreState", { cornerId });
-          if (this.options.lane === "no_code" && state.lane !== "no_code") {
-            this.options.onLaneChanged?.();
-            return true;
-          }
-          if (!state.closeRequested)
-            return false;
+    const { api, cornerId, signal, supervisor } = this.options;
+    const intake = (progress) => runServerCommandIntake({
+      api,
+      roomId: cornerId,
+      agentId: this.agent.publicKey,
+      context: this.commandContext,
+      signal,
+      pollMs: this.options.pollMs,
+      presence: {
+        ...this.options.config.daemonReleaseVersion ? { releaseVersion: this.options.config.daemonReleaseVersion } : {},
+        ...this.options.config.daemonSourceSha ? { sourceSha: this.options.config.daemonSourceSha } : {},
+        available: !this.options.config.modelUnavailable
+      },
+      onWake: (wake) => {
+        this.wakeIntake = wake;
+      },
+      onPoll: () => {
+        progress();
+        this.options.onPoll();
+      },
+      onSubscriptionState: this.options.onSubscriptionState,
+      onError: (error) => {
+        this.options.onIntakeError?.(error);
+        console.error("[thin-core] corner command failed", error);
+      },
+      // See monolith-room-turn.ts (C112): mark busy the instant a claim
+      // attempt starts, before its own network round trip and before
+      // context.enter()'s own file I/O, so a reconcile busy-check landing
+      // anywhere in that window can never see this corner as idle when a
+      // turn was already claimed (or about to be).
+      onClaiming: () => {
+        this.busy = true;
+      },
+      onClaimFailed: () => {
+        this.busy = false;
+      },
+      onEnter: (command) => this.squireRelay.activate(command, this.commandContext.generationId),
+      onLeave: (command) => this.squireRelay.deactivate(command.turnRequestId),
+      stop: (requestId) => this.stopTurn(requestId),
+      restart: () => this.options.onRestartRequested?.(),
+      canStartTurn: this.options.canStartTurn,
+      closed: async () => {
+        if (this.closePushed) {
+          this.closePushed = false;
           await this.harvest;
           await this.options.onCloseRequested();
           return true;
-        },
-        run: (command) => this.prompt(command.turnRequestId, command.source.body, command.source.attachments, command.source.authorId, command.reason === "corner_check" ? [command.source.body] : void 0, command.source.type === "message" ? command.sourceMessageId : void 0)
-      });
+        }
+        if (!this.reconcileCloseRequested)
+          return false;
+        this.reconcileCloseRequested = false;
+        const state = await api.execute("getCornerRestoreState", { cornerId });
+        if (this.options.lane === "no_code" && state.lane !== "no_code") {
+          this.options.onLaneChanged?.();
+          return true;
+        }
+        if (!state.closeRequested)
+          return false;
+        await this.harvest;
+        await this.options.onCloseRequested();
+        return true;
+      },
+      run: (command) => this.prompt(command.turnRequestId, command.source.body, command.source.attachments, command.source.authorId, command.reason === "corner_check" ? [command.source.body] : void 0, command.source.type === "message" ? command.sourceMessageId : void 0)
+    });
+    try {
+      await (supervisor ? supervisor.supervise(`corner ${cornerId}`, signal, intake) : intake(() => void 0));
     } finally {
       this.squireRelay.close();
       this.options.grantRunner?.unregister(cornerId);
@@ -41170,6 +41701,89 @@ var SurfaceHealth = class {
   }
 };
 
+// apps/body/dist/room-supervisor.js
+var ROOM_RETRY_DELAYS_MS = [1e3, 5e3, 3e4];
+var RoomSupervisor = class {
+  delaysMs;
+  #parked = /* @__PURE__ */ new Set();
+  #wakes = 0;
+  constructor(delaysMs = ROOM_RETRY_DELAYS_MS) {
+    this.delaysMs = delaysMs;
+  }
+  /** The live socket opened or discovery was woken: every waiting loop retries now. */
+  wake() {
+    this.#wakes += 1;
+    for (const resume of [...this.#parked])
+      resume();
+  }
+  /** Wakes so far; a wait that started from an older count does not wait. */
+  get wakes() {
+    return this.#wakes;
+  }
+  /** How many timed retries follow one failure before a loop parks. */
+  get retries() {
+    return this.delaysMs.length;
+  }
+  /**
+   * Wait before retrying failure number `failures` (1-based). Within the
+   * bound the fixed delay applies, and a wake may cut it short; past the bound
+   * only a wake (or the abort) ends the wait. A wake that already arrived
+   * after `since` (a `wakes` count) ends it at once, so none is lost.
+   */
+  retryDelay(failures, signal, since = this.#wakes) {
+    const delay = this.delaysMs[failures - 1];
+    return new Promise((resolve40) => {
+      let timer;
+      const done = () => {
+        clearTimeout(timer);
+        this.#parked.delete(done);
+        signal?.removeEventListener("abort", done);
+        resolve40();
+      };
+      this.#parked.add(done);
+      signal?.addEventListener("abort", done, { once: true });
+      if (signal?.aborted || this.#wakes !== since) {
+        done();
+        return;
+      }
+      if (delay !== void 0) {
+        timer = setTimeout(done, delay);
+        timer.unref?.();
+      }
+    });
+  }
+  /**
+   * Run one Room or corner intake under supervision: a failed read never ends
+   * it. `run` resolves only when the intake itself is finished (aborted or
+   * closed); it calls `progress` once its reads succeed again, which restores
+   * the full retry budget. The intake rejects only after its active turn has
+   * settled, so re-entering cannot claim the same command twice.
+   */
+  async supervise(label, signal, run2) {
+    let failures = 0;
+    for (; ; ) {
+      const since = this.#wakes;
+      try {
+        await run2(() => {
+          failures = 0;
+        });
+        return;
+      } catch (error) {
+        if (signal?.aborted)
+          return;
+        failures += 1;
+        const parked = failures > this.delaysMs.length;
+        console.error(`[thin-core] ${label} intake failed; ${parked ? "waiting for the next live open or discovery wake" : `retry ${failures} of ${this.delaysMs.length} in ${this.delaysMs[failures - 1]}ms`}:`, error);
+        await this.retryDelay(failures, signal, since);
+        if (signal?.aborted)
+          return;
+        if (parked)
+          failures = 0;
+      }
+    }
+  }
+};
+
 // apps/body/dist/room-runtime.js
 init_runtime();
 
@@ -41597,11 +42211,6 @@ var SessionScheduler = class {
 // apps/body/dist/room-runtime.js
 var REMOVAL_CONFIRMATION_READS = 2;
 var ROOM_JOIN_CONCURRENCY = 4;
-var DEFAULT_ROOM_WATCHDOG_STALE_MS = 9e4;
-var DEFAULT_RECONCILE_HEARTBEAT_MS = 10 * 6e4;
-function defaultReconcileHeartbeatMs(random = Math.random) {
-  return DEFAULT_RECONCILE_HEARTBEAT_MS + Math.floor(random() * 5 * 6e4);
-}
 var DEFAULT_DRAIN_DEADLINE_MS = 30 * 6e4;
 var CORNER_BRANCH_DELETE_ATTEMPTS = 3;
 var CornerCredentialLookupError = class extends Error {
@@ -41609,25 +42218,6 @@ var CornerCredentialLookupError = class extends Error {
     super("corner repository credential lookup failed", { cause });
   }
 };
-var DiscoveryWakes = class {
-  arrived = 0;
-  served = 0;
-  /** Called for every agent-directed `rooms-changed` wake. */
-  wake() {
-    this.arrived += 1;
-  }
-  needsFastReconcile() {
-    return this.arrived !== this.served;
-  }
-  /** Snapshot at reconcile entry: the wake count its reads will cover. */
-  beginReconcile() {
-    return this.arrived;
-  }
-  /** Clear only wakes the completed start pass actually served. */
-  completeReconcile(covered) {
-    this.served = Math.max(this.served, covered);
-  }
-};
 function shouldPostInitialCornerWorkingState(restore) {
   return !restore.lifecycle?.branch && !restore.lifecycle?.pr;
 }
@@ -41908,8 +42498,6 @@ var RoomRuntimeCoordinator = class {
   /** Parent ownership retained so a failed corner listing never authorizes removal. */
   monolithCornerParents = /* @__PURE__ */ new Map();
   now;
-  watchdogStaleMs;
-  reconcileHeartbeatMs;
   drainDeadlineMs;
   drainDeadlineAt;
   workspaceRemovalConfirmations = 0;
@@ -41921,14 +42509,9 @@ var RoomRuntimeCoordinator = class {
   repositoryStateFlights = /* @__PURE__ */ new Map();
   tokenCache = /* @__PURE__ */ new Map();
   tokenFlights = /* @__PURE__ */ new Map();
-  confirmationPending = false;
   restartRequested = false;
-  /** Unscoped agent-directed discovery wakes (#1369), counted instead of
-   *  flagged: a wake that arrives while a reconcile is already running must
-   *  survive its start-pass clearing, or a reconnect mid-reconcile waits a
-   *  heartbeat for a wake the daemon already received. A scoped membership
-   *  event applies incrementally and never touches this latch. */
-  discoveryWakes = new DiscoveryWakes();
+  /** Keeps Room and corner intakes alive across failed reads, without polling. */
+  supervisor = new RoomSupervisor();
   discoveryWakeListener;
   interactiveIdleListener;
   /** One command-grant runner per daemon; Rooms and corners register their checkouts on it. */
@@ -41975,8 +42558,6 @@ var RoomRuntimeCoordinator = class {
       void this.scheduler.suspendIdle().catch((error) => console.error("[body] config-change session restart failed", error));
       void Promise.resolve(this.options.onConfigChanged?.()).catch((error) => console.error("[body] config-change catalog refresh failed", error));
     });
-    this.watchdogStaleMs = options.watchdogStaleMs ?? DEFAULT_ROOM_WATCHDOG_STALE_MS;
-    this.reconcileHeartbeatMs = options.reconcileHeartbeatMs ?? defaultReconcileHeartbeatMs();
     this.drainDeadlineMs = options.drainDeadlineMs ?? DEFAULT_DRAIN_DEADLINE_MS;
     const fixedWorkspaceCeiling = process.env.BUZZY_BODY_MAX_SESSIONS;
     this.scheduler = new SessionScheduler({
@@ -41998,12 +42579,18 @@ var RoomRuntimeCoordinator = class {
   setInteractiveIdleListener(listener) {
     this.interactiveIdleListener = listener;
   }
-  reconnectAfterFailure() {
-    if (!this.options.daemonApi.supportsDiscoveryWake?.())
-      this.options.daemonApi.reconnectLive?.();
+  /**
+   * A failed reconcile makes the live socket suspect: it is pinged, and a
+   * silent one is replaced, which works with any server version. A response
+   * the server actually sent (or a full local read budget) says nothing about
+   * the socket.
+   */
+  suspectLink(error) {
+    if (!(error instanceof DaemonApiError))
+      this.options.daemonApi.link?.suspect();
   }
   wakeDiscovery() {
-    this.discoveryWakes.wake();
+    this.supervisor.wake();
     this.discoveryWakeListener?.();
   }
   activeRoomCount() {
@@ -42027,12 +42614,6 @@ var RoomRuntimeCoordinator = class {
   schedulerSnapshot() {
     return this.scheduler.snapshot();
   }
-  needsFastReconcile() {
-    return this.confirmationPending || this.discoveryWakes.needsFastReconcile();
-  }
-  reconcileHeartbeatIntervalMs() {
-    return this.reconcileHeartbeatMs;
-  }
   isWorkspaceIdle() {
     return this.activeTurnCount() === 0;
   }
@@ -42058,6 +42639,16 @@ var RoomRuntimeCoordinator = class {
       room.controller.abort();
     return true;
   }
+  /**
+   * Undo `quiesceForUpdateIfIdle` after a managed restart failed: clear the
+   * latch and let reconciliation start the Room loops the quiesce stopped.
+   */
+  resumeServing() {
+    if (this.stopped)
+      return;
+    this.restartRequested = false;
+    this.wakeDiscovery();
+  }
   setDrainDeadlineAt(deadlineAt) {
     if (Number.isFinite(deadlineAt)) {
       this.drainDeadlineAt = Math.min(this.drainDeadlineAt ?? Number.POSITIVE_INFINITY, deadlineAt);
@@ -42080,9 +42671,7 @@ var RoomRuntimeCoordinator = class {
   async reconcile() {
     if (this.stopped)
       return "member";
-    this.confirmationPending = false;
     const existingRooms = new Set(this.running.keys());
-    const coveredWakes = this.discoveryWakes.beginReconcile();
     const bootstrap = await this.options.daemonApi.execute("getDaemonBootstrap", {
       agentId: this.agent.publicKey
     });
@@ -42091,7 +42680,6 @@ var RoomRuntimeCoordinator = class {
     if (!bootstrap.workspaceIds.includes(this.runtime.communityId)) {
       this.workspaceRemovalConfirmations += 1;
       if (this.workspaceRemovalConfirmations < REMOVAL_CONFIRMATION_READS) {
-        this.confirmationPending = true;
         this.wakeDiscovery();
         return "unknown";
       }
@@ -42179,10 +42767,8 @@ var RoomRuntimeCoordinator = class {
         continue;
       const confirmations = (this.roomRemovalConfirmations.get(channelId) ?? 0) + 1;
       this.roomRemovalConfirmations.set(channelId, confirmations);
-      if (confirmations < REMOVAL_CONFIRMATION_READS) {
-        this.confirmationPending = true;
+      if (confirmations < REMOVAL_CONFIRMATION_READS)
         continue;
-      }
       await this.stopRunning(channelId, running);
       this.roomRemovalConfirmations.delete(channelId);
     }
@@ -42207,7 +42793,6 @@ var RoomRuntimeCoordinator = class {
     for (const [roomId, running] of this.running)
       if (existingRooms.has(roomId))
         running.body.requestReconciliation();
-    this.discoveryWakes.completeReconcile(coveredWakes);
     if (this.roomRemovalConfirmations.size)
       this.wakeDiscovery();
     return "member";
@@ -42310,7 +42895,6 @@ var RoomRuntimeCoordinator = class {
         await this.reapCornerScratch(running.scratch);
     } catch (error) {
       console.error(`[thin-core] corner ${channelId} cleanup failed; will retry:`, error);
-      this.confirmationPending = true;
     }
   }
   roomRecord(roomId) {
@@ -42373,7 +42957,6 @@ var RoomRuntimeCoordinator = class {
     const controller = new AbortController();
     const cwd = this.roomRoot(roomId);
     const grantRunnerEndpoint = await this.grantRunnerEndpoint();
-    const startedAt = this.now();
     const loop = new MonolithRoomTurnLoop({
       roomId,
       workspaceId: this.runtime.communityId,
@@ -42386,18 +42969,12 @@ var RoomRuntimeCoordinator = class {
       api: this.options.daemonApi,
       scheduler: this.scheduler,
       signal: controller.signal,
-      health: {
-        poll: () => this.notePoll(roomId),
-        failure: (retryInMs) => this.noteFailure(roomId, retryInMs),
-        presence: () => void 0
-      },
+      health: { poll: () => this.notePoll(roomId) },
       onSubscriptionState: (connected) => this.surfaceHealth.subscribed(roomId, connected),
       onIntakeError: () => this.surfaceHealth.degraded(roomId, "Room command intake failed"),
-      onCornerOpened: () => {
-        this.confirmationPending = true;
-      },
       onRestartRequested: () => this.requestLifecycleRestart(),
-      canStartTurn: () => !this.restartRequested
+      canStartTurn: () => !this.restartRequested,
+      supervisor: this.supervisor
     });
     const promise = loop.run().catch((error) => {
       if (!controller.signal.aborted) {
@@ -42413,14 +42990,7 @@ var RoomRuntimeCoordinator = class {
       await promise;
       return;
     }
-    this.running.set(roomId, {
-      body: loop,
-      controller,
-      promise,
-      lastPollAt: startedAt,
-      backoffUntil: 0,
-      recovering: false
-    });
+    this.running.set(roomId, { body: loop, controller, promise });
     console.log(`[thin-core] serving monolith Room ${roomId}`);
   }
   /**
@@ -42546,7 +43116,6 @@ var RoomRuntimeCoordinator = class {
       }
       const controller = new AbortController();
       const grantRunnerEndpoint = await this.grantRunnerEndpoint();
-      const startedAt = this.now();
       const loop = new MonolithCornerTurnLoop({
         cornerId: corner.cornerId,
         grantRunner: this.grantRunner,
@@ -42574,7 +43143,6 @@ var RoomRuntimeCoordinator = class {
         scheduler: this.scheduler,
         signal: controller.signal,
         onPoll: () => this.notePoll(corner.cornerId),
-        onFailure: (retryInMs) => this.noteFailure(corner.cornerId, retryInMs),
         onSubscriptionState: (connected) => this.surfaceHealth.subscribed(corner.cornerId, connected),
         onIntakeError: () => this.surfaceHealth.degraded(corner.cornerId, "corner command intake failed"),
         onCloseRequested: () => worktree ? this.reapCornerWorktree({
@@ -42586,7 +43154,8 @@ var RoomRuntimeCoordinator = class {
         }) : this.reapCornerScratch({ path: workspacePath, cornerId: corner.cornerId }),
         onLaneChanged: () => void this.applyCornerRestart(corner.cornerId).catch((error) => console.error("[thin-core] corner lane-change restart failed", error)),
         onRestartRequested: () => this.requestLifecycleRestart(),
-        canStartTurn: () => !this.restartRequested
+        canStartTurn: () => !this.restartRequested,
+        supervisor: this.supervisor
       });
       const promise = loop.run().catch((error) => {
         if (!controller.signal.aborted) {
@@ -42607,9 +43176,6 @@ var RoomRuntimeCoordinator = class {
         body: loop,
         controller,
         promise,
-        lastPollAt: startedAt,
-        backoffUntil: 0,
-        recovering: false,
         ...worktree ? {
           worktree: {
             ...worktree,
@@ -42937,8 +43503,6 @@ var RoomRuntimeCoordinator = class {
     const room = this.running.get(roomId);
     if (!room)
       return;
-    room.lastPollAt = this.now();
-    room.backoffUntil = 0;
     if (this.deferredRepositoryRestarts.has(roomId) && !room.body.isBusy()) {
       this.deferredRepositoryRestarts.delete(roomId);
       void this.stopRunning(roomId, room).then(() => this.stopped ? void 0 : this.startRoom(roomId)).catch((error) => {
@@ -42949,29 +43513,6 @@ var RoomRuntimeCoordinator = class {
     if (this.isWorkspaceIdle())
       this.interactiveIdleListener?.();
   }
-  noteFailure(roomId, retryInMs) {
-    const room = this.running.get(roomId);
-    if (room)
-      room.backoffUntil = Math.max(room.backoffUntil, this.now() + retryInMs);
-  }
-  async watchdogTick() {
-    if (this.stopped)
-      return;
-    for (const [roomId, room] of [...this.running]) {
-      if (room.recovering || room.body.isBusy())
-        continue;
-      if (this.now() <= Math.max(room.lastPollAt + this.watchdogStaleMs, room.backoffUntil))
-        continue;
-      room.recovering = true;
-      room.controller.abort();
-      await room.promise.catch(() => void 0);
-      if (room.worktree) {
-        this.confirmationPending = true;
-      } else if (!this.stopped && !this.running.has(roomId)) {
-        this.startRoom(roomId);
-      }
-    }
-  }
   beginShutdown() {
     if (this.stopped)
       return;
@@ -43160,6 +43701,10 @@ var ThinDaemonCore = class {
   quiesceForUpdateIfIdle() {
     return this.roomRuntime.quiesceForUpdateIfIdle();
   }
+  /** A managed restart failed after intake closed: take turns again. */
+  resumeServing() {
+    this.roomRuntime.resumeServing();
+  }
   async prepareForForcedUpdateRestart() {
     await this.roomRuntime.prepareForForcedUpdateRestart();
   }
@@ -43192,25 +43737,35 @@ var ThinDaemonCore = class {
     try {
       if (!opts.signal?.aborted)
         await opts.onEstablished?.();
+      const supervisor = this.roomRuntime.supervisor;
+      let failures = 0;
       while (!opts.signal?.aborted) {
         this.pendingDiscovery = false;
+        const wakesBefore = supervisor.wakes;
         try {
           const membership = await this.roomRuntime.reconcile();
           if (membership === "not-member")
             return "agent-removed";
           this.discoveryStatus = membership === "unknown" ? "monolith membership degraded" : "";
+          failures = 0;
         } catch (error) {
           if (isAgentRemovedError(error))
             return "agent-removed";
-          console.error("[thin-core] discovery failed; waiting for live recovery:", error);
+          failures += 1;
+          console.error(failures > supervisor.retries ? "[thin-core] discovery failed; waiting for the next live open or discovery wake:" : `[thin-core] discovery failed; retry ${failures} of ${supervisor.retries}:`, error);
           this.discoveryStatus = `monolith discovery degraded: ${error instanceof Error ? error.message : String(error)}`;
-          this.roomRuntime.reconnectAfterFailure();
+          this.roomRuntime.suspectLink(error);
         }
         if (opts.signal?.aborted)
           break;
         await opts.onProgress?.(this.healthStatus());
-        if (!this.pendingDiscovery)
+        if (failures > 0) {
+          await supervisor.retryDelay(failures, opts.signal, wakesBefore);
+          if (failures > supervisor.retries)
+            failures = 0;
+        } else if (!this.pendingDiscovery) {
           await this.waitForDiscovery(opts.signal);
+        }
       }
       return "aborted";
     } finally {
@@ -43220,28 +43775,169 @@ var ThinDaemonCore = class {
   }
 };
 
-// apps/body/dist/daemon-shutdown.js
-var DAEMON_HARD_STOP_MS = 75e3;
-function installDaemonStopSignals(controller, options = {}) {
-  const emitter = options.emitter ?? process;
-  let timer;
-  const stop = () => {
-    if (controller.signal.aborted)
+// apps/body/dist/helper-lifecycle.js
+init_systemd();
+var HELPER_HARD_STOP_MS = 8e4;
+var HELPER_EXIT_CODES = {
+  stopped: 0,
+  "restart-requested": 0,
+  update: 0,
+  failed: 75,
+  "rolled-back": 75,
+  "force-update-failed": 75,
+  distress: DAEMON_DISTRESS_EXIT_STATUS,
+  "agent-removed": DELIBERATE_REMOVAL_EXIT_STATUS,
+  "unknown-agent": UNKNOWN_AGENT_EXIT_STATUS
+};
+var HelperLifecycle = class {
+  options;
+  #state = { kind: "serving" };
+  #hardStop;
+  #exitProcess;
+  constructor(options) {
+    this.options = options;
+    this.#exitProcess = options.exitProcess ?? ((code) => process.exit(code));
+  }
+  get state() {
+    return this.#state;
+  }
+  get serving() {
+    return this.#state.kind === "serving";
+  }
+  /** The reason the final stop was asked for, once one was. */
+  get stopReason() {
+    return this.#state.kind === "stopping" ? this.#state.reason : void 0;
+  }
+  /**
+   * Close intake. An update may only start from serving; `/restart` and a
+   * forced update also take over a waiting update. Returns whether this call
+   * moved the helper to quiescing.
+   */
+  quiesce(reason) {
+    const state = this.#state;
+    if (state.kind === "serving" || state.kind === "quiescing" && state.reason === "update" && reason !== "update") {
+      this.#state = { kind: "quiescing", reason };
+      return true;
+    }
+    return false;
+  }
+  /** A managed restart failed after intake closed: serve again. */
+  resume() {
+    if (this.#state.kind !== "quiescing")
+      return false;
+    this.#state = { kind: "serving" };
+    return true;
+  }
+  /**
+   * The managed update's idle gate: quiesce only while serving and only if
+   * `closeIntakeIfIdle` proves no turn is running (and closes intake in the
+   * same step). A busy helper stays serving, so the update waits.
+   */
+  quiesceUpdateIfIdle(closeIntakeIfIdle) {
+    return this.serving && closeIntakeIfIdle() && this.quiesce("update");
+  }
+  /** A managed restart failed after its quiesce: serve again and reopen intake. */
+  resumeAfterFailedUpdate(reopenIntake) {
+    const state = this.#state;
+    if (state.kind !== "quiescing" || state.reason !== "update" || !this.resume())
+      return false;
+    reopenIntake();
+    return true;
+  }
+  /** The final stop: abort the core, and exit no later than the hard limit. */
+  stop(reason) {
+    if (this.#state.kind === "stopping" || this.#state.kind === "exited")
       return;
-    timer = setTimeout(() => {
-      console.error("[thin-core] shutdown deadline reached; exiting old helper");
-      (options.hardExit ?? (() => process.exit(0)))();
-    }, options.timeoutMs ?? DAEMON_HARD_STOP_MS);
-    controller.abort();
-  };
-  emitter.once("SIGINT", stop);
-  emitter.once("SIGTERM", stop);
-  return () => {
-    if (timer)
-      clearTimeout(timer);
-    emitter.removeListener("SIGINT", stop);
-    emitter.removeListener("SIGTERM", stop);
-  };
+    this.#state = { kind: "stopping", reason };
+    this.#hardStop = setTimeout(() => {
+      console.error("[thin-core] shutdown deadline reached; exiting helper");
+      this.exit(reason);
+    }, this.options.hardStopMs ?? HELPER_HARD_STOP_MS);
+    this.#hardStop.unref?.();
+    this.options.controller.abort();
+  }
+  /** The one exit funnel: each reason maps to exactly one code. */
+  exit(reason) {
+    if (this.#state.kind === "exited")
+      return;
+    clearTimeout(this.#hardStop);
+    const code = HELPER_EXIT_CODES[reason];
+    this.#state = { kind: "exited", code };
+    this.#exitProcess(code);
+  }
+  /** SIGTERM and SIGINT are a final stop. */
+  installSignals(emitter = process) {
+    const stop = () => this.stop("stopped");
+    emitter.once("SIGINT", stop);
+    emitter.once("SIGTERM", stop);
+    return () => {
+      emitter.removeListener("SIGINT", stop);
+      emitter.removeListener("SIGTERM", stop);
+    };
+  }
+};
+function installUnhandledRejectionGuard(emitter = process) {
+  const log2 = (reason) => console.error("[thin-core] unhandled rejection (kept running):", reason);
+  emitter.on("unhandledRejection", log2);
+  return () => emitter.removeListener("unhandledRejection", log2);
+}
+function isTransientServerFailure(error) {
+  return isNetworkFailure(error) || error instanceof DaemonApiError && error.retryable;
+}
+function successorRollbackAllowed(error, deadlineAt, now2 = Date.now()) {
+  return !isTransientServerFailure(error) || deadlineAt !== void 0 && now2 >= deadlineAt;
+}
+async function retryBeforeReady(work, options) {
+  const now2 = options.now ?? Date.now;
+  const slice = options.waitSliceMs ?? 6e4;
+  let failures = 0;
+  for (; ; ) {
+    try {
+      return await work();
+    } catch (error) {
+      if (!isTransientServerFailure(error) || options.signal?.aborted)
+        throw error;
+      if (options.deadlineAt !== void 0 && now2() >= options.deadlineAt)
+        throw error;
+      failures += 1;
+      const timedRetry = ROOM_RETRY_DELAYS_MS[failures - 1];
+      console.warn(`[thin-core] server unreachable before READY; ${timedRetry === void 0 ? "waiting for the live socket to open" : `retrying in ${timedRetry}ms or on open`}:`, error);
+      let opened = false;
+      let wake = () => void 0;
+      const off = options.onLinkOpen(() => {
+        opened = true;
+        wake();
+      });
+      try {
+        const waitStarted = now2();
+        while (!opened && !options.signal?.aborted) {
+          const remaining = [
+            slice,
+            options.deadlineAt === void 0 ? Infinity : options.deadlineAt - now2(),
+            timedRetry === void 0 ? Infinity : timedRetry - (now2() - waitStarted)
+          ];
+          const wait2 = Math.min(...remaining);
+          if (wait2 <= 0)
+            break;
+          await options.extendStartTimeout(wait2 + 15e3);
+          await new Promise((resolve40) => {
+            const timer = setTimeout(done, wait2);
+            function done() {
+              clearTimeout(timer);
+              options.signal?.removeEventListener("abort", done);
+              resolve40();
+            }
+            wake = done;
+            options.signal?.addEventListener("abort", done, { once: true });
+            if (opened || options.signal?.aborted)
+              done();
+          });
+        }
+      } finally {
+        off();
+      }
+    }
+  }
 }
 
 // apps/body/dist/force-update-journal.js
@@ -43667,7 +44363,7 @@ async function runUpdateFunctionalProbe(input) {
 }
 
 // apps/body/dist/update-rollback-alert.js
-import { mkdir as mkdir23, readFile as readFile22, rename as rename8, unlink as unlink6, writeFile as writeFile17 } from "node:fs/promises";
+import { mkdir as mkdir23, readFile as readFile23, rename as rename9, unlink as unlink6, writeFile as writeFile17 } from "node:fs/promises";
 import { dirname as dirname20, resolve as resolve32 } from "node:path";
 var REPORT_INTERVAL_MS = 60 * 60 * 1e3;
 var lastLogged = /* @__PURE__ */ new Map();
@@ -43680,7 +44376,7 @@ async function writeAlert(runtimeDir, alert) {
   await mkdir23(dirname20(path), { recursive: true });
   await writeFile17(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
-  await rename8(staged, path);
+  await rename9(staged, path);
 }
 async function queueUpdateRollbackAlert(runtimeDir, releaseId, now2 = Date.now()) {
   const existing = await readUpdateRollbackAlert(runtimeDir);
@@ -43690,7 +44386,7 @@ async function queueUpdateRollbackAlert(runtimeDir, releaseId, now2 = Date.now()
 }
 async function readUpdateRollbackAlert(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile22(updateRollbackAlertPath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile23(updateRollbackAlertPath(runtimeDir), "utf8"));
     if (value.version !== 1 || typeof value.releaseId !== "string")
       return void 0;
     return value;
@@ -44024,6 +44720,11 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
           env: this.#env,
           log: (line) => console.log(line)
         });
+        await convergeAgentServiceUnit({
+          libDir: this.#layout.libDir,
+          env: this.#env,
+          log: (line) => console.log(line)
+        });
       } else if (process.platform === "darwin" && this.#env.BEELINE_LAUNCHD_USER !== "0") {
         await convergeLaunchdTrustySquireBrokerService({
           libDir: this.#layout.libDir,
@@ -44375,7 +45076,7 @@ init_runtime();
 init_launchd();
 init_systemd();
 init_runtime();
-import { mkdir as mkdir25, rename as rename9 } from "node:fs/promises";
+import { mkdir as mkdir25, rename as rename10 } from "node:fs/promises";
 import { dirname as dirname22, resolve as resolve34 } from "node:path";
 async function retireRemovedAgent(runtime, options = {}) {
   const deletedRoot = resolve34(runtime.supervisorRoot, "beeline", "deleted-runtimes");
@@ -44400,7 +45101,7 @@ async function relocateAgentRuntime(runtime, target, options = {}) {
     });
   }
   await mkdir25(dirname22(destination), { recursive: true, mode: 448 });
-  await rename9(source, destination);
+  await rename10(source, destination);
   return destination;
 }
 
@@ -44735,7 +45436,7 @@ async function runStartCommand(args, interactiveUi, dependencyOverrides = {}) {
 // apps/body/dist/connect-command.js
 import { spawn as spawn12 } from "node:child_process";
 import { createHash as createHash13, randomUUID as randomUUID11 } from "node:crypto";
-import { chmod as chmod10, mkdir as mkdir26, readFile as readFile23, unlink as unlink7, writeFile as writeFile19 } from "node:fs/promises";
+import { chmod as chmod10, mkdir as mkdir26, readFile as readFile24, unlink as unlink7, writeFile as writeFile19 } from "node:fs/promises";
 import { homedir as homedir17, hostname as hostname3 } from "node:os";
 import { dirname as dirname24, resolve as resolve35 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
@@ -45413,7 +46114,7 @@ async function readMachineId(env = process.env) {
   let machineId;
   let machineName = hostname3();
   try {
-    const existing = await readFile23(machineIdPath, "utf8");
+    const existing = await readFile24(machineIdPath, "utf8");
     machineId = existing.trim();
     if (!/^[0-9a-f-]{32,}$/.test(machineId))
       throw new Error("invalid persisted machine id");
@@ -45669,12 +46370,12 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile23(resolve35(path), "utf8"));
+    const grant = JSON.parse(await readFile24(resolve35(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
     const connected = await completeDevicePairing(grant);
     await unlink7(resolve35(path));
-    const providerEnv = grant.llmEnvFile ? await readFile23(grant.llmEnvFile, "utf8").catch(() => "") : "";
+    const providerEnv = grant.llmEnvFile ? await readFile24(grant.llmEnvFile, "utf8").catch(() => "") : "";
     const apiKey = (/^OPENROUTER_API_KEY=(\S+)/m.exec(providerEnv)?.[1] ?? "").replace(/^["']|["']$/g, "");
     const model = openRouterModelId(grant.model, { OPENROUTER_API_KEY: apiKey });
     if (model) {
@@ -45698,7 +46399,7 @@ async function runConnectFinishCommand(path) {
 init_self_update();
 
 // apps/body/dist/daemon-failure.js
-import { mkdir as mkdir27, readFile as readFile24, rename as rename10, rm as rm13, writeFile as writeFile20 } from "node:fs/promises";
+import { mkdir as mkdir27, readFile as readFile25, rename as rename11, rm as rm13, writeFile as writeFile20 } from "node:fs/promises";
 import { dirname as dirname25, resolve as resolve36 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
@@ -45707,7 +46408,7 @@ function daemonFailurePath(runtimeDir) {
 }
 async function readFailureRecord(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile24(daemonFailurePath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile25(daemonFailurePath(runtimeDir), "utf8"));
     if (value.version !== 1 || !Array.isArray(value.failures) || value.failures.some((failure) => typeof failure !== "number") || typeof value.lastError !== "string") {
       return void 0;
     }
@@ -45722,7 +46423,14 @@ async function writeFailureRecord(runtimeDir, record6) {
   await mkdir27(dirname25(path), { recursive: true, mode: 448 });
   await writeFile20(staged, `${JSON.stringify(record6, null, 2)}
 `, { mode: 384 });
-  await rename10(staged, path);
+  await rename11(staged, path);
+}
+function countsTowardDistress(error) {
+  if (isNetworkFailure(error))
+    return false;
+  if (error instanceof DaemonApiError && (error.retryable || error.status === 401))
+    return false;
+  return true;
 }
 async function recordDaemonStartFailure(runtimeDir, error, now2 = Date.now()) {
   const prior = await readFailureRecord(runtimeDir);
@@ -45737,6 +46445,11 @@ async function recordDaemonStartFailure(runtimeDir, error, now2 = Date.now()) {
   await writeFailureRecord(runtimeDir, record6);
   return { distressed, count: failures.length, path: daemonFailurePath(runtimeDir) };
 }
+async function settleDaemonStartFailure(runtimeDir, error, now2 = Date.now()) {
+  if (!countsTowardDistress(error))
+    return { distressed: false };
+  return recordDaemonStartFailure(runtimeDir, error, now2);
+}
 async function clearDaemonStartFailures(runtimeDir) {
   await rm13(daemonFailurePath(runtimeDir), { force: true });
 }
@@ -45746,7 +46459,7 @@ init_systemd();
 
 // apps/body/dist/current-release-probe.js
 import { spawn as spawn13 } from "node:child_process";
-import { dirname as dirname26, join as join17 } from "node:path";
+import { dirname as dirname26, join as join18 } from "node:path";
 init_runtime();
 init_self_update();
 var CURRENT_RELEASE_PROBE_TIMEOUT_MS = 12e4;
@@ -45790,7 +46503,7 @@ function outcomeFromReport(report) {
   }
 }
 async function probeReleaseInSubprocess(input) {
-  const bundleDir = join17(input.layout.releasesRoot, input.releaseId);
+  const bundleDir = join18(input.layout.releasesRoot, input.releaseId);
   const entrypoint = await resolveBundleEntrypoint(bundleDir);
   if (!entrypoint) {
     return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
@@ -45853,7 +46566,7 @@ async function runUpdateProbeCommand(args, options = {}) {
   const runtime = await readRuntimeRecord(configPath);
   const agent = runtimeAgentCommand(runtime);
   const config = loadBodyConfig({
-    workspaceRoot: join17(dirname26(configPath), "workspace"),
+    workspaceRoot: join18(dirname26(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env: { ...env, BUZZ_AGENT_BIN: agent.command, BUZZ_DEV_MCP_BIN: runtime.mcpBinary },
     agent
@@ -45879,14 +46592,14 @@ async function runUpdateProbeCommand(args, options = {}) {
     sandboxRequired: runtime.sandbox !== "off",
     sandboxUnavailableDetail: sandbox.advisory,
     // The successor's probe still holds `<runtimeDir>/update-functional-probe`.
-    probeRoot: join17(runtimeDir, "current-release-probe")
+    probeRoot: join18(runtimeDir, "current-release-probe")
   }));
   const report = outcome.kind === "served" ? { probe: "served" } : outcome.kind === "refused" ? { probe: "refused", status: outcome.status, reason: outcome.reason } : outcome.kind === "sandbox-unavailable" ? { probe: "sandbox-unavailable", reason: outcome.reason } : { probe: "failed", reason: outcome.reason };
   write2(JSON.stringify(report));
 }
 
 // apps/body/dist/release-status.js
-import { readFile as readFile25, readdir as readdir10, rename as rename11, writeFile as writeFile21 } from "node:fs/promises";
+import { readFile as readFile26, readdir as readdir10, rename as rename12, writeFile as writeFile21 } from "node:fs/promises";
 import { resolve as resolve37 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
@@ -45908,7 +46621,7 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
   const temporary = `${target}.${status.pid}.tmp`;
   await writeFile21(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
-  await rename11(temporary, target);
+  await rename12(temporary, target);
   return status;
 }
 
@@ -46028,15 +46741,16 @@ All other config via env vars (see config.ts).
   process.exit(exitCode);
 }
 var daemonFailureRuntimeDir;
+var daemonLifecycle;
 var SCRATCH_SWEEP_INTERVAL_MS = 6 * 60 * 6e4;
 function runScratchSweepLogged(runtimeDir) {
   void runScratchSweep(runtimeDir).catch((error) => console.error("[body] scratch sweep failed:", error));
 }
 var DaemonExitError = class extends Error {
-  exitStatus;
-  constructor(message, exitStatus) {
+  reason;
+  constructor(message, reason) {
     super(message);
-    this.exitStatus = exitStatus;
+    this.reason = reason;
     this.name = "DaemonExitError";
   }
 };
@@ -46117,7 +46831,9 @@ async function runStoredDaemon(pathOrPointer) {
     config.sandboxMaskPaths = [...config.sandboxMaskPaths ?? [], ...runtime.sandboxMaskPaths];
   }
   const controller = new AbortController();
-  const disposeStopSignals = installDaemonStopSignals(controller);
+  const lifecycle = new HelperLifecycle({ controller });
+  daemonLifecycle = lifecycle;
+  const disposeStopSignals = lifecycle.installSignals();
   const runtimeDir = dirname27(configPath);
   const layout = beelineInstallLayout(process.env);
   const notifier = new SystemdNotifier();
@@ -46139,15 +46855,17 @@ async function runStoredDaemon(pathOrPointer) {
   let update;
   let pendingSuccessor = false;
   let successorRolledBack = false;
+  let attemptDeadlineAt;
   if (layout) {
     const settle = await settleUpdateAttemptOnStart(layout);
     if (settle.kind === "rolled-back") {
       await queueUpdateRollbackAlert(runtimeDir, settle.record.releaseId);
       await drainRollbackAlert(runtime.rooms[0]?.channelId);
       console.error(`[body] self-update ROLLED BACK: bundle ${describeIdentity(settle.record.to)} never confirmed healthy; restored ${settle.record.previousReleaseId ?? "previous release"}`);
-      throw new DaemonExitError("stale unconfirmed release rolled back; supervisor must restart", 75);
+      throw new DaemonExitError("stale unconfirmed release rolled back; supervisor must restart", "rolled-back");
     } else if (settle.kind === "pending") {
       pendingSuccessor = true;
+      attemptDeadlineAt = (await readUpdateAttempt(layout))?.confirmBy;
     }
     loadedRelease = await activeReleaseId(layout);
     await clearUpdateRollbackAlertIfConfirmed(runtimeDir, loadedRelease);
@@ -46162,6 +46880,9 @@ async function runStoredDaemon(pathOrPointer) {
       requiredProbeIds: [...await runningRuntimeProbeIds(process.env), runtime.agent.publicKey]
     });
     if (pendingSuccessor && process.platform === "linux" && process.env.BEELINE_SYSTEMD_USER !== "0") {
+      await rewriteAgentServiceUnit({ lock: (work) => withInstallLock(layout, work) }).catch((error) => {
+        console.error(`[beeline] agent unit not converged: ${error instanceof Error ? error.message : String(error)}`);
+      });
       await installTrustySquireBrokerService().catch((error) => {
         console.error(`[beeline] host Squire broker unit not converged: ${error instanceof Error ? error.message : String(error)}`);
       });
@@ -46201,6 +46922,7 @@ async function runStoredDaemon(pathOrPointer) {
     return catalogRefresh;
   };
   let stoppingStatus = "daemon stopped";
+  let exitReason;
   try {
     registryMcpBroker = new RegistryMcpHostBroker(
       config.operatorHome,
@@ -46224,16 +46946,16 @@ async function runStoredDaemon(pathOrPointer) {
       daemonApi,
       onConfigChanged: refreshCatalog,
       onRestartRequested: () => {
-        if (lifecycleRestart)
+        if (lifecycleRestart || !lifecycle.quiesce("restart"))
           return;
         lifecycleRestart = (async () => {
           const cancelled = await core.cancelActiveWorkForRestart();
           stoppingStatus = cancelled ? "restart requested; active work cancelled" : "restart requested; no active work";
-          await notifier.stopping(stoppingStatus);
-          controller.abort();
+          await notifier.stopping(stoppingStatus).catch((error) => console.error("[thin-core] stopping notification failed:", error));
+          lifecycle.stop("restart-requested");
         })().catch((error) => {
           console.error("[thin-core] requested restart failed:", error);
-          controller.abort();
+          lifecycle.stop("restart-requested");
         });
       }
     });
@@ -46242,6 +46964,7 @@ async function runStoredDaemon(pathOrPointer) {
       loadedVersion: loadedReleaseIdentity?.version,
       runtimeDir,
       interrupt: () => {
+        lifecycle.quiesce("force-update");
         core.setDrainDeadlineAt(Date.now() + 6e4);
         return core.interruptForServerMinimum();
       },
@@ -46260,25 +46983,25 @@ async function runStoredDaemon(pathOrPointer) {
         if (staggerMs > 0)
           await new Promise((resolve40) => setTimeout(resolve40, staggerMs));
         stoppingStatus = `server minimum installed; restarting onto ${desiredRelease}`;
-        await notifier.stopping(stoppingStatus);
-        controller.abort();
+        await notifier.stopping(stoppingStatus).catch((error) => console.error("[thin-core] stopping notification failed:", error));
+        lifecycle.stop("update");
       },
       failed: (error) => {
         console.error("[thin-core] forced helper update failed:", error);
-        controller.abort();
+        lifecycle.stop("force-update-failed");
       }
     }) : void 0;
     daemonApi.setForceUpdateListener((minVersion) => {
       if (!forceUpdate) {
         console.error("[thin-core] server requires a published helper, but this process has no install layout");
-        controller.abort();
+        lifecycle.stop("stopped");
         return;
       }
       forceUpdate.request(minVersion);
     });
     const updateDrain = update ? new ManagedUpdateDrain({
       update,
-      quiesceIfIdle: () => !forceUpdate?.active && core.quiesceForUpdateIfIdle(),
+      quiesceIfIdle: () => !forceUpdate?.active && lifecycle.quiesceUpdateIfIdle(() => core.quiesceForUpdateIfIdle()),
       activeTurnCount: () => core.activeTurnCount(),
       restart: async ({ desiredRelease, drainDeadlineAt }) => {
         core.setDrainDeadlineAt(drainDeadlineAt);
@@ -46286,20 +47009,29 @@ async function runStoredDaemon(pathOrPointer) {
         if (staggerMs > 0)
           await new Promise((resolve40) => setTimeout(resolve40, staggerMs));
         stoppingStatus = `update pending, converging; loaded_release=${loadedRelease ?? "unknown"}; desired_release=${desiredRelease}; active work drained; intake quiesced`;
-        await notifier.stopping(stoppingStatus);
-        controller.abort();
+        await notifier.stopping(stoppingStatus).catch((error) => console.error("[thin-core] stopping notification failed:", error));
+        lifecycle.stop("update");
       },
       waiting: async ({ desiredRelease }) => {
         await notifier.progress(`loaded_release=${loadedRelease ?? "unknown"}; update ready; active agent work is still running; handoff deferred; desired_release=${desiredRelease}`);
       }
     }) : void 0;
+    const tickUpdate = async () => {
+      try {
+        await updateDrain?.tick();
+      } catch (error) {
+        console.error("[thin-core] managed restart failed; serving again:", error);
+        lifecycle.resumeAfterFailedUpdate(() => core.resumeServing());
+      }
+    };
     daemonApi.setHelperReleaseListener(({ version, sha }) => {
       update?.notifyReleaseAvailable(`${version}:${sha}`);
-      void updateDrain?.tick();
+      void tickUpdate();
     });
+    daemonApi.onLiveOpen(() => void tickUpdate());
     core.setInteractiveIdleListener(() => {
       institutionalMemoryWorker?.wake();
-      void updateDrain?.tick();
+      void tickUpdate();
     });
     const result = await core.run({
       signal: controller.signal,
@@ -46359,7 +47091,12 @@ async function runStoredDaemon(pathOrPointer) {
             console.log(`[thin-core] successor functional probe passed on exact release ${loadedRelease}: ${functionalProof?.harness ?? "unknown"} session/new + turn` + (functionalProof?.modelAnswer === "unavailable" ? ` (model answer unavailable: ${functionalProof.modelAnswerReason})` : ""));
         }
         try {
-          await reportInterruptedTurns(runtimeDir, daemonApi, runtime.agent.publicKey);
+          await retryBeforeReady(() => reportInterruptedTurns(runtimeDir, daemonApi, runtime.agent.publicKey), {
+            onLinkOpen: (listener) => daemonApi.onLiveOpen(listener),
+            extendStartTimeout: extendSystemdStartTimeout,
+            ...attemptDeadlineAt !== void 0 ? { deadlineAt: attemptDeadlineAt } : {},
+            signal: controller.signal
+          });
         } catch (error) {
           if (error instanceof DaemonApiError && error.status === 426 && error.code === "update_required" && forceUpdate?.pending) {
             await forceUpdate.pending;
@@ -46407,18 +47144,18 @@ async function runStoredDaemon(pathOrPointer) {
       onProgress: async (status) => {
         lastCoreStatus = status;
         void drainRollbackAlert(core.activeRoomIds()[0] ?? runtime.rooms[0]?.channelId);
-        await notifier.progress(`loaded_release=${loadedRelease ?? "development"}; ${status}`);
-        await updateDrain?.tick();
+        await notifier.progress(`loaded_release=${loadedRelease ?? "development"}; ${status}`).catch((error) => console.error("[thin-core] progress notification failed:", error));
+        await tickUpdate();
       }
     });
     if (result === "agent-removed") {
       controller.abort();
       const archivedRuntime = await retireRemovedAgent(runtime);
-      process.exitCode = DELIBERATE_REMOVAL_EXIT_STATUS;
+      exitReason = "agent-removed";
       console.log(`[beeline] agent ${runtime.agent.publicKey} removed; runtime archived at ${archivedRuntime}`);
     }
   } catch (error) {
-    const rolledBack = successorRolledBack || layout && pendingSuccessor && !ready && // Named, so a sibling daemon's journal can say whose failure reverted
+    const rolledBack = successorRolledBack || layout && pendingSuccessor && !ready && successorRollbackAllowed(error, attemptDeadlineAt) && // Named, so a sibling daemon's journal can say whose failure reverted
     // the attempt it shares with this one.
     await rollbackFailedSuccessor(layout, runtimeDir, {
       probeId: runtime.agent.publicKey,
@@ -46441,6 +47178,7 @@ async function runStoredDaemon(pathOrPointer) {
     await clearDaemonPidRecordIfPid(configPath, process.pid);
     disposeStopSignals();
   }
+  return exitReason ?? lifecycle.stopReason ?? "stopped";
 }
 async function main() {
   const args = process.argv.slice(2);
@@ -46529,6 +47267,7 @@ async function main() {
     return;
   }
   if (command === "daemon") {
+    installUnhandledRejectionGuard();
     const configFlag = args.indexOf("--config");
     const agentFlag = args.indexOf("--agent");
     let configPath = configFlag >= 0 ? args[configFlag + 1] : void 0;
@@ -46547,11 +47286,12 @@ async function main() {
       configPath = configs.find((candidate) => dirname27(candidate).endsWith(agentPubkey));
     }
     if (!configPath && agentPubkey) {
-      throw new DaemonExitError(`unknown agent ${agentPubkey}: no durable runtime exists; refusing service restart loop`, UNKNOWN_AGENT_EXIT_STATUS);
+      throw new DaemonExitError(`unknown agent ${agentPubkey}: no durable runtime exists; refusing service restart loop`, "unknown-agent");
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve39(configPath));
+    const reason = await runStoredDaemon(resolve39(configPath));
+    daemonLifecycle?.exit(reason);
     return;
   }
   if (command === "update") {
@@ -46591,7 +47331,8 @@ async function main() {
 main().catch(async (err) => {
   if (process.argv[2] === "daemon") {
     const layout = beelineInstallLayout(process.env);
-    if (layout && await rollbackFailedSuccessor(layout).catch(() => false)) {
+    const attempt = layout ? await readUpdateAttempt(layout).catch(() => void 0) : void 0;
+    if (layout && successorRollbackAllowed(err, attempt?.confirmBy) && await rollbackFailedSuccessor(layout).catch(() => false)) {
       console.error("[thin-core] successor failed during startup; previous release restored once");
     }
   }
@@ -46603,19 +47344,24 @@ main().catch(async (err) => {
   } else {
     console.error(import_picocolors3.default.red("[body] fatal:"), err);
   }
-  let exitStatus = err instanceof DaemonExitError ? err.exitStatus : 1;
-  if (process.argv[2] === "daemon" && daemonFailureRuntimeDir && exitStatus === 1) {
+  if (process.argv[2] !== "daemon")
+    process.exit(1);
+  let reason = err instanceof DaemonExitError ? err.reason : "failed";
+  if (daemonFailureRuntimeDir && reason === "failed") {
     try {
-      const failure = await recordDaemonStartFailure(daemonFailureRuntimeDir, err);
+      const failure = await settleDaemonStartFailure(daemonFailureRuntimeDir, err);
       if (failure.distressed) {
-        exitStatus = DAEMON_DISTRESS_EXIT_STATUS;
+        reason = "distress";
         console.error(`[thin-core] daemon start failed ${failure.count} times; service restart stopped. operator record: ${failure.path}`);
       }
     } catch (recordError) {
       console.error("[thin-core] could not persist daemon distress record:", recordError);
     }
   }
-  process.exit(exitStatus);
+  if (daemonLifecycle)
+    daemonLifecycle.exit(reason);
+  else
+    process.exit(HELPER_EXIT_CODES[reason]);
 });
 /*! Bundled license information: